Correct foundation truth states and codify harness-independent boundaries

[levineam]

Goal

Update draft PR #257 without widening it into runtime implementation. Correct repository/specification truth states and make the minimum harness-independent product boundaries explicit.

Contract

• Draft PR work is never labeled canonical or repository-shipped.
• jarvOS has no load-bearing harness.
• Active Assistant is a jarvOS-owned service boundary.
• Native sessions remain harness-owned; portable conversation identity, mappings, and receipts remain jarvOS-owned.
• Capability claims use explicit evidence-bearing truth states.

Done criteria

• capability-ledger.json accurately reflects draft PR/repository state.
• Architecture docs name runtime modes, ownership boundaries, compatibility-read direction, and tiered conformance without claiming unimplemented runtime behavior.
• Tests and docs checks pass.
• Independent branch review finds no P0-P2 compatibility risk.

Constraints

No activation, migration, process changes, Vault writes, or live capability claims. Keep implementation work in follow-up PRs. Coordination: levineam/clawd#1249.

[levineam]

Implementation pushed to draft PR #257 at 34192f11dbc24c0ee262cc30ba98593781b2d442. Ledger truth states now read draft / draft-pr, architecture boundaries are explicit, and regression checks reject canonical/shipped claims for draft work. Focused suites pass (141 control-plane, 29 foundation, 5 docs); remote CI unit/smoke/lint/meta/secret jobs pass. A separate Luna/max exact-head review is now running before any ready/merge decision. Local full-suite note: one unrelated Hermes Python fixture lacks PyYAML, while the remote full unit job passes.

[levineam]

Independent Luna/max exact-head review: HOLD pending four corrections.

• P2: candidate contract calls the envelope immutable but returns the original mutable object; deep-freeze/clone or narrow the claim.
• P2: sparse arrays bypass forEach validation in candidate sources, promotion receipt arrays, and capability-ledger arrays. Add fail-closed regressions and validation.
• P2: the foundation plan still says canonical / local-only, contradicting the corrected draft / draft-pr state.
• P3: “active pipeline” wording overstates fixture-only foundation behavior.

No P0/P1 findings. Runtime impact remains low/additive, but PR stays draft until fixes and rereview.

[levineam]

Independent Luna/max rereview of exact head 7603ae6: all four prior findings resolved; no new P0-P2 findings. Focused 65, smoke 66/66, diff check, and all remote checks pass. Runtime impact remains additive/I/O-free. P3 advisory only for exotic non-JSON prototype/non-enumerable objects. Recommendation: MERGE after the planned #252-first ordering, then follow with the normal ledger lifecycle update from draft-pr to merged repository state.

[levineam]

Completed by merged PR #257 (03b5263e3b273ea7a3e76581fd73c6059fd90ada) after independent review/fix/rereview. The foundation is harness-independent, Active Assistant/session ownership boundaries are explicit, validators are fail-closed for sparse arrays and immutable candidates, and no runtime activation or I/O path was added. Post-merge truth-state lifecycle is tracked separately in #267/PR #269.