contract: integrated agent-native stack (per-app modification + accessibility + security seams + purple-team)

docs/contract-additions/README.md

@@ -7,6 +7,7 @@ This directory contains discoverability notes for additive SourceOS/SociOS contr
 | [Agent Machine Local Data Plane and TopoLVM Mount Contracts](agent-machine-local-data-plane.md) | Defines safe local workspace mounts for Agent Machine and maps the same logical contract to TopoLVM-backed node-local persistent volumes in cluster mode. | `AgentMachineLocalDataPlane`, `AgentMachineMountPolicy`, `TopoLVMPlacementProfile` |
 | [Network, Mesh, BYOM, and Native Assistant Door Contracts](network-assistant-model-doors.md) | Defines enterprise/user network profiles, firewall bindings, service-mesh bindings, BYOM model endpoints, and native assistant bridges such as Apple App Intents/Siri/Shortcuts-style integrations. | `NetworkAccessProfile`, `FirewallBindingProfile`, `MeshBindingProfile`, `ExternalModelProviderProfile`, `NativeAssistantBridgeProfile` |
 | [Isolation Spaces and Taints](isolation-spaces-and-taints.md) | Makes the consent-plane isolation spaces (kernel/system/user/agent/data-namespace) real at the OS layer: k8s-style taints admitted by role tolerations, with surface `space_deny` as a defence-in-depth cap. The OS enforces what the consent-plane gate admits. | — |
+| [Integrated Agent-Native Stack](integrated-agent-native-stack.md) | One integrated system like macOS but agent-native + owned: per-app feature-modification matrix (launcher/browser/files/terminal/mail/media/messaging/assistant/search wired to shell + consent + receipts + mesh + model plane), accessibility as a first-class default (opt-in agent modes), the named security seams, and mandatory purple-team tests on each seam. | (contract doc) |
 
 ## Rules for additions
 

docs/contract-additions/integrated-agent-native-stack.md

@@ -0,0 +1,158 @@
+# SourceOS Integrated Agent-Native Stack v0.1
+
+## Purpose
+
+macOS wins because it is **one integrated system**, not a pile of apps. SourceOS
+matches that integration and goes past it by being **agent-native**: every app is
+a **modified** first-class citizen of one coherent stack — wired to the shell, the
+consent-plane, the receipts/warrant trail, the mesh, and the local model plane —
+rather than a stock upstream binary dropped in. This contract specifies the
+**per-app feature modifications**, makes **accessibility a first-class default**,
+names the **security seams**, and mandates **purple-team tests** on each seam.
+
+Depends on: `isolation-spaces-and-taints.md`, `socioprophet-agent-standards`
+`consent-plane/001`, the enhancement program (`SociOS-Linux/enhancements` E1–E12),
+and the owned SociOS shell (`SourceOS-Linux/sourceos-shell`).
+
+## Decision — one integrated, agent-native, owned stack
+
+1. **Owned shell, not extensions.** The shell (menu, dock, monitors, Tilix-quake,
+   the Albert-parity launcher, the E11 consent/receipts UX) is ONE owned,
+   version-locked layer in `sourceos-shell` — never a gnome-look extension
+   graveyard, never proprietary apps (no WhatsApp/Telegram/Element).
+2. **Every app carries feature modifications** (below): it MUST integrate the
+   agent-native seams, not ship stock.
+3. **Accessibility is a first-class default** (opt-in for the deeper agent modes).
+4. **Every integration crosses a named security seam**, and each seam has a
+   **purple-team test** that must fire.
+
+## Per-app feature-modification matrix (agent-native integration)
+
+Each app in the macOS-replacement set gets these modifications designed in:
+
+| App (replacement) | Feature modifications (agent-native, integrated) |
+|---|---|
+| **Launcher + `lampstand`** | Albert-class parity (keyboard-first, fuzzy, actions/plugins, calc) **wired natively to `sherlock-search` (IR) + slashtags (tagging) + `holmes` (investigation) + NewHope**; every query is purpose-gated (E1) and receipted (E4/E11); results carry warrant. |
+| **Browser (BearBrowser)** | agent-runtime mode; every navigation/DOM action consent-gated + receipted; pinned to `agent-space`; mesh handoff of tabs/sessions; page content is untrusted input. |
+| **Files (`sourceos-syncd`)** | agent file-ops with consent receipts; slashtag tagging; mesh sync (Continuity); data-namespace taints on tenant data. |
+| **Terminal (Tilix-quake + `sourceos-shell`)** | command-bus with consent-plane on exec + receipts; agent co-pilot in the drawer. |
+| **Mail/PIM + `prophet-workspace`** | local-agent triage/summarize/draft; consent receipts on send/read; office surfaces show their warrant. |
+| **Media + `imagelab`/`ocrlab`** | on-device vision via the governed model plane (E6); consent on library access. |
+| **Messaging (OWN capability)** | first-class on the mesh/Matrix substrate, E2EE, agent-assisted, consent-gated — never a third-party client. |
+| **Assistant → Noetica voice concierge** | replaces **Siri + Apple Intelligence**, and *extends* them because the whole intelligence stack is native (see below): local-agent default (E2); App-Intents/Shortcuts bridge; reasoning-backed multi-step actions; every action receipted. |
+| **Search (Spotlight → `sherlock`/`lampstand`)** | purpose-gated, slashtag-aware, transparent ranking, receipted. |
+
+Each row's modifications are **contracts on the app repo**, tracked against the
+enhancement matrix (`enhancements` E1–E12).
+
+## Intelligence layer — Siri + Apple Intelligence, native and *extended*
+
+Apple ships Siri + "Apple Intelligence" (writing tools, summarization, image
+generation, notification/priority summaries, an on-device assistant, and a
+cloud-model escape hatch) as bolt-ons to a closed stack. In SourceOS **the entire
+intelligence stack is native**: `Noetica` (reasoning), the labs (`speechlab` STT,
+a TTS, `nlplab`, `ocrlab`, `imagelab`, `translationlab`, `embeddinglab`), the
+governed model plane (`model-router` + `model-governance-ledger` + champion–
+challenger eval), and the local agent cell. So the **Noetica voice concierge is a
+superset of Siri + Apple Intelligence**, not a copy:
+
+- Every Apple-Intelligence feature (summarize, rewrite, generate, prioritize,
+  transcribe, translate, describe) is a **native governed-model-plane capability**,
+  local-by-default (E2), swappable and auditable (E6) — not a fixed vendor model.
+- The concierge is **reasoning-backed** (Noetica) and **agentic**: it doesn't just
+  answer, it takes governed multi-step action across the integrated apps (consent-
+  gated, receipted) — the thing Siri cannot do.
+- It is the **voice front-end of the same agent** that powers the accessibility
+  assistive layer and the launcher — one intelligence, many surfaces.
+
+This is *why* the concierge's features get extended as the stack matures: each new
+native capability (a lab, a model, a reasoning skill) is immediately available to
+the concierge, the launcher, and accessibility at once — no per-feature Apple-style
+gatekeeping.
+
+## Accessibility — first-class defaults (opt-in for agent modes)
+
+- **On by default:** AT-SPI + Orca screen reader available, high-contrast + large-
+  text toggles, full keyboard-only navigation, reduced-motion respected — WCAG 2.2
+  AA is the baseline, not an add-on.
+- **Agent-native accessibility (opt-in):** the local agent + `speechlab` (STT) + a
+  TTS + Agent-S UI-grounding form a first-class **assistive layer** — the agent can
+  describe and *operate* the UI on the user's behalf. This is opt-in (it is a
+  powerful capability) and, being an agent acting for the user, it runs under the
+  consent-plane with receipts like any other agent action.
+- Accessibility settings live in the owned shell's Privacy/Accessibility pane (E11),
+  not scattered across apps.
+
+## Semantic grounding & ontology bindings
+
+The stack's vocabulary — purposes, intents, actions, profiles, accessibility roles
+— MUST be **ontologically grounded, not ad-hoc**. Everything binds to the canonical
+stack:
+
+- **KKO upper set** (`KBpedia`/KKO, ~58k reference concepts) — the upper ontology
+  every OS concept subsumes under. Purposes, app intents, and data classes are
+  KKO-anchored types, not free strings.
+- **Action Ontology** (`socioprophet-agent-standards` `agent-plane/001`) — every
+  action/tool call is an Action-Ontology action with a trace + receipt binding
+  (this is what E4 records). The consent-plane purpose is a property of the action.
+- **Semantic Coordinate Algebra** (`procyber/semantic/`) — intents and actions are
+  placed as coordinates; admission/routing/similarity are algebraic operations, not
+  heuristics.
+- **Intent grid (23×6)** — the launcher/concierge intents map onto the intent grid;
+  each app's intents are a slice of it.
+
+**Proper ontologies to author** (OWL + SHACL, in `ontogenesis` — E10's home — and
+*projected into runtime* enforcement, closing E10's "not projected" gap):
+
+1. **OS-layer ontology** — spaces (kernel/system/user/agent/data-namespace),
+   surfaces (terminal/notes/browser/…), planes, and the six security **seams** as
+   classes with SHACL constraints (a taint/toleration is a modelled relation).
+2. **Accessibility-binding ontology** — AT-SPI roles ↔ intents ↔ the agent assistive
+   layer, so "the agent operates the UI" is a typed, consented, receipted action.
+3. **Per-app intent + profile ontology** — each app's intents and profiles as
+   classes on the intent grid, bound to Action-Ontology actions.
+4. **Consent-purpose ontology** — the purpose vocabulary (discover/implement/verify/
+   ship/operate/egress/administer) as KKO-anchored classes with SHACL admissibility
+   constraints, so `purpose_admissibility_gate` decisions are ontology-checked, not
+   string-matched.
+
+Conformance: the ontologies validate with SHACL in CI, and the runtime gate/receipt
+path consumes them (a purpose or intent absent from the ontology is refused —
+fail-closed). This is what makes the stack's semantics *machine-checkable and
+coherent* across every app, the launcher, the concierge, and accessibility.
+
+## Security seams (the enforcement boundaries)
+
+Every integration crosses exactly one named seam; the seam is where policy is
+enforced fail-closed and a receipt is emitted:
+
+1. **Consent seam** — the `purpose_admissibility_gate` before any privileged tool/action (E1).
+2. **Space seam** — isolation-space taints ⇄ tolerations (kernel/system/user/agent/data-namespace).
+3. **Surface seam** — the surface envelope (browser confined to agent-space, notes = personal-data consent, terminal = no egress/operate).
+4. **Supply-chain seam** — signed, reproducible (Guix), zot-registered artifacts; provenance receipts (Gatekeeper analog).
+5. **Mesh seam** — cross-device / cross-tenant federation boundary (data-namespace NoExecute = consent withdrawal severs flows).
+6. **Identity seam** — machine + human identity bound to a hardware root (TPM/vTPM; SEP where available).
+
+## Purple-team tests (mandatory, must fire)
+
+Each seam MUST have a **purple-team test** in CI — a red-team probe paired with the
+blue-team detection it must trigger — and it must be *proven to fire* (never-fired =
+suspect). Fail-closed. Examples:
+
+- **Consent/Surface seam:** red = a page-injected browser agent attempts `implement`/
+  `operate` (run a shell, write source); blue = denied, pinned to agent-space,
+  receipted + alarmed. (Ties to BearTrap/honeypot.)
+- **Space seam:** red = a `user`-role process attempts `system`/`kernel`-space
+  syscalls; blue = denied by capability set / LSM, receipted.
+- **Mesh seam:** red = withdraw a tenant's consent mid-flow; blue = in-flight
+  cross-tenant data flow severed (NoExecute), receipted (GDPR 7(3)).
+- **Supply-chain seam:** red = an unsigned/tampered artifact; blue = admission
+  refused at zot/verify, receipted.
+
+Purple-team tests are first-class CI (like the consent-plane fires-both-ways tests),
+owned by the estate, and are the acceptance gate for each seam's "done."
+
+## Implementation boundary
+This is the contract. The owned shell + launcher live in `sourceos-shell`; per-app
+modifications live in each app repo (governed by the matrix); the purple-team tests
+live beside each seam's enforcement. Enforcement code stays in the owning repos.