Agent operations acceptance

Status: planned. The roadmap owns each slice's deliverable, order and entry conditions; this document owns its acceptance. Test each item at the lowest useful boundary (testing policy): schema and contract tests for operations, Node service tests with real SQLite and deterministic clocks, IDs and worker layers for state, and built-CLI tests for the CLI path.

Every slice

• A person's change previews, confirms and leaves a receipt; a stale revision or a different input digest changes nothing; an agent's confirmation gets role_denied.
• Agent writes, such as follow-up tasks and dataset rows, stay within grants and caps.
• The CLI path passes before any client view of the same operation.
• No slice adds a dependency or service without owner approval.

Per slice

• S53 Tasks. A task that would block itself or an ancestor is refused; a link to a task outside the actor's scope is refused; the owner wakes exactly once when its last child settles, including when two children settle at once and across a Node restart; closing a parent with open children needs their exact IDs; a Routine run's task tree matches its Run ledger.
• S54 Workspace goals and rules. A Project rule never removes a Workspace rule; on conflict the Workspace rule applies and the Session context names both; each turn reads the rule revision current at its start; a goal roll-up counts only linked tasks the reader may see; an agent's goal or rule change previews and its confirmation gets role_denied.
• S55 Budgets. Concurrent reservations never exceed a scope's limit, because each reservation is atomic; a run whose reservation fails does not start; usage that cannot be measured counts at its reserved amount and stays marked unknown (budget reservation contract); the warning fires once at its threshold; at the limit new work holds and running work stops at its next turn edge; a restart reconciles open reservations with settled usage.
• S56 Tracing. One trace ID links the client request, Node operation, Session, turn, tool call and model call; context inspect for a turn shows that turn's sources and token counts; OTLP export sends nothing until its egress is approved, and masked values never leave.
• S57 Required gateway. With a required gateway, a Session on any other Connection fails with a typed error for every harness; a launch carries no competing key, subscription token or vendor login; a gateway without the harness's wire protocol fails connection test; the sandbox reaches only the gateway host; lifting the requirement needs a person's confirmation.
• S58 Server setup. The release comes from its channel by digest; a changed host key stops every command; an enrolled Node reconnects after a dropped link with capped backoff; a failed probe lists every failing check.
• S59 Fleet view. maia node list shows each Node, Execution Node and live worker with its heartbeat age; a missing heartbeat shows as stale, never healthy; an agent sees only Nodes and workers within its grants.
• S60 Agent reliability. A fallback happens only before output (D-023); the next harness gets the original request and every person's turn or a reference to it, masked; resume after a Node restart repeats no effect; coalesced wakes start one run; the work-in-progress cap holds under concurrent dispatch; a stuck task reaches the attention inbox (R8) once.
• S61 GitHub. An agent without a grant gets no token, and a token minted for one repository is refused on another; no worker launch carries a person's gh or Git credentials; a Node with no public route still receives changes by polling; a revoked grant stops the next GitHub call; a write to a protected path without its own grant is refused before any API call; an ungranted write, merge included, asks a person; a granted merge is refused once its grant is revoked, when the head changed since the checks passed, or when branch protection fails; the merge feed attributes each merged pull request to its task and runs; with a grant for one tool, a raw sandbox push, API write or protected-path push is refused and reaches no GitHub endpoint.
• S62 Evals and datasets. An eval run records its rubric revision, model and call statistics; a dataset append outside the agent's grant is refused; a JSONL export matches its snapshot digest.
• S63 Templates and backups. A template preview lists every Agent and Routine it adds, and a rejected preview adds nothing; a backup restored into a fresh home yields the same state digest; restore refuses a newer schema.
• S64 Web workflow tools. CLI filters return the same rows as the SDK read; when the editor ships (Later), its graph equals the Routine's after list and saving an edited graph is a previewed Routine revision.
• S65 Run control. A wake that starts nothing records its reason; work for an Agent that cannot run is refused with a typed reason; a run at its token, context or turn cap compacts or restarts as configured and never continues past it; the quota governor keeps each Connection under its window and staggers starts; every content read and live projection is masked by S12t, and no trace field holds a held key value or a key-, token- or PEM-shaped string.
• S66 Session move and sleep. A move happens only between turns and keeps the native session and the worktree digest; an interrupted move leaves the Session on exactly one Node; a sleeping Session resumes on its next turn with no lost item. A Session moved from a person's computer to a server and back resumes on each with no lost item, per qualified harness; a move to a Node without the Session's harness version or Connection is refused at preview (D-174).
• S68 Datasets to custom models. A dataset row without a confirmed policy, or with an unmasked secret, is refused; a tuning job never starts outside its budget; a tuned model that does not beat its base on its admission evals cannot be admitted; a rollback restores the previous model pin.
• S70 Pause and resume. As in pause and resume.
• S71 Tool connections. A tool server whose digest differs from its admission is not started; a tool the Agent was not granted is refused before the call; an ask tool waits for one approval; no credential or answered secret appears in model context, transcripts or receipts; each call leaves one receipt; a vendor tool server in the harness configuration never starts.
• S72 Notifications. A notification carries no confirmation control and its link opens the trusted screen for the exact item; a reply in a channel never confirms; an unpaired or unconfirmed channel account reaches no person or agent; quiet hours delay all but the person's chosen urgent kinds; a failed delivery retries with the same notification ID and is receipted once.
• S73 Extensions. As in extensions.
• S74 Alerts. A breach raises exactly one attention item until it clears; fixtures with reused Sessions, delayed dispatch and a failed launch count every execution attempt; a threshold change previews and confirms; an agent cannot change or silence a threshold; on recorded fixture days with known counts, failure rate by cause, queue wait and wake-to-start match the expected values; S61b qualifies its runs per merge view on the same fixtures.
• S75 Import. The preview lists every source item and confirming creates exactly those, with Routines disabled; a second run creates nothing new; no secret or credential value is read or stored; before S48 and S54 ship, the preview lists goals as skipped and confirming creates none; an open-task round trip (import, tasks created after cutover, export back) loses and duplicates none.