ENV and UOP execution planes

ENV and UOP are separate executable decision planes. ENV selects the current Codex context and eligible route; UOP independently authorizes operators, formulas, budgets, effects, privacy boundaries, fallback, and human gates.

Current counts are derived release facts, not permanent ceilings.

Full cross-plane route

flowchart LR
    Entry["Entry Slip + exact source identity"] --> Context["Current host / workspace / project / Delta"]
    Context --> ENV["ENV selection"]
    ENV --> Host["Host + locality + capability grants"]
    ENV --> Mode["Mode + project recipe + 18-lane classification"]
    ENV --> Provider["CPU / eligible NVIDIA / AMD provider"]
    Mode --> Join["Cross-plane decision"]
    Host --> Join
    Provider --> Join
    Context --> UOP["UOP governance"]
    UOP --> Operators["110 PCM/MBA activations + 14 public operators"]
    UOP --> Formula["State + gates + operator tensor + validator"]
    UOP --> Gates["Permission / privacy / disclosure / HIL / budget"]
    Operators --> Join
    Formula --> Join
    Gates --> Join
    Join --> SDK["Typed internal SDK owner"] --> Route["Lane + authority + condition-true tools"]
    Route --> Validate["Schema + effect + receipt validation"]
    Validate --> Pass["Bounded result and next eligible state"]
    Validate -. mismatch .-> Fail["Fail closed with no authority effect"]

Adapted working behavior, not imported host authority

The current action plane records 25 ENV behavior groups / 275 nodes / 256 edges and 8 UOP behavior groups / 80 nodes / 57 edges. The original working topology is preserved as content-addressed reference evidence, then mapped to current Codex owners.

ChatGPT host identity, historical active state, old project templates, old command authority, and predecessor databases are not imported as executable authority. Deferred project-template and successor-root behavior remains queryable but cannot execute until its current owner and preconditions exist.

ENV working behavior groups

ENV formula components

ENV currently contains 110 PCM/MBA operators and the same number of exact activation rules. Registration is not execution: an operator fires only when its declared trigger, lane, action phase, effect, tool route, and budget match the compiled formula receipt.

Mode and lane selection

The imported working catalog contains 14 mode clusters, 17 namespaces, 4 combination rules, 18 working lane classifications, and 6 formula-driven lane routes. These classifications are mapped into the current canonical 18-sector registry; they do not create extra project lanes.

UOP working behavior groups

Current UOP public operators

Delta and human-decision boundaries

UOP preserves additive Delta history, visible warnings, and explicit supersession. AUTO_ACCEPTED_DELTA_ROW_WORK and AUTO_ACCEPTED_DELTA_LEARNING are admitted only at verified Delta exit and can feed the next Delta entry. Neither has an individual HIL, Project Overlay effect, or accepted-ZIP effect.

Full-PV Project HIL and consolidated Learning HIL remain separate human decisions. Only exact accepted Project Truth can move the Project pointer, create the Project Overlay, and rotate the one accepted root ZIP. Learning approval moves only its own pointer.

Cross-plane parity

MCP never bypasses the internal SDK, the outer SDK owns no business logic, tool presence is not permission, and hooks are not required for explicit actions. ENV and UOP remain separate authorities throughout the route.

Source-bound workflow map

This page is projected from the same current executable snapshot as the rest of the documentation set. The map is deliberately two-directional: each horizontal district shows peer stages while vertical edges show ownership and state progression.

flowchart TB
    subgraph InputDistrict["Input and classification"]
      direction LR
      A["Entry Slip plus current host and project context"] --> B["ENV context, mode, lane, locality and provider selection"] --> C["UOP operator, formula, budget and permission decision"]
    end
    subgraph ExecutionDistrict["Selection and execution"]
      direction TB
      D["Typed action and internal SDK owner"] --> E["Condition-true lane, authority and tool route"] --> F["Cross-plane effect and receipt validation"]
    end
    subgraph EvidenceDistrict["Evidence and outcome"]
      direction LR
      G["Bounded execution receipt"] --> H["Delta continuation, explicit HIL, or fail-closed result"]
      G -. mismatch .-> I["Never import ChatGPT host identity or merge ENV with UOP"]
    end
    C --> D
    F --> G

Contract and readback

Canonical source owners

• toolchains/env-domain-catalog.v2.json
• toolchains/uop-domain-catalog.v2.json
• sdk/env_uop/cross-plane-contract.v1.json

Exact backend readback

Cross-surface invariants

• The current snapshot contains 91 public actions, 26 skills, 11 hook events / 44 handlers, 119 tool requirements, 18 sector lanes, and 11 named authorities. These are derived counts, not fixed ceilings.
• Executable ownership stays one-way: skills select, MCP exposes, the outer SDK routes, the internal SDK executes, ENV selects, UOP governs, tools perform bounded work, hooks emit receipts, and the owning authority validates effects.
• Any missing identity, schema, grant, capability, dependency, receipt, or authority proof must fail closed at its owning phase; a later green check cannot retroactively authorize the skipped boundary.
• A changed route refreshes every dependent schema, manifest, generator, test, diagram, and documentation reference; the superseded executable route is directly purged in the same Delta.
• Tests, Git, CI, installation, restart, deployment, discussion, or a rendered page never imply Project HIL, Learning HIL, Goal completion, or pointer movement.

This page is a Git-tracked documentation projection. Executable source, SQLite authorities, installed-runtime receipts, and explicit human gates remain the governing evidence.