Agree and implement opt-in model-information compiler-to-AWF contract (ADR 0004 Phase 4) #70728

Objective and current status

Implement the model-information compiler/config handoff for github/gh-aw-firewall#10294, under github/gh-aw-firewall#10290.

2026-10-21 user-directed scope correction: model management only. Remove the unmerged protected-launch/executor/driver/control-channel/immutable-runtime-closure expansion. Do not replace existing launch or sandbox security architecture. Preserve useful canonical validation, scoped import collection, lossless source codecs, model config handling, fail-closed error propagation, and their focused tests.

AWF's schema/identity/compiler foundations and partial lifecycle-reader migration are merged in github/gh-aw-firewall#10301, github/gh-aw-firewall#10310, github/gh-aw-firewall#10317, and github/gh-aw-firewall#10360. Local unfinished work is not merged progress and must not close either companion prematurely.

Model-only contract

Implementation direction: model-information frontmatter -> AWF modelInformation, version 1, canonical overlay records, original pre-substitution source provenance, and explicit source enabled/offline settings. Reconcile exact model-only schema/fixtures jointly after removing private execution-plan and launch-attestation requirements. These names were selected under delegated implementation authority, not a direct user endorsement of every schema byte.

Initial source support is frozen inline snapshots/offline operation; active live URLs reject actionably until policy-aware fetching exists. No source means no unconfigured fetch/cache fallback. Preserve exact numeric tokens before YAML/JSON float conversion.

Keep the existing 21,000-byte final expression-bearing rendered-script limit, including serialization/escaping/command overhead. Oversized output fails actionably; no larger-snapshot staging.

Required implementation and acceptance evidence

• Compiler and AWF validate the same versioned model payload and canonical semantic constraints. Go/WASM validation agrees with the canonical JS reference without a new mandatory Node subprocess.
• Root, dependency-ordered imports, custom-agent and secondary-engine contributions retain exact provider/channel/deployment scope and reach the appropriate model consumer through existing execution/config paths. Never silently drop declarations.
• Cross-contribution assignments to the same semantic field reject when provider/channel match and deployments intersect, even if values match. Operator lifecycle status, including active, counts as an assignment; authors consolidate overlapping model contributions. Preserve valid within-record scoped facts.
• Provenance identifies original authored/fetched source before substitutions, remains bounded/sanitized, and does not expose prompts, credentials, raw runtime arguments, or absolute checkout paths.
• Strict model-config validation remains mandatory when broader schema checks are disabled. Unknown fields/versions and unsupported pinned AWF versions fail clearly; no silent --config omission.
• Preserve existing workflows, open unversioned provider overlays, configured pricing-catalogue v1 authority, accounting, and successful command rendering. Keep the narrowly coupled fail-closed config-generation and independent-eval fallback fixes.
• Ordinary harness selection/version semantics distinguish execution-environment observations from host versions. Missing evidence is unknown/ineligible where a model constraint applies; this feature does not require tamper-proof process attestation.
• Compiler -> AWF config -> scoped model resolution round trips cover imports/secondary contexts, conflicts, source/offline cases, exact numeric handling, version failures, provenance, and rendered-size boundaries. Model assets work in built/package/container contexts.
• Derive supporting model-feature versions from actual shipped capability; do not invent a release floor or use latest as proof. Link implementation PRs/evidence before closure.

Non-goals

No new kernel/Yama policy, native runtime-hardening addon, cgroup/pidfd/controller authentication, protected spawn/release/child-signalling architecture, private execution-plan transport, full Node/SDK closure distribution, or speculative engine/SDK/RPC driver rewrites. Existing sandbox/network/security controls remain unchanged.

No pricing/accounting migration, live feed/cache/publication, reasoning/translation activation, staged target-data activation, new reflection endpoint, live workflow dispatch, or production changes. Further reflection uses the existing /reflect additively.