From 767eabd2001f5425b4c7d4b28f518f299fd74e45 Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Sat, 30 May 2026 17:56:48 -0400 Subject: [PATCH 1/6] Document SourceOS interaction task boundary --- .../sourceos-interaction-boundary.md | 93 +++++++++++++++++++ 1 file changed, 93 insertions(+) create mode 100644 docs/integrations/sourceos-interaction-boundary.md diff --git a/docs/integrations/sourceos-interaction-boundary.md b/docs/integrations/sourceos-interaction-boundary.md new file mode 100644 index 0000000..31cf28c --- /dev/null +++ b/docs/integrations/sourceos-interaction-boundary.md @@ -0,0 +1,93 @@ +# SourceOSInteractionEvent task-boundary binding + +## Status + +Boundary registration and deterministic fixture validation only. + +Superconscious may accept or emit `SourceOSInteractionEvent` references at the task boundary so Noetica, AgentTerm, Superconscious, AgentPlane, Memory Mesh, Agent Registry, Policy Fabric, and model-router can coordinate over one interaction substrate without collapsing authority boundaries. + +## Canonical contract + +The canonical schema is owned by `SourceOS-Linux/sourceos-spec`: + +- `schemas/SourceOSInteractionEvent.json` +- `generated/python/sourceos_interaction_event.py` +- `generated/typescript/sourceos-interaction-event.ts` + +Superconscious does not own this schema. It may vendor, validate, or reference it from a pinned SourceOS spec revision. + +## Allowed Superconscious behavior + +Superconscious may: + +- accept a source interaction event or event reference as bounded task context; +- emit a bounded result interaction event or event reference; +- preserve session, workroom, topic, thread, actor, participant, task, steering, governance, evidence, replay, and redaction references; +- coordinate the visible cognition/task loop around the event; +- route missing-authority states to the appropriate authority plane. + +## Prohibited authority drift + +Superconscious must not: + +- become the Policy Fabric admission authority; +- become the Agent Registry grant/session/revocation authority; +- become the Memory Mesh durable memory or context-pack authority; +- become the AgentPlane execution evidence or replay authority; +- become the model-router authority in SourceOS mode; +- put raw secrets, credentials, unrestricted transcripts, unrestricted shell output, unrestricted browser history, or private chain-of-thought in event payloads; +- treat an interaction event as side-effect authorization. + +## Required task-boundary fields + +A Superconscious task-boundary binding should carry, at minimum: + +- `source_interaction_event_ref` or `source_interaction_event`; +- `result_interaction_event_ref` or `result_interaction_event`; +- `session_ref`; +- `workroom_ref` or explicit null; +- `topic_ref` or explicit null; +- `actor_ref`; +- `policy_decision_refs`; +- `grant_refs`; +- `memory_scope_ref` or explicit null; +- `context_pack_refs`; +- `agentplane_run_ref` or explicit null; +- `evidence_refs`; +- `replay_ref` or explicit null; +- `redaction_refs`. + +## Payload posture + +Only bounded metadata, summaries, or references are allowed. `payload_mode` must be one of: + +```text +metadata-only +summary +ref-only +inline-bounded +redacted +``` + +Private chain-of-thought is never a valid payload. + +## Operational flow + +```text +Noetica / AgentTerm / Matrix / API source event + -> SourceOSInteractionEvent ref or bounded inline event + -> Superconscious task-boundary binding + -> Policy / grant / route / memory / evidence references preserved + -> bounded result interaction event/ref emitted + -> AgentTerm or Noetica can render the same governance trace +``` + +## Validation + +Use the local checker: + +```bash +python3 scripts/check_sourceos_interaction_boundary.py tests/fixtures/integrations/sourceos-interaction-boundary.valid.json +``` + +The checker validates that the binding is bounded, preserves authority references, and does not claim policy, grant, memory, route, or evidence authority. From eb0faed31156a3fe850057d0142da778877baba8 Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Sat, 30 May 2026 17:57:31 -0400 Subject: [PATCH 2/6] Add SourceOS interaction boundary schema --- .../sourceos-interaction-boundary.v1.json | 87 +++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 schemas/integrations/sourceos-interaction-boundary.v1.json diff --git a/schemas/integrations/sourceos-interaction-boundary.v1.json b/schemas/integrations/sourceos-interaction-boundary.v1.json new file mode 100644 index 0000000..35bcabf --- /dev/null +++ b/schemas/integrations/sourceos-interaction-boundary.v1.json @@ -0,0 +1,87 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://socioprophet.ai/superconscious/schemas/integrations/sourceos-interaction-boundary.v1.json", + "title": "SourceOSInteractionEvent Task Boundary Binding", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "binding_id", + "mode", + "authority_boundaries", + "source_interaction_event_ref", + "result_interaction_event_ref", + "payload_mode", + "session_ref", + "actor_ref", + "policy_decision_refs", + "grant_refs", + "context_pack_refs", + "evidence_refs", + "redaction_refs", + "claim_boundary" + ], + "properties": { + "schema_version": {"const": "superconscious.sourceos-interaction-boundary/v1"}, + "binding_id": {"type": "string", "pattern": "^urn:srcos:superconscious:interaction-boundary:"}, + "mode": {"const": "task-boundary-reference-binding"}, + "authority_boundaries": { + "type": "object", + "additionalProperties": false, + "required": [ + "superconscious", + "sourceos_spec", + "policy_fabric", + "agent_registry", + "memory_mesh", + "agentplane", + "model_router" + ], + "properties": { + "superconscious": {"const": "task-cognition-coordinator"}, + "sourceos_spec": {"const": "canonical-schema-owner"}, + "policy_fabric": {"const": "policy-admission-authority"}, + "agent_registry": {"const": "identity-grant-authority"}, + "memory_mesh": {"const": "memory-context-pack-authority"}, + "agentplane": {"const": "execution-evidence-replay-authority"}, + "model_router": {"const": "sourceos-routing-authority"} + } + }, + "source_interaction_event_ref": {"type": "string", "pattern": "^urn:srcos:interaction-event:"}, + "result_interaction_event_ref": {"type": "string", "pattern": "^urn:srcos:interaction-event:"}, + "payload_mode": {"type": "string", "enum": ["metadata-only", "summary", "ref-only", "inline-bounded", "redacted"]}, + "session_ref": {"type": "string", "minLength": 1}, + "workroom_ref": {"type": ["string", "null"]}, + "topic_ref": {"type": ["string", "null"]}, + "actor_ref": {"type": "string", "minLength": 1}, + "policy_decision_refs": {"type": "array", "items": {"type": "string"}}, + "grant_refs": {"type": "array", "items": {"type": "string"}}, + "memory_scope_ref": {"type": ["string", "null"]}, + "context_pack_refs": {"type": "array", "items": {"type": "string"}}, + "agentplane_run_ref": {"type": ["string", "null"]}, + "evidence_refs": {"type": "array", "items": {"type": "string"}}, + "replay_ref": {"type": ["string", "null"]}, + "redaction_refs": {"type": "array", "items": {"type": "string"}}, + "source_event_summary": { + "type": "object", + "additionalProperties": false, + "required": ["surface_kind", "event_class", "task_status"], + "properties": { + "surface_kind": {"type": "string", "minLength": 1}, + "event_class": {"type": "string", "minLength": 1}, + "task_status": {"type": "string", "minLength": 1} + } + }, + "result_event_summary": { + "type": "object", + "additionalProperties": false, + "required": ["surface_kind", "event_class", "task_status"], + "properties": { + "surface_kind": {"type": "string", "minLength": 1}, + "event_class": {"type": "string", "minLength": 1}, + "task_status": {"type": "string", "minLength": 1} + } + }, + "claim_boundary": {"type": "string", "minLength": 1} + } +} From 3612b0367a714adb5a86762ac034674d283710bd Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Sat, 30 May 2026 17:58:42 -0400 Subject: [PATCH 3/6] Add valid SourceOS interaction boundary fixture --- .../sourceos-interaction-boundary.valid.json | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 tests/fixtures/integrations/sourceos-interaction-boundary.valid.json diff --git a/tests/fixtures/integrations/sourceos-interaction-boundary.valid.json b/tests/fixtures/integrations/sourceos-interaction-boundary.valid.json new file mode 100644 index 0000000..d4c66c3 --- /dev/null +++ b/tests/fixtures/integrations/sourceos-interaction-boundary.valid.json @@ -0,0 +1,46 @@ +{ + "schema_version": "superconscious.sourceos-interaction-boundary/v1", + "binding_id": "urn:srcos:superconscious:interaction-boundary:noetica-local-demo-0001", + "mode": "task-boundary-reference-binding", + "authority_boundaries": { + "superconscious": "task-cognition-coordinator", + "sourceos_spec": "canonical-schema-owner", + "policy_fabric": "policy-admission-authority", + "agent_registry": "identity-grant-authority", + "memory_mesh": "memory-context-pack-authority", + "agentplane": "execution-evidence-replay-authority", + "model_router": "sourceos-routing-authority" + }, + "source_interaction_event_ref": "urn:srcos:interaction-event:noetica-standalone-complete-0001", + "result_interaction_event_ref": "urn:srcos:interaction-event:superconscious-boundary-accepted-0001", + "payload_mode": "ref-only", + "session_ref": "noetica-session-local", + "workroom_ref": "urn:srcos:workroom:professional-intelligence-demo", + "topic_ref": "urn:srcos:topic:professional-intelligence", + "actor_ref": "urn:srcos:subject:user:operator", + "policy_decision_refs": [ + "urn:srcos:decision:noetica-standalone-admit-0001" + ], + "grant_refs": [ + "call:openai" + ], + "memory_scope_ref": "noetica-session-local", + "context_pack_refs": [], + "agentplane_run_ref": null, + "evidence_refs": [ + "urn:srcos:evidence:noetica-standalone-0001" + ], + "replay_ref": "urn:srcos:replay:noetica-standalone-0001", + "redaction_refs": [], + "source_event_summary": { + "surface_kind": "noetica", + "event_class": "interaction.task_completed", + "task_status": "success" + }, + "result_event_summary": { + "surface_kind": "superconscious", + "event_class": "interaction.task_completed", + "task_status": "accepted" + }, + "claim_boundary": "Superconscious binds SourceOSInteractionEvent references as bounded task context only. It does not own policy admission, agent grants, memory writeback, model routing, AgentPlane evidence, or replay authority." +} From c10bc91815b3cfb368fdf9ea040f5a429e8931c8 Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Sat, 30 May 2026 17:59:25 -0400 Subject: [PATCH 4/6] Add invalid SourceOS interaction boundary fixture --- ...tion-boundary.authority-drift.invalid.json | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 tests/fixtures/integrations/sourceos-interaction-boundary.authority-drift.invalid.json diff --git a/tests/fixtures/integrations/sourceos-interaction-boundary.authority-drift.invalid.json b/tests/fixtures/integrations/sourceos-interaction-boundary.authority-drift.invalid.json new file mode 100644 index 0000000..819d95a --- /dev/null +++ b/tests/fixtures/integrations/sourceos-interaction-boundary.authority-drift.invalid.json @@ -0,0 +1,40 @@ +{ + "schema_version": "superconscious.sourceos-interaction-boundary/v1", + "binding_id": "urn:srcos:superconscious:interaction-boundary:invalid-authority-drift", + "mode": "task-boundary-reference-binding", + "authority_boundaries": { + "superconscious": "policy-admission-authority", + "sourceos_spec": "canonical-schema-owner", + "policy_fabric": "policy-admission-authority", + "agent_registry": "identity-grant-authority", + "memory_mesh": "memory-context-pack-authority", + "agentplane": "execution-evidence-replay-authority", + "model_router": "sourceos-routing-authority" + }, + "source_interaction_event_ref": "urn:srcos:interaction-event:noetica-standalone-complete-0001", + "result_interaction_event_ref": "urn:srcos:interaction-event:superconscious-boundary-accepted-0001", + "payload_mode": "ref-only", + "session_ref": "noetica-session-local", + "workroom_ref": null, + "topic_ref": null, + "actor_ref": "urn:srcos:subject:user:operator", + "policy_decision_refs": [], + "grant_refs": [], + "memory_scope_ref": null, + "context_pack_refs": [], + "agentplane_run_ref": null, + "evidence_refs": [], + "replay_ref": null, + "redaction_refs": [], + "source_event_summary": { + "surface_kind": "noetica", + "event_class": "interaction.task_completed", + "task_status": "success" + }, + "result_event_summary": { + "surface_kind": "superconscious", + "event_class": "interaction.task_completed", + "task_status": "accepted" + }, + "claim_boundary": "Invalid fixture: Superconscious incorrectly claims policy authority." +} From fb1c3f4dfc03f987067dc0704bcf3f4d6f6292fd Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Sat, 30 May 2026 17:59:58 -0400 Subject: [PATCH 5/6] Add SourceOS interaction boundary checker --- .../check_sourceos_interaction_boundary.py | 98 +++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 scripts/check_sourceos_interaction_boundary.py diff --git a/scripts/check_sourceos_interaction_boundary.py b/scripts/check_sourceos_interaction_boundary.py new file mode 100644 index 0000000..e7d01f9 --- /dev/null +++ b/scripts/check_sourceos_interaction_boundary.py @@ -0,0 +1,98 @@ +#!/usr/bin/env python3 +from __future__ import annotations + +import json +import sys +from pathlib import Path + +try: + import jsonschema +except Exception: # pragma: no cover + jsonschema = None + +ROOT = Path(__file__).resolve().parents[1] +SCHEMA = ROOT / "schemas" / "integrations" / "sourceos-interaction-boundary.v1.json" + +REQUIRED_BOUNDARIES = { + "superconscious": "task-cognition-coordinator", + "sourceos_spec": "canonical-schema-owner", + "policy_fabric": "policy-admission-authority", + "agent_registry": "identity-grant-authority", + "memory_mesh": "memory-context-pack-authority", + "agentplane": "execution-evidence-replay-authority", + "model_router": "sourceos-routing-authority", +} + +FORBIDDEN_PAYLOAD_TERMS = { + "chain-of-thought", + "private reasoning", + "raw secret", + "credential dump", + "unrestricted transcript", + "unrestricted shell output", + "browser history dump", +} + +REQUIRED_CLAIM_PHRASES = ( + "bounded task context", + "does not own policy admission", + "agent grants", + "memory writeback", + "model routing", + "AgentPlane evidence", + "replay authority", +) + + +def load_json(path: Path) -> dict: + return json.loads(path.read_text(encoding="utf-8")) + + +def validate(path: Path) -> None: + doc = load_json(path) + schema = load_json(SCHEMA) + + if jsonschema is not None: + jsonschema.validate(instance=doc, schema=schema) + + boundaries = doc.get("authority_boundaries", {}) + for key, expected in REQUIRED_BOUNDARIES.items(): + if boundaries.get(key) != expected: + raise AssertionError(f"authority boundary drift for {key}: expected {expected!r}") + + payload_mode = doc.get("payload_mode") + if payload_mode not in {"metadata-only", "summary", "ref-only", "inline-bounded", "redacted"}: + raise AssertionError(f"invalid payload mode: {payload_mode!r}") + + serialized = json.dumps(doc, sort_keys=True) + lowered = serialized.lower() + for term in FORBIDDEN_PAYLOAD_TERMS: + if term in lowered: + raise AssertionError(f"forbidden payload term present: {term!r}") + + claim_boundary = doc.get("claim_boundary", "") + for phrase in REQUIRED_CLAIM_PHRASES: + if phrase not in claim_boundary: + raise AssertionError(f"claim_boundary must include {phrase!r}") + + if doc.get("source_interaction_event_ref") == doc.get("result_interaction_event_ref"): + raise AssertionError("source and result interaction event refs must be distinct") + + if not doc.get("source_interaction_event_ref", "").startswith("urn:srcos:interaction-event:"): + raise AssertionError("source_interaction_event_ref must be an interaction-event URN") + + if not doc.get("result_interaction_event_ref", "").startswith("urn:srcos:interaction-event:"): + raise AssertionError("result_interaction_event_ref must be an interaction-event URN") + + +def main(argv: list[str]) -> int: + if len(argv) != 2: + print("usage: check_sourceos_interaction_boundary.py ", file=sys.stderr) + return 2 + validate(Path(argv[1])) + print("sourceos interaction boundary: ok") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main(sys.argv)) From 1c226640606d15aa5aa5c05d92e8bb2d548ac503 Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Sat, 30 May 2026 18:00:39 -0400 Subject: [PATCH 6/6] Test SourceOS interaction boundary checker --- tests/test_sourceos_interaction_boundary.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 tests/test_sourceos_interaction_boundary.py diff --git a/tests/test_sourceos_interaction_boundary.py b/tests/test_sourceos_interaction_boundary.py new file mode 100644 index 0000000..7ff0e40 --- /dev/null +++ b/tests/test_sourceos_interaction_boundary.py @@ -0,0 +1,18 @@ +from pathlib import Path + +import pytest + +from scripts import check_sourceos_interaction_boundary as checker + +ROOT = Path(__file__).resolve().parents[1] + + +def test_valid_sourceos_interaction_boundary(): + checker.validate(ROOT / "tests/fixtures/integrations/sourceos-interaction-boundary.valid.json") + + +def test_rejects_sourceos_interaction_authority_drift(): + with pytest.raises(Exception): + checker.validate( + ROOT / "tests/fixtures/integrations/sourceos-interaction-boundary.authority-drift.invalid.json" + )