ADIP Target Agent

This workspace is the target-local execution plane for Agnostic Distributed Intent-Driven Projection (ADIP).

It proves what a target is, verifies that an incoming package is authentic and intended for that target, establishes runtime closure, activates the embodiment, routes admitted capability calls, emits normalized evidence, and restores prior state when required.

attest target
  -> verify package
  -> guard freshness and replay
  -> establish runtime closure
  -> activate embodiment
  -> dispatch admitted capabilities
  -> collect and sign observations
  -> stop or roll back

Workspace map

• apps/local-agent composes the first local development agent.
• packages/agent-protocol defines commands, events, identities, and correlation contracts.
• packages/target-profile produces attested target facts.
• packages/package-verification validates signatures, recipient, hashes, expiry, replay, and compatibility.
• packages/closure-runner coordinates toolchain, dependency, build, binding, entrypoint, and smoke-invocation closure.
• packages/runtime-supervisor activates, monitors, stops, and restarts embodiments.
• packages/capability-router dispatches only declared semantic operations.
• packages/adapter-host isolates concrete databases, APIs, secret providers, operating systems, and legacy gateways.
• packages/observation-collector normalizes, minimizes, redacts, correlates, and signs evidence.
• packages/rollback-manager restores prior admitted state and cleans incomplete activation.
• adapters contains separately admitted concrete boundary implementations.
• contracts contains language-neutral target-plane contracts and examples.

Safety boundary

The target agent may refuse a package. It may not reinterpret scenario meaning, weaken policy, choose an undeclared binding, or promote its own output. Those decisions remain in the ADIP control plane.

MVP status

The local-agent MVP implements the complete in-memory/local-host vertical slice. See IMPLEMENTATION_PLAN.md for scope, exclusions, phase acceptance criteria, and the end-to-end definition of done.

The local-process boundary uses direct, no-shell process creation and explicit allowlists. It is an application-level governance boundary, not an operating-system sandbox.

Local-agent commands are schema-validated before dispatch. Package artifact values use base64 at that boundary. Adapter registrations and installations are closure-scoped; blocked closure staging is removed before return. Rollback accepts only a known execution handle, requires confirmed termination, derives cleanup scope from retained activation state, and leases shared closure cleanup against concurrent activation. Signed observations omit process stdout and stderr by default.

Verification

npm test

The command validates the original scaffold, type checks the workspace, compiles it, validates JSON Schemas and fixtures, runs phase tests, and exercises the complete receipt chain.