intent: neutral-manager-role

[yihanzhu]

Closes #169

What this accepts

This G1 intent defines the design problem and migration boundary for a vendor-neutral manager-role contract.

• manager/CLAUDE.md stays the current live Claude adapter.
• A later accepted design may reduce it to a thin wrapper over the neutral role.
• Claude, GitHub, Codex, model, and orchestration mechanics stay in adapters or the durable orchestrator.
• A selected profile may request capabilities and adapter bindings. Only accepted policy and permission records grant authority.
• The manager wrapper never launches a coder directly. Typed stage requests go through the durable orchestrator and the selected producer adapter.
• Live activation waits for an accepted default-adapter qualification record and environment-specific evidence from roadmap items 5–7. The record binds actual model/tool facts and every authority/config identity; unavailable facts cannot gate, and bound changes return the wrapper/environment to shadow.
• G2 waits for and pins the three portable-core children, control foundation, and durable orchestrator at G2. Implementation pins every corresponding G3 commit.

This PR does not rename the manager file, change the installed /yshifu command, edit the live Claude persona, implement an adapter, or activate anything.

Review

Three independent passes checked contract feasibility, roadmap/dependency consistency, and security/authority boundaries. Formal PR reviews tightened profile grants, qualification evidence, producer dispatch, and complete rollback. This is the third and final finding-driven revision under the rounds cap.

Proof

Clean detached worktree at 39b4fc924af3d82172d33e13d852fec6a7de8650:

• structure check: passed
• ShellCheck 0.11.0: passed
• north-star resolver: 74 passed
• north-star gate/consumer: 226 passed
• models parser: 63 passed
• degraded-review gates: 91 passed
• pending-stage, round-cap, quota, rename/probe tests: passed
• rename gate and git diff --check: passed

Merging this artifact would accept G1 exploration only. It would not approve G2, implementation, activation, or live synchronization.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: eb107e6
Reviewed-base: d3284c3
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/170-11196/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The intent assigns capability-granting authority to the selected profile, contradicting the accepted portable contract's separation between profile requests and policy grants. That would weaken the planned authorization boundary.

Review comment:

• [P1] Keep capability grants out of the selected profile — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.bnxUKpX5zs/work/neutral-manager-role/intent.md:29-29
  When a caller supplies the selected profile, this makes that profile the source of the manager's capabilities. That conflicts with portable-core-contracts, where a profile only requests capabilities and later accepted policy may grant them; otherwise a selected but unauthenticated profile could widen manager authority. State that the role uses capabilities granted by accepted policy or permission records, while the profile only requests adapter bindings.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	39b4fc9
Status:	✅  Deploy successful!
Preview URL:	https://d1e9ca1f.fabrica-6yx.pages.dev
Branch Preview URL:	https://ystack-intent-neutral-manage.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 392eb1e
Reviewed-base: d3284c3
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/170-28383/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The change adds a scoped intent document that preserves current behavior, records required dependencies, and keeps authority and adapter concerns separated. No actionable correctness issue was found.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 392eb1e
Reviewed-base: 3c657de
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/170-30162/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The intent leaves a path to activate an authority-bearing manager wrapper without the qualification evidence required by the accepted roadmap. That safety gate should be explicit before the intent is accepted.

Review comment:

• [P1] Require qualification before live manager cutover — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.xxCxiJ9ymL/work/neutral-manager-role/intent.md:90-93
  For a live manager that can clear proactive work and spawn coders, this list permits cutover after shadow smoke, permission checks, and operator approval without requiring the roadmap's accepted eval/telemetry stage or a qualification record bound to the exact workflow, profile, adapters, and execution environment. That would allow an authority-bearing prompt/profile change to go live before rollout items 5–7 prove it. Make live activation wait for the accepted default-adapter qualification and environment-specific evidence, as well as these operational checks.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 5f8950d
Reviewed-base: 3c657de
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/170-46908/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The intent assigns producer dispatch to the manager wrapper, which conflicts with profile-selected adapters and the durable orchestration boundary. Its cutover rollback also omits restoring configuration despite backing it up.

Full review comments:

• [P1] Route coder launches through the selected producer adapter — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.1kOpaVfMIi/work/neutral-manager-role/intent.md:72-72
  When a profile keeps Claude as manager but selects another producer, placing Claude subagent spawning in the manager wrapper makes the wrapper choose the producer instead of honoring the resolved profile. It also permits launches outside the typed stage-request and durable-orchestrator boundary, so recorded actor and capability data can disagree with the actual executor. Dispatch launches through the selected producer adapter; keep the wrapper limited to manager-runtime concerns.

• [P2] Restore configuration as part of rollback — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.1kOpaVfMIi/work/neutral-manager-role/intent.md:102-103
  When a failed cutover changed adapter, model, or permission configuration, restoring only the prior prompt and profile leaves the new configuration active. This bullet separately requires configuration backups, so the tested rollback must restore that configuration too; otherwise the old role can resume under incompatible settings or permissions.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 39b4fc9
Reviewed-base: 3c657de
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/170-64098/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The change adds only a new intent artifact and does not alter runtime behavior. Its authorization, dependency, qualification, activation, and rollback constraints are consistent with the repository's roadmap and safety rules.