ADR 0016 Vibe Carving Repository and Context Migration

Context

ADR-0013 declared four repositories, but the backend retained GitOps, Starlight, contract schemas, and a desktop application. Ownership, updates, and AgentSquad repository lanes remained ambiguous. Backend application behavior also accumulated under the access context even when Agent Execution owned its meaning.

Decision

The original decision treated the Assembly clone as the workspace root and placed the other independently versioned role clones below it. ADR-0017 supersedes that hidden layout with four visible sibling clones. Assembly manifest pins remain the only integration baseline; bootstrap never overwrites dirty worktrees.

Repository authority becomes physical:

Assembly owns platform/, apps/docs/, ADRs, environment topology, pins, and black-box integrated scenarios.
Contract owns communication schemas, compatibility, deterministic artifacts, and neutral conformance data.
Frontend owns Portal and Protected Registry Desktop source, copy, and tests.
Backend owns bounded contexts, services, provider adapters, and Supabase migrations.

Backend behavior converges on context-owned outcome slices. Agent profiles, leases, continuity, provider takeover, process containment, and single-project sandbox admission move from access.application.studio to agent_execution. Cross-context calls use public contracts, ports, events, or named orchestration. Environment paths and Kubernetes filenames cannot act as backend domain contracts.

Tests move with the smallest behavior owner. Cross-repository tests use published artifacts or runtime interfaces in assembly. Build stages resolve lockfiles first, produce one minimal artifact in Kubernetes BuildKit, and promote one digest.

Runtime Delivery Ownership

Runtime delivery follows a contract-first producer/consumer boundary:

Outcome	Owner	Rule
Agent Execution behavior	Backend	Own the bounded context and provider adapters.
Runtime release manifest	Contract	Define the immutable image and provenance message.
Daytona workspace image	Backend	Build once with Kubernetes BuildKit and publish a digest.
Harbor publisher credential	Assembly	Reconcile a least-privilege robot through OpenBao and ExternalSecret; never fall back to admin.
GitOps rollout and live canary	Assembly	Consume the released digest through runtime APIs without importing Backend source or building another image.

The existing Backend-owned isolation canary and its disposable Harbor image push are migration debt. The replacement Assembly scenario consumes the Backend release manifest, creates only disposable Daytona resources, and records cleanup evidence. Consequently agentsquad-canary-harbor-robot is retired instead of provisioned. architecture/outcome-ownership.json is the machine-readable migration gate.

Migration Rules

Compatibility trees are delete-only: no new behavior or fixes land in a non-owning copy. Each removal first proves the authoritative target and updates consumers. Contract changes sequence contract, backend/frontend, then assembly pins. Database schema remains backend migration truth; Supabase/CNPG topology and recovery remain assembly truth.

Ouroboros is not an active context or module. Any future return requires a new proposed ADR and independent capability proof.

Implementation Evidence

ADR-0017 replaces the hidden clone layout with a non-repository workspace root and visible assembly/, backend/, contract/, and frontend/ sibling clones.
Assembly workspace verification rejects symlinks and pin drift.
architecture/repository-ownership.json makes repository ownership and expiring compatibility paths machine-readable.
architecture/outcome-ownership.json pins Contract-first runtime delivery. The Assembly AgentSquad workflow consumes runtime-release.v1.json, calls Daytona as a black-box API, and never builds or pushes an image.
Backend Tach dependency and external gates enforce declared module boundaries.

Known Gaps

Platform and docs compatibility copies remain in backend. Runtime workflows still reach assembly paths directly. The access context still owns unrelated execution, identity, repository, and studio behavior. These are migration facts, not accepted steady-state exceptions.

Rollback

Every role remains an independent clone. Rollback checks out previous immutable assembly manifest pins. Never reset a dirty role worktree; archive or commit its work before materializing rollback clones.

Revision History

2026-07-12: Accepted by repository owner directive; canonical workspace integrated.
2026-07-13: Superseded by ADR-0017 after the repository owner required visible sibling clones.