2026-07-22 · CONTROL PLANE · DREAM.OS · ~6 MIN READ
Portfolio Reconciliation
Needed a Control Plane.
ChatAudit caught the real bug: when ProjectScanner was required and the wrapper failed, the runtime improvised. That is now a governed failure mode.
The obvious failure looked like a slow filesystem scan. The real failure was subtler: a required tool failed through one wrapper, and the execution path drifted into a homemade substitute.
That is exactly backwards. If a capability owns a domain, the platform should retry that capability directly, prove it passed, or hard-block. It should not quietly become a new implementation path because the first shell shape was inconvenient.
Required capability failure should create a governed block, not an improvisation opportunity.
What Changed
Dream.OS now has a Portfolio Git Control Plane slice. It starts with a canonical registry of the 25 Victor-Dixon repositories, their expected local paths, locked lanes, scan budgets, and required implementation authority.
PORTFOLIO_GIT_CONTROL_PLANE=PASS PROJECTSCANNER_AUTHORITY=PASS INVENTORY_STATE=COMPLETE_INVENTORY COVERAGE_PROVEN=TRUE MUTATIONS=0
The important part is the shape of the claim. It exposes authority, evidence, scope, and completeness instead of collapsing all inventory into "we found some repos."
Truth Classes
The runner now distinguishes complete inventory from bounded evidence:
- COMPLETE_INVENTORY: remote and canonical local counts are proven.
- BOUNDED_INVENTORY: known roots were scanned within a declared budget.
- STALE_INVENTORY: evidence exists but is too old to seal.
- PRELIMINARY_PROBE: useful early signal, not closure.
- UNKNOWN_COVERAGE: scope is not known enough to make the claim.
That distinction prevents a bounded probe from becoming fake certainty. It is small, but it changes the behavior of the whole lane.
Locked Means Specific
A locked repo is not simply "do nothing." It has separate permissions: inspect, fetch, mutate worktree, mutate history, and push remote.
That matters because git status and git push --force
should not live in the same risk bucket. DreamVault can inspect a locked lane
while still refusing worktree mutation and remote history mutation.
The Bigger Lesson
This is the pattern Dream.OS needs everywhere: deployment, messaging, verification, publishing, secret handling, and portfolio cleanup should all declare their owning capability and fallback policy before execution begins.
When the system cannot prove the authority path, it should stop with a useful block. That is not slower. That is how the platform stops producing new one-off tools every time the terrain gets rough.
The future version of Dream.OS does not investigate the portfolio. It operates a portfolio control plane.