Skip to content

M6 decision package: Portable organization contract

Core and profile

conductor-core.v1 supplies stable concepts: organization, Initiative, workstream, role, stage, pack, authorization, privacy class, adapter, authority, provenance, and governance. An organization profile maps local vocabulary and providers onto those concepts. It may specialize but cannot redefine them.

Profiles created by onboarding have status incomplete or candidate, binding: false, and core_modified: false. Workflow and standard answers become candidate policy units requiring the existing governance path before activation.

Interview and gaps

The fixed interview collects:

  • organization name;
  • roles and line/privacy bindings;
  • systems of record;
  • workflows and ownership;
  • standards;
  • environments;
  • approval subjects and protocol;
  • privacy classes and visibility;
  • provider-neutral adapters;
  • required secret names;
  • estate-class vocabulary.

Every missing required answer is a typed blocking gap. Local environment variables, repositories, instruction folders, and model guesses are not fallback answers.

Adapter contract

Each adapter binds one organization to a kind (state, source, secret-provider, or runtime), provider, capabilities, secret names, and configuration references. It contains no credential values. Provider choices such as Notion/GitHub/Bitwarden are organization configuration, not universal core requirements.

Organization authorization boundary

Durable profile and resource operations require a server-issued access context binding:

  • authenticated subject;
  • exactly one organization_id;
  • delegated capabilities;
  • visible privacy classes.

Caller JSON cannot mint this context. Every read, write, search, export, and import rechecks the organization ID and capability. Privacy filtering occurs before results enter an export.

The M3 plan bundle, prepared context, review artifact, and authorization envelope now carry organization_id; execution validation treats organization drift as material binding drift. Delegation changes the authenticated subject, not the organization, Initiative, workstream, plan, or pack identity.

The current public shared-token MCP surface may compile a non-binding candidate profile, but it does not expose tenant storage/export/import. Those operations remain behind server identity until per-client authentication maps a caller to an organization.

Organization profiles are internal configuration metadata, not privacy-partitioned project content. Seeing a profile requires the privileged export capability; resource privacy classes then further restrict which state/history records enter that export. Granting export therefore grants visibility to role mappings and approval subjects for that organization.

The hosted preparation surface is instance-bound by CONDUCTOR_ORGANIZATION_ID. It refuses plans for another organization before labeling adapter or corpus evidence. A second organization may run the same core with a different profile, corpus overlay, adapter configuration, and instance binding; the current Hector corpus is never relabeled for it.

Export/import

An export is a canonical integrity-bound envelope containing one profile and permission-filtered resources. It preserves stable IDs, versions, relationships, authority, privacy, and provenance. It declares and enforces:

  • secret_values_included: false;
  • local_instruction_folders_included: false.

The digest is accompanied by an HMAC-SHA256 authentication record and key ID. The signing key is a runtime secret resolved from the secret provider and is never exported. Recomputing an unkeyed digest after tampering is insufficient.

Import requires the same organization identity, compatible core version, trusted MAC, valid digest, complete profile/resource contracts, matching resource/profile organization IDs, permitted privacy classes, and explicit capability. Validation completes before one transaction writes anything. Identical replay is idempotent; a conflicting profile or resource with the same stable ID fails closed. Import does not rename an organization.

Portable interview content uses allowlisted shapes for roles, workflows, standards, environments, approvals, privacy, and adapters. Arbitrary nested configuration is not portable profile content. Secret/credential signatures and local instruction directories are rejected before profile/resource storage, export, or import.

Moving hosts therefore requires this bundle plus adapter configuration and credentials resolved from the target secret provider—not copied workspace instructions or embedded secrets.

Canary

The synthetic org.northstar-coop uses:

  • Steward and Builder roles;
  • Linear and GitLab systems of record;
  • 1Password secret provider;
  • Nomad runtime;
  • Experiment, Community, and Foundation estate classes;
  • open and member-private privacy classes;
  • a different approval subject and protocol.

The profile compiles against the organization-aware core model established by M6. A real preparation canary then consumes synthetic Linear and GitLab adapter evidence plus portable core corpus metadata; it does not load or relabel Hector's corpus. Its policy answers remain candidates and contain no Hector, Prototype, Lab, Notion, GitHub, Bitwarden, or host-specific requirements.

The M5 learning path also binds feedback, experiences, review cursors, candidates, listings, and proposal drafts to organization_id, preventing cross-organization evidence deduplication or disclosure.