Skip to content

M6 implementation brief: Portable organization onboarding

Work contract

Field Value
Milestone M6
Status verified
Depends on Verified M5
Gaps G13-G15
Canary org.northstar-coop (synthetic)
Output Candidate profile/corpus, adapter contracts, tenant-bound export/import
Core boundary M6 adds organization binding once; the second-org canary requires no organization-specific core fork

Objective

Prove that Conductor can represent a second organization without embedding Hector-specific roles, providers, estate labels, approvers, or infrastructure in the core model. Onboarding must expose unanswered questions, produce only candidate policy, exclude secret values, and maintain an organization boundary through search and portability.

Work packages

  1. #35 — organization profile and explicit-gap interview.
  2. #36 — adapter contracts and secret-reference portability.
  3. #37 — organization-scoped export/import and authorization isolation.
  4. #38 — second-organization canary and independent verification.

Exit conditions

  1. The interview covers roles, systems of record, workflows, standards, environments, approval, privacy, adapters, secret names, and estate labels.
  2. Missing required answers remain blocking gaps.
  3. Answers produce a non-binding candidate profile and candidate policy units; they never edit core or active corpus.
  4. State, source, secret-provider, and runtime adapters use explicit provider-neutral contracts.
  5. Secret names and configuration references export; secret values and local instruction folders never do.
  6. Export/import preserves organization ID, profile version, resource IDs, relationships, authority, privacy, provenance, and integrity. Integrity is authenticated by a server-held key, not a recomputable hash.
  7. Server-issued identity, capability, and privacy bindings prevent cross-organization search, write, export, and import.
  8. Delegated subjects can change without changing Initiative or pack identity.
  9. The synthetic organization passes without Hector-specific vocabulary or a Conductor core change.
  10. Independent verification reproduces positive and adversarial paths.

Non-goals

  • Activating a synthetic organization's candidate policies.
  • Copying either organization's live private data into the canary.
  • Storing or transporting secret values.
  • Supporting public multi-tenant storage through the current shared-token MCP endpoint. Tenant storage requires server-issued authenticated identity.