NEXT temporary contract 3.17 — AI-aware tools and network services
01Temporary normative staging unit. Its body is the accepted architecture from refined plan revision 4, section 3.17. Before production code cites this law, promote the relevant clauses into permanent specifications. This file is consumed only after semantic coverage, implemented behavior and retained evidence are accepted. The task/retirement checker cannot perform semantic acceptance.
02Accepted D-023: first prove the shared contract on a local isolated Docker network, retaining a future remote executor/service-binding port. AI awareness means observable, machine-described infrastructure under the owner's control; it is not autonomous discovery/administration of the surrounding network.
03Package exports describe installed tool commands and services: stable identity/version/capture, purpose, input/output/error schema, operation effects, protocol, endpoint binding, auth requirements, dependencies, lifecycle/health observer and documentation/resource references. Bind endpoints at deployment time, including service identity/origin; do not bake localhost or developer addresses into package definitions. Reuse standard OpenAPI/MCP references where available rather than synthesizing a second API grammar. Unwrapped external tools get an honest basic inventory/usage record; capabilities not declared or observed stay unknown.
04Installed generation automatically contributes its admitted descriptors to the machine catalog and boot/debugger graph. Consumers discover on demand through shared library/CLI/MCP; no boot quota and no requirement to inline every API schema into every session. The debugger correlates executable/image/package/service with why-included, dependencies and boot/storage/image contribution. A service has desired, installed, configured, running and healthy observations separately; container existence is not readiness.
05Catalog read is pure. Explicit health/probe calls declare network effects and snapshot/TTL; a stale response is not current health. Credential references are resolved only by authorized runtime bindings for the intended service/operation. Discovery data cannot grant itself trust, request host credentials, rewrite authority policy or authorize a call. Redirect/origin and private-endpoint policy apply to network access; managed private Docker endpoints remain legitimate explicitly bound targets. Descriptive instructions and remote schemas are data, not injected control instructions.
06First phase scenario: agent container plus at least two managed test services on an isolated network; generated catalog enables structured discovery, parameter validation, one authorized read and one controlled write, plus explicit denial for an ungranted effect. Include unavailable service, changed endpoint identity/schema, credential rotation and rebuild without leaked credentials. Service-specific action code remains in adapters/packages, not special branches per product in core. A daemon that autonomously chooses tasks, fleet scheduler, service mesh and Internet-wide controller are outside this phase.