docs(rfc): define the production command composition kit

[rickylabs]

Summary

Drafts the production command composition kit RFC: a narrow, one-store transaction boundary for business state, idempotent replay receipts, audit records, and outbox messages, with explicit adapter refusal and post-commit at-least-once relay semantics.

This is an RFC/docs-only PR. It does not implement or change a package, plugin, schema, scaffold, export, or runtime. Fable PLAN-EVAL cycle 2 and the independent Qwen adversarial evaluation both passed. This PR is now in the formal Final Comment Period and remains draft until that process completes.

Scope

• Tracking RFC: RFC: production command composition kit — one transactional boundary for business state, audit, outbox and idempotency #1361 (reference only; this PR must not close it)
• Related implementation/dependency issues: fix(scaffold/service): generated services have no internal layering — the v1 router template teaches ORM-in-handler and deno task test fails on an empty tree #1362, Epic: Production command composition — transaction, audit, idempotency, outbox, and relay #1363, docs(orchestration-runtime): outbound webhook delivery has no recipe or template — triggers ship inbound ingress only, so every product hand-rolls signing, retry and dead-lettering #1364, [sdk-client S1] fix(sdk): preserve contract errors through safe() and isDefinedError #1350, prisma-adapter-mysql: adapter class is unexported and has no connection-error hook — the honest example needs both #1293, Type soundness ratification: eliminate unsound and arbitrary types across the public surface and the docs #1278
• Source roadmap: plan(seed): Fable 5 long-range remediation roadmap (planning-only, drafts) #1347
• Described archetypes: A4 contracts/service DSLs, A2 database/telemetry adapters, A3 relay runtime discipline, A5 thin integrations, A6 generators
• Run: .llm/runs/docs-rfc-command-composition-kit--rfc/

Slices

• B0 Activate harness and draft PR — ad643e15d
• S1 Re-baseline source, exports, docs, board, and primary adapter truth — e0b98f289
• S2 Lock exact contracts, laws, capability/error/security/telemetry model — ad16c42f8
• S3 Complete runtime boundary, conformance, staging, and first handoff — 2dfe8c841, 62304176f
• Fable PLAN-EVAL cycle 1 artifact, FAIL_PLAN / F-B1–F-B7 — 122301d25
• S4 Remediate F-B1–F-B7 and preserve launcher metadata — c98c08ada
• S4 Record cycle-2 evidence and exact handoff — 6c2043d91

Cycle-1 remediation

• Provider-specific receipt claims and bounded waits: PostgreSQL conflict-safe insert, MySQL savepoint/1062 recovery with session restoration, SQL Server named-index range locks; timeout is callback-terminal.
• Relay ownership: raw persistence in database, decoded delivery/sinks/supervision in service, with an explicit new one-way service → database dependency.
• Queue decision: no direct queue dependency/wrapper; reuse lease/test patterns only and propose runtime-DDL reconciliation before future code sharing.
• Identity and portability: changed scope/name executes as new with deterministic negative conformance; MySQL SNAPSHOT is a distinct Stage-6 blocker; SQLite is default-only; generated Prisma transaction typing belongs to db command-store add.
• Batch corrections: A4/A2/A3/A5/A6 mapping, literal-preserving ContractBuilder annotation, unified idempotency vocabulary, ratification-vs-implementation milestone explanation, worker claim wording, telemetry asymmetry, and deliberate CLI noun.

The one-store atomicity, same-commit receipt/audit/outbox, at-least-once relay, capability honesty, and refusal laws remain unchanged.

Validation

• Scoped authored-Markdown format and git diff --check — PASS
• RFC F-B1–F-B7/frontmatter/forbidden-vocabulary assertion — PASS; 17 required claims, 3 forbidden-pattern classes
• deno task docs:links — PASS; 102 docs, 0 broken links, 0 broken anchors, 0 orphans
• deno task docs:accuracy — PASS
• Current database/service/contracts/telemetry public-entrypoint deno check --no-lock --unstable-kv — PASS; existing warnings only
• Focused Prisma 7.8 generated-client probe — PASS; generator-owned type requirement confirmed; probe removed
• Review-thread gate — PASS; 0 threads, 0 unanswered
• PR-check reconciliation at remediation content HEAD — PASS; 15 checks, 0 current failures; docs-only lanes skipped
• Changed-file/lock audit — PASS; RFC plus mandatory run artifacts only; no deno.lock or product change
• Full CLI/scaffold runtime — N/A for this docs-only PR

Harness handoff

• Final handoff: .llm/runs/docs-rfc-command-composition-kit--rfc/final-handoff.md
• RFC remediation content HEAD: c98c08adabbd992a557ff7c596deae68b9c9cd62
• Final evidence/branch HEAD: 6c2043d915ea2afbe7020bbb88d90ea4d0ea16a5
• Phase: status:review; Fable cycle 2 and Qwen final evaluation both passed; formal FCP opened 2026-08-08
• Draft remains 0000 / Draft
• No evaluator was launched and no author verdict was claimed in this remediation turn

Board / lifecycle

No issue was created or closed, no RFC number was assigned, no milestone was mutated, and this PR was not readied or merged. The RFC references #1361 without a closing keyword. A queue runtime-DDL reconciliation child is proposed for maintainer filing only after acceptance.

[rickylabs]

[PHASE: RESEARCH]

Harness bootstrap is live on draft PR #1389 at commit ad643e15d.

Scope

• Run: .llm/runs/docs-rfc-command-composition-kit--rfc/
• Baseline: origin/main@fac9e339042c
• Sole generator: Codex GPT-5.6 Sol xhigh, daemon-attached thread 019fe242-2c45-7e03-a428-eebfb968eda0
• Selected profile: SCOPE-docs + SCOPE-service, describing future Archetype 1–6 surfaces without changing product code
• CI lane: docs-only, so ci:skip-e2e and ci:skip-scaffold are intentional

Evidence

• Raw git verification: requested branch, HEAD, and merge-base all matched the pinned baseline before B0
• Required RFC process, doctrine, archetype, gate-matrix, plan-gate, lane, and evaluator authority read completely
• Live RFC: production command composition kit — one transactional boundary for business state, audit, outbox and idempotency #1361–docs(orchestration-runtime): outbound webhook delivery has no recipe or template — triggers ship inbound ingress only, so every product hand-rolls signing, retry and dead-lettering #1364 and source PR plan(seed): Fable 5 long-range remediation roadmap (planning-only, drafts) #1347 confirmed
• Initial push used only git push origin HEAD:refs/heads/docs/rfc-command-composition-kit

Drift

The read-only agentic runtime status probe returned MISSING_IDENTITY and made no changes. The checked-in thread receipt remains the session identity; no daemon repair or rival session was launched.

Next

Re-baseline the carried proposal against current public APIs, implementations, tests, generated surfaces, live dependencies, and primary adapter/runtime documentation.

[rickylabs]

[PHASE: PLAN]

Plan locked at commit e0b98f289 for harness run .llm/runs/docs-rfc-command-composition-kit--rfc/.

Evidence completed:

• re-baselined the carried proposal against origin/main@fac9e339042c, live RFC: production command composition kit — one transactional boundary for business state, audit, outbox and idempotency #1361–docs(orchestration-runtime): outbound webhook delivery has no recipe or template — triggers ship inbound ingress only, so every product hand-rolls signing, retry and dead-lettering #1364/[sdk-client S1] fix(sdk): preserve contract errors through safe() and isDefinedError #1350/prisma-adapter-mysql: adapter class is unexported and has no connection-error hook — the honest example needs both #1293, current export maps, generated service/CLI surfaces, workers/sagas, and primary Prisma/Deno KV/SQLite/SQL Server/W3C/OTel documentation;
• native deno doc confirmed the current public signatures and subpath boundaries;
• focused transaction-type probe unexpectedly compiled root-only/nested-transaction callback calls, proving withTransaction cannot be reused verbatim;
• focused typed-error probe reproduced [sdk-client S1] fix(sdk): preserve contract errors through safe() and isDefinedError #1350 with TS2339 (error.code on never);
• proposal drift and JSR/public-surface consequences are recorded in research.md, plan.md, and drift.md.

Locked direction: conformant one-store/same-commit command store only; service/database/contracts/telemetry focused subpaths; consumer-owned generated rows; RFC-8785 + SHA-256 fingerprints; explicit replay codecs; repository CAS; no hidden callback retries; no external I/O in the transaction; at-least-once outbox relay with stable message identity; KV refused in v1 and SQLite unclaimed until conformance.

Formal PLAN-EVAL/IMPL-EVAL has not been triggered. Per the owner brief, the root orchestrator will steer the existing Fable review only after the complete RFC and final handoff.

[rickylabs]

[PHASE: IMPL]

The complete RFC draft is now on the branch in commit ad16c42f8.

Slices landed

1. Added rfcs/0000-command-composition-kit.md from the repository template, retaining RFC 0000 and Draft.
2. Defined the service, database, contracts, telemetry, receipt/audit/outbox, relay, and testing surfaces with semantic laws and an exact refusal boundary.
3. Added current-provider truth, JCS request identity, CAS/idempotent replay rules, typed failures, privacy/cardinality policy, injected-failure conformance, migration, generators, staging, and issue decomposition.
4. Recorded the S2 contract review in the harness artifacts, including attempt executionId, typed outbox codecs, relay terminal disposition, and the direct Standard Schema dependency consequence.

Evidence

• Scoped Markdown format and git diff --check: pass before commit.
• Focused command type-shape probe: passed against current database types, Zod, and the locked Standard Schema API after identifying that the future service package needs a direct import-map dependency; probe removed.
• Product/runtime code: unchanged.
• Evaluator: not launched; formal Fable/Qwen review remains root-orchestrator-owned.

Next

• Run the final RFC/docs, source-alignment, lock/diff, and review-thread gates.
• Write final-handoff.md, update this draft PR, and move exactly one lifecycle label to status:plan-eval without triggering evaluation.

[rickylabs]

PLAN-EVAL HANDOFF — EXTERNAL VERDICT PENDING

The generator handoff is complete at branch HEAD 62304176ffafbb8d50417b36c405b0bf05ef364f; the reviewed RFC content commit is ad16c42f8e717c727ae00bb66c694f4073234a39.

• Draft PR remains open, draft, and unmerged.
• The sole lifecycle label is status:plan-eval.
• No RFC number, issue, milestone, or board state was mutated.
• No PLAN-EVAL/IMPL-EVAL/Fable/Qwen session was launched by this generator.
• Exact root-to-Fable review instructions, locked decisions, four unresolved FCP questions, validation evidence, and board reconciliation are in .llm/runs/docs-rfc-command-composition-kit--rfc/final-handoff.md.
• Final local/repository evidence: format/diff/RFC assertions pass; docs links are 102/0/0/0; docs accuracy passes; review threads are 0/0; the prior PR-check reconciliation had 15 checks and 0 current failures.

Next owner: the root orchestrator resumes the existing Claude Fable 5 session with the quoted handoff, then owns any remediation and the independent Qwen adversarial pass. This comment deliberately carries no evaluator phase token or verdict.

[rickylabs]

[PHASE: PLAN-EVAL] [VERDICT: CHANGES_REQUESTED]

FAIL_PLAN, cycle 1 of 2. Evaluator of record: Claude Fable 5 · high (owner-designated cross-family PLAN-EVAL; generator was Codex). Full verdict: .llm/runs/docs-rfc-command-composition-kit--rfc/plan-eval.md @ 122301d25. Deep-dive delegation (recorded): 1× Opus 5 · xhigh, read-only, workflow wf_b3416478-edf.

The core promise is verified honest and internally consistent — one store transaction with an explicit TTx (no ambient state, grep-verified against the repo's real ALS usage), DB-constraint idempotency (not check-then-act), at-least-once relay with stable message identity, no hidden migrations, no exactly-once claim anywhere. The provider matrix was verified against primary Prisma/PG/MSSQL/SQLite sources and is accurate, including the #1293-is-adjacent call. The failures are three boundary decisions taken silently plus citable corrections.

Findings

1. F-B1 (critical) — claimReceipt's unique-violation-inside-transaction algorithm is unspecified. On PostgreSQL a losing insert poisons the transaction (25P02) — a savepoint or INSERT … ON CONFLICT DO NOTHING RETURNING+SELECT is mandatory; SQL Server (2627, statement-level) and MySQL (INSERT IGNORE) diverge; the bounded busy/retryAfterMs path needs provider lock-timeout mechanics (SET LOCAL lock_timeout / innodb_lock_wait_timeout / SET LOCK_TIMEOUT). Adapter-algorithm freedom is granted only for the relay claim, and callbackAttempts:'one' + single store.transaction() forbids retry-outside. Repair: a normative receipt-claim-algorithm subsection (per-provider strategies + no-transaction-poisoning conformance items), or an explicit FCP question with the option space enumerated.
2. F-B2 (critical) — relay-port ownership hole can invert the dependency arrow. CommandOutboxRelayStore/Sink/Delivery have no ownership-table row; Delivery references service-owned CommandJson/CommandTraceContext; Stage 5 says A3/A5 while the child-issue row says service+database. Wrong placement forces database→service — the cycle L3 forbids. Repair: add the ownership rows, decide the package now, and state explicitly that service → database is a new package edge packages/service/deno.json must declare (verified absent today).
3. F-B3 (major) — reuse-vs-reinvent against @netscript/queue undecided. queue/adapters/postgres.adapter.ts already implements claim (FOR UPDATE SKIP LOCKED :373-396), lease/visibility timeout, redelivery, max-attempts, and a dead-letter store — the mechanics the relay re-derives, with no rejected-alternatives entry (A7 wrap-don't-reinvent). The insert side can't reuse the queue; the claim/lease/DLQ side has no such constraint. Decide and record. Related: the queue's ensureSchema() runtime CREATE TABLE IF NOT EXISTS (:319-369) is exactly what this RFC's no-hidden-migrations rule forbids — scope the rule to the command kit or call for the reconciliation issue.
4. F-B4 (major) — scope instability silently defeats idempotency. Same key + different scope() result lands a different receipt row: the handler runs again and no law fires. Prose says "must not vary" with no enforcement; conformance item 4 covers only same-key/different-hash. Add negative items (same key + different scope; same key + renamed command) and a determinism requirement on scope() mirroring fingerprint()'s.
5. F-B5 (medium) — MySQL SNAPSHOT undeclared prerequisite. prisma-adapter-mysql/src/adapter.ts:476-481 declares 'SNAPSHOT' and :370-372 interpolates the level into SQL without an execution-point allow-list — an isolation MySQL cannot honor. Name this fix in Stage 6's exit condition.
6. F-B6 (medium) — PrismaTransactionClient doesn't exist. Zero repo hits; @database maps to the root-client surface; the db command-store init deliverable list omits emitting/typing the transaction-client type. Add it to the generator's deliverables (the withTransaction root-client-assertion fix is already correctly required).
7. F-B7 (minor batch) — (a) Stage-1 archetype is A4 (contracts), not A1, per doctrine 06:375. (b) commandBaseContract needs the literal-preserving explicit annotation and must state it reuses [sdk-client S1] fix(sdk): preserve contract errors through safe() and isDefinedError #1350's spelling or it re-introduces the erasure. (c) committed vs claimed — one word per state. (d) Clarify frontmatter target-milestone: 0.0.6 = ratification (children 0.0.8, [sdk-client S1] fix(sdk): preserve contract errors through safe() and isDefinedError #1350 at 0.0.7). (e) Require correction of WorkerIdempotencyPort's "exactly-once-effective" doc-comment in Stage 5 docs. (f) Fold into FCP Q2: Prisma rejects isolationLevel on SQLite → supportedIsolationLevels=[] would refuse Serializable, the one level SQLite always provides. (g) Name the db command-store init vs db init sub-noun choice deliberately. (h) FCP Q3 should acknowledge that existing telemetry already emits netscript.correlation.id/netscript.idempotency.key (messaging.ts:15, saga.ts:12) while command spans exclude both.

FCP adjudication: Q1/Q3/Q4 safe to defer; Q2 safe once F-B7(f) folds in. F-B1–F-B3 are missing from FCP and must be resolved in text or added as fully-specified FCP questions before FCP closes.

Next

• Root orchestrator resumes the Codex generator with this list; the transaction/receipt/relay laws, capability honesty, and refusal boundary all survived adversarial verification — no structural redesign requested.
• Label moved status:plan-eval → status:plan in this action; restore status:plan-eval with the amended handoff.

[rickylabs]

[PHASE: PLAN] [CYCLE: 2 REMEDIATION]

Authoring remediation for the authoritative cycle-1 FAIL_PLAN is now pushed at c98c08adabbd992a557ff7c596deae68b9c9cd62.

Resolved in the RFC and locked harness plan:

• F-B1: normative PostgreSQL/MySQL/SQL Server receipt-claim algorithms, bounded wait/session restoration, callback-terminal busy handling, and no-poison/leader commit/rollback conformance.
• F-B2: raw relay persistence types in database; decoded delivery/sink/supervisor types in service; explicit new service → database dependency and no reverse edge.
• F-B3: direct @netscript/queue reuse rejected; lease/test patterns reused; hidden runtime-DDL reconciliation proposed before future sharing.
• F-B4–F-B6: execute-as-new scope/name drift laws and negatives, MySQL four-level isolation prerequisite, and generator-owned CommandTransactionClient.
• F-B7: corrected archetypes, literal error annotations, vocabulary, milestone meaning, worker wording, SQLite default-only truth, CLI noun, and telemetry asymmetry.

The RFC remains 0000 / Draft and this PR remains documentation-only and draft. No evaluator is triggered or verdict claimed by this comment. Repository docs/link/diff and PR metadata gates are running next; the final cycle-2 handoff will be a separate [PHASE: PLAN-EVAL] comment.

[rickylabs]

[PHASE: PLAN-EVAL] [CYCLE: 2 READY] [EXTERNAL VERDICT: PENDING]

Cycle-1 remediation is complete and this draft is ready for the root orchestrator to resume the existing Fable 5 evaluator session. This is an author handoff, not an approval or evaluator trigger.

Exact review target

• Final branch/evidence HEAD: 6c2043d915ea2afbe7020bbb88d90ea4d0ea16a5
• RFC remediation content HEAD: c98c08adabbd992a557ff7c596deae68b9c9cd62
• Cycle-1 evaluator commit: 122301d25f4055bfebffefeb3aec2b23c707cfca
• Run: .llm/runs/docs-rfc-command-composition-kit--rfc/
• Exact Fable prompt: .llm/runs/docs-rfc-command-composition-kit--rfc/final-handoff.md#exact-fable-cycle-2-re-evaluation-handoff

Required-for-PASS reconciliation

1. F-B1: provider-specific receipt claims, bounded waits, rollback/no-poison/session restoration, leader-commit/rollback and timeout conformance are normative.
2. F-B2: database owns raw relay persistence; service owns decoded runtime/sinks; the new direct edge is only service → database.
3. F-B3: direct queue reuse is rejected; lease/test patterns are reused; runtime-DDL reconciliation is proposed before any future sharing.
4. F-B4: scope/fingerprint determinism plus changed-scope/renamed-command execute-as-new behavior, negative tests, and migration aliases are explicit.
5. F-B5: MySQL four-level allow-list and SNAPSHOT removal/rejection are a Stage-6 prerequisite distinct from prisma-adapter-mysql: adapter class is unexported and has no connection-error hook — the honest example needs both #1293.
6. F-B6: db command-store add emits the consumer-owned transaction client derived from generated Prisma types with root/lifecycle methods omitted.
7. F-B7: archetypes, literal ContractBuilder typing, vocabulary, milestone meaning, worker wording, SQLite default-only truth, telemetry asymmetry, and CLI noun are corrected.

Evidence

• Authored Markdown format + diff/lock audit: PASS
• RFC 17-claim/forbidden-vocabulary assertion: PASS
• Docs links: PASS (102 / 0 broken links / 0 broken anchors / 0 orphans)
• Docs accuracy: PASS
• Current database/service/contracts/telemetry public-entrypoint Deno check: PASS (existing warnings only)
• Focused Prisma generated-client probe: PASS and removed
• Review threads: PASS (0 / 0 unanswered)
• PR checks at remediation content HEAD: PASS (15 / 0 current failures; docs-only skips)
• Product/CLI E2E: N/A for this docs-only change

PR #1389 remains draft, the RFC remains 0000 / Draft, and the sole lifecycle label is status:plan-eval. No issue, milestone, RFC number, merge state, or evaluator session was mutated by this handoff.

[rickylabs]

[PHASE: PLAN-EVAL] [VERDICT: APPROVED]

PASS, cycle 2. Same owner-designated Fable 5 evaluator session as cycle 1. Verdict of record: .llm/runs/docs-rfc-command-composition-kit--rfc/plan-eval.md @ 57b51128f. Accepted RFC content SHA: c98c08adabbd992a557ff7c596deae68b9c9cd62 (branch HEAD at verdict: 57b51128f, atop the author handoff 6c2043d91).

All seven cycle-1 findings verified resolved mechanically:

• F-B1 — exceeds the asked bar: normative per-provider receipt-claim table — PG INSERT … ON CONFLICT DO NOTHING RETURNING + indexed SELECT with transaction-local set_config('lock_timeout') save/restore, 55P03→busy, 40001 retryable; MySQL savepoint recovering only 1062 (INSERT IGNORE explicitly forbidden with the warning-downgrade rationale) with session innodb_lock_wait_timeout restore and failed-restore-discards-connection; SQL Server UPDLOCK, HOLDLOCK on the named generated unique index with SET LOCK_TIMEOUT restore, MERGE/catch-2627 rejected. Busy is callback-terminal; every timeout path rolls back; new conformance items + primary-source citations.
• F-B2 — relay ownership completed: @netscript/service/commands/relay owns decoded delivery/sinks/supervisor; database owns raw rows + lease/token/release types; the only cross-package edge is service → database, with the direct-dependency declaration requirement stated (stage split 5a/5b matches).
• F-B3 — explicit "do not wrap @netscript/queue in v1" decision + rejected-alternatives entry: reuse of the verified lease algorithm/test pattern, not queue's delete-on-ack/DLQ/public-loop contract or runtime schema creation; queue runtime-DDL reconciliation child proposed for maintainer filing before any code sharing.
• F-B4 — execute-as-new law stated at the identity definition + negative conformance items 5/6 (changed scope; renamed command; changed definitionVersion = mismatch); scope determinism mirrors fingerprint.
• F-B5 — MySQL conformance blocked until prisma-adapter-mysql's SNAPSHOT export and unchecked SQL interpolation are fixed (Stage 6 gate); prisma-adapter-mysql: adapter class is unexported and has no connection-error hook — the honest example needs both #1293 correctly still adjacent.
• F-B6 — generator-owned CommandTransactionClient = Omit<Prisma.TransactionClient, …> with engine-module re-export, in the db command-store add deliverables; verified against a Prisma 7.8 probe.
• F-B7 — all eight batch items landed (A4 archetypes, [sdk-client S1] fix(sdk): preserve contract errors through safe() and isDefinedError #1350 literal-preserving ContractBuilder spelling pinned, claimed vocabulary unified, frontmatter ratification-only footnote, WorkerIdempotencyPort doc-comment correction required in Stage 5, SQLite selectableIsolationLevels: []/defaultIsolation fold into FCP Q2, db command-store add noun distinction, telemetry-asymmetry acknowledgment). The new selectable/default capability split also resolves the SQLite refusal-law wart cleanly.

The four amended FCP questions are policy-only and safe; the three cycle-1 rework-forcing gaps are now resolved design inputs. Labels remain honest (diff = RFC + run artifacts only; changed-file audit confirms no package/lock change).

Next

Label moved status:plan-eval → status:augment-review (pending root-owned Qwen 3.8 Max adversarial acceptance pass). Handing the accepted SHA back to the root orchestrator; do not merge before the Qwen pass and owner ratification.

[rickylabs]

Final Comment Period — disposition: accept

The independent review sequence is complete:

• Claude Fable 5 PLAN-EVAL cycle 2: APPROVED / PASS
• Qwen 3.8 Max, maximum reasoning, final adversarial review: PASS_ACCEPT
• Cross-RFC composition with RFC-A: PASS
• All F-B1–F-B7 findings independently confirmed resolved
• No Critical or Major findings; only board/process advisories remain

Authoritative final report: QWEN-FINAL-ADVERSARIAL-EVAL.md at 278a2dd9a

Maintainer disposition of the safe questions

1. Idempotency is required by default; mode: "optional" is an explicit opt-out restricted to controlled internal callers and emits not_requested.
2. Accept the SQLite default-only capability shape, but release it later and make no current support claim. It does not delay PostgreSQL/MySQL/SQL Server work.
3. Keep command correlation durable-row/log-only by default; reconcile the older messaging/saga telemetry attributes in a separate redaction/deprecation cleanup.
4. Require explicit deployment values for receipt and published-outbox retention until operational evidence supports safe defaults; audit retention remains application policy.

The authenticated envelope path will explicitly depend on #1387's typed-principal/context surface. RFC-B receives 0002 after RFC-A receives 0001. target-milestone will consistently mean the first implementation milestone, so the accepted file will target 0.0.8 rather than the ratification milestone.

FCP window

This comment opens the repository-required approximately seven-day FCP with disposition accept. Please raise any concrete objection by 2026-08-15 22:00 Europe/Zurich. Unless a blocking objection is substantiated, the maintainer will then assign 0002, fill accepted metadata, mark the PR ready, and merge it. Tracking issue #1361 remains open for implementation.