Control Plane Runtime

The control plane is the governance layer for agentic execution. It turns incoming intent into deterministic plans, enforces risk policy before side effects, and records replayable traces for audits.

Canonical execution loop

1. Accept intent and create execution identity + trace context.
2. Compile intent into a typed, deterministic plan DAG.
3. Verify plan against policy and risk rules.
4. Route into autonomous or assist mode based on verdict.
5. Execute steps with idempotent keys and explicit stage events.
6. Persist outcomes for replay, audits, and operator visibility.

Contract surfaces (v1 baseline)

The runtime is contract-first. Commands, queries, events, and capabilities are explicit and versioned under @contractspec/lib.contracts-spec.

Commands
- controlPlane.intent.submit
- controlPlane.plan.compile
- controlPlane.plan.verify
- controlPlane.execution.start
- controlPlane.execution.approve
- controlPlane.execution.reject
- controlPlane.execution.cancel
- controlPlane.skill.install
- controlPlane.skill.disable

Queries
- controlPlane.execution.get
- controlPlane.execution.list
- controlPlane.trace.get
- controlPlane.policy.explain
- controlPlane.skill.list
- controlPlane.skill.verify

Events
- controlPlane.intent.received
- controlPlane.plan.compiled
- controlPlane.plan.rejected
- controlPlane.execution.step.started
- controlPlane.execution.step.blocked
- controlPlane.execution.step.completed
- controlPlane.execution.completed
- controlPlane.execution.failed
- controlPlane.skill.installed
- controlPlane.skill.rejected

Capabilities
- control-plane.core
- control-plane.approval
- control-plane.audit
- control-plane.skill-registry
- control-plane.channel-runtime

Policy and safety posture

• No side-effect action executes unless it comes from a compiled plan.
• High-risk actions are blocked from autonomous mode in v1.
• Approval commands provide explicit human-in-the-loop transitions.
• Skill installation is modeled as governance-controlled operations.
• Trace queries expose policy rationale and step outcomes for replay.

Implementation map

packages/libs/contracts-spec/src/control-plane/
  commands/
  queries/
  events/
  capabilities/
  contracts.ts
  contracts.test.ts

packages/apps/web-landing/src/app/docs/architecture/control-plane/page.tsx
implementation_plan_controle_plane.md

What comes next

WS1 delivers the contract fabric. Next increments add planner/executor split, policy escalation, capability-bound authorization, signed skill compatibility checks, and full replay tooling.