Wayfinder map: the deepening route — from the 2026-08-20 review to designed specs

[George-RD]

Destination

A decided deepening route: every candidate from the 2026-08-20 architecture review ruled land / fold / reject by the decision test (DIRECTION.md), surviving candidates carried to designed specs published via to-spec (ready-for-agent), plus the Immune-system (promise 4) design lane. Done when nothing about code shape is left to decide before to-tickets.

Notes

• Owner ruling (2026-08-20, second): the coordinator agent stands in for the owner in grilling rounds and to-tickets approvals for this map, answering from DIRECTION.md / CONTEXT.md / STORIES.md and the recorded decisions; lanes run as Orca-orchestrated sessions. Goal extended by the owner: complete roadmap + specs + implementation tickets with native dependencies, and rewrite pre-existing roadmap issues into one cohesive graph.
• Plan-only, with one owner override (2026-08-20): AFK wayfinder:task tickets may be batch-resolved in the session that charts or works the map, so existing issues get more implementation-ready immediately. HITL tickets (grilling/prototype) remain one per session.
• Handoff shape (DIRECTION.md "Delivery vehicle"): a design ticket resolves when its grilled decision is recorded and a to-spec spec issue exists on the tracker, linked from the resolution comment. to-tickets and implement run off-map from that spec.
• Vocabulary: CONTEXT.md (promises, users, runtime terms) · STORIES.md (failure modes) · DIRECTION.md (decided list, decision test). Cite promises and users by name.
• Bell roadmap is canon-as-context: priorities hold (Effect Truth first; the fit review gates tenancy implementation); map decisions add shape to its tickets via comments and links.
• Skills per ticket type: grilling + domain-modeling for design tickets; research; prototype. Review evidence: .raw/openspine-architecture-review-2026-08-20.md.

Decisions so far

• Fold the settlement and reservation shape into the Effect Truth issues: Gmail 5xx on drafts.create is classified as a confirmed failure, clearing the retry fence and releasing reviewed budget #173/Provably pre-effect ConnectorUnavailable rejection permanently retains the scoped standing-rule reservation #174 now carry the settlement-module direction, the typed-reservation step, and the dead EgressClassifier deletion.
• Fold the owner-surface leak inventory and command-table direction into #129: ~28 leaks, triplicated kind-dispatch, five Telegram-only command families, command-table direction posted.
• Fold the fault-seam evidence into #177: 13 mechanisms, four release-compiled flags — the seam must be test-gated wholesale.
• File the polling-twin fix as an implementation-ready issue: filed as Make the tested path the production path in Telegram polling, ready-for-agent.
• File package submission as a governed effect, fenced behind the fit review: filed as Package submission as a governed effect (fenced: post-fit-review).
• Research: design inputs for the Immune-system lane: catalogs are pre-inference, egress gating is runtime, provenance is hybrid; nothing raw crosses the quarantine boundary; the branch-steering residual is bounded by grants, not eliminated. Findings: research/immune-system-design-inputs.
• Design disclosure gating on external egress: generalized from a web-search-only branch to a connector-agnostic runtime hook on every external send (email.send was the live gap — the only counterparty-facing action bypassed disclosure); one MessagingSend egress class; Design provenance labels with typed identity #193's label extension point named; spec #204, tickets #205–#207.
• Design the typed owner identity: PrincipalId(Ulid) newtype + OwnerPrincipal aggregate replace the three AppState scalars and four grant.user shapes; approved_by sourced from the verified surface; optional audit actor dimension, no backfill; MACs preserved; tenancy explicitly out of scope but extendable. Spec #197, tickets #199–#203.
• Design capability-derived tool catalogs: a genuinely new pre-inference layer — no LLM-facing catalog exists today; pure projection in authority (grant + kernel tool descriptors → CatalogView) served over the existing /v1/task seam; denied/ungranted tools structurally absent (Bell I2); absence is attenuation, gate() stays the sole enforcement; step-up = recompute, no session state. Spec #209, tickets #210–#212.
• Design the deepened Store interface: transaction combinators + type-enforced audit-before-effect pairing on the effect path; begin_effect/settle_effect(disposition) seam reserved for Effect Truth Effect Truth Slice A-C: Characterise, type, and settle (Epic) #198; conn goes private with every bypass migrated; channel-neutral OwnerVerifiedProof and the dead-letter chat_id → OwnerSurfaceRef migration cut the store off telegram. Spec #208, tickets #213–#219 (expand–contract).
• Design provenance labels with typed identity: labels answer WHOSE data, not just what kind — ProvenanceOrigin {Owner(PrincipalId), Counterparty(IdentityRef), System}, kernel-minted and unforgeable; origin-vs-recipient closure enforced at egress in v1 (closes Bell's "internal data to a stranger"); grant caveat mirrors the egress-class caveat, dormant on the owner grant. Spec #220, tickets #221–#227.
• Rule on foreign-host mode: dormant or cited: census found no decision citing the Outside-framework story → dormant, recorded in DIRECTION.md; nothing that only it needs gets built or preserved.
• Roadmap cohesion (no wayfinder ticket): all 18 pre-existing roadmap issues rewritten to the standard shape with originals preserved; Effect Truth epic #198 with Gmail 5xx on drafts.create is classified as a confirmed failure, clearing the retry fence and releasing reviewed budget #173/Provably pre-effect ConnectorUnavailable rejection permanently retains the scoped standing-rule reservation #174 as sub-issues; native edges wired (Mine and match reusable authority by kernel-resolved scope #128/Prove progressive delegation is portable across communication protocols #131/Make reusable-authority evaluation proposal-specific and evidence-backed #133 ← Effect Truth; Compose whole responsibilities from workflows, triggers, authority, and exception policy #132 ← Mine and match reusable authority by kernel-resolved scope #128+Prove progressive delegation is portable across communication protocols #131); 7 issues fenced with fence:post-fit-review; Counterparty erasure has no local origination surface: sweep guard is wired but only externally reachable #172 kept unfenced as needs-triage.

Not yet specified

• Pipeline composition monoliths (main.rs 10-subsystem select, owner_review_decision ~800-line fn, worker lifecycle flattened into HTTP handlers): surfaced by the review's scouts, unscoped; revisit after the settlement and owner-surface decisions land.
• The inbound quarantine wrapper (UntrustedContext<T> / schema-decoded returns from untrusted content): a distinct adjacent Immune-system lane; its seam is named in spec #220 but nobody has designed it.
• What the Immune-system designs demand of the kernel HTTP contract and shell/TypeScript workers: partially cleared — the catalog rides the existing /v1/task seam (spec Spec: capability-derived tool catalogs #209); the worker-side rendering of tool descriptors remains a worker concern, dim until a real non-Rust worker exists (T11/T12).
• Retiring openspec tooling from scripts/check.sh: housekeeping after the Pocock workflow proves out.

Out of scope

• Kernel tenancy implementation — waits for the fit review; Bell v1 is instance-per-tenant (DIRECTION.md).
• WhatsApp connector build — during Bell's integration spike, never before (DIRECTION.md).
• Bell product specifics — Bell's own repo.
• Anything only the Outside-framework story needs — pending the foreign-host ruling ticket.
• The 41 MiB graphify history rewrite — decided, owner-executed; a fact, not a ticket (DIRECTION.md).