I0908 — A hosted process has no repository, and says so instead of failing

BLOCKED wave 2 · p0 · deep-work profile · parallel safe

Part of fly-deployment — A deployment is a projection of the repository model, and a reachable URL is its evidence.

Objective

Separate the local mode that inspects a developer's repository from the hosted mode that serves a packaged layer, and report the capabilities that are unavailable in hosted mode from capability metadata rather than from a hand-written list.

Why

Majordomus reads a repository checkout. A Machine has no developer's home directory. Without an explicit boundary the hosted process either panics on the first read or silently serves an empty layer, and a hand-maintained list of what does not work remotely would be one more thing to drift.

Current state

The executable resolves a repository from the working directory. Nothing distinguishes a packaged deployment from a local checkout, and no absolute path scan exists.

Desired state

The hosted process serves the packaged layer, the documentation, the UI and the API; a capability that genuinely requires a writable local checkout reports itself unavailable with a reason; and no absolute developer path exists anywhere in the image or its configuration.

Scope

• apps/majordomus-cli/src/repository.rs
• apps/majordomus-cli/src/share.rs

Out of scope

• Making local-only capabilities work remotely by shipping a checkout
• A hand-written list of unavailable capabilities

Dependencies

• I0902BLOCKED The deployment object becomes typed Rust that refuses nonsense

Acceptance criteria

• The packaged layer is a declared build input of the deployment object, not an implicit copy
• A capability unavailable in hosted mode is derived from capability metadata and reported with a reason rather than panicking
• The mode is observable through the metadata read, so an operator can tell which one a process is in
• A scan proves no absolute developer path — /Users, a home directory, a worktree path — appears in the image, the generated configuration or the served output

Validation

• cargo test --workspace --all-features
• bash test/run.sh

Evidence required

• hosted_mode
• capability_boundary
• no_local_paths

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

Packaging this repository's own layer into the image makes the public deployment a demonstration of one repository. That is the intent, and it must be stated rather than discovered.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I0908.yaml. Read it back with majordomus plan show I0908.