Forward-looking companion to `STACK_COMPLETION.md`.
Where STACK_COMPLETION.md answers "where are we right now?", this file answers "what's worth shipping next, and why?" It is the synthesis of four research passes (external industry scan, internal portfolio audit, niche probe, verification + goal-targeted research on continual learning and multi-agent spatial collaboration).
Last updated: 2026-05-28 Maintained by: Travis Burandt Update policy: Update when (a) a candidate moves out of "missing" because it ships, (b) a new candidate emerges, (c) the priority ranking changes due to a portfolio shift, or (d) industry events close an empty seat we'd been planning to fill.
Companion docs:
STACK_COMPLETION.md — current state of every product, version, deployment, test count
AmpersandBoxDesign/SPEC.md — authoritative [&] Protocol specification
opensentience.org/docs/spec/README.md — OS-001 through OS-011 index
CLAUDE.md — agent onboarding
The "infrastructure over LLM" thesis is correct. The next round of leverage is not 100s of new protocols; it's:
Finishing what's half-built — BendScript reserved vocabularies, OS-012/013/014, formal automata for already-shipped state.
One unifying spatial protocol pair (OS-012 SCOPE) — N-D Region algebra (NDR) + SpatialClaim envelope (CLAIM). Collapses 6+ multi-agent coordination dimensions into 2 specs and structurally bridges GeoFleetic ↔ RuneFort for the first time. Reviewed design, not yet a committed artifact — a v0.1 design (sections 0–17, dated 2026-04-30) was reviewed in §3 of this doc, but no SCOPE spec file has been written, and SCOPE stays deferred behind two missing hard prerequisites (PULSE v0.1.2 vendor-namespace tokens; a Graphonomous region field) plus the §1.1 wired-arrows gate. It is not the next move; see §3 v0.1 draft status and the 2026-06-12 decision note there.
One small PULSE addition (Boundary/Drift Signal tokens) — sibling to the existing SurpriseSignal. Smallest spec, biggest CL unlock.
A handful of industry empty seats where [&] can claim category before the obvious players show up — Grounding, Capability Handoff, Skill Portability Manifest, Plasticity Lattice, Refutes anti-edge.
The "100s to 1000s" vision is real, but it's vocabularies + profiles on ~12-15 protocols, not 1000s of separate protocols (the AT Protocol Lexicon model).
A protocol candidate is worth shipping only if it passes most of these:
Replaces work the LLM is currently doing in tokens/prose (substrate that takes work out of the context window)
Substrate, not service — composes with anything; no stack lock-in
Diffable text artifact at rest — a JSON/YAML file survives version control
Falsifiable round-trip claim — a property the protocol either holds or doesn't (e.g. parse(serialize(x)) === x)
Empty seat with no incumbent
Small spec, namespaced extension surface
Reference impl ≤ 25KB gzipped
A good candidate passes 5+. A great one passes all 7.
The 7-property test above is necessary but not sufficient. Adopted 2026-05-25 from STACK_ARCHITECTURE_GAP_REVIEW.md Finding 1 (extended 2026-06-11 with the wired-arrows gate): before a candidate gets a top-level OS-XXX slot (vs. living as an implementation track inside an existing product), it must also pass all eight of these:
| Gate | Required proof |
|---|---|
| Two consumers | At least two internal products or one external implementation need the same artifact. |
| Portable artifact | The thing survives outside the current database/service. |
| Falsifiable processor | There is a deterministic validate/verify/derive function. |
| Prior-art delta | A one-page comparison to incumbents names the exact remaining gap. |
| ≤25KB reference | Minimal verifier/processor can plausibly fit the size target. |
| Conformance fixtures | Valid, invalid, replay, revocation, version-skew, and redaction fixtures exist. |
| Live proof path | At least one end-to-end stack proof consumes it. |
| Wired arrows (in + out) | **At least one wired consumer arrow IN and one OUT exists before any vX.0 release** — a real upstream producer emits the artifact and a real downstream consumer reads it (not a planned/hypothetical coupling). A protocol with no wired producer or no wired consumer stays pre-vX.0 (alpha/draft), regardless of how complete its spec is. Prevents shipping "vX.0" specs that nothing actually flows through. |
Failing any of these = implementation track, not a protocol slot. PACT and TALLY both fail "two consumers" and "portable artifact" today; they're tracked as implementation work in §6.14 and §6.15. The wired-arrows gate is also why BendScript (no portfolio adopter yet committing to bend: URIs) and OS-012 SCOPE (subscription contract + first wired consumer deferred) honestly remain pre-v1.0 drafts.
Cross-checked across the portfolio in 2026-04-28. Of the candidates that prior planning mistakenly listed as "missing":
| Item | Where | Status |
|---|---|---|
| Replay-Determinism (per-run fail-fast) | body-browser/lib/body_browser/replay.ex:1-80 + body-os/lib/body_os/replay.ex | Full impl with state-hash verification, mid-trace divergence checking, SurpriseSignal emission |
| InteractionTrace schema | OS-011 §4 + BodyBrowser.TraceRecorder | Full schema + recorders shipped |
| PULSE manifest schema + 6 canonical tokens | PULSE/schemas/pulse-loop-manifest.v0.1.json:71-211 | v0.1.1 fully shipped (SurpriseSignal was the 6th, added for OS-011) |
| OS-006 Authorization Kernel | delegatic/ v0.1.0 (HMAC AuthorizationBlock + 42 tests + Fly.io ready) | Kernel shipped; org-tree layer is future work |
| OS-011 Embodiment | Full spec + 2 reference impls (body-browser + body-os) + 12 conformance tests each | Shipped |
| Node lifecycle fields | graphonomous/lib/graphonomous/types/node.ex:30-35 (superseded_by, forgotten_at, creation_source) + belief_revision.ex | Fields + supersession exist; only the formal FSM declaration is missing |
| Confidence algebra (basic) | q_value + q_update_count + Bayesian smoothing in learner.ex:12-16 and consolidator.ex | Basic algebra exists; advanced Wilson/Dempster-Shafer is the gap |
| BendScript core vocabulary mechanism | @bendscript/core v0.1.0-alpha.0 (TypeScript parser/validator/round-trip harness, 96 tests) + bendscript.com/docs/spec/README.md §2.1 (678-line v0.1 draft) | Mechanism shipped + core reserved; the other four named vocabularies are the gap (see §6.1) |
| Affordance enumeration | body_browser/types/affordance.ex:1-56 + body_os/types/affordance.ex | Type + AffordanceSet + policy filtering exist; only the projection function affordances(agent, policy_context) → actions[] is missing |
| Item | What exists | What's missing |
|---|---|---|
| Crystallization | crystallize/3 in KAPPA_DELIBERATOR_PROMPT + FleetPrompt.PollWorker.crystallize_one/2 | Formal output schema |
| Forgettable Memory | GDPR cascade in forgetter.ex | k_anon, dp_epsilon, dependency-graph cascade through consolidation |
| OS-012 Credentials | WebHost.Systems §40 + delegatic HMAC blocks | Unified install.credentials → runtime.secrets envelope |
| BendScript reserved vocabularies | Names declared in bendscript.com/docs/spec/README.md:173-181 | Edge-predicate / block-kind specs for argument.v1, memory.v1, spec.v1, runefort.v1 |
Two nested research repos now inventoried in STACK_COMPLETION.md §2.6. Their planning status is deliberately constrained, and the constraint is the point:
the-residency is explicitly a thin deliberation+findings layer — it is the single best example in the portfolio of the "do NOT rebuild" rule. Its DIRECTION.md maps every tempting "build this" (confidence/novelty/evidence engine, knowledge graph, benchmarks-as-memory, research loop, findings-as-objects) back onto an existing component (Graphonomous / PRISM / PULSE / [&]) and builds only the ~one layer none of them cover (multi-resident board + findings-as-first-class-objects-with-provenance + living-paper loop). Do not wire it into the rest of the stack until its ROADMAP.md Gate 0 (does a board beat a single agent?) and Gate 1 (finding reliability over 3–4 corpora) pass. Everything past that is gated, connection-not-construction.
TRVM is the residency's first corpus and the proof artifact for its eventual CRDT-merged memory model (research/INCRDT.md, merge = NF(A ∪ B)). It is research-stage; it is not an extraction candidate and has no protocol-extraction gate pressure. Honesty edits this session kept its distribution claim scoped (confluence ⇒ schedule-independence; coordination-freedom ⇒ + boundary-port discipline).
The immediate buildable work is narrow: make the residency's corpus + personas swappable, then run the Gate 0 comparison (single critic vs. board) on a second portfolio corpus — that single run is both the Gate-0 test and the first Gate-1 data point. Nothing larger is in scope until that produces evidence.
The cleanest result of the four-pass research. 15 multi-agent spatial-collaboration dimensions collapse to 2 underlying gaps + 1 separable one.
Subsumes 6 dimensions: shared spatial state, intent broadcasting, conflict resolution, presence, attention/salience, territory/role.
These are all the same primitive at different time horizons / coupling strengths:
attention/salience = current frame, soft, advisory
presence = current frame, hard, factual
intent broadcast = next frame, soft, advisory
territory = long horizon, hard, contractual
conflict resolution = what happens when claims collide
shared spatial state = the read-side projection of all the above
Unifying primitive: typed SpatialClaim envelope {agent, region, kind, strength, horizon, confidence, expires_at, supersedes, trace_id} carried over CloudEvents v1 (the same envelope PULSE already uses for cross-loop tokens).
Empty at the protocol layer. ROS2 tf2 is poses-only. DDS-RTPS QoS is topic-bound. Liveblocks/Yjs awareness is untyped. Figma multiplayer is proprietary cursors-only. CNP (Contract Net Protocol, 1980 → Vorobeychik 2024 refresh) is an algorithm without a carrier. MASCN (AAMAS 2025) is concept-paper only.
Subsumes 4 dimensions: cognitive viewports, spatial memory tagging, N-D substrates, spatio-temporal traces.
A Region discriminated union: {kind: "geo"|"grid"|"file"|"graph"|"embedding"|"document"|"temporal", ...} with operations contains/overlaps/distance/union/buffer/project.
Today every portfolio piece picks its own region type and the post-pivot mappings make this concrete:
kind: "geo" ↔ GeoFleetic GeoJSON polygons
kind: "grid" ↔ RuneFort layout protocol primitives (rooms / claims / neighbors over an integer grid; see runefort.com/docs/spec/runefort.protocol.md)
kind: "graph" ↔ BendScript v0.1 graph regions (typed inline link facets over bend:doc#blk.spn URIs; see bendscript.com/docs/spec/README.md)
kind: "document" ↔ shared whiteboard / canvas use cases (subsumes the old kappa SaaS canvas pattern)
Graphonomous = implicit graph-hops, OS-011 bodies = viewport rects
Allen interval algebra (temporal) + RCC-8 (geographic) + Manhattan (grid) all exist separately; the unification is what's missing.
Doesn't collapse into A or B. Federated averaging is saturated (Flower, OpenFL, NVFlare). Federated typed-graph aggregation — node sets, edge sets, attributes from N peers without raw-data sharing — is genuinely empty. FedGraph (NeurIPS 2024) and Subgraph FL (ICML 2025) are algorithms; no envelope, no schema, no merger semantics.
Multi-agent continual learning in shared space requires exactly:
Gap B (regions to scope memories)
Gap A (claims to avoid duplicate learning and attribute outcomes)
Gap C / FGAP (cross-peer KG aggregation)
The most ambitious composite use case requires exactly the three empty seats and no more. Strong validation that A+B+C are the right cuts.
A shared whiteboard = a document Region (Gap B kind=document) over which multiple agents emit SpatialClaims (Gap A) of kinds presence (looking here), intent (will edit this paragraph next), attention (currently reasoning about), and territory (own the methodology section). Conflict resolution is Gap A's supersedes chain plus Deliberatic for hard cases. Persistence is Graphonomous storing claims as semantic nodes with Region payloads. No new primitive needed. That's the test that A+B are the right cuts.
The cross-product synergy has been hand-wavy. Gap B is the explicit bridge: a geographic region (GeoFleetic) and a grid-cell room (RuneFort) become two kinds of the same Region type. Then Gap A lights up the dynamics: a fleet asset entering a geofence emits a SpatialClaim (kind=presence, region=geo) which a RuneFort renderer displays as a state binding on the corresponding tile (region=grid).
Decision note — 2026-06-12 (Travis-reserved item discharged). Verified against the live tree: no SCOPE spec file exists (repo-wide
*SCOPE*search → none; the only OS-012/SCOPE hits are this doc, STACK_COMPLETION, STACK_SITEMAP, and amp-nav). The "v0.1 draft" below is a design captured and reviewed in prose here — never a committed artifact. Decision: SCOPE stays deferred — do not green-field the spec. Honest unblock order: (1) PULSE v0.1.2 vendor-namespace tokens, (2) a Graphonomousregionfield with ≥1 real region-scoped consumer, (3) only then a consumer-gated SCOPE v0.1. Update — 2026-06-12, blocker #1 discharged. PULSE v0.1.2 vendor-namespace tokens are now shipped `in_tree` (schema + OS-010 §6.7 spec +tokens.tsruntime + 8/8 tests; see §6.7). A SCOPE manifest can now declarescope.v1.*tokens against PULSE's connection layer. Remaining blockers: (2)graphonomous/lib/graphonomous/types/node.exstill has no `region` field (region-scoped retrieval undeliverable), and (3) the §1.1 wired-arrows gate (no wired consumer). SCOPE stays deferred until (2) and (3) clear. The design review below is retained as the input to that future work.
The following captures a v0.1 design (sections 0–17, dated 2026-04-30) reviewed against the ProjectAmp2 stack and competitive landscape (tf2, W3C Web Annotation, MAPF/CBS, Yjs awareness, etcd leases). The review surfaced three classes of issue that would need resolving before any v0.1 final:
Surface area is ~40% larger than current consumers justify. Consumer-gated v0.1 minimum:
3 region kinds — grid (Runefort), document_span (BendScript), graph_subgraph (Graphonomous). Defer file_range (no current consumer; SpecPrompt and Graphonomous claim files at file-level, not range-level) and viewport (OS-011 body-browser/body-os don't run multiple agents per viewport today) to v0.2 with explicit consumer commitments.
6–7 claim types — presence, edit, reserve, territory, coverage, memory, handoff. Defer avoid/hazard (robotics-flavored, no ProjectAmp2 robotics consumer) to a scope.robotics.v1 vocabulary. Drop attention (overlaps presence), inspect (reads rarely conflict; cover via presence + meta), observation/drift (these are facts/events, not assertions of intent — already covered by PULSE OutcomeSignal and SurpriseSignal).
3 strength levels — advisory, soft, exclusive. Defer mandatory until a fencing-token mechanism exists (the draft's §6.3 promises "policy-enforced" without specifying enforcement; without monotonic claim versions per (frame, region), stale clients can act after expiry — the etcd/Chubby/Redlock lesson).
Three structural gaps in the draft:
Subscription contract deferred to v0.2 — but the whole stack is event-driven (PULSE/Graphonomous/PRISM all CloudEvents-based). Without subscription, agents must poll a static document. This is the core feature of a coordination protocol; promote to v0.1 normative.
Cross-frame conflicts deferred undercuts the spatial-collapse pitch — under §7.4 rule 7, a Runefort grid claim and a BendScript span claim cannot interact in v0.1 even when the user wants them to (e.g., "this room governs this section of the doc"). Either rename v0.1 honestly to "single-substrate coordination format" or specify a minimum same_target cross-frame mapping.
Determinism (§10.2) conflicts with `graph_subgraph` overlap (§7.1) — if expand_hops resolves against a live (mutating) Graphonomous graph, recompute_conflicts is non-deterministic across time. Either snapshot the graph at evaluation time, require self-contained selectors (no expand_hops), or carve graph-substrate conflicts out of the determinism guarantee.
Field-naming reconciliation needed. The Gap A envelope above uses horizon (a richer time-window concept covering "active during phase X" / "valid until window Y"); the v0.1 draft uses expires_at (single timestamp). Pick one before v0.1 final — horizon is more expressive and maps cleaner onto PULSE phases.
Misframed dependencies in the draft:
§16 misframes the [&] relationship as "v0.2 maturation of &space.region and &space.claim." AmpersandBoxDesign/SPEC.md §4.4 currently defines &space.* with three subtypes only (fleet/route/geofence); SCOPE introduces region and claim as new subtypes — backward-compatible, but the framing matters for protocol historians.
§13.1 PULSE token registration is currently impossible — see §6.7 below. PULSE v0.1.2 vendor-namespace mechanism is a hard prerequisite.
§13.2 references "OS-E003 Region-Scoped Continual Learning Benchmark" — no such benchmark number has been issued by PRISM. Drop the OS-E003 number; refer to it descriptively.
§13.4 Graphonomous region-scoped retrieval is correct division of labor but Graphonomous has no region scoping today. The Node schema (graphonomous/lib/graphonomous/types/node.ex) has no region field. SCOPE v0.1 should document Graphonomous-side dependency parallel to the PULSE v0.1.2 dependency.
Prior-art map for §0.5 of the spec. SCOPE has two genuine novelties — substrate-agnostic frames (lifted from tf2, generalized) and substrate-agnostic typed claims with strength gradient (synthesized from etcd/Chubby + Yjs awareness + MAPF). The rest is assembly. The spec should explicitly cite: ROS REP 105 / tf2 (frames), W3C Web Annotation (selectors via refinedBy; SCOPE selectors should map onto W3C selector vocabulary where possible), MAPF Conflict-Based Search (typed conflicts as first-class records), Yjs awareness + Liveblocks presence (ephemeral broadcast claims with TTL), etcd leases / Chubby (advisory locks + strength gradient).
Recommended pitch. "Awareness for typed regions, across substrates" — Yjs awareness is the most-recognized analog every collaborative-software builder already has cached. Names the three concrete extensions (typed regions, frames, strengths) that justify SCOPE's existence. Avoids over-promising (MAPF: implies a planner SCOPE will never have) and under-positioning (W3C Web Annotation: descriptive not coordinative). Audience-specific secondary pitches: "tf2 generalized beyond rigid-body transforms" (robotics), "etcd leases, but typed and substrate-aware" (distributed-systems), "the spatial layer A2A and MCP don't have" (agent-protocol).
Engineering risks the draft is silent on (paid-for lessons from production predecessors): fencing tokens for mandatory (Kleppmann via etcd/Chubby), selector resolution drift in document_span (Hypothesis fuzzy anchoring — store multiple selectors per anchor like W3C refinedBy, not single), UTF-16/UTF-8/grapheme-cluster encoding negotiation (LSP PositionEncodingKind), clock skew on expires_at (logical-clock counterpart needed), GC of superseded chains (CRDT tombstone bloat), binary wire profile for >1Hz presence (Yjs awareness is 10–50× lighter than JSON envelopes), authority signature story (A2A v1.0 Signed Agent Cards added 2026 because unsigned claims are spoofable).
The CL field is algorithm-shaped, not protocol-shaped. Mem0/Letta/Zep/Cognee occupy services; almost no portable diffable substrate exists.
7-stage consolidation pipeline already does CLS-style episodic→semantic transformation
Wilson-interval epistemic frontier, goal coverage scoring, GDPR cascade forget, weighted-Dijkstra trace-evidence-path
Document the existing pipeline against CLS terminology (Hassabis 2017, Kumaran/Hassabis/McClelland) so reviewers can map cleanly
| Find | What | Composes with | |||
|---|---|---|---|---|---|
| Boundary/Drift Signal token (PULSE v0.1.2) | BoundaryDetected { detector, statistic, p_value, scope, suggested_action } + ConceptDriftSignal { concept_id, drift_type, magnitude, half_life_estimate } as cross-loop tokens, sibling to SurpriseSignal | PULSE v0.1.2; Graphonomous consolidation hint; PRISM eval segmentation | |||
| Plasticity Lattice | Per-node-type stability/plasticity declaration: user_pref: 0.9, org_policy: 0.05, api_signature: 0.0. Consumed by learn_outcome (confidence-update rate) and consolidate_idle (merge aggressiveness) | Native Graphonomous schema extension; PRISM benchmarks the trade-off curve | |||
| Refutes anti-edge | First-class negative knowledge: refutes(node_a, node_b, evidence, decisive_for_kappa: bool) so failed-approach knowledge routes into κ-deliberation as evidence-against, not as a competing positive claim | One-line edge-taxonomy change in Graphonomous; κ-routing already handles cyclicity | |||
| Skill Portability Manifest | `binding: model_version_bound \ | family_bound \ | portable \ | substrate_only + validated_against: [...] + regression_probes + fallback_behavior` | Critical for model-upgrade treadmill; Graphonomous tags procedural nodes; PULSE emits ModelMigrationEvent; FleetPrompt registry uses binding as facet |
| Capability Delta Card (CDC) | Typed delta artifact after every learn/consolidate: {before_hash, after_hash, deltas[], attribution}. Turns PRISM continuous, not periodic | PRISM emits; trace-evidence-path attributes; curriculum consumes | |||
| Replay Bundle Format | Portable prioritized replay (priority, td_error, recency, task_id) anchored to Graphonomous nodes | Output of consolidation; PRISM BYOR fixture; FleetPrompt tradable artifact | |||
| CurriculumProposal | {proposed_goal, prerequisites_met[], estimated_capability_delta, replay_bundle_ref, expected_cost, falsifiable_outcome} | Pairs with refutes anti-edge; PULSE cross-loop token; Delegatic policy gates |
~1KB spec. Sibling to existing SurpriseSignal. Unlocks task-boundary + concept-drift detection across the whole stack in one shot.
After verification, these are the genuinely-empty seats outside the portfolio:
Five candidates share one structural property: they are all typed provenance envelopes for different acts:
Oracle Query — {hypotheses, distinguishing_question, expected_information_gain, fallback} (typed "agent asks for help")
Grounding/Citation — {output_span → source_span, confidence, retrieval_method, reproducibility_hash} (natural BendScript v0.2 link facet)
Capability Handoff — {delegated_capabilities, scope, budget, expiry, revocation_handle, parent_provenance} (Delegatic's killer use case — A2A does transport, not delegation contracts)
Synthetic Data Provenance — row-level {generator, ancestors, contamination_flags, confidence_for_train, confidence_for_eval}
Replay Manifest (already shipped at body level — only the LLM-side equivalent is the open seat)
There may be a meta-protocol underneath them all: PEP — Provenance Envelope Protocol that the five specialize as profiles. Single OS-0XX submission with five specialized profiles, much smaller total spec surface, stronger composition with Graphonomous (which already wants provenance as first-class).
| Candidate | Why empty |
|---|---|
| AAH — Agent-Affordance-Hypermedia | HATEOAS reborn for resource-scoped affordances. MCP is connection-scoped, OpenAPI is global; nobody owns resource-scoped contextual affordances. |
| Shape Protocol (LinkML/SHACL for agent state) | SHACL too academic, JSON Schema too weak, Cue doesn't model graphs. Direct fit Graphonomous. |
| Failmode taxonomy schema | MAST/MAESTRO/OWASP publish taxonomies but no shared on-disk schema. Every framework re-encodes inline. |
| Agent Contracts schema | arXiv 2601.08815 (COINE 2026) literally states no protocol provides formal resource-governance. Paper exists, no JSON schema yet. |
| Causal trace (dual to ATIF) | ATIF/agent-trace race for sequential trajectories; neither stores why this step caused that step. κ-substrate territory. |
Agent identity / DID — AGNTCY, AITLP, SD-Card, W3C Digital Credentials, OpenAgents AgentID, Microsoft Entra Agent ID — 5+ live IETF drafts as of 2026-04
Whole-agent definition language — Open Agent Spec, Microsoft declarative manifest, AgentSpec, SuperSpec, DALIA — at least 5 competitors
Agent-to-agent transport — A2A absorbed ACP under Linux Foundation (April 2026); ANP, ACIP, multiple IETF drafts live
Agent observability spans — OpenTelemetry-GenAI consolidating fast; ATIF and Cursor agent-trace racing for trajectory format
Memory consolidation as service — Mem0/Zep/Letta/Cognee competing; Graphonomous is your answer, don't fork
Sandbox manifest — closed April 2026 (OpenAI Agents SDK Manifest with E2B/Modal/Vercel/Daytona/Runloop behind it)
Capability negotiation — ACNBP (arXiv 2506.13590) covers it
Theory-of-mind state — academic, not protocol-shaped (SymbolicToM is research)
Goal trees / HTN-task — ReAcTree, GoalAct, HWSP all 2025-2026, crowded
Model-routing manifest — OpenRouter :nitro/:floor + LiteLLM cover it
Time-series substrate — Apache Arrow + DuckDB + Polars own it
Knowledge graph format — RDF/JSON-LD won general; BendScript wins agent-doc slice; don't relitigate
Protocols that the existing portfolio specs imply needing but never formalized.
The authoritative protocol index (opensentience.org/docs/spec/README.md) defines OS-001–OS-011. Everything below is reserved here. Update this table whenever a new slot is claimed to prevent re-collision.
| Slot | Name | Status | Anchor |
|---|---|---|---|
| OS-012 | SCOPE — N-D Region Algebra + SpatialClaim envelope | deferred — reviewed design only, no spec file; blocker #1 (PULSE v0.1.2 vendor tokens) cleared 2026-06-12, still blocked on Graphonomous region + wired consumer (see §3 decision note) | §3, Tier A row 5 |
| OS-013 | Telemetry Unification | candidate | §6.3, Tier A row 6 |
| OS-014 | Affordance Projection function | candidate | §6.4, Tier S row 4 |
| OS-015 | Viewport Binding (RuneFort) — largely subsumed by SCOPE | conditional | §6.5 |
| OS-016 | Autonomy Budget | candidate | §6.6 |
| OS-017 | unallocated (was PACT — withdrawn 2026-05-25, see §6.14) | free | — |
| OS-018 | unallocated (was TALLY — withdrawn 2026-05-25, see §6.15) | free | — |
| OS-019 | Credentials Transfer | candidate | §6.2 |
| OS-020 | FGAP — Federated Graph Aggregation Protocol | deferred | Tier C row 18 |
| OS-021 | Multi-Embodiment | deferred (6+ months) | Defer §7 |
OS-017 and OS-018 were briefly reserved on 2026-05-24 for PACT (Principal Protocol) and TALLY (multi-currency ledger), then withdrawn on 2026-05-25 after STACK_ARCHITECTURE_GAP_REVIEW.md Findings 4 and 10 demonstrated that both fail the §1.1 extraction gate (two-consumer test, portable-artifact test). They are now tracked as implementation work inside existing products (§6.14, §6.15). The slots are free; they should not be re-claimed without passing §1.1 first.
bendscript.com/docs/spec/README.md:173-181 declares four reserved vocabularies (alongside core, which is shipped) with zero edge-predicate or block-kind specification:
bendscript.argument.v1 — Toulmin (claim/warrant/rebuttal/qualifier) for Deliberatic + κ deliberation outputs
bendscript.memory.v1 — Graphonomous node-kind vocabulary (semantic / episodic / procedural / belief-state)
bendscript.spec.v1 — capability/contract/invariant/precondition terms for cross-spec citation
bendscript.runefort.v1 — workspace/pane/tab embedding vocabulary
Days of work each. Real consumers waiting (Deliberatic, Graphonomous, SpecPrompt, RuneFort).
BendScript v0.1 final is gated on (a) §8 LLM round-trip evidence and (b) §14 written with at least one portfolio adopter committed to bend: URIs. Graphonomous via `bendscript.memory.v1` is the obvious first adopter — shipping that vocabulary doubles as gating-criterion satisfaction.
(Originally numbered OS-012 in earlier drafts; renumbered 2026-05-24 to free OS-012 for SCOPE, which dominates §3.)
WebHost.Systems §40 mentions "write-only secrets API" — never actually specified. FleetPrompt install, WebHost deploy, Delegatic policy, OpenSentience harness all assume secrets flow through them but no schema exists. You currently can't deploy a FleetPrompt agent to WebHost without manually injecting secrets outside the spec. Blocks the dark-factory closed loop.
WebHost emits {tokens_in, tokens_out, latency_ms, ...}, PRISM emits {scenario_id, dimension_scores, ...}, PULSE emits CloudEvents envelopes, Graphonomous emits {action_id, status, causal_nodes[], ...}. Same domain, four shapes, no canonical mapping. STACK_COMPLETION's §3.4 admits cross-loop wiring uses simulator MCP client — not exercised end-to-end.
Affordance enumeration already exists. The missing piece is just affordances(agent_id, policy_context) → {actions[]} as a contract. body.os spec literally says "bounded by the current affordance set, which is policy-filtered by Delegatic" — but the projection function isn't a first-class contract.
runefort.com/docs/spec/runefort.core.md:66-86 declares signal/threshold/navigation primitives but no transport schema. Each host app reinvents WebSocket/SSE/polling. Largely subsumed by OS-012 SCOPE if shipped.
graphonomous/lib/graphonomous/cost_tracker.ex + MODEL_TIER_PROMPT.md + PROTOCOL_PROMPT.md §3.11.1 all encode budget concepts, none unified. No way to declaratively say "spend max $0.50 and 30s per SCC, or escalate."
6+ implicit tokens used across the portfolio that aren't canonical: CredentialInjectionRequest, AffordanceSnapshot, TelemetryAggregate, SkillProvenanceRecord, BreachAlert, ModelTierDecision. Plus the new BoundaryDetected, ConceptDriftSignal, ModelMigrationEvent, FleetMergeRequest, CurriculumProposal, SpatialClaim recommended by §3 and §4.
Vendor-namespace token mechanism — SHIPPED 2026-06-12 (`in_tree`). PULSE v0.1.1's token field was a closed enum of the six canonical tokens with no extension pattern. As of 2026-06-12 the v0.1.2 vendor-namespace mechanism is implemented across all layers:
Schema — connection.token is now oneOf the canonical enum or the vendor pattern ^[a-z][a-z0-9_]*\.v[0-9]+\.[A-Z][A-Za-z0-9]*$ (PULSE/schemas/pulse-loop-manifest.v0.1.json). Additive/backward-compatible; the pulse/opensentience/os prefixes are reserved.
Spec — OS-010 §6.7 "Vendor-Namespaced Tokens (v0.1.2)" defines the form <vendor>.v<N>.<TokenName>, CE-type derivation (<vendor>.<snake(Name)>.v<N>), opaque payloads, and reserved prefixes. §6 corrected to six canonical tokens (folds in the missing SurpriseSignal); §16.1 stability list updated.
Runtime — tokens.ts adds VENDOR_TOKEN_RE, isCanonicalToken/isVendorToken/isValidToken, and ceTypeFor vendor derivation; emit_signal accepts vendor tokens; payloads typed PulseTokenData (opaque for vendors).
Tests — 5 added cases (canonical accept, vendor accept, 4 malformed rejects, helper classification, CE-type derivation); full suite 8/8 green, tsc clean.
This discharges SCOPE blocker #1. A SCOPE manifest can now register scope.v1.SpatialClaim (and the scope.v1.* family) against PULSE's connection layer without enlarging the canonical enum. SCOPE's remaining blockers are (2) a Graphonomous region field + ≥1 real region-scoped consumer, and (3) the §1.1 wired-arrows gate. The mechanism also unblocks the Tier S Boundary/Drift tokens (§4), which can ship as scope-independent vendor or future-canonical tokens.
Note (publish): the
os-pulsenpmpackage.jsonis still at0.1.1; bumping to0.1.2+ republish is a release decision left to Travis. The protocol-version mechanism (manifests may declarepulse_protocol_version: "0.1.2") is in tree and tested now.
Every manifest in PULSE/manifests/ redeclares the canonical 5-phase pattern. Should be extends: "core_loop" plus delta.
Fields exist (superseded_by, forgotten_at, creation_source); only the formal automaton declaration is missing.
Basic Bayesian smoothing exists. Wilson interval / Dempster-Shafer evidence combination, q_value semantics, derivation_proof / confidence_history are the gap.
graphonomous/lib/graphonomous/reranker.ex exists in code, no protocol spec. Agents can't declare ranking weights/filters declaratively.
ampersand-supabase/ARCHITECTURE.md:118-120 forbids cross-schema FKs with no replacement protocol for service discovery, shared queries, event broadcasting.
Status: implementation track, not a protocol slot. Withdrawn per STACK_ARCHITECTURE_GAP_REVIEW.md Finding 4.
Why no protocol slot yet. Agent identity is a saturated seat (§5 — 5+ live IETF drafts: DID, AGNTCY, AITLP, SD-Card, W3C-DC, OpenAgents-AgentID, Microsoft-Entra-Agent-ID). Mature prior art already covers the four genuine needs: DID for portable identifiers, VC 2.0 for attestations, UCAN for delegated/attenuated capability grants, GNAP for dynamic grant negotiation, OCapN/object-capability thinking for runtime authority. Fails §1.1 extraction gate on "two consumers" (only Delegatic needs it today) and "portable artifact" (the binding artifact lives entirely in Supabase + Delegatic).
Motivating gap (real, but solvable inside existing products). Delegatic's AuthorizationBlock (delegatic/lib/delegatic/authorization_block.ex) HMACs (policy_id, approved_by, approved_at, expires_at) with approved_by as a free-form string and no public-key binding (line 19 marked "unsafe for prod"). Delegatic memberships key on Delegatic.Accounts.User; the principal layer that would hold the binding is the missing piece.
Recommended implementation (no new protocol):
amp.principals — workspace-scoped principal records
amp.principal_bindings — bindings to DIDs, OAuth identities, service accounts
amp.capability_grants — UCAN-shaped delegated grants (issuer, audience, capability, caveats, expiry, proof)
amp.grant_revocations — revocation log
delegatic.authorization_blocks.principal_id — FK into amp.principals
delegatic.authorization_blocks.capability_grant_ref — FK into amp.capability_grants
PULSE/telemetry standard dimensions: principal_id, grant_id, scope_id, lease_id
Extraction test (when to revisit as a protocol). PACT becomes a protocol candidate only when the binding/grant artifact is consumed outside Supabase + Delegatic (e.g., an external implementation reads/writes grants; or a second internal product needs to issue grants without going through amp.*).
Status: implementation experiment, not a protocol slot. Withdrawn per STACK_ARCHITECTURE_GAP_REVIEW.md Finding 10.
Why no protocol slot yet. The seven-currency thesis in topology-as-authority.html §07 (ω Opson, ν Nexus, ε Episteme, φ Phos, δ Demurra, γ Grava, θ Tithon) is interesting but does not yet require a new protocol. ν+θ can be shipped as a webhost.billing event-ledger experiment aligned with REA/hREA (Resource-Event-Agent) prior art — balances as derived views, events as canonical state. Fails §1.1 extraction gate on "two consumers" (only WebHost needs billing today) and "portable artifact" (no external system consumes the ledger).
Recommended implementation (no new protocol):
Event-sourced θ (USD) ledger in webhost.billing schema; REA-style agents / resources / events / commitments / fulfillment
Balances derived from event stream, not stored
Optional ν (mutual credit) ledger as a second event stream — used to test whether ν changes routing/settlement/resilience decisions in a way θ alone cannot
Idempotency/exactly-once posting rules; provider event-ID dedupe
PACT grant requirement for ledger mutation (composes with §6.14)
Privacy/redaction classes per Finding 11
Open empirical questions (drive the experiment, not the spec):
Does ν add measurable decision signal beyond θ? If not, the seven-currency thesis weakens.
Where does demurrage (δ) actually load-bear? Wörgl/Gesell/Peanuts converged on ~1%/month empirically — is that a webhost.billing parameter, or a separate experiment?
Conjecture 5 (multi-currency vs single-currency control fleet) probably can't be tested until ω + φ + ε also ship — that's deferred falsification, not a v0.1 scope question.
Extraction test (when to revisit as a protocol). TALLY becomes a protocol candidate only when (a) at least two products need the same portable ledger semantics, AND (b) the artifact escapes Supabase. Keep all seven currencies as a registry/thesis, not a protocol surface, until extraction pressure forces otherwise.
Several product specs are protocol-capable but haven't been extracted:
Delegatic → &govern.policy substrate (org-tree is product; policy evaluation is substrate)
AgenTroMatic → &reason.consensus substrate (deliberation is product; consensus/voting is substrate)
TickTickClock → &time.analysis substrate (orchestration is product; anomaly/forecast primitives are substrate)
GeoFleetic → &space.query + &space.learn substrates (fleet management is product; spatial primitives are substrate — and Gap B/NDR is the missing primitive these would all build on)
RuneFort is no longer in this list. Post-pivot (2026-04-28, see STACK_COMPLETION.md §2.2), RuneFort is itself a layout protocol (@runefort/core v0.1.0-alpha.1 + 1150-line 3-file spec at runefort.com/docs/spec/{runefort.protocol.md, runefort.core.md, runefort.dsl.md}); the [&] supervisor floor is one application of the protocol, not the protocol itself. The eventual bendscript.runefort.v1 vocabulary becomes the bridge between BendScript documents and RuneFort layouts — that's the substrate-on-protocol layering, not a further extraction.
Ranked by leverage × empty-seat-quality × portfolio-fit, accounting for what's already built.
| # | Item | Effort | Why |
|---|---|---|---|
| 1 | BendScript reserved vocabularies × 4 (argument.v1, memory.v1, spec.v1, runefort.v1) | 2-3 days each | Stub-only with committed consumers |
| 2 | PULSE v0.1.2: Boundary/Drift Signal tokens | 1 day | Smallest spec, biggest CL unlock; sibling to SurpriseSignal |
| 3 | OS-012 Credentials Transfer | 3 days | Blocks dark-factory closed loop today |
| 4 | OS-014 Affordance Projection function (small piece on top of existing affordance enum) | 4 days | Unblocks AgenTroMatic + GeoFleetic composition |
| # | Item | Effort | Why |
|---|---|---|---|
| 5 | OS-012 SCOPE — DEFERRED, do not start (decision 2026-06-12, §3). No spec file exists; the sections 0–17 "draft" is a reviewed design, not an artifact. Blocked on two confirmed-missing hard prerequisites (PULSE v0.1.2 vendor-namespace tokens; Graphonomous region field) and the §1.1 wired-arrows gate (no wired consumer). Unblock order: PULSE v0.1.2 (Tier S, §6.7) → Graphonomous region + a real region-scoped consumer → only then consumer-gated SCOPE v0.1. The design (3 region kinds + 6–7 claim types + 3 strength levels, subscription contract promoted normative, horizon vs expires_at reconciled) is the input to that future work. | — (do not schedule until prereqs land) | Architecturally the cleanest research result, but blocked; naming it now would manufacture a vX.0 that nothing flows through |
| 6 | OS-013 Telemetry Unification | 1 week | Enables observability + cost tracking |
| 7 | Plasticity Lattice (CL Find 4) | 1 week | Local Graphonomous extension; PRISM-measurable |
| 8 | Refutes anti-edge (CL Find 7a) | 3 days | One-line edge taxonomy change; big semantic gain |
| 9 | `&govern.policy` substrate extraction from Delegatic | 1 week | Unblocks 4 downstream consumers |
| # | Item | Effort | Why |
|---|---|---|---|
| 10 | Skill Portability Manifest (CL Find 1) | 2 weeks | Most strategically valuable for model-upgrade treadmill |
| 11 | Capability Delta Card (CDC) (CL Find 6) | 2 weeks | Turns PRISM continuous, not periodic |
| 12 | Capability Handoff envelope | 2 weeks | Delegatic's killer use case; window closing as OpenAI Agents SDK ships handoffs in production |
| 13 | Grounding/Citation as BendScript v0.2 facet | 2 weeks | What BendScript was designed around |
| 14 | Provenance Envelope Protocol (PEP) meta-protocol | 3 weeks | Unifies Oracle/Grounding/Handoff/SynthData — highest-leverage single new protocol |
| 15 | Replay Bundle Format (CL Find 2) + CurriculumProposal (CL Find 7b) | 2 weeks combined | Continual learning closure |
| 16 | OS-016 Autonomy Budget | 2 weeks | Unifies cost+time+action across CostTracker/MODEL_TIER/PROTOCOL_PROMPT |
| 17 | PULSE v0.2 phase templates + token registry expansion | 2 weeks | Reduces boilerplate; formalizes the 6+ implicit tokens |
| # | Item | Effort | Why |
|---|---|---|---|
| 18 | OS-020 FGAP (federated graph aggregation) | 4 weeks | Ship after Graphonomous has multi-instance deployments (originally numbered OS-013; renumbered 2026-05-24) |
| 19 | Confidence Calibration Algebra (advanced) | 3 weeks | Wilson / Dempster-Shafer on top of existing basic algebra |
| 20 | Memory Schema Migration DSL | 4 weeks | Becomes urgent at v0.5 schema break |
| 21 | Forgettable Memory cascade (k-anon, DP) | 4 weeks | EU AI Act forces by Q3 2026 |
| 22 | AAH (Agent-Affordance-Hypermedia) | 3 weeks | Biggest reach extension into general API ecosystem |
| 23 | Shape Protocol (LinkML/SHACL-for-agents) | 4 weeks | Typed graph constraints |
| 24 | Failmode taxonomy schema | 3 weeks | Industry play |
| 25 | Agent Contracts schema | 2 weeks | Industry play; arXiv 2601.08815 does most of the hard work |
| 26 | Causal trace (dual to ATIF) | 4 weeks | Industry play; fits κ-routing |
OS-021 multi-embodiment — wait for single-body production data (6+ months) (originally numbered OS-014; renumbered 2026-05-24)
Synthetic Data Provenance — first-mover advantage in ~12 months; not urgent
Whole-agent definition language — saturated; don't enter
Most pass-1 OS-XXX numbered slots without empty-seat justification — naming is not progress
The "100s to 1000s" vision scales as vocabularies + profiles on ~12-15 protocols, not 1000s of separate protocols. Look at the existing pattern: BendScript reserves five vocabularies; each is a few dozen typed concepts. Multiply by ~12 protocols at maturity = ~60 vocabularies, ~6,000 typed concepts. That's the real surface area.
Don't buy domains for new protocols. Use subpaths under what you already own:
Spatial pair (OS-012 SCOPE) → opensentience.org/spec/OS-012-SCOPE.md
BendScript vocabularies → bendscript.com/docs/spec/vocabularies/
PEP meta-protocol → ampersandboxdesign.com/spec/pep or pep.ampersandboxdesign.com
Spec extensions → specprompt.com/spec/<vocab>
The domain-per-protocol pattern (runefort.com, bendscript.com) was right when standalone identity for external partners mattered. For internal-thesis-extending protocols, namespace them under the natural composition role.
Finish what's half-built first (Tier S) — highest immediate ROI, no design risk
Architectural unifications next (Tier A) — OS-012 SCOPE delivers 6+ dimensions at once; cheaper than 6 protocols
Industry plays last (Tier B/C) — only after the portfolio is internally coherent
Multi-agent CL in shared space requires exactly the three empty seats (NDR + CLAIM + FGAP). When the most ambitious composite use case requires exactly the empty seats and no more, the cuts are right.
Adopted 2026-05-25 from STACK_ARCHITECTURE_GAP_REVIEW.md §7. This is the optimization target the stack should be measured against — more important than naming more protocols:
Every consequential agent action is authorized by a principal-bound grant, bounded by a scope, emitted as an observable event, wrapped in provenance, stored with evidence, replayable under policy, and benchmarkable by PRISM.
Mapping each clause to the substrate:
| Clause | Substrate |
|---|---|
| principal-bound grant | §6.14 (amp.principals + amp.capability_grants + Delegatic) |
| bounded by a scope | OS-012 SCOPE region/claim |
| observable event | PULSE v0.1.2 + OTel trace context |
| wrapped in provenance | PEP envelope (Tier B §7 row 14) |
| stored with evidence | Graphonomous + W3C Web Annotation selectors |
| replayable under policy | OS-011 replay + Delegatic policy |
| benchmarkable by PRISM | PRISM Evidence Bundle |
If a roadmap candidate doesn't move this invariant from "true for zero vertical paths" toward "true for one complete vertical path," it should defer to candidates that do.
Added 2026-05-28. This section answers two questions the prior sections don't: *how does the stack rate against its own thesis (not against "is it built")*, and what "systems that build systems" are we missing. It is the synthesis pass over the three theory artifacts (STACK_PROOF.html, STACK_TOPOLOGY_AS_AUTHORITY.html, STACK_PERIODIC_TABLE_OF_AGENT_INVARIANTS.html), the Workbench/Supervisor specs, and the live code audit.
The stack's own thesis, distilled from the three theory documents:
Topology is authority. A system's structural position in a graph (κ cyclicity, β persistence, σ conflict, π phase-order, the governance lattice) grants the authority it may exercise — provably, not by convention.
Composition over monoliths. Capabilities compose via ~12–15 protocols + vocabularies, never 1000s of bespoke protocols. Extraction is disciplined (§1.1 gate).
Proof, not vibes. Every claim is backed by a replayable evidence artifact: "valid because replay produces evidence, not because a model said so."
The dark factory. The loop perceive → record → consolidate → crystallize → ship → install+replay → PRISM-measure runs autonomously and closes.
Continual learning as portable substrate, not a hosted service.
Rated against the thesis above — i.e. against the stack's own ambition, which is a far harder bar than "did we build a thing."
| Goal | Architecture / theory | Evidence in running code | Grade |
|---|---|---|---|
| 1. Topology is authority | κ proof is real (1,926,351 systems, JSV-categorical); governance 4-law lattice proved; β/σ/π shipped | κ/β/σ live in Graphonomous; but only 10 / 43 periodic-table invariants are proved-or-shipped; 21 are still `missing` (symbol "?") | 9 / 6 (theory / evidence) |
| 2. Composition over monoliths | §1.1 extraction gate is genuinely rigorous; PACT + TALLY were withdrawn when they failed it — rare discipline | [&] validator + 6 MCP servers compose live; vocabularies stubbed (BendScript ×4) | 9 / 7 |
| 3. Proof, not vibes | Workbench proof-gate model is the sharpest idea in the stack; verifier ≠ producer | Workbench: 6 gates, 112 tests, smoked. But the 6 gates cover ~6 of 43 invariants, and no cross-machine live flow has ever executed end-to-end | 9 / 4 |
| 4. Dark factory | Fully specified perceive→measure loop | 2 / 7 steps live, 5 / 7 in-tree. PRISM has only ever scored Graphonomous — never a third-party system | 8 / 4 |
| 5. CL as substrate | Strong, well-grounded against CLS literature | Graphonomous is genuinely implemented (Tarjan, Wilson, 7 algos, EXLA, SQLite, 5-machine MCP) | 9 / 8 |
Weighted e2e: architecture/theory ≈ 8.8 / 10; proof-in-the-pudding ≈ 5.5 / 10; blended ≈ 6.7 / 10 against the thesis's own bar. (STACK_COMPLETION's 8.3 is correct against "is it built"; this lower number is deliberate — it grades against "proof, not vibes," where the evidence gap dominates.)
The gap is not architectural and not "is it built." It is evidence production at scale. Three numbers capture it:
43 invariants enumerated, 6 with executable proof gates (workbench/app/src/lib/bundle/verify.ts). The periodic table is a 43-cell promise; verify.ts is a 6-cell down-payment.
1 invariant (κ) with a machine-checked proof artifact; the rest are prose + (sometimes) code.
0 third-party systems scored by PRISM. The benchmark that is supposed to grade everyone has only ever graded its own sibling.
The user's instinct is correct: the Workbench "school" (Supervisor) is the right lever for this gap. It is the only autonomous-skill-generation formulation in the field whose verifier it did not build (PRISM gates), so its central claim — a curriculum is valid because every skill independently passes the gate, an out-of-context devil's advocate failed to find a cheap-pass, and coverage carries a Wilson lower bound — is enforceable, not aspirational (SUPERVISOR.md §0.4, §4.5, §5.3).
But the school is gated on a prerequisite the spec names but does not solve: "additional invariants become eligible the moment their verifiers ship in bundle/verify.ts" (SUPERVISOR.md §5.2). The school can only teach the 6 invariants it can verify. Turning 37 non-shipped periodic-table cells into curricula requires manufacturing 37 proof gates — and nothing in the stack is a loop whose output is proof gates. That is the missing institutional loop (§10.5, Loop B).
The stack is a tower of nested loops, each producing the input to the one above:
| Level | Loop | Produces | Status |
|---|---|---|---|
| L0 | Agent loop — Graphonomous 5-machine (retrieve→route→act→learn→consolidate) | graph mutations (knowledge) | live |
| L1 | Teach loop — Workbench factory.run_one | one verified SkillBundle | in_tree (112 tests) |
| L2 | Teacher loop — Supervisor (charter→curriculum) | one CurriculumBundle per invariant | spec (v0.2 draft; v0.1 data layer in_tree) |
| L3 | Registrar / School — accumulates curricula across invariants over time | InvariantLedger, TeacherLedger, AlumniLedger | spec (v0.2 ships CellLedger scaffolding only) |
| L4 | (unfilled) | — | — |
L2 is the first true "system that builds systems" — it builds skill libraries. L3 is the institution that remembers being a school. Both are designed; neither orchestration layer is in_tree. Shipping L2→L3 is the single highest-leverage move for the proof-in-the-pudding gap, because it converts the periodic table from a static census into a self-populating evidence factory.
Ranked by leverage on the thesis. The first is designed-and-waiting; the rest are net-new.
Loop A — Registrar / School (L3). Designed (SUPERVISOR.md §8.4–8.5), scaffolding in_tree. Ship the full Registrar: 4 ledgers + /school dashboard (invariant × model × time) + cross-charter consolidation phase. This is the institution layer — without it, every curriculum is one-shot and the school never compounds. Effort: comparable to the Supervisor itself (~1 PR). Prerequisite: Supervisor v0.2 orchestration layer ships first.
Loop B — Gate Foundry (verifier-synthesis loop). THE unlock for the periodic table. A loop whose output is proof gates (verify.ts predicates / MCPInvariantPack entries), not skills. Today the binding constraint on the entire school is "6 of 43 invariants have gates," and there is no system that manufactures more. The Foundry closes that:
input: a named/sketched/missing periodic-table cell (formal definition + authority + math source),
process: synthesize a candidate verifier → generate valid/invalid/replay/skew/redaction fixtures (the §1.1 conformance-fixture set) → run the devil's advocate against it → harden until the advocate stops finding cheap-passes,
output: a shipped verify.ts gate + fixtures + a new periodic-table cell promoted missing → shipped.
The devil's-advocate machinery already exists in the Supervisor and already produces exactly the right signal ("advocate found a gate-miss" = "strengthen the gate"); the Foundry is the loop that consumes that signal to mint gates instead of discarding it. This is the literal machine that turns the periodic table from a 23%-complete census into a self-completing one. Effort: medium; it reuses the Supervisor panel + the §1.1 fixture discipline. Recommend prototyping it as a Supervisor charter family whose manifestation space is "candidate gate predicates."
Loop C — Provost (supervisor-of-supervisors / meta-charter). Deferred in SUPERVISOR.md §13. Reads the InvariantLedger (L3) for portfolio coverage gaps and commissions which invariant to teach next — the school directing its own curriculum toward where the periodic table is weakest. Closes the self-direction loop: L3 reports gaps → Provost issues charters → L2 fills them → L3 updates. Gated on Loop A (needs the InvariantLedger to read).
Loop D — Extraction Observatory. The §1.1 protocol-extraction gate is currently a manual human judgment applied retroactively (it's how PACT/TALLY got withdrawn). A loop that watches cross-product artifact usage and auto-flags candidates that have crossed the "two-consumers + portable-artifact" threshold would make protocol extraction a measured event rather than a periodic manual audit. Lower leverage than A/B/C but it's the only loop that keeps goal #2 (composition discipline) honest as the portfolio grows. Effort: small; mostly telemetry over PULSE token traffic — composes with OS-013 Telemetry Unification (§6.3).
Loop E — Currency circulation (economic). The 7 economic invariants (ω/ν/ε/φ/δ/γ/θ) are all sketched/named and describe a circulation system, but PULSE tokens are only the wiring — nothing runs the economy. Per §6.15 this stays a thesis/experiment, not a protocol, until extraction pressure forces it. Defer; listed for completeness so it isn't mistaken for an oversight.
This reframes §7's protocol backlog under the thesis. §7 remains the detailed effort/sequencing table; this is the why-now ordering against goal #3 (proof, not vibes), which is where the stack is weakest.
| Rank | Component | Upgrade | Moves which goal | Cross-ref |
|---|---|---|---|---|
| 1 | Workbench → Supervisor L2 | Ship the v0.2 orchestration layer (charter→curriculum, panel, CellLedger) | #3, #4 — turns 1 evidence artifact into N per invariant | SUPERVISOR.md §4, §7 |
| 2 | Gate Foundry (Loop B) | Verifier-synthesis charter family; promote ≥6 more periodic-table cells missing→shipped | #1, #3 — the periodic-table unlock | §10.5-B |
| 3 | PRISM | Score the first third-party system; ship ingest_curriculum_bundle endpoint | #3, #4 — kills the "only ever scored its sibling" gap | SUPERVISOR.md §8.2 |
| 4 | Cross-machine live flow | Execute one full dark-factory vertical end-to-end (the §9 architectural invariant, "true for one complete vertical path") | #4 | §9 |
| 5 | Registrar / School (Loop A) | Full 4-ledger institution + /school dashboard | #3 compounding | §10.5-A |
| 6 | Provost (Loop C) | Meta-charter reading InvariantLedger coverage gaps | self-direction | §10.5-C |
| 7 | Protocol backlog (Tier S/A) | BendScript vocabularies, PULSE v0.1.2, SCOPE v0.1, Credentials Transfer | #2, unblocks #4 | §7 |
Sequencing principle for this section: goal #3 (proof) is the lagging metric and the thesis's own headline claim, so ranks 1–4 all attack it directly. Protocol naming (§7 Tier B/C, industry plays) stays after the stack can demonstrate one complete proven vertical — naming more protocols does not move the proof-in-the-pudding number.
2026-04-28 — Initial draft. Synthesis of four research passes (external industry scan + internal portfolio audit + niche probe + verification + goal-targeted CL/spatial research). Verification corrected nine prior "missing" recommendations to "shipped" (most notably Replay-Determinism Manifest, which is fully implemented in OS-011). Spatial collapse identified (15 dimensions → 2 + 1 gaps). PULSE Boundary/Drift Signal identified as smallest highest-ROI single addition.
2026-04-28 (later) — Reconciled with STACK_COMPLETION.md update covering BendScript and RuneFort pivots:
§2 Verification audit — BendScript core vocabulary mechanism row updated to cite @bendscript/core v0.1.0-alpha.0 (TypeScript reference: parser/validator/round-trip harness, 96 tests passing) and v0.1 draft spec (678 lines); core is the fifth reserved vocabulary and is shipped.
§3 Spatial collapse — Region.kind mappings made explicit: grid ↔ RuneFort protocol primitives, graph ↔ BendScript typed inline link facets, geo ↔ GeoFleetic, document ↔ shared whiteboard/canvas. Confirms NDR is the right unification target, not a fork of any single product spec.
§6.1 BendScript reserved vocabularies — added gating note: BendScript v0.1 final requires (a) §8 LLM round-trip evidence and (b) §14 adopter commitment; Graphonomous via bendscript.memory.v1 is the obvious first adopter, so shipping that vocabulary doubles as gating-criterion satisfaction.
§6.13 Product → substrate extractions — RuneFort removed from the extraction list. Post-pivot it is already a layout protocol (@runefort/core v0.1.0-alpha.1 Web Components + 1150-line 3-file spec); the supervisor floor is one application, not the protocol.
Test count baseline shifts from 1,372 → 1,463 (+91 from BendScript core); kag.* schema (migrations 010-019) is now orphaned per STACK_COMPLETION §2.4.
2026-05-01 — OS-012 SCOPE v0.1 draft (sections 0–17, dated 2026-04-30) reviewed against the ProjectAmp2 stack and competitive landscape (tf2/REP 105, W3C Web Annotation, MAPF/CBS, Yjs awareness + Liveblocks presence, etcd leases / Chubby).
§0 TL;DR — bullet 2 updated to note v0.1 draft exists; next move is consumer-gated revision, not green-field spec.
§3 Spatial collapse — added v0.1 draft status subsection. Recommends ~40% scope reduction for v0.1 final: 3 region kinds (grid/document_span/graph_subgraph) gated to current consumers (Runefort/BendScript/Graphonomous); 6–7 claim types (drop attention/inspect/observation/drift as overlapping or fact-not-claim, defer avoid/hazard to a scope.robotics.v1 vocabulary); 3 strength levels (defer mandatory until fencing tokens exist). Surfaced three structural gaps: subscription deferred to v0.2 (should be v0.1 normative — a coordination protocol without events doesn't coordinate), cross-frame conflicts deferred (undercuts the spatial-collapse pitch in v0.1), recompute_conflicts determinism (§10.2) conflicts with graph_subgraph overlap (§7.1) under a mutating Graphonomous graph. Field-naming reconciliation flagged: STACK_PLANNING uses horizon (richer time-window); v0.1 draft uses expires_at (single timestamp). Misframed dependencies flagged: §16 misframes [&] relationship (introducing &space.region/&space.claim, not maturing them — current &space.* only has fleet/route/geofence); §13.2 references "OS-E003" benchmark with no PRISM-issued number; §13.4 Graphonomous region-scoped retrieval is correct division of labor but Node schema currently has no region field. Prior-art map added (tf2 + W3C Web Annotation + MAPF + Yjs/Liveblocks + etcd/Chubby); two genuine novelties identified (substrate-agnostic frames, substrate-agnostic typed claims). Engineering-risk roster added (fencing tokens, selector drift, encoding negotiation, clock skew, GC of superseded chains, binary wire profile, authority signatures). Recommended pitch: "Awareness for typed regions, across substrates."
§6.7 PULSE v0.1.2 — added vendor-namespace token mechanism as hard prerequisite for SCOPE v0.1 final. PULSE v0.1.1's closed enum (PULSE/schemas/pulse-loop-manifest.v0.1.json:203-212) cannot accept scope.v1.* tokens; PULSE v0.1.2 must specify the namespace pattern before SCOPE can be normatively conformant.
§7 Tier A row 5 — retitled to OS-012 SCOPE v0.1 final; effort revised to 1 week spec revision + 1 week ref impl scaffold (down from 2+1 green-field). Sequencing dependency on PULSE v0.1.2 (Tier S row 2 / §6.7) made explicit.
2026-05-24 — OS-XXX slot collision audit. Three double-bookings reconciled:
OS-012 previously used for both Credentials Transfer (§6.2) and SCOPE (§3 + Tier A row 5). SCOPE wins (entire §3 architectural pitch + all downstream references); Credentials Transfer relocated to OS-019 (§6.2 retitled).
OS-013 previously used for both Telemetry Unification (§6.3 + Tier A row 6) and FGAP (Tier C row 18). Telemetry Unification wins (scheduled, 1-week, immediate consumers); FGAP relocated to OS-020 (Tier C row 18 retitled).
OS-014 previously used for both Affordance Projection function (§6.4 + Tier S row 4) and multi-embodiment (Defer). Affordance Projection wins (scheduled, 4-day, Tier S); multi-embodiment relocated to OS-021 (Defer entry retitled).
New §6.0 OS-XXX slot reservation table added as the canonical index — update whenever a slot is claimed.
OS-017 PACT (Principal, Attestation, Chain-of-Trust) and OS-018 TALLY (Typed Account Ledger, Layered Yields) reserved as stubs (§6.14, §6.15) pending design review. Three open questions per stub; no draft until thesis-fit and 7-property-test are independently validated. Slots reserved, not committed.
2026-05-25 — Architecture gap review folded in (STACK_ARCHITECTURE_GAP_REVIEW.md).
§1.1 added — protocol extraction gate (7 required proofs beyond the §1 7-property test) per review Finding 1. Any future OS-XXX slot claim must pass both gates.
OS-017 and OS-018 reservations withdrawn — review Findings 4 and 10 demonstrated both fail the extraction gate on "two consumers" and "portable artifact." §6.0 slot table marks OS-017 and OS-018 as unallocated; §6.14 rewritten as "Principal/capability implementation track" pointing to amp.principals + amp.capability_grants + Delegatic binding work (using DID/VC/UCAN/GNAP/OCapN prior art rather than green-field identity); §6.15 rewritten as "ν+θ event-ledger experiment" pointing to webhost.billing with REA/hREA event-sourced model (balances as derived views). Both sections include explicit extraction tests — the conditions under which they become protocol candidates again.
§9 added — architectural invariant adopted from review §7 as the optimization target. Maps each invariant clause to its substrate (principal binding → §6.14, scope → OS-012 SCOPE, observable event → PULSE+OTel, provenance → PEP, evidence → Graphonomous+W3C Web Annotation, replay → OS-011+Delegatic, benchmark → PRISM Evidence Bundle).
Update log relocated to §10 (now §11) to keep it last.
Larger work deferred to separate sessions (flagged here so it isn't lost): (a) reconcile kag/rune/spec status drift across STACK_COMPLETION.md, STACK_PLANNING.md, and ampersand-supabase/ARCHITECTURE.md per review Finding 2/3; (b) adopt spec / in_tree / live_local / live_deployed / external status vocabulary across all three files; (c) replace §7 Tier S/A/B/C with the review's Phase 0–7 roadmap once status reconciliation is complete; (d) PEP design pass after SCOPE v0.1 final.
2026-05-28 — E2E thesis review folded in (new §10). Read the three theory artifacts (STACK_PROOF.html, STACK_TOPOLOGY_AS_AUTHORITY.html, STACK_PERIODIC_TABLE_OF_AGENT_INVARIANTS.html v0.5), the full Workbench Supervisor spec (workbench/docs/spec/SUPERVISOR.md v0.2 draft), the IA source (workbench/app/src/lib/ia/*), and re-audited specs-vs-code across the portfolio.
§10 added — rates the stack against its own thesis (5 distilled goals), not against "is it built." Scorecard splits theory (~8.8/10) from proof-in-the-pudding (~5.5/10); blended ≈ 6.7/10. The gap is entirely evidence-production-at-scale, not architecture.
Proof-in-the-pudding gap quantified (§10.3): 43 periodic-table invariants enumerated, 6 with executable proof gates (verify.ts), 1 (κ) machine-checked, 0 third-party systems scored by PRISM.
Loop hierarchy L0–L3 named (§10.4); four missing institutional loops identified (§10.5): A=Registrar/School (designed, ship it), B=Gate Foundry (verifier-synthesis loop — the periodic-table unlock, turns missing→shipped by manufacturing proof gates; nothing in the stack currently produces gates), C=Provost (supervisor-of-supervisors reading coverage gaps), D=Extraction Observatory (automates §1.1 judgment); E=currency circulation deferred per §6.15.
§10.6 per-component upgrade proposal re-prioritizes §7 under goal #3 (proof, not vibes): ranks 1–4 (Supervisor L2 → Gate Foundry → PRISM scores a third party → one complete live vertical) all attack the lagging proof metric before more protocol naming.
Update log renumbered §10 → §11.
2026-06-11 — Stack-reconciliation pass (see STACK_COMPLETION.md 2026-06-11 entry for the full task list).
§1.1 extended to 8 gates — added the Wired arrows (in + out) gate: a candidate needs ≥1 wired consumer arrow IN and ≥1 OUT (real producer emits, real consumer reads — not hypothetical coupling) before any vX.0. Closes the deferred-work item (b) from the 2026-05-25 entry in spirit and operationalizes "≥1 wired consumer in and out before any vX.0." BendScript and SCOPE remain honestly pre-v1.0 under this gate.
Status vocabulary adopted across STACK_COMPLETION.md (every bare ✅/⚠️/❌ replaced by spec | in_tree | live_local | live_deployed | external) — discharges the deferred-work item (b) from the 2026-05-25 entry for that file.
No planning/roadmap content changed beyond the gate addition; this was a docs-honesty + inventory pass, not a re-plan.
2026-06-12 — OS-012 SCOPE go/no-go decision (discharges the Travis-reserved "SCOPE v0.1 scope" item from the 2026-06-11 reconciliation flags).
Verified against the live tree, not the prose: no SCOPE spec file exists anywhere (repo-wide *SCOPE* → none); the "sections 0–17 draft" is a design reviewed in §3, never a committed artifact. The TL;DR (§0 bullet 2), §3 v0.1 draft status, the §6.0 slot table, and §7 Tier A row 5 all previously read as if a draft file existed — corrected to "reviewed design, deferred."
Both hard prerequisites confirmed missing: PULSE's cross-loop token field is still a closed 6-token enum (PULSE/schemas/pulse-loop-manifest.v0.1.json:205-212) with no vendor namespace; graphonomous/lib/graphonomous/types/node.ex has no region field. With no wired consumer, SCOPE also fails the §1.1 wired-arrows gate.
Decision: SCOPE stays deferred — do not green-field the spec. Honest unblock order recorded in §3 and §7 Tier A row 5: PULSE v0.1.2 vendor-namespace (Tier S, §6.7) → Graphonomous region + a real region-scoped consumer → consumer-gated SCOPE v0.1. Consistent with §10.6 (proof before protocol naming) and STACK_COMPLETION "What NOT to prioritize."
No roadmap re-plan; this aligns the doc's SCOPE claims with the live tree and records the deferral rationale.
2026-06-12 — PULSE v0.1.2 vendor-namespace token mechanism shipped `in_tree` (SCOPE blocker #1, the smallest genuine unblock; §6.7).
Schema — connection.token changed from a closed 6-token enum to oneOf {canonical enum, vendor pattern ^[a-z][a-z0-9_]*\.v[0-9]+\.[A-Z][A-Za-z0-9]*$} (PULSE/schemas/pulse-loop-manifest.v0.1.json). Additive, backward-compatible; pulse/opensentience/os prefixes reserved.
Spec — OS-010 §6.7 added (form, CE-type derivation, opaque payloads, reserved prefixes); §6 retitled and corrected from "five" → six canonical tokens (folds in SurpriseSignal, which v0.1.1 added but never landed in §6); §10 + glossary + §16.1 reconciled.
Runtime — tokens.ts: VENDOR_TOKEN_RE, isCanonicalToken/isVendorToken/isValidToken, vendor ceTypeFor, PulseToken/PulseTokenData; emit_signal (tools.ts) accepts vendor tokens. README.md token line corrected to six + vendor.
Tests — 5 new cases; suite 8/8 green, tsc clean.
Effect: §3 decision-note blocker #1 discharged; SCOPE still deferred on (2) Graphonomous region field + real consumer and (3) §1.1 wired-arrows. Also unblocks Tier S Boundary/Drift tokens. npm package.json left at 0.1.1 — version bump + republish is a Travis release decision.