[deku2026]

Summary

This PR records the product owner's decision of 2026-10-28, given in reply to AD-0021's open questions. It adds AD-0021 §13a.

• Official hosted center. Center-mediated node connectivity, execution, monitoring and control, and MCP access are subscription services. There is no permanent free hosted-node allowance at this stage. Essential sign-in, account, billing, security and recovery operations stay available without a subscription.
• Self-hosting. Free use remains available through self-hosting, which never requires an official subscription.
• Self-hosted mode. This mode is explicitly configured. A built-in default enables the self-hostable capabilities that are available, and the operator can optionally configure feature and resource limits. External services still need the operator's own configuration and credentials.
• Fail closed. The center mode is explicit. In official-hosted mode, missing or invalid configuration never silently enables every feature.
• No bypass. Feature availability never bypasses authentication, device ownership, authorization, AGENT/HUMAN separation, audit or resource controls.
• Values are configuration. Development fixtures stay separate from production settings. Exact prices, trials, node limits and traffic allowances remain open (H-07), and no production sales are activated.

The PR also makes these changes:

• AD-0021's "Open questions" are updated: question 1 is partly decided and question 2 is decided.
• New requirement R-CTR-017 with its traceability: AF-CTR-02/03/05/07 and AF-CLD-03, matching companion Plan PR plan/center-subscription-modes.
• Amendment notes in the product definition §5 and chapter 14 are updated.

Verification

• check_design.py --require-protoc --plan <companion Plan branch>: 0 errors.
• Tool tests: 47 OK.
• Host statuses come from python eng/verify.py run-and-report.

---

Generated by Claude Code

[deku2026]

Independent review record

The reviewer did not author either PR. They reviewed this PR together with Plan #74 through the MCP hosts, against the owner's reply of 2026-10-28 (quoted verbatim in the review brief).

Round 1 at ffb9a15: approved, with non-blocking findings N-1 to N-4 and N-7.

• N-1: the enrollment-versus-connectivity split, and what happens when a subscription lapses, were not stated in the Design.
• N-2: AD-0021 §13 contradicted §13a.
• N-3: the R-COM note was stale.
• N-4: no feature keys were defined.
• N-7: the byte-order evidence citation was missing.

The reviewer confirmed the PR captures the owner's words without overreach:

• no price, trial, limit or traffic value is invented;
• H-07 stays open for those values;
• no sales are activated.

Round 2 at 4d871f2: approved. All findings are resolved:

• §13a now records ungated enrollment, and closing a lapsed node's connection at the next entitlement check.
• The feature keys are defined: center.nodes, center.execute, remote.view, remote.control, center.mcp and push.
• §13 and §17 reference §13a.
• The §11 entitlement-change row matches §13a.
• The §10 byte-order rule cites Contracts #117.
• The R-COM note points to §13a.
• The traceability for R-CTR-017 includes AF-ID-02, AF-COM-01 and AF-CLD-04.

The two optional nits carry into the task briefs:

• a test that a lapse closes an existing connection (AF-CTR-05);
• which key gates routed cancel and retry (AF-CTR-03).

Checks the reviewer re-ran on each head:

• plan.py validate --design: 0 errors.
• check_design.py --require-protoc --plan: 0 errors.

Host statuses at 4d871f2:

• arcforges/windows: 3 steps in 14 s.
• arcforges/linux: 3 steps in 41 s.

---

Generated by Claude Code