aios/docs/ARCHITECTURE_CHANGE_V2.md

AIOS Unified Platform Convergence — Architecture Change V2

Status: R2 REVIEW CANDIDATE Date: 2026-09-14 Authority base for rebind: beabd053961047f170e87e1110f2636dbd50f5fb

1. Purpose

R2 preserves the R1 architectural direction but corrects the eight review findings F01–F08. It does not authorize deployment.

The program still has four tracks:

1. existing Identity / Lineage S3;
2. ANNEX-2.3 R2 Auto-Claim / Execution Integrity;
3. Platform Generation G0 (WP0a–e/WP1/WP2 only);
4. governed merge, staging, release and root/program acceptance.

Existing Identity/Lineage mission/root/children remain authoritative and are not recreated or redefined by this program.

2. Authority split

• Git authority main: beabd053961047f170e87e1110f2636dbd50f5fb
• release-control runtime: 3c320aeb89d9ba8f0ed516abeb57252682b18983
• production V2R2C2: 4642b74af62c89a505ae49241e805a5a88ca897f

A review candidate is not a governed commit. All target preimages must be refreshed from live Git authority before submission.

3. R2 safety corrections

3.1 Caller evidence is fail-closed

caller_scan v2 separates:

• static source caller evidence;
• active runtime caller evidence;
• test-only evidence;
• opaque/dynamic uncertainty;
• complete negative evidence.

Static source imports alone do not prove runtime LIVE.

PROVEN_ORPHAN requires all of:

• zero production static caller;
• zero active systemd/API/scheduler/runtime-loaded caller;
• relevant runtime host set non-empty and completely scanned;
• loaded bytes negative proof;
• systemd/API/scheduler scan coverage;
• complete observation window;
• no probe failures/opaque dynamic references;
• rollback reference;
• independent acceptance GO.

Incomplete negative evidence returns LIKELY_ORPHAN; probe failure, opaque dynamic import, or unresolved production source caller returns UNKNOWN. UNKNOWN can never drive Sunset.

3.2 Schedulability proof is diagnostic, final claim is authoritative

R2 checks task lifecycle state and treats explicit max_concurrency=0 as zero. Invalid capacity values are structured blockers.

The proof remains non-bearer. Claim has three stages:

1. preflight observation;
2. claim-time read-only recheck;
3. existing TaskPlane authority performs claim_atomically at the linearization point.

The atomic adapter contract must revalidate task revision/generation/status, worker generation/identity/health/capacity, authorization ref/revision, scope, dependencies, freeze and conflicting lease inside the same authoritative transaction/fenced operation that creates the claim.

The returned receipt must include claim id, lease id, fencing generation and receipt revision.

R2 reference tests verify the adapter contract only. They do not prove a production adapter is atomic; real staging A18–A23 remain mandatory.

3.3 Retry Governor is whitelist-only

• UNKNOWN/indeterminate → RECONCILE;
• governance/dependency boundary → BLOCK;
• proven success → SUPPRESS/REUSE;
• unrecognized state → BLOCK;
• only explicitly executable states may return EXECUTE.

A prior success for the same operation conflicting with a later NOT_APPLIED observation must reconcile rather than re-execute.

3.4 Canonical bytes are reused

Schedulability and Retry/Toil reuse app.task_plane.models.canonical_json; no second JSON canonical encoder is introduced. See ADR_CANONICAL_EVIDENCE_DIGEST_V1.md.

3.5 Platform G0 discovery is not G0 acceptance

WP0a–d and WP1 now expose completeness/missing evidence. Lexical/static discovery cannot by itself satisfy Generation-G0 Exit.

See G0_EVIDENCE_COVERAGE_V2.md.

4. Non-circular review/deploy gates

R1's production gate was circular because existing root C06 and Program production evidence could be required before production itself.

R2 replaces it with:

REVIEW_READY
  ↓
STAGING_ACTIVATION_READY
  ↓
STAGING_ACCEPTED
  ↓
PRODUCTION_ELIGIBLE
  ↓
PRODUCTION_ACCEPTED
  ↓
PROGRAM_COMPLETE

REVIEW_READY

Requires:

• live authority rebind + exact preimages;
• ChangeEnvelope complete;
• complete affected repository regression;
• independent review GO.

STAGING_ACTIVATION_READY

Requires:

• governed commit + authority readback;
• bounded staging activation scope;
• rollback/recovery plan ready;
• pre-activation lab/contract evidence.

It does not require evidence that only real staging activation can produce.

STAGING_ACCEPTED

Requires actual staging:

• TaskPlane adapter/claim/lease/fencing;
• root action executor;
• ANNEX A01–A23;
• restart/response-loss/sibling concurrency/recovery evidence.

PRODUCTION_ELIGIBLE

Requires:

• STAGING_ACCEPTED;
• existing release authorization valid;
• production rollback ready;
• freeze/NO-GO clear.

PRODUCTION_ACCEPTED

Requires actual deployment:

• production deployment/runtime readback;
• authenticated business E2E;
• external projection readback.

PROGRAM_COMPLETE

Only after production acceptance:

• existing Identity/Lineage original C01–C06 all accepted;
• Program final acceptance all satisfied;
• final root review proves no remaining acceptance gaps.

The existing root acceptance contract is unchanged. Its full completion is consumed only by the final program-complete gate.

5. State authority rules

No new business authority is added.

• caller_scan: read-only evidence producer;
• WP0 inventories: read-only discovery;
• Environment Profile: read-only host profile;
• Retry Governor: decision/audit only;
• SchedulabilityProof: short-lived diagnostic evidence;
• SystemTruth: read-only derived view;
• TaskPlane / existing claim transaction: authoritative task/claim/lease state;
• existing mission/continuation path: root-action executor;
• existing release Saga: release authority.

No new Task DB, scheduler, mission store, release controller or authorization authority is introduced in R2.

6. Migration

• Existing mission/root/children: preserve IDs and acceptance.
• Legacy durable task/job: attach metadata only; do not replace identity.
• Schedulability proof: persist only through existing evidence/journal if persistence is required.
• No direct SQLite mutation outside existing TaskPlane repository.
• G0 outputs remain shadow/read-only.

7. Deployment status

R2 code may proceed to live-authority rebase and repository-native review after its focused regressions pass.

Deployment remains NO-GO until:

• live preimages are refreshed;
• full repository regressions pass;
• atomic TaskPlane adapter is implemented and verified;
• ANNEX A18–A23 pass;
• real root-action executor consumes PENDING intents exactly once;
• independent staging review is GO.

8. Rollback

Review candidate: discard candidate.

Governed but undeployed commit: use existing successor/revert path; no shared branch reset/force push.

Staging: disable feature/policy binding and preserve evidence.

Production: existing release Saga rollback only.

9. Deferred platform work

WP3–WP10 remain dependency-gated backlog from Platform Baseline V4. R2 does not claim their acceptance and does not pre-build them.