rickylabs · rickylabs · Aug 11, 2026 · Aug 8, 2026 · Aug 8, 2026 · Aug 8, 2026
@@ -0,0 +1,19 @@
+# rfc-command-kit — Codex implementation thread
+
+- **Thread / session id:** `019fe242-2c45-7e03-a428-eebfb968eda0`
+- **Rollout:** `/home/codex/.codex/sessions/2026/08/08/rollout-2026-08-08T18-43-35-019fe242-2c45-7e03-a428-eebfb968eda0.jsonl`
+- **Worktree:** `/home/codex/repos/ns-rfc-command-kit`
+- **Branch:** `docs/rfc-command-composition-kit` @ `fac9e3390` (NO upstream by design).
+- **Push rule:** explicit refspec only — `git push origin HEAD:refs/heads/docs/rfc-command-composition-kit`.
+- **Requested route:** provider=openai · model=gpt-5.6-sol · effort=xhigh
+- **Observed route:** provider=openai · model=gpt-5.6-sol · effort=xhigh
+- **Route verdict:** matched
+- **Runtime:** approval=never · sandbox=dangerFullAccess
+- **Brief (staged):** `/home/codex/rfc-command-kit-brief.md`
+
+## Steering (same thread — never a second send-message-v2 at this worktree)
+```bash
+codex exec resume 019fe242-2c45-7e03-a428-eebfb968eda0 -- "<follow-up>"
+```
+
+_Written by `.llm/tools/agentic/codex/launch-codex-slice.ts`._
@@ -0,0 +1,108 @@
+# Context Pack: production command composition kit RFC
+
+## Run Metadata
+
+| Field          | Value                                                           |
+| -------------- | --------------------------------------------------------------- |
+| Run ID         | `docs-rfc-command-composition-kit--rfc`                         |
+| Branch         | `docs/rfc-command-composition-kit`                              |
+| Current phase  | `plan-eval-ready-cycle-2`                                       |
+| Archetype      | Docs delivery describing A4/A2/A3/A5/A6 implementation surfaces |
+| Scope overlays | `SCOPE-docs`, `SCOPE-service`                                   |
+
+## Current State
+
+The run remains on the requested branch/base in the sole daemon-attached Codex thread. Draft PR
+#1389 is open, draft, and ready for root-steered PLAN-EVAL cycle 2. Fable cycle 1 remains preserved
+at evaluator commit `122301d25` with its authoritative `FAIL_PLAN`; no author verdict overrides it.
+RFC remediation content commit `c98c08ada` resolves F-B1–F-B7 by locking provider claims/timeouts,
+the service → database relay split, queue non-reuse/runtime-DDL reconciliation, identity drift,
+MySQL/SQLite capability truth, generated transaction typing, and the correction batch. Proportionate
+format/type/link/diff/PR gates are green. No product code or export changed.
+
+## Completed
+
+- Verified `HEAD == merge-base(HEAD, origin/main) == fac9e339042c...` and branch name.
+- Preserved the staged `implement.md` and `codex-thread-ids.md` receipts.
+- Read the RFC process/template, all current doctrine chapters, Archetypes 1–6, docs/service
+  overlays, lane/doc-audit policy, gate matrix, plan gate, and PLAN/IMPL evaluator protocols.
+- Confirmed live #1361–#1364 and PR #1347 exist; #1361 is open and ratification-only.
+- Opened draft PR #1389 with required labels, `status:research`, and research phase comment.
+- Proved the transaction callback typing defect and typed-error defect with removed focused probes.
+- Locked future package ownership, logical row ownership, JCS hashing/codec contract, adapter
+  refusal rules, worker/saga boundary, telemetry redaction, and implementation decomposition.
+- Authored `rfcs/0000-command-composition-kit.md` from the repository template, keeping `0000` and
+  `Draft` through maintainer discussion.
+- Tightened the S2 surface with attempt identity across receipt/audit/outbox, schema-backed outbox
+  codecs, deterministic scope inputs, and explicit relay retry/terminal dispositions.
+- Passed docs links/accuracy, scoped format/diff, RFC structural/terminology, review-thread, and PR
+  check reconciliation; captured current package doc-lint findings as future implementation bars.
+- Read `plan-eval.md` completely and preserved its evaluator commit/verdict.
+- Re-verified queue, service/database dependency, MySQL, worker, telemetry, CLI, Prisma generated
+  type, and primary provider-lock surfaces for F-B1–F-B7.
+- Reconciled the plan's open-decision sweep so no provider/package/migration/generator choice is
+  silently deferred.
+- Committed and pushed the RFC remediation slice as `c98c08adabbd992a557ff7c596deae68b9c9cd62` using
+  the required explicit refspec.
+- Passed scoped format, RFC assertion, current public-entrypoint Deno check, docs links/accuracy,
+  diff/lock hygiene, review-thread, and PR-check reconciliation for the remediation content.
+
+## Ready Handoff
+
+- The final evidence commit, PR body, exact `status:plan-eval` label, and non-verdict phase comment
+  are reconciled by the closing commands of this authoring turn. The exact resulting branch HEAD is
+  carried in that PR comment and the root response.
+
+## Next Steps
+
+1. Root orchestrator resumes the existing Fable session with the exact prompt in `final-handoff.md`.
+2. Fable records the formal cycle-2 verdict without changing the authored RFC.
+3. The later independent Qwen adversarial pass remains root-owned; this generator launches neither.
+
+## Key Decisions
+
+| Decision                                                | Source                         | Notes                                                                          |
+| ------------------------------------------------------- | ------------------------------ | ------------------------------------------------------------------------------ |
+| Docs-only RFC; no package/plugin changes.               | brief, #1361                   | Implementation is separate.                                                    |
+| One-store atomicity is the maximum portable claim.      | brief, doctrine A11–A13        | Cross-store and exactly-once claims refused.                                   |
+| Generator will not launch PLAN/IMPL evaluators.         | brief                          | Root orchestrator owns Fable/Qwen sessions.                                    |
+| No weak command store; KV is refused in v1.             | Deno KV/runtime research       | Same-commit truth is encoded by conformance, not a boolean callers can ignore. |
+| Service/database/contracts/telemetry focused subpaths.  | doctrine + dependency analysis | No new package or root export growth; avoids package cycle.                    |
+| Consumer-owned generated schemas with JCS codecs.       | JSR/Prisma/provider analysis   | No hidden migrations or provider-JSON fiction.                                 |
+| Provider-specific receipt claims and bounded waits.     | PLAN-EVAL F-B1 + primary docs  | No generic duplicate catch or callback retry.                                  |
+| Relay runtime in service over raw database persistence. | PLAN-EVAL F-B2 + doctrine      | New direct service → database edge; no reciprocal dependency.                  |
+| No direct queue reuse in v1.                            | PLAN-EVAL F-B3 + queue source  | Share algorithm/tests; reconcile runtime DDL before future code sharing.       |
+| Scope/name drift executes as new.                       | PLAN-EVAL F-B4 + unique key    | Determinism tests and replay migration/alias required.                         |
+| Generated transaction type + honest isolation split.    | PLAN-EVAL F-B5–F-B7 + probes   | MySQL allow-list; SQLite default-only FCP; explicit root-method omission.      |
+
+## Files Changed
+
+| Path                                               | Status   | Notes                                                                                        |
+| -------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------- |
+| `.llm/runs/docs-rfc-command-composition-kit--rfc/` | modified | Evaluator artifact preserved; remediation evidence/handoff and launcher metadata reconciled. |
+| `rfcs/0000-command-composition-kit.md`             | modified | Draft RFC remediation only; no framework/product implementation.                             |
+
+## Gates
+
+| Gate family | Current status                                                | Evidence                    |
+| ----------- | ------------------------------------------------------------- | --------------------------- |
+| Static      | PASS; format/diff/docs/RFC/PR gates green                     | `worklog.md` gate table     |
+| Fitness     | PASS_DESIGN with existing doc-lint baseline findings recorded | `plan.md` and `research.md` |
+| Runtime     | N/A for docs PR                                               | no product mutation         |
+| Consumer    | current CLI/scaffold analysis PASS; generated proof deferred  | S1 re-baseline              |
+
+## Open Questions
+
+- FCP policy only: idempotency default, acceptance/timing of SQLite's default-only capability,
+  correlation telemetry plus existing-precedent cleanup, and retention defaults. Provider claims,
+  relay ownership, and queue reuse are resolved and not open.
+
+## Drift and Debt
+
+- Drift: runtime identity, cycle-1 undeclared boundary decisions, queue runtime DDL, identity drift,
+  isolation truth, and launcher metadata reconciliation are recorded in `drift.md`.
+- Debt: no new or deepened architecture debt; existing package verdicts constrain the RFC.
+
+## Commits
+
+- See the draft PR's commit list + per-slice PR comments (V3 retired `commits.md`).
@@ -0,0 +1,137 @@
+# Drift Log: production command composition kit RFC
+
+Drift is append-only. Record facts that diverge from the carried proposal, plan, doctrine, or
+current-state documentation.
+
+## 2026-08-08 — Runtime identity correlation unavailable
+
+- **What:** The desired-state runtime controller could not match this worktree to a persisted
+  runtime identity.
+- **Source:** `deno task agentic:runtime status --worktree /home/codex/repos/ns-rfc-command-kit`.
+- **Expected:** A read-only session snapshot associated with the pre-staged Codex thread.
+- **Actual:** Exit 3, `MISSING_IDENTITY`, zero sessions, `changed: no`.
+- **Severity:** minor.
+- **Action:** accept for this run; preserve the checked-in thread receipt and do not repair/restart
+  an active daemon-attached session.
+- **Evidence:** `codex-thread-ids.md`; `supervisor.md`.
+
+## 2026-08-08 — Owner-controlled evaluator routing
+
+- **What:** Formal review/evaluation is reserved for existing external sessions steered by the root
+  orchestrator.
+- **Source:** Owner implementation brief.
+- **Expected:** Harness default would route a selected formal PLAN/IMPL evaluation via its canonical
+  separate-session lanes.
+- **Actual:** This generator must prepare inputs, stop at `status:plan-eval`, and must not trigger
+  PLAN-EVAL/IMPL-EVAL itself; root will steer Fable cross-RFC review and a final Qwen adversarial
+  pass.
+- **Severity:** significant.
+- **Action:** accept as explicit owner override; do not self-certify and do not launch a rival
+  session.
+- **Evidence:** `implement.md`; `supervisor.md`.
+
+## 2026-08-08 — Proposal outbox inventory is stale
+
+- **What:** The proposal says the repository has no outbox primitive.
+- **Source:** Carried RFC-B §1.1 and §3.5.
+- **Expected:** No `outbox` match in packages/plugins.
+- **Actual:** `packages/plugin-sagas-core/src/ports/saga-outbox-port.ts` publicly defines a reserved
+  T2 `SagaOutboxPort`; it has no adapter/caller and cannot join a command transaction.
+- **Severity:** significant.
+- **Action:** cite it as narrow prior art, do not reuse it as atomicity proof, and define a
+  command-specific transaction-bound row/store contract.
+- **Evidence:** `research.md` R9 and proposal-adjudication table.
+
+## 2026-08-08 — Proposal overstates current adapter/helper portability
+
+- **What:** The proposal treats `withTransaction` as reusable verbatim, SQLite as a current adapter,
+  `maxIsolation` as a truthful scalar, and #1293 as a MySQL command blocker.
+- **Source:** Carried RFC-B §§3.1, 4, and 6.
+- **Expected:** A sound transaction-client callback and current exported adapters for the full
+  matrix.
+- **Actual:** The helper asserts the full root client; focused check compiled invalid root-only
+  calls; no SQLite adapter subpath exists; isolation is a provider set/configuration; #1293 targets
+  another package's class/error hook while `@netscript/database/adapters/mysql` already exists.
+- **Severity:** significant.
+- **Action:** require a true `TTx`, exact supported-level sets, separate feasibility/current-support
+  columns, treat SQLite as unproven, and classify #1293 as adjacent.
+- **Evidence:** `research.md` R2/R3/R12/R13; focused probe transcript in `worklog.md`.
+
+## 2026-08-08 — Proposal concurrency and telemetry APIs are unsafe as written
+
+- **What:** The proposal offers `expectVersion(current)` and emits raw scope/key/version attributes.
+- **Source:** Carried RFC-B §§3.3 and 3.6.
+- **Expected:** A race-free portable version check and safe command telemetry.
+- **Actual:** Read-then-compare does not make the mutation conditional; raw identifiers and versions
+  are high-cardinality and may contain sensitive application data.
+- **Severity:** significant.
+- **Action:** make CAS repository-specific with a zero-row typed conflict, and restrict default
+  telemetry to stable names, enums, booleans, and counts.
+- **Evidence:** Prisma OCC docs; OTel attribute requirement/convention guidance; `research.md`.
+
+## 2026-08-08 — PLAN-EVAL cycle 1 exposed three undeclared boundary decisions
+
+- **What:** The first RFC draft left receipt duplicate recovery/timeout, relay type ownership, and
+  queue reuse-versus-rejection to implementation inference.
+- **Source:** Authoritative `plan-eval.md` findings F-B1–F-B3; verdict `FAIL_PLAN`.
+- **Expected:** The plan's open-decision sweep should have resolved every choice that could rework
+  provider or package boundaries.
+- **Actual:** The core laws were sound, but these three decisions were absent from both locked plan
+  and FCP questions.
+- **Severity:** critical.
+- **Action:** lock provider-specific claim algorithms, split database raw relay persistence from
+  service decoded runtime/sinks, reject queue-package reuse in v1, and propose queue runtime-DDL
+  reconciliation before future code sharing.
+- **Evidence:** RFC normative claim/relay/queue sections; `research.md` R21–R25; `plan.md` L14–L16.
+
+## 2026-08-08 — Receipt identity drift was described more strongly than the key can enforce
+
+- **What:** The first draft said scope must be stable but did not state that a changed scope or
+  renamed command creates a different unique-key namespace.
+- **Source:** `plan-eval.md` F-B4.
+- **Expected:** Same raw idempotency key would appear protected by the key-reuse law.
+- **Actual:** `(scope, commandName, keyHash)` changes, so no conflicting receipt exists and the
+  handler honestly executes as new.
+- **Severity:** significant.
+- **Action:** add deterministic identity fixtures, execute-as-new negative conformance, and a
+  breaking replay migration/alias rule for scope/name changes.
+- **Evidence:** RFC canonical identity, semantic law 13, conformance items 5–6.
+
+## 2026-08-08 — Isolation vocabulary needs provider allow-lists and default-only truth
+
+- **What:** Existing planning treated MySQL/SQLite capability as a supported-level set only.
+- **Source:** `plan-eval.md` F-B5/F-B7f and current adapter source.
+- **Expected:** MySQL omits unsupported `Snapshot`; SQLite could advertise its serializable engine
+  level directly.
+- **Actual:** The lower MySQL adapter union includes/interpolates `SNAPSHOT`; the evaluator found
+  SQLite's Prisma selection surface unavailable even though its engine default is serializable.
+- **Severity:** significant.
+- **Action:** replace the capability with `selectableIsolationLevels` plus `defaultIsolation`, make
+  MySQL four-level allow-list/removal a Stage-6 gate, and put SQLite's default-only acceptance in
+  FCP Q2.
+- **Evidence:** RFC capability matrix; `research.md` R27/R29; `plan.md` L18/L20.
+
+## 2026-08-08 — Queue runtime DDL is baseline drift, not command-kit precedent
+
+- **What:** `@netscript/queue` already creates PostgreSQL queue/DLQ schema from runtime adapter
+  initialization.
+- **Source:** `packages/queue/adapters/postgres.adapter.ts` and dead-letter adapter; F-B3.
+- **Expected:** The RFC's no-hidden-migration law might read as a repository-wide current invariant.
+- **Actual:** It is a normative rule for new command-kit/relay paths; the sibling queue behavior is
+  existing drift requiring separate reconciliation before reuse.
+- **Severity:** significant.
+- **Action:** scope the immediate law to command-kit paths and propose a migration-free queue slice;
+  create no issue in this RFC run.
+- **Evidence:** RFC queue-decision/rejected-alternative/board sections.
+
+## 2026-08-08 — Launcher metadata formatting arrived with evaluator handoff
+
+- **What:** `.llm/runs/docs-rfc-command-composition-kit--rfc/codex-thread-ids.md` had a pre-existing
+  launcher metadata formatting edit when remediation began.
+- **Source:** worktree at evaluator HEAD `122301d25`.
+- **Expected:** Evaluator commit plus clean authored state.
+- **Actual:** The metadata lines were reflowed without changing thread/session identities.
+- **Severity:** minor.
+- **Action:** preserve and include the formatting reconciliation with run-artifact updates; do not
+  discard or regenerate launcher identity state.
+- **Evidence:** final raw diff and commit slice S4.