# AWP Incremental Delivery Plan **Date:** 2026-08-20 **Status:** **CANONICAL IMPLEMENTATION ORDER — SPEC/DESIGN GATE CLOSED; I0 AUTHORIZED TO START** **Specification authority:** [`AWP-FULL-SPECIFICATION-RATIFICATION.md`](AWP-FULL-SPECIFICATION-RATIFICATION.md) **Finalization:** [`AWP-SPECIFICATION-FINALIZATION-2026-08-20.md`](AWP-SPECIFICATION-FINALIZATION-2026-08-20.md) **Capability map:** [`AWP-INCREMENT-REALIZATION-MATRIX.md`](AWP-INCREMENT-REALIZATION-MATRIX.md) **Parallel execution:** [`AWP-I0-I1-PARALLEL-IMPLEMENTATION-PLAN.md`](AWP-I0-I1-PARALLEL-IMPLEMENTATION-PLAN.md) > **AMENDED 2026-08-21** — [`AWP-GOVERNANCE-AMENDMENT-2026-08-21.md`](AWP-GOVERNANCE-AMENDMENT-2026-08-21.md): A5 revokes "full-target page composition" / "full-target composition prototype exists" as gates (§ *Core Rule*, § *Per-Increment Design Complete Gate*), and narrows the § *Anti-Drift* "move approved U1–U6 composition casually" rule to within-I1 only. A3/A4 descope the I0 provider proofs to one integration test per seam and move ARC/gVisor/SecretStore post-dogfood; K3s pod execution containment stays non-negotiable. The § *Reuse / Source / Provider Gate* Overdeck clause is non-blocking per A2. The I0/I1 sections below are distilled into the binding [`I0-I1-AUTHORITY.md`](I0-I1-AUTHORITY.md). ## Core Rule AWP is delivered as end-to-end usable increments, not module-by-module. ```text FULL TARGET SPECIFICATION COMPLETE -> full-target page composition COMPLETE for I1 -> owner U1–U6 approval COMPLETE -> reuse/source/provider gates explicit and lane-owned -> implement I0 -> I1 -> ... -> I9 ``` An early implementation is a compatible subset of final identities/seams/layout, never a temporary replacement model. ## Foundational Product Model ```text ProjectVision enduring direction Goal current/future outcome Plan bounded work advancing Goal(s) Task executable work with dependencies Queue legal dispatch ordering projection ``` `GOLIVE` is not a primitive. A go-live target is a Goal with launch-oriented criteria/readiness. Hard Task dependencies form an acyclic graph. Manual Queue priority cannot violate dependency or policy constraints. ## I0 — Foundation / Self-Hosting Substrate **Goal:** make it possible for AWP to begin building AWP without recreating workstation insecurity. Activate only foundations required by I1: - modular-monolith/runtime skeleton; - final IDs/types for Project, ProjectVision, Goal, Plan, Task, FactoryRun, AgentRun/Attempt, Workspace, ChangeSet, Review; - PostgreSQL/Drizzle persistence + transaction pattern; - business events/audit; - Principal/capability skeleton; - typed configuration; - Connection/CredentialReference/SecretStore seam; - provider/adapter framework; - minimal Git provider + trusted publication boundary; - minimal account/model provider after Subrouter/Platform consumer proof; - K3s execution substrate; - isolated durable Workspace/WIP contract; - DBOS durable workflow ownership/retry semantics; - GitHub Actions + ARC substrate required by repository checks; - basic structured logs/OTel-compatible telemetry; - R1 executable architecture-conformance checks. I0 does not activate rich Planning, Advisor/Search behavior, full CI control plane, production CD, polished Cluster UX or generic Incident UX. ### I0 implementation waves ```text A0 bootstrap / root architecture convergence -> C0 then parallel: A core domain/application/persistence B provider/account/VCS/Fabro/ACP C DBOS/K8s/Workspace/ARC execution D I1 UI against stable contracts E Overdeck/source evidence (may start before C0) ``` Exact ownership/convergence rules are binding in `AWP-I0-I1-PARALLEL-IMPLEMENTATION-PLAN.md`. ## I1 — First Complete Vertical Slice **Goal:** prove one complete lifecycle. ```text Project + compact ProjectVision + Goal -> Plan -> Task + dependency/Queue legality -> FactoryRun -> AgentRun / Attempt on K3s -> durable WIP / ChangeSet -> focused VerificationEvidence + repository-required checks -> independent Review -> trusted Merge ``` Required characteristics: - durable authoritative state; - observable progress; - account/model Attempt provenance; - isolated execution; - WIP/checkpoint survival across failure; - retries/new Attempts; - cleanup only after durable collection/terminal handling; - failure/waiting visibility; - trusted publication/merge boundary; - polished UI sufficient to understand current/next/blocked/completed work; - no normal agent execution dependency on workstation state. ### I1 UI Design Gate — GREEN Owner-approved final lifecycle states: ```text U1 Project: Goals / Attention / Blockers / Queue-next / Plans / Factory / Recent Progress U2 active FactoryRun U3 waiting/failure/retry + preserved WIP U4 ChangeSet / Review U5 ready to merge U6 merged / completed ``` Binding artifacts are indexed from `docs/mockups/i1/README.md`. Generated image attempts are not implementation authority once the approved deterministic HTML/CSS/JS realization exists. ### I1 Security Gate Before privileged I1 dogfooding, executable mitigations must cover: ```text browser/gateway -> control trust provider/model credentials Git publication authority Kubernetes execution untrusted agent code Workspace isolation WIP/checkpoint storage Connection/resource scoping AgentRun -> trusted publisher Review -> merge authority webhook/provider event trust ``` Threat-model design is already complete; runtime evidence is produced in I0/I1 lanes. ## I2 — Real Planning / Goal Management Activate: ```text Project onboarding -> ProjectVision generation/reconciliation -> Goal create/edit/status/criteria/readiness -> PlanningProfile / PlanningSession / PlanningWorkflow -> Simple | Expert participation -> Quality + CI + delivery recommendations -> execution preview -> Start | Schedule | Park -> Factory ``` Launch readiness is Goal readiness, not a `GOLIVE` object. ## I3 — Decisions / Approvals / Autonomy + Project Manager + Search Activate generic Policy, Approval, Decision, Project Decision Log, authority provenance, supersession/impact propagation plus: ```text AdvisorPersona / AdvisorThread / AdvisorTurn Project Manager built-in persona ProjectScoped AdvisorShell advisor proposal -> canonical command path Advisor settings/persona versioning Cmd/Ctrl+K Search/Command palette visible Search affordance URL-restorable full Search ``` Search uses `cmdk` for interaction after compatibility verification and reuses `@platform-modules/search` before custom generic search infrastructure. ## I4 — Full Factory / Agent Observability + AWP Advisor Deepen FactoryRun/AgentRun with graph/status/chat/tool activity/diffs/files/checkpoints/retries/relationships/artifacts/cost and activate system-scoped AWP Advisor over authorized Projects/resources. ## I5 — CI Control Plane Activate ChangeClassifier, dependency/capability graph, CI invariants/planning, VerificationAuthority, EvidenceLedger/reuse/invalidation, provider ingestion, resolver and optimizer. ARC remains runner infrastructure beneath provider semantics. ## I6 — Release / Deployment Activate Artifact, Release, Environment, Deployment, promotion, health evaluation, rollback and deployment resolver. Productize supply-chain evidence where applicable: digest, SBOM, provenance, signature/attestation and vulnerability results. ## I7 — Cluster Product Surface K3s exists since I0. I7 activates machine lifecycle, labels/capabilities, scheduler/capacity/health, placement explainability, maintenance and deeper Queue/capacity UX. ## I8 — Self-Healing Operations Activate generic Incident/Resolver/ResolutionRecipe product behavior and verified resolver lifecycle. ## I9 — External / Enterprise Productization Activate organizations/users, tenant isolation, quotas, retention/audit export, backup/restore, upgrade/migration, stable public API/adapter SDK, installation/supportability, Advisor/Search governance and formal reliability/SLO/error-budget machinery. ## Engineering Practice Timing | Recommendation | Timing | |---|---| | R1 Architecture conformance | I0 onward | | R2 Threat modeling | design complete; executable mitigations before privileged I1 | | R3 SBOM + provenance | when meaningful artifacts first distribute; full I6 | | R4 API/contract compatibility | policy now; gates when stable consumers exist; CI I5 | | R5 Reliability/SLO/error budgets | target-specified now; I9 activation | ## Full-Spec Gate — GREEN Before I0 materially starts: ```text [✓] architecture/domain/workflow/UI target specs exist [✓] human HTML companions/index are consistent at canonical level [✓] Goal model canonical; no GOLIVE primitive drift [✓] Increment Realization explicit [✓] material Decisions/ADRs linked [✓] I0/I1 boundaries unambiguous [✓] I1 U1–U6 owner-approved ``` Full-specification completion is recorded in `AWP-SPECIFICATION-FINALIZATION-2026-08-20.md`. ## Reuse / Source / Provider Gate Before equivalent custom code for a subsystem: ```text exact Platform source/version/export disposition exact current Overdeck source/commit/capability disposition where applicable native/standard/FOSS/provider fit proof consumer/runtime proof for failure semantics where required smallest remaining AWP-specific adapter/semantic code ``` These gates are **lane-local**. They do not block unrelated pure domain/UI foundation work, but they do block calling the dependent subsystem complete. Current detailed authority: - [`AWP-I0-I1-REUSE-PREFLIGHT.md`](AWP-I0-I1-REUSE-PREFLIGHT.md) - [`STEP-0-PREPARATION-DEPENDENCIES.md`](STEP-0-PREPARATION-DEPENDENCIES.md) - [`AWP-I0-I1-IMPLEMENTATION-READINESS.md`](AWP-I0-I1-IMPLEMENTATION-READINESS.md) ## Per-Increment Design Complete Gate An increment enters user-facing implementation when: ```text target-state specs cover capability increment boundary confirmed future invariants preserved full-target composition prototype exists current states/interactions covered failure/waiting/permission/responsive behavior covered where material spec + prototype agree remaining unknowns are implementation-local ``` For I1 this gate is now **GREEN**. ## Anti-Drift Rules Do not: - implement future capabilities early merely because specified; - invent temporary domain identities; - let code silently override approved seams; - treat `GOLIVE` as a separate primitive; - let manual Queue priority bypass dependencies; - rebuild Platform/Overdeck/native/FOSS mechanics without disposition; - move approved U1–U6 composition casually; - confuse semantic completeness with live provider readiness. Do: - preserve full target intent; - implement only current increment behavior; - make early code forward-compatible; - use explicit Decisions/ADRs to change target direction; - dogfood each coherent increment; - deepen the same architecture rather than replace it; - keep durable lane progress records. ## Immediate Implementation Sequence ```text 1. launch Development Agent 1 using AWP-I0-DEVELOPMENT-AGENT-1-PROMPT.md 2. I0-A0 establishes root/runtime skeleton and lands C0 3. Lane E exact Overdeck/source harvest may run immediately in parallel 4. after C0, launch A/B/C/D independent path-owned lanes 5. close lane-owned Platform/Subrouter/FOSS/provider/runtime/security proofs 6. converge and pass I0 exit 7. implement/dogfood I1 end to end using U1–U6 as acceptance journey 8. record evidence-backed amendments only when needed ``` No gate is marked green without evidence.