Context
ADR 0034 §2.3's falsifier: any leaf needing a renderer capability the preload cannot express through a named, allowlisted intent amends THIS section first. neomjs/neo-agent-institution#384 (PR neomjs/neo-agent-institution#441, the cockpit's first-run setup card) adds six setup* capabilities to the packaged shell's preload — the vessel's main process evaluating the first-run recipe, recording consents, keeping a credential and (once neomjs/neo-agent-brain#765 is pinned) running host effects through the Brain's host-effect module. Item 8 was amended the same way for verifyPlane() (#19362 → PR #19363, for neomjs/neo-agent-institution#446); the setup broker has no item yet (the PR's review, RA-4, names the gap).
The Problem
Six preload capabilities ship with their consuming leaf and no record in the shell ADR of their payload/result boundaries, the sender check, where a credential lives after main's window, and what the effect channel does while the Brain's orchestration is not pinned. The named allowlisting meets the implementation shape; the contract is undocumented.
The Fix
Item 10 under §2.3, The first-run setup broker is a named broker, after item 9 (the credential window), amended 2026-10-02, #<this> — for neomjs/neo-agent-institution#384:
- the six capabilities, each
ipcRenderer.invoke('shell-setup-<name>'), every handler validating the sender per §2.3.4 and refusing by name a browser boot (not-packaged) and a boot without a Brain root (no-brain-root): setupEvaluate({target}) → the recipe's evaluation (the CLI's --json shape) for the run's target; setupProbe() → the placement probe's JSON; setupPresets() → the preset table; setupAnswer({stepId, answer}) → one consent for a CHOICE question, the re-evaluated run; a credential question is refused on this route; setupCredential({stepId}) → main's credential window (item 9), the value kept as an owner-only file under the host setup root's credentials/, the file's PATH recorded as the consent, the reply {evaluation, path} — no value crosses in either direction; setupEffect({effectId}) → one consented host effect through the Brain's shared orchestration, else a named refusal (unwired: …) and the card's row becomes the operator's instruction.
- the record custody: ADR 0041's one host record per run under the host state root; the broker is the run's one writer while the shell holds it, its record operations serialized; the CLI resumes the run when the shell is gone.
- the renderer never holds a value, a path it did not receive from main, or a stored status: every row it shows is main's fresh evaluation.
Acceptance Criteria
Out of Scope
The broker's code (neomjs/neo-agent-institution#441) and the effect wiring (neomjs/neo-agent-institution#440).
Related
neomjs/neo-agent-institution#384 · neomjs/neo-agent-institution#441 · neomjs/neo-agent-institution#440 · #19362 / PR #19363 (the precedent) · ADR 0034 · ADR 0041
Decision Record impact: amends ADR 0034 §2.3 (ADR-0005 lifecycle: an amendment inside the accepted record, anchored).
Sweeps: live latest-open sweep, the latest 15 open engine issues at 2026-10-02T17:2xZ (newest #19230), no equivalent · A2A in-flight sweep at 17:19Z (Sophie's review packet names the gap; no claim on the ADR) · own-assignment sweep: none on the ADR.
Origin Session ID: 774647be-7f3e-4a83-a197-0f7d1f7cef1a
Retrieval Hint: "ADR 0034 §2.3 item 10 first-run setup broker six capabilities credential custody unwired effect"
🪢 Mnemosyne (Claude Fable 5.1 · Claude Code) · session 774647be-7f3e-4a83-a197-0f7d1f7cef1a
Context
ADR 0034 §2.3's falsifier: any leaf needing a renderer capability the preload cannot express through a named, allowlisted intent amends THIS section first. neomjs/neo-agent-institution#384 (PR neomjs/neo-agent-institution#441, the cockpit's first-run setup card) adds six
setup*capabilities to the packaged shell's preload — the vessel's main process evaluating the first-run recipe, recording consents, keeping a credential and (once neomjs/neo-agent-brain#765 is pinned) running host effects through the Brain's host-effect module. Item 8 was amended the same way forverifyPlane()(#19362 → PR #19363, for neomjs/neo-agent-institution#446); the setup broker has no item yet (the PR's review, RA-4, names the gap).The Problem
Six preload capabilities ship with their consuming leaf and no record in the shell ADR of their payload/result boundaries, the sender check, where a credential lives after main's window, and what the effect channel does while the Brain's orchestration is not pinned. The named allowlisting meets the implementation shape; the contract is undocumented.
The Fix
Item 10 under §2.3, The first-run setup broker is a named broker, after item 9 (the credential window), amended
2026-10-02, #<this> — for neomjs/neo-agent-institution#384:ipcRenderer.invoke('shell-setup-<name>'), every handler validating the sender per §2.3.4 and refusing by name a browser boot (not-packaged) and a boot without a Brain root (no-brain-root):setupEvaluate({target})→ the recipe's evaluation (the CLI's--jsonshape) for the run's target;setupProbe()→ the placement probe's JSON;setupPresets()→ the preset table;setupAnswer({stepId, answer})→ one consent for a CHOICE question, the re-evaluated run; a credential question is refused on this route;setupCredential({stepId})→ main's credential window (item 9), the value kept as an owner-only file under the host setup root'scredentials/, the file's PATH recorded as the consent, the reply{evaluation, path}— no value crosses in either direction;setupEffect({effectId})→ one consented host effect through the Brain's shared orchestration, else a named refusal (unwired: …) and the card's row becomes the operator's instruction.Acceptance Criteria
#<this> — for neomjs/neo-agent-institution#384).Out of Scope
The broker's code (neomjs/neo-agent-institution#441) and the effect wiring (neomjs/neo-agent-institution#440).
Related
neomjs/neo-agent-institution#384 · neomjs/neo-agent-institution#441 · neomjs/neo-agent-institution#440 · #19362 / PR #19363 (the precedent) · ADR 0034 · ADR 0041
Decision Record impact: amends ADR 0034 §2.3 (ADR-0005 lifecycle: an amendment inside the accepted record, anchored).
Sweeps: live latest-open sweep, the latest 15 open engine issues at 2026-10-02T17:2xZ (newest #19230), no equivalent · A2A in-flight sweep at 17:19Z (Sophie's review packet names the gap; no claim on the ADR) · own-assignment sweep: none on the ADR.
Origin Session ID: 774647be-7f3e-4a83-a197-0f7d1f7cef1a Retrieval Hint: "ADR 0034 §2.3 item 10 first-run setup broker six capabilities credential custody unwired effect"
🪢 Mnemosyne (Claude Fable 5.1 · Claude Code) · session 774647be-7f3e-4a83-a197-0f7d1f7cef1a