Orchestrata Ultimate › Plans › spec-audit › 01-DECISIONS

Wave-0 decisions (D1–D5) — resolved

Source: plans/spec-audit/01-DECISIONS.md at 8a2cb42ad · last changed 2026-07-27 · first committed 2026-07-04 · 153 lines.

Prose pending.

Plan text

Wave-0 decisions (D1–D5) — resolved

Companion to 00-MASTER-PLAN.md. These are the five foundational calls the plan was blocked on. Decided in session 195 (D1/D2/D3/D5 by the operator; D4 by the assistant). Each entry records the call, the evidence, and the delta it makes to the swarm plan.

D1 — Canonical orchestration engine → Quarantine the duplicates

Call: PipelineRunner is the sole canonical engine. The 0-reference generic duplicates are moved to experimental/ (preserved, not deleted) — a future generic non-pipeline orchestration mode may want them.

Evidence (verified this session):

Plan delta: Wave-3 cleanup becomes "move to experimental/", not delete. SPEC-001/003/005/006 remaining work = quarantine + update the spec text to describe the thin-registry / PipelineRunner reality (→ S8 Scribe). No behaviour change; experimental/ is excluded from the standards/check-deps gates and documented as not-wired.

D2 — Goal system → Build the in-product runtime capability

Call: SPEC-023 is a runtime capability — volks set / track / evaluate goals during a build. Consolidate onto the in-product impl and wire evaluation + goal-state injection. The dev claude/tools/session CLI stays as separate session-tracking tooling (it is NOT the product feature).

Evidence: GoalMixin is already mixed into SessionController (session/controller/_core.py:160) — the foundation exists. pm/goal_registry.py::GoalRegistry is a 0-ref parallel orphan to fold in. Missing runtime pieces (per cluster B): goal_evaluate() (verify_command/pattern never executed), session-start goal injection, re-planning.

Plan delta: SPEC-023 moves from retire-orphans (S) to a real L build → new swarm S9 · Helmsman. It also satisfies the SPEC-009 "session/goal-state injection: pending" gap (goal state becomes a context-injection source). Couples to session (006) and the pipeline. GoalRegistry is consolidated into the SessionController goal path, not quarantined.

D3 — Verification U:Vfy → Wire it into the pipeline

Call: Independent multi-tier verification is a product goal. Wire the built-but-orphaned subsystem into the orchestrator as a real capability.

Evidence: verification/orchestration/coordinator.py::VerificationCoordinator (1 def, 0 use), plus verification/agents/ (Execution/Supervisor/Verification). Fully built, tested, wired to nothing. The live verification/review/ (a different, code-review capability) stays.

Plan delta: SPEC-007b moves from retire (S) to an L build → new swarm S10 · Sentinel. Wire VerificationCoordinator into the PipelineRunner at a checkpoint, over real CXP, with the Execution→Supervisor→Verification tiers. Couples to CXP (004), multi-agent (005), and pipeline checkpoints; coordinate with S5 Guild (shares the review/QA path). Also reconcile max_attempts=3 vs the spec's immutable 5.

D4 — Dead observability deps → Prune (assistant call)

Call: Remove structlog>=24.1.0 + opentelemetry-api/sdk/instrumentation/exporter-otlp-proto-http from pyproject.toml.

Evidence: All five are declared in pyproject.toml and imported nowhere in src/ (verified: zero import (opentelemetry|structlog) matches). They make check-deps falsely green and imply an OTel tracing layer + structlog logging that were never built (the code uses stdlib logging via core.logging).

Plan delta: Pruning is an S8 Scribe item. When SPEC-100 observability is actually scoped (swarm S3 Gatekeeper), the deps are re-added together with their wiring — never declared ahead of use.

D5 — Security scope (SPEC-099) → Internal / trusted; keep current

Call: Keep JWT token-auth + PAM++ deny-by-default. Re-spec SPEC-099 down to that reality — drop MFA/TOTP, OAuth, bcrypt password policy, AES encryption + key rotation, account lockout, and the audit hash-chain. No security build.

Rationale: The system runs on the operator's private Incus network as a single-operator dev tool, not an internet-facing/multi-tenant service. Those enterprise-SaaS auth features have no bearing on the actual deployment. Revisit trigger: if it ever becomes hosted or multi-user.

Plan delta: Removes the L greenfield from the plan. SPEC-099 becomes an S8 Scribe re-spec (S). S3 Gatekeeper loses its 099 auth-endpoints work, shrinking to gateway HTTP + governance surface + logging/metrics.

Net effect on the swarm plan

Two new build swarms (S9, S10) join the roster; one build (099) is removed. The keystones (K1–K4) and the other swarms (S1 Toolsmith, S2 Mnemosyne, S3 Gatekeeper, S4 Interface, S5 Guild, S6 Bridge, S7 Medic, S8 Scribe) are unchanged. Updated roster and execution order are reflected in 00-MASTER-PLAN.md §6–§7.

S9 · Helmsman — in-product runtime goal system (new)

• Entry: D2 + session (006). Effort: L. Members: SPEC-023 (+ the goal-injection half of 009).
• Work: consolidate GoalRegistry into the SessionController goal path; implement goal_evaluate() (run verify_command/verify_pattern); inject live goal state into volk context (closes the 009 gap); goal-gated / re-planning hooks in the pipeline.

S10 · Sentinel — multi-tier verification wired into the pipeline (new)

• Entry: D3 + CXP (004) + pipeline checkpoints. Effort: L. Members: SPEC-007b.
• Work: wire VerificationCoordinator + Execution/Supervisor/Verification agents into PipelineRunner over real CXP; reconcile max_attempts 3→5; coordinate with S5 Guild on the shared review/QA path.

K3 topology — resolved from code (session 195, no user decision needed)

The plan flagged K3 (persistent DI memory engine) as needing a lifecycle-ownership decision. Reading the code settles it:

• Memory is constructed per-request in exactly two sites: gateway/handlers/memory.py:46 (MemoryEngine()) and orchestrator/pipeline_runner.py:231.
• The gateway is the long-lived process (gateway/cli.py: WebSocketGateway(config).start() under asyncio.run) and it hosts both the memory handler and session-close (gateway/handlers/session.py). RPCHandler.__init__ builds MemoryHandler() and SessionHandler(pubsub) once — so the memory engine is already a de-facto gateway singleton (lazy-built, reused), with a set_* late-binding pattern for shared deps.
• The DIContainer (di/container.py) already supports SINGLETON scope, register_instance, and async resolve; IMemoryEngine is a real Protocol.

⇒ The persistent singleton belongs in the gateway process. K3 implementation (swarm S2 entry):

1. Bootstrap a DIContainer at WebSocketGateway.start(); register IMemoryEngine as a singleton (register_instance of an initialized MemoryEngine, or a SINGLETON factory). Closes SPEC-024 adoption + SPEC-010 FR-001.
2. Inject that one engine into MemoryHandler (replace its lazy MemoryEngine()), and hold a reference reachable from the session-close path.
3. On session close (SessionHandler), call engine.migrate_to_cold(session_id) — closes SPEC-010 FR-008 (the concrete functional gap: hot→cold migration currently never fires; migrate_to_cold has 0 callers). Optionally emit a session.closed EventBus event the engine subscribes to.
4. Test against real Redis + Neo4j: resolve-twice-same-instance; store→close→assert cold migration count > 0. (Real infra, no doubles.)

Related

• Plans
• Orchestrata Ultimate — project index
• Workflow
• Tasks