The plan
Milestones as executable outcome specifications, issues as execution contracts, and the dependency graph that decides what may be executed next. Every figure is derived from .ai/repo/project.
- ready
- 23
- blocked
- 126
- active
- 1
- verify
- 0
- done
- 52
- cancelled
- 0
Derived when this page was built, from the canonical model. No status is stored: each one is computed from what an issue recorded about itself and from the state of its dependencies. How that works.
next ready issue
I0806 — Make the session rules doctrines, with retention and archiving
Declare the session rules in share/standard/majordomus/ with validators that doctor and watch dispatch — a malformed active or closed record, a session left open past its policy, a reference to a record that does not exist, and retention over the declared cap — and implement policy-driven archiving that never deletes and never overwrites.
majordomus plan next
Milestones
A milestone is an executable specification of an outcome, not a folder for tickets. Its state follows from its issues and from its own acceptance evidence — never from a count of closed tickets reaching a total.
-
M000DONE
Milestone and DAG driven development
Every non-trivial change in this repository belongs to a milestone specification and to one dependency-linked issue execution contract, validated as a DAG, with status derived rather than asserted, and projected to GitHub and to the website from that one canonical model.
15 of 15 done
-
M001DONE
A blocking question survives a handover
An unresolved question keeps refusing a completed finish after the work moves to a new task, or the alternative is chosen deliberately and the reason is recorded where the next worker will read it.
4 of 4 done
-
M002PLANNED
A durable record names the worker that wrote it
A durable record either names the worker that produced it or is refused, and a record written from one session can never arrive attributed to another session's task.
0 of 4 done · 1 ready · 3 blocked
-
M003ACTIVEactive
A session is a durable envelope, and knowledge is compiled from what is already canonical
A worker with no conversation history can answer what happened, why, what was decided, which evidence supports it, where the canonical source lives, and what to do next — from records and a derived index, with git still the authority over both.
8 of 16 done · 2 ready · 6 blocked
-
M004ACTIVE
Performance is executable evidence, and the hot path does no canonical work twice
Every public command can be benchmarked from the command registry with cold and warm distributions, the phases and work counters of any run can be printed, the caches and batch reads that remove repeated work preserve every observable result, an accepted baseline lives in the repository and a check refuses a regression by policy, and the pre-commit hook is fast enough that nobody routes around it.
11 of 27 done · 6 ready · 10 blocked
-
foundationDONE
A supervisory control layer that is real rather than described
A repository carries one policy, a small set of profiles, durable task state, and a set of commands that refuse work which does not meet a declared contract — with every rule dispatched from a registry that proves it reaches the command claiming to run it.
0 of 0 done
-
runtime-adaptersPLANNED
Profiles become runtime constraints rather than advice
A profile's axes become opt-in runtime clamps a provider actually applies — read size, output condensation, subagent budget — with the limit derived from the profile rather than configured twice.
0 of 6 done · 1 ready · 5 blocked
-
execution-telemetryBLOCKED
Execution telemetry, only from providers that expose it honestly
Execution telemetry is recorded for providers that report it truthfully, and absence is recorded as absence rather than estimated.
0 of 5 done · 5 blocked
-
cost-per-accepted-outcomeBLOCKED
Cost per accepted outcome, only on measured data
The cost of an accepted outcome is computed from measured telemetry and the finish contract that accepted it, and is reported only where both exist.
0 of 4 done · 4 blocked
-
routing-recommendationsBLOCKED
Routing recommendations derived from measured cost
The profile a task should run under is recommended from measured cost per accepted outcome, and the recommendation names the data it came from.
0 of 4 done · 4 blocked
-
shared-policyBLOCKED
Shared policy across repositories and workers
A policy can be shared across repositories and workers, with local override remaining explicit and drift from the shared source detectable in one command.
0 of 5 done · 5 blocked
-
fly-deploymentPLANNED
A deployment is a projection of the repository model, and a reachable URL is its evidence
One canonical deployment object under .ai/repo/deployments/ describes the deployment; a typed Rust model parses and validates it; the container image, the Fly configuration, the smoke suite, the doctor checks, the documentation, the cockpit view and the CI jobs are all projections of that object and of the capability registry, and every one of them is checked for drift. The service runs on Fly.io on a single shared-CPU Machine that stops when idle, its health and readiness are verified from outside, the smoke suite is derived from the route registry rather than written twice, and the deployed URL answers.
0 of 32 done · 1 ready · 31 blocked
-
web-sign-inPLANNED
The deployed surfaces know who is asking, and the identity providers are data
One canonical identity-provider kind under .ai/repo/identity/providers/ describes each provider as data: its issuer, its endpoints or its discovery document, the scopes requested, the claim that carries a stable subject and the environment variable names its credentials arrive in. A single OpenID-Connect-shaped flow in the executable serves every provider in that directory; Google and Facebook are two objects, not two code paths. Sessions are cookie-borne, signed, short and revocable; identity is attached to a request once, in the router, and every surface — HTTP, Cockpit, OpenAPI, MCP — reads it from the same place. The capability registry's effect classification, not a per-route list, decides what an anonymous reader may do, and the OpenAPI document and the Cockpit both state that decision because both project it from the registry. Striking a provider is deleting one file and regenerating.
0 of 8 done · 1 ready · 7 blocked
-
capability-graphACTIVE
One capability graph, two projections, and no second inventory of what this repository can do
One typed, deterministic capability graph composes the registries that already own their facts — it does not replace them — and adds typed relations between them that are inferred where a stable convention exists and declared where it does not. Both the running server and the published site render from that one graph: the static projection is the snapshot, the runtime projection is the snapshot plus live state. Navigation, overview, detail, search, the relation view and the coverage matrix are all derived, a dangling relation fails generation rather than rendering as a missing section, and a capability that exists with no documentation, no test or no enforcement is visible as such rather than indistinguishable from one that has them.
6 of 31 done · 8 ready · 16 blocked · 1 active
-
external-workspacesACTIVE
An external workspace is read the way this repository reads anything else, and its content never becomes public by accident
A workspace is a declared object of the layer — vendor, identity, what the operator authorised, which browser profile reaches it, which capabilities it is expected to have — and rides the existing kind pipeline onto every surface with no code that special-cases it. Its content is synced by the Node tooling layer that already drives the system browser, lands under `.ai/local/workspaces/`, carries provenance and a support level on every record, and is read back through exactly one capability shaped like `continuity`: served, never published. A sync is incremental from a durable checkpoint, idempotent on replay, fails closed when an observed contract breaks, and never writes a credential anywhere.
1 of 10 done · 1 ready · 8 blocked
-
two-folder-integrationPLANNED
A repository that adopts Majordomus gains two directories and two lines, and can give them back
Adoption is a reconciliation, not a template copy. One typed repository model is discovered once and every consumer reads it. A desired integration is computed from that model, diffed against what the repository actually holds, and applied as the smallest mutation that closes the gap — with everything Majordomus owns living under `.ai/` and `.majordomus/`, and anything outside those two namespaces reduced to a small managed bridge whose ownership is recorded. Running the reconciliation twice changes nothing the second time, and uninstalling gives back exactly what was taken and nothing a person authored.
0 of 23 done · 1 ready · 22 blocked
-
work-graph-githubACTIVE
The projection to GitHub is gated, identified and traversable, and a merged pull request leads back to the outcome it served
The projection cannot rot silently: a gate runs the drift check on every change that can move the model or the adapter, and drift is a CI failure with the record named. Identity travels with the record rather than being parsed out of its title, so renaming a GitHub title moves nothing and creates no duplicate, and the remote can be a fixture, so which record is which is provable with no network. The reconciliation vocabulary distinguishes the states it currently conflates, so `missing` no longer stands for both a record never created and a record a person deleted, and a remote edit is reported as a remote edit. Above the projection, a pull request names the issue it realises and the edge is derived from git and GitHub rather than remembered, so a merged commit leads back to the acceptance criteria it satisfied and an outcome leads forward to the evidence that it holds. The derivations the shell already computes — ready, blocked, waves, next, status — are readable through the same capability surface as every other thing this repository knows, rather than only from a terminal.
7 of 8 done · 1 ready
Execution waves
A wave is a layer of the dependency graph: an issue sits one layer past its deepest dependency. Sharing a wave is necessary for two issues to run at the same time and is not sufficient — overlapping declared scope serialises them, and that is reported below the graph on each milestone.
wave 0
- I0001DONEAudit what actually plans work in this repository
- I0101DONEReproduce the escaped blocker as an executable case
- I0201READYDeclare which profile axis may become which runtime limit
- I0301BLOCKEDDefine the execution record, including what an absence looks like
- I0401BLOCKEDDefine an accepted outcome, and join it to its measurements without storing the join
- I0501BLOCKEDGroup comparable work from what the records already carry
- I0601BLOCKEDLet a policy name a shared source it does not copy
- I0701READYReproduce the misattribution as an executable case
- I0801DONENarrow the Clean Extraction Boundary and record what was adopted
- I0802DONESpecify the session record before writing one
- I0817DONEPhase timing and work counters behind MJ_TIMING
- I0829DONEPerformance doctrine as project rules
- I0901READYThe deployment description is a kind of the layer, not a provider file
- I1001DONEOne typed graph composes the registries that already own their facts
- I1031READYA served surface says which checkout it is serving
- I1101READYWhat this tool leaves behind, established by inspection rather than by memory
- I1201READYAn identity provider is a declarative object, and Google and Facebook are two of them
- I1301DONEA workspace is a declared object of the layer; only its content is local
- I1401DONEThe identity of a projected record is what the record carries, not what its title says
- I1406DONEThe plan's derivations are capabilities, so every surface reads the readiness the terminal reads
wave 1
- I0002DONEDefine the canonical milestone and issue schema
- I0102DONEDecide whether a question transfers or the gate widens
- I0202BLOCKEDResolve a task's effective limits and print them as data
- I0302BLOCKEDRecord telemetry a provider reports, and refuse anything it did not
- I0402BLOCKEDReport cost only where measurement and acceptance both exist
- I0502BLOCKEDRecommend a profile from measured cost, naming the measurements
- I0602BLOCKEDMake a local override explicit and prove it survives an update of the shared source
- I0702BLOCKEDDecide how a record is attributed, between named alternatives
- I0803DONEOpen a session and report its status
- I0807DONEDiscover knowledge sources from git, not from the filesystem
- I0818DONEThe command registry is read in one pass
- I0819DONEThe project model is loaded with one flatten per file and no per-file lookups
- I0821READYFlattened YAML is cached under .ai/local/cache by content hash
- I0823DONEmajordomus bench: targets derived from the command registry
- I0833DONEknowledge nodes and edges read each source once
- I0837READYTiming report as JSON
- I0902BLOCKEDThe deployment object becomes typed Rust that refuses nonsense
- I0924BLOCKEDThe decision is recorded where architecture decisions are recorded
- I1002DONERelations are typed, inferred from stable identities, and never dangle
- I1003DONESkills, rules, decisions, documents, use cases and benchmarks enter the graph as themselves
- I1004DONEAvailability and visibility are metadata, not conditions in a template
- I1025DONEThe federated model and its two projections are an architecture decision
- I1102BLOCKEDThe two namespaces are a typed contract, not a habit
- I1105BLOCKEDThe repository is discovered once, into one model
- I1202BLOCKEDOne typed provider model reads the objects, and no code names a provider
- I1302READYIdentity, provenance and support level are typed fields, not prose
- I1402DONEA finding says which of six states it found, and the state that could hide a person's edit is no longer one of them
- I1405DONEA pull request names the issue it realises, and the edge is derived rather than remembered
wave 2
- I0003DONEImplement the model loader and the status derivation engine
- I0103DONEImplement the decision and prove it holds
- I0203BLOCKEDMake enforcement opt-in, and prove a repository that declines is unaffected
- I0303BLOCKEDProve a silent provider produces an explicit absence, never a guess
- I0403BLOCKEDMake a thin denominator say so rather than average it away
- I0503BLOCKEDReturn no recommendation where the data is too thin, and say why
- I0603BLOCKEDReport drift from the shared policy in one command
- I0703BLOCKEDImplement the decision and prove it holds
- I0804DONEClose a session into an envelope derived from the ledger
- I0808DONEExtract nodes with identities that survive a rebuild
- I0820READYCatalogue, DAG, context and command-surface validators read their inputs once
- I0824DONEBench persists local runs and keeps a latest projection
- I0827DONEThe benchmark policy block
- I0832READYgenerate-site-data instrumented and its hot spots removed
- I0836READYA synthetic repository generator for scaling cases
- I0841BLOCKEDCache equivalence proved by property-shaped cases
- I0903BLOCKEDDeployment reads are declared once and projected everywhere
- I0904BLOCKEDThe listen address is one fact with two projections
- I0905BLOCKEDLiveness and readiness are registered capabilities, not router hacks
- I0907BLOCKEDThe running process says what it is, from an allowlist
- I0908BLOCKEDA hosted process has no repository, and says so instead of failing
- I0918BLOCKEDThe bootstrap credential is used once and belongs to nothing
- I1005DONEThe graph is a generated artifact with a schema and no unsafe field
- I1011READYThe coverage matrix reports evidence, and never a green cell without one
- I1015ACTIVEA surface with no server behind it is not offered as if it had one
- I1103BLOCKEDWhether a file is authored or derived is a field, not a naming convention
- I1104BLOCKEDBoth namespaces carry their contracts, all the way down
- I1106BLOCKEDThe registries are views of the model, not separate discoveries
- I1203BLOCKEDOne flow serves every provider, and it refuses everything it did not start
- I1303BLOCKEDThe store is bounded, measured and invisible to every published projection
- I1304BLOCKEDThe browser transport is the one this repository already drives
- I1404DONEThe drift check is a gate, so a projection that stops being applied cannot stay silent
wave 3
- I0004DONEImplement DAG validation and execution waves
- I0104DONEMove the claim from planned to guaranteed
- I0204BLOCKEDApply one derived limit for real and prove it changes what happens
- I0304BLOCKEDRead the measurements back through the history surface, under a bound
- I0404BLOCKEDPublish the cost-per-outcome claim with its unit defined beside it
- I0504BLOCKEDProve the recommendation is advisory and publish it as such
- I0604BLOCKEDProve the offline guarantee survives sharing
- I0704BLOCKEDPublish what attribution guarantees, and what it still cannot
- I0805DONERead sessions back with a divergence label
- I0809DONERecord only edges that a file states, each with where it was observed
- I0822BLOCKEDEvery canonical file is flattened at most once per command
- I0825DONEAn explicit committed baseline
- I0828BLOCKEDdoctor under a declared budget, and the hook inherits it
- I0840BLOCKEDcontext and its subcommands under a second
- I0842BLOCKEDBefore and after evidence for every optimisation
- I0906BLOCKEDTermination is graceful and proved against the real container
- I0909BLOCKEDThe production image is a generated projection of the build specification
- I0913BLOCKEDThe provider configuration is generated, and the cheap profile is declared
- I0927BLOCKEDThe cockpit shows the deployment from the same data
- I1006READYThe runtime reads the graph through the registry, like every other read
- I1007READYThe site renders the same graph, generated once
- I1009READYEvery menu in this repository comes from one derivation
- I1010READYThe overview is what exists, counted rather than claimed
- I1012READYOne detail view, assembled from what a node actually has
- I1018BLOCKEDThe surface rules exist as checks, proved by making them fail
- I1023READYNothing private reaches a published page
- I1107BLOCKEDDiscovery is deterministic, cached, and its cost is known
- I1108BLOCKEDThe desired integration is a value, and the plan is a diff
- I1117BLOCKEDThe hand-maintained lists are removed, not left running beside the derivation
- I1204BLOCKEDThe session is signed, short, and revocable from the server
- I1305BLOCKEDAn observed contract has a fingerprint, a compatibility state and a fixture
- I1308BLOCKEDThe executable's share is one capability, shaped like continuity
- I1403READYBackfill the projection once, deliberately, and record what it created
- I1407DONEOne issue travels the whole path and back, as an executable case
- I1408DONEThe documents stop claiming a projection nobody runs
wave 4
- I0005DONEImplement the plan command surface
- I0006DONEGenerate the Mermaid DAG from the graph
- I0010DONEBehavioural tests for schema, status, graph and command
- I0205BLOCKEDDeclare the clamp as a doctrine so the mapping and the adapter cannot drift
- I0305BLOCKEDPublish the telemetry claim and record what remains unmeasured
- I0605BLOCKEDPublish the shared-policy claim and what sharing still cannot do
- I0806READYMake the session rules doctrines, with retention and archiving
- I0810READYA content-hash manifest that makes a second sync cheap
- I0826DONEbench --check refuses a regression by policy
- I0834BLOCKEDThe test runner reports per-case time and the suite budget
- I0839BLOCKEDwatch inherits every doctor fix and its own budget
- I0910BLOCKEDThe release profile is chosen by measurement, not by folklore
- I0911BLOCKEDA source change does not rebuild the world, and the context stays small
- I0912BLOCKEDThe image serves the site the canonical pipeline produced
- I0914BLOCKEDOne deployment core, one command, and a dry run that mutates nothing
- I0919BLOCKEDNothing secret and nothing local leaves in the image
- I0920BLOCKEDThe image's dependencies are known and its advisories are policy
- I0926BLOCKEDThe deployment documentation is generated and reachable
- I1008BLOCKEDThe two projections are proved to be the same model
- I1013BLOCKEDSearch over the graph, generated, with nothing to run
- I1014BLOCKEDThe relation view reads the graph and holds no data of its own
- I1016BLOCKEDThe Cockpit works on a phone and before JavaScript runs
- I1017BLOCKEDLive state is an overlay that degrades to nothing
- I1019BLOCKEDOne skill runs the whole loop, and is itself in the graph
- I1020BLOCKEDThe graph's health is answered by the doctor that already answers everything else
- I1022BLOCKEDDrift in any derived surface fails the build
- I1026BLOCKEDThe architecture explains itself, from inside itself
- I1028BLOCKEDThe inventories this replaces are removed, not left running beside it
- I1109BLOCKEDEverything placed outside the two namespaces is recorded, with what it was
- I1120BLOCKEDA refusal says what to do about it
- I1205BLOCKEDIdentity is resolved once, in the router, and every surface reads it from there
- I1207BLOCKEDNo credential reaches any output, and hostile provider metadata renders safely
- I1306BLOCKEDA sync resumes, repeats itself without harm, and says how fresh it is
- I1307BLOCKEDThe ChatGPT shape is mapped from evidence and never becomes the canonical model
- I1309BLOCKEDThe boundaries this milestone asserts are gates, not sentences
wave 5
- I0007DONEEnforce the canonical model as doctrine
- I0008DONEProject the model to GitHub milestones and issues
- I0009DONEProject the model into the website
- I0013DONEDocument the semantics and the dogfooding rule
- I0206BLOCKEDPublish the runtime-adapters claim with the test that proves it and the limits it does not cover
- I0811BLOCKEDRead-only knowledge lookup with an ordering that can be explained
- I0830DONEdocs/PERFORMANCE.md, README, CONTRIBUTING and CLI reference
- I0831BLOCKEDPerformance claims at their proven status
- I0835BLOCKEDCI runs the structural performance checks
- I0838READYbench compare and the top regressions report
- I0915BLOCKEDDeployment joins the diagnostics that already exist
- I0916BLOCKEDThe smoke suite is derived from the route registry, never written twice
- I0917BLOCKEDA bad deployment can be undone deterministically
- I0921BLOCKEDSize is measured first and budgeted second
- I0930BLOCKEDThe real image runs under the real limits before anything is deployed
- I1021BLOCKEDA browser proves the interface, at the widths people use
- I1024BLOCKEDThe interface has a weight, and it is measured
- I1027BLOCKEDA synthetic capability proves the architecture instead of describing it
- I1110BLOCKEDThe second run changes nothing, and a test says so
- I1111BLOCKEDUninstall gives back exactly what was taken
- I1112BLOCKEDWhat touches the root is two small blocks, and they never change again
- I1206BLOCKEDWhat an anonymous reader may do is derived from the effect classification, not from a list
- I1310BLOCKEDThe subsystem is documented where a person looks, and the plan is closed against the repository
wave 6
- I0011DONECross-surface consistency and mutation tests
- I0014DONEMake the worker instructions require the model
- I0812BLOCKEDValidate the graph, and let doctor and watch ask the same validator
- I0814BLOCKEDGive the worker a bounded slice of knowledge, not the knowledge base
- I0843BLOCKEDThe performance workflow is discoverable and complete
- I0922BLOCKEDThe memory hypothesis is tested, not asserted
- I0923BLOCKEDCold start and endpoint cost are benchmark targets like everything else
- I0925BLOCKEDEvery deployment rule is a check that runs
- I0928BLOCKEDA pull request cannot merge a deployment that would not work
- I1029BLOCKEDThe gate refuses what would silently break the interface
- I1113BLOCKEDEntering a directory is local, bounded and silent about the network
- I1114BLOCKEDA provider is an adapter over the model, and adding one is an implementation
- I1116BLOCKEDThis repository's own footprint moves, through the reconciler
- I1121BLOCKEDEvery surface shows the integration from the one model
- I1208BLOCKEDAdding a provider is one file, removing one is one deletion, and both are executed rather than described
wave 7
- I0012DONEMake CI refuse an invalid model or a stale projection
- I0813BLOCKEDA closed session becomes a node that points at its episode
- I0931BLOCKEDThe application exists, one machine runs it, and the URL answers
- I1030BLOCKEDThe milestone is accepted on its evidence
- I1115BLOCKEDCompletion comes from the command model, not from a second list
- I1118BLOCKEDEvery invariant of this milestone is a rule with a check that runs
- I1119BLOCKEDThe budgets are measured, and a regression fails rather than being noticed
- I1122BLOCKEDA foreign repository, adopted, upgraded and given back
wave 8
The graph
Generated from the same edges the command reads, by majordomus plan graph. No diagram on this site is drawn by hand.
flowchart LR
I0001["I0001<br/>Audit what actually plans work in this repository"]:::done
I0002["I0002<br/>Define the canonical milestone and issue schema"]:::done
I0003["I0003<br/>Implement the model loader and the status derivation engine"]:::done
I0004["I0004<br/>Implement DAG validation and execution waves"]:::done
I0005["I0005<br/>Implement the plan command surface"]:::done
I0006["I0006<br/>Generate the Mermaid DAG from the graph"]:::done
I0007["I0007<br/>Enforce the canonical model as doctrine"]:::done
I0008["I0008<br/>Project the model to GitHub milestones and issues"]:::done
I0009["I0009<br/>Project the model into the website"]:::done
I0010["I0010<br/>Behavioural tests for schema, status, graph and command"]:::done
I0011["I0011<br/>Cross-surface consistency and mutation tests"]:::done
I0012["I0012<br/>Make CI refuse an invalid model or a stale projection"]:::done
I0013["I0013<br/>Document the semantics and the dogfooding rule"]:::done
I0014["I0014<br/>Make the worker instructions require the model"]:::done
I0015["I0015<br/>Open the first real milestone and execute one issue through it"]:::done
I0101["I0101<br/>Reproduce the escaped blocker as an executable case"]:::done
I0102["I0102<br/>Decide whether a question transfers or the gate widens"]:::done
I0103["I0103<br/>Implement the decision and prove it holds"]:::done
I0104["I0104<br/>Move the claim from planned to guaranteed"]:::done
I0201["I0201<br/>Declare which profile axis may become which runtime limit"]:::ready
I0202["I0202<br/>Resolve a task's effective limits and print them as data"]:::blocked
I0203["I0203<br/>Make enforcement opt-in, and prove a repository that declines is unaffected"]:::blocked
I0204["I0204<br/>Apply one derived limit for real and prove it changes what happens"]:::blocked
I0205["I0205<br/>Declare the clamp as a doctrine so the mapping and the adapter cannot drift"]:::blocked
I0206["I0206<br/>Publish the runtime-adapters claim with the test that proves it and the limits it does not cover"]:::blocked
I0301["I0301<br/>Define the execution record, including what an absence looks like"]:::blocked
I0302["I0302<br/>Record telemetry a provider reports, and refuse anything it did not"]:::blocked
I0303["I0303<br/>Prove a silent provider produces an explicit absence, never a guess"]:::blocked
I0304["I0304<br/>Read the measurements back through the history surface, under a bound"]:::blocked
I0305["I0305<br/>Publish the telemetry claim and record what remains unmeasured"]:::blocked
I0401["I0401<br/>Define an accepted outcome, and join it to its measurements without storing the join"]:::blocked
I0402["I0402<br/>Report cost only where measurement and acceptance both exist"]:::blocked
I0403["I0403<br/>Make a thin denominator say so rather than average it away"]:::blocked
I0404["I0404<br/>Publish the cost-per-outcome claim with its unit defined beside it"]:::blocked
I0501["I0501<br/>Group comparable work from what the records already carry"]:::blocked
I0502["I0502<br/>Recommend a profile from measured cost, naming the measurements"]:::blocked
I0503["I0503<br/>Return no recommendation where the data is too thin, and say why"]:::blocked
I0504["I0504<br/>Prove the recommendation is advisory and publish it as such"]:::blocked
I0601["I0601<br/>Let a policy name a shared source it does not copy"]:::blocked
I0602["I0602<br/>Make a local override explicit and prove it survives an update of the shared source"]:::blocked
I0603["I0603<br/>Report drift from the shared policy in one command"]:::blocked
I0604["I0604<br/>Prove the offline guarantee survives sharing"]:::blocked
I0605["I0605<br/>Publish the shared-policy claim and what sharing still cannot do"]:::blocked
I0701["I0701<br/>Reproduce the misattribution as an executable case"]:::ready
I0702["I0702<br/>Decide how a record is attributed, between named alternatives"]:::blocked
I0703["I0703<br/>Implement the decision and prove it holds"]:::blocked
I0704["I0704<br/>Publish what attribution guarantees, and what it still cannot"]:::blocked
I0801["I0801<br/>Narrow the Clean Extraction Boundary and record what was adopted"]:::done
I0802["I0802<br/>Specify the session record before writing one"]:::done
I0803["I0803<br/>Open a session and report its status"]:::done
I0804["I0804<br/>Close a session into an envelope derived from the ledger"]:::done
I0805["I0805<br/>Read sessions back with a divergence label"]:::done
I0806["I0806<br/>Make the session rules doctrines, with retention and archiving"]:::ready
I0807["I0807<br/>Discover knowledge sources from git, not from the filesystem"]:::done
I0808["I0808<br/>Extract nodes with identities that survive a rebuild"]:::done
I0809["I0809<br/>Record only edges that a file states, each with where it was observed"]:::done
I0810["I0810<br/>A content-hash manifest that makes a second sync cheap"]:::ready
I0811["I0811<br/>Read-only knowledge lookup with an ordering that can be explained"]:::blocked
I0812["I0812<br/>Validate the graph, and let doctor and watch ask the same validator"]:::blocked
I0813["I0813<br/>A closed session becomes a node that points at its episode"]:::blocked
I0814["I0814<br/>Give the worker a bounded slice of knowledge, not the knowledge base"]:::blocked
I0815["I0815<br/>Say what is now true in the claims, the documentation and the worker instructions"]:::blocked
I0816["I0816<br/>Prove the loop on a real issue, without a transcript"]:::blocked
I0817["I0817<br/>Phase timing and work counters behind MJ_TIMING"]:::done
I0818["I0818<br/>The command registry is read in one pass"]:::done
I0819["I0819<br/>The project model is loaded with one flatten per file and no per-file lookups"]:::done
I0820["I0820<br/>Catalogue, DAG, context and command-surface validators read their inputs once"]:::ready
I0821["I0821<br/>Flattened YAML is cached under .ai/local/cache by content hash"]:::ready
I0822["I0822<br/>Every canonical file is flattened at most once per command"]:::blocked
I0823["I0823<br/>majordomus bench: targets derived from the command registry"]:::done
I0824["I0824<br/>Bench persists local runs and keeps a latest projection"]:::done
I0825["I0825<br/>An explicit committed baseline"]:::done
I0826["I0826<br/>bench --check refuses a regression by policy"]:::done
I0827["I0827<br/>The benchmark policy block"]:::done
I0828["I0828<br/>doctor under a declared budget, and the hook inherits it"]:::blocked
I0829["I0829<br/>Performance doctrine as project rules"]:::done
I0830["I0830<br/>docs/PERFORMANCE.md, README, CONTRIBUTING and CLI reference"]:::done
I0831["I0831<br/>Performance claims at their proven status"]:::blocked
I0832["I0832<br/>generate-site-data instrumented and its hot spots removed"]:::ready
I0833["I0833<br/>knowledge nodes and edges read each source once"]:::done
I0834["I0834<br/>The test runner reports per-case time and the suite budget"]:::blocked
I0835["I0835<br/>CI runs the structural performance checks"]:::blocked
I0836["I0836<br/>A synthetic repository generator for scaling cases"]:::ready
I0837["I0837<br/>Timing report as JSON"]:::ready
I0838["I0838<br/>bench compare and the top regressions report"]:::ready
I0839["I0839<br/>watch inherits every doctor fix and its own budget"]:::blocked
I0840["I0840<br/>context and its subcommands under a second"]:::blocked
I0841["I0841<br/>Cache equivalence proved by property-shaped cases"]:::blocked
I0842["I0842<br/>Before and after evidence for every optimisation"]:::blocked
I0843["I0843<br/>The performance workflow is discoverable and complete"]:::blocked
I0901["I0901<br/>The deployment description is a kind of the layer, not a provider file"]:::ready
I0902["I0902<br/>The deployment object becomes typed Rust that refuses nonsense"]:::blocked
I0903["I0903<br/>Deployment reads are declared once and projected everywhere"]:::blocked
I0904["I0904<br/>The listen address is one fact with two projections"]:::blocked
I0905["I0905<br/>Liveness and readiness are registered capabilities, not router hacks"]:::blocked
I0906["I0906<br/>Termination is graceful and proved against the real container"]:::blocked
I0907["I0907<br/>The running process says what it is, from an allowlist"]:::blocked
I0908["I0908<br/>A hosted process has no repository, and says so instead of failing"]:::blocked
I0909["I0909<br/>The production image is a generated projection of the build specification"]:::blocked
I0910["I0910<br/>The release profile is chosen by measurement, not by folklore"]:::blocked
I0911["I0911<br/>A source change does not rebuild the world, and the context stays small"]:::blocked
I0912["I0912<br/>The image serves the site the canonical pipeline produced"]:::blocked
I0913["I0913<br/>The provider configuration is generated, and the cheap profile is declared"]:::blocked
I0914["I0914<br/>One deployment core, one command, and a dry run that mutates nothing"]:::blocked
I0915["I0915<br/>Deployment joins the diagnostics that already exist"]:::blocked
I0916["I0916<br/>The smoke suite is derived from the route registry, never written twice"]:::blocked
I0917["I0917<br/>A bad deployment can be undone deterministically"]:::blocked
I0918["I0918<br/>The bootstrap credential is used once and belongs to nothing"]:::blocked
I0919["I0919<br/>Nothing secret and nothing local leaves in the image"]:::blocked
I0920["I0920<br/>The image's dependencies are known and its advisories are policy"]:::blocked
I0921["I0921<br/>Size is measured first and budgeted second"]:::blocked
I0922["I0922<br/>The memory hypothesis is tested, not asserted"]:::blocked
I0923["I0923<br/>Cold start and endpoint cost are benchmark targets like everything else"]:::blocked
I0924["I0924<br/>The decision is recorded where architecture decisions are recorded"]:::blocked
I0925["I0925<br/>Every deployment rule is a check that runs"]:::blocked
I0926["I0926<br/>The deployment documentation is generated and reachable"]:::blocked
I0927["I0927<br/>The cockpit shows the deployment from the same data"]:::blocked
I0928["I0928<br/>A pull request cannot merge a deployment that would not work"]:::blocked
I0929["I0929<br/>Production deploys from CI with a token scoped to one application"]:::blocked
I0930["I0930<br/>The real image runs under the real limits before anything is deployed"]:::blocked
I0931["I0931<br/>The application exists, one machine runs it, and the URL answers"]:::blocked
I0932["I0932<br/>The milestone is accepted on its evidence"]:::blocked
I1001["I1001<br/>One typed graph composes the registries that already own their facts"]:::done
I1002["I1002<br/>Relations are typed, inferred from stable identities, and never dangle"]:::done
I1003["I1003<br/>Skills, rules, decisions, documents, use cases and benchmarks enter the graph as themselves"]:::done
I1004["I1004<br/>Availability and visibility are metadata, not conditions in a template"]:::done
I1005["I1005<br/>The graph is a generated artifact with a schema and no unsafe field"]:::done
I1006["I1006<br/>The runtime reads the graph through the registry, like every other read"]:::ready
I1007["I1007<br/>The site renders the same graph, generated once"]:::ready
I1008["I1008<br/>The two projections are proved to be the same model"]:::blocked
I1009["I1009<br/>Every menu in this repository comes from one derivation"]:::ready
I1010["I1010<br/>The overview is what exists, counted rather than claimed"]:::ready
I1011["I1011<br/>The coverage matrix reports evidence, and never a green cell without one"]:::ready
I1012["I1012<br/>One detail view, assembled from what a node actually has"]:::ready
I1013["I1013<br/>Search over the graph, generated, with nothing to run"]:::blocked
I1014["I1014<br/>The relation view reads the graph and holds no data of its own"]:::blocked
I1015["I1015<br/>A surface with no server behind it is not offered as if it had one"]:::active
I1016["I1016<br/>The Cockpit works on a phone and before JavaScript runs"]:::blocked
I1017["I1017<br/>Live state is an overlay that degrades to nothing"]:::blocked
I1018["I1018<br/>The surface rules exist as checks, proved by making them fail"]:::blocked
I1019["I1019<br/>One skill runs the whole loop, and is itself in the graph"]:::blocked
I1020["I1020<br/>The graph's health is answered by the doctor that already answers everything else"]:::blocked
I1021["I1021<br/>A browser proves the interface, at the widths people use"]:::blocked
I1022["I1022<br/>Drift in any derived surface fails the build"]:::blocked
I1023["I1023<br/>Nothing private reaches a published page"]:::ready
I1024["I1024<br/>The interface has a weight, and it is measured"]:::blocked
I1025["I1025<br/>The federated model and its two projections are an architecture decision"]:::done
I1026["I1026<br/>The architecture explains itself, from inside itself"]:::blocked
I1027["I1027<br/>A synthetic capability proves the architecture instead of describing it"]:::blocked
I1028["I1028<br/>The inventories this replaces are removed, not left running beside it"]:::blocked
I1029["I1029<br/>The gate refuses what would silently break the interface"]:::blocked
I1030["I1030<br/>The milestone is accepted on its evidence"]:::blocked
I1031["I1031<br/>A served surface says which checkout it is serving"]:::ready
I1101["I1101<br/>What this tool leaves behind, established by inspection rather than by memory"]:::ready
I1102["I1102<br/>The two namespaces are a typed contract, not a habit"]:::blocked
I1103["I1103<br/>Whether a file is authored or derived is a field, not a naming convention"]:::blocked
I1104["I1104<br/>Both namespaces carry their contracts, all the way down"]:::blocked
I1105["I1105<br/>The repository is discovered once, into one model"]:::blocked
I1106["I1106<br/>The registries are views of the model, not separate discoveries"]:::blocked
I1107["I1107<br/>Discovery is deterministic, cached, and its cost is known"]:::blocked
I1108["I1108<br/>The desired integration is a value, and the plan is a diff"]:::blocked
I1109["I1109<br/>Everything placed outside the two namespaces is recorded, with what it was"]:::blocked
I1110["I1110<br/>The second run changes nothing, and a test says so"]:::blocked
I1111["I1111<br/>Uninstall gives back exactly what was taken"]:::blocked
I1112["I1112<br/>What touches the root is two small blocks, and they never change again"]:::blocked
I1113["I1113<br/>Entering a directory is local, bounded and silent about the network"]:::blocked
I1114["I1114<br/>A provider is an adapter over the model, and adding one is an implementation"]:::blocked
I1115["I1115<br/>Completion comes from the command model, not from a second list"]:::blocked
I1116["I1116<br/>This repository's own footprint moves, through the reconciler"]:::blocked
I1117["I1117<br/>The hand-maintained lists are removed, not left running beside the derivation"]:::blocked
I1118["I1118<br/>Every invariant of this milestone is a rule with a check that runs"]:::blocked
I1119["I1119<br/>The budgets are measured, and a regression fails rather than being noticed"]:::blocked
I1120["I1120<br/>A refusal says what to do about it"]:::blocked
I1121["I1121<br/>Every surface shows the integration from the one model"]:::blocked
I1122["I1122<br/>A foreign repository, adopted, upgraded and given back"]:::blocked
I1123["I1123<br/>The milestone is accepted on its evidence"]:::blocked
I1201["I1201<br/>An identity provider is a declarative object, and Google and Facebook are two of them"]:::ready
I1202["I1202<br/>One typed provider model reads the objects, and no code names a provider"]:::blocked
I1203["I1203<br/>One flow serves every provider, and it refuses everything it did not start"]:::blocked
I1204["I1204<br/>The session is signed, short, and revocable from the server"]:::blocked
I1205["I1205<br/>Identity is resolved once, in the router, and every surface reads it from there"]:::blocked
I1206["I1206<br/>What an anonymous reader may do is derived from the effect classification, not from a list"]:::blocked
I1207["I1207<br/>No credential reaches any output, and hostile provider metadata renders safely"]:::blocked
I1208["I1208<br/>Adding a provider is one file, removing one is one deletion, and both are executed rather than described"]:::blocked
I1301["I1301<br/>A workspace is a declared object of the layer; only its content is local"]:::done
I1302["I1302<br/>Identity, provenance and support level are typed fields, not prose"]:::ready
I1303["I1303<br/>The store is bounded, measured and invisible to every published projection"]:::blocked
I1304["I1304<br/>The browser transport is the one this repository already drives"]:::blocked
I1305["I1305<br/>An observed contract has a fingerprint, a compatibility state and a fixture"]:::blocked
I1306["I1306<br/>A sync resumes, repeats itself without harm, and says how fresh it is"]:::blocked
I1307["I1307<br/>The ChatGPT shape is mapped from evidence and never becomes the canonical model"]:::blocked
I1308["I1308<br/>The executable's share is one capability, shaped like continuity"]:::blocked
I1309["I1309<br/>The boundaries this milestone asserts are gates, not sentences"]:::blocked
I1310["I1310<br/>The subsystem is documented where a person looks, and the plan is closed against the repository"]:::blocked
I1401["I1401<br/>The identity of a projected record is what the record carries, not what its title says"]:::done
I1402["I1402<br/>A finding says which of six states it found, and the state that could hide a person's edit is no longer one of them"]:::done
I1403["I1403<br/>Backfill the projection once, deliberately, and record what it created"]:::ready
I1404["I1404<br/>The drift check is a gate, so a projection that stops being applied cannot stay silent"]:::done
I1405["I1405<br/>A pull request names the issue it realises, and the edge is derived rather than remembered"]:::done
I1406["I1406<br/>The plan's derivations are capabilities, so every surface reads the readiness the terminal reads"]:::done
I1407["I1407<br/>One issue travels the whole path and back, as an executable case"]:::done
I1408["I1408<br/>The documents stop claiming a projection nobody runs"]:::done
I0001 --> I0002
I0002 --> I0003
I0003 --> I0004
I0004 --> I0005
I0004 --> I0006
I0004 --> I0010
I0005 --> I0007
I0005 --> I0008
I0005 --> I0009
I0005 --> I0013
I0005 --> I0014
I0006 --> I0009
I0008 --> I0011
I0009 --> I0011
I0010 --> I0011
I0011 --> I0012
I0012 --> I0015
I0013 --> I0014
I0014 --> I0015
I0101 --> I0102
I0102 --> I0103
I0103 --> I0104
I0201 --> I0202
I0202 --> I0203
I0203 --> I0204
I0204 --> I0205
I0205 --> I0206
I0301 --> I0302
I0302 --> I0303
I0303 --> I0304
I0304 --> I0305
I0401 --> I0402
I0402 --> I0403
I0403 --> I0404
I0501 --> I0502
I0502 --> I0503
I0503 --> I0504
I0601 --> I0602
I0602 --> I0603
I0603 --> I0604
I0604 --> I0605
I0701 --> I0702
I0702 --> I0703
I0703 --> I0704
I0801 --> I0807
I0802 --> I0803
I0803 --> I0804
I0804 --> I0805
I0805 --> I0806
I0806 --> I0813
I0807 --> I0808
I0808 --> I0809
I0809 --> I0810
I0810 --> I0811
I0811 --> I0812
I0811 --> I0814
I0812 --> I0813
I0813 --> I0815
I0814 --> I0815
I0815 --> I0816
I0817 --> I0818
I0817 --> I0819
I0817 --> I0821
I0817 --> I0823
I0817 --> I0832
I0817 --> I0833
I0817 --> I0837
I0818 --> I0820
I0818 --> I0822
I0818 --> I0828
I0818 --> I0842
I0819 --> I0820
I0819 --> I0822
I0819 --> I0828
I0819 --> I0832
I0819 --> I0836
I0819 --> I0842
I0820 --> I0822
I0820 --> I0828
I0820 --> I0840
I0820 --> I0842
I0821 --> I0840
I0821 --> I0841
I0822 --> I0831
I0822 --> I0835
I0823 --> I0824
I0823 --> I0827
I0823 --> I0830
I0824 --> I0825
I0825 --> I0826
I0826 --> I0830
I0826 --> I0831
I0826 --> I0835
I0826 --> I0838
I0827 --> I0828
I0828 --> I0834
I0828 --> I0839
I0829 --> I0830
I0830 --> I0843
I0831 --> I0843
I0832 --> I0842
I0833 --> I0842
I0835 --> I0843
I0841 --> I0843
I0842 --> I0843
I0901 --> I0902
I0901 --> I0924
I0902 --> I0903
I0902 --> I0904
I0902 --> I0905
I0902 --> I0907
I0902 --> I0908
I0902 --> I0909
I0902 --> I0913
I0902 --> I0918
I0903 --> I0913
I0903 --> I0914
I0903 --> I0926
I0903 --> I0927
I0904 --> I0906
I0904 --> I0909
I0905 --> I0909
I0905 --> I0916
I0906 --> I0930
I0909 --> I0910
I0909 --> I0911
I0909 --> I0912
I0909 --> I0914
I0909 --> I0919
I0909 --> I0920
I0909 --> I0930
I0910 --> I0921
I0911 --> I0921
I0912 --> I0930
I0913 --> I0914
I0913 --> I0926
I0913 --> I0931
I0914 --> I0915
I0914 --> I0916
I0914 --> I0917
I0914 --> I0931
I0915 --> I0925
I0916 --> I0931
I0917 --> I0931
I0918 --> I0929
I0918 --> I0931
I0919 --> I0928
I0920 --> I0932
I0921 --> I0928
I0922 --> I0931
I0923 --> I0932
I0924 --> I0926
I0925 --> I0932
I0926 --> I0932
I0927 --> I0932
I0928 --> I0932
I0929 --> I0932
I0930 --> I0922
I0930 --> I0923
I0930 --> I0928
I0930 --> I0931
I0931 --> I0929
I0931 --> I0932
I1001 --> I1002
I1001 --> I1003
I1001 --> I1004
I1001 --> I1025
I1002 --> I1005
I1002 --> I1011
I1002 --> I1014
I1002 --> I1020
I1004 --> I1005
I1004 --> I1009
I1004 --> I1015
I1005 --> I1006
I1005 --> I1007
I1005 --> I1009
I1005 --> I1010
I1005 --> I1012
I1005 --> I1023
I1006 --> I1008
I1006 --> I1017
I1007 --> I1008
I1007 --> I1013
I1007 --> I1014
I1007 --> I1020
I1007 --> I1022
I1009 --> I1016
I1009 --> I1028
I1010 --> I1030
I1011 --> I1018
I1012 --> I1026
I1013 --> I1030
I1014 --> I1021
I1014 --> I1024
I1015 --> I1018
I1015 --> I1021
I1016 --> I1021
I1017 --> I1030
I1018 --> I1019
I1018 --> I1027
I1019 --> I1027
I1020 --> I1030
I1021 --> I1029
I1022 --> I1029
I1023 --> I1029
I1024 --> I1030
I1025 --> I1026
I1026 --> I1030
I1027 --> I1030
I1028 --> I1030
I1029 --> I1030
I1101 --> I1102
I1101 --> I1105
I1102 --> I1103
I1102 --> I1104
I1104 --> I1123
I1105 --> I1106
I1106 --> I1107
I1106 --> I1108
I1106 --> I1117
I1107 --> I1123
I1108 --> I1109
I1108 --> I1120
I1109 --> I1110
I1109 --> I1111
I1109 --> I1112
I1110 --> I1116
I1110 --> I1118
I1110 --> I1122
I1111 --> I1122
I1112 --> I1113
I1112 --> I1114
I1112 --> I1116
I1112 --> I1121
I1113 --> I1119
I1114 --> I1115
I1115 --> I1123
I1116 --> I1118
I1116 --> I1122
I1117 --> I1123
I1118 --> I1123
I1119 --> I1123
I1120 --> I1123
I1121 --> I1122
I1122 --> I1123
I1201 --> I1202
I1202 --> I1203
I1202 --> I1208
I1203 --> I1204
I1204 --> I1205
I1204 --> I1207
I1205 --> I1206
I1206 --> I1208
I1301 --> I1302
I1302 --> I1303
I1302 --> I1304
I1302 --> I1307
I1303 --> I1306
I1303 --> I1308
I1303 --> I1309
I1304 --> I1305
I1305 --> I1306
I1305 --> I1307
I1308 --> I1309
I1308 --> I1310
I1309 --> I1310
I1401 --> I1402
I1401 --> I1403
I1401 --> I1405
I1402 --> I1403
I1402 --> I1404
I1404 --> I1403
I1404 --> I1407
I1404 --> I1408
I1405 --> I1407
I1406 --> I1407
classDef done stroke:#16a34a,fill:#052e16,stroke-width:2px
classDef active stroke:#2563eb,fill:#eff6ff,stroke-width:2px
classDef verify stroke:#7c3aed,fill:#f5f3ff,stroke-width:2px
classDef ready stroke:#0891b2,fill:#ecfeff,stroke-width:2px
classDef blocked stroke:#b45309,fill:#fffbeb,stroke-width:2px
classDef cancelled stroke:#6b7280,fill:#f9fafb,stroke-width:2pxThe graph on its own page, with the edge list.
Findings
What validation says about the model as published. A failure would have stopped this build; anything below is a warning the model reports and does not block.
| level | code | subject | message |
|---|---|---|---|
| WARN | scope_conflict | I0201 | shares share with I0901; they may not run concurrently |
| WARN | scope_conflict | I0201 | shares share with I1201; they may not run concurrently |
| WARN | scope_conflict | I0821 | shares lib/common.sh with I0837; they may not run concurrently |
| WARN | scope_conflict | I0821 | shares docs/SCHEMAS.md with I1302; they may not run concurrently |
| WARN | scope_conflict | I0837 | shares docs/SCHEMAS.md with I1302; they may not run concurrently |
| WARN | scope_conflict | I0901 | shares share/kinds.yaml with I1201; they may not run concurrently |
How to work through it
majordomus plan next
majordomus plan show <id>
majordomus plan start <id>
majordomus plan evidence <id> --covers <token> --type test --command "<cmd>" --result "<what it showed>"
majordomus plan done <id>Read the planning model for what the terms mean, and dogfooding for why this repository holds itself to it. The release roadmap — what each version adds — is a separate page.