Compose responsibilities, not a monolith
Choose the smallest set of components that owns the decisions and records your workflow actually needs. Passing data between tools does not transfer authority.
The machine-readable composition map references IDs in the component inventory; it records required and optional capabilities, public example disposition, lost guarantees, and refusal boundaries without copying the component catalog. The profile list is a mutable candidate catalog, not an immutable release manifest. Read the release policy for alpha and snapshot limits.
Use case → capability matrix
Read one saved check beside an authored objective connects Maude, Monitor, Nightshift, NQ, an explicitly enrolled application reader and Phosphor. The exact public-only runtime and kit passed newcomer execution and retained-state inspection. Alpha.3 pins this read profile; it does not qualify a full application migration.
The alpha.5 installed saved-check profile adds an exact cadence-tick composition with same-slot replay, overlap refusal and missed-slot no-catch-up. Its clean public-only anonymous-clone reproduction and retained-state inspection passed. The single-user local fixture uses NQ's explicit debug-only same-UID helper exception; Nightshift and Monitor use release builds. The example invokes the tick directly; systemd activation, response loss after NQ acceptance, live Slack/Discord, human acknowledgment, migration, restore and rollback are not established.
Constellation Monitor is now the canonical public source for Monitor and its hosted Pulse subsystem. Immutable profiles continue to pin the exact Nightshift compatibility exports they qualified; those historical pins remain reproducible and do not make Nightshift the current Monitor source.
The alpha.6 reviewed local-copy profile adds one actual provider-reviewed, explicitly accepted, one-use governed action through Maude, NQ, Pulse, Nightshift/Foreman, Switchyard, AG and Docket. Its public newcomer path verifies immutable released evidence and exact-identity refusal without provider credentials or another effect. The profile is specific to the named local-copy contract and Linux environment; it is not a general executor or production profile.
| Need | Required capability → implementation | Optional addition | Public source/example and status | Lost guarantee or refusal |
|---|---|---|---|---|
| Create and inspect a local plan | Pre-governed authoring and inspection → Maude | None | Qualified maude-plan-consultation/v1: public Maude source, kit 013b05d0c5258ee1bc898a51b271e47d49c4f865, and the released versioned guide. This is a Maude-only consultation profile. | A check or lock is not permission or execution. An absent, malformed, or incompatible read-only store refuses rather than creating a replacement. |
| Consult governed records | Read-only campaign index projection → AG hosting Phosphor | Owner-detail navigation is a Phosphor feature, not an additional component. | Verified component demonstration from AG 32f1010 and public reader kit 013b05d: run the deterministic demo. This is not the Maude-only consultation profile and not a composed Maude→AG profile. | Unknown schema, oversized body, redirects, and HTTP or transport failure refuse the index. A demo GET is not current runtime state, reliance, or permission. |
| Govern one bounded reviewed action | Exact plan/executor → Maude; evidence/currentness → NQ/Pulse; occurrence/review preparation → Nightshift; provider/review custody → Switchyard; exact-work judgment and one-use authorization → AG; local permission, attempt and settlement custody → Docket | Read-only objective projection → Phosphor/AG | reviewed-local-copy/v1 alpha.6 pins the actual governed occurrence and a credential-free public evidence-verification path. | One named Linux local-copy composition only. The public newcomer path verifies retained evidence rather than repeating the provider call/effect. Permission revoked at resolution and unresolved states refuse; revocation after successful resolution is non-retroactive for that custody attempt. No production or arbitrary-executor support. |
| Refresh and remove a disposable cache | Plan → Maude; host and result evidence → NQ; currentness support → Pulse; proposal → Nightshift; one-use permission → AG; attempt custody → Docket. Authoring, Standing and the caller-asserted role are explicit synthetic inputs. | Phosphor can present owner records; owner CLI inspection remains available without it. This host profile does not invoke a separate Monitor service. | Recipe C is released as connected-cache-c in alpha.4, with exact public pins, a clean newcomer run, pre-effect refusal cases and retained qualification scope. | This finite disposable profile does not establish a production Standing service, current cache health, general resume, interrupted-effect recovery, live notification delivery, or an installed cache service. Inspect the original attempt before any new submission. |
| Carry a selected command to a substrate | Caller-selected command transport and factual transcript → Porter | Docket custody only through a separately supported adapter | Porter public CLI/library; interface disposition in the table below. | A transcript does not supply Docket custody, authorization, or a general executor contract. Federation and arbitrary executor substitution remain unsupported. |
| Acquire a local queue and decide whether it needs attention | Bounded acquisition → Monitor; factual admission → NQ; source support/currentness → Pulse; durable attention → Nightshift | No additional component in this tested profile. Live messaging is outside its verified scope. | Actual four-component public-source example, with pinned sources, real disposable reads, duplicate and stale-state recovery checks. | Missing or stale support cannot become current attention. No automatic maintenance overlay, recurring scheduler, live delivery or authorization is implied. |
| Evaluate a saved SQLite check and deliver local attention | Actual acquisition → Monitor; saved evaluation, maintenance and delivery custody → NQ; finite recurrence and attention decision → Nightshift | No optional adapter is qualified in this profile. Pulse support and AG/Docket execution are separate compositions. | Public-only three-component walkthrough and versioned snapshot with exact public pins, duplicate replay and altered-receipt refusal. | Failed remains failed under maintenance. One local file is not human acknowledgment; unattended recurrence, retention rollover and application migration remain unqualified. |
| Exercise an installed-cadence saved check | Actual acquisition → Monitor; saved evaluation, maintenance and notification custody → NQ; exact cadence slot, replay, overlap exclusion and retained attention → Nightshift | The timer is a wake source only. The example invokes the tick directly and configures no remote notification route. It uses NQ's debug-only same-UID helper exception; that is not the installed identity boundary. | installed-saved-check/v1 alpha.5, pinned to exact NQ and Nightshift/Monitor commits. Clean public-only anonymous-clone reproduction and retained-state inspection passed. | No systemd activation, post-acceptance response-loss case, live Slack/Discord, human acknowledgment, migration, restore, rollback or unattended service qualification. |
To inspect an authored goal, its exact linked runs and the evidence for each criterion, use the objective read integration guide. Maude provides the goal and criterion identities; your explicitly enrolled application reader supplies assessments and declared dependencies; Phosphor validates and presents them. The included NQ reader example connects one exact saved evaluation without repeating its check. Recorded outcome, source freshness and maintenance remain separate. The alpha.3 public-only composition qualifies one explicit saved-check mapping with fresh, stale and missing-record reads. Full application migration and governed effects remain outside that profile.
For minimal adoption, begin with the released Maude consultation or saved-check profile above. Adopt the alpha.6 reviewed local-copy profile only when the caller actually needs a governed effect and can supply its exact reviewer route, permission, executor and durable recovery state. The release qualifies those named interfaces; it does not make arbitrary replacements compatible.
Interfaces and caller boundaries
These are supported component interfaces, not a universal cross-component protocol. A caller may name input and identity; it does not thereby obtain a permission, currentness fact, or ownership of retained records.
| Surface | Supported input/output scope | Identity, evidence, and lifecycle boundary |
|---|---|---|
| Maude Plan Core CLI | maude-plan-consultation/v1 uses --read-only list|inspect over one selected plans.sqlite; it emits structured JSON. unavailable is JSON with exit status 0, so callers must parse the result rather than treat exit status alone as availability. | The caller owns the selected local store. Revisions and locks are retained Plan Core records; a lock binds bytes, not currentness, authority, or execution. Aggregate inspection is only consistent with quiescent writers; do not retry mutating commands on behalf of a caller. |
| AG-hosted Phosphor HTTP | The documented demo reader makes one loopback GET to the campaign-index endpoint and accepts only ag.operator-ui.campaign-index/v1; semantic detail links remain owner-selected. | The GET caller has no mutation permission. Owner sources remain available or unavailable; index output is not a freshness, readiness, or authorization verdict. |
| Phosphor objective occurrence capture | The bounded wrapper makes one GET to an exact loopback /api/v1/objectives/<digest> endpoint, retains the response create-only, and invokes the public AG checker with a caller-supplied exact identity tuple and checker SHA-256. | The Phosphor process must already have assembled actual owner records. Capturing or checking a response does not establish objective completion, current health, legitimate reliance, permission, or authority to continue. Alpha.6 publishes one exact real-owner projection and public checker reproduction; other deployments must assemble and validate their own records. |
| AG → Docket governed path | AG authorizes exact work. Docket’s local permission profile additionally requires an operator-issued grant for the exact run, valid for at most 300 seconds. Its CLI documents grant creation and read-only receipt inspection; these are component interfaces, not a completed external recipe. | Docket records the observed permission identity, revision, resolution time and expiry with custody. Missing or unresolved permission fails closed; revocation after successful resolution is non-retroactive for that attempt. AG authorization, independent review and executor reconciliation remain separate requirements. Settlement does not establish success; uncertain effects must be reconciled through the existing attempt. |
| Switchyard provider and review interfaces | The public source distribution supplies switchyard-direct-api, switchyard-provider-runner and switchyard-review-verifier. The runner’s preflight-request checks the exact request’s local size contract without starting a backend. The verifier reads already-retained review custody; it does not dispatch a reviewer. | Use the exact caller-enrolled source/schema combination. Request feasibility is not provider availability; provider completion is not plan acceptance or execution permission. Preserve the original request and stores after response loss. The verifier cannot create missing evidence. See the input, output and custody limits. |
| Nightshift and NQ | Nightshift owns temporal observation/currentness records; NQ evaluates retained evidence under a named profile. The public canonical runtime source cut also includes Foreman’s bounded model-work scheduler. Select its separate runtime/Cargo.toml; the preserved root predecessor commands are not aliases for it. | Evidence admission and a past success do not establish present permission. Missing or stale evidence is not a retry instruction. The source cut’s Foreman component tests do not establish a complete reviewed-action composition; follow a qualified profile rather than combining arbitrary current heads. |
| Porter CLI/library | Caller recipes select a command and substrate; Porter returns factual transcript, observed exit status, artifacts, and hashes. It is not a daemon, endpoint provisioner, or MCP server. | The caller still owns command selection. Cancellation, retry, expiry, and recovery semantics are not supplied universally by transport; use an explicitly supported composition where needed. |
| Verifier CLI and stdio MCP | verifier-check checks a caller-encoded finite claim; verifier-mcp exposes verify over stdio. Neither is a Constellation workflow MCP contract. | A caller supplies model, assumptions, and input truth. Unsat and unknown currently collapse into failed rules; there is no distinct solver-timeout or translation-failure verdict. A verdict is neither real-system correctness nor permission. |
There is no supported instruction here to inspect another owner’s database or to substitute an opaque locator for an owner identity. Keep credentials, private prompts, and whole databases out of diagnostics; use the documented component route and retain only the minimal redacted evidence needed to explain a refusal or unavailable source.
Choosing and recovering
Need to tell a human when something fails? Read Human notifications before migrating Classic notification hooks. The bounded Slack/Discord adapter and local receipt replay are implemented; one live Slack delivery was observed on 2026-10-01, while dependable channel delivery and application deployment remain unqualified. A finite saved-check recurrence and local-inbox composition is now public-only qualified. Retained evidence and an inspection UI are not delivery.
Need to check a local SQLite source and inspect the result later? NQ’s saved-check example runs without a model, daemon, or private prerequisite. Its public-only reproduction covers exact replay, stale-input refusal, and a retained condition view that keeps outcome, source freshness, local-read evidence and maintenance separate. Later maintenance declarations cannot rewrite an earlier view. This is an experimental local capability, not a released multi-component profile or a complete recurring-monitoring migration.
Use Operations for retained-state/restart guidance and Troubleshooting for a minimal report. In an uncertain governed attempt, inspect and reconcile the retained attempt first; do not repeat mechanics merely to obtain a tidier answer. Cancellation and expiry must come from the selected component contract—there is no suite-wide cancel or renewal guarantee.
Unsupported combinations
- Federation is not a supported profile. A shared HTTP or MCP transport does not establish matching plan, evidence, review, or authority semantics.
- The deprecated Python governor and classic NQ are not drop-in implementations of the successor AG/NQ contracts.
- Maude's design workspace and AG-hosted Phosphor inspection do not share a plan store. Navigation between them does not supply handoff or execution.
- Porter's command transport alone does not supply an arbitrary Docket executor, task-specific NQ profile, or Nightshift composition.
- General ECAD/design-flow and arbitrary campaign execution remain outside the advertised supported recipes.