OmegaFlow-design: checkpoint unfinished LLD investigations

docs/consumers/supporting/omegaflow-rp-c6-implementation-plan/bounded-proof-evidence.json

@@ -0,0 +1,20 @@
+{
+  "OmegaFlow-lld-stream-proof-result.json": {
+    "path": "/home/omry/.local/state/awd/reploy-E-resume-20261028/OmegaFlow-lld-stream-proof-result.json",
+    "sha256": "77296342e921500e313d3dddf9d4410edf7a39c8dc5697842119f4e272050310"
+  },
+  "OmegaFlow-lld-stream-proof-attempt01-result.json": {
+    "path": "/home/omry/.local/state/awd/reploy-E-resume-20261028/OmegaFlow-lld-stream-proof-attempt01-result.json",
+    "sha256": "0d80e32b8ec4bcb5dc94479851a944a9d1d43abd1b0f307768164486f94b22e8"
+  },
+  "OmegaFlow-lld-image-namespace-proof-result.json": {
+    "path": "/home/omry/.local/state/awd/reploy-E-resume-20261028/OmegaFlow-lld-image-namespace-proof-result.json",
+    "sha256": "29258adecb304005864b7a03cf41c33df43b105d64bac0180105181e2fda8be0"
+  },
+  "watchdog_focused_test": {
+    "command": "go test ./internal/dockerdeploy -run '^(TestControlledSessionWatchdogParentLossRemovesOnlyManifestResources|TestControlledSessionWatchdogRetriesParentLossCleanupWhileDockerIsUnavailable|TestControlledSessionWatchdogRejectsPriorBootBeforeReady)$' -count=1",
+    "exit_code": 0,
+    "output": "ok github.com/omry/reploy/internal/dockerdeploy 0.008s",
+    "limits": "Existing shared algorithm tests, not native child-process proof."
+  }
+}

docs/consumers/supporting/omegaflow-rp-c6-implementation-plan/candidate-boundaries-and-sizing.md

@@ -0,0 +1,102 @@
+# Engineering sizing assessment before the LLD
+
+This is a source-based candidate responsibility map, not a canonical slice
+inventory, reviewed estimate or implementation authorization. Actual IDs and
+coherent cuts belong to the LLD authoring stage. Open readiness proofs can change
+these ranges; a material mechanism or guarantee change returns to architecture
+review. No production code has been written for these responsibilities.
+
+The historical 1300–2050 production / 2700–4350 test estimate is withdrawn as a
+current forecast. It omitted real portable-channel/watchdog prerequisites and
+did not settle image namespace protection. It remains historical evidence in the
+approved preimage; the current consumer record must replace its table when the
+full LLD is authored and reviewed. This assessment is not that final replacement.
+
+## Cost and compatibility audit disposition
+
+The [source/contract audit](scope-and-multi-identity-compatibility.md) found
+substantial existing broker/protocol, protected-path, build/store and cleanup
+behavior to reuse. The rows below are responsibility envelopes, not evidence
+that each subsystem must be implemented again. In particular, the transport row
+needs a container-private peer relay and host integration, not another public
+controller broker. Existing namespace checks need complete evidence/alias
+extensions, not an independent OmegaFlow policy compiler.
+
+The ranges and arithmetic below remain the pre-audit candidate assessment. They
+are retained for traceability and are **not an accepted delivery forecast**.
+No lower replacement total is justified until missing interfaces/proofs yield
+concrete implementation deltas. Shared E/F foundations will have one owner in
+the canonical LLD; backend adapters and qualification remain separate.
+
+## Counting convention
+
+Changed physical text lines means additions plus removals against the accepted
+parent, including comments and blank lines. Production includes shipped runtime,
+build and packaging configuration. Test code includes test helpers, test-only
+configuration and textual fixtures. A line is counted once. Generated/vendor/
+lockfile changes, binaries, Markdown, review bookkeeping, release execution and
+OmegaFlow-side changes are excluded. Native test access and evidence collection
+are material non-LOC prerequisites, not free proof inferred from these figures.
+No working-hour estimate is provided.
+
+## Candidate responsibility ranges
+
+Shared foundations have one owner here. Dependent rows reuse those foundations.
+Ranges reflect the inspected current modules and the unproven work below, not
+measurements or a fixed PR count. The 450–650 broker row exceeds the 500 target
+at its upper bound but stays below the 750 hard maximum; refine its coherent
+cut after the transport proof, rather than claim a 500-line cap was met.
+
+| Responsibility | Production/configuration LOC | Test-code LOC | Concrete change basis |
+| --- | ---: | ---: | --- |
+| Namespace path resolution | 300–500 | 650–1000 | Component-aware path/absence and ELF metadata observations in internal/probe; retain current inspection protocol compatibility. |
+| Namespace mount protection | 300–500 | 700–1100 | Derived image execution/configuration roots; alias/ancestor/automatic-volume checks in dockerdeploy, not just lexical Bash overlap. |
+| Container-private broker | 450–650 | 800–1300 | Packaged Linux helper peer credentials, one claim and bounded frame relay; reuse protocol validation. |
+| Host portable channel integration | 300–500 | 700–1100 | Pinned local-engine attached stream and lifecycle integration; replace host Unix channel after parity proof, not a second default route. |
+| macOS watchdog adapter | 80–160 | 250–450 | Reuse Unix inherited descriptor model and existing shared exact-manifest cleanup; native survival and receipt tests. |
+| Windows watchdog adapter | 300–500 | 700–1100 | Explicit inherited private handles, detached child survival, readiness/disarm/EOF and incident target; reuse shared cleanup and boot identity. |
+| Native safe supplied-file opening | 200–350 | 550–850 | Reuse providerstore expected-byte publication; descriptor-safe regular-file opening, alias refusal and source independence across native filesystems. |
+| Selected image and environment provenance | 300–450 | 450–700 | Public selection retained into current ordinary provider build; separate inherited/application/final environment; no tag fallback. |
+| Protected input contract and capture | 350–500 | 650–1000 | Bounded complete inventory and independent manifest expectation; validation, cancellation and generation-owned capture publication. |
+| Normal image payload delivery | 350–500 | 650–1000 | Deterministic archive through current normal build, fixed modes, trusted collision check and exact final inventory verification. |
+| Bounded public observations | 300–500 | 700–1100 | No-healthcheck trusted create profile, bounded requested facts, types and absence; reuse namespace resolver rather than duplicate. |
+| Retained comparison record | 250–400 | 500–800 | Versioned opaque public identifier, private projection under existing generation ownership, record bounds and replay/deletion behavior. |
+| Locked admission binding | 350–500 | 700–1100 | Expected identity on existing session entry; compare again after queue waits, pin through use, no caller-report trust or alias fallback. |
+| Reachability and recovery | 250–400 | 500–850 | Capture/record/image generation reachability, cancellation and exact-owned cleanup/incident continuation. |
+| Public interface composition | 250–400 | 450–750 | Existing native blueprint and structured CLI/JSON integration; user docs and Changie fragment excluded from LOC. |
+| Integrated acceptance and adoption evidence | 150–300 | 1000–1600 | Full public path and refusal/cleanup matrix on inherited supported hosts plus WSL2 Desktop; three Linux/amd64 consumer profiles. |
+| **Candidate total** | **4480–7110** | **9950–15800** | Sum of the above lower/upper bounds. |
+
+The first seven shared prerequisites subtotal **1930–3160 production/configuration LOC** and **4350–6900 test-code LOC**. Namespace enforcement, transport and native watchdogs are
+substantive production work. They cannot be hidden in a test-only final slice.
+
+## Inspected reuse and uncertainty
+
+At current source, `controlledsession/channel.go` has 294 lines and its Linux
+transport 179. The existing engine attach adapter has 219. Reuse bounded frame
+validation and local-engine endpoint dialers; an engine non-TTY exec stream still
+needs its own multiplexing, claim and cancellation handling, not a copied PTY
+assumption. The broker and host rows include removal/adjustment of the old route.
+The shared watchdog has 561 lines, its Linux launch adapter 231; retain the
+algorithm instead of implementing cleanup separately per host. Darwin can reuse
+Unix descriptor semantics; native proof is still required. Windows Go exposes
+explicit inherited handles, but inherited process-job behavior and parent-loss
+receipt ownership remain unproven.
+
+Current probe inspection has 230 lines but only resolves final symlinks. It is
+not a complete safe ancestor resolver or namespace derivation module. The normal
+payload image helper has 964 lines and staging 593; reuse the build/store graph,
+not its image-shell destination checks. Providerstore has 676 lines and already
+compares expected digests before publication. It does not supply native alias
+checks, a complete supplied-input contract or generation reachability alone.
+
+The namespace rows remain the largest feasibility uncertainty: runtime lookup
+paths, loader/configuration state, required absence, mount aliases and engine
+mounts must be protected without a new generic dependency-analysis service.
+The three cached image inspections establish loader/library presence only, not
+that the proposed namespace derivation is sufficient or the Bash builds qualify.
+If these requirements cannot fit a bounded trusted-helper extension, return to
+architecture review before accepting the inventory or implementing it.
+
+Endpoint publication remains separate. The existing E campaign remains paused
+before E2.3. No part of this estimate allocates E work to OmegaFlow.

docs/consumers/supporting/omegaflow-rp-c6-implementation-plan/consumer-adoption-reconciliation.md

@@ -0,0 +1,44 @@
+# OmegaFlow RP-C6 consumer adoption reconciliation
+
+This is a Reploy-side contract mapping and handoff. It does not claim that the
+OmegaFlow checkout has been edited, reviewed, qualified or adopted. The relayed
+corrected request accepts protected copies and supplies the bounded hash
+inventory. The approved Reploy architecture chooses ordinary immutable-image
+delivery. Older consumer assumptions must be reconciled before adoption.
+
+## Required consumer changes
+
+| Older consumer assumption | Agreed contract | Adoption check |
+| --- | --- | --- |
+| Final executable runtime must be a read-only source bind at `/omegaflow-runtime`. | Retained bytes are verified against the supplied complete inventory and independent manifest digest, then delivered in the normal immutable final image at those paths with fixed modes. Physical source-bind type is not the acceptance fact. | C6.3 accepts protected image delivery and verifies protected inventory/path/mode facts. Remove the old required physical bind from reserved composition; do not patch composed YAML later. |
+| A staged-tree hash establishes the runtime that will launch. | Hash the actual retained bytes against supplied expected hashes and verify the exact final-image inventory. The public prepared identity binds those facts through admission/use. | Pre-capture corruption refuses. Original source mutation/removal after independent capture remains valid. Workload writes and shadowing cannot replace protected contents. |
+| Obtain raw Bash/system-rc bytes. | R4 requires bounded resolved path/type/digest/absence facts; no raw file export. | Compare Bash digest to OmegaFlow's qualified build table; require the exact selected system-rc path absent, with errors and dangling links distinguished from absence. |
+| Any mutable tag/source change invalidates prior inspection. | Changes to actual admitted state invalidate; irrelevant external references do not. | Moving a tag with the same retained image and changing original files after capture succeeds; actual final image/generation/command/env/identity/mount/endpoints change refuses before bootstrap. |
+| Reploy needs a consumer image-dependency inventory. | Reploy protects image code/configuration and lookup namespaces; OmegaFlow inventories only its 18 payload files plus manifest. | Bash, sh, loader and image libraries remain Reploy-owned. Do not add a discovery/snapshot task to OmegaFlow. |
+| All runtime paths are protected/immutable. | App data is live; `/run/omegaflow` remains writable tmpfs for sockets/FIFOs. | App data changes remain ordinary runtime behavior; none may shadow protected contents or required absence. |
+
+## Governing sources and acceptance order
+
+The older source is [OmegaFlow part-C C6.3](../../../../../omegaflow/docs/design/part-c-implementation-design.md),
+with the historical reserved-workload locator
+`src/omegaflow/conf/reploy/envoy/reserved/default.yaml` in that checkout. That
+file is absent at checkpoint verification; this is a historical source reference,
+not a verified current composition. Resolve the consumer's actual composition
+before adoption; no replacement source is inferred here.
+Those checkout links are context, not new design authorities or claims of changed
+consumer files. The corrected normative request is retained in
+[the requirements source](../omegaflow-rp-c6-requirements/consumer-request-and-evaluation.txt)
+and [R4/R9 clarification](../omegaflow-rp-c6-requirements/consumer-clarifications.md).
+The approved requirements and HLD govern this mapping.
+
+1. Complete reviewed Reploy LLD and readiness proofs; implement only after its
+   required approval and separate delivery authorization.
+2. Qualify the complete public inspection → admission → launch path and refusal/
+   cleanup behavior on the supported hosts, including WSL2/Desktop.
+3. Select an explicit compatible Reploy release/source and let OmegaFlow update
+   and review its bind-specific C6.3/composition checks through its own workflow.
+4. OmegaFlow qualifies its three Bash compatibility profiles and supplied runtime
+   against that selected release before claiming RP-C6 unblocked.
+
+Endpoint publication is a separate dependency. This mapping does not resolve it
+or restart OmegaFlow's paused campaign or Reploy milestone E.