C4: retire active Carrier governance from direct Dev MCP operations #471

Goal

C4 after C1 (#431), C2 (#449), C3 (#447): retire CarrierBindingStore / ControlPlaneConsumer as admission for new Dev MCP-native cutover and direct dependency_sync operations, while preserving fail-closed historical coordination-bound recovery. DevSpace remains the local execution layer, not Nexus governance.

Fresh baseline

GitHub main at issue creation: 5c008b0b7aca3dbe8b83e192036dabf7ae001d46 (verify again before implementation). Running primary Dev M5 currently 668f5df6a84bed09f0c8d8e4f715676cf182a64d: runtime is healthy/converged to its accepted release but behind main. PR #464 / Issue #462 added a real Carrier-bound terminal cutover CLI; do not remove that historical recovery path as dead code. Open PR #412 (#407) is the older carrier-expansion direction; reconcile before any integration.

Bounded work / sequence

1. Cutover direct path. New MCP cutover_start must create a durable direct/unbound cutover without a paired Carrier or injected coordination reader, using existing McpCutoverController, cutover file, durable operation identity and restart/finish safety. Never downgrade an existing coordination-bound generation/operation to unbound. Preserve exact durable correlation and lost-ACK same-effect readback.
2. Dependency sync. Existing single-conversation checkout and managed isolated worktree can invoke dependency_sync under existing workspace conversation/collision/path checks without Carrier authority. Preserve frozen lock/spec hash, Git base revision, attemptKey/replay conflict, terminal witness and outcome_unknown non-replay rules; do not widen shared-checkout admission.
3. Active wiring. Retire default Carrier/ControlPlane creation on ordinary new execution. Compatibility readers may be loaded only when an actual historical bound record needs recovery/terminalization; no new policy owner, coordinator, database or generic abstraction.
4. CLI/migration boundary. After direct lifecycle and real live canary, remove/deprecate normal-path carrier and --coordination-reader-* governance entrypoints. Preserve genuinely needed authenticated historical bound cutover recovery including the new finish-bound path from PR feat(cutover): add carrier-bound finish-bound CLI for drained generations (#462) #464, and do not break owner sidecar before its active callers migrate. Separate follow-up gate if external owner-sidecar consumer cannot be safely switched in the same patch.
5. Proof: deterministic RED (unpaired new cutover and non-managed direct sync fail on old main), GREEN on same inputs; old bound persisted cutover/recovery must still fail closed for unbound/mismatched caller and close with exact carrier identity; crash/lost-ACK/double start, stale source/build/manifest, restart and exact workspace/agent witness negatives; tests for affected CLI/MCP/protocol/durable boundaries, typecheck/build and exact-head CI. Final closeout only after independent review, merge and canonical install/activated build/runtime and tool projection readback.

Non-goals

No Nexus/Core governance, admission, model routing, acceptance, policy, extra controller or migration history rewrite. Do not delete historical DB tables, bound receipts/leases, chat-swarm-carrier.ts, authority_mode, withInstalledNexusCertifyOnPath(), or general provider/process/workspace safety. Do not force merge or active service restart when no exact approved artifact/build-readiness evidence exists.

Expected scope and next gate

Prefer small, independently reviewable Candidates: (A) direct cutover/dependency behavior; (B) active wiring/CLI migration once consumers are proven; (C) exact-head validation and live deployment canary. Collision checks before effects and after worker terminal. Unknown external sidecar dependencies remain explicitly blocked, not silently deleted.

In-progress C4 Candidate status — 2026-10-09 (Asia/Taipei)

NOT COMPLETE / NO AUTOMATIC CHAIN. Source-only change in managed isolated worktree ws_56dddadc8a, physical root /Users/james/.devspace/worktrees/devspace-fe76971e, exact base 5c008b0b7aca3dbe8b83e192036dabf7ae001d46. Source edits are currently uncommitted; no PR, merge, activation, or deployment was attempted for this Candidate.

• Implemented and tested OWNER_DIRECT durable new cutover_start, exact directOperation request correlation and lost-ACK no-retry reconciliation, direct frozen dependency sync for managed isolated worktrees and single-conversation checkout, and shared-checkout admission rejection.
• Default Carrier/ControlPlane store instantiation is now gated by actual historical persisted bound operations or explicitly supplied legacy reader bindings. Historic bound cutover/restart/finish and CLI authority recovery remain fail-closed; current no-longer-primary CLI/docs wording was marked legacy.
• Verified before last documentation/negative-test edits: C4 MCP 2/2, server 68/68, server-ci 75/75, Carrier 51/51, ControlPlane 28/28, cutover-state 32/32, durable 16/16, typecheck and build green; additional direct-lost-ACK, binding-tamper and forged-witness negative cases green. The single npm test command hit its 300-second execution limit after passing the earlier chain; omitted tail groups were run in two chunks and passed. One unrelated PTY timing race failed once under concurrent test load and passed focused + serial rerun; node-pty spawn-helper execute mode was repaired using the repository's existing postinstall script.
• Final post-test change: an additional negative test to prove historical Carrier-bound generation cannot be silently downgraded to OWNER_DIRECT; legacy CLI/docs description update; one unused server parameter removed. These final edits still require typecheck, focused tests, full diff check and exact-head readback.
• Blocking concurrent live action: Dev M5 primary runtime at 668f5df6a84bed09f0c8d8e4f715676cf182a64d is in another Carrier-bound cutover 8eaa5969-80b6-44de-877b-400abf011173, phase drained, aiming at 5c008b0b7aca3dbe8b83e192036dabf7ae001d46. This is not C4's cutover. Host correctly returns CUTOVER_RECONCILIATION_REQUIRED on consequential commands. Do not bypass, restart, rebind, or finish that owner-held lease from C4.
• Next gate: authorized owner must terminally reconcile the existing cutover; rebind live runtime/main/worktree identity, then finish final source validation and immutable Candidate commit. Separate independent review/issue-check/integration and exact accepted deploy/canary remain pending. Standalone nexus-certify executable was not found on this Mac's known PATH locations; do not claim Issue-bound completion without it.

2026-10-09 C4 published Candidate gate

Committed and pushed exact C4 Candidate 67c674fa11f47c98e6b172620830439ee85bee9c (tree 8d8e439658f17cf3dd3963228a5768258815ee79, base 5c008b0b7aca3dbe8b83e192036dabf7ae001d46) on branch c4-retire-carrier-governance-471; opened PR #478. Verified build, typecheck, durable 17/17, server-ci 75/75, Carrier 51/51, ControlPlane 28/28, cutover state 32/32, MCP cutover 16/16, CLI 5/5; source tree clean after commit. Original separate bound cutover 8eaa5969-80b6-44de-877b-400abf011173 is CLOSED; live authoritative primary runtime converged at main 5c008b0b…, not Candidate. Independent review is NOT complete: Claude/HerdR reviewer agt_7674682f failed to launch (provider disabled), Gemini reviewer agt_5d2b340c timed out at its 180-second cap with no terminal semantic verdict. Do NOT infer acceptance from either attempt. Exact-head independent review/Core issue-check/required CI, PR merge, release and live C4 canary remain pending. Issue remains open.