Reconcile producer guidance with the Phase A interoperability gates

[forkwright]

Finding

Hamma's public producer guidance currently dispatches the WireGuard data plane before the two control-plane gates that make it safe and interoperable. It also relies on private Kanon planning as the sequencing authority, which reverses the producer/consumer relationship for a public repository.

Evidence

• README.md, CLAUDE.md, AGENTS.md, llms.txt, and _llm/current_state.toml carry separately authored Phase A status or ordering.
• The current implementation is a self-paired registration/map prototype: Implement HTTP/2 over Noise instead of treating Noise records as control RPC boundaries #65 documents the invented direct-JSON framing where the reference protocol requires HTTP/2 over Noise.
• Build authoritative ACL policy state before advertising or activating the data plane #67 documents the absent authoritative ACL state and the required distinction between absent, present-empty deny-all, and present-non-empty policy.
• Cargo.toml has no active boringtun dependency and no data-plane constructor exists.
• The root Cargo manifest proves Koinon is a standalone forkwright/koinon dependency used only for dictyon development support; it is not an Akroasis-owned crate.

Why this matters

Agent prose is a weak and duplicated control. A private consumer plan cannot be the only authority for a public producer's build order, and a future data-plane patch must fail before merge if it appears without both predecessor capabilities.

Desired correction

• Add one public typed contracts/phase-a.toml graph with exactly:
  • Implement HTTP/2 over Noise instead of treating Noise records as control RPC boundaries #65 http2-over-noise;
  • Build authoritative ACL policy state before advertising or activating the data plane #67 effective-acl, requiring http2-over-noise;
  • data-plane, explicitly requiring both.
• Generate bounded Phase A blocks in every public/agent surface and regenerate _llm/current_state.toml from that contract.
• Put the generator's fixed-point/graph check inside the required forge and GitHub gates; docs-only changes must not bypass it.
• Refuse data-plane dependency/module activation while either predecessor is incomplete.
• Keep interoperability claims receipt-bound to immutable producer and independent-oracle artifacts.
• Make private Kanon planning consume this producer contract, not redefine it.
• Correct Koinon's ownership from the Cargo manifest.

Done when

• One public typed graph owns Phase A order and every prose projection is generated from it.
• CI rejects malformed/cyclic graphs, a node advanced past an incomplete predecessor, stale projections, and premature data-plane activation.
• No surface calls WireGuard the next milestone while Implement HTTP/2 over Noise instead of treating Noise records as control RPC boundaries #65 or Build authoritative ACL policy state before advertising or activating the data plane #67 is incomplete.
• Koinon is described as the standalone shared crate it is.
• Any completed interoperability gate names a hash-bound independent receipt.

[forkwright]

Completed by #123, merged as 9aa9a56223afdd47d7723104cd16a5c07d5fc722.

The public typed contract now owns the exact Phase A order; every public/agent projection is derived from it; required gates reject malformed, cyclic, unknown-key, invalid-transition, stale-projection, and premature-activation states; and Koinon ownership is corrected. All completion transitions remain fail-closed.

This does not claim independent interoperability proof. The authenticated independent oracle and hash-bound completion receipt remain explicitly owned by open #122.

[forkwright]

Completion-audit correction — Kanon still does not consume the public producer state

Verified against Hamma main 9aa9a56223afdd47d7723104cd16a5c07d5fc722 and Kanon main b1d7cf9a56f9e55f1c9a052900adafdf31fcfd97.

PR #123 correctly made contracts/phase-a.toml the public typed authority and derived Hamma's public/agent Phase A blocks. The cross-repo acceptance clause in this issue remains unmet: canonical Kanon projects/hamma/STATE.md still publishes an older, contradictory project state rather than consuming that producer contract and live repository facts.

Evidence

forkwright/kanon/projects/hamma/STATE.md currently says all of the following:

• :11-17 — “No dictyon code touched since 2026-04-13,” despite substantial later control, validation, contract, and release work through Hamma main@9aa9a562.
• :19 — version v0.1.0 (unreleased), while Hamma root Cargo.toml is workspace version 0.2.0 and the repository has released through that line.
• :28-36 and later summaries — the live shared crate is hamma-core; current Hamma has workspace members dictyon and mitos, and no crates/hamma-core path.
• :134-151 — Derive every control-plane version from one truthful capability and encode TS2021 big-endian #64 and Lint-debt burn-down: 18 violations block gate stamping (baseline expires 2026-08-13) #57 are active blockers. Both issues are closed as completed (Derive every control-plane version from one truthful capability and encode TS2021 big-endian #64 on 2026-08-16; Lint-debt burn-down: 18 violations block gate stamping (baseline expires 2026-08-13) #57 on 2026-08-15).
• :153-161 and repeated earlier prose — Milestone 4/WireGuard data plane is “next.” The public producer contract requires http2-over-noise (Implement HTTP/2 over Noise instead of treating Noise records as control RPC boundaries #65) → effective-acl (Build authoritative ACL policy state before advertising or activating the data plane #67) → data-plane, and makes all completion transitions unavailable pending the authenticated independent oracle in Prove the capability-version handshake against an independent TS2021 oracle #122.
• The Active blockers section does not represent Prove the capability-version handshake against an independent TS2021 oracle #122's completion-authority gate, despite the public generated contract making that limitation central.
• :163-168 — the repo is an AGPL scaffold with an unresolved license reconsideration. Current Hamma is explicitly dual Apache-2.0 OR MIT in Cargo metadata and both public license files.

The closure comment on this issue says “the public typed contract now owns the exact Phase A order” and that private Kanon planning consumes it. The first statement is true inside Hamma; the second is not true of current Kanon.

Why this matters

Kanon is the fleet's canonical planning/control surface. Agents consulting it receive a false repository topology, release state, blocker set, license, and next milestone. Most importantly, they are still told to proceed toward data-plane work in prose that bypasses the public producer's executable dependency graph.

This recreates the exact authority inversion #118 was filed to eliminate: the producer contract says one thing, while the private consumer plan independently preserves another.

Desired correction / remaining done criteria

Reproject projects/hamma/STATE.md from the public Hamma contract and current repository state:

• make the generated/public Phase A graph the only source of gate order and completion authority;
• represent Implement HTTP/2 over Noise instead of treating Noise records as control RPC boundaries #65, Build authoritative ACL policy state before advertising or activating the data plane #67, and Prove the capability-version handshake against an independent TS2021 oracle #122 with their actual roles and current states;
• remove closed Derive every control-plane version from one truthful capability and encode TS2021 big-endian #64/Lint-debt burn-down: 18 violations block gate stamping (baseline expires 2026-08-13) #57 from active blockers;
• update workspace topology to dictyon + mitos and remove all hamma-core claims;
• update version/release/license facts from GitHub/Cargo rather than maintained prose;
• replace “Milestone 4 is next” with the executable producer order; and
• remove historical “no code touched” status that no longer describes the repository.

Keep Kanon-only material limited to private coordination context that cannot be derived from the producer. Add a check or generated projection so a stale crate path, closed issue listed as active, or producer-order contradiction cannot satisfy the Kanon docs/state gate.

This issue should remain open until the Kanon-side canonical state actually consumes the public authority it required.