sergstack · sergstack · Sep 2, 2026 · Sep 2, 2026 · Sep 2, 2026
diff --git a/.agents/skills/ai-os-orchestrator/SKILL.md b/.agents/skills/ai-os-orchestrator/SKILL.md
@@ -44,6 +44,76 @@ When the current owner identifies a concrete cross-domain need:
 
 Handoff completion is not goal completion. A prepared contract, identified owner, passing intermediate check, generated artifact, completed slice, or ready-for-review state is only an intermediate milestone unless it satisfies the original goal.
 
+### Native subagent dispatch (pilot)
+
+Owner-approved bounded pilot, dated 2026-09-02, governed by
+`ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md`
+("Supervised AI-OS Subagent Dispatch"). It is not a standard workflow and
+does not generalize. This subsection adds a dispatch mechanism to step 2 of the
+canonical loop above; it does not add a second router, state machine, or
+execution record.
+
+Preconditions for one dispatched slice:
+
+- routing has already resolved exactly one owner capability for this stage
+  (Steps 2–4 of Procedure);
+- that capability's `PROJECT_CAPABILITIES.yaml` entry has an `executor` block
+  with `backend: claude_code_subagent`;
+- the slice is reversible and policy-permitted, or its external action is
+  already authorized; a `write_capable: false` executor may not perform repository writes.
+
+Dispatch:
+
+1. Spawn one subagent of `executor.agent_type`. Pass a bounded prompt only:
+   the `original_goal`, the resolved capability id and `canonical_path`, the
+   `context_entrypoints` to load through `executor.context_loader`
+   (`project-context`), the single slice objective, the slice acceptance
+   criteria, and the relevant `authority_provenance` claims. Do not pass the
+   whole AES record, other projects, unrelated history, or secrets.
+2. Instruct the child explicitly: return result, evidence references, and any
+   `cross_domain_need`; do not choose or invoke the next owner; do not spawn
+   sub-subagents (`child_dispatch: forbidden`).
+3. The child runs in the same working tree. Treat shared filesystem as a risk:
+   only a `write_capable: true` executor (currently `codex`) may be asked to
+   modify files, and only when the slice genuinely requires it.
+
+On return, the root (and only the root):
+
+4. appends one `continuation.route_trace` entry — `from_owner:
+   ai-os-orchestrator`, `to_owner: <capability>`, `resume_stage`,
+   `criteria_addressed`, `route_signature`, `outcome` (`dispatched` →
+   `completed` or `refused`), `evidence_refs`; the same `execution_id` is kept;
+5. validates the child result against the slice acceptance criteria and folds
+   its evidence into the AES record;
+6. reassesses the `original_acceptance_criteria`;
+7. selects the next route only through `ROUTING_RULES.md`, honoring the existing
+   `continuation.guards` (`max_continuation_hops`, `max_retries_per_owner`,
+   `max_no_progress_hops`, `route_signature_history_window`). A repeat route
+   without a material `evidence_delta` is recorded as
+   `repeat_route_refused_missing_evidence_delta` and not dispatched.
+
+The after-child step is **mechanical, not discretionary** (preserves the AES
+§2.1 resolved-owner boundary; a discretionary root becomes a standing
+supervisor above the resolved owner and defeats warm resume). After a child
+returns, the root performs only continuation-layer functions — record the
+evidence delta, update progress against the original acceptance criteria,
+evaluate the four guards — then restores the resolved owner and its
+`resume_stage` and returns control to that owner. The root does not pick a new
+owner on its own judgment and does not perform or redo domain work. The root
+diverts from the resolved owner only on a closed trigger: (i) a cold-entry-level
+change to the original goal, resolved owner, scope, authority, or canonical
+routing state; (ii) an AES §2 `decide` trigger; (iii) a tripped continuation
+guard; or (iv) all original acceptance criteria satisfied. Cross-domain routing
+after a child return still originates from the resolved owner's identified
+`cross_domain_need`.
+
+Failure handling: a spawn error, missing result, denied tool, or unusable
+output is registered as an AES defect (`classification: external_dependency`
+for a runtime/tool failure, `implementation` for a bad result), not retried
+silently or hidden. No subagent timeout primitive exists; rely on explicit
+cancel and the guard limits. A dispatched slice is never terminal goal
+completion — only Closure Review against the `original_goal` can close.
+
 ### Execution lifecycle and warm resume
 
 Once `Invoke AI-OS` begins for an execution, this orchestration contract

diff --git a/.agents/skills/project-context/SKILL.md b/.agents/skills/project-context/SKILL.md
@@ -7,6 +7,8 @@ description: Load a bounded context pack after canonical routing resolves an exi
 
 Use after canonical routing resolves one capability. This skill loads context; it does not classify the request or define domain methodology.
 
+When a capability's `executor.context_loader` names this skill, it is also the context entrypoint for a dispatched subagent (`AGENT_LOOP_PLAYBOOK.md`, "Supervised AI-OS Subagent Dispatch"): load only the one resolved capability's bounded pack; the subagent must not load other projects, classify the request, or select the next owner.
+
 ## Procedure
 
 1. Read the resolved capability from `PROJECT_CAPABILITIES.yaml` and verify its `canonical_path` exists.

@@ -116,7 +116,7 @@ valid when the user explicitly supplies them.
 - Make the smallest necessary change.
 - Keep changes bounded and reversible.
 - Do not refactor unrelated content.
-- Do not add blocked promotion items: embeddings, semantic search, vector DB, web UI, autonomous retrieval, agentic workflows, autonomous agents, production deploys, secrets, credentials, or runtime artifacts.
+- Do not add blocked promotion items: embeddings, semantic search, vector DB, web UI, autonomous retrieval, agentic workflows, autonomous agents, production deploys, secrets, credentials, or runtime artifacts. One bounded, owner-approved, root-controlled exception exists — "Supervised AI-OS subagent dispatch (pilot)" in `ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md`; it is pilot-only and does not generalize.
 - Do not claim production readiness or `production_promotion=yes`.
 - Do not commit directly to `main`.
 - Follow the canonical merge policy in `GOAL_MODE.md`; Codex and agents must not manually merge pull requests.

@@ -15,6 +15,7 @@
 - local_first_compute_status: candidate policy; production allowlist empty; owner review pending
 - orchestration_primitives_p1_status: review complete; P1.3 partial gap; implementation owner review pending
 - executable_capability_routing_status: resolved; P0 audit BLOCKED_FOR_NATIVE_DISPATCH; P1–P4 already owned by canonical contracts; no MVP implemented; owner accepted the audit and closed #350 as completed (2026-09-02)
+- native_subagent_dispatch_status: pilot MVP under bounded owner-approved carve-out (2026-09-02); hub-and-spoke, root-controlled, one AES execution_id, no parallel state model; pilot-only, not a standard workflow; evidence in docs/evidence/NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md
 - acceptance_status: candidate / ready for human review
 - smoke_qa_evidence: docs/evidence/SMOKE_QA_RESULTS.md; docs/evidence/CROSS_PROJECT_SMOKE_QA_RESULTS.md
 - validation_gates: see `MASTER_STATUS.md` — "Validation Gates" and "Operational Gates" (canonical lists; do not copy them here)
@@ -23,7 +24,7 @@
   - semantic search
   - vector DB
   - web UI
-  - agentic workflows
+  - agentic workflows  # one bounded exception: supervised AI-OS subagent dispatch (pilot), root-controlled, pilot-only — see AGENT_LOOP_PLAYBOOK.md
   - autonomous retrieval
 
 ## Current state

diff --git a/ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md b/ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md
@@ -26,6 +26,42 @@ The loop is supervised when a human or explicit project gate controls scope, sto
 | PR Judge loop | `[Thinking]` / `[Codex]` | revise PR until pass/revise/blocked is clear |
 | ChatGPT routing loop | `[Inbox Router]` | reroute when task type is unclear |
 | Prompt QA Factory | `[AI OS]` -> owner project | candidate -> test -> judge -> revise -> selected, with human acceptance |
+| Supervised AI-OS subagent dispatch (pilot) | `[AI OS]` root `ai-os-orchestrator` | root re-routes only via `ROUTING_RULES.md`; a child never selects the next owner |
+
+## Supervised AI-OS Subagent Dispatch (Pilot)
+
+Owner-approved bounded exception, dated 2026-09-02, for one MVP only. It is
+**not** a general permission for agentic workflows or autonomous agents, and it
+does not become a standard workflow automatically. Standardization requires a
+separate owner decision.
+
+Scope: the root `ai-os-orchestrator` may spawn a native built-in coding-agent
+subagent to execute one bounded, already-routed capability slice, then resume.
+
+Mandatory bounds:
+
+- hub-and-spoke only: `root -> child -> root`; no `child -> child` delegation;
+- root `ai-os-orchestrator` is the only controller and the only canonical
+  routing entrypoint; a child may return a `cross_domain_need` but never
+  selects or invokes the next owner;
+- one AES `execution_id` for the whole user goal;
+- reuse the existing AES state machine, `continuation`, `route_trace`, `guards`,
+  handoff, and `authority_provenance`; do not create a parallel model;
+- `PROJECT_CAPABILITIES.yaml` remains the only capability registry;
+- each child receives bounded `project-context` for its resolved capability
+  only;
+- the child gets no new authority; merge, deploy, production, destructive, and
+  external-action gates are unchanged;
+- no Temporal / LangGraph / CrewAI / AutoGen / Mastra and no new
+  runtime, service, or database;
+- `.claude/agents` is not a canonical source and `.gitignore` is unchanged;
+- shared filesystem is a known risk: do not give a write-capable child unless
+  the slice genuinely requires writes;
+- no subagent timeout primitive exists; this is a recorded runtime limitation,
+  mitigated by explicit cancel and guard limits;
+- every actual spawn, result, and failure must be observable evidence
+  (`NOT RUN != PASS`); a runtime failure is registered as an AES defect, not
+  hidden by retry.
 
 ## Not Autonomous Agents
 
@@ -37,7 +73,8 @@ Supervised loops are not:
 - background automation;
 - vector DB / embeddings / semantic search;
 - web UI;
-- uncontrolled multi-agent execution.
+- uncontrolled multi-agent execution (the pilot above is the only bounded,
+  owner-approved, root-controlled exception).
 
 ## Stop Conditions
 
@@ -48,7 +85,7 @@ Stop when:
 - production, runtime, deploy, or migration work appears;
 - formulas, schemas, output contracts, column names, metric definitions, or business logic may change;
 - autonomous retrieval is needed;
-- uncontrolled multi-agent work would be required;
+- uncontrolled multi-agent work would be required beyond the bounded pilot;
 - acceptance criteria conflict.
 
 ## Human Acceptance

diff --git a/ChatGPT/[AI OS]/Knowledge_Bundles/AIOS_05_SUPERVISED_AGENT_LOOPS.md b/ChatGPT/[AI OS]/Knowledge_Bundles/AIOS_05_SUPERVISED_AGENT_LOOPS.md
@@ -21,7 +21,7 @@ ChatGPT Project Sources / Knowledge for `[AI OS]`.
 - default_upload_mode: `Knowledge_Bundles`
 - bundle_type: generated compact upload artifact
 - source_of_truth: declared granular source files
-- source_fingerprint: sha256:108523a32cf77e20ffbde41bcae48947f10f6b3c4dd6c667a9c7e2c566ea38dd
+- source_fingerprint: sha256:274d77935b7fc633725ae5da1bb025a477aef0ef54d99bc08cc745c306ba061f
 - generator: scripts/build_knowledge_bundles.py
 
 ---
@@ -51,6 +51,37 @@ The loop is supervised when a human or explicit project gate controls scope, sto
 | PR Judge loop | `[Thinking]` / `[Codex]` | revise PR until pass/revise/blocked is clear |
 | ChatGPT routing loop | `[Inbox Router]` | reroute when task type is unclear |
 | Prompt QA Factory | `[AI OS]` -> owner project | candidate -> test -> judge -> revise -> selected, with human acceptance |
+| Supervised AI-OS subagent dispatch (pilot) | `[AI OS]` root `ai-os-orchestrator` | root re-routes only via `ROUTING_RULES.md`; a child never selects the next owner |
+## Supervised AI-OS Subagent Dispatch (Pilot)
+Owner-approved bounded exception, dated 2026-09-02, for one MVP only. It is
+**not** a general permission for agentic workflows or autonomous agents, and it
+does not become a standard workflow automatically. Standardization requires a
+separate owner decision.
+Scope: the root `ai-os-orchestrator` may spawn a native built-in coding-agent
+subagent to execute one bounded, already-routed capability slice, then resume.
+Mandatory bounds:
+- hub-and-spoke only: `root -> child -> root`; no `child -> child` delegation;
+- root `ai-os-orchestrator` is the only controller and the only canonical
+  routing entrypoint; a child may return a `cross_domain_need` but never
+  selects or invokes the next owner;
+- one AES `execution_id` for the whole user goal;
+- reuse the existing AES state machine, `continuation`, `route_trace`, `guards`,
+  handoff, and `authority_provenance`; do not create a parallel model;
+- `PROJECT_CAPABILITIES.yaml` remains the only capability registry;
+- each child receives bounded `project-context` for its resolved capability
+  only;
+- the child gets no new authority; merge, deploy, production, destructive, and
+  external-action gates are unchanged;
+- no Temporal / LangGraph / CrewAI / AutoGen / Mastra and no new
+  runtime, service, or database;
+- `.claude/agents` is not a canonical source and `.gitignore` is unchanged;
+- shared filesystem is a known risk: do not give a write-capable child unless
+  the slice genuinely requires writes;
+- no subagent timeout primitive exists; this is a recorded runtime limitation,
+  mitigated by explicit cancel and guard limits;
+- every actual spawn, result, and failure must be observable evidence
+  (`NOT RUN != PASS`); a runtime failure is registered as an AES defect, not
+  hidden by retry.
 ## Not Autonomous Agents
 Supervised loops are not:
 - autonomous retrieval;
@@ -59,15 +90,16 @@ Supervised loops are not:
 - background automation;
 - vector DB / embeddings / semantic search;
 - web UI;
-- uncontrolled multi-agent execution.
+- uncontrolled multi-agent execution (the pilot above is the only bounded,
+  owner-approved, root-controlled exception).
 ## Stop Conditions
 Stop when:
 - no validation path exists;
 - secrets, credentials, tokens, or `.env` values are needed;
 - production, runtime, deploy, or migration work appears;
 - formulas, schemas, output contracts, column names, metric definitions, or business logic may change;
 - autonomous retrieval is needed;
-- uncontrolled multi-agent work would be required;
+- uncontrolled multi-agent work would be required beyond the bounded pilot;
 - acceptance criteria conflict.
 ## Human Acceptance
 Human acceptance is required before:

@@ -44,6 +44,7 @@ Canonical list. Other documents (including `CURRENT_STATUS.md`) must reference t
 - `docs/evidence/SMOKE_QA_RESULTS.md` — `[AI OS]` smoke QA evidence from 2026-07-06.
 - `docs/evidence/CROSS_PROJECT_SMOKE_QA_RESULTS.md` — cross-project smoke QA evidence from 2026-07-06.
 - `docs/evidence/EXECUTABLE_CAPABILITY_ROUTING_P0_AUDIT_2026-09-02.md` — Issue #350 P0 audit: `BLOCKED_FOR_NATIVE_DISPATCH`; P1–P4 already owned by canonical contracts; no MVP implemented. Audit accepted by the owner; #350 closed as completed 2026-09-02. See `docs/evidence/README.md` for the other decision-evidence records (#342, #344, #345).
+- `docs/evidence/NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md` — bounded native-subagent-dispatch MVP pilot on the Claude Code surface (follow-up to #350), under the 2026-09-02 owner carve-out. 3 multi-owner executions, verdict `PASS`, recommended pilot-only. Not standardized; not merged; not production-authorized.
 - `docs/operations/CHATGPT_PROJECT_SYNC_CHECKLIST.md` — manual sync status.
 - `docs/operations/PILOT_CASES.md` — pilot backlog; pilot completion still requires result evidence.
 - `StreamDeck/README.md` — StreamDeck active/candidate status.

@@ -6,49 +6,98 @@
       "context_entrypoints": [
         "PROJECT_INSTRUCTIONS.md",
         "Knowledge/AI_OS_PROJECT_FILES_INDEX.md"
-      ]
+      ],
+      "executor": {
+        "backend": "claude_code_subagent",
+        "agent_type": "Plan",
+        "context_loader": "project-context",
+        "write_capable": false,
+        "child_dispatch": "forbidden"
+      }
     },
     "thinking": {
       "canonical_path": "ChatGPT/[Thinking]",
       "context_entrypoints": [
         "PROJECT_INSTRUCTIONS.md",
         "Knowledge/INDEX.md"
-      ]
+      ],
+      "executor": {
+        "backend": "claude_code_subagent",
+        "agent_type": "Plan",
+        "context_loader": "project-context",
+        "write_capable": false,
+        "child_dispatch": "forbidden"
+      }
     },
     "analytics": {
       "canonical_path": "ChatGPT/[Analytics]",
       "context_entrypoints": [
         "PROJECT_INSTRUCTIONS.md",
         "Knowledge/ANALYTICS_PROJECT_FILES_INDEX.md"
-      ]
+      ],
+      "executor": {
+        "backend": "claude_code_subagent",
+        "agent_type": "Plan",
+        "context_loader": "project-context",
+        "write_capable": false,
+        "child_dispatch": "forbidden"
+      }
     },
     "llm": {
       "canonical_path": "ChatGPT/[LLM]",
       "context_entrypoints": [
         "PROJECT_INSTRUCTIONS.md",
         "Knowledge/LLM_ROUTING.md"
-      ]
+      ],
+      "executor": {
+        "backend": "claude_code_subagent",
+        "agent_type": "Plan",
+        "context_loader": "project-context",
+        "write_capable": false,
+        "child_dispatch": "forbidden"
+      }
     },
     "codex": {
       "canonical_path": "ChatGPT/[Codex]",
       "context_entrypoints": [
         "PROJECT_INSTRUCTIONS.md",
         "Knowledge/INDEX.md"
-      ]
+      ],
+      "executor": {
+        "backend": "claude_code_subagent",
+        "agent_type": "general-purpose",
+        "context_loader": "project-context",
+        "write_capable": true,
+        "child_dispatch": "forbidden"
+      }
     },
     "inbox_router": {
       "canonical_path": "ChatGPT/[Inbox Router]",
       "context_entrypoints": [
         "PROJECT_INSTRUCTIONS.md",
         "Knowledge/INBOX_ROUTER_FILES_INDEX.md"
-      ]
+      ],
+      "executor": {
+        "backend": "claude_code_subagent",
+        "agent_type": "Plan",
+        "context_loader": "project-context",
+        "write_capable": false,
+        "child_dispatch": "forbidden"
+      }
     },
     "thinkers_os": {
       "canonical_path": "ChatGPT/[Thinkers OS]",
       "context_entrypoints": [
         "PROJECT_INSTRUCTIONS.md",
         "Knowledge/INDEX.md"
-      ]
+      ],
+      "executor": {
+        "backend": "claude_code_subagent",
+        "agent_type": "Plan",
+        "context_loader": "project-context",
+        "write_capable": false,
+        "child_dispatch": "forbidden"
+      }
     }
   }
 }