id: Phase 12 designs to run through the research workflow #534

What and why

These Phase 12 tasks (.opencode/plans/phase-12-platform-flexibility.md) need a design, or for D1-026 a research package, before anyone implements them. Run each through the research workflow, commit the design, then open an implementation issue and tick the box. F12.1 (manifest) and F12.4 (provider registry) are the plan's two highest-return tasks; F12.7 (ABI spec) is part of its recommended first slice.

Items

Each box is done when the design (or research package) is committed and an implementation issue is linked here.

• D1-019 — F12.1 Declarative world manifest (world.toml) with apply / --dry-run / diff (L, design)
  A world.toml naming module (hash or source), seed, grants, ceilings, resource profile, roles/invites and schedules. id world apply reconciles a live world idempotently through existing admin operations, and id world diff detects drift. The plan calls it one of the two highest-return tasks.
  • Status: not started. No world.toml parser and no Apply/Diff command: grep -rn 'world.toml' pkgs/id/src finds nothing; WorldCommand (cli.rs:1388) lacks Apply/Diff.
  • Source: .opencode/plans/phase-12-platform-flexibility.md:31; .opencode/plans/phase-12-platform-flexibility.md:21; .opencode/plans/phase-12-platform-flexibility.md:80
  • Prerequisites: id(world): F11.11 enforce the client projection with a structural test #543 — D1-011 F11.11 One client projection (seed secret, chat by scope) + enforcement test, Define rollback compatibility for world profile journal entries #227 — D1-012 F11.12 Journal format version header, check and backup commands
• D1-022 — F12.4 Capability provider registry (manifested components) (L, design)
  Providers become components with a manifest (name, version, argument schema, bounds, required scope, default ceiling), read by the ledger, compile gate and CLI, so adding a capability needs no edit to world.rs. One of the two highest-return tasks.
  • Status: not started. pkgs/id/src/world_caps.rs:55 pub const CATALOG: &[&str] is a hard-coded list, and execution is a string match in pkgs/id/src/world.rs:2526-2547. No registry type (grep -rn 'ProviderRegistry\|provider_registry' pkgs/id/src finds nothing).
  • Source: .opencode/plans/phase-12-platform-flexibility.md:37; .opencode/plans/phase-12-platform-flexibility.md:16; .opencode/plans/phase-12-platform-flexibility.md:80
  • Prerequisites: id(world): F11.10 split world.rs, world_session.rs and cli.rs (moves only) #540 — D1-010 F11.10 Split world.rs, world_session.rs, cli.rs (moves only), id(world): F11.13 error taxonomy: stable codes plus reasons on the wire #554 — D1-013 F11.13 Error taxonomy: stable codes plus reasons on the wire
• D1-025 — F12.7 Versioned guest ABI spec, plaza_abi_version export, conformance suite (L, design)
  Write the plaza_* exports and capability protocol down as a versioned spec, add a plaza_abi_version export, and publish a conformance suite built on F11.16 fixtures and the feat(id): record world sessions to replayable fixtures #239 recordings. Part of the recommended first slice.
  • Status: not started. The ABI is described only in module docs (pkgs/id/src/sandbox.rs:6-8 lists plaza_out_len, plaza_alloc, memory). grep -rn plaza_abi_version pkgs/id finds nothing, and there is no spec document or conformance test directory.
  • Source: .opencode/plans/phase-12-platform-flexibility.md:43; .opencode/plans/phase-12-platform-flexibility.md:84
  • Prerequisites: id(world): F11.16 replay self-check (id world verify) #544 — D1-016 F11.16 Replay self-check (id world verify)
• D1-021 — F12.3 Roles v2: journaled builder and moderator scopes with audit (M, design)
  Journaled grants for builder (install modules) and moderator (revoke participants) as scope bits, with an audit record for each use; builder never gets network/file/process authority.
  • Status: not started. WorldScopes checks only CHAT/HISTORY/JOIN-style bits (pkgs/id/src/world.rs:201-204); grep -rn 'BUILDER\|MODERATOR' pkgs/id/src finds nothing.
  • Source: .opencode/plans/phase-12-platform-flexibility.md:33; doc/2026-10-17T08-00-00Z_feature_world_roles_directory/
  • Prerequisites: D1-019 F12.1 Declarative world manifest (world.toml) with apply / --dry-run / diff (in this list)
• D1-024 — F12.6 Structured audit log with OpenTelemetry export (L, design)
  A structured audit log of admin actions and provider use, exported via OpenTelemetry, building on F11.7; a test replays the log to the final grants.
  • Status: not started. grep -rn 'opentelemetry\|OpenTelemetry\|audit' pkgs/id/src/world*.rs finds nothing. Prerequisite F11.7 has not started (D1-007).
  • Source: .opencode/plans/phase-12-platform-flexibility.md:39
  • Prerequisites: id(world): F11.7 host metrics, Prometheus endpoint and tracing spans #553 — D1-007 F11.7 Host metrics, Prometheus endpoint and tracing spans
• D1-023 — F12.5 First new providers: kv, blob, http.fetch, notify (XL, design)
  A bounded durable per-world KV store, content-addressed blobs over iroh-blobs, allowlisted http.fetch (off by default, no off-list redirects), and rate-limited notify. Each needs a ceiling, an audit entry, and bound, refusal and replay tests.
  • Status: not started. None of kv/blob/http.fetch/notify appears in CATALOG (pkgs/id/src/world_caps.rs:55-73) or in the dispatch match (world.rs:2526-2547).
  • Source: .opencode/plans/phase-12-platform-flexibility.md:38; .opencode/plans/phase-12-platform-flexibility.md:85
  • Prerequisites: D1-022 F12.4 Capability provider registry (manifested components) (in this list), D1-024 F12.6 Structured audit log with OpenTelemetry export (in this list)
• D1-026 — F12.8 Rust and TypeScript/Zig guest SDKs; WIT/component-model decision (XL, research package)
  SDKs for Rust (wasm32-unknown-unknown) and AssemblyScript or Zig with screen/json/grid/cap helpers equal to the Roc libraries, each with an example world and a passing conformance run. Record a decision on the Wasm component model / WIT.
  • Status: not started. No sdk directory (ls pkgs/id/sdk pkgs/id/sdks: no such directory); all eight examples are Roc (pkgs/id/examples/{lounge,roc-chat,roc-counter,roc-grid,roc-screen,roc-world,territory,tic-tac-toe}).
  • Source: .opencode/plans/phase-12-platform-flexibility.md:44; .opencode/plans/phase-12-platform-flexibility.md:17
  • Prerequisites: D1-025 F12.7 Versioned guest ABI spec, plaza_abi_version export, conformance suite (in this list)
• D1-027 — F12.9 Program upgrade with state migration and rollback (L, design)
  Versioned snapshots and an optional migrate export; an upgrade runs on a probe instance, commits only if migrated state round-trips, otherwise rolls back.
  • Status: not started. Install swaps the program and resets state handling (pkgs/id/src/world.rs:3168-3180); grep -rn '"migrate"\|fn migrate' pkgs/id/src/world*.rs pkgs/id/src/sandbox.rs finds nothing.
  • Source: .opencode/plans/phase-12-platform-flexibility.md:45
  • Prerequisites: D1-025 F12.7 Versioned guest ABI spec, plaza_abi_version export, conformance suite (in this list)
• D1-028 — F12.10 Fair cross-world scheduling, per-account quotas, slow-client back-pressure (L, design)
  A hub scheduler that shares fuel/CPU fairly across worlds, with per-account quotas (worlds, storage, fuel/s) and back-pressure; exit: a spinning world cannot raise another's p99 by more than 10%.
  • Status: not started. pkgs/id/src/world_hub.rs bounds only sessions and open worlds (:12); grep -n 'quota\|fair\|fuel_per_sec' pkgs/id/src/world_hub.rs pkgs/id/src/sandbox.rs finds nothing. F11.7/F11.8 prerequisites are not started.
  • Source: .opencode/plans/phase-12-platform-flexibility.md:49
  • Prerequisites: id(world): F11.7 host metrics, Prometheus endpoint and tracing spans #553 — D1-007 F11.7 Host metrics, Prometheus endpoint and tracing spans, id(ci): F11.8 benchmark harness with committed baselines #539 — D1-008 F11.8 Benchmark harness with committed baselines
• D1-032 — F12.14 Portals: cross-world messaging granted by both admins (L, design)
  A capability both worlds' admins grant, with bounded rate and size and an audit entry on each side.
  • Status: not started. Only host-level cross-world write toggles exist (CrossWorldWrite/ForceCrossWorldWrite in the WorldCommand enum, cli.rs:1388); there is no guest-visible portal capability in CATALOG (world_caps.rs:55-73).
  • Source: .opencode/plans/phase-12-platform-flexibility.md:56; doc/2026-10-10T04-59-57Z_feature_cross_world_access/
  • Prerequisites: D1-022 F12.4 Capability provider registry (manifested components) (in this list), D1-024 F12.6 Structured audit log with OpenTelemetry export (in this list)
• D1-035 — F12.17 Module signature trust list and compiler-version provenance (M, design)
  Verify module signatures against an admin trust list, add the compiler version to observed provenance, journal the trust decision; an unsigned module is refused when the list is non-empty.
  • Status: not started. Observed provenance exists (ModuleProvenance fields at pkgs/id/src/world.rs:299, :527, :586), but world.rs:310 states it is "not a signature or a trust attestation"; there is no trust list. The plan cites PR feat(id): record world module build provenance #225, which is CLOSED; provenance reached main another way.
  • Source: .opencode/plans/phase-12-platform-flexibility.md:65; doc/2026-10-16T09-00-00Z_feature_world_module_provenance/; doc/2026-10-16T09-30-00Z_feature_world_module_provenance/
  • Prerequisites: id(roc): F11.18 pin the Roc compiler for checked-in example modules and rebuild them in CI #541 — D1-018 F11.18 Pinned Roc compiler for checked-in example modules + CI rebuild job

Source

• .opencode/plans/phase-12-platform-flexibility.md:16
• .opencode/plans/phase-12-platform-flexibility.md:17
• .opencode/plans/phase-12-platform-flexibility.md:21
• .opencode/plans/phase-12-platform-flexibility.md:31
• .opencode/plans/phase-12-platform-flexibility.md:33
• .opencode/plans/phase-12-platform-flexibility.md:37
• .opencode/plans/phase-12-platform-flexibility.md:38
• .opencode/plans/phase-12-platform-flexibility.md:39
• .opencode/plans/phase-12-platform-flexibility.md:43
• .opencode/plans/phase-12-platform-flexibility.md:44
• .opencode/plans/phase-12-platform-flexibility.md:45
• .opencode/plans/phase-12-platform-flexibility.md:49
• .opencode/plans/phase-12-platform-flexibility.md:56
• .opencode/plans/phase-12-platform-flexibility.md:65
• .opencode/plans/phase-12-platform-flexibility.md:80
• .opencode/plans/phase-12-platform-flexibility.md:84
• .opencode/plans/phase-12-platform-flexibility.md:85
• doc/2026-10-10T04-59-57Z_feature_cross_world_access/
• doc/2026-10-16T09-00-00Z_feature_world_module_provenance/
• doc/2026-10-16T09-30-00Z_feature_world_module_provenance/
• doc/2026-10-17T08-00-00Z_feature_world_roles_directory/

Size

XL overall (items M to XL)

Prerequisites

Listed per item above.

Acceptance criteria

• Every item listed above has its design (or research package, where marked) committed to the repo
• Every item has a linked implementation issue, and its checkbox above is ticked only once both are true
• No item is closed out on the basis of a plan or report reference alone — the committed artifact is the evidence