[deku2026]

Summary

This PR records the product owner's decisions of 2026-10-27/28 as a new accepted decision, AD-0021, and amends the affected documents so that no current policy conflicts with it.

What the decision says:

• Nodes keep execution authority. User-owned C# nodes (Windows 11, native Linux) still own execution, scheduling, resources, output, recovery, workspaces, caches and SQLite.

• Ordinary use goes through a configured center, which can be official or self-hosted:

  • clients use the center's business API;
  • cloud AI uses the center's MCP endpoint;
  • local AI uses the stdio adapter, which forwards to the same center.

  Every call names an explicitly selected node. Nodes connect outbound only. Local IPC stays for management, sign-in, diagnostics and recovery.

• The center is written in Go and stores its data in Neon/PostgreSQL.

  • Migrations are versioned and checksummed, and run with a separate migration role and runtime role.
  • Node connections terminate in the Go center; a per-account Durable Object hub becomes roadmap RM-20.
  • D1 is no longer the store. Production never had a D1 binding.

• Three credential kinds are kept apart: account sessions, node credentials and the new agent grants. AGENT callers never gain HUMAN power and never approve their own requests.

• Data flows (§10) and failure behaviour (§11) are stated explicitly. The center never persists task specifications, output or file contents.

• LAN leaves current delivery.

  • AF-LAN-01/02/03 are superseded and LAN distribution becomes RM-19.
  • AD-0008 and chapter 09 are kept as history.
  • Published peer.v1 contracts stay compatible.

• No pricing, allowance or limit is decided. The promise of account-free, center-free normal operation is withdrawn.

• The C# center is retired after the exit criteria of §15 hold.

Changes in this PR:

• Requirements: a new section R-CTR-001 … R-CTR-016, a disposition note for R-LAN, and amendment notes for R-CLOUD, R-API-002 and R-AI.
• Traceability: model.json maps the R-CTR requirements to the new AF-CTR tasks. Per-requirement task lists are recomputed from the Plan graph of the companion Plan PR.
• Decision status lines amended: AD-0003, AD-0007, AD-0009, AD-0010, AD-0011, AD-0015. AD-0008 is superseded for current delivery. The README decision table now includes AD-0021.
• Dated amendment notes that separate target from delivered behaviour, in:
  • architecture 01, 08, 09, 10, 11, 12 and 16;
  • experience/mcp.md and experience/cli.md;
  • data/cloud-store.md, which also gains a new §6 with the PostgreSQL derivation rules;
  • product definition §5.
• Delivery: fuller chapter rewrites follow with each AF-CTR task, as the AD-0021 "Delivery state" section describes.

Verification

• python tools/check_design.py --require-protoc --plan <Plan worktree>/delivery-graph.json: 0 errors (225 methods, 19 state machines). Run on the Linux host against the companion Plan branch plan/central-access-go-center.
• python -m unittest discover -s tests: 47 tests OK.
• The host statuses arcforges/windows and arcforges/linux are reported by python eng/verify.py run-and-report on each host.

Merge order

Merge this PR first. The companion Plan PR's verification validates against Design main.

---

Generated by Claude Code

[deku2026]

Independent review record

An independent reviewer read this PR together with Plan #72. The reviewer did not author either change and worked through the Linux and Windows MCP hosts. The authority was the product owner's migration instruction (C:\MyFile\Projects\ArcForges\ArcForges-Claude-Migration.md) and the Design and Plan rules.

Round 1 (1fe5a4b): changes required. Four findings were blocking:

• D-1: command signing was dropped without a recorded decision.
• D-2: the product definition was only partly amended.
• D-3: chapter 14 had no amendment.
• D-4: several other current-policy documents had no amendment notes.

Non-blocking findings D-5 to D-8 asked for target markers, a split between owner decisions and design choices, a complete Amends list, and the open entitlement questions.

Round 2 (8a39009): approved. Every finding was resolved:

• Routed calls are signed end to end (AD-0021 §10).
• AD-0021 §17 separates the owner's decisions from the design choices made under them, and the bounded run --local is recorded there.
• An "Open questions for the owner" section was added.
• Amendment notes were added to the product definition, chapters 05 and 14, the journeys, the Desktop, Web and Android experience pages, the contracts README, AD-0002, AD-0004 and the state-machine titles.

Round 3 (7f9abd7): approved, with no new findings. N-1 assigns the node key and key exchange to AF-CTR-04 (02 §4, AD-0016, AD-0021 §10). N-6 moves the chapter 05 note to the top.

Checks the reviewer re-ran on each head:

• python tools/plan.py validate --design <this head>: 0 errors.
• python tools/check_design.py --require-protoc --plan <Plan #72 head>: 0 errors, 225 methods, 19 state machines.
• check_design --write produced no diff.

Residual risks recorded for later tasks:

• The hosted Container stays running while any node is connected. This is now stated, metered under AF-PLAT-01, and EX-28 records the alternative.
• Production activation of the center surfaces waits on the owner's decision on plan contents (H-07).
• The MCP specification and OAuth details are re-checked when AF-CTR-07 starts.

Host statuses at 7f9abd7: arcforges/windows passed (3 steps in 15 s) and arcforges/linux passed (3 steps in 39 s).

---

Generated by Claude Code