Session 211 — SPEC-003 Intent Broker: wired end-to-end + governed front door

Date: 2026-07-11 · Branch: master · Tests: 210/210 green (governance + validator + broker + boot, consolidated)

What shipped (all on origin/master)

Commit	Deliverable
`061ee563`	Extensible NL intent parser/evaluator (vocabulary → categories → workflows; dr-hannah three-tier cascade)
`71d13d90`	`IntentBroker.process_text()` wired to the evaluator + `build_intent_broker` injects a real `IntentEvaluator`
`0ec2c1c8`	Kernel-boot construction: `_boot_intent_broker` builds the broker as a discoverable `intent-broker` component
`6f15b0fa`	Gateway NL ingress reconciled through the shared `IntentEvaluator` (replaces the coarse heuristic) + disambiguation gate
`492dfcd7`	Removed the one hand-rolled test double (real-objects-only doctrine)
`14d6a2f8`	Governed front door: broker validates every intent (Prolog) before the `PipelineRunner` runs it

The arc

SPEC-003's IntentBroker was code-complete and tested but unreachable in a running system — build_intent_broker was called only from tests. Closed three gaps:

No caller → the kernel packet handler (agents/kernel_handler._govern) now classifies + validates each new work intent through the broker before executing it.
No production governance policy (the deep one) → permission_granted/2 was undefined in every .pl file (only tests assertz'd it). The validator is fail-closed, so a real gate would have denied everything. Added prolog/intent_policy.pl — un-module-wrapped, default-allow ("allowed unless permission_denied"), both predicates dynamic, extensible deny surface.
Rules not loaded → _boot_intent_pipeline now defaults to the canonical prolog dir (the relative "prolog" default rarely exists at the CWD).

Architecture (Option A): broker = governed front door (parse → classify → validate); PipelineRunner = executor (all 9 volks). The broker's own single-volk Postman dispatch stays vestigial. Full-pipeline execution is preserved; the coarse gateway heuristic remains as a degraded fallback.

⚠️ Governance parallelism — NOT solved

The governance gate is correct but runs on the serial Prolog path:

Interpreter is free-threaded (sys._is_gil_enabled() → False), but the installed janus_swi is stock → importing it re-enables the GIL process-wide (verified GIL False → True on import).
All Prolog ops still serialize through the single PrologWorker thread.
The fix — free-threaded janus (Py_MOD_GIL_NOT_USED + PyMutex, ~105 lines, 3.6× on 8 threads) — is a proven PoC in worktree orchestrata-ft-prolog-poc @642ee21a, not deployed to .venv. See Free-Threaded Prolog PoC.

Validating every intent now adds load to this serial bottleneck.

Open decision

intent_policy.pl security posture — default-allow (shipped, non-regressing) vs deny-by-default (allow-list), and which ops to forbid (delete/execute on system, etc.). Mechanism supports either; left to the operator.