Design Actor Bus and AA consult lane using Oracle

[marcusglee11]

Objective

Design a governed Actor Bus layer that lets LifeOS actors communicate across COO, EA, and AA roles, with Oracle as the first Advisory Agent (AA) adapter for ChatGPT/Gemini/Claude consults.

This is the missing layer above the current COO↔EA work. The target is not a free-form direct mesh. The target is a policy-mediated actor bus where every actor can message other actors, but command authority remains constrained by LifeOS governance.

Background

Related work:

• Wire COO-to-EA dispatch, monitoring, and receipts #60 — Wire COO-to-EA dispatch, monitoring, and receipts
• fix(receipts): validate EA worker receipts #61 — Validate EA worker receipts
• Design automated COO-to-EA dispatch pipeline #62 — Design automated COO-to-EA dispatch pipeline

#62 covers the COO→EA execution path. This issue covers the broader communication layer needed for COO↔AA, EA↔AA, AA↔COO, and future actor-to-actor coordination.

Oracle reference:

• https://github.com/steipete/oracle

Relevant Oracle capabilities:

• Bundles prompts and files for model consults.
• Supports GPT, Gemini, Claude, and multi-model runs.
• Supports API mode, browser mode, manual copy fallback, and session replay.
• Provides MCP tooling (consult, sessions) for Codex/Claude-style agents.
• Supports Windows-hosted browser session bridging to Linux clients, useful for current LifeOS operating setup.

Core design position

Oracle should be treated as an AA adapter, not as the LifeOS architecture.

Correct invariant:

Every actor may message every other actor.
Only authorised actors may command other actors.
All commands become typed requests on a governed bus.
All outcomes require validated receipts.

Direct all-to-all command/control is forbidden because it would break the authority model.

Target actor model

Source	Target	Allowed meaning
CEO → COO	command	Authoritative instruction
COO → EA	dispatch	Governed execution request
COO → AA	consult	Advisory model call
EA → COO	receipt/status/blocker	Evidence, not authority
EA → AA	consult	Advisory assistance while executing
AA → COO	recommendation/challenge	Advisory only
AA → EA	proposed instruction	Must route through COO/policy gate
AA → AA	cross-check	Allowed only if budget/policy permits

Hard rule:

AA → EA direct execution is forbidden.
AA → COO → EA proposal path is allowed.

Proposed architecture

CEO / User
   ↓
COO Orchestrator
   ↓
Actor Bus
   ├── EA Adapter: Codex
   ├── EA Adapter: Claude Code
   ├── AA Adapter: Oracle → ChatGPT
   ├── AA Adapter: Oracle → Gemini
   ├── AA Adapter: Oracle → Claude
   └── future adapters

The Actor Bus owns:

• Actor registry
• Message envelope schema
• Routing policy
• Idempotency keys
• Attempt IDs
• Budget enforcement
• Authority checks
• Receipt validation
• Loop prevention
• Audit storage

Oracle is one transport adapter under the bus.

Proposed schemas

actor_message.v0

Canonical envelope for all actor-to-actor communication.

schema_version: actor_message.v0
message_id: msg_...
correlation_id: corr_...
parent_message_id: null
source_actor: coo.hermes
target_actor: aa.chatgpt.pro
intent: consult
authority_class: advisory_only
requires_response: true
idempotency_key: ...
budget:
  max_cost_usd: 5
  max_runtime_seconds: 3600
  max_context_files: 20
context_refs:
  - github_issue: 62
  - repo_path: docs/...
payload_ref: artifacts/actor_bus/msg_.../prompt.md
expected_receipt_schema: aa_receipt.v0
status: queued
created_at: ...

aa_receipt.v0

Advisory-agent equivalent of the EA receipt.

schema_version: aa_receipt.v0
message_id: msg_...
attempt_id: aa_attempt_...
target_actor: aa.chatgpt.pro
transport: oracle
engine: api | browser | copy
model: gpt-...
oracle_session_id: ...
status: succeeded | failed | blocked | timed_out
output_ref: artifacts/actor_bus/msg_.../answer.md
output_hash: sha256:...
structured_output_valid: true
cost:
  estimated_input_tokens: ...
  estimated_output_tokens: ...
  estimated_usd: ...
blockers: []
created_at: ...

Invariant:

An AA answer is never authority. It is evidence/advice attached to a COO decision.

Proposed actor policy shape

schema_version: actor_policy.v0

actors:
  ceo:
    class: human_authority
  coo.hermes:
    class: orchestrator
  ea.codex:
    class: execution_agent
  ea.claude_code:
    class: execution_agent
  aa.chatgpt:
    class: advisory_agent
  aa.gemini:
    class: advisory_agent
  aa.claude:
    class: advisory_agent

edges:
  ceo -> coo.*:
    intents: [command, approve, reject]
  coo.* -> ea.*:
    intents: [dispatch, status_query, retry]
    requires: [delegation_envelope_check]
  coo.* -> aa.*:
    intents: [consult, review, challenge, compare]
    requires: [budget_check]
  ea.* -> aa.*:
    intents: [consult]
    requires: [task_scope_bound, budget_check]
  aa.* -> ea.*:
    intents: [proposal_only]
    requires: [coo_gate]
  aa.* -> coo.*:
    intents: [advice, objection, blocker, review_result]

Oracle adapter sketch

Minimal API-mode invocation shape:

oracle \
  --engine api \
  --model gpt-5.4-pro \
  --slug "$ATTEMPT_ID" \
  --write-output "artifacts/actor_bus/$MESSAGE_ID/answer.md" \
  -p "$(cat artifacts/actor_bus/$MESSAGE_ID/prompt.md)" \
  --file "docs/**/*.md"

Browser/Pro-account mode shape:

oracle \
  --engine browser \
  --browser-manual-login \
  --browser-auto-reattach-delay 30s \
  --browser-auto-reattach-interval 2m \
  --browser-auto-reattach-timeout 2m \
  --slug "$ATTEMPT_ID" \
  --write-output "artifacts/actor_bus/$MESSAGE_ID/answer.md" \
  -p "$(cat artifacts/actor_bus/$MESSAGE_ID/prompt.md)" \
  --file "docs/**/*.md"

MCP route:

• Install Oracle MCP in Codex/Claude Code.
• Expose consult and sessions as advisory tools.
• Persist all advisory outputs through the same aa_receipt.v0 path.

Proposed split from #62

Recommended sequencing:

#62 = COO→EA automated dispatch pipeline
this issue = Actor Bus + AA consult lane
future issue = Oracle adapter proof
future issue = cross-actor policy matrix + schemas

First production-capable slice

Smallest useful slice:

COO can ask one AA for advisory review through Oracle,
store request/output/receipt,
validate receipt,
attach summary to GitHub issue,
and never treat the answer as authority.

Acceptance criteria for the first slice:

• Given actor_message.v0 targeting aa.chatgpt, runner invokes Oracle.
• Oracle output is written to deterministic artefact path.
• aa_receipt.v0 is emitted.
• Missing output produces failed receipt.
• Missing/malformed receipt fails closed.
• AA result cannot mutate repo state.
• COO can cite AA output as evidence in issue/PR comment.
• Duplicate idempotency key does not create duplicate consults.
• Cost/runtime budget is enforced.
• Actor policy forbids AA→EA execution bypass.

Risks and controls

Risk	Control
Authority confusion	AA receipts marked advisory_only; COO remains decision point
Runaway model loops	max hop count, max fanout, cost budget, per-correlation lock
Browser fragility	API mode default; browser mode fallback; --copy manual fallback
Secret/session exposure	no cookies in repo; local ~/.oracle; bridge token treated as secret
Non-deterministic output	hash answer artefact; require structured response schema where possible
Cost explosion	budget in actor_message.v0; no automatic multi-model fanout unless policy allows
Prompt injection through repo/docs	context manifest + explicit system boundary in prompt template
False success	receipt validation mirrors #61 pattern; no wrapper-exit success assumption

Deliverables

• Actor Bus design packet
• actor_message.v0 schema proposal
• aa_receipt.v0 schema proposal
• actor_policy.v0 routing/authority matrix
• Oracle adapter proof design
• Failure-mode matrix
• First-slice implementation plan
• Acceptance criteria for production-capable AA consult lane

Explicit non-goals

• Do not implement unrestricted actor mesh.
• Do not allow AA output to directly command EAs.
• Do not treat Oracle browser success as task success without receipt evidence.
• Do not make Drive/Workspace canonical for actor state.
• Do not change CEO/COO authority rules without separate governance approval.

Research note

This does not need Pro-level research before the first slice. The immediate implementation path is clear enough: schema → adapter → receipt validation → policy-gated routing.

A Pro-level research pass may be valuable later, after #62 and the first Oracle AA lane are proven, to compare long-term protocol options: direct mesh, brokered bus, MCP-only, A2A-style protocol, and GitHub-mediated control plane.

[marcusglee11]

Review synthesis — required revision to #63

External review verdict: REVISE.

I agree with the substance of the review. The original #63 framing should be narrowed before implementation. The strategic intent remains valid — Oracle as an AA adapter, advisory-only outputs, no AA→EA execution — but the architecture should be revised to avoid introducing a second control plane or premature actor mesh.

Accepted blocking corrections

1. Collapse "Actor Bus" into COO Commons

Replace the proposed standalone Actor Bus with:

AA adapter category under existing COO Commons substrate

No new bus, no parallel control plane, no duplicate registry/routing/idempotency/receipt-validation/audit layer.

Revised invariant:

COO Commons remains the single deterministic enforcement substrate.
EA and AA are adapter categories under COO Commons.

2. Generalize one shared envelope across #62 and #63

Do not create a separate actor_message.v0 envelope that collides with #62.

Use one common envelope, tentatively:

coo_message.v0

or:

dispatch_envelope.v0

intent acts as discriminator:

intent = ea_dispatch | aa_consult | status_query | retry | receipt_notice | blocker

Receipts remain intent-specific siblings:

ea_receipt.v0
aa_receipt.v0

with shared header fields.

3. Enforce sole-writer and authority at write time

Policy is not enough if it only lives in adapter logic.

Required rule:

The schema/write validator rejects command-class envelopes unless:
principal == active_coo
source_actor matches authorised COO actor
intent is allowed for that source/target pair

source_actor must not be treated as self-authenticating text.

4. Remove all nonessential edges from first slice

Delete from first-slice scope:

AA→EA
EA→AA
AA→AA
AA→COO→EA proposal conversion

First slice is only:

COO → AA consult → COO advisory return

AA output may advise, object, or summarize. It may not command, mutate, dispatch, or directly address an EA.

5. API-only first slice

Browser-mode Oracle is out of scope for first implementation.

First slice must fail closed if configured for browser mode.

Browser mode becomes a separately scoped issue with its own tests for bridge loss, manual login, profile lock, timeout, and reattach behavior.

6. Context pinning is mandatory

context_refs by path are insufficient.

The envelope must bind consult context to immutable state:

repo commit SHA and/or per-file content hashes
prompt hash
context manifest hash
prompt template version

Runner must fail closed if context mutates between enqueue and execution.

7. Loop and budget controls must be schema-enforced

Add explicit operational controls:

hop_count
max_hops
expires_at / ttl
deadline_at
per-message budget
per-correlation aggregate budget
per-day kill switch

No advisory chain may recurse without these fields and enforcement tests.

Revised schema direction

Shared envelope: coo_message.v0 / dispatch_envelope.v0

Required fields to add/retain:

schema_version: coo_message.v0
message_id: msg_...
correlation_id: corr_...
parent_message_id: null
causality_chain:
  - msg_...
hop_count: 0
max_hops: 3
expires_at: "..."
deadline_at: "..."
principal: active_coo
source_actor: coo.hermes
target_actor: aa.chatgpt
intent: aa_consult
authority_class: advisory_only
idempotency_key: ...
prompt_template_version: aa_consult_v0
payload_ref: artifacts/...
payload_hash: sha256:...
context_pin:
  repo_commit_sha: ...
  context_manifest_hash: sha256:...
  files:
    - path: docs/...
      sha256: ...
budget:
  max_cost_usd: ...
  max_runtime_seconds: ...
  correlation_budget_remaining_usd: ...
expected_receipt_schema: aa_receipt.v0
status: queued
created_at: ...

Split registry from policy

Use two files/schemas:

actor_registry.v0 = slow-changing actor identities/classes/capabilities
actor_policy.v0 = edges, intents, budgets, hop limits, rate limits

aa_receipt.v0 amendments

Required fields:

schema_version: aa_receipt.v0
message_id: msg_...
attempt_id: aa_attempt_...
attempt_number: 1
target_actor: aa.chatgpt
transport: oracle
transport_session_id: ...
engine: api
model: ...
status: succeeded | failed | blocked | timed_out
prompt_hash: sha256:...
context_manifest_hash: sha256:...
output_ref: artifacts/...
output_hash: sha256:...
output_validation:
  schema_id: aa_answer_schema.v0
  status: pass | fail
  errors: []
policy_decision_ref: ...
actual_cost_usd: ...
budget_remaining_usd: ...
warnings: []
blockers: []
created_at: ...

Replace:

structured_output_valid: true
oracle_session_id: ...

with:

output_validation: { schema_id, status, errors }
transport_session_id: ...

Prompt-injection posture

First slice must assume repo/document context is adversarial.

Required controls:

• Per-edge context allow-list.
• Prompt template versioning.
• AA output schema validation.
• No-trust posture on AA-suggested actions.
• Canary test where malicious repo text attempts to override instructions.

Revised first-slice acceptance criteria

Replace the previous first-slice criteria with:

• Design automated COO-to-EA dispatch pipeline #62 first slice ships before Design Actor Bus and AA consult lane using Oracle #63 implementation begins.
• Shared envelope is defined once and can represent both EA dispatch and AA consult by intent discriminator.
• COO Commons write-time validator rejects command-class envelopes where principal/source_actor are not authorised COO values.
• First slice supports only COO→AA→COO advisory consult.
• AA→EA, EA→AA, AA→AA, and AA proposal-to-dispatch flows are absent from first slice.
• Oracle adapter is API-only in first slice; browser mode produces a config error.
• Consult context is pinned by commit SHA and/or per-file content hashes.
• Runner detects stale context and fails closed before invoking Oracle.
• Envelope includes hop_count, max_hops, expires_at, deadline_at, and enforceable budgets.
• Duplicate idempotency key returns same receipt id and does not invoke Oracle twice.
• Oracle failure/quota exhaustion/non-zero exit emits failed AA receipt; COO state machine records explicit AA-unavailable branch.
• Malformed AA output fails output schema validation after bounded retry count.
• Adversarial prompt-injection canary does not produce a succeeded receipt carrying adversarial instruction as valid advice.
• Per-message budget breach terminates adapter process and emits failed receipt with budget-breach reason.
• Per-day kill switch prevents further AA invocations.
• AA adapter has no repo write token and cannot mutate repo state.
• Receipts are written by COO-controlled process, not by the adapter directly.
• Forged receipt/message written by another actor/process is rejected by validator.

Revised implementation sequence

1. Ship Design automated COO-to-EA dispatch pipeline #62 first slice: governed COO→EA dispatch with ea_receipt.v0 validation.
2. Generalize envelope after Design automated COO-to-EA dispatch pipeline #62: extract shared coo_message.v0 / dispatch_envelope.v0; refactor Design automated COO-to-EA dispatch pipeline #62 to use it.
3. Implement Design Actor Bus and AA consult lane using Oracle #63 as AA adapter category under COO Commons, API-only, single edge COO→AA→COO.
4. Validate with tests for authority spoofing, stale context, prompt injection, idempotency replay, AA unavailability, budget breach, write permission, malformed output, and TTL/hop expiry.
5. Add Gemini/Claude AA adapters only after the single-model ChatGPT/Oracle adapter passes.
6. Defer browser mode, AA↔AA, EA→AA, and AA→COO→EA proposal conversion to separately scoped issues.

Net recommendation

Revise #63 before implementation. Keep the core insight — Oracle as a swappable AA adapter with advisory-only output — but collapse the proposed Actor Bus into COO Commons, use one shared envelope with #62, make authority/write-time validation non-bypassable, pin context, enforce loop/budget controls, and restrict the first slice to API-only COO→AA→COO consults.

[marcusglee11]

Roadmap status correction from #74 Hermes review

#63 is deferred from the Autonomous Work Chain v0 critical path.

Do not implement the current broad Actor Bus shape for v0.

Before implementation, #63 should be narrowed to:

COO Commons AA consult adapter, API-only first slice
COO → AA → COO advisory return only

Explicitly out of v0 first slice:

• standalone Actor Bus / second control plane,
• AA→EA,
• EA→AA,
• AA→AA,
• AA proposal-to-dispatch conversion,
• browser-mode Oracle.

Dependency:

#62 executable COO→EA first slice must exist before #63 implementation begins.

For now, #63 is advisory-lane design debt, not a blocker for #75/#69/#62 critical path execution.