Skip to content

ADR 0003: POWER 3.5 Core Boundary and Trust Planes

Status: Accepted

Date: 2026-08-11

Decision

POWER 3.5.0 ships one lean, local-first core. Human-authored Markdown and Git remain the source plane and authority. Generated indexes, SQLite search projections, dense generations, locks, caches, and temporary files are runtime projections that must be rebuildable. Control-plane Markdown, work packets, review queues, policies, and receipts are visible to humans and survive a runtime-cache reset. External captures are evidence-plane data and never gain authority merely by being retrieved.

The shared application service owns the use cases discover, retrieve, propose, apply, task, fleet-status, and receipt. CLI and local stdio MCP are transport adapters; they must not implement storage or transaction business logic independently.

The canonical retrieval profiles are:

  • fts: offline deterministic baseline;
  • auto: verified dense only when the local provider and generation are ready, otherwise labelled FTS with a fallback reason;
  • semantic and reranked: explicit optional profiles that fail closed when their assets are unavailable.

The base install contains no neural runtime or remote MCP dependency. Optional profiles are delivered only through named extras and may not be imported from core.__init__ eagerly. Fleet, GUI, federation, A2A, graph-assisted experiments, alternate models, and benchmark runners are not 3.5.0 dependencies; each requires its own consumer, owner, evidence, threat model, expiry, and kill criterion.

Compatibility and deprecation

Existing 3.4.x command and library paths remain compatibility-tested while the canonical workflow is documented through the application service. A redundant surface may be removed only after a consumer inventory, replacement path, deprecation notice, and compatibility fixture are retained for one release window. A capability without a named consumer, owner, evidence budget, threat model, or expiry is not promoted into core.

Evidence

  • The executable interface and tool inventory are generated by power_framework.core.capabilities.manifest().
  • The OKF contract is generated from OKFMetadata into docs/schemas/okf-metadata-v1.json.
  • Transactional writes require an exact preimage/plan hash, explicit approval, atomic postcondition, rollback boundary, and content-free receipt.
  • A missing optional profile degrades to local FTS only when the caller selected auto; explicit dense requests fail closed.

Reconsideration / kill criteria

Reopen this ADR if a wrapper diverges from the application service, a source mutation lacks a verifiable postcondition and rollback, base installation acquires an optional neural/remote dependency, or an optional track lacks a measured consumer outcome. In those cases the affected capability remains plan-only or is removed; the FTS/source/control path remains authoritative.