S60 · U / Bagadata - the fleet's development agent

Declared state: built and REACHABLE 2026-10-17 - convene() has a caller (brain/u_launch), seats get their own git worktree on a run-scoped branch, teardown refuses over uncommitted work, and a live run spawned an installed CLI with the owner's checkout untouched. 16 of 19 seats drivable. Not yet proven: a real seat answering, which needs a provider credential the allowlist withholds on purpose.

This is the repository plan and evidence, not a live health reading. A task marked done may still depend on credentials, devices, deployment or a newer acceptance test.

Dependencies

S58, D-90, D-08

Tasks and gates

60.F1 · U writes objective, constraints and acceptance check into the worktree's AGENTS.md / CLAUDE.md before the CLI runs, so the harness reads the contract instead of receiving it as argv.

Tier F · done · Verification: hermetic-test

Gate: - `test_u_contract.py` - the worktree carries the contract before dispatch, and the argv equivalent is unchanged.

  • hermetic-green · 2026-10-17 · bench/test_u_contract.py, bench/test_u_launch.py

60.F2 · Verification gate extracted as its own component - tests, lint and diff scope - reusing the executor's refusal rules instead of only what code_improve.py does.

Tier F · done · Verification: hermetic-test

Gate: - `test_u_contract.py` - the gate is callable independently of the one path that currently owns it.

  • hermetic-green · 2026-10-17 · bench/test_u_contract.py, bench/test_u_launch.py

60.F3 · Scope enforcement: a diff touching files outside the declared scope is REJECTED, not returned as a success.

Tier F · done · Verification: hermetic-test

Gate: - `test_u_contract.py` - an out-of-scope edit fails the brief; a passing suite does not buy it a pass.

  • hermetic-green · 2026-10-17 · bench/test_u_contract.py, bench/test_u_launch.py

60.F4 · Adapters only for harnesses MEASURED on this host, with unavailable_because naming the gap for every one that is not.

Tier F · done · Verification: hermetic-test

Gate: - `test_u_contract.py` asserts each adapter's real availability on this host and fails if a row claims a harness that `shutil.which` cannot find - while `test_executor_contract.py` keeps the executor invariants. Nothing is declared that has not been run; a placeholder that merely passes `shutil.which` is worse than a missing row.

  • hermetic-green · 2026-10-17 · bench/test_u_contract.py, bench/test_executor_contract.py

60.R1 · Invariant 1 still holds: a coding brief with no acceptance check is refused before dispatch.

Tier R · done · Verification: hermetic-test

Gate: - `test_u_contract.py` re-asserts the refusal for a U-shaped brief (U writes its own acceptance check, so it must still be required), while `test_executor_contract.py` keeps the existing invariant unchanged. The best-measured invariant in the executor is not traded for U's identity.

  • hermetic-green · 2026-10-17 · bench/test_u_contract.py, bench/test_executor_contract.py

60.R2 · Invariant 3 still holds and is now gated: no credential reaches the child process, because `_child_env` is an allowlist.

Tier R · done · Verification: hermetic-test

Gate: - `test_u_contract.py` asserts the allowlist for every adapter added by 60.F4, not only for the one that exists today, while `test_executor_contract.py` keeps the existing invariant.

  • hermetic-green · 2026-10-17 · bench/test_u_contract.py, bench/test_executor_contract.py, bench/test_u_launch.py

60.R3 · Verified work lands on a branch, and a failed gate destroys nothing already committed (closes D-104.4).

Tier R · done · Verification: hermetic-test

Gate: - `test_u_contract.py` - the brief's dispatch staged into the MAIN repo's index then deleted the worktree, which loses the work; the branch is created outside and the commit happens on the worktree repo.

  • hermetic-green · 2026-10-17 · bench/test_u_contract.py, bench/test_u_launch.py

HUD screen contracts

All subsystems · Source: docs/systems-plan.json.