repository-automation-is-typed — Repository automation is typed capabilities that Rhai orchestrates, and domain-logic shell only shrinks
A person, CI and an agent run the same repository automation through one executable with an embedded Rhai engine and typed Rust capabilities; just recipes are derived from the command graph and the commit hook is one call of the executable; shell remains only at declared OS, bootstrap and provider boundaries, and the domain logic left in shell only shrinks; and every migrated unit proved it behaves as its predecessor before the predecessor was deleted.
PLANNED 0 of 8 issues done
- ready
- 3
- blocked
- 5
- active
- 0
- verify
- 0
- done
- 0
- cancelled
- 0
Problem
A person, CI and an agent run the same repository automation through one executable with an embedded Rhai engine and typed Rust capabilities; just recipes are derived from the command graph and the commit hook is one call of the executable; shell remains only at declared OS, bootstrap and provider boundaries, and the domain logic left in shell only shrinks; and every migrated unit proved it behaves as its predecessor before the predecessor was deleted. Proposed in ADR 0184 (Every command name is implemented by exactly one executable, and the other only delegates) (proposed; it carries no authority until the owner accepts it). Sources: chatgpt-majordomus:c105#0, chatgpt-majordomus:c110#0, chatgpt-majordomus:c110#3, chatgpt-majordomus:c110#4, chatgpt-majordomus:c140#0, chatgpt-majordomus:c140#2, chatgpt-majordomus:c192#5, chatgpt-majordomus:c230#0, chatgpt-majordomus:c230#6, chatgpt-majordomus:c244#6, chatgpt-majordomus:c290#0, chatgpt-majordomus:c290#2.
Outcome
A person, CI and an agent run the same repository automation through one executable with an embedded Rhai engine and typed Rust capabilities; just recipes are derived from the command graph and the commit hook is one call of the executable; shell remains only at declared OS, bootstrap and provider boundaries, and the domain logic left in shell only shrinks; and every migrated unit proved it behaves as its predecessor before the predecessor was deleted.
Current state
Its issues extend existing milestones; see each issue's why.
Desired state
Every criterion of the intent is carried by an issue here and proven by its test.
Acceptance criteria
- A scripted capability declared in the layer runs through majordomus run and appears on every projection with no edit elsewhere
- Neither the class-A unit count nor the class-A line count, derived from the tree, rises against the merge base, and a record relabelled away from A without a reason is refused; the shell check says so
- Every command path (program plus its full word sequence) resolves to one implementing executable, and a path both executables implement outside a declared delegation is a finding
- Every just recipe is a recipe of the generated, untracked command-graph bridge or a hand-written recipe with its inventory record, a hand-written duplicate of a bridged recipe is refused, and regeneration is byte-identical
- A class A or B shell unit is deleted only when its parity case has a recorded pass for the head being judged; otherwise the shell check refuses the deletion and names the missing case
- The commit hook is one call of a command path the Rust executable owns, every enforcement entry wired by it is still proven invoked, and it reports its time per component against its budget
Validation
- majordomus plan validate
Issues
Each one is an execution contract with its own acceptance criteria, validation command and required evidence. The wave column is the layer of the dependency graph it sits in.
| issue | status | wave | depends on | title |
|---|---|---|---|---|
| I3154 | READY | 0 | — | Every just recipe is generated from the command graph or names the exemption that keeps it hand-written |
| I3155 | READY | 0 | — | The shell check reports shell by disposition, and the count of domain-logic shell never rises against the merge base |
| I3156 | READY | 0 | — | Every command path is implemented by one executable, and the other only delegates |
| I3157 | BLOCKED | 2 | I1801 | A scripted capability declared in an adopting repository's layer reaches its surfaces with no change to the tool, and says where it came from and what it may do |
| I3159 | BLOCKED | 3 | I1804 | A shell unit is deleted only after a parity case shows its replacement gives the same verdict on the same fixture |
| I3161 | BLOCKED | 1 | I3156 | The commit hook is one call of the executable that runs the commit subset of doctor, the worktree guard and pages current under a declared budget |
| I3305 | BLOCKED | 3 | I1801, I3157 | A scripted capability installed from outside the repository registers like one inside it |
| I3306 | BLOCKED | 4 | I3305, I3157, I1800 | An external scripted capability runs under default-deny grants, bounded, and leaves an audit record |
The graph
flowchart LR
I3154["I3154<br/>Every just recipe is generated from the command graph or names the exemption that keeps it hand-written"]:::ready
I3155["I3155<br/>The shell check reports shell by disposition, and the count of domain-logic shell never rises against the merge base"]:::ready
I3156["I3156<br/>Every command path is implemented by one executable, and the other only delegates"]:::ready
I3157["I3157<br/>A scripted capability declared in an adopting repository's layer reaches its surfaces with no change to the tool, and says where it came from and what it may do"]:::blocked
I3159["I3159<br/>A shell unit is deleted only after a parity case shows its replacement gives the same verdict on the same fixture"]:::blocked
I3161["I3161<br/>The commit hook is one call of the executable that runs the commit subset of doctor, the worktree guard and pages current under a declared budget"]:::blocked
I3305["I3305<br/>A scripted capability installed from outside the repository registers like one inside it"]:::blocked
I3306["I3306<br/>An external scripted capability runs under default-deny grants, bounded, and leaves an audit record"]:::blocked
I3156 --> I3161
I3157 --> I3305
I3157 --> I3306
I3305 --> I3306
classDef done stroke:#16a34a,fill:#dcfce7,color:#14532d,stroke-width:2px
classDef active stroke:#2563eb,fill:#eff6ff,color:#1e3a8a,stroke-width:2px
classDef verify stroke:#7c3aed,fill:#f5f3ff,color:#4c1d95,stroke-width:2px
classDef ready stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
classDef planned stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
classDef blocked stroke:#b45309,fill:#fffbeb,color:#78350f,stroke-width:2px
classDef cancelled stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px
classDef superseded stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2pxLinked from this diagram (8)
- I3154 Every just recipe is generated from the command graph or names the exemption that keeps it hand-written
- I3155 The shell check reports shell by disposition, and the count of domain-logic shell never rises against the merge base
- I3156 Every command path is implemented by one executable, and the other only delegates
- I3157 A scripted capability declared in an adopting repository's layer reaches its surfaces with no change to the tool, and says where it came from and what it may do
- I3159 A shell unit is deleted only after a parity case shows its replacement gives the same verdict on the same fixture
- I3161 The commit hook is one call of the executable that runs the commit subset of doctor, the worktree guard and pages current under a declared budget
- I3305 A scripted capability installed from outside the repository registers like one inside it
- I3306 An external scripted capability runs under default-deny grants, bounded, and leaves an audit record
Canonical record: .ai/repo/project/milestones/repository-automation-is-typed.yaml. Read it back with majordomus plan show repository-automation-is-typed.