# I0-A Core Progress

- Lane: Development Agent 2 — Lane A, Core Domain / Persistence / Application
- Branch: `impl/i0-a-core`
- Worktree: `/home/user/Projects/.worktrees/awp-i0-a-core`
- Required branch base: `origin/main` at `75d80546d78380e7ee317a9df46964d951832ac1`
- Recorded C0 implementation baseline: `114b57a4ad37f9178b9c6309497c39663d4580e9`
- State: C1 complete and landed; C1.x provider-neutral shared-contract reconciliation implemented and fully validated; publication/landing in progress

## C1 scope delivered

### Domain and contracts

- Finalized I0/I1 fields and lifecycle state for Project, ProjectVisionVersion, Goal, Plan, PlanRevision, Task, FactoryRun, AgentRun, Attempt, Workspace, ChangeSet and Review.
- Added hard Task dependency DAG validation with rejection of unknown/cross-Project prerequisites and readable cycle paths.
- Added dependency-safe Queue projection, exact unsatisfied prerequisite reporting, dispatch eligibility, legal placement ranges and authoritative reorder rejection using stable `QUEUE_ORDER_CONSTRAINT` errors.
- Added explicit lifecycle transition functions for Project, Task, FactoryRun, AgentRun, ChangeSet and Review, including terminal-state protection and I1 recovery/correction paths.
- Strengthened Principal/capability narrowing: an AuthorityContext cannot request capabilities outside the Principal ceiling.
- Strengthened Connection/CredentialReference semantics with project binding validation that rejects capability/resource broadening.

### Application contracts

- Expanded transaction-scoped repositories across the I1 lifecycle: Project, ProjectVisionVersion, Goal, Plan, PlanRevision, Task, FactoryRun, AgentRun, Workspace, Attempt, ChangeSet and Review, plus business event/audit/outbox repositories.
- Added deterministic I1 Project/Goal/Plan/Task/FactoryRun fixtures for UI/provider consumers.
- Added deterministic I1 Project Overview read-model construction against canonical domain state and Queue legality.
- Added a Queue reorder command contract that validates domain legality before transactionally appending the business event, audit record and outbox message.

### Persistence

- Expanded Drizzle mappings for I1 domain state: names/titles/status, Goal criteria, Task dependency/Goal links, run/attempt provenance, ChangeSet revision/status and Review status/disposition/reviewer.
- Implemented transaction-scoped PostgreSQL mappings for ProjectVisionVersion, PlanRevision, Workspace, AgentRun and Attempt in addition to Project/Goal/Plan/Task/FactoryRun/ChangeSet/Review.
- Regenerated the pre-release initial Drizzle snapshot so the repository's existing migration integration gate applies the complete C1 baseline.
- Preserved the atomic state + business-event + audit + outbox transaction pattern from C0.

## Tests added

- `tests/domain/dependencies.test.ts`: legal DAG, readable cycle rejection, unknown dependency rejection.
- `tests/domain/queue.test.ts`: readiness, dispatch eligibility, legal placement range, illegal reorder rejection.
- `tests/domain/lifecycle.test.ts`: forward/recovery transitions and terminal-state protection.
- `tests/application/security.test.ts`: Principal and Connection binding ceiling enforcement.
- `tests/application/read-models.test.ts`: deterministic UI contract fixture/read model.
- `tests/application/commands.test.ts`: legal Queue mutation emits event/audit/outbox; illegal reorder emits none.
- `tests/persistence/schema.test.ts`: required I1 lifecycle/dependency persistence columns.
- Existing PostgreSQL atomic commit/rollback integration tests continue to pass against the regenerated C1 migration baseline.

## Boundaries preserved

- No provider SDK implementation.
- No Kubernetes, DBOS or ARC implementation.
- No UI implementation.
- No provider-native type is made authoritative in the domain.
- Trusted publication remains separate from AgentRun/AgentProvider authority.

## Validation environment

Repository engine contract is Node 22.x / pnpm 9.7.0. The local VM has Node 24, so gates are run on authorized buildbox `debian1` using a user-local Node `v22.18.0` and pnpm `9.7.0`; the repository engine constraint is not weakened.

Final C1 gate evidence on `debian1`:

- `node --version` -> `v22.18.0`.
- `pnpm --version` -> `9.7.0`.
- `pnpm check` -> PASS.
- `pnpm typecheck` -> PASS.
- `pnpm lint` -> PASS.
- `pnpm test` -> PASS, 11 files / 25 tests.
- `pnpm build` -> PASS.
- `pnpm test:architecture` -> PASS; 6 architecture tests and dependency-cruiser reports 0 violations across 37 modules / 46 dependencies.
- `pnpm format:check` -> PASS.
- Existing PostgreSQL PGlite commit/rollback integration tests -> PASS.

## C1 stable contract signal

The exact commit establishing the stable deterministic I1 read-model/fixture contract is `fa6c7d95fbef9194fb9b3b90767b347f87dc11b6`. Lane D must branch/consume from that exact C1 commit, not from the later docs-only handoff commit or an intermediate working-tree state.

## Stop condition

Stop at C1. Do not implement provider SDKs, durable execution infrastructure, Kubernetes/ARC/DBOS mechanics or UI in this lane.

## C1.x provider-neutral contract reconciliation

C1.x is a narrow convergence patch only. It consumes the Lane B provider handoff plus the FIRE learning corpus and does not start I2 or implement provider/Kubernetes/DBOS/ARC/UI behavior. The implementation is based on `origin/main@89d53009f1309095c9579f38c91d4e92fc5fbac3`; Lane C reported final convergence complete, but that convergence had not yet advanced `origin/main` when this handoff commit was frozen.

### Shared contracts added/ratified

- **RT-008 / RT-009 / INV-FIRE-005 — durable mutable credential authority:** added canonical AWP-owned Connection/CredentialReference authority state with owner, monotonic generation/fencing token, `active`/`handoff`/`fenced` state, pending handoff owner and revision. Transaction-scoped persistence operations atomically claim, prepare handoff, fence and transfer ownership. Stale generation/owner/state mutations fail closed with typed authority conflicts. Mutable SecretStore rotation now requires a canonical `CredentialMutationAuthority`; no provider-specific token authority was introduced.
- **RT-040 / INV-FIRE-012 — immutable structured candidate safety manifest:** ChangeSet now carries a canonical candidate manifest with exact tree digest, patch digest, complete changed-path set and structured add/modify/delete metadata. Manifest construction rejects incomplete/duplicate path metadata and freezes the canonical structure. Trusted publication consumes the manifest directly rather than human/log summaries. Persistence prevents later ChangeSet candidate identity rewrites.
- **RT-007 — trusted Merge mutation/reconciliation:** added provider-neutral `TrustedMergeRequest`, `TrustedMerger`, result and reconciliation contracts carrying exact ChangeSet identity, publication `ProviderReference`, candidate digest/manifest, expected base/target identities and the existing operation/idempotency context. Application execution validates candidate/target/base before mutation and reconciles an ambiguous retryable provider response before any mutation retry; a reconciled success exposes the exact resulting merge/native revision. AgentRun/AgentProvider still has no merge operation or reusable merge credential.
- **RT-036 / INV-FIRE-020 — immutable Attempt retry/fallback provenance:** Attempt now records immutable `initial`/`retry`/`fallback` selection provenance with required reason and previous Attempt linkage for retry/fallback. Persistence permits lifecycle revision/status updates but rejects provider/account/model/selection provenance rewrites on an existing Attempt.
- **Attempt cancellation/reconciliation identity:** Attempt may bind exactly one canonical provider-neutral `ProviderReference` for the native agent session. The reference can be resolved without provider-native domain types and cannot be silently rebound.
- **Provider failure transport semantics:** shared provider ports now use `ProviderCall<T>`: `ProviderResult<T>` is success-only and failures reject with canonical `ProviderFailure` carrying `ProviderError`. This removes the prior result-vs-error ambiguity without adding provider-specific error classes to shared contracts.

### Persistence / migration

- Added additive Drizzle migration `packages/persistence/drizzle/0001_absent_arachne.sql`; the landed C1 `0000` baseline was not rewritten.
- Added `credential_authorities` durable state.
- Added Attempt immutable `selection_provenance` and optional canonical `provider_reference`.
- Added ChangeSet immutable `candidate_manifest`.
- Integration tests now apply all ordered Drizzle SQL migrations instead of assuming only `0000`.

### C1.x required regression coverage

- stale credential-authority generation cannot mutate — **PASS**, PGlite integration coverage in `tests/integration/persistence.test.ts`;
- authority handoff fences old writer — **PASS**, same integration suite, including prepare → fence → transfer and old-generation rejection;
- candidate manifest immutable/complete for machine publication policy — **PASS**, `tests/domain/candidate.test.ts`;
- ambiguous trusted Merge reconciles exact successful result before retry — **PASS**, `tests/application/trusted-merge.test.ts` (`RT-007`);
- mismatched target/candidate prevents Merge — **PASS**, `tests/application/trusted-merge.test.ts`;
- retry/fallback reason immutable per Attempt — **PASS**, `tests/domain/attempt-provenance.test.ts` plus persistence integration protection;
- Attempt provider reference supports cancel/reconcile without native types — **PASS**, `tests/domain/attempt-provenance.test.ts` plus one-time persistence binding;
- provider failure transport has one typed behavior — **PASS**, `tests/application/provider-contracts.test.ts`.

### Final C1.x validation

Executed on authorized buildbox `debian1` using Node `v22.18.0` and pnpm `9.7.0`, after a clean frozen install had already passed on the same build copy. Final aggregate `pnpm check` is **PASS**:

- typecheck: PASS;
- lint: PASS;
- test: PASS — **15 files / 33 tests**;
- build: PASS;
- architecture tests: PASS — 6 tests;
- dependency-cruiser: **0 violations across 41 modules / 53 dependencies**;
- Prettier check: PASS;
- `git diff --check`: PASS.

### C1.x exact handoff commit

The exact implementation commit that establishes the reconciled provider-neutral C1.x contract is:

`b86a370b748609e3b7c148c7a1c94b5f85700549`

Lane B should reconcile its provider adapters against this contract after it lands. No provider implementation is copied or implemented in Lane A.

### C1.x stop condition

Stop after this contract reconciliation. Do not start I2, provider implementation, durable-execution implementation, or UI work in Lane A.