I1109 — Everything placed outside the two namespaces is recorded, with what it was
Record every mutation Majordomus makes outside `.ai/` and `.majordomus/` in a typed ledger: the path, the kind of mutation, the content hash as written, the generator and version that wrote it, and what was there before.
BLOCKED wave 4 · p0 · implementation profile · parallel safe
Blocked. This issue cannot start until I1108 is done. The status is derived from that, not declared.
Objective
Record every mutation Majordomus makes outside `.ai/` and `.majordomus/` in a typed ledger: the path, the kind of mutation, the content hash as written, the generator and version that wrote it, and what was there before.
Why
Without a ledger the tool cannot tell its own edits from a person's, which means it can neither update them safely nor remove them at all. The ledger is what makes an uninstall possible and an overwrite refusable.
Current state
Root documents carry generated blocks and provider bootstraps are written to the root. Nothing records that Majordomus put them there.
Desired state
The ledger is the authority on what Majordomus owns outside its namespaces, and a mismatch between what it recorded and what is on disk stops a mutation rather than resolving it.
Scope
- .majordomus/manifest.json
- apps/majordomus-cli/src/integration/ownership.rs
Out of scope
- Recording anything inside the two namespaces, which are owned by construction
- A ledger a person is expected to edit
Dependencies
What waits on this
- I1110BLOCKED The second run changes nothing, and a test says so
- I1111BLOCKED Uninstall gives back exactly what was taken
- I1112BLOCKED What touches the root is two small blocks, and they never change again
Acceptance criteria
- Every mutation outside the two namespaces is recorded with its path, its kind, the hash as written, the generator and version, and the prior state
- A managed region records the markers that bound it, so the rest of the file is never in question
- The ledger is typed and schema-backed, generated from the canonical type rather than hand-written
- A path whose current hash does not match what the ledger recorded is reported as edited by a person, and no mutation proceeds on it silently
- The ledger contains no secret and no absolute developer path
Validation
- cargo test --workspace --all-features
- bin/majordomus doctor
Evidence required
- ledger_records
- mismatch_stops
Evidence
None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.
Risk
A ledger that drifts from the filesystem authorises deletions it cannot justify. The hash is what keeps it honest, and a mismatch has to stop the operation rather than warn about it.
Timeline
- started
- —
- verified
- —
- completed
- —
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I1109.yaml. Read it back with majordomus plan show I1109.