Orchestrata Ultimate › Plans › swarm-plan-prioritized-2026-07-06
Swarm implementation plan — prioritized by impact (2026-07-06)
Source: plans/swarm-plan-prioritized-2026-07-06.md at 8a2cb42ad · last changed 2026-07-27 · first committed 2026-07-06 · 168 lines.
Prose pending.
Plan text
Swarm implementation plan — prioritized by impact (2026-07-06)
Derived from audit-full-2026-07-06.md (57 specs, full chain SPECIFIED →
TRACED → IMPLEMENTED → WIRED → TESTED) and wiring-campaign-2026-07-06.md
(Waves A–I). Ordered by impact, not spec number. Impact = production-
correctness/safety risk × surface affected × how much it unblocks. Effort and
dependencies then set sequencing within a band.
Current baseline (already landed — do NOT re-do)
- SPEC-007 governance enforcement WIRED (this session,
a064fc6e): rules consulted, real deny/allow, no-mock tests, 86% cov. - Wave A (
b44426a1): ClaudeCodeDriver, OpenAIAdapter (A2), VolkRegistry (A3), PMVolk goals (A5) wired; 6 dead twins deleted (A8). - Prolog ports (
57b552c3): cxp.pl + 3 governance .pl consulted. - Gateway auth bypass (
f8bd14c8), tui.read containment (f87472c1), QA verdict fail-closed (f87472c1/a8819e7d).
Operating model (applies to every item)
- Opus orchestrates (design/rulings/routing/review); Sonnet agents build.
Agent types:
auditor,builder,wirer,refactorer,test-writer,reviewer. - Worktree isolation per agent; serial merge to main; one-to-two waves of agents at a time, bounded by shared-infra (Neo4j/Redis) load.
- Definition of Done (non-negotiable, per campaign traceability gate):
implemented + constructed in the production path +
@traces(spec,story, reqs)on both code and the wiring seam + a no-mock test proving the observable effect (construction → call path → effect) + all gates green + the REQ ids visibly move to implemented+tested in a regenerated RTM +check-tracesclean. A wave that only adds a decorator is NOT done. - When a builder catches a real bug, fix the CODE to spec — never weaken, skip, or fake a test. STOP and escalate on any genuine design fork.
- No mocks, no xdist, no pip, absolute imports, no AI attribution.
P0 — Stop the bleeding (safety/correctness lies) · do FIRST · small, parallel
Production is actively wrong, unsafe, or tests certify falsehoods. Highest impact-per-effort; each is a single agent, mostly independent → run the whole band concurrently.
| # | Item (spec) | Why it's P0 | Agent | Blocks |
|---|---|---|---|---|
| P0.1 | Postman delivery.py:357 _deliver_to_recipient fakes success (sleep→DELIVERED) (002) |
Silent data loss: messages report DELIVERED, never sent. admin.py:87 disconnect_agent twin always True. |
builder | Wave C |
| P0.2 | SPEC-007b stubs hardcode truth: 4 model wrappers status=verified, SupervisorAgent approved=True, ConstraintEvaluator ignores its Prolog bridge |
If wired as-is, verification rubber-stamps everything. Must be real BEFORE Wave B wires it. | builder + test-writer | Wave B |
| P0.3 | jwt_secret defaults "dev-secret", no prod guard (099) |
Any deploy that forgets to set it accepts forged tokens. Add fail-closed prod guard now. | builder | — |
| P0.4 | CheetahClaws multi-agent edit review is a facade — no volk handles review_edit → every edit auto-approves (050) |
Approval theater on a write path. | builder | — |
| P0.5 | Gateway chat bypasses real ConciergeVolk (3s gRPC window → canned "Received:"); no thread_id keying (concurrency) (032) |
Users silently get a fake assistant; shared-instance state races. | wirer + builder | — |
| P0.6 | SPEC-001 US-006 Workflow: 85 REQs "VERIFIED" tagged onto unrelated modules; zero DAG/YAML code | Active misrepresentation (worse than a gap). Correct the false traces now; DAG build is P3 or descope. | auditor→builder | RTM truth |
| P0.7 | Un-enshrine stub-certifying tests as their features land: CLI stubs asserting echoed strings (000), tui exit_code==1 (022), self-review-not-called (029 REQ-029-062..066), test_prolog_gate fail-open |
These lock in wrong behavior; each is fixed with the corresponding build so coverage never re-certifies a stub. | test-writer | coupled |
Exit: no production path returns a hardcoded/faked success; no test asserts a stub's wrong output; US-006 traces reflect reality.
P1 — Foundational unblockers · design rulings + core capability
Resolve the rulings that GATE parallel wiring, then complete the highest-value capability. Rulings are Opus (some need USER); capability is builder/wirer.
P1.A — Design rulings owed (resolve before the waves they gate)
| Ruling | Gates | Owner |
|---|---|---|
D12 canonical KG merge keys — :Session keyed 4 ways (session_id/connection_id/id/seq); :TestRun CREATE-not-MERGE dupes |
Wave D, Wave C7, all KG writers, 008 | Opus + USER |
012-vs-023 two-goal reconciliation — PM context.json["goals"] (raw I/O) vs SPEC-023 ["goal"] via ContextFileManager |
A5 deepening, SPEC-023 build | Opus + USER |
A4 governance surface for dynamic_policy + resource_access (3 live surfaces, no clean seam) |
those two wirings | Opus + USER |
| D3/A6 CXPRouter consolidation, A7 DomainEntity twin | kernel router, entity | Opus |
P1.B–F — Core capability (impact-ranked)
- P1.C SPEC-010 memory-engine (highest P1 impact) — agent-runtime +
kernel-CLI paths pass
memory_engine=None→ 0% functional memory in 2 of 3 deployments. Wire the real MemoryEngine into both; replace hash bag-of-words with sentence-transformers (REQ-010-036, declare dep). → wirer + builder. - P1.D SPEC-009 context injection —
payload["task_context"]is produced (pipeline_kg.py:372) and never consumed. Wire the consumer; the 568-line test proves only the producer. → wirer. - P1.E Wave B verification (007b) — after P0.2: (A) audit-only QA Gate 4 via
VerificationEngine, (B) author
prolog/verification.pl+ ConstraintEvaluator consults it, (C) max_attempts 5 + ESCALATED path, (D) realcall_llmin wrappers + rewrite their tests, (E) IntentConstraint adapter. Consolidate ~1,900 LOC that duplicates qa/codedirector FIRST. → builder. - P1.F Wave C postman (002) — after P0.1 + C12 governance delegate first
- C7 storage under D12: 12-phase absorption, seam =
Postman.route()constructs DeliveryManager via packet↔envelope adapter. → builder.
- C7 storage under D12: 12-phase absorption, seam =
- P1.B SPEC-014 gateway hardening — authz/scope checks in
rpc.dispatch, apply stored subscription filters (FR-009), real flow control (FR-011), populate/metrics(FR-022). → builder.
P2 — Wiring waves · built capability, connect it · highly parallelizable
Campaign Waves D–I. Each: twin-check first (many predate volks/ → consolidate, don't duplicate), then wire to the natural consumer, then prove with a no-mock test. Run ~2 waves concurrently, infra-bounded.
| Wave | Scope | Natural consumer | Note |
|---|---|---|---|
| D | KG analysis layer, 10 mod / 1,698 LOC | handlers/knowledge.py RPC, KG gRPC, kg_context |
needs D12 (P1.A) for test_results_store |
| E | orchestrator managers, 9 mod / 3,135 LOC + SPEC-003 intent_broker (0 prod imports) | orchestrator/engine.py intent path (parse→validate→broker→dispatch→workflow) |
US-004 routing → Prolog, not static map |
| F | kernel F1 (D17): AuditLogger, PAMEnforcer→dispatcher, ResourceMonitor→health, perf; fold kernel/pam/escalation into governance handler |
OrchestrationKernel.__init__/start |
F2 twin-checks (config/session/queue managers) |
| G | agents old runtime, 9 mod / 2,196 LOC | — | TWIN CHECK REQUIRED — likely consolidate/delete vs volks/ (005 pattern) |
| H | session managers + hooks, 8 mod / 2,113 LOC; SPEC-020: register error_gate in settings.json Stop hooks + restore missing session_auto_start source |
controller lifecycle + hook_registry | error_gate is 1,073 LOC built-never-registered |
| I | misc singles: isolation, error_handling, ws_client/ws_server (twin-check vs gateway), fireflies_sync | per-module | — |
| + | SPEC-104 openspec, SPEC-008 KG analysis, SPEC-015 alias guards invocation | prod callers | openspec real+tested, 0 callers |
P3 — Net-new GAPPED builds · largest effort · several USER-gated
Real missing features. Framework substrate exists (tools/base, tools/registry).
| Track | Scope | Gate |
|---|---|---|
| P3.cli (high user-facing) | SPEC-000: build the real orchestrata command tree (init/stop/status/team/agents/governance/verification/kg/session) wrapping the working pipeline_cli logic; retire the "not yet implemented" stubs |
build |
| P3.security | SPEC-099: bcrypt, MFA, AES-256, refresh tokens, lockout (~38 FRs) | build |
| P3.tools | SPEC-062 (14 tools) + 063–072 (REPL/worktree/LSP/PowerShell/remote-trigger/cron/task/team/mcp-resource/tool-search); declare paramiko/croniter/pyte | USER: build vs descope |
| P3.goal-bdi | SPEC-023 BDI differentiators: stop-hook goal guard, audio alarm, re-planning (after 012/023 ruling) | build |
| P3.tui | SPEC-022 Textual TUI | USER: build vs descope |
| P3.todoist | SPEC-052 server sync engine | USER: build vs descope |
| P3.openrouter | SPEC-053 FR-009 key mgmt, FR-006 budget-alert dispatch, REST surface | build |
Cross-cutting continuous tracks (run throughout, every merge)
- CC.RTM-truth (systemic #1) — re-tool
generate_traced_rtm_simple.pyso "VERIFIED" means constructed + tested, not decorator-exists. This is what makes every other wave's scoreboard honest. → builder + auditor. - CC.coverage — coverage swarm to ≥90% tiered — only on REAL code (never add coverage that certifies a stub). → test-writer.
- CC.review —
revieweradversarially verifies each wave's diff before merge (hunt for new false-confidence). Non-optional for P0/P1. - CC.spec-fixes (USER-domain — flag, don't edit unilaterally) — SPEC-STALE corrections: 016 gadget counts, 019 self-contradiction, 063 "Production Ready" lie, 051 deprecation, 060/061 supersession, 070 2024 dating.
Dependency graph (blockers)
P1.A/D12 ─────────► Wave D, Wave C7, KG writers
P1.A/012-023 ─────► A5-deepen, P3.goal-bdi
P1.A/A4 ──────────► dynamic_policy + resource_access wiring
P0.1 stub fix ────► Wave C
P0.2 stub fix ────► Wave B
Wave C: C12 gov-delegate ─► absorption; C7 ─► D12
Twin checks (G, F2, I/ws) ─► their wiring
CC.RTM-truth ─────► honest scoreboard for ALL waves
Sequencing (agent waves)
- Now (parallel): entire P0 band (6–7 agents) + P1.A rulings (Opus,
surface USER decisions) + CC.RTM-truth tooling + CC.coverage on real
code.
reviewerverifies each P0 merge. - After P0 stubs + rulings clear: P1.C, P1.D (independent) → then P1.E (Wave B), P1.F (Wave C), P1.B (gateway).
- As slots free (infra-bounded, ~2 concurrent): P2 Waves D→I, twin-check gating each.
- After USER build-vs-descope decisions: P3 tracks; P3.cli + P3.security can start immediately (not gated).
- Continuous: CC.coverage, CC.review, RTM regen + check-traces on every merge; serial merge to main throughout.
USER decisions that unblock the swarm (collect up front)
- Tool suite 062–072 + tui 022 + todoist 052: build or descope? (~11 specs)
- D12 canonical KG merge keys — pick the
:Session/:TestRunkey. - 012 vs 023 goal system — which persistence wins.
- A4 governance surface — which of the 3 surfaces owns dynamic_policy/ resource_access.
- 060/061 supersession — retire into 007, or author real traces.