diff --git a/docs/contract-additions/README.md b/docs/contract-additions/README.md index 1c759a6..7f7ad39 100644 --- a/docs/contract-additions/README.md +++ b/docs/contract-additions/README.md @@ -7,6 +7,7 @@ This directory contains discoverability notes for additive SourceOS/SociOS contr | [Agent Machine Local Data Plane and TopoLVM Mount Contracts](agent-machine-local-data-plane.md) | Defines safe local workspace mounts for Agent Machine and maps the same logical contract to TopoLVM-backed node-local persistent volumes in cluster mode. | `AgentMachineLocalDataPlane`, `AgentMachineMountPolicy`, `TopoLVMPlacementProfile` | | [Network, Mesh, BYOM, and Native Assistant Door Contracts](network-assistant-model-doors.md) | Defines enterprise/user network profiles, firewall bindings, service-mesh bindings, BYOM model endpoints, and native assistant bridges such as Apple App Intents/Siri/Shortcuts-style integrations. | `NetworkAccessProfile`, `FirewallBindingProfile`, `MeshBindingProfile`, `ExternalModelProviderProfile`, `NativeAssistantBridgeProfile` | | [Isolation Spaces and Taints](isolation-spaces-and-taints.md) | Makes the consent-plane isolation spaces (kernel/system/user/agent/data-namespace) real at the OS layer: k8s-style taints admitted by role tolerations, with surface `space_deny` as a defence-in-depth cap. The OS enforces what the consent-plane gate admits. | — | +| [Integrated Agent-Native Stack](integrated-agent-native-stack.md) | One integrated system like macOS but agent-native + owned: per-app feature-modification matrix (launcher/browser/files/terminal/mail/media/messaging/assistant/search wired to shell + consent + receipts + mesh + model plane), accessibility as a first-class default (opt-in agent modes), the named security seams, and mandatory purple-team tests on each seam. | (contract doc) | ## Rules for additions diff --git a/docs/contract-additions/integrated-agent-native-stack.md b/docs/contract-additions/integrated-agent-native-stack.md new file mode 100644 index 0000000..0de6466 --- /dev/null +++ b/docs/contract-additions/integrated-agent-native-stack.md @@ -0,0 +1,158 @@ +# SourceOS Integrated Agent-Native Stack v0.1 + +## Purpose + +macOS wins because it is **one integrated system**, not a pile of apps. SourceOS +matches that integration and goes past it by being **agent-native**: every app is +a **modified** first-class citizen of one coherent stack — wired to the shell, the +consent-plane, the receipts/warrant trail, the mesh, and the local model plane — +rather than a stock upstream binary dropped in. This contract specifies the +**per-app feature modifications**, makes **accessibility a first-class default**, +names the **security seams**, and mandates **purple-team tests** on each seam. + +Depends on: `isolation-spaces-and-taints.md`, `socioprophet-agent-standards` +`consent-plane/001`, the enhancement program (`SociOS-Linux/enhancements` E1–E12), +and the owned SociOS shell (`SourceOS-Linux/sourceos-shell`). + +## Decision — one integrated, agent-native, owned stack + +1. **Owned shell, not extensions.** The shell (menu, dock, monitors, Tilix-quake, + the Albert-parity launcher, the E11 consent/receipts UX) is ONE owned, + version-locked layer in `sourceos-shell` — never a gnome-look extension + graveyard, never proprietary apps (no WhatsApp/Telegram/Element). +2. **Every app carries feature modifications** (below): it MUST integrate the + agent-native seams, not ship stock. +3. **Accessibility is a first-class default** (opt-in for the deeper agent modes). +4. **Every integration crosses a named security seam**, and each seam has a + **purple-team test** that must fire. + +## Per-app feature-modification matrix (agent-native integration) + +Each app in the macOS-replacement set gets these modifications designed in: + +| App (replacement) | Feature modifications (agent-native, integrated) | +|---|---| +| **Launcher + `lampstand`** | Albert-class parity (keyboard-first, fuzzy, actions/plugins, calc) **wired natively to `sherlock-search` (IR) + slashtags (tagging) + `holmes` (investigation) + NewHope**; every query is purpose-gated (E1) and receipted (E4/E11); results carry warrant. | +| **Browser (BearBrowser)** | agent-runtime mode; every navigation/DOM action consent-gated + receipted; pinned to `agent-space`; mesh handoff of tabs/sessions; page content is untrusted input. | +| **Files (`sourceos-syncd`)** | agent file-ops with consent receipts; slashtag tagging; mesh sync (Continuity); data-namespace taints on tenant data. | +| **Terminal (Tilix-quake + `sourceos-shell`)** | command-bus with consent-plane on exec + receipts; agent co-pilot in the drawer. | +| **Mail/PIM + `prophet-workspace`** | local-agent triage/summarize/draft; consent receipts on send/read; office surfaces show their warrant. | +| **Media + `imagelab`/`ocrlab`** | on-device vision via the governed model plane (E6); consent on library access. | +| **Messaging (OWN capability)** | first-class on the mesh/Matrix substrate, E2EE, agent-assisted, consent-gated — never a third-party client. | +| **Assistant → Noetica voice concierge** | replaces **Siri + Apple Intelligence**, and *extends* them because the whole intelligence stack is native (see below): local-agent default (E2); App-Intents/Shortcuts bridge; reasoning-backed multi-step actions; every action receipted. | +| **Search (Spotlight → `sherlock`/`lampstand`)** | purpose-gated, slashtag-aware, transparent ranking, receipted. | + +Each row's modifications are **contracts on the app repo**, tracked against the +enhancement matrix (`enhancements` E1–E12). + +## Intelligence layer — Siri + Apple Intelligence, native and *extended* + +Apple ships Siri + "Apple Intelligence" (writing tools, summarization, image +generation, notification/priority summaries, an on-device assistant, and a +cloud-model escape hatch) as bolt-ons to a closed stack. In SourceOS **the entire +intelligence stack is native**: `Noetica` (reasoning), the labs (`speechlab` STT, +a TTS, `nlplab`, `ocrlab`, `imagelab`, `translationlab`, `embeddinglab`), the +governed model plane (`model-router` + `model-governance-ledger` + champion– +challenger eval), and the local agent cell. So the **Noetica voice concierge is a +superset of Siri + Apple Intelligence**, not a copy: + +- Every Apple-Intelligence feature (summarize, rewrite, generate, prioritize, + transcribe, translate, describe) is a **native governed-model-plane capability**, + local-by-default (E2), swappable and auditable (E6) — not a fixed vendor model. +- The concierge is **reasoning-backed** (Noetica) and **agentic**: it doesn't just + answer, it takes governed multi-step action across the integrated apps (consent- + gated, receipted) — the thing Siri cannot do. +- It is the **voice front-end of the same agent** that powers the accessibility + assistive layer and the launcher — one intelligence, many surfaces. + +This is *why* the concierge's features get extended as the stack matures: each new +native capability (a lab, a model, a reasoning skill) is immediately available to +the concierge, the launcher, and accessibility at once — no per-feature Apple-style +gatekeeping. + +## Accessibility — first-class defaults (opt-in for agent modes) + +- **On by default:** AT-SPI + Orca screen reader available, high-contrast + large- + text toggles, full keyboard-only navigation, reduced-motion respected — WCAG 2.2 + AA is the baseline, not an add-on. +- **Agent-native accessibility (opt-in):** the local agent + `speechlab` (STT) + a + TTS + Agent-S UI-grounding form a first-class **assistive layer** — the agent can + describe and *operate* the UI on the user's behalf. This is opt-in (it is a + powerful capability) and, being an agent acting for the user, it runs under the + consent-plane with receipts like any other agent action. +- Accessibility settings live in the owned shell's Privacy/Accessibility pane (E11), + not scattered across apps. + +## Semantic grounding & ontology bindings + +The stack's vocabulary — purposes, intents, actions, profiles, accessibility roles +— MUST be **ontologically grounded, not ad-hoc**. Everything binds to the canonical +stack: + +- **KKO upper set** (`KBpedia`/KKO, ~58k reference concepts) — the upper ontology + every OS concept subsumes under. Purposes, app intents, and data classes are + KKO-anchored types, not free strings. +- **Action Ontology** (`socioprophet-agent-standards` `agent-plane/001`) — every + action/tool call is an Action-Ontology action with a trace + receipt binding + (this is what E4 records). The consent-plane purpose is a property of the action. +- **Semantic Coordinate Algebra** (`procyber/semantic/`) — intents and actions are + placed as coordinates; admission/routing/similarity are algebraic operations, not + heuristics. +- **Intent grid (23×6)** — the launcher/concierge intents map onto the intent grid; + each app's intents are a slice of it. + +**Proper ontologies to author** (OWL + SHACL, in `ontogenesis` — E10's home — and +*projected into runtime* enforcement, closing E10's "not projected" gap): + +1. **OS-layer ontology** — spaces (kernel/system/user/agent/data-namespace), + surfaces (terminal/notes/browser/…), planes, and the six security **seams** as + classes with SHACL constraints (a taint/toleration is a modelled relation). +2. **Accessibility-binding ontology** — AT-SPI roles ↔ intents ↔ the agent assistive + layer, so "the agent operates the UI" is a typed, consented, receipted action. +3. **Per-app intent + profile ontology** — each app's intents and profiles as + classes on the intent grid, bound to Action-Ontology actions. +4. **Consent-purpose ontology** — the purpose vocabulary (discover/implement/verify/ + ship/operate/egress/administer) as KKO-anchored classes with SHACL admissibility + constraints, so `purpose_admissibility_gate` decisions are ontology-checked, not + string-matched. + +Conformance: the ontologies validate with SHACL in CI, and the runtime gate/receipt +path consumes them (a purpose or intent absent from the ontology is refused — +fail-closed). This is what makes the stack's semantics *machine-checkable and +coherent* across every app, the launcher, the concierge, and accessibility. + +## Security seams (the enforcement boundaries) + +Every integration crosses exactly one named seam; the seam is where policy is +enforced fail-closed and a receipt is emitted: + +1. **Consent seam** — the `purpose_admissibility_gate` before any privileged tool/action (E1). +2. **Space seam** — isolation-space taints ⇄ tolerations (kernel/system/user/agent/data-namespace). +3. **Surface seam** — the surface envelope (browser confined to agent-space, notes = personal-data consent, terminal = no egress/operate). +4. **Supply-chain seam** — signed, reproducible (Guix), zot-registered artifacts; provenance receipts (Gatekeeper analog). +5. **Mesh seam** — cross-device / cross-tenant federation boundary (data-namespace NoExecute = consent withdrawal severs flows). +6. **Identity seam** — machine + human identity bound to a hardware root (TPM/vTPM; SEP where available). + +## Purple-team tests (mandatory, must fire) + +Each seam MUST have a **purple-team test** in CI — a red-team probe paired with the +blue-team detection it must trigger — and it must be *proven to fire* (never-fired = +suspect). Fail-closed. Examples: + +- **Consent/Surface seam:** red = a page-injected browser agent attempts `implement`/ + `operate` (run a shell, write source); blue = denied, pinned to agent-space, + receipted + alarmed. (Ties to BearTrap/honeypot.) +- **Space seam:** red = a `user`-role process attempts `system`/`kernel`-space + syscalls; blue = denied by capability set / LSM, receipted. +- **Mesh seam:** red = withdraw a tenant's consent mid-flow; blue = in-flight + cross-tenant data flow severed (NoExecute), receipted (GDPR 7(3)). +- **Supply-chain seam:** red = an unsigned/tampered artifact; blue = admission + refused at zot/verify, receipted. + +Purple-team tests are first-class CI (like the consent-plane fires-both-ways tests), +owned by the estate, and are the acceptance gate for each seam's "done." + +## Implementation boundary +This is the contract. The owned shell + launcher live in `sourceos-shell`; per-app +modifications live in each app repo (governed by the matrix); the purple-team tests +live beside each seam's enforcement. Enforcement code stays in the owning repos.