# Kernel Contracts

These are the canonical contracts for CCD's core kernel.

They define the parts of CCD that should stay stable even as hosts, models, and recall providers change.

## Boundary With RFCs

Specs contract. RFCs decide.

Use a spec for stable, implementable behavior: CLI contracts, runtime JSON
fields, provider protocols, state invariants, conformance rules, and testable
interfaces. A spec should read like something an implementer, runtime adapter,
or test harness can follow.

Use an RFC for product or architecture decisions: why CCD should add, remove, or
reshape a primitive; which options were considered; and which tradeoffs were
accepted. A spec should not re-debate an RFC-owned primitive.

If an RFC supersedes a spec idea, mark the spec body as historical/superseded
and point forward. If an accepted RFC needs precision, add or update a spec only
for the stable contract and keep rationale in the RFC.

Each spec directory contains:

- `spec.toml` for machine-readable metadata
- `body.md` for the living contract

## Core Contracts

- [state-model-core](state-model-core/body.md): separates project truth, operator state, and workspace-local runtime state
- [repo-identity-linking](repo-identity-linking/body.md): bootstraps and links workspaces safely
- [runtime-state-contract](runtime-state-contract/body.md): defines clone-local runtime state and canonical startup surfaces
- [lifeloop-lifecycle-contract](lifeloop-lifecycle-contract/body.md): defines the provider-neutral lifecycle substrate below CCD continuity
- [lifeloop-ccd-client](lifeloop-ccd-client/body.md): maps CCD ceremonies onto Lifeloop without making compatibility transports semantic owners
- [session-workflow](session-workflow/body.md): defines the attach -> start -> checkpoint/radar loop
- [thread-curls](thread-curls/body.md): defines bounded work-arc records attached to continuity threads
- [symbolic-prompt-dialect](symbolic-prompt-dialect/body.md): drafts the compact `CCD1` representation for CCD-owned agent-facing continuity surfaces; Lifeloop may transport CCD1 payloads but must not interpret them

## Beyond The Kernel

CCD also ships deeper platform and integration contracts for runtime builders, autonomous hosts, and optional extensions.

Those surfaces still matter, but they are not the newcomer index.

- [autonomous-session-lifecycle](autonomous-session-lifecycle/body.md): defines the CCD-owned lease, heartbeat, stale-session, and takeover contract for long-lived runtime sessions that Lifeloop-backed integrations may trigger
- [continuity-history-and-focus-recommendation](continuity-history-and-focus-recommendation/body.md): superseded design note; useful parts are absorbed into the thread-curls contract
- [extension-continuity-attachments](extension-continuity-attachments/body.md): drafts the transfer-capsule rail for bounded extension-owned context that must travel with a continuity thread
- [skill-sync-distribution](skill-sync-distribution/body.md): archived post-slim; `ccd skills install` now writes to the active harness's native skill layout and `ccd sync` is gone
- Memory specs such as [memory-entry-format](memory-entry-format/body.md), [memory-promotion](memory-promotion/body.md), [memory-compaction-replay](memory-compaction-replay/body.md), and [autonomous-memory-governance](autonomous-memory-governance/body.md) are historical CCD-side contracts. Memory now belongs outside CCD.

See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the full implementation matrix across kernel, platform, memory-provider, and extension contracts.
