025 closes baserow, gitlab and the public-exposure limits. The gitlab
entry replaces the survey's Premium-or-Ultimate claim with what the
source says, because that claim would have kept a working endpoint
behind a licence that does not gate it.
032 turns two Phase 2 criteria from untouched into stdio_only with the
evidence: OpenClaw's own CLI reference calls 'openclaw mcp serve' a stdio
server whose process the client owns, Hermes runs the SDK's stdio
transport from both entry points, and neither repository defines an HTTP
server path. A stdio server has no address on the container network, so
the supervisor flow is blocked rather than merely unbuilt. The agent
identity entry stops waiting on a credential model this repository would
write: no deployed provider offers the per-user OAuth that 035 requires
before auth_subject: user may be declared.
035 closes the range half with measured numbers and records the mutating
criterion as a gate, since no surface enables mutations and a test of
that path would assert against nothing.
The audit read as prose, so a role could sit under a classification nobody had checked against its own declaration, and "blocked" could not be told apart from "nobody looked". The sections are now named after the exact values a role declares, which makes the section titles the vocabulary: one rule holds every role under its own declared classification, a second rejects a classification outside the vocabulary, and a third requires a named blocker per blocked role while forbidding a blocked role from shipping an enabled surface.
The report itself is generated from the roles' own metadata and a drift check imports the generator and compares against the committed file, which caught a stale report twice while this work was in progress. It lives under docs/contributing rather than beside the requirements, because a generated file in that directory reads like a finished criterion.
The criteria across seven requirement files now carry what they rest on: what closed them, or what blocks them and where that was measured. Two coverage limits stay stated rather than hidden: the report is built only from roles that declare an MCP block, so a role blocked without one is invisible to it, and a ticked criterion here means implemented and tested rather than proven in operation.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
031, 032 and 033 named meta/schema.yml as the place credentials live, which
481666bdb renamed to meta/secrets.yml. 035 named role scripts without their
language folder, which dfe7a7fdd introduced.
Not cosmetic: a wrong location in a requirement costs real time. 036 asserted
that .running and group_names agree on a single-host round, and acting on
that claim configured every AI consumer with the openrouter/auto vendor model
until the gateway rejected it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The requirement assumed Hermes would use its own OIDC support. The
deployed version serves a bearer API rather than a browser dashboard, so
that support does not apply and the agent sits behind the auth proxy
like the other two. The amendment keeps the original decision visible
and names both sides: the API server key alone used to be the whole
boundary, and a client presenting only a bearer no longer reaches the
agent through its public vhost.
Tick 41 criteria across the MCP and AI requirements, each against a file
that carries the content or a line in a deploy log, leaving anything that
merely looked plausible unchecked.
Reword five criteria the implementation contradicted. Credentials now
follow their origin: a secret this deployment generates stays a vault
credential, one the application issues cannot be, because the vault
cannot generate it. OpenProject is licence-gated rather than pending.
Flowise prepares its instance rather than registering servers, since it
exposes no registry to register them in. A client is held to the server
list only where upstream offers one.
Replace the five audit-artifact criteria with three that describe what
the tree actually enforces. The generator and its committed file were
dropped: once every fact moved into the role that owns it, the artifact
was a copy that could only go stale, and grep answers the same question.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The requirement named Kata with the Firecracker hypervisor. That cannot be delivered on Docker Engine: Firecracker needs the container rootfs as a block device through the containerd devmapper snapshotter, while dockerd always hands the runtime a directory. Kata Firecracker driver advertises no filesystem sharing, and Kata own documentation tests Docker with QEMU. Reaching a microVM means moving the agent tier off dockerd onto containerd with devmapper, which is a separate decision, so the microVM clauses are marked as intent rather than shipped mechanism.
What ships is gVisor: runtime runsc, a userspace guest kernel intercepting syscalls before the host sees them. Decision 4 turns from a claim into an enforced one, matching the implementation: compose reads the runtime the container actually received and refuses runc, swarm refuses the sandbox label while the node default is still runc, and a lint refuses privileged containers, host namespaces and the docker socket in any role declaring the sandbox. Decision 3 gains the inverse placement constraint, because a node-wide default runtime applies to everything scheduled there. Decision 5 states arm64 as coverage rather than exclusivity.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kevinveenbirkenbach
