AO Control Plane

English | 日本語 | 简体中文 | 繁體中文 | 한국어 | Español | Русский | Français | Deutsch | Português

Future management layer for the AO public set. Start with ao-operator; this repo is for teams that already need typed state across many AO runs.

AO Control Plane turns AO Runtime and AO Operator runs into typed, assumption-aware, replayable work records.

This repository is the first MVP slice. It does not replace AO Runtime or AO Operator. It ingests profile runs, writes typed run-state records, checks that the record is internally coherent, and compiles a portable control-plane evidence tar.

Public Repo Set

The repos are public together, but the advertisement should still name one product: AO Operator.

Repo	What it is	How to read it
ao-operator	The product: role contracts, RunSpecs, provider routing, evidence packs, release gates	Start here. Clone this first.
ao-runtime	The Rust execution engine: DAG scheduler, policy seam, event log, artifacts, workers, adapters	Read when you want to understand or embed the engine.
financial-services-profile	Flagship demo profile: citation-sensitive financial workflows over public/synthetic data	Run after AO Operator to see the regulated-workflow story.
secure-agent-profile	Reusable secure coding-agent profile: guarded patching, dependency review, PR evidence	Run after AO Operator to see policy-gated software work.
ao-control-plane	Future management layer: typed run state, evidence aggregation, release-train gates	You are here. Read this after the product and profiles.

AO Control Plane is not required to install, run, or evaluate AO Operator. It is the roadmap layer for typed run state, evidence aggregation, and release-train control once usage proves the need.

Current Proof

The MVP can ingest secure-agent, financial-services, and AO Operator proof runs. For local development, point the commands below at a run directory produced by one of the profile repos.

Use sample run paths from your own checkout; do not commit local absolute paths into public examples.

Commands

python -m ao_control_plane.cli init --repo ../secure-agent-profile
python -m ao_control_plane.cli ingest secure-agent \
  --repo ../secure-agent-profile \
  --run ../secure-agent-profile/runs/<secure-agent-run-id>
python -m ao_control_plane.cli status --state .ao-control/runs/<secure-agent-run-id>/run-state.json
python -m ao_control_plane.cli verify --state .ao-control/runs/<secure-agent-run-id>/run-state.json
python -m ao_control_plane.cli compile-pack --state .ao-control/runs/<secure-agent-run-id>/run-state.json

Financial-services proof:

python -m ao_control_plane.cli ingest financial-services \
  --repo ../financial-services-profile \
  --run ../financial-services-profile/runs/public-sec-citation-proof
python -m ao_control_plane.cli ingest financial-services \
  --repo ../financial-services-profile \
  --run ../financial-services-profile/runs/<earnings-note-run-id>
python -m ao_control_plane.cli ingest financial-services \
  --repo ../financial-services-profile \
  --run ../financial-services-profile/runs/<kyc-triage-run-id>

When the run contains public-proof.json, AO Control Plane preserves it as artifact-public-proof-summary, adds step-public-proof-summary, and records the external-publication boundary from the proof summary as a policy decision.

AO Operator-native proof:

python -m ao_control_plane.cli ingest ao-operator \
  --repo ../ao-operator \
  --run ../ao-operator/run-artifacts/<ao-operator-run-id>

Release-train proof:

python -m ao_control_plane.cli manifest \
  --output .ao-control/release-train/current/release-train-manifest.json
python -m ao_control_plane.cli train-gate \
  --output .ao-control/release-train/current

Release tag enforcement:

python -m ao_control_plane.cli train-gate \
  --output .ao-control/release-train/current \
  --require-target-tags \
  --verify-tag-signatures \
  --ao-operator-run /path/to/tagged/ao-operator/run \
  --secure-agent-run /path/to/tagged/secure-agent/run \
  --financial-services-public-proof-run /path/to/financial-services/public-proof-run \
  --financial-services-earnings-run /path/to/tagged/financial-services/earnings-run \
  --financial-services-kyc-run /path/to/tagged/financial-services/kyc-run

The train gate ingests the AO Operator, secure-agent, financial-services public-proof, earnings-note, and KYC sample runs; verifies each typed state; compiles per-run control-plane evidence packs; and then compiles one ao-release-train-evidence.tar bundle. The --require-target-tags mode fails until every product member has its configured release tag; adding --verify-tag-signatures also requires Git to verify those tags locally. The five --*-run flags let the final gate consume release-blocking fixture outputs from tagged artifacts instead of the built-in sample run paths.

Verification

python -m pytest -q