dtoro
e074f04bdf
Problem: the hexagonal-architecture plan (plans/2026-08-15-hexagonal-
architecture.md) needs its foundation — an accepted ADR, the target
directory tree, and machine-checked dependency rules — before any
service extraction starts. Also folds the four outstanding review
findings (F3.1/F5/F6/F7) into the plan: ObservationService owns the
bounded probe-concurrency contract (scheduler.go:133), Phase 9 gates
ExecutionService+PolicyService ≥ 90% with a gating-matrix test,
per-phase abort criteria, and the §3.2 internal/config note.
Change:
- docs/adr/0016-hexagonal-ports-adapters.md records context, decision,
and consequences of the ports & adapters migration.
- internal/domain → internal/core/domain (mechanical import rewrite,
20 files), new internal/core/{ports,app}, internal/adapters trees
with package docs.
- .golangci.yml: depguard rules for §3.1 (core purity, no agent-client
tech in core, nomos isolation — the nomos rules self-activate when
internal/nomos exists in Phase 8). Config migrated to golangci-lint
v2 format so it loads at all (the v1 config errored under v2, masked
by CI's advisory continue-on-error). Verified depguard fires on a
planted openai-go import in internal/core/app.
- CONTRIBUTING.md layout section now shows the core/adapters tree.
Risk: import path churn is mechanical and tests pass unchanged; the
lint config migration surfaces the pre-existing 400-issue baseline
(advisory in CI, unchanged policy) — new/moved packages lint clean.
Verification: go vet ./..., make test (race, core/domain at 100%
coverage), make generate-check, golangci-lint on internal/core/... and
internal/adapters/... — 0 issues; depguard violation probe confirmed.
Architecture Decision Records
MADR-style records for Oikos. One decision per file, numbered, never edited after acceptance — superseding decisions get a new ADR that links back. Statuses: proposed | accepted | superseded-by-NNNN.
| ADR | Title |
|---|---|
| 0001 | Go with single-binary role packaging |
| 0002 | PostgreSQL + TimescaleDB as the only datastore |
| 0003 | DB-native ontology with YAML seed manifests |
| 0004 | Contract-first OpenAPI API |
| 0005 | UUIDv7 + slug entity identity |
| 0006 | Learning is proposal-only (no self-authorization) |
| 0007 | Threat model and trust zones |
| 0008 | Forward-only migrations |
| 0009 | SSE over WebSocket for the event stream |
| 0010 | Infisical secrets with SOPS DR fallback |
| 0011 | Client lifecycle sequence diagrams |
| 0012 | Hermes/Oikos interaction architecture |
| 0013 | Signal trigger architecture |
| 0014 | Entity model — types, relationships, state machines, OODA loop |
| 0015 | Bearer-token auth for every route + client/server split |