Record indexes | OPFiles

Record index

The backlog

backlog_item.index.toml namespace BI .working/toml/

One record per unit of planned work, with a permanent ID, a closed set of states, and a "done" that is ratified, not felt.

Template

.working/toml/backlog_item.index.toml

schema = 1
  [[record]]
  id     = "BI-42"
  type   = "backlog_item"
  status = "active"
  title  = "Add the drift gate to CI"

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape: schema = 1 plus an array of [[record]] rows. Each record carries the standard envelope: id, type, status, title, created_at and updated_at (RFC 3339 UTC, read from the clock), actor.kind (maintainer, assistant, automation, or importer), optional summary, links (a closed vocabulary: supersedes, resolves, remediates, receipt_of, corrects, follows, relates, exemplifies, derives_from), refs (captured external sources: path, url, or doc), and registered x-<vendor> extensions. Schemas are closed; an unknown key is a validation failure.

The problem it solves

A backlog that lives in prose drifts: items vanish, "done" means different things, and blocked work hides.

Typed records give each item a permanent ID, a closed state set, and a ratification step: an assistant or automation finishing an item lands done/proposed, and only a maintainer transition removes the qualifier. Blocked-ness is deliberately never a stored state; it is derived from active blocks at view time, so it can never go stale in the record.

Pairs with

TODO.md BACKLOG.md PIPELINE.md

Three composed views draw on this index joined against blocks, all byte-drift-gated and rendering the actionability join. An optional BACKLOG_ITEM-INDEX.md mirror renders the index one-to-one for human reading.

Lifecycle

open → active → done | dropped

Open may go straight to dropped. No resurrection: a record in an unqualified terminal state never re-enters a working state, so a revived concern is a new record linking the old one. A ratified done creates a one-to-one completion receipt in the done index, and an item is actionable while open or active with no unqualified active block scoping it.

Referenced by

opf init opf render opf doctor

Created by opf init (empty index), then records by process as work is planned; updated by state transitions under the status grammar and maintainer ratification of proposed terminals; read by opf render and validated by opf doctor (schema validity, ID uniqueness, transition legality, no-resurrection).

What it protects

A ratified "done", not a felt one

A backlog whose completion claims are gated: "done" is a ratified transition with a durable receipt, not a feeling, which helps prevent silent scope loss and unratified completion from entering the record.

Record index

Completion receipts

done.index.toml namespace DN .working/toml/

A durable completion receipt, created in its single terminal state and immutable from birth, linked one-to-one to the backlog item whose ratified completion it witnesses.

Template

.working/toml/done.index.toml

schema     = 1
  [[record]]
  id         = "DN-42"
  type       = "done"
  status     = "recorded"
  links      = [{ rel = "receipt_of", id = "BI-42" }]

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape (schema = 1 plus [[record]] rows) with the standard envelope and no type-specific extra fields. The single state is recorded, with no transitions and never proposable: a factual receipt awaits no ratification, so it carries no /proposed qualifier. It links receipt_of to the backlog item it witnesses; a standalone receipt is legal only for imported history with provenance.

The problem it solves

Completion needs its own artefact.

If "done" were only a state flag on the backlog item, the moment of completion, who ratified it, and what it covered would be reconstructable only from history. A separate immutable receipt makes each completion a first-class, linkable fact.

Pairs with

DONE.md

Composed from this index, plus the optional DONE-INDEX.md mirror; both byte-drift-gated.

Lifecycle

recorded (terminal only)

A single state, no transitions, and never proposable: a factual receipt awaits no ratification, so it carries no /proposed qualifier. A ratified done on a backlog item creates the receipt in the same act, one to one. Like all records in unqualified terminal states other than the worklog, receipts may rotate to the calendar-year archive on manifest-declared thresholds; rotation is enumerated relocation, never deletion, so every receipt remains resolvable forever.

Referenced by

opf init opf render opf doctor

Created by opf init (empty index), by the ratified-done transition, and by the importer for migrated history with provenance; never updated, since records are immutable, though rotation relocates aged receipts to the archive; read by opf render (DONE.md and the mirror) and validated by opf doctor (schema, uniqueness, the one-to-one receipt link).

What it protects

An audit-ready record of completion

An audit-ready record of what was finished, when, and on whose ratification. Because a receipt exists only for a ratified completion, the DONE view helps prevent proposed or asserted completion from reading as settled fact.

Record index

The finding register

finding.index.toml namespace FN .working/toml/

An observation worth acting on: something wrong, suspicious, or worth noting, that links its remediation rather than containing it and leaves open for exactly one of fixed, routed, refuted, or accepted.

Template

.working/toml/finding.index.toml

schema = 1
  [[record]]
  id       = "FN-42"
  type     = "finding"
  status   = "fixed"
  severity = "major"

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape with the standard envelope plus one type-specific field, severity. Links typically carry remediates toward the backlog item or change that fixes the finding; refs capture the evidence (a path and line, a URL, or a document and section) at the moment the claim is made.

The problem it solves

Defects argued about in chat disappear; defects recorded with permanent IDs get resolved or explicitly accepted.

Two rules keep the record honest: severity is graded at or after the fix decision, never before, so triage pressure cannot downgrade a defect to avoid fixing it; and an assistant or automation closing a finding lands fixed/proposed, awaiting maintainer ratification.

Pairs with

FINDINGS.md

Composed from this index, plus the optional FINDING-INDEX.md mirror; both byte-drift-gated.

Lifecycle

open → fixed | routed | refuted | accepted

Four terminal outcomes, all proposable: fixed (remediated), routed (sent to its real owner), refuted (the observation did not hold), accepted (a recorded decision to live with it). No resurrection: a concern that returns is a new finding linking the old one.

Referenced by

opf init opf render opf doctor

Created by opf init (empty index) and by whoever observes a defect, human or assistant; updated by resolution transitions, maintainer ratification, and severity grading at or after the fix decision; read by opf render (FINDINGS.md and the mirror) and validated by opf doctor (schema, uniqueness, transition legality).

What it protects

A register that cannot quietly shrink

A defect register that cannot quietly shrink: every confirmed observation has a permanent row that leaves only through a named, ratified outcome. This helps prevent the silent disappearance of inconvenient findings.

Record index

Pending decisions

pending_decision.index.toml namespace PD .working/toml/

A question that must be answered before dependent work settles: open until decided or withdrawn, with an all-or-none resolution bundle.

Template

.working/toml/pending_decision.index.toml

schema     = 1
  [[record]]
  id         = "PD-42"
  type       = "pending_decision"
  status     = "decided"
  decision   = "Ship the drift gate in 1.1.0"
  decided_at = "2026-09-04T09:37:48Z"
  decided_by = "maintainer"

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape with the standard envelope plus the resolution bundle fields: decision, decided_at, and decided_by. An open decision carries none of the three; a decided one carries all three. A decided record may be superseded by a new decision linking supersedes; the decision-resolution join walks that chain to find the current effective resolution.

The problem it solves

Half-recorded decisions are worse than none.

A decision with no decider, or a decider with no decision text, cannot be audited or relied on. The all-or-none bundle makes a partial resolution a validation failure rather than a lurking ambiguity, and the supersession chain keeps exactly one current effective resolution per question.

Pairs with

DECISIONS.md DECISIONS.toml

The composed DECISIONS.md (drawing on all four decision types) and the machine projection DECISIONS.toml, both byte-drift-gated, plus the optional PENDING_DECISION-INDEX.md mirror.

Lifecycle

open → decided | withdrawn

Both terminal states are proposable: an assistant-recorded resolution lands with the /proposed qualifier until a maintainer ratifies it. Overturning a decided question is a new record that supersedes the old; the old record is never edited back to open.

Referenced by

opf init opf render opf doctor

Created by opf init (empty index) and whenever a question is parked for decision; updated by the deciding transition with its full bundle and by supersession from later decisions; read by opf render (DECISIONS.md, DECISIONS.toml, the mirror) and validated by opf doctor (schema, the all-or-none bundle, exactly one effective resolution per chain).

What it protects

Decisions with provenance

Decisions with provenance: who decided, when, and what exactly, with the current answer always derivable by machine. This helps prevent stale or contradictory decision records from steering later work.

Record index

Self-made decisions, on the record

autonomous_decision.index.toml namespace AD .working/toml/

A call an actor was authorized to make itself: the classification basis that put it inside that authority, the action taken, and links to what it affected. Created terminal, immutable, and awaiting no ratification.

Template

.working/toml/autonomous_decision.index.toml

schema = 1
  [[record]]
  id             = "AD-1"
  type           = "autonomous_decision"
  status         = "recorded"
  title          = "Retry the flaky fixture on timeout"
  classification = "within standing authority: reversible, internal"
  action         = "added a bounded retry to the fixture setup"
  actor          = { kind = "assistant" }

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape with the standard envelope plus two type-specific fields: classification (the basis that classified the decision as the actor's to make) and action (what was done). There are no transitions; overturning is always a new linking record. Because each record is typed and linked, views and audits can walk from any action back to the authority claim beneath it.

Autonomy without a trail erodes oversight.

The problem it solves

Recording every self-made call with its basis makes autonomous operation reviewable after the fact: a maintainer can audit what was decided under standing authority and overturn anything, not by editing the record, but by a new record or a maintainer decision that links the old one.

Pairs with: DECISIONS.md DECISIONS.toml AUTONOMOUS_DECISION-INDEX.md
The composed decisions view, its TOML projection, and the optional one-to-one mirror.
Lifecycle: recorded
A single state, created terminal and immutable: written at the moment the decision is enacted, awaiting no ratification and carrying no /proposed qualifier. The trail cannot be tidied retroactively; it is overturned only by a new linking record.
Referenced by: opf init opf render opf doctor
init scaffolds the empty index; render composes the views; doctor checks schema and ID uniqueness. Nothing updates it; it is immutable.

What it protects

Reviewable autonomy: standing authority comes with a recorded, immutable trail, which helps prevent quiet scope creep in what an assistant decides for itself.

← pending_decision · maintainer_decision →

Record index

Rulings the maintainer made

maintainer_decision.index.toml namespace MD .working/toml/

A created-terminal, immutable ruling carrying its decision, the answer plus its rationale. Its actor kind is restricted to maintainer or importer alone.

Template

.working/toml/maintainer_decision.index.toml

schema = 1
  [[record]]
  id       = "MD-1"
  type     = "maintainer_decision"
  status   = "recorded"
  title    = "Ship the drift gate in 1.1.0"
  decision = "yes; the gate blocks merge on any view drift"
  actor    = { kind = "maintainer" }

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape with the standard envelope plus decision. A ruling may link exemplifies to the preference pattern it instantiates, feeding the distillation of standing preferences from individual rulings. It is baseline as of spec 1.1.0 (it was module-tier in 1.0.0); the additive schema upgrade carries a populated 1.0.0 governance-module index forward byte for byte.

The record, not the conversation, is the source of truth: a ruling made in chat and never recorded did not happen.

The problem it solves

Making rulings a distinct immutable type separates what the maintainer decided from what anyone proposed, and the attribution restriction makes that separation structural: a maintainer ruling with assistant attribution is a contradiction the schema refuses, and importer attribution covers migrated history.

Pairs with: DECISIONS.md DECISIONS.toml MAINTAINER_DECISION-INDEX.md
The composed decisions view, its TOML projection, and the optional one-to-one mirror.
Lifecycle: recorded
A single state, created terminal and never proposable: recorded the session it is made, with no transitions. Overturning is a new record linking the old one.
Referenced by: opf init opf render opf doctor
init scaffolds the empty index, the importer fills migrated history; render composes the views; doctor checks schema, the actor-kind restriction, and uniqueness. Nothing updates it; it is immutable.

What it protects

An authoritative, immutable register of the human's rulings, which helps prevent a decision from being re-litigated, mis-remembered, or silently reattributed.

← autonomous_decision · preference_pattern →

Record index

Standing preferences, distilled

preference_pattern.index.toml namespace PP .working/toml/

The reusable rule beneath a family of individual rulings, carrying its context and rationale with the envelope's title. It is active until retired.

Template

.working/toml/preference_pattern.index.toml

schema = 1
  [[record]]
  id        = "PP-1"
  type      = "preference_pattern"
  status    = "active"
  title     = "Prefer the smallest correct change"
  context   = "when a change could be broadened past its requirement"
  rationale = "scope creep is where regressions and review cost hide"
  actor     = { kind = "maintainer" }

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape with the standard envelope plus context and rationale. Maintainer decisions may link exemplifies toward the pattern they instantiate, so the evidence for a pattern accumulates as links. It is baseline as of spec 1.1.0 (module-tier in 1.0.0); a populated 1.0.0 decision-support index is preserved as is by the schema upgrade.

Individual rulings answer individual questions; patterns keep the maintainer from answering the same question forever.

The problem it solves

Distillation is useful and risky in equal measure, so the standard gates it: an assistant-distilled pattern lands active/proposed and steers nothing until a maintainer ratifies it to the unqualified active.

Pairs with: DECISIONS.md DECISIONS.toml PREFERENCE_PATTERN-INDEX.md
The composed decisions view, its TOML projection, and the optional one-to-one mirror.
Lifecycle: active → retired
active is the initial, gated state; retired is terminal when a preference no longer holds. Entering the gated state as an assistant or automation takes /proposed until a maintainer ratifies, the same gating mechanism as block and contribution.
Referenced by: opf init opf render opf doctor
init scaffolds the empty index; maintainers record patterns directly and assistants as gated proposals; render composes the views; doctor checks schema and gated-state legality.

What it protects

Standing preferences that are explicit, ratified, and able to be retired, which helps reduce repeated clarification and helps prevent an assistant's own inference about "what the maintainer wants" from hardening into unratified policy.

← maintainer_decision · block →

Record index

Blocks

block.index.toml namespace BL .working/toml/

A record that named work cannot proceed: it scopes an enumerated list of record IDs and feeds the actionability rule, so only a maintainer-ratified active block hides work.

Template

.working/toml/block.index.toml

schema = 1
  [[record]]
  id     = "BL-42"
  type   = "block"
  status = "active"
  scopes = ["BI-42", "BI-43"]

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape with the standard envelope plus scopes, the enumerated record IDs the block covers. States: active (initial, gated) to released or expired (terminal). Blocked-ness is never stored on the scoped records; it is derived at view time through the block join.

The problem it solves

"Blocked" is one of the easiest states to abuse: it can park inconvenient work indefinitely.

The standard makes a block a scoped, auditable record rather than a mood, and gates its creation: a block created by an assistant or automation is active/proposed, a proposal that hides nothing and justifies no stop until a maintainer ratifies it. Moving work to blocked is the maintainer's decision, structurally.

Pairs with

BLOCKS.md TODO.md BACKLOG.md PIPELINE.md

BLOCKS.md is composed from this index, and the block join renders inside TODO.md, BACKLOG.md, and PIPELINE.md; an optional BLOCK-INDEX.md mirror completes the set. All byte-drift-gated.

Lifecycle

active (gated) → released | expired

An unqualified active block hides the records it scopes from actionable views; a proposed or terminal block hides nothing. The block-actionability join is one of exactly two named joins in the closed transform vocabulary. Active blocks never rotate to the archive.

Referenced by

opf init opf render opf doctor

Created by opf init (empty index), by maintainers directly, and by assistants as gated proposals; updated by ratification, release, or expiry transitions; read by opf render (BLOCKS.md and the actionability join in the three backlog views) and validated by opf doctor (schema, gated-state legality, scoped-ID resolution).

What it protects

Blocks you can audit

Blocks that are visible, scoped, and ratified, which helps prevent manufactured stops: work reads as blocked only on a grant the record can show.

Record index

The session handoff

handoff.index.toml namespace HO .working/toml/

The durable state snapshot a session resumes from, current until superseded, with at most one current handoff at any time.

Template

.working/toml/handoff.index.toml

schema  = 1
  [[record]]
  id      = "HO-42"
  type    = "handoff"
  status  = "current"
  summary = "Drift gate merged; OPF verbs next"

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape with the standard envelope and no type-specific extra fields; the handoff's content rides summary, links, and refs. States: current (initial) to superseded (terminal).

The problem it solves

Sessions end, contexts truncate, and whatever lived only in conversation is gone.

A records-first discipline resumes from the durable handoff rather than starting cold, and the single-current rule means there is never ambiguity about which snapshot is authoritative. A handoff records where the work stands, what is in flight, and what comes next.

Pairs with

HANDOFF.md

Composed from this index, plus the optional HANDOFF-INDEX.md mirror; both byte-drift-gated.

Lifecycle

current → superseded

Posting a new handoff supersedes the previous one in the same act, so at most one current handoff exists; supersession is atomic with posting, the new handoff and the old one's terminal transition landing together. The current handoff never rotates to the archive, and the chain of superseded handoffs remains a readable history of how the work's state evolved.

Referenced by

opf init opf render opf doctor

Created by opf init (empty index) and by a new record at each session close or state checkpoint; updated only by supersession, in the same act as the next handoff's posting; read by session resume, by opf render (HANDOFF.md and the mirror), and validated by opf doctor (schema, the at-most-one-current invariant).

What it protects

Continuity across sessions

Continuity across sessions and machines: resuming from the recorded handoff helps reduce cold-start reconstruction and helps prevent constraints and in-flight state from lapsing when a context is lost.

Record index

Sources, captured at the claim

reference.index.toml namespace RF .working/toml/

An immutable captured source, a repository path (with a line where applicable), a URL, or a document and section, recorded at the moment a claim or artefact that rests on it is produced.

Template

.working/toml/reference.index.toml

schema = 1
  [[record]]
  id     = "RF-1"
  type   = "reference"
  status = "recorded"
  title  = "OPF spec, the record envelope"
  refs   = [{ kind = "doc", locator = "OPF-SPEC.md#8", note = "envelope fields" }]
  actor  = { kind = "assistant" }

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape with the standard envelope and no type-specific extra fields; the captured sources themselves ride the envelope's refs array, each entry {kind, locator, note} with kind one of path, url, or doc. This type is the inward counterpart of contribution, which records what the project sends out.

A reference reconstructed later from memory is a guess wearing a citation's clothes.

The problem it solves

The standard's rule is capture-at-claim: a record whose claims rest on an external source without a captured reference is unsourced, whatever confidence backs it. Making references a first-class immutable type lets many records share one captured source.

Pairs with: REFERENCES.md REFERENCE-INDEX.md
The composed references view and the optional one-to-one mirror, both byte-drift-gated.
Lifecycle: recorded
A single state, created terminal, immutable, and never proposable: a captured fact awaits no ratification. Records link toward references rather than editing them, so a source, once captured, stays exactly what was captured.
Referenced by: opf init opf render opf doctor
init scaffolds the empty index; render composes the view; doctor checks schema and uniqueness; and any record that links to its captured sources reads it. Nothing updates it; it is immutable.

What it protects

Claims with their evidence attached at birth, which helps reduce the likelihood of unsourced assertions hardening into recorded fact, and makes every load-bearing claim re-checkable at its source.

← handoff · contribution →

Record index

Work sent to a peer project

contribution.index.toml namespace CN .working/toml/

An artefact, fix, or proposal this project sent to a peer project, with a delivery receipt: the outward counterpart to reference, which records what comes in.

Template

.working/toml/contribution.index.toml

schema = 1
  [[record]]
  id             = "CN-1"
  type           = "contribution"
  status         = "sent/proposed"
  title          = "Drift-gate fix sent upstream"
  recipient      = "peer-project"
  dedup_class    = "drift-gate-fix"
  content_digest = "sha256:..."
  delivery       = { channel = "pr", ref = "peer/repo#128", sent_at = "2026-09-04T09:37:48Z" }
  actor          = { kind = "assistant" }

Illustrative excerpt: the envelope fields (created_at, updated_at, actor) are omitted for brevity.

The shared index shape with the standard envelope plus recipient, dedup_class, content_digest, and the delivery bundle {channel, ref, sent_at, receipt_ref?, receipted_at?}: channel, ref, and sent_at are required once sent and forbidden before, and the receipt fields are legal only at acknowledged. acknowledged is the single positive terminal (responded, adopted, reshaped, or declined); the outcome lives in summary or an extension, never as a state. A contribution typically links derives_from the internal finding, decision, or backlog item that motivated it, and carries no fleet-specific semantics; those ride a registered x-<vendor> extension.

Outbound work is an external action, so its claim, "we sent this", is gated.

The problem it solves

An assistant lands sent/proposed, awaiting a maintainer's ratification that it was genuinely sent, unless the adopter has declared a standing authorization for that named recipient. An absent or malformed declaration fails closed, so gating stays on by default.

Pairs with: CONTRIBUTIONS.md CONTRIBUTION-INDEX.md
The composed contributions view and the optional one-to-one mirror, both byte-drift-gated.
Lifecycle: proposed → sent → acknowledged | superseded
Or from proposed straight to withdrawn. Entering the gated sent state as an assistant or automation takes /proposed, the same mechanism as block and preference-pattern gating; a re-send is a new record linking supersedes.
Referenced by: opf init opf render opf doctor
init scaffolds the empty index; render composes the view; doctor checks schema, the delivery-bundle completeness rules, and gated-state legality. Updated by the send transition, acknowledgement, supersession, or withdrawal.

What it protects

An auditable record of the project's recorded outbound actions, with delivery evidence attached, which helps prevent an asserted send from reading as a settled fact before it is ratified or receipted.

← reference · Module and importer types →

Modules

Optional modules and importer types

4 optional modules 8 record types + 1 importer-only

Beyond the twelve baseline types, eight record types ship in four optional modules, one type belongs to the importer alone, and two names are reserved. Modules are default-off, each enabled by one manifest edit.

The module and importer types

Governance

One type: maintainer_action (MA), moving open → done | dropped.

Delivery assurance

Four types: artifact (AR, staged → promoted | rejected), gate_run (GR, a recorded three-valued verdict of pass | fail | cannot_evaluate never folded into status), release (RL, planned → published | abandoned), and waiver (WV, active → expired | revoked, expiry required at creation).

Operational policy

Two types: mode (MO, active → retired) and tier_assessment (TA, recorded).

Concurrent operation

One type: session_lease (SL), moving held → released | reconciled.

Importer-only

No module toggle: legacy_fragment (LF, quarantined → resolved | ignored) is created only by opf import, never scaffolded, holding whatever an import cannot confidently map.

The full type list

  Governance module
    maintainer_action   MA   open → done | dropped
  Delivery-assurance module
    artifact            AR   staged → promoted | rejected
    gate_run            GR   recorded, with a three-valued verdict field
                             (pass | fail | cannot_evaluate), never folded into status
    release             RL   planned → published | abandoned
    waiver              WV   active → expired | revoked; expiry required at creation
  Operational-policy module
    mode                MO   active → retired
    tier_assessment     TA   recorded
  Concurrent-operation module
    session_lease       SL   held → released | reconciled
  Importer-only (no module toggle)
    legacy_fragment     LF   quarantined → resolved | ignored
  Reserved
    transaction         TX   excluded from the adopter standard; name and namespace reserved
    (none)              CL   reserved unassigned, so it can never half-collide with "changelog"

These are outline state sets; the full module record schemas ship with the module schemas release. The delivery-assurance release record, where enabled, references a version.toml release row by version string: the ledger row is the fact, the record is the delivery-assurance envelope around it.

legacy_fragment is created only by an importer, never scaffolded: everything an import cannot confidently map becomes quarantined fragment data with source path, digest, span, and run ID, so nothing is dropped. The scaffolded counters file already carries the LF namespace at zero, so a fresh store can accept quarantine imports without a schema change. Module-type index mirrors are deferred until the module record schemas ship; the reference renderer covers the baseline types today and reports a per-record layout or an unknown view as a clear cannot-evaluate rather than guessing.

The problem it solves

Not every project needs delivery assurance or operational-policy records on day one.

Default-off modules keep the baseline small while keeping the extended vocabulary standard: when a project grows into a capability, the types, namespaces, and states are already defined, so no adopter invents an incompatible local variant. Enabling a module makes its types valid to declare, each with its normative namespace; a module-tier type declared without its module enabled is a validation failure.

Enabled by: manifest.toml
One manifest edit per module, under the adopter's own review flow.
Created by: opf import
By process, once a module is enabled; legacy_fragment by opf import alone.
Read by: opf doctor
opf doctor for module-toggle validity (a declared module type requires its enabled module); the AIQT profile, which requires the governance, operational-policy, and concurrent-operation modules.

What it protects

Growth without fragmentation

Capability arrives as a reviewed manifest edit with standard semantics, which helps prevent per-project dialects of the same operational ideas.