Codesign SEAM 6: the autonomy datum — device {none|ro|rw} in the warrant-bounds schema

[aarontrowbridge]

Important

Problem — The one-autonomy-doctrine design says the device profile datum (none | ro | rw) is THE single switch — but today it exists as an informal convention across three systems: the amicode approval-warrant bounds carry a device field by tool description, strumento's P4 gate is recorded-not-yet-enforced, and Telaio's warrant bounds have their own shape. Nothing rejects a second knob, so three systems can grow three switches.
Approach — amicode's half: the datum formalized in the warrant-bounds schema (the schema package), with a rejection test (warrant-bounds parsing rejects UNKNOWN device fields — "no second knob" made mechanical), and the counterpart reads named as merge-gated follow-ons in the SEAM 4 contract note (the P4 gate's end-to-end read requires strumento #75 MERGED; Telaio's conformance is theirs).
Scope — in: the schema datum + the rejection test + the tool-surface alignment · out: the P4 gate itself (#75), Telaio's warrant deserialization (their campaign's criterion), any enforcement beyond schema rejection.

Acceptance Criteria

• device_profile_datum_in_warrant_bounds == 1 — the warrant-bounds schema formally defines device as the enum {none, ro, rw} with the datum's semantics documented (none = no device access; ro = read-only device access; rw = device writes permitted, gated by the real-board-session human gate)
• warrant_schema_rejects_unknown_device_fields == 1 — a rejection test: warrant-bounds parsing refuses a bounds object carrying any device field outside the enum (the "no second knob" test)
• The three-systems contract is stated once: amicode's bounds (this slice), the P4 gate's read (merge-gated on strumento WIP night spike: pulse-designer Layer-0 — interview → entities → solve, e2e green #75), Telaio's conformance (their campaign) — cross-referenced from the SEAM 4 contract note, no system's criterion claimed as another's

Testing Decisions

Schema tests in the schema package's existing suite (the roundtrip/rejection patterns); the tool-surface alignment rides the extension's existing warrant tests.

Key Decisions

• The datum is an enum with documented semantics, not a free string — three states, three documented meanings.
• amicode's rejection test protects amicode's side only; the doctrine's cross-system conformance lives in the contract note (the merge-gated criteria are NAMED, not verified here).

Constraints & Invariants

• No enforcement beyond schema rejection in this slice — the gate enforcement is P4's (WIP night spike: pulse-designer Layer-0 — interview → entities → solve, e2e green #75); the human gates stand unchanged.
• The datum composes with the existing approval-warrant flow (max_solves, tier, size_class) — additive.

Prior Art

The amicode_request_approval tool's bounds surface (device already informally present); the spec's SEAM 6 section (design-of-record); the fleet capability profiles spec Rev 4 (the device: none|ro|rw doctrine at the product layer); the amico depth-1 spec §6.1 (the P4 rider).

Source

Part of #679 (the codesign PRD) · design-of-record: specs/spec-20260831-120000-amicode-outside-lab-codesign.md (SEAM 6) · no blockers (the amicode half; counterpart reads merge-gated elsewhere).

Notes

Third-wave decomposition of the codesign PRD. Small by design — the datum is the foundation the P4 enforcement and Telaio conformance build on.