Status / priority
P1 — MATERIAL AUTHORITY-CONTINUITY GAP. READY_FOR_BOUNDED_IMPLEMENTATION AFTER FRESH START-STATE AUDIT. AUTO_CHAIN=false.
This Issue is the durable implementation home for the settled NAB-E2 result:
MULTI_HOP_DELEGATION_CONTINUITY_GAP_PROVEN
NAB open-ended research is closed. Do not reopen E4/E5/E6 or invent new broad NAB research from this Issue unless implementation or a physical canary produces a new material counterexample.
Fresh source fence
Observed 2026-09-26:
James3014/devspace origin/main = 4a94932eb107b312cfab2cc296458faeefdff15a- tree =
ba3ca1cabef2f9ec0a8153f09ec2b029a146d0b2
James3014/Nexus-new origin/main = 006f16f23496942e2024a8bc16fea25a8d941bed
Rebind current source before mutation. This Issue does not claim the local loaded runtime is identical to GitHub main.
Proven gap
Settled Nexus semantics require recursive delegation with monotonic narrowing:
Owner / root authority
-> Main Controller
-> Worker
-> Subagent
-> ...
-> consequential physical effect
Required invariant:
Authority(child) ⊆ Authority(parent) ⊆ Authority(root)
Current DevSpace already has useful one-hop primitives:
- durable parent linkage;
- scope/action narrowing;
- child validity bounded by parent validity;
- parent revocation fencing descendants;
- exact effect/lease/CAS binding;
- ancestry traversal / cycle protection.
But current execution policy still materially stops at Controller -> Worker and explicitly rejects Worker -> child/subagent delegation on the active path.
The gap is therefore not "whether recursive delegation is desirable". That product semantic is already settled. The gap is that the physical carrier does not yet preserve root-principal authority through arbitrary bounded delegation depth to the final effect.
Required behavior
Implementation must preserve the existing authority owner and extend the existing carrier, not create a second policy system.
At minimum, a consequential descendant effect must be mechanically bound to:
- root authority reference/hash;
- exact parent delegation identity;
- leaf delegation identity;
- bounded delegation depth;
- operation/attempt identity;
- deterministic delegation-chain identity;
- existing effect/lease/CAS identity.
Every child must fail closed on widening of any authority dimension materially present in the current contract, including action/effect/tool ceiling, repository/task identity, scope, validity and claim ceiling.
Ancestor revocation/expiry/invalidation must fence all new descendant effects.
Owner-only / Candidate-acceptance / merge / release / deploy / production authority must remain non-delegable under the existing canonical authority model.
Mandatory hostile controls
- valid Main -> Worker -> Subagent narrowed chain succeeds;
- child action widening rejects pre-effect;
- filesystem/scope widening rejects;
- descendant merge/Owner-only authority request rejects;
- ancestor revocation fences already-issued descendant;
- expired parent with apparently-valid child rejects;
- root-principal substitution rejects;
- cross-repository / cross-goal chain stitching rejects;
- same operation with different delegation chain rejects or requires reconciliation;
- leaf-only / truncated chain cannot satisfy a consequential-effect claim;
- existing Controller -> Worker behavior does not regress;
- no-subdelegation work does not require synthetic meaningless hops.
Delegation depth boundary
Do not mint a product default in implementation.
Current host/source safety caps may be reused as physical upper bounds if freshly verified, but:
host hard cap != product default
The V1 contract requires an explicitly bounded effective maximum from an existing approved authority/configuration seam. If no legal bounded value exists for an attempted recursive delegation, fail closed rather than inventing one.
Authority boundaries
- CapabilityPlanner remains the sole Nexus route/capability-selection authority.
- DevSpace transports, persists and enforces delegated authority; it does not create root authority.
- Existing receipt/effect authorities remain canonical; do not create a second receipt truth.
- No worker/subagent may self-accept, merge, release, deploy or auto-chain.
Acceptance / physical witness
Source/unit tests are necessary but insufficient.
Terminal acceptance requires a controlled physical witness:
root authority
-> Main
-> Worker
-> Subagent
-> bounded consequential effect
-> durable evidence reconstructing the same chain
with the hostile controls above and exact source/build/runtime identity.
Relationship to other NAB work
This Issue is independent of the E3 Remote MCP Tool Identity implementation except for a shared final effect seam. Neither is a hard prerequisite for the other's source implementation.
Research closure
NAB broad research is considered complete at Issue creation. Reopen research only if implementation evidence falsifies a settled invariant or exposes a new material authority mechanism that E2/E3 cannot express.
Execution / review boundary
Architecture/security-sensitive work.
- claim mode:
MANUAL_DISPATCH
- independent Candidate acceptance: required
- merge/integration: separate authority
AUTO_CHAIN=false
Exact next gate
E2_G0_FRESH_MULTI_HOP_CARRIER_OWNERSHIP_AND_CALLER_AUDIT
Rebind current callers and the exact existing one-hop authority carrier first, then implement the smallest recursive attenuation extension compatible with that owner.
Status / priority
P1 — MATERIAL AUTHORITY-CONTINUITY GAP. READY_FOR_BOUNDED_IMPLEMENTATION AFTER FRESH START-STATE AUDIT.
AUTO_CHAIN=false.This Issue is the durable implementation home for the settled NAB-E2 result:
MULTI_HOP_DELEGATION_CONTINUITY_GAP_PROVENNAB open-ended research is closed. Do not reopen E4/E5/E6 or invent new broad NAB research from this Issue unless implementation or a physical canary produces a new material counterexample.
Fresh source fence
Observed 2026-09-26:
James3014/devspace origin/main = 4a94932eb107b312cfab2cc296458faeefdff15aba3ca1cabef2f9ec0a8153f09ec2b029a146d0b2James3014/Nexus-new origin/main = 006f16f23496942e2024a8bc16fea25a8d941bedRebind current source before mutation. This Issue does not claim the local loaded runtime is identical to GitHub main.
Proven gap
Settled Nexus semantics require recursive delegation with monotonic narrowing:
Required invariant:
Current DevSpace already has useful one-hop primitives:
But current execution policy still materially stops at Controller -> Worker and explicitly rejects Worker -> child/subagent delegation on the active path.
The gap is therefore not "whether recursive delegation is desirable". That product semantic is already settled. The gap is that the physical carrier does not yet preserve root-principal authority through arbitrary bounded delegation depth to the final effect.
Required behavior
Implementation must preserve the existing authority owner and extend the existing carrier, not create a second policy system.
At minimum, a consequential descendant effect must be mechanically bound to:
Every child must fail closed on widening of any authority dimension materially present in the current contract, including action/effect/tool ceiling, repository/task identity, scope, validity and claim ceiling.
Ancestor revocation/expiry/invalidation must fence all new descendant effects.
Owner-only / Candidate-acceptance / merge / release / deploy / production authority must remain non-delegable under the existing canonical authority model.
Mandatory hostile controls
Delegation depth boundary
Do not mint a product default in implementation.
Current host/source safety caps may be reused as physical upper bounds if freshly verified, but:
host hard cap != product defaultThe V1 contract requires an explicitly bounded effective maximum from an existing approved authority/configuration seam. If no legal bounded value exists for an attempted recursive delegation, fail closed rather than inventing one.
Authority boundaries
Acceptance / physical witness
Source/unit tests are necessary but insufficient.
Terminal acceptance requires a controlled physical witness:
with the hostile controls above and exact source/build/runtime identity.
Relationship to other NAB work
This Issue is independent of the E3 Remote MCP Tool Identity implementation except for a shared final effect seam. Neither is a hard prerequisite for the other's source implementation.
Research closure
NAB broad research is considered complete at Issue creation. Reopen research only if implementation evidence falsifies a settled invariant or exposes a new material authority mechanism that E2/E3 cannot express.
Execution / review boundary
Architecture/security-sensitive work.
MANUAL_DISPATCHAUTO_CHAIN=falseExact next gate
E2_G0_FRESH_MULTI_HOP_CARRIER_OWNERSHIP_AND_CALLER_AUDITRebind current callers and the exact existing one-hop authority carrier first, then implement the smallest recursive attenuation extension compatible with that owner.