Skip to content

I0203 — Make enforcement opt-in, and prove a repository that declines is unaffected

Add one policy key that turns runtime enforcement on, default it to off, and prove with a case that a repository which never sets it behaves exactly as it does today.

BLOCKED wave 2 · p1 · implementation profile · runs alone

Part of runtime-adapters — Profiles become runtime constraints rather than advice.

Blocked. This issue cannot start until I0202 is done. The status is derived from that, not declared.

Objective

Add one policy key that turns runtime enforcement on, default it to off, and prove with a case that a repository which never sets it behaves exactly as it does today.

Why

Clamping what a worker may read or emit changes how every session behaves. A change of that size cannot arrive with an update; it has to be chosen, and the choice has to be visible in the policy the repository already reviews.

Current state

Nothing is enforced, so nothing needs an opt-in. Adding the adapter without one would enforce limits in every repository that updates.

Desired state

The policy carries an explicit enforcement key. Absent or false, the tool behaves as it did before the adapter existed, and a case demonstrates that rather than asserting it.

Scope

  • lib
  • share

Out of scope

  • Any default that enables enforcement
  • Per-command overrides; the choice is the repository's, once

Dependencies

What waits on this

Acceptance criteria

  • The key is declared in the policy allowlist and rejected when it holds anything but a boolean
  • Default and absent both mean off, and the projections say so where a worker reads them
  • A case runs the full lifecycle in a repository that never sets the key and shows unchanged behaviour
  • Doctor reports whether enforcement is on, without turning it on

Validation

  • bash test/run.sh
  • bin/majordomus doctor

Evidence required

  • suite

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

An opt-in that defaults to on in the skeleton is not an opt-in; the skeleton has to be covered by the same case.

Timeline

started
—
verified
—
completed
—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I0203.yaml. Read it back with majordomus plan show I0203.