Hertz control plane / verified audit 15 August 2026 · Canary contract revision f2bcf456d7fc

Al cutover + workforce readiness

Good design.
Incomplete cutover.

The V2 route is real, and its module tests are strong. The live system still exposes an obsolete V1 contract, depends on frozen helpers, and cannot start a new workforce flow from the current working tree.

Source flows11
Al mapped8
Al tests406 / 0
Old refs14
Frozen links7
Dispatch nowBlocked
01

Ordered work

Get Al fully onto Canary V2

Finish the public contract first. Then remove the compatibility world. Ratify only clean, identifiable bytes.

Remaining list

10 open
  1. Publish the real V2 wire contract. Replace Al's public V1 schema, old action enum, examples, and 16 V1 fixtures.
  2. Stop dropping V2 meaning. Make V2 the native handler model, or isolate the V2-to-V1 adapter behind one named compatibility boundary.
  3. Prove Canary is V2-only. Observe production input, then remove V1 fields, actions, and acceptance.
  4. Make drift checks structural. Compare shapes, types, conditions, actions, and retired acceptance. Add the missing “accepts retired” check.
  5. Remove frozen brief paths. Replace the five old release and Airtable paths with V2-owned sources.
  6. Ratify the product registry. Commit the V2 manifest and its loader/tests before it is runtime authority.
  7. Close the route matrix. Add or remove innovation deliberately. Decide the Al front doors for asm, component, and user-guide.
  8. Restore liveness hooks. Install and prove Al's tmux hooks, or report degraded health instead of accepting the failure.
  9. Test the service as a service. Split the 5,282-line server and add boot-level coverage for the HTTP, spawn, callback, and reaper seams.
  10. Run known clean bytes. Add loaded-byte identity, ratify the tree, restart Al, and prove the version endpoint identifies what is running.

Migration dependency map

V2 seam incomplete 
flowchart TB
  C["Canary V2
rev f2bcf456d7fc"]:::good --> W["V2 wire validation"]:::good
  W --> N["V2 → V1 normalization
fields lose native meaning"]:::warn
  N --> H["Legacy internal handler model"]:::bad
  H --> S["Spawn and callback pipeline"]:::warn

  P["Al public contract
schema 1.12.0 / V1"]:::bad -. "contradicts" .-> C
  F["V1 fixtures and old actions"]:::bad --> P
  D["Drift checker
names, not full structure"]:::warn -. "clean result misses mismatch" .-> P

  R1["1 · Publish V2 schema + fixtures"]:::next --> R2["2 · Prove V2-only traffic"]:::next
  R2 --> R3["3 · Retire adapter + V1 acceptance"]:::next
  R3 --> R4["4 · Ratify clean bytes + restart"]:::next
  R4 --> DONE["Canary contract aligned
old world removed"]:::good

  classDef good fill:#11291f,stroke:#62d39a,color:#f2f6fa,stroke-width:2px;
  classDef warn fill:#2b2214,stroke:#ffc45c,color:#f2f6fa,stroke-width:2px;
  classDef bad fill:#30171d,stroke:#ff7777,color:#f2f6fa,stroke-width:2px;
  classDef next fill:#0c2734,stroke:#5fd8ff,color:#f2f6fa,stroke-width:2px;
Verified seam: the live Canary contract is V2. Al accepts it, then normalizes it to a V1 model. Al's own public /pea/trigger/contract still describes V1. The present drift check reports clean because it does not compare the full public structure.
02

Workforce flows + build team

How work is meant to move

Eleven source contracts exist. Al maps eight jobs. Three contracts have no Al route. Innovation has a selector but no contract.

Executable route

8 mapped / 11 contracts 
flowchart LR
  C["Canary
POST /pea/trigger"]:::start --> A["Al
validate + normalize"]:::start
  A --> R{"Action route"}:::gate

  R -->|build / mandate| B["build"]:::mapped
  R -->|bug-reproduce| CB["confirm-bug"]:::mapped
  R -->|feature-ideate| E["explore"]:::mapped
  R -->|ideation profile| I["ideation"]:::mapped
  R -->|audit| CA["codebase-audit"]:::mapped
  R -->|ux audit| UA["ux-audit"]:::mapped
  R -->|Airtable| AT["airtable-build"]:::mapped
  R -->|release| RL["release"]:::mapped
  R -->|innovation| IX["innovation
REFUSED: no source contract"]:::bad

  B & CB & E & I & CA & UA & AT & RL --> D["flow-dispatch
job → source contract"]:::core
  D --> G["flow-spawn
HEAD-byte gate"]:::core
  G --> T["isolated worktree
tmux harness"]:::core
  T --> P["seat-send
prose run flow contract"]:::core

  NR["asm · component · user-guide"]:::orphan -. "source contracts exist;
no Al route" .-> D

  classDef start fill:#0c2734,stroke:#5fd8ff,color:#f2f6fa,stroke-width:2px;
  classDef gate fill:#2b2214,stroke:#ffc45c,color:#f2f6fa,stroke-width:2px;
  classDef mapped fill:#11291f,stroke:#62d39a,color:#f2f6fa,stroke-width:2px;
  classDef core fill:#101f31,stroke:#5fd8ff,color:#f2f6fa,stroke-width:2px;
  classDef bad fill:#30171d,stroke:#ff7777,color:#f2f6fa,stroke-width:2px;
  classDef orphan fill:#2b2214,stroke:#ffc45c,color:#f2f6fa,stroke-width:2px,stroke-dasharray:5 4;

Flow list

Current catalogue
  • buildPlan, build, prove, package, close.
  • confirm-bugReproduce, decide, report.
  • exploreScope, investigate, publish, retro.
  • ideationVisual loop, approval, locked brief.
  • codebase-auditParallel audit, gate, remediation.
  • ux-auditSurface audit, gate, remediation.
  • airtable-buildPlan, build, validate.
  • releaseLinus release flow.
  • asmSource contract. No Al route.
  • componentSource contract. No Al route.
  • user-guideSource contract. No Al route.
  • innovationAl selector. No source contract.

Build team + gates

Strong shape 
flowchart TB
  S["Steve
lead + integration"]:::lead
  S --> F["Frame + definition of done"]:::gate
  F --> PL["Theo
plan + architecture"]:::role
  PL --> BU["Andrew + Travis
build + prove"]:::role
  BU --> RV["Liz
quality review"]:::role
  BU --> UI["Chris
UI review when needed"]:::role
  RV & UI --> FG{"Final gate"}:::gate
  FG --> PK["Steve
package + PR"]:::lead
  PK --> CL["Evidence + close"]:::done

  classDef lead fill:#0c2734,stroke:#5fd8ff,color:#f2f6fa,stroke-width:2px;
  classDef role fill:#101f31,stroke:#3d5874,color:#f2f6fa,stroke-width:2px;
  classDef gate fill:#2b2214,stroke:#ffc45c,color:#f2f6fa,stroke-width:2px;
  classDef done fill:#11291f,stroke:#62d39a,color:#f2f6fa,stroke-width:2px;
Authority defect: the launcher executes src/flow-*.prose.md. It does not import the richer peas/teams/*/index.md programs. Both layers define the team, but the launcher binds only one. The detailed gates can drift without changing execution.
03

Live script and team state

Well tested. Not deployable as-is.

The intended controls are good. Current unratified bytes and old-world dependencies make the operating state red.

Current state map

Dispatch blocked 
flowchart TB
  A["Al modules
406 pass / 0 fail"]:::good --> R["Route selection"]:::good
  D["flow-dispatch
45 pass"]:::good --> FS["flow-spawn
40 pass"]:::good
  SS["seat-send
18 pass"]:::good

  R --> FS
  SS --> X{"Working bytes
equal HEAD?"}:::gate
  FS --> X
  X -->|No: dirty seat-send| ALL["ALL new flow-spawn
dispatches blocked"]:::bad
  X -->|Build contract dirty| BUILD["build dispatch blocked"]:::bad

  OLD["14 frozen refs
8 team files"]:::bad --> HELP["5 V2 helpers missing"]:::bad
  LINKS["7 installed Al helper links
still frozen"]:::bad --> CUT["Old-world cutover incomplete"]:::bad
  DUAL["Two program-authority layers"]:::warn --> CUT
  HELP --> CUT
  ALL --> READY["NOT OPERATIONALLY READY"]:::bad
  BUILD --> READY
  CUT --> READY

  classDef good fill:#11291f,stroke:#62d39a,color:#f2f6fa,stroke-width:2px;
  classDef gate fill:#2b2214,stroke:#ffc45c,color:#f2f6fa,stroke-width:2px;
  classDef warn fill:#2b2214,stroke:#ffc45c,color:#f2f6fa,stroke-width:2px;
  classDef bad fill:#30171d,stroke:#ff7777,color:#f2f6fa,stroke-width:2px;

Verdict matrix

Not fully V2
AreaStatusVerified finding
Flow designGoodClear stages, named roles, dedicated worktrees, fail-closed gates. Eleven V2 contracts lint with 0 errors and 1 warning.
Module testsStrongAl 406/0. flow-dispatch 45 pass. flow-spawn 40 pass. seat-send 18 pass.
Whole-service proofWeakThe large Al server is excluded from normal coverage because it boots on import.
Current launcherBlockedDirty seat-send bytes fail the launcher integrity gate for every new dispatch. Active Al and flow scripts are unratified working bytes.
Build flowBlockedThe build source contract differs from HEAD and fails its own contract gate.
Team programsMixedBuild: BLOCK. Airtable: PARTIAL. Audit: PARTIAL. Solution Guide: BLOCK.
Program authoritySplitSource flow contracts execute. Richer team programs are not imported by the launcher.
Canary contractMismatchCanary is V2. Al publicly advertises obsolete V1, drops V2 fields, and normalizes V2 into V1.
Estate checksIncompleteV2 run-all sees 6 checks; the frozen runner sees 36. Taxonomy, enforcement, health, and publishing checks are missing.
Runtime controlsDegradedAl tmux liveness hooks are absent. Runtime helper links are mixed between V2 and frozen sources.
Old worldPresent14 direct old references, five missing V2 helpers, and seven frozen installed links remain. Both contract sets still use frozen prose-lint.
Review proofGapThe review-seat suite has a test/schema disagreement.
OverallNot readyDo not call the team fully migrated or currently dispatch-ready.
406 passAl · 0 fail
45 passflow-dispatch
40 passflow-spawn
18 passseat-send
V2 liveCanary rev f2bcf456d7fc
Evidence anchors: agentic_workforce/services/al/server.ts, agentic_workforce/control-plane/contracts/dispatch-contract.schema.json, programs/flow-spawn/flow-dispatch.ts, programs/flow-spawn/flow-spawn, src/flow-*.prose.md, and peas/teams/*/index.md. The legacy contract set also linted: 83 contracts, 0 errors, 5 warnings. Live state and test results were checked on 15 August 2026.