!!! note “Historical v0.3 scope” This page records decisions made for v0.3. Some implementation statuses, especially container workers, were superseded by v0.7. Use current non-goals and the v0.7 operator guide for current behavior.
This document is normative. It lists what v0.3 will not do. It exists because a scope boundary that only lives in someone’s head is not a boundary — it is a mood, and moods lose arguments to enthusiasm at 2am.
The rule for this file: a non-goal is removed only by a deliberate decision that
is recorded in CHANGELOG.md. It is not removed by a pull request that happens to
be convenient, and it is not quietly outgrown.
Read alongside API stability, which says what is promised. This says what is refused. Durable refusals through v0.7, including Sandcastle, are restated in non-goals.md. The post-v0.5 sequence is roadmap.md.
Sandcastle must not be introduced into this repository in any form. This is a hard prohibition, not a preference:
pyproject.toml — not in dependencies, not in
[project.optional-dependencies], not in [dependency-groups].WorkerBackend
implementation.Config field.The reasoning is the same reasoning that produced the whole architecture. This
project’s isolation story is deliberately built on primitives the operator
already owns and can inspect without a vendor: kernel Landlock on Linux ≥ 5.13,
Apple’s sandbox-exec on macOS, and an ordinary OS process as the unit of
containment. Adding a sandboxing layer means the answer to “what confined this
worker, and can I verify it” stops being “read these forty lines and cat the
profile” and starts being “consult a third party.” A framework whose central
claim is that you can own, audit, and reproduce the bottom of the stack cannot
take that dependency and keep the claim.
If Sandcastle-shaped isolation is genuinely needed, the answer is a separate
repository that depends on sovereign-agent, not a code path inside it. That
keeps this tree’s guarantee intact and puts the dependency where the person who
wants it can see it.
A pull request that adds Sandcastle to this repository should be closed with a link to this section. No further discussion is required.
DockerWorker stays a stub in v0.3. It exists so that
Config.worker_backend='docker' fails with a clear NotImplementedError instead
of an import error, and for no other reason.
There is no container image, no Dockerfile, and no bind-mount code in this
repository. The docker pip extra installs only the Docker SDK and is
deliberately excluded from the all meta-extra, because shipping a
dependency for a code path that does not exist advertises a capability the
library does not have.
worker_backend='subprocess' is the supported isolated backend. It gets
kernel-enforced filesystem isolation without a daemon.
The memory subsystem stays a filesystem-backed skeleton. No Chroma, no FAISS,
no pgvector, no hosted embedding store, and no embedding provider dependency.
MemoryStore, MemoryRetrieval, and MemoryConsolidation keep their current
signatures so that a future backend is additive, but v0.3 does not implement
retrieval or consolidation behavior. Any documentation that implies otherwise is
a bug in the documentation.
One orchestrator, one host, one sessions_dir. There is no lease layer, no
coordination protocol, and no work-stealing between instances, and v0.3 does not
add one.
Two orchestrators pointed at the same sessions_dir is undefined behavior, and
sessions_dir on NFS or SMB is unsupported because the atomic-rename guarantee
the whole design rests on is weaker there. v0.3 will not add workarounds for
either; it will keep failing honestly.
Sessions stay directories. IPC stays atomic rename(). No Postgres, no SQLite
session store, no Redis, no Kafka, no NATS, no task queue library.
This is decision one of the architecture, and every capability that “would be
easier with a broker” is a capability being asked to justify discarding the
property that makes the system debuggable by cat.
This is a work repo. It holds code. It does not hold the scoping and reporting chain for work done on it, and v0.3 will not add one:
work_repo — this repository. Code that genuinely collides, landing on
branches, merged through pull requests.sow_repo — a separate corpus repository. Where work is scoped and reported.No SOW.md, no SOW/ directory, no filing chain, and no document in this tree
claiming to be an authoritative statement of work. Earlier revisions of
the architecture doc linked a root SOW.md; that file never
existed and its absence is the design, not a gap.
This document deliberately does not name a path in the corpus repository. A hard-coded corpus path in a work repo is exactly the coupling the two-field split exists to prevent, and it would be wrong the first time either repository moved. Locate your chain with the tooling, not with a string copied out of a README.
The Evidently and OpenTelemetry backends and the voice pipeline stay
import-gated stubs in v0.3. logs/trace.jsonl remains the only observability
path that actually works, and it remains dependency-free.
Adding a real backend is not forbidden forever — it is forbidden as a v0.3 deliverable, so that the release does not ship three half-backends instead of one working substrate.
v0.3 will not grow a graph DSL, an agent marketplace, a hosted control plane, or
a plugin ecosystem intended to attract third-party publishers. Plugin and
Registry exist to keep the framework’s own extension points honest, not to seed
a marketplace.
The project’s stated purpose is to be readable at the bottom of the stack. Every feature that trades legibility for surface area is a feature that undermines the reason to choose it.
CHANGELOG.md under the
release that reverses it, and edit this file in the same change.