M0 Architecture and Contract Freeze

Objective

Freeze the architecture, the Partition Contract, the IR, the Backend API, the Hardware Profile, and the Recovery model, as documentation and schemas, so that all later milestones build on the same semantics.

Scope

  • GoMyRobotOS specification

  • Partition Contract v1 (spec + JSON Schema + examples per target)

  • IR v1 specification

  • Backend API v1 specification

  • Hardware Profile v1 specification

  • Recovery model v1 specification

  • The full documentation structure of this site

  • ADR-0001 … ADR-0013 records

  • Milestone definitions M0-M6 with gates

Out of scope (deliberately): every line of implementation code, any backend, any target deployment, any measured result.

Deliverables

  • this documentation site (versioned with the software, ADR-0013)

  • schemas/partition-contract.schema.json (machine-checkable Contract v1)

  • examples/{x86-64,ng-ultra,hpsc}/flight-control.yml (one conceptual partition, three targets)

  • Milestone plan + gates (this section)

  • ADR list ([development/architecture-decisions] (../development/architecture-decisions))

Tests

  • Documentation builds cleanly (CI: docs job), zero warnings; the CI build runs Sphinx with -W, so a single warning fails it.

  • Schema job: every examples/*/flight-control.yml validates against the JSON Schema (CI: schema job).

  • Human review gate: the contract describes a complete workload (identity, execution, memory, devices, interrupts, DMA, communication, startup, security, recovery, requirements, verification) without mentioning Xen, XNG, or any board-specific implementation, the acceptance gate itself.

Acceptance gate

A complete workload can be described without mentioning Xen, XNG, or any board-specific implementation.

Current status

In progress. This documentation is the freeze artifact in progress; sign-off happens when the five deliverables above are reviewed and the gate sentence holds under adversarial reading.

Known limitations

  • M0 deliverables are specifications; they prove nothing about implementability. Proofs come from M1/M2.

  • The contract is a v1 hypothesis: RP1 findings are expected to evolve it (via ADR), “frozen” means “frozen until an ADR supersedes it”, not “cannot change”.

  • Nothing in M0 is a certification input by itself; no assurance claim is generated at M0 at all.