grid_assets library

The_grid's opinion assets — the agent/verify/land Capability impls + the code Circuit + the git SourceControl (ADR-0008 D2 / M4-P1 §6).

These are the OPINIONS the opinion-free engine (grid_engine) must not carry (ADR-0007 §1): the coding agent it spawns (claude), the check it runs, the PR it opens. A station runner wires them via buildCodeRegistry + a CircuitResolver (RS-8 retired the transitional CodeRunCommand — the resident composition is the only consumer now). The power_station home of the first-party assets (extracted from the_grid at the repo split).

The v3 COMPOSITION ASSETS (Track F, tg-5r9, composition_assets.dart) are how those opinions mount into the grid tree at a SCOPE — the replacement for the runner-built ServiceBundle map: GitGridAssets plus a domain delivery asset (substation-scoped source control, over the ambient GitServices machinery carrier the delegate mounts once), HarnessProvider (station-scoped harness provision), CircuitProvider (the Q8 circuit provider/scope), and sourceControlOf (bead → substation → root resolution, no string-keyed map).

The AGENT SCOPE's model resolution is TIER → MODEL (beads pow-2c9, pow-n6n.4): a spawner declares the AgentTier it rides (frontier for the build and the spec author, mid for the critics, cheap for the read-only lenses) and the STATION arms tier → model (AgentConfig.tiers, a ModelTiers value — an unarmed tier rides defaultModelForTier: kFrontierModelDefault opus, kMidModelDefault sonnet, kCheapModelDefault haiku). resolveAgentConfig resolves bead grid.agent params.model > the selected environment's own model > the station's arming of the declared tier, stamping the winner into the harness transport key. So the committee grades cheap while the build runs strong, and a retune is one arming change. WHICH environment a seat rides is the TYPED lookup (ADR-0006 D2) — D5 retired the role indirection. The resolved model is ALWAYS explicit — never the harness CLI's own default (which silently fell back to fable when a weekly limit blew) — and UsageReport.model captures the id(s) that ACTUALLY ran, so grid.result.<node>.model proves it from the ledger (subsuming bead pow-efv).

The COMPUTE asset domain (ADR-0011 D2/D3, M6 Track D) also lives here: the DispatchCommand/CommandResult payloads + the bounded "use" + the capacity predicate moved OUT of the kind-agnostic grid_federation core, and the LeaseCapability wraps a federation lease as an engine Capability (mount = acquire + dispatch, unmount = release).

The SEARCH domain (bead pow-ovh, the first coupled skill+command pair) also lives here: deterministic, READ-ONLY (A37) cross-store search over the station's attached substations. mountedRosterOf resolves the roster from the resident-station context (the composing station's GridDelegate tree, mounted offline), while codedRosterOf owns and disposes a fresh delegate around that enumeration; StationSearchService queries each seat's .beads/ store (backlog + decision beads) through a read-only-by-construction seam; SearchCommand is the THIN exported CLI adapter a station composes (space search <query>) — the substrate agentic skills (discover) CALL instead of reinventing search by inference. Semantic vectors live in the grid-home-owned, derived DoltEmbeddingIndex at .grid/embeddings; DoltEmbeddingIndex.open provisions its VECTOR(N) width from EmbeddingIndexIdentity, rejects a provider/model/dimension mismatch before use, and is the sole storage API shared by the indexing and semantic-read paths. It never writes a substation work store or the resident tranquility store. IndexCommand is the only embedding writer: it calls EmbeddingClient before writing the grid-home-owned DoltEmbeddingIndex. SearchCommand remains inference-free and write-free.

The FILING pair is the front-door completeness counterpart: FilingService reads one bead through ExactSubstationBeadSource, gathers its FilingEvidence, and FilingContract deterministically evaluates the eleven mechanical authoring requirements over both; FilingCommand is the thin CLI adapter the discover skill calls. Description and acceptance usefulness remain with the agentic half.

Four of the eleven rows are PRESENCE and six are VIABILITY: can the validation_plan be PARSED by the gating lane's shell and by CI's dash, are the bead's file anchors repository-relative, does every bead id it cites EXIST in the current or an attached store, is its acceptance free of pinned release versions, and is every decision it cites already RECORDED. The pure scanners those rows run are in filing_text.dart — one copy, shared with discovery's own anchor and citation gather. The eleventh is CONTENT: no_corrupting_text refuses a NUL byte — and only a NUL byte — in the bead's own body text, because it truncates the write while bd reports success. A backtick is legitimate bead text and passes. The row reads no evidence — the text is the whole question.

The viability rows are judged against FilingEvidence, which every leg reports in three states rather than two: answered, answered-negative, and NOT ANSWERED. An unavailable leg is never read as an empty one, so "no store holds this id" and "nobody asked a store" stay different facts and only the first refuses a bead. FilingCommand and ApproveCommand bind the live gather by default (SystemFilingEvidenceSource over SystemValidationPlanProbe, BdListAllStatusBeadSource and the station's roster decision index); a test or an alternate station overrides it with a FilingEvidenceSource or a whole FilingService. The two checks that deliberately stay AGENT JUDGEMENT — whether the plan finishes inside the critic lane's cap, and whether it covers every affected consumer — are not decidable from bead text and are not requirements. The dependencies requirement is a DependencyProjection of the dependency rows bd holds for the bead — local targets and external:<project>:<capability> targets alike — and NOTHING in this package reads bead prose for blockers: a Blocked by sentence is prose (Nico, 2026-09-13, under the_grid#the-grid-is-a-beads-controller). Each external row resolves through the station roster both filing verbs take by the SAME injected seam (noArmedSubstations is the fail-closed default), so filing and approve cannot answer the same contract two ways; a project the roster does not arm — or a roster that was never supplied — refuses the row and NAMES the remedy.

filing, approve and unpark take NO --state-root. The option existed for ONE reader — the grid home's cross-store link beads — and that read is gone (the_grid#447) with bd's own external: rows replacing it in the store these verbs already read. park, show and mount keep the seam (addStateRootOption / resolveStateRoot), which takes the GRID HOME and appends its .grid state store, because they genuinely reach the session-lifecycle beads there.

MountCommand is the filing verb's counterpart on the OTHER question, and it is an EXPLAINER rather than an actuator: filing answers "is this bead APPROVABLE", mount answers "why will this bead not MOUNT", and the answer used to live in human memory as memorised dances (a hand-closed session leaves a bare work_bead key and the bead never re-mounts; the mount-attempt cap has no reset verb at all). MountExplanationContract turns them into ten ordered rows, each PASS / BLOCKED / UNCHECKED with its own evidence and — when it does not pass — the remedy, which the verb NAMES and never performs: several are destructive and belong to the governor. It COMPOSES the filing report whole rather than restating it, its dependencies row reuses the very DependencyProjection filing rendered (refined only with each local target's open/closed state), and its field clauses are the one mountEligibilityFindings predicate the engine's mount boundary already calls. Being OFFLINE is the point: it is the third consumer of the state-root seam because it reads SESSION-LIFECYCLE beads, and everything that lives only in a running station's memory — capacity, reservations, latches, process liveness, the engine-only mint and successor-retry counters — is reported UNCHECKED with a pointer to the resident status verb, never as a pass.

The PARK PAIR rides that same seam, one rung further in: it is the operator's sanctioned exit for a session the engine's own writers can no longer reach. ParkCommand absorbs the five-step hand ritual — note, unstamp, defer, close, void-retire — across the two stores A37 separates, and UnparkCommand undoes it by clearing the defer DATE through bd undefer and then CALLING ApproveService for the re-stamp rather than re-expressing the preflight. ShowService and ShowCommand sit beside them as the explicit ONE-BEAD READ: no verb anywhere printed a single bead's prose, because bead board/bead round are serviced by the RESIDENT and refuse when it is down — so reading a bead meant knowing which seat mints its prefix and shelling bd from that root. show reads it through the SAME ExactSubstationBeadSource.readExact the filing preflight uses (ONE exact-id bd query on bd's RECORD surface, which carries the bead and its dependency rows together, no mutation surface) and renders id, prose, the grid.approved_* stamp and the dependency edges with NO station in the path. Its output is BOUNDED at kBoundedOutputCapBytes on both the plain and the JSON rendering, and what it cuts it NAMES with the withheld byte count (power_station#a-mechanical-lookup-is-a-vended-command-with-a-bounded-output); --if-revision suppresses the prose only against the bead's own updated_at revision, never against the text of the request. Round, lane and grade data stay with bead round, which owns them. ParkService is guarded on both sides: it ADMITS only on a durable park marker (an open gate bead blocking the session, or grid.session.pause_state=paused — ParkMarker), never on worktree staleness, which is collected as WorktreeActivity corroboration and reported in every receipt and refusal; and it REFUSES on a still-LIVE process fence, probed for MEMBERS (not a leader bool) through the ProcessGroupController seam, so a dead leader over live descendants reads live (FenceLiveness). --override-live waives only that second guard and prints what it waived. The retired join key is never composed here — the session update writes exactly what voidRetireMetadata returns, so a park receipt is indistinguishable in SHAPE from the engine's own void retire. A composing station adds both beside filing and approve.

The SEAT command set makes an operator seat OCCUPIABLE with its own disc (bead pow-lv6t): PrimeCommand is the grid's own SessionStart hook target. It answers for the STATION and POINTS rather than restates (memento-engineering#a-station-explains-itself-through-prime-and-bounded-help): the station's identity and invocation, every verb it exposes BY NAME with that verb's own help beside it — DERIVED from the composed CommandRunner, never a list authored here that would drift the moment a station adds a verb — then where ratified decisions live and which verb searches them, the seat's disc, and the fenced service tick that wakes a seat. The issue tracker's bd prime reference follows VERBATIM under its own heading: still reachable, no longer the whole answer. Handoff injection is ONE note, only on startup, clear and compact, and WHICH note is the launcher's call: the body it consumed for this occupancy, declared in kConsumedHandoffEnvironmentVariable, or — failing that — whatever survived on the disc, which is the hand-started session and the only one still owed the succession verb, named with one seatHandoffAgeDiagnostic line. The whole answer rides the pack's ONE output bound, boundedOutput at kBoundedOutputCapBytes — the same selector the show verb consumes, because a second implementation of a cap is the defect power_station#a-mechanical-lookup-is-a-vended-command-with-a-bounded-output exists to stop one layer down; prime supplies only its own trim order (tracker body, then handoff body, then whole verb-pointer records) and every cut NAMES the bytes withheld and how to ask for them. SeatCommand is the OUTER harness that launches a seat's occupant with its role definition and disc and relaunches it on handoff. SuccessionCommand owns BOTH mechanical edges of the handoff's lifetime. It CONSUMES one through SeatSuccessionService, which archives the seat disc in a path-scoped commit and proves the note is in HEAD before deleting it and its one MEMORY.md pointer line (--no-destructive stops after the proof). The destruction the disc doctrine licenses on "the disc is tracked, so git history is the archive" now has something ENFORCING the tracked half. And --write-handoff <file> WRITES one, from a complete note on stdin, through SeatDisc.writeHandoffOnce — which refuses a second live handoff rather than amending the first, because a handoff is working memory "written once at a boundary, picked up, and deleted" (memento-engineering#handoffs-are-working-memory-and-long-term-memory-stays-thin). Consuming one was already enforced while writing one was only prose, which is how a single governor note came to be rewritten across thirty commits over nine hours; with amendment refused, an unconsumed note is simply a seat that has not handed off, and seatHandoffAgeDiagnostic is the threshold-free line every seat reader renders to make that visible. All three are harness-neutral: every vendor token is an AgentEnvironment declaration (AgentEnvironment.roleArgs, AgentEnvironment.memoryDirArgs, AgentEnvironment.primeMode, AgentEnvironment.drivenArgs, AgentEnvironment.roleAsset). A composing station adds them beside filing and approve; that one-line composition is space_station's own bead, the way power_station#a11-bead-pow-ovh-the-search-domain-roster-resolution-is-an-o landed search.

The VENDED SKILLS (bead pow-88p, extension/station_overlay/skills/) are those agentic halves: discover is the grid home's HITL front door — it dispatches on arg shape (topic research / bead advisory / bead directed), researches via the vended search Command, and on the human's yes files an ephemeral staged bead and hands to specify. vendedSkillIds enumerates them; PackagedAssetLoader.renderSkill renders one by id.

The DELIVERY leg is ONE RESOLUTION and two writers (bead pow-4peu, power_station#one-asset-resolution-defines-tree-and-writers). resolveGridAssets evaluates the station-generated GridAssetRegistry's declared selectors against an immutable SubstationFactsSnapshot — observed OUTSIDE build by a SubstationFactsRepository and projected into the tree by SubstationFactsAssets, aspect-scoped per SubstationKey — and returns the SELECTED generated definitions plus each one's exact source and target path. Registry membership is potential availability; a definition MOUNTED in a substation's assets is actual availability, and it is the same value. OverlayMaterializer then writes exactly that set: this package's OWN provision-time wire (AgentCapability, onto a per-bead WORKTREE root, so a station-spawned agent can /invoke a vended skill; SCOPED to kWorktreeOverlaySubtrees — the per-harness SKILL trees .claude/skills and .agents/skills — because a loose .claude/settings.json is repo-owned territory) and the operator install Command (onto a STATION repo root, unscoped). It renders each file, REFUSES to install one whose holes are unbound, NEVER clobbers a file it did not generate, and never deletes a generated file the resolution stopped selecting (OverlayFileStale).

The OPERATOR leg of that delivery is AssetsCommand over src/assets/overlay_install.dart: <cli> assets install observes the grid home's facts once, resolves the station registry against them, writes the selected artifacts (OverlayInstallService) and prints the DIFF (renderInstallReport). No runtime package-extension walk decides scope any more — the generated registry does. It COMMITS NOTHING — the operator reviews and commits. Each installed file carries a PROVENANCE stamp (overlay_provenance.dart) naming the grid_assets ref it came from, which is what lets the vended assets be COMMITTED rather than gitignored: the stamp tells a generated file from a hand-authored one, and assets install --check classifies every path IN SYNC, DRIFTED, HAND-EDITED, MISSING or STALE, writing nothing. mountedValuesOf is the one offline delegate-mount walker both this leg (for the grid home) and mountedRosterOf (for the substation roster) ride.

The SPEC-READINESS INTAKE LENS (bead pow-q7n, src/code/readiness.dart) heads that spec circuit: a deterministic intake contract (IntakeCapability — a driveable type + a real brief, ZERO agents) then ONE cheap agent grading the BEAD (ReadinessCriticCapability, the bead-readiness rubric) and a decision point (ReadinessRouteCapability). A bead that is not spec-ready is HELD for refinement BEFORE specify spawns, so a coarse brief never burns the architect + the 4-critic committee — the ~18-agent round the 2026-07-11 wide run spent discovering that at the committee.

The DISCOVERY circuit (src/code/discovery.dart) is the spec circuit's second head, nested between that ladder and specify — a gather AND a gate. The gather is deterministic (AnchorsCapability, ZERO agents): the committee's own grading rubrics, the bead's code anchors resolved against the worktree, and prior art through the read-only StationSearchService the search Command already vends. Three READ-ONLY explorers (DiscoveryLensCapability) then run in parallel on the CHEAP tier and, because a lens DECIDES NOTHING, a lens emits no letter: it emits a LensReport of context notes and CITED violations. DiscoveryRouteCapability makes the call, deterministically (decideDiscovery): a bead that contradicts a ratified ADR or an applicable skill WITHOUT acknowledging the departure is HELD with the offence CITED, so no architect and no committee ever runs on it; a clean bead ADVANCES with a curated DiscoveryDossier that buildSpecifyBrief renders — the architect specs against the rubrics it will be graded by. The gate is CITE-THE-OFFENCE by construction (gatesTheBead): no citation is a vibe and can never hold a bead, a DECLARED departure passes, and a pattern deviation needs a NAMED precedent.

The DART domain (the typed grid.dart envelope + pub dev-time linkage + DartCommand) lives in its sibling pack dart_grid_assets.