RFC-0003 implementation campaign: ActionIntent adoption to typed-domain kernel #26

Purpose

A non-normative execution plan for moving RFC-0003 from a ratified encoding to meaningful substrate use without spending an adversarial-review round on every mechanical prerequisite.

Current facts:

• Tranche A3 / CNP-0-JCS: RATIFIED
• adoption-evidenced: false
• interop-confirmed: false
• Myc standalone-test prerequisite merged: a8ee5b3e1604b4257210a7df061dac29389f24cc
• Myc organism-history reconciliation merged: 2fbcdbafc73c0a0806db5513a8691bbe8b298c5f
• chord-frontmatter signature-format gap remains deferred in Define a versioned chord signature that authenticates authority frontmatter #25

This issue is a work plan, not ratification authority and not evidence by itself.

Campaign 1 — adopt CNP-0-JCS on the ActionIntent authority path

Claude owns the implementation batch

Prepare both candidate PRs before asking Codex for another review.

1. Myc ActionIntent candidate

   • rebuild the original ActionIntent commit on current Myc main;
   • only x5820_action_intent.ts, its tests, and the proposal E2E test;
   • exact hsp-jcs@v0 / cnp-0 canonical bytes and known digest;
   • no dual-hash path;
   • full runtime-domain validation on both exported encoding/commitment entrypoints;
   • reject extra members;
   • requested_effects is an actual canonical set: deduplicate and sort;
   • direct-bypass negatives for every class rejected by validateIntent;
   • standalone deno task check.

2. Trinity ActionIntent candidate

   • may initially pin the unmerged Myc candidate commit so both sides can be reviewed together;
   • update the vendored x5E10_warrant.ts algorithm and runtime validation;
   • exact canonical-byte and digest vector locally, even when submodules are unavailable;
   • when the Myc checkout is present, compare bytes and digest across the boundary;
   • E2E must exercise the stored proposal/grant and authority comparison, not only a helper;
   • core CI remains self-contained without sibling checkout;
   • update stale RFC README/status prose only in this final Trinity candidate, not in Myc;
   • keep interop-confirmed: false.

3. Freeze both candidate SHAs and provide one delta-only evidence packet.

One joint Codex gate

Codex reviews the Myc and Trinity candidates together, once:

• exact candidate/base SHAs and closed changed-file sets;
• canonical bytes and digest;
• direct-bypass/domain attacks;
• cross-substrate byte parity;
• E2E authority path;
• status/provenance claims.

After acceptance:

1. merge Myc first;
2. move Trinity's submodule pin from the reviewed Myc head to its merge commit;
3. rerun CI; the one-line pin adjustment needs ancestry/diff verification, not a new semantic review;
4. merge Trinity;
5. one signed Claude receipt for the whole campaign, pinning both accepted and merge SHAs.

adoption-evidenced becomes true only if the merged E2E/runtime path really computes hsp-jcs@v0 references on the ActionIntent authority path. It does not move interop-confirmed.

Campaign 2 — typed-domain kernel before broader federation

After Campaign 1 is closed, do not sweep all remaining stable() helpers.

Prepare one bounded Tranche-B design/proof package covering the dependencies needed by later work:

• capability-split StateDomain interfaces and typed delta space (B1/B3);
• declared algebra laws plus explicit evidence status (B2/B7);
• invariant context as a content-addressed input (B4/B8);
• version derived from the content DAG (B5);
• identify which properties Lean can prove structurally and which require runtime evidence.

Deliver the interface/evidence map first. A second Lean package is justified only where it decides a normative ambiguity or proves a composition invariant; theorem count is not a goal.

Codex performs one review of the frozen package, not per file.

Campaign 3 — translation and admission slice

Only after the B kernel is settled:

• connect the existing Part-03 Lean loss/suitability results to the typed-domain carrier;
• implement one real translator with canonical loss/suitability/debt receipts;
• then exercise one conflict/admission boundary from Tranches D/E;
• do not begin the full federation handshake or activate the autonomy executor from elapsed time.

The current live roadmap marks the autonomy actuator as designed but dormant and requiring organic acted-receipt evidence. This campaign must not manufacture that demand.

Review-budget policy

Claude may merge without Codex micro-review

Only when all are true:

• docs, fixtures, projections, or local tests;
• no canonical bytes/digest, authority, crypto, trust root, ratification/status, or external effect;
• exact closed file set;
• CI green;
• an executed counterexample for every claim that something is rejected;
• no unresolved review comment.

Codex samples these at the next campaign checkpoint.

Joint frozen-batch review required

Any change to:

• wire/canonical bytes or reference identity;
• authority/admission/finality;
• signatures, keys, or crypto verification;
• normative RFC text or ratification/adoption status;
• irreversible/external effects.

Batch related changes and request one review only when the complete candidate is frozen.

Round limit

• Maximum two Codex adversarial rounds per frozen high-risk batch.
• P0/P1 findings are fixed.
• After round two, non-security polish and hypothetical hardening without a runnable reproducer go to a follow-up issue.
• No receipt until the campaign is merged.
• Reports are delta-only: exact SHA, changed files, commands/results, executed negative controls, remaining limitations. Do not repeat the history or self-diagnosis unless it changes the disposition.

Explicitly deferred

• independent interoperability or manufactured “second maintainer” evidence;
• global migration of every stable serializer;
• chord signature format v2 (Define a versioned chord signature that authenticates authority frontmatter #25);
• autonomy activation without organic demand;
• further conformance-kit hardening without a concrete new reproducer.