Campaign: feature-gaps-zero — macOS replacement + superiority to 100%

[mdheller]

Tracking issue for the feature-gaps-zero campaign: drive the macOS-replacement + macOS-superiority spec (and build) to complete. Grounded in a full completeness audit (2026-08-03).

Baseline (audit)

• App-by-app replacement spec: ~50% → now ~closed at the spec layer by the census (spec(macos): app-by-app replacement & enhancement matrix (feature-gaps-zero census) #266): the app-by-app matrix never existed as a merged artifact; spec(macos): app-by-app replacement & enhancement matrix (feature-gaps-zero census) #266 enumerates ~37 stock-macOS surfaces (replacement · owning repo · superiority · E-IDs · deps · status) + a hardware-gap register.
• macOS-superiority spec: ~75% — all 12 enhancements (E1–E12) defined with owning repos + ~60-repo application matrix + 6 seams + purple-team tests + ontology grounding; docked for 3 named-but-undesigned differentiators + spec>runtime.
• Severity: spec-written ≠ built. Only BearBrowser is a shipped product; consent-plane now enforces at 3 surfaces (goose voice, netwatch, turtle-agentd — built this session, engine in policy-fabric#100). E8 Guix (the sovereignty substrate) not started.

The ranked gaps → campaign work items

• 1. Merged app-by-app replacement matrix — the Draft: add core agent-plane schema scaffolds #1 gap. DONE: spec(macos): app-by-app replacement & enhancement matrix (feature-gaps-zero census) #266 (37 surfaces + hardware register).
• 2. E11 Consent/Receipts UX surface (Privacy/Security Center) — named, never designed. The human-facing differentiator over macOS opacity. Design the pane/flow + build a prototype. (companion: prophet-platform#1255 E11)
• 3. E3 mesh / Continuity / Handoff / AirDrop transport spec — only "the mesh" as a concept. Author the protocol/transport spec (WireGuard/mDNS/libp2p) + Continuity/Handoff/AirDrop parity.
• 4. Consent-plane runtime enforcement + ontology projection — engine built (policy-fabric#100) + 3 surfaces live; remaining: sweep to BearBrowser/sourceos-shell/agent-machine (prophet-platform#1256), project the 4 ontologies (ontogenesis#134) into the runtime gate, and author a proven-firing purple-team suite (not just examples).
• 5. E12 sovereign OTA + snapshot/rollback/backup — conceptual only. Author the signed atomic-update-tree + measured-boot/TPM attestation + backup-plane spec (Time Machine + Software Update superset).
• 6. Per-app specs for the census gap rows — Photos, Music, Messages, lampstand, Time Machine, System Settings pane, Contacts, Reminders, Maps, Passwords, Screen Time, FaceTime/AirPlay. Each: a spec conforming to the contract (contract: integrated agent-native stack (per-app modification + accessibility + security seams + purple-team) #262), then build to the "agent-native + accessible + seam-purple-team" bar.
• 7. E8 Guix packaging — the substrate for the whole "sovereign" claim; not started (in zero READMEs). Package the differentiating shell components.
• 8. E2/E6 local model serving — Siri-superset + Core-ML-replacement need something actually serving locally (agent-machine "Not implemented"; labs manifest-only).

Done-definition (from the contract, #262)

A row/gap is closed only when: agent-native (agent uses the same typed/consented/receipted surface as a human) · accessible by default · its seam's purple-team test passes. hw rows (Neural Engine, Secure Enclave, HW codecs, display) are honestly capped by the hardware register in #266 and can reach "built" in software while remaining capped.

The census (#266) is the live work-breakdown; this issue tracks the campaign to zero.

[mdheller]

Gap #2 (E11 Consent/Receipts UX) — spec + prototype done. Design spec authored (docs/contract-additions/e11-consent-receipts-ux.md, in #266): 5 normative regions (purpose vocab · consent envelope · sealed receipt timeline · Governor queue · residency), each bound to a shipped backing artifact (consent-plane/001 · purpose_admissibility_gate · AutonomyAdmissionReceipt · guardrail-fabric · goose-guard region branch) so it's build-don't-rebuild. Clickable one-workflow prototype delivered (all regions over the real contract shapes, theme-aware, keyboard model). Census row System Settings moved partial→spec. Remaining to built: live receipt-stream read + envelope round-trip + Vue port into client-vue (System Settings → Privacy & Security). Next campaign gap: #3 E3 mesh/Continuity transport spec.

[mdheller]

Gap #3 (E3 personal mesh transport) — spec + first code done. Spec e3-mesh-transport.md (layered L0 identity→L4 tenants; MeshTransfer envelope; Continuity/Handoff/AirDrop/AirPlay parity; superiority = no vendor cloud + every transfer consent-gated & receipted). First code shipped in sourceos-shell#36: MeshTransfer schema + fail-closed admit() (grants only on explicit policy decision + hash-sealed receipt; data-namespace egress needs a region toleration) + 9 green tests. Corrected a census misattribution: transport owner is sourceos-shell, not memory-mesh (that's the memory plane, a tenant). Next: gap #5 E12 OTA/backup or a buildable app row (lampstand).

[mdheller]

Merged (08-03). #266 landed on main: the app-by-app census (37 surfaces + hardware register), the E11 + E3 specs, and the full docs/surfaces/ set — 7 canonical surfaces (holography framework · B₁₁ life-mirror · E11 consent/receipts · lampstand semantic launcher · turn-witness Gödel/consistency/conclusions · genesis+flywheel diagrams) + sourceos.tokens.css (style validated against source-os) + the diagram-is-a-witness doctrine. sourceos-shell#36 landed the MeshTransfer E3 first-code. House theme = the first theme (B₁₁ instrument). Campaign gaps #1/#2/#3 closed with spec+code+surfaces; remaining #4–#8 (runtime wiring, E12 OTA, per-app long tail, Guix, local serving) tracked here.

[mdheller]

Gap #4 (wire surfaces to live state) — done (#269, merged). B₁₁ / E11 / turn-witness now fetch ./data/<name>.json (or window.SURFACE_FEED_URL), fall back to embedded seed, and show a LIVE / SAMPLE badge — the instrument declares its own provenance. tools/build_surface_feed.py (7 tests) is the producer seam: runtime feeds it real state (netwatch snapshot · consent-plane catalog · receipt stream · App-Intents parser) → provenance=live. Remaining campaign gaps: #5 E12 OTA/backup · #6 per-app long tail (lampstand build-out, Photos, Messages) · #7 Guix packaging · #8 local model serving.

[mdheller]

Gaps #5 + vendoring — done (#270, merged). E12 sovereign OTA + snapshot/backup spec (signed atomic generations, A→B→Q with auto-rollback, measured-boot seal; Software Update + Time Machine replacement, consent-gated + receipted). Sovereign shell assembly manifest indexes every campaign component + build order into a buildable spine. Vendored hellgraph @ v0.4.45 (MIT) as a consumed dep with sha512 integrity + verify_vendor.py (recomputes + matches). Remaining: #6 lampstand done (sourceos-shell#37); per-app long tail (Photos/Messages); #7 Guix packaging into source-os (needs the OS module + nix build verification — the last mile to a bootable image); #8 local model serving.

[mdheller]

Gap #7 (vendoring into the OS build) — done (source-os#319, merged). The OS build now asserts its consumed hellgraph dep is vendored (v0.4.45, MIT) with sha512 integrity, via a sovereign-vendor-contract wired into flake checks. CI proof the OS builds+boots with it: nix flake check + edition-desktop/server/edge boot tests all SUCCESS. Campaign status: #1 census ✅ · #2 E11 ✅ · #3 E3 ✅ · #4 live feeds ✅ · #5 E12 ✅ · #6 lampstand ✅ · #7 vendored+OS-build ✅. Remaining: #8 local model serving (agent-machine) + per-app long tail build-out (Photos/Messages).

[mdheller]

Gap #8 — intersection landed (#271, merged). Started at the cloud∩local intersection, not two stacks: inference-gateway-intersection.md defines the shared InferenceGateway seam both prophet-platform (model-fabric) and agent-machine (local) adapt to, emitting the existing GatewayCallAudit receipt, consent-gated fail-closed. Live cockpit screen: Model Catalog & Leaderboard surface — every foundation model + OS capability, cloud/local/both placement, sovereignty×governance-weighted board, SP-vs-Claude-Enterprise positioning (DRAFT/VERIFY-gated). Feed-driven.

Fan-out (next tranche): (a) local adapter in agent-machine conforming to the existing contracts/inference-provider.schema.json + GatewayCallAudit; (b) per-model/capability screens in prophet-platform (catalog+serving), prophet lattice (notebooks), model leaderboards — all reading one board. Note: substrate is still Nix on source-os main; Guix migration ([[project_guix_migration]]) not yet landed.

[mdheller]

Model plane expanded — Governance Registry (#272, merged). Beyond foundation models: business targets (fraud/churn/credit/AML/propensity) each with champion vs challenger, historic version comparison, PSI drift, and the DataClass classifiers governing each target's data. Promotions gate through eval fail-closed as RunReceipts; regulated targets need examiner sign-off. Model risk management (APRA CPS 230 / OCC) as a witness surface — the governs-agents thesis made examinable. Two model-plane cockpit surfaces now: model-catalog (foundation, sovereignty×gov leaderboard) + model-governance (champion/challenger + classifiers). Remaining fan-out: agent-machine local adapter (conforms to existing inference-provider.schema.json + GatewayCallAudit); cloud screens in prophet-platform/lattice/notebooks reading the same board.

[mdheller]

Fan-out landed — local serving + grounded docs/support. (1) agent-machine#127 (merged): local InferenceGateway adapter — serves only through a registered active InferenceProvider + admitting consent, emits GatewayCallAudit on every call incl. refusals (17 controls, wired into make validate). The local plane now implements the shared seam. (2) sourceos-spec#273 (merged): grounded NLQA + support surface + build_docs_index.py (43 docs auto-generated from source) + a CI drift-guard (fresh) that fails if the index diverges from source. NLQA answers only from the corpus, cites every source, and abstains to support when ungrounded. Docs ↔ NLQA ↔ support linked to the autogen docs, grounded.