contracts

The UCC contracts repo, mounted on every host as contracts:.

• AXIOMS.md — the base contract: mount names and path grammar, the pin rules, the engine substrate (## hello), the identity triple. An armed rules/query page; an edit states its reason as force: (rules/020).
• One directory per seam, one file per version, status: released or draft: records/v1.md (the record face), formats/v1.md (the session tree, cards, columns, roles, memos), pages/v1.md (the pages service), identity/v1.md, client/v1.md and formats/v2.md (the peer lane — the seat map, inbox and quarantine records, the wake, and how a root declares its version), released by their rounds; oneshot/v1.md (the daemon socket's one-shot frames — each frame's fields, answer and errors — beside the held-connection frames of client/), released with the daemon code it describes; hooks/v1.md (the hook seam — how a harness hook event reaches the daemon through ccc-statusd hook and how the HOOKS.md plane's composed answer goes back, per event), released with the daemon code it describes; pages/v2.md (the pages service with the standard chat — the caps read, the message record, edit and delete, the browser upload to /f/ — as a delta over pages/v1.md), released with the service code it describes; pages/v3.md (what a permanent delete of a chat message removes — files another row names or the caller did not upload stay, an undrained inbox row becomes a chat.purged row — as a delta over pages/v2.md), released with the service code it describes; wire/v1.md (the fleet wire — one outbound WebSocket per host to the per-login FleetWire object, and the view socket beside it: transport, envelope, every frame both ways, versions, caps, close codes, idempotency), a design contract released before its code, which the fleetwire library and the object are built against. wire/v2.md (a login registers several pages to read its wire — the page set, PUT/DELETE/GET /w/page — as a delta over wire/v1.md, no frame change), a design delta released before its code. wire/v3.md (the seat directory as built — a stood-down card claims nothing, sticky holders ordered by seniority along the handoff chain, seat.lost only on an id seat, GET /w/directory — and the object serving every version from 1, as a delta over wire/v2.md, no frame change), released with the object code it describes. wire/v7.md (a machine with no UCC login joins a login's wire by a single-use ticket and reports on a host key of its own, the owner revokes it, and a viewer runs a command line in a host's terminal and gets its output and exit code — /w/join/…, DELETE /w/hosts/<host>, hello.credential, term.run/term.done — as a delta over wire/v6.md), a design delta released before its code. wire/v8.md (the centre pushes a published skill-text or launch-config marker to every host and a host below the text's daemon floor holds and says so, update upgrades a host's install over the wire, each host reports a software@1 fact, and a welcomed host stops polling the marker — POST/GET /w/publish, publish, sync, update, welcome.published — as a delta over wire/v7.md), a design delta released before its code. wire/v9.md (the object runs a login's daemon releases through rings — ring 0 the canary, ring 1 after a clean hour judged on the health@1 fact, ring 2 last — by its own update frames, tells the notify roster's holder of each move, makes the ring 1 release get-ucc's default for the login and answers a host's boot-time update with its ring's release — GET/POST /w/release, release, health@1, users/<login>/ring.json — as a delta over wire/v8.md), a design delta released before its code. wire/v10.md (a viewer lists a host's tmux sessions — each with its last activity and a plain-text capture of its active pane — and attaches one read-only, with no way to type into it or change its size — term.list, term.attach — as a delta over wire/v9.md), a design delta released before its code.
• external/<name>/v<N>.md — a byte-exact copy of an outside document a contract reads (external/peer/v1.md, the peer protocol's doc.md), pinned by v<N>.source.md beside it: the source, its commit and blob, the copy's digest. Not a contract: no frontmatter, no ^id, no lock row; the external lane keeps it equal to what the source publishes.
• frozen.lock.md — every released section and the four sections of AXIOMS.md, pinned by heading path. Released text is frozen: a wording fix is an errata: frontmatter line, a change of meaning a new file.
• rules/ — the doors on this root: 010 heading freeze, 020 force-reason on AXIOMS.md, 030 pre-minted ^id on every released section. Armed in meridian/armed-rules.md; edit and re-arm are one act.
• .woodpecker.yml — three lanes: frozen (mrd check --commit-gate --require-pins -- frozen.lock.md, a red prints contract-diff), rules (plain mrd check over the armed rows, then bin/check-released-ids) and external (bin/ci/external-check, every pinned copy against its digest and its published source).
• bin/contract-diff [LOCK.md] --locks FILE reads a red pin for an agent — the section, the recorded and current fingerprint, the byte diff between the pinned git blob and the working tree, who pins it; bin/contract-consumers '<object>#<heading path>' LOCK.md … is that last read alone. Both compose mrd pin --refresh --dry --json, mrd walk --json, git cat-file and diff, need jq, and change nothing.
• bin/ci/ — what a consumer repo's lane calls: mrd-fetch (the pinned engine by digest from the forge's package registry, mrd-pin), consumer-check PAGE… (binds this checkout as contracts: in a private mount table, starts the daemon a cross-root walk needs, walks and checks the pages, prints contract-diff on a red).
• bin/test/ — run (the wrappers' done test), probes (the four probes the fence stands on), fence (the fence's done tests F1–F8), each on a scratch world under a private HOME with its own mrd daemon; the machine's ~/MERIDIAN.md is never touched.

A consumer repo keeps a CONTRACTS.md whose lock rows pin the sections it was built against, and a CI lane that runs consumer-check on it; the walk is green while the text it built against is unchanged.