Plans turn intentions into revisable dependency graphs (migration 0027):
objective, assumptions, ordered or dependent steps, capabilities,
expected observations, preconditions, risk, estimates, budget,
completion criteria, abort conditions and the alternatives considered.
- Validation owns structure: acyclic dependencies, registered and
unlocked capabilities only, schema-valid parameters, targets that agree
with parameters, read-only checks, a closed set of step kinds and
internal actions. Model proposals are parsed into the same structure;
fields that could carry authority or claim progress are reported as
ignored, and an invalid draft is stored as a draft that never runs.
- The planner prefers deterministic strategies: a direct action verified
by observation, a read-only diagnosis that requests temporary scoped log
access with risk and fallback stated, and an escalation that diagnoses
and informs the operator instead of repeating a failed action. Failed
strategies are not reused; a model is consulted only when none applies.
- The executor holds no state in memory: it claims a step with a
conditional update, acts only through Invoke and RequestCapability, and
records the outcome. Waiting for approval or access forms a subordinate
intention and blocks the parent with the reason. Expectations become
verification predictions resolved from a read-only observation, so an
HTTP-level success is never taken as the outcome; a miss is a prediction
error that weakens the supporting belief and triggers reconsideration.
Replanning creates a new revision, withdraws open requests of the old
one and keeps it as history, within a replan limit. Checks never raise
approval prompts. Budgets stop runaway plans. Preconditions skip actions
when the world already changed. Dream plans and disabled sandbox minds
never act. An interrupted non-idempotent action with no record is
blocked for verification instead of repeated; recorded outcomes are
adopted. Completed plans are stored as procedural memories; a completed
escalation does not count as fulfilling the intention.
- Executions and approvals record their origin; minds may withdraw their
own pending approval requests; Preview reports a decision without side
effects; service.status is allowed by default as a bounded read.
Bounded operations instead of a shell (ADR-0011): service.status,
service.restart and logs.query run systemctl/journalctl from a fixed
allow-list with no shell, a minimal environment, validated unit names and
the unit as the derived policy target; logs mask e-mail and IP addresses
and credential-like values by default. host.disk.usage,
host.memory.status and host.process.list read the kernel directly and
never read command lines. browser.navigate/read/links fetch through the
SSRF-safe client, run no scripts, refuse cross-host redirects, use the
host as the policy target and deliver content as low-trust observations.
Writing browser operations are designed but not registered. The test
harness takes a fake command runner so no test touches a real unit.
Andy Dixon