# Plans

Implementation plans that have not been fully executed. A pending plan is
live documentation: keep it accurate as the work proceeds (check off stages,
record scope changes).

When a plan has been executed or abandoned, it stops being a plan and becomes
a record: archive it to `docs/history/plans/` following the procedure in
[`../README.md`](../README.md).

## Current plans

- [CFC spec correspondence process](cfc-spec-correspondence-process.md)
  gives agents the procedure for changing Contextual Flow Control here: read
  the specification first, classify the change as host arrangement, conforming
  implementation or semantic gap, and route a semantic gap through a specs
  pull request before code; and stages what enforces it, from the instruction
  surfaces that name the specs repository, through a hash-pinned spec snapshot
  and correspondence manifest checked in CI and a §18.6.4 conformance
  statement, to a kernel of same-named pure functions the pseudocode is the
  source of.
- [Unify Weaver Ask and CF harness](weaver-ask-console.md) sequences typed
  callbacks, a cohesive handles module, one session UI for both command aliases,
  and hands-on demo validation across labs, Weaver, and Loom.
- [Memory router security requirements](memory-router-security-requirements.md)
  defines the authentication, authorization, isolation, and public-ingress
  gates for multiplexed Memory WebSockets routed to toolsheds.
- [Compact CFC label maps](compact-cfc-label-maps.md) proposes shared label
  subtrees, graph-aware policy queries, and a reader-first stored-format migration
  to bound the cost of staged reference diamonds.
- [Independent reference labels](cfc-independent-reference-labels.md) moves a
  link write to the specified contract (§8.2, §8.12.8): the slot persists the
  creating attempt's own label and nothing copied from the target, a label
  envelope beside a mergeable append describes the committed list, and a
  specs ruling retires the `LinkReference` atom, after which the runtime
  stopped minting and reading it. Legacy entries stay as conservative
  restrictions; no migration runs.
- [Release gates without an integrity union](cfc-release-gate-integrity.md)
  keeps one consumed value's evidence from releasing another value's clause:
  the write, sink and display gates run value-intrinsic rules at each location
  an access consumed and the other rules over the join (§5.3, §4.6.3). What
  remains is a specs ruling on the join within one location and the display's
  fit of a cell's stored label.
- [Input requirements on an endorsed computation's arguments](cfc-argument-input-requirements.md)
  refuses a stand-in fed to code a rule endorses, by checking the integrity
  each argument declares against the reads made through it. The declaration is
  taken from the code's own module, not the graph's data, so a rule that guards
  on the identity rests on it. It needs a narrow specs ruling first, and it
  parks a per-item threshold drawn from a policy key.

- [Shuffled test order: what is left to build](test-order-shuffle.md) carries
  the piece the shuffle does not yet have: a shuffle inside this repository's
  own `describe()` and `it()`, which every test file already resolves to,
  reordering the cases inside a file that `deno test --shuffle` leaves in
  place. Its first stage, a scheduled run under the next day's seed a day
  ahead, is built.
- [Security and privacy roadmap](security-privacy-roadmap.md) gives an overview
  of current trust boundaries and the path from runtime security to operator
  exclusion, with remaining work and technical references in an appendix.
- [Discovering Loom resources with wish](loom-resource-discovery.md) proposes
  publishing existing database and companion-cell references once per Loom
  environment, with a staged person-inbox migration and compiled integration
  acceptance gates.
- [Revising a piece's source from an agent session](piece-revision-from-a-session.md)
  covers the two `pattern-author` tools that revise a piece someone already
  has — a handle-addressed read of its current source, and a direct edit
  through the runtime's own compatibility check and setup transaction — what
  they lean on rather than rebuild, and the two questions left open: whether
  revising is really `run_pattern` with a target, and what to do about an
  agent retyping a whole pattern for a one-character mistake.
- [View-scoped client replication](view-scoped-client-replication.md) tracks
  rollout, recovery, and adversarial verification of active-view delivery and
  guarded speculative computation. It separates execution demand from delivery
  and stages document selection before optional field projections.
- [cf-harness task research and composition](cf-harness-inbox-reliability.md)
  adds a `research` service that reads documentation and indexed source,
  prepares a usable implementation kit for every task, and supports tested email
  components that authors can compose.
- [Interaction cost in the unified inbox](person-inbox-interaction-cost.md)
  records the runtime work behind a thread open that cost 1482 ms paced and
  10.7-19.5 s against five people's data: the per-read prefix scan over a
  document's dereference-trace sources, the schemaless result pull a child
  instantiation registers, and the authoring rule that a display cap bounds the
  render and not the transaction. It carries what was disproved with what
  landed, and the one item still open — a session that settles at ~800 ms after
  roughly twenty clicks, which is waiting rather than compute.
- [Topics computation cost and live upgrade](topics-computation-cost.md)
  sequences shared backlink lookup, incremental mention maintenance, topic
  summaries, measurement gates, and rehearsed upgrades of populated boards.
- [One way to render Markdown](markdown-rendering.md) brings the three modules
  that render `marked` tokens — the `<cf-markdown>` component, the harness
  console, and the `cf` pager — onto one character reference decoder and one URL
  policy, and asks whether the two Lit renderers should share their token walk.
- [Cast-free patterns](cast-free-patterns.md) sequences shared type and API
  repairs, migration of authored patterns and their tests, and enforcement
  through lint and new-source admission.
- [Acquiring skills from the open internet](external-skill-acquisition.md)
  splits discovery from acquisition against a public skill registry: the
  registry answers what exists, a digest-verified `.well-known` entry or a git
  commit SHA answers for the bytes, the text loads by handle into a child the
  chooser never reads, and a split-mint provenance mark records where it came
  from without declassifying anything.
- [Collection naming: the first customer](collection-naming-topics.md)
  builds [Naming in collections](../specs/collection-naming.md) on a parallel
  exemplar board — a naming library, a member namespace the CLI and the shell
  resolve as `top/42`, and `#42` in the editor — proven against the Topics
  shape by a test-only board, and grafted onto Topics once, at the end.
- [`cf view` language and syntax coverage](cf-view-language-coverage.md)
  orders the remaining language, data, build, and configuration formats needed
  for honest coverage of the active organization repositories.
- [cf-harness Codex subscription authentication](cf-harness-codex-subscription-auth.md)
  tracks the remaining shipping gates after the core implementation.
- [CFC exchange-rule authoring](cfc-exchange-rule-authoring.md) tracks the
  remaining owner decisions and blocked stages for exchange rules.
- [CFC llm-sink admission](cfc-llm-sink-admission.md) tracks the
  boundary-scoped admission mechanism the max-enforcement posture names as
  pending for its llm sinks: public-only ceilings paired with class-scoped
  exchange rules, the llm sink class those rules need, and the owner decisions
  on which authority and which caveat tiers admit content to a model.
- [CFC TypeScript authoring](cfc_typescript_authoring.md) sequences the
  TypeScript and JSX authoring surface for CFC metadata.
- [First-class serializable factories](first-class-serializable-factories.md)
  sequences the implementation of durable pattern, module, and handler
  factories.
- [Hosted pattern authoring](hosted-pattern-authoring.md) sequences the shared
  server operation and the piece menu, Home, and `cf` entry points for changing
  a piece or creating a space from a request.
- [Developer-tooling feedback for hosted authoring](hosted-pattern-authoring-tooling-feedback.md)
  adds a separate, non-blocking way for an authoring agent to report missing or
  defective development capabilities.
- [Ingest channels and the journal sink](ingest-channels-journal-sink.md)
  proposes a minted, bearer-authed inbound endpoint that accumulates what it
  receives as a provenance-marked, append-only log — the shared capability
  behind webhooks, beacons, and any source with no runtime of its own. It
  builds on the split-mint seam in
  [`../features/vouched-ingest-channel-mint.md`](../features/vouched-ingest-channel-mint.md).
- [Integration-test video demos](integration-test-video-demos.md) tracks
  optional CI adoption and further fixture hardening.
- [Stream markers out of stored data](stream-markers-out-of-stored-data.md)
  moves stream-ness out of the stored `{ "$stream": true }` value and into the
  link schema and the module wrapper, and triggers the cold-start repairs on a
  structural mismatch instead of the missing marker. It names putting the
  owner into a stream's address as the follow-up it is written toward.
- [Cutting the resume pre-sync's cost](resume-presync-cost.md) removes what
  the pre-sync repeats or does not need: a child start re-planning the
  subtree its parent named, every plan's inputs cell re-inlining its
  schemas, a cross-space pass that materializes every plan to find a link,
  a planning loop that never yields to read the answers it asked for, and a
  node bound once for the pre-sync and again for its instantiation.
- [Pre-syncing from node plans](presync-from-node-plans.md) makes one
  derivation per pattern node serve both instantiation and the pre-sync, so a
  resume and a fresh start name exactly what each lift, handler, builtin, and
  nested pattern reads under their declared read schemas, then holds each
  node's first run on the loads it named instead of on a space-wide timer.
- [A scheduler breaker for remote-echo write loops](scheduler-remote-echo-breaker.md)
  bounds the loop in which a derivation writes a document, a remote change to
  that same document re-triggers it, and it writes again without end because
  another session is doing the same from the other side. Detection keyed per
  `(action, document)` on the self-referential, foreign-triggered, value-changing
  write; capped exponential backoff on the re-run; a counted loud line, a
  scheduler stat, and trips and clears reported over the memory session to the
  health route beside the commit rates; and a two-session harness that trips
  the loop on purpose. The
  backoff Topic 911 waits for, and the first of Topic 913's three guardrails.
  Always on, in every runtime.
- [Durable history of new real test failures and a bounded
  aggregate](durable-new-real-test-failure-history.md) keeps every new real
  test failure the test-selection publisher has credited a test with through
  a bootstrap, a rename, and an outage, and stops the publisher's aggregate
  growing with the age of the store. It is built, and waits for the checks
  its first run after landing answers.
- [Memory `apply-op`](memory-apply-op.md) sequences the editor-neutral
  collaborative-field substrate, the first CodeMirror codec and editor
  integration, and the checkpoints and review gates required before a future
  WordGard codec.
- [Seed: codeless graph rebuild](codeless-graph-rebuild-seed.md) records,
  for a parked arc, the facts that make a running piece's graph durably
  reconstructible from scheduler state and module-addressed code — the
  recovery class the 2026-08-27 keyless close-out ruled out of contract.
- [Server-primary execution v2](server-execution-v2.md) sequences the
  greenfield rebuild that executes the server-side-execution v2 spec, with
  per-phase task and success-criteria checkboxes. Its
  [stage-C design](server-execution-v2/stage-c-design.md) is the
  reconciled design + build work order for the design build stage
  (demand as the memory server's tracked-ids closure with the demand
  walk deleted — the structural walk demoted to fallback — the client
  intent listener, the ruled double-dispatch implementation, the
  acceptance and the owner ruling set); it archives beside the stage-C
  closeout when that build lands.
- [Scheduled work in the server](scheduled-work-in-the-server.md) proposes a
  simpler form for bgUpdater, which the owner ruled will come back later: a
  pattern declares the cadence it wants to wake on, and the space's own
  serving runtime honors it, so background work needs no separate process
  anyone has to run and keep online. Nothing wakes a piece on a timer with nobody watching, and the ruling
  accepts that capability being absent in the meantime — nothing depends on
  it. Two separable parts: the capability, and compute accounting, which the
  capability does not depend on to function. The capability rests on a further
  ruling, because a scheduled wake would be the second issuer of warm demand
  where the spec pins the count at one.
- [Revision-keyed schema memo](revision-keyed-schema-memo.md) designs a
  cross-evaluation, per-document memo of schema-walk computation on the
  memory server, keyed by each document's revision so validity needs no
  invalidation machinery, sitting under the query evaluation cache to make
  post-commit and cross-shape evaluations cost what changed instead of the
  whole corpus. Carries the measured baseline and the staged path to a
  per-revision snapshot cache.
- [Retention and CFC execution provenance](retention-and-provenance.md)
  sequences how long an invocation record is kept and what the runtime knows
  about who caused it — the `AgentActor` mint, trusted ingress, and metadata
  confidentiality. Gated on a CFC review that has not happened.
- [Random space identities](random-space-identities.md) gives every newly
  created space a fresh random identity whose authority ends after ACL genesis,
  while every space that already exists keeps its DID and the name that reaches
  it. It implements the
  [random space identity specification](../specs/random-space-identities.md),
  uses existing DID routes, and is complete without a public name registry.
  The code is implemented; its deployment sequence, a specification change and
  an infrastructure change in other repositories, and the tripwire's deletion
  remain.
- [CFC runner implementation](runner_cfc_implementation.md) defines the
  commit-boundary enforcement workstreams and rollout.
- [Finishing the piece source lifecycle](piece-source-lifecycle-completion.md)
  compares the lifecycle spec against the repository and orders the remainder
  as four pull requests in two tracks — what a revision records, and how a
  learned route persists.
- [Bulk piece operations](piece-bulk-operations.md) designs retargeting,
  repairing, and rolling back many pieces as one reviewable, resumable
  operation over a shared plan — with batching as an execution strategy
  underneath rather than the subject.
- [The Topics verb surface](topics-verb-surface.md) sequences how the Topics
  board and topic grow their verbs without breaking the pieces already holding
  data: the shape the board demands of a stored topic, the one rehearsed break
  that narrowing it needs, and the items waiting on platform work.
- [`compact-space`](compact-space.md) designs the operator tool that shrinks
  one space's revision history after a write storm: materialize a `set` at
  every selected head under one `system` compaction commit, keep every head's
  address but the ACL document's, which records the compaction, drop the
  rows behind it, hollow every commit payload outside a retained window
  except the genesis receipt's and those an `op_*` row references, while
  keeping every commit's identity,
  and write the result out with `VACUUM INTO`. Options for what compaction
  means and what each breaks, the flags, the safety and rollback recipe for
  Estuary, and the server change that goes first because it keeps a future
  storm from degrading the space it hits.
- [`cf space clone` rehearsal](space-clone-rehearsal.md) records the design for
  rehearsal-grade copies of populated spaces. The tooling has shipped (`cf
  space`, `cf inspect churn`); the operating procedure lives in
  [`../development/space-clone-rehearsal.md`](../development/space-clone-rehearsal.md).
  The plan stays live until the practice has been exercised on a real
  migration.
- [Reading Fabric data](fabric-read-model.md) is the umbrella for one model
  across three concerns: everything addressable is a cell, so a verb's result
  and a direct read are the same operation on different cells. It carries the
  vocabulary and points at
  [shaped reads and verb results](shaped-reads-and-verb-results.md) — the shared
  read layer, how a shape says "an address here, a value there", and what
  calling a verb adds — and at
  [CLI surface shape](../history/plans/cli-surface-shape.md) for the command surface, an executed
  plan now archived. Start here rather than at either part.
- [References as arguments](references-as-arguments.md) proposes lifting
  address resolution out of the LLM dialog builtin, which already does it, and
  into the boundary every external caller crosses. An LLM and the CLI can
  hand a pattern a reference — the CLI in both spellings, converting the
  emitted address against the declared contract at its dispatch gate — while
  the webhook and ingest paths still forward a payload unresolved. It carries
  the measurement, the size, and the gate-by-gate evidence that the remaining
  refusal is drift rather than policy. The ruling it was once gated on is
  executed and archived:
  [the verb input contract](../history/plans/verb-input-contract.md).
- [Designing verbs so they can change](verb-evolution.md) records how verbs are
  declared so that adding to and changing them later is possible: verbs are
  promises and their names are stable by default — an owner may break their
  own pattern deliberately, so what a caller holds is a commitment rather than
  a guarantee — a holder declares only what it uses, an optional member's
  maybe is resolved once at binding, and an output change gets a new verb
  name. It states what the update gate enforces today, what
  the transformer and authoring tools should carry so a one-off author never
  has to learn a rule, and the open stream — named versioned interfaces,
  per-piece upgrade policy, migrations that run code — that everything else
  stands as the interim for. Written to be followable by anyone on the team,
  not only by pattern authors.
- [Verb calls: working notes](verb-result-selection.md) holds the call-specific
  investigation those documents do not carry: what produces a receipt and what
  its existence proves, how a receipt's address is derived, and the error and
  exit-status conventions. Sketches to draw from, not a settled contract.
- [Verbs — implementation plan](verbs-implementation.md) sequences the remaining
  work on verbs across both arcs that produced it: what a verb declares, what a
  caller may ask for, and what comes back. Read it for order; read the designs
  it points at for reasoning.
- [Shuttle — a place-aware fabric shell](shuttle/README.md) is the working design
  state for an interactive terminal tool: a REPL whose prompt carries a
  mutable current place — the context that fills in the omitted levels of the
  fabric's right-anchored references — plus full-screen live views, for
  inspecting and editing space and piece state. Decisions so far and open
  questions; construction is under way, in the order its
  [build sequence](shuttle/build-sequence.md) sets out.
- [Shell completion coverage](cli-completion-coverage.md) sequences the work
  that makes `cf completion` answer correctly across the surface it claims and
  reach the verb surface it does not: the slots that offer a wrong candidate,
  the verb flags and result shapes that offer none, the source `--space` needs
  before any of it is reachable by name, and the gate that keeps completion
  from falling behind the command tree again.
- [Handler-callable egress](handler-callable-egress.md) records the capability
  a pattern does not have: a network request a handler can issue and await,
  which the runtime records and gates the way it records and gates a node
  factory's request. It carries the shape of program that has no home without
  one, the two routes a design could take and what each gives up, and the
  provider-side stack left standing in the meantime.

## Concepts not planned for deployment

These documents retain implementation detail for designs that may be evaluated
again. They are not scheduled work and are not dependencies of current plans.

- [Space name registry](space-name-registry.md) describes a possible
  implementation of the DNS namespaces, ASP redirects, registered targets, and
  displayed-name selection in the dormant
  [Common Fabric URL](../specs/fabric-urls.md) concept. It remains independent of
  space identity creation.