OmpOS · Architecture

3 min read

Gaps and acceptance status

Updated 2026-09-27 after the implementation smoke recorded in implementation. Verdict: BLOCKED with the exact gaps below; every implemented surface is separately evidenced.

Still blocked

  • Chat: SiteKits setup documentation explicitly says <omp-chat-bubble> is planned, not implemented (setup.md:47-59). No exported module, registration API, event/transport contract or OmpOS site value exists. OmpOS renders the exact blocker, launches no provider child and fabricates no composer. Actual cited answers require the SiteKits owner to ship the component contract.
  • Memory: no independently authoritative identity-to-project/bank authorization policy exists. Native mnemopi constructors can create/migrate storage and recall updates counters; agent/project labels do not prove human ownership. Retrieval is denied before any bank access rather than querying globally and filtering afterward.
  • Ledger: no reachable authoritative current FlowMaster decision/standby export is established. The authorized candidate /srv/flow/loco-cockpit-data denies the service read (PermissionError); cockpit getDatabase() creates/migrates its store and is not called; readable 2026-09-26 handoffs are historical, not a current feed.
  • Authentication: neither OmpOS host has a matching one-factor policy and the shared policy defaults to bypass. Live controllers for SiteKits and the Authelia gatekeeper were present throughout; no exclusive writer window existed, so shared configuration was left untouched (zero edits, zero restarts). The public app remains 503 and the public authenticated-route proof was therefore not obtainable.
  • Public route acceptance: because the edge rule cannot be applied, “every panel through the real authenticated nginx route as a human session” is unproven. Panel truth was established over the real backend via a clearly labeled loopback diagnostic bridge (synthetic principal), which is not an Authelia login.

Resolved during this run

  • Knowledge: full admitted census executed — 61 tenants, 57 admitted, 32 private companions, 23 sources explicitly denying anonymous fetch (302 to Authelia, listed per-source), 630 pages, meaningful search with provenance. No sampling; no fenced or private index touched.
  • Seats: live allowlisted roster and view-only, generation-checked, host-local links proven; no control links requested.
  • Judge: real health and source-attributed capabilities; inference never invoked.
  • Skills: real metadata catalog (198 installed) with precedence and collisions surfaced; nothing installed or invoked.
  • Mutations: all flags false server-side; direct calls 403 (chat POST exact 503); TCP identity spoofing 401 on every route.
  • Shell: seven panels verified in Chrome at 1280 and 390 with real adapter data, keyboard navigation, provenance, no settled horizontal overflow, zero console/network errors.

Standing policies

  • Provider HTTP 429: stop provider work, retain a BLOCKED receipt, do not switch providers or run a retry campaign. No provider calls were made during this run.
  • Research honesty: one scout returned fabricated FlowMaster CLI/fence claims; these were retracted, never implemented, and corrected evidence is recorded. An overbroad scout search incidentally returned excluded private-wiki/profile matches; the content was not used as integration data.
flowchart LR
  Evidence[Observed evidence] --> Gate{All acceptance criteria?}
  Gate -->|Yes| Complete[COMPLETE]
  Gate -->|No| Blocked[BLOCKED with exact gaps]