What has been completed

The released core consists of one Rust MCP server, one execution Runtime, and ten public tools. Together they let an authenticated agent create an exact Git workspace, inspect and mutate files, review the resulting diff, execute host commands, observe or cancel long-running work, list durable Jobs, read retained Artifacts, and remove completed workspaces.

The active execution path is deliberately small:

Agent reasoning → Ordivon durable execution → observable result → recovery or continuation.

Under that path, SQLite owns Job and Attempt truth, systemd and cgroups own the process tree, bounded files own stdout, stderr, results, and Artifact bytes, and Git continues to own repository history and rollback.

The important change was subtraction

Ordivon did not arrive here by adding another layer to the earlier architecture. It arrived by replacing a broad governance platform with the narrow Runtime that real agent work required.

The earlier direction contained policy objects, registries, proof structures, document systems, specialized adapters, and multiple forms of predeclared control. Many of those mechanisms were defensible from a classical software-governance perspective. They were also expensive in an agentic workflow: they duplicated facts already owned by Git or the host, increased context, created more states to reconcile, and often blocked ordinary reversible work without improving recovery.

The simplified Runtime keeps mechanisms only when they preserve reality or provide causal feedback. That means process identity, cancellation intent, terminal results, bounded output, Artifact identity, and restart reconciliation remain. Reconstructable metadata and ceremonial governance do not.

A new division of responsibility

The current system rests on a sharper responsibility split:

  • The user owns intent. Objectives, preferences, risk posture, and final commitments remain human responsibilities.
  • The agent owns implementation and operation. It reasons, chooses tools, edits code, runs tests, repairs failures, and adapts to observations.
  • The Runtime owns durable execution truth. It identifies the request, owns the process tree, records terminal reality, exposes Artifacts, and recovers after interruption.

This is not an attempt to make the Runtime intelligent. It is an attempt to let increasingly intelligent agents operate without losing the execution facts that matter.

The ten-tool surface

The public protocol now contains exactly ten tools:

  1. workspace.open — create an isolated workspace at an exact Git revision;
  2. workspace.close — remove a completed workspace and its record;
  3. workspace.read — read bounded full or sliced UTF-8 content;
  4. workspace.mutate — apply validated writes, appends, and exact replacements;
  5. workspace.diff — inspect tracked changes and untracked paths;
  6. workspace.exec — execute one command with durable Job and Attempt identity;
  7. task.observe — observe running or terminal task state;
  8. task.cancel — persist cancellation intent and terminate the owned process tree;
  9. task.list — list Jobs through stable cursor pagination;
  10. artifact.read — read retained Artifact bytes by range and digest-bound identity.

This surface is intentionally narrower than a general desktop-control toolkit. Ordinary host capabilities—Git, Docker, systemd, cloud CLIs, package managers, browsers, and language toolchains—remain available through workspace.exec instead of becoming bespoke Ordivon abstractions.

What the protocol dogfood proved

The final acceptance run called all ten tools through the production MCP path. Every positive path passed:

  • an exact repository revision opened and later closed cleanly;
  • full and sliced reads preserved a stable file digest;
  • write, append, and exact replacement mutations advanced revision digests correctly;
  • the diff exposed an untracked probe without inventing tracked changes;
  • synchronous execution returned compact Artifact descriptors directly;
  • a running process transitioned predictably from working to cancelled;
  • task pagination advanced through a stable cursor;
  • Artifact range reads returned consistent bytes and digest identity;
  • workspace cleanup left no accessible test workspace behind.

The negative boundaries also failed closed:

  • a stale mutation digest returned REVISION_MISMATCH;
  • reusing one client request identity for a different command returned IDEMPOTENCY_CONFLICT;
  • pairing an Artifact with the wrong Job returned ARTIFACT_IDENTITY_CONFLICT;
  • access after cleanup returned WORKSPACE_NOT_FOUND.

The same request identity and identical execution request also returned the same Job and Attempt rather than dispatching duplicate work.

What Ordivon deliberately is not

The core release is easier to understand through its negative boundary. Ordivon is not an agent loop, governance operating system, policy platform, document knowledge base, cloud scheduler, multi-tenant control plane, or user interface.

It does not prebuild a GitHub platform, Docker platform, browser platform, memory system, skill registry, or scheduler around the agent. A dedicated capability should be added only after repeated real tasks demonstrate that ordinary command execution cannot provide the required semantics.

Three engineering defaults survived the redesign

  1. Thin active context. Source, tests, Git, live state, and a few current documents should provide the working mental model.
  2. Thin recovery. Git restores code; Ordivon preserves only execution facts that cannot be reconstructed reliably.
  3. Reallocated responsibility. Human intent, agent operation, and Runtime execution truth remain separate.

These defaults are not aesthetic minimalism. They reduce the amount of stale or contradictory state the agent must interpret and keep the system focused on facts with operational consequences.

Core complete does not mean operations finished

The implementation and protocol boundary are complete enough to close the M0–M7 construction line. Production adoption remains an observable operational task: the installed Rust MCP must carry real Ordivon engineering and research work; backup and restore must preserve the minimal Registry; and the production Cloudflare route must remain recoverable with the old bridge available only as rollback.

This distinction matters. The next phase should not add breadth because the core has been released. It should use the Runtime, measure where the agent still falls back to older tools or manual intervention, and remove any state or helper that real recovery does not justify.

What comes next

Ordivon now grows by observed failure rather than roadmap imagination. Real engineering and research tasks will determine whether a missing operation deserves a new primitive. Until that evidence exists, the mature host toolchain remains the extension surface.

The release is therefore both a completion and a constraint: the thin core exists, the ten tools have been exercised, and future complexity must earn its place through repeated use.