Feature 035 acceptance matrix¶
Established: 2026-09-06 during completion-plan T0.
Baseline: b585e80 plus the session reconciliation. No runtime changes or new runtime acceptance tests occurred during T0.
Requirements: 035 specification.
Execution: completion plan.
Reading the matrix¶
There are 56 functional requirements and 13 success criteria: one row for each identifier actually declared in the spec.
Retained preserves the requirement. Revised replaces a superseded assumption with the cited decision; the replacement still requires verification.
Deferred preserves a requirement outside retained 035 scope, with a durable debt destination and future acceptance.
No runtime row is certified complete by this documentation task. Update evidence only from named tests or recorded observations.
Task owners are defined in the completion plan; deferred owners and exit criteria are defined in the linked debt entries.
T10 supplies candidate/live acceptance. T11 checks coverage and final status across all retained rows.
Evidence catalog¶
- E1: The reconciliation records 128 focused backend/adapter/selector tests passing on the audited baseline. Files:
tests/unit/lib/backends/test_openai_agents_backend.py,test_openai_agents_tool_adapters.py, andtest_selector.py. - E2: The same report records 196 tests covering LiteLLM, tool initialization, context generation, tracing, output, cost, fallback, MCP, permissions, and OTel redaction. These are focused baseline tests, not full/live acceptance.
- E3:
src/holodeck/models/openai_config.py,models/agent.py,lib/backends/validators.py, and their model/validator tests were inspected. Configuration presence does not prove serve enforcement. - E5 (T1, 2026-09-06): Runner-level fallback acceptance in
tests/unit/lib/backends/test_openai_agents_fallback_runner.py(6 tests) drives the real SDKRunnerover realOpenAIResponsesModelinstances against an in-processhttpx.MockTransport: primary client retries exhaust (1 + max_retriesrequests) before one fallback attempt; no third attempt after a fallback failure; non-retryable 401 never reaches the fallback; streamed fallback beforeresponse.createdwith deltas delivered once; no restart after the first event; the SDKconversation_lockedcompatibility re-run bounded to four primary/fallback pairs; bothresponsespans (first with error) reach the OTel mirror under one trace via the router. Tracing-policy router acceptance intest_openai_agents_tracing.py(TestTraceRouter*, 23 tests) andtest_openai_agents_backend.py(TestTracingPolicyFor,TestBackendTracingPolicyLifecycle,TestRunConfigCapturePolicy, 18 tests) covers the routing matrix, mixed providers in both orders, repeated registration, observability-disabled Azure, spans under a caller-owned outer trace opened before the run, spans finished outside their scope, after trace end, or after trace-map eviction, immediate withdrawal of in-flight traces, bounded trace map, untagged traces, per-run tagging, teardown withdrawal, and the env-default capture override. Command:uv run pytest tests/unit/lib/backends tests/unit/serve tests/integration/test_multi_turn_dual_backend.py -n auto -q— 946 passed at the T1 revision (later reruns are listed in the completion plan). Live dashboard/collector observation remains T10. - E6 (T2, 2026-09-06): LiteLLM inference contracts (D15).
tests/unit/lib/test_tool_initializer.py::TestEmbeddingDimensionsForwarding(7 tests) proves factory-to-provider dimension forwarding intolitellm.aembedding, distinct services for tools with differentembedding_dimensions, one shared service otherwise, single-tool init forwarding, a provider size mismatch aborting init with theValueErrorcause, and a provider failure aborting init withEmbeddingServiceError→ original exception chained.tests/unit/lib/test_litellm_support.py::TestEmbeddingServiceErrorBoundary(4 tests) pins the boundary; vectorstore/hierarchical tool tests pin propagation (no placeholder fallback with a service).tests/unit/lib/observability/test_litellm_spans.py(9 tests) reads real embedding andLLMContextGeneratorchat spans from an in-memory exporter behindRedactingSpanProcessor: default span shape and token attributes, no content and no raw-response span underNO_CONTENT, redacted prompt/completion/raw payload underSPAN_ONLY, theOTEL_SEMCONV_STABILITY_OPT_IN=gen_ai_latest_experimentalshape with and without capture (no raw span under the opt-in), and a provider failure span whoseerror.*attributes andexceptionevent carry no credential.test_otel_redaction.pypins the raw-response,error.*, and event scrubbing.TestLiteLLMEmbeddingServicepins the Azure deployment-aliasallowed_openai_paramsallow-list fordimensions. Existingtest_llm_context_generator.pyretry/truncation/concurrency andTestResolveContextGeneratorClaude-selection tests pass unchanged. Command:uv run pytest tests/unit/lib/test_litellm_support.py tests/unit/lib/test_tool_initializer.py tests/unit/test_vectorstore_tool.py tests/unit/tools tests/unit/lib/backends/test_otel_redaction.py tests/unit/lib/observability tests/unit/lib/test_llm_context_generator.py tests/unit/lib/backends/test_claude_backend.py tests/unit/lib/backends/test_openai_agents_tracing.py tests/integration/test_multi_turn_dual_backend.py -n auto -q— 699 passed after an independent adversarial review (six findings: Azure alias dimensions guard, unredacted failure telemetry, LiteLLMcallback_listfixture leak, token-row wording, opt-in raw-span claim, untyped helper — all fixed). Live OpenAI/Azure/Ollama grounded and contextual ingest and collector observation remain T10. - E7 (T3, 2026-09-06): Subagents, skills, and handoff events (D16).
tests/unit/lib/backends/test_openai_agents_subagents.py(25 tests) builds real SDKAgent/FunctionToolobjects and pins: three subagents become three handoffs in order with prefixed instructions and descriptions;tools: nullinherits the parent's tools and MCP servers (same SDK objects); explicit lists restrict by config name, can grant an MCP server, an empty list grants nothing, unknown or disallowed names raiseConfigErrornaming the entry;inherit/omitted reuse the parent model object and explicit ids go through the provider resolver; inline and SKILL.md skills yield identical instructions, description, tools, and model; skills carry no prefix, get no tools withoutallowed_tools, are dropped when disallowed, and collide-fail againstopenai.agentskeys.tests/unit/models/test_skill_tool.py(19 tests) andtests/unit/lib/test_skills.py(13 tests) pinSkillToolvalidation (naming, inline/path exclusivity, frontmatter fallback, base-dir resolution, missing directory/file/field failures) and theallowed_toolscross-check onAgent.tests/unit/models/test_openai_config.py::TestOpenAISubagentSpec(13 tests) pins prompt/prompt_file rules and Claude-literal rejection.tests/unit/lib/backends/test_openai_agents_events.py(10 tests) pins theToolEventmapping and drives the real SDKRunnerthroughOpenAIAgentsSessionwith a scripted model (entry →transfer_to_researcher→ inheritedlookup→ answer): bothsend_streamingandsenddeliverstart/end(transfer_to_researcher), subagent_message, start/parent_link/end(lookup), subagent_messagein that order, andExecutionResultrecords the handoff call andhandoff:researcherresult.test_openai_agents_backend.py::TestHandoffWiring/TestResolveSubagentModelpininitialize()passing handoffs to the SDK agent, unknown subagent tools failing initialize, and the Azure deployment model resolver.test_validators.py::TestSettingSourcesWarningpins FR-071. Schema regenerated (make schema,make schema-check). An independent adversarial review found ten issues, all fixed before commit: SDK tool-name collisions (kb+kb_search) now fail load;load_agent_yamlsetsagent_base_dirbefore validation (also fixes stale-contextclaude.agents.prompt_fileresolution); handoff targets carry the parent'soutput_typeand model settings; normalisedtransfer_to_name collisions fail load; indented---inside SKILL.md block scalars is content; the handoffendis deferred to run completion so the panel nests children; a mid-stream failure closes open calls witherror; the event queue is bounded; FR-071 logs once per load.sample/openai-agents-fullexercises every surface (loads and builds five handoff targets offline); its live run is E8. - E4:
src/holodeck/serve/server.py,serve/tool_init_manager.py,deploy/deployers/azure_containerapps.py,models/deployment.py, and existing serve/deploy tests were inspected. Current/readyonly proves lifecycle state and always returns 200. ACA probes already use/ready.
Paths in this catalog are repository-relative. Proposed additional tests belong to the corresponding T1–T10 tasks, not fictitious existing files.
- E8 (T3 live follow-up, 2026-09-06): sample/openai-agents-full/agent.azure.yaml run against Azure OpenAI (gpt-5-mini deployment, text-embedding-3-small embeddings, MCP filesystem server over npx, knowledge_base and the handbook hierarchical index on Qdrant 1.17, collections documents_dim512 and hierarchical_docs_handbook_dim1536): 7/7 test cases pass on five consecutive runs (holodeck test run). Live handoffs: transfer_to_researcher → knowledge_base_search/handbook_search (restricted tools), transfer_to_analyst → get_inventory + reserve_stock (inherited tools), transfer_to_summarise (inline skill) → knowledge_base_search; purge_inventory never offered. Evaluators: G-Eval against expected_output on all cases and faithfulness (RAG) scoring 1.0 on the four retrieval cases and skipped on the rest. Defects found and fixed on the same branch: the test runner did not recognise OpenAI-backend tool names (<name>_search) when building retrieval_context, so RAG metrics were silently skipped on openai/azure_openai (tests/unit/lib/test_runner/test_executor.py now pins all three naming schemes); vectorstore on Qdrant failed ingest (400, non-UUID point IDs) and search (AsyncQdrantClient.search removed in qdrant-client 1.13+) — deterministic UUIDv5 IDs with native UUID/int IDs preserved, plus a query_points shim in create_qdrant_client (tests/unit/tools/test_vectorstore_source_keys.py::TestQdrantRecordIds, tests/unit/lib/test_vector_store.py::TestCreateQdrantClientSearchCompat; H-010 tracks structured business-key preservation). Not covered: plain provider: openai (no credits on the available key), OpenAI dashboard trace upload, collector observation — T10.
- E9 (T3 serve follow-up, 2026-09-06): holodeck serve sample/openai-agents-full/agent.azure.yaml --port 8765 validated with raw AG-UI SSE requests (curl -N POST /awp, two threads, two turns each) and then a CopilotKit browser flow (sample/copilotkit, HOLODECK_BACKEND_URL=http://127.0.0.1:8765/awp, user-driven plus scripted turns). Events observed in order: RUN_STARTED, REASONING_*, TOOL_CALL_START(transfer_to_analyst) with nested get_inventory/reserve_stock (parentMessageId chain), TOOL_CALL_RESULT "Handoff to 'analyst' completed.", TEXT_MESSAGE_*, RUN_FINISHED; the researcher thread showed transfer_to_researcher → handbook_search/knowledge_base_search. Defect found and fixed: turn 2 on any thread returned an empty reply with RUN_FINISHED — the backend (and its stdio MCP servers) was initialised in turn 1's HTTP request task, whose anyio streams died with it (ClosedResourceError on list_tools), and the chat executor ignored the is_error result. Fixes: serve enables the task-bound actor for every provider and the actor now builds, prepares, closes, and tears the backend down inside its own task (tests/unit/agent/test_executor_coverage.py::TestTaskBoundSessionOwnership); execute_turn raises BackendSessionError on content-less error results and returns partial content otherwise (TestExecuteTurnErrorResults); the backend logs swallowed run failures. After the fix: four requests, zero errors, follow-up turns answered from session history (Reservation ID: R-1000, Bay H.). CopilotKit rendered the reasoning block and the three nested tool cards as Complete. AG-UI HTTP acceptance for FR-006 is therefore live on Azure; REST protocol and holodeck deploy remain T7/T10.
Functional requirements and success criteria¶
| ID | Scope | Owning task / destination | Required test or observable result | Decision | Evidence status |
|---|---|---|---|---|---|
| FR-001 | Revised | T10 | Selector routes by provider without inventing a Backend enum or backend override. | D01 | Baseline backend coverage (E1); final acceptance pending |
| FR-002 | Retained | T10 | Protocol tests cover initialize, invoke_once, create_session, teardown and failure cleanup. | D01 | Baseline backend coverage (E1); final acceptance pending |
| FR-003 | Retained | T10 | Session tests cover prepare/send/stream/close, multi-turn history and cancellation. | D01 | Baseline backend coverage (E1); final acceptance pending |
| FR-004 | Retained | T10 | Assert every ExecutionResult field, structured output, reasoning summaries, usage and error payloads. | D04 | Baseline backend coverage (E1); final acceptance pending |
| FR-005 | Retained | T7 / T10 | Streaming deltas and final accounting survive the AG-UI/REST path and cancellation. | D01 | Baseline backend coverage (E1); final acceptance pending; HTTP integration pending |
| FR-006 | Retained | T3 / T7 / T10 | Ordinary start/end/error/thinking and handoff parent-link/subagent events reach AG-UI in order. | D02 / D16 | Backend event contract closed (E7): ordered start/end/parent_link/subagent_message/thinking through the session tool_events queue on streaming and post-hoc paths; AG-UI HTTP integration live on Azure through serve + CopilotKit (E9); live handoff (E8); OpenAI run remains T10 |
| FR-007 | Revised | T10 | OpenAI/Azure route to native OpenAI; Anthropic/Ollama route to Claude; absent AF/ADK/SK options are not promised. | D01 | Baseline backend coverage (E1); final acceptance pending |
| FR-010 | Retained | T7 | Both provider credential errors occur at startup before accepting requests. | D03 | Pending implementation and acceptance |
| FR-011 | Retained | T8 | Build and inspect OpenAI images with/without Node-requiring MCP; default has no Node layer. | D01 | Shared Docker code exists (E4); image acceptance pending |
| FR-012 | Retained | T8 | Container entrypoint exits non-zero with actionable missing-credential errors. | D03 | Pending implementation and acceptance |
| FR-013 | Revised | T7 | /health is liveness; /ready is 503 until prerequisites and required init tools are ready, then 200; cover empty/failed/shutdown states. | D10 | Lifecycle-only /ready exists (E4); required gating pending |
| FR-014 | Retained | T7 | Only active turns use slots; overflow rejects; every termination path releases a slot. | D11 | Pending implementation and acceptance |
| FR-020 | Retained | T7 / T10 | Exercise POST/GET init and GET tools for vector/hier-doc; non-init tools return 400. | D10 | Shared routes exist (E4); OpenAI acceptance pending |
| FR-030 | Retained | T10 | ModelSettings receives configured low/medium/high reasoning effort. | D04 | Baseline backend coverage (E1); final acceptance pending |
| FR-031 | Revised | T10 | max maps to xhigh without the obsolete high-clamp behavior. | D04 | Baseline backend coverage (E1); final acceptance pending |
| FR-032 | Retained | T10 | Budget exhaustion aborts with partial output, accumulated cost and correct error classification. | D02 | Baseline helper coverage (E2); final acceptance pending |
| FR-033 | Retained | T1 / T10 | Runner-level retry/fallback order, permitted errors, no restart after the first emitted event (including non-text events), and both-attempt traces are demonstrated. | D03 | Direct wrapper tests (E2) plus Runner-level order, stream, and both-attempt trace tests passed (E5, D14); live provider evidence pending (T10) |
| FR-034 | Retained | T4 / T10 | Permission filtering excludes tools; overlapping allow/deny fails; include newly introduced tool types. | D02 | Baseline helper coverage (E2); final acceptance pending; hosted integration pending |
| FR-040 | Retained | T10 | stdio constructor receives command/args/substituted env and cleans up resources. | D05 | Baseline helper coverage (E2); final acceptance pending |
| FR-041 | Retained | T10 | SSE receives substituted URL/headers and preserves lifecycle/error behavior. | D05 | Baseline helper coverage (E2); final acceptance pending |
| FR-042 | Retained | T10 | Streamable HTTP receives substituted URL/headers and preserves lifecycle/error behavior. | D05 | Baseline helper coverage (E2); final acceptance pending |
| FR-043 | Retained | T10 | WebSocket is skipped with the documented warning, not silently ignored. | D05 | Baseline helper coverage (E2); final acceptance pending |
| FR-044 | Retained | T10 | Static MCP filtering exposes only allowed names. | D05 | Baseline helper coverage (E2); final acceptance pending |
| FR-050 | Revised | T6 | Event/action matrix proves observation, failure wrappers, input abort, tool reject-and-continue, hosted-MCP rejection, unsupported MCP errors and inert modify warning. | D05 | Pending implementation and acceptance |
| FR-051 | Retained | T5 / T6 | Tracking/redaction precedes user hooks; declaration order and first terminal action are honored. | D05 | Pending implementation and acceptance |
| FR-060 | Revised | T3 | openai.agents creates named handoff targets with declared prompts/descriptions/tools/models. | D02 / D16 | Closed (E7): three subagents become three SDK Agents on handoffs in declaration order with prompt/prompt_file, description, tools, model |
| FR-061 | Retained | T3 | Omitted subagent tools inherit parent tools; explicit restrictions remain enforced. | D16 | Closed (E7): tools: null inherits every built parent tool and MCP server; explicit lists restrict by config name; unknown or disallowed names fail load |
| FR-062 | Retained | T3 | inherit uses parent model; Claude literals fail; supported provider model IDs pass. | D16 | Closed (E7): inherit/omitted reuse the parent model object; sonnet|opus|haiku fail config validation; other ids pass through (OpenAI) or wrap an Azure deployment on the parent endpoint |
| FR-063 | Revised | T3 | Recommended handoff prefix and openai.agents skip flag work exactly once. | D16 | Closed (E7): prefix prepended once (idempotent on an already-prefixed prompt); skip_recommended_prefix: true leaves the prompt verbatim |
| FR-070 | Retained | T3 / T10 | Both inline and SKILL.md forms create restricted skill handoff targets; malformed sources fail clearly. | D02 / D16 | Closed for fixtures (E7): SkillTool in ToolUnion with schema regenerated; inline and SKILL.md skills produce identical handoff agents scoped to allowed_tools; missing directory/SKILL.md/frontmatter fields fail config load; live skill route on Azure (E8); OpenAI run remains T10 |
| FR-071 | Revised | T3 | Declared setting_sources compatibility field is accepted with a Claude-only warning and no ambient loading. | D16 | Closed (E7): validate_openai_agents logs setting_sources is a Claude-only concept; ignored on openai. once per backend load, exactly when claude.setting_sources is declared; ambient loading remains H-020 |
| FR-080 | Revised | T7 / T8 | ACA uses supported 1CPU/2Gi; cap=20 at 2048MiB/100; local1024MiB gives10; overrides, no-cgroup fallback and below-one errors match D11. | D11 | Configuration fields exist (E3); resolver/echo acceptance pending |
| FR-081 | Retained | T7 / T10 | At the resolved active-turn limit, reject excess work with 429, Retry-After and the exact problem type. | D11 | Pending implementation and acceptance |
| FR-082 | Retained | T10 | Default max_turns20 reaches Runner in all invocation paths and overrides work. | D02 | Baseline backend coverage (E1); final acceptance pending |
| FR-083 | Revised | T4 | CodeInterpreter requires opt-in; ComputerTool fails load even with opt-in because its harness is deferred. | D06 | Pending implementation and acceptance |
| FR-084 | Revised | T4 / T6 | Existing approval gates are never bypassed; unsupported interactive approval fails closed; automatic rejection follows D05. | D05 | Pending implementation and acceptance; interactive resume is H-013 |
| FR-085 | Retained | T8 | Local image tests verify conditional Node, corpus ownership/read-only access and scratch volumes, not only rendered strings. | D11 | Shared hardening exists (E4); image acceptance pending |
| FR-086 | Retained | T8 / T10 | Deployment defaults to internal ingress; explicit external ingress produces the documented warning. | D11 | Shared defaults exist (E4); candidate acceptance pending |
| FR-087 | Revised | T5 | Synthetic tool output is sanitized before model consumption for HoloDeck-built tools; opt-out warns; unsupported coverage is explicit. | D05 | Pending implementation and acceptance |
| FR-088 | Retained | T1 / T5 / T10 | Exporter observes sanitized tool/message attributes with content capture both on and off. | D07 | Baseline helper coverage (E2); final acceptance pending; integrated/live coverage pending |
| FR-089 | Revised | T5 | Managed MCP/function/hook child environments omit provider secrets by default; opt-out and concurrent isolation are tested without global-env mutation. | D09 | Pending implementation and acceptance; arbitrary Python containment is H-021 |
| FR-090 | Deferred | H-022 | Credential-free agent container with Envoy-owned credentials; required by the future hardened-profile acceptance. | D08 | Excluded from 035 completion; not implemented/verified |
| FR-091 | Deferred | H-022 | Provider, embedding and MCP allowlists; required by the future hardened-profile acceptance. | D08 | Excluded from 035 completion; not implemented/verified |
| FR-092 | Deferred | H-022 | Provider-specific local proxy routing; required by the future hardened-profile acceptance. | D08 | Excluded from 035 completion; not implemented/verified |
| FR-093 | Deferred | H-022 | Reject credential-bearing hardened agent environment; required by the future hardened-profile acceptance. | D08 | Excluded from 035 completion; not implemented/verified |
| FR-094 | Deferred | H-011 | Validated sandbox-mode configuration; required by the future sandbox acceptance. | D08 | Excluded from 035 completion; not implemented/verified |
| FR-095 | Deferred | H-011 | SandboxAgent construction with equivalent agent fields; required by the future sandbox acceptance. | D08 | Excluded from 035 completion; not implemented/verified |
| FR-096 | Deferred | H-011 | Sandbox safety opt-in; required by the future sandbox acceptance. | D08 | Excluded from 035 completion; not implemented/verified |
| FR-097 | Deferred | H-011 | Local workspace lifecycle and cleanup; required by the future sandbox acceptance. | D08 | Excluded from 035 completion; not implemented/verified |
| FR-098 | Deferred | H-011 | Remote client, isolated workspace and credential ownership; required by the future sandbox acceptance. | D08 | Excluded from 035 completion; not implemented/verified |
| FR-099 | Deferred | H-011 | Reject redundant sandbox/hosted execution configuration; required by the future sandbox acceptance. | D08 | Excluded from 035 completion; not implemented/verified |
| FR-100 | Revised | T1 / T10 | OpenAI upload remains when permitted; configured OTel mirror receives spans; content capture policy holds. | D07 / D13 | Mirror tests (E2) plus router policy-matrix tests passed (E5); live dashboard/collector acceptance pending (T10) |
| FR-101 | Revised | T1 / T10 | Azure never uploads to OpenAI dashboard, including when OTel is disabled; enabled OTel still receives spans. | D07 / D13 | Router tests prove no upload with observability disabled, repeated registration, and mixed providers in both orders (E5); live non-upload observation pending (T10) |
| FR-102 | Retained | T1 / T10 | disable_provider_tracing suppresses upload for either provider without disabling enabled OTel; mixed initialization cannot override it. Verify workflow/run identity, session/group ID, and explicit per-run capture policy overriding SDK environment defaults. | D07 / D13 | Override, workflow name, group id, per-run policy tag, and env-default capture override tested (E5); live acceptance pending (T10) |
| FR-110 | Retained | T3 / T4 / T6 / T7 | One side-effect-free validation pass reports all applicable errors, including new tools/hooks/handoffs. | D02 | Base validator exists (E3); handoff/skill tool-name and Claude-literal checks added (E7); hosted/hook surfaces pending |
| FR-111 | Revised | T7 / T8 | Serve/deploy validate and echo resolved limits, hooks/tools and trace destinations before listening/deploying; no secret values. | D02 / D11 | Pending implementation and acceptance |
| SC-001 | Revised | T3 / T4 / T10 | Provider selection executes all five retained HoloDeck types plus five hosted types without a backend override. | D01 / D06 | Function/RAG/MCP baseline (E1/E2); skills fixture-level (E7) and live on Azure (E8); hosted pending |
| SC-002 | Revised | T11 | Candidate full suite and compatibility tests pass; preserve Claude/RAG contracts without restoring removed SK or nonexistent AF/ADK runtimes. | D01 / D12 | Baseline focused tests only; candidate full suite pending |
| SC-003 | Revised | T10 | Provider-neutral single/multi-turn, streaming, tools/errors and multimodal contracts match retained Claude behavior. | D01 | Baseline core coverage (E1); candidate parity acceptance pending |
| SC-004 | Revised | T10 | Time validation below1s on stated fixture/environment; invalid credentials/tool policies/safety gates return collected actionable errors; Azure capability errors stay runtime-gated. | D03 | Timing and complete validation acceptance pending |
| SC-005 | Retained | T10 | Clean environment without OpenAI extra imports selector and runs non-OpenAI setup without SDK leakage. | D01 | Source lazy gate exists; isolated-install proof pending |
| SC-006 | Retained | T10 | NLP, G-Eval and RAG consume results without shape regressions; evaluation-model overrides remain effective. | D12 | G-Eval and RAG faithfulness consume live OpenAI-backend results on Azure (E8) after the retrieval_context naming fix; NLP metrics and model overrides remain T10 |
| SC-007 | Revised | T3 / T4 / T10 | Per-tool tests and supported-provider runs cover five retained HoloDeck and five hosted types; ComputerTool is rejected. | D06 | Partial adapter baseline (E1/E2); skill fixture coverage (E7); five retained types live on Azure (E8); hosted coverage and OpenAI live run pending |
| SC-008 | Revised | T7 / T8 / T10 | Local1CPU/1Gi admits10 without OOM/rejects11th; supported ACA1CPU/2Gi admits20 without OOM/rejects21st; test overrides and slot recovery. | D11 | Capacity and local/cloud load evidence pending |
| SC-009 | Revised | T5 / T10 | A synthetic credential result is redacted in model context and exported spans; no actual credentials used. | D05 / D07 | Span unit coverage (E2); model-visible/end-to-end acceptance pending |
| SC-010 | Deferred | H-022 | Authorized hardened deployment proves separate secret ownership and rejected non-allowlisted egress. | D08 | Excluded from 035 completion; not verified |
| SC-011 | Revised | T1 / T10 | Real OpenAI request reaches allowed dashboard+collector; Azure reaches collector only; opt-out/disabled/mixed cases prove non-upload. | D07 | Local isolation cases passed (E5); live destinations acceptance pending (T10) |
| SC-012 | Deferred | H-011 | Sandbox command executes in its confined workspace on both providers with required opt-in. | D08 | Excluded from 035 completion; not verified |
| SC-013 | Deferred | H-011 | Hardened remote sandbox workspace stays off agent filesystem; inspect deployment and remote handle. | D08 | Excluded from 035 completion; not verified |
Acceptance work without a separate original FR identifier¶
These tasks are mandatory for the completion plan. Their absence from the original numbered FR list does not defer them.
| Task | Required evidence | Current status |
|---|---|---|
| T2 / H-009 | Factory-to-provider dimensions, error boundary, collector-visible LiteLLM embedding/chat spans, content capture/redaction, OpenAI/Azure/Ollama grounded and contextual ingest, Claude context-generator regression | Focused contracts closed (E6, D15); live three-provider ingest/query and collector observation remain T10 |
| T9 | Tracked agent/tool fixtures, clean-directory quick starts, provider tabs, hook/guardrail matrix, guide-template decisions, corrected current SK/serve/deploy claims, rendered inspection | Open; documentation corrections listed in docs plan |
| T10 | Multimodal input, evaluation overrides, candidate-specific evidence, provider capability restrictions and complete acceptance results | Open |
| T11 | Full checks, evidence-backed historical gate closure, schema/architecture/quality updates, debt status, archival links and migration ledger | Open |
Deferred scope destinations¶
The debt tracker owns the rationale, owners, and exit criteria. These links also cover exclusions that do not have their own original FR number.
| Deferred scope | Destination |
|---|---|
| Final Semantic Kernel removal | H-008 |
| Hardened Envoy profile | H-022 |
| Sandbox mode, remote clients, and Modal | H-011 |
| Computer-use | H-012 |
| Interactive human approval | H-013 |
| MCP-server guardrails | H-014 |
| Executable modify hooks | H-015 |
| Prompt-tool execution | H-016 |
| Namespace unification | H-017 |
| VoicePipeline | H-018 |
| RealtimeAgent | H-019 |
| Ambient skill discovery | H-020 |
| Per-session ephemeral containers and arbitrary Python containment | H-021 |
New deployment targets and nonexistent AF/ADK runtime preservation are not implicit implementation work. D01 preserves the actual routing contract.
T0 verification¶
Verified 2026-09-06: the original 56 FR + 13 SC identifiers match the spec and 69 complete matrix rows exactly. All 181 local fragment links across the spec and active records resolve to rendered Markdown anchors. make harness-check, git diff --check, and uv run mkdocs build --strict pass. Independent review found no missing mandatory scope or unowned deferrals after correcting FR-033 and FR-102 acceptance details.
T0 completion establishes this contract and its traceability, not runtime conformance.