RigelBuild · rigel-mintaka · Aug 31, 2026
@@ -145,6 +145,15 @@ check enforces the mechanical half. Full rationale:
 | DL-288 | The profile's model axis resolves through the RIG-1715 LLM gateway (single egress; agents hold no provider creds) and REFERENCES the RIG-2845 role taxonomy + stable-name routing policy — this record delivers per-Manager profile selection + propagation, RIG-2845 owns the policy the model fields name, and RIG-1716 is where the deferred extensions axis will resolve | Active (Matt, 2026-08-29) | [per-Manager profiles §Adjacency](agent/compass-per-agent-overrides/design.md#adjacency-compose-do-not-duplicate) |
 | DL-289 | The agent-facing spawn path may carry `profile` — a Manager may select its subtree's profile (RIG-2937 ruled YES, unconditional): no selectable-set policy, no cross-family conditioning (cross-family stays an advisory `profiles/` PR-review check, not a door lint); the oversight-degradation-by-composition residual risk is accepted; owner-fence and set-at-creation-only are unchanged | Active (Matt, 2026-08-29) | [per-Manager profiles §Two-layer contract](agent/compass-per-agent-overrides/design.md#the-two-layer-contract-reframed-at-profile-granularity) |
 | DL-290 | A profile-named model that fails registry resolution FAILS LOUD on ALL sessions (every session carries a profile; `default` included) — the spawn fails with a frame-visible error (the Manager belt `cli.ts:991-1005` fires on `session.model === undefined`); a model that resolves but has no working auth fails loud as a frame-visible HARD error (at spawn if T6 auth-pre-flights the pinned model, else at first turn), never a silent substitution. Compass never relies on the SDK's built-in silent auth-fallback substitution | Active (Matt, 2026-08-29) | [per-Manager profiles §T6](agent/compass-per-agent-overrides/design.md#t6--agent-profile-resolution--model-stack-render) |
+| DL-325 | The runner end state splits by trust model (RIG-3070): untrusted multi-tenant operation requires the microVM hardware boundary (KVM, unchanged); self-host single-tenant deployments keep podman as a permanent, supported entry tier requiring no `/dev/kvm`, with microVM the recommended (not required) upgrade for defense-in-depth or an operator running untrusted code. When and how a hosted multi-tenant service sequences its move to microVM-only is a managed-plane rollout decision, out of scope here. AMENDS the frozen KVM-only amendment (`microvm-kvm-only-amendment.md:96-97`, "A KVM-absent host does not get a lesser boundary; it does not run") with a self-host carve-out; RATIFIES DL-259's stack SHAPE (host-level bring-up, no compose/Swarm) and PARTIAL-SUPERSEDES its KVM-machine clause BY CITATION for the podman entry tier (matching DL-319's treatment of the same clause; DL-259 stays Active); the `ContainerRuntime` interface stays frozen; DL-235's client-only charter is REVERSED by DL-319 (the compass-native embedded-mode-revival record, `ui/compass-native-embedded-revival/design.md`), which carries this record's trust-model rationale, and this record does not itself alter compass-app architecture | Active (Matt, 2026-08-31) | [runner topology & adoption §The ruled topology](infra/runtime/compass-runner-adoption-strategy/design.md#the-ruled-topology) |
+
+> Ledger note: DL-325 (the trust-model runtime split, RIG-3070) was drafted
+> and cited as DL-318 by the compass-native embedded-revival record
+> (`ui/compass-native-embedded-revival/design.md`); a concurrent-merge window
+> then allocated DL-318 to the unrelated RIG-2616 error/abort `SessionError`
+> row (below), so the split landed as DL-325. That merged record's frozen
+> prose still cites DL-318 for this row; resolve those stale cites through
+> this note (the freeze rule adds, never rewrites frozen prose).
 
 ## Comms & tools
 

@@ -0,0 +1,70 @@
+# Elastic session runtime — amendment: microVM KVM-only carved out for self-host single-tenant
+
+> **Design amendment.** Amends the frozen microVM KVM-only amendment
+> (`docs/designs/infra/runtime/compass-elastic-session-runtime/microvm-kvm-only-amendment.md`,
+> RIG-1717/RIG-2394, ruled by Matt 2026-08-23). That amendment is frozen and is
+> **not** rewritten in place (a later change adds a record, never rewrites the
+> frozen one); this amendment records the self-host carve-out ruled by Matt
+> (2026-08-31, DL-325) and is the authority where it and the KVM-only amendment
+> disagree. Every citation is a path in the **`RigelBuild/compass`** monorepo.
+
+Status: Active — ruled by Matt (2026-08-31)
+Tracking: RIG-3070 (runner adoption strategy)
+Amends: RIG-1717/RIG-2394 microVM KVM-only amendment (`microvm-kvm-only-amendment.md`)
+Refs: DL-325; runner-adoption-strategy record (`../compass-runner-adoption-strategy/design.md`, §The ruled topology)
+
+## Problem / Intent
+
+The KVM-only amendment reads as an absolute end-state: "the runtime is
+KVM-only; it does not degrade to the container runtime"
+(`microvm-kvm-only-amendment.md:34-35`), and "A KVM-absent host does not
+get a lesser boundary; it does not run" (`:96-97`). That posture was ruled
+for the boundary whose purpose is isolating **untrusted tenants** from each
+other.
+The runner-adoption-strategy record (DL-325, RIG-3070) splits the runner end
+state by trust model, which carves the podman entry tier back in for
+**self-host single-tenant** deployments — where the operator is the only
+tenant and there is no untrusted code to isolate. A reader grounding in the
+KVM-only amendment sees the absolute with no pointer to that carve-out; this
+amendment supplies the pointer so the frozen amendment is not silently wrong
+— the reconciliation mechanism its own Alternatives named (the
+`virtualfs-descope-amendment.md` precedent in this directory).
+
+## Approach
+
+**The KVM-only posture is RATIFIED for untrusted multi-tenant operation and
+AMENDED for self-host single-tenant.** The authoritative reconciled reading
+lives in DL-325 and the runner-adoption-strategy record's §The ruled
+topology; this amendment does not restate it, it points at it:
+
+- **Untrusted multi-tenant** — unchanged. The microVM/KVM hardware boundary
+  is required; a KVM-absent host does not run. The KVM-only amendment stands
+  verbatim.
+- **Self-host single-tenant** — amended. Podman is a permanent, supported
+  entry tier requiring no `/dev/kvm`; microVM is the recommended (not
+  required) upgrade for defense-in-depth or an operator running untrusted
+  code. Podman here is a first-class runtime choice, not a fallback and not a
+  lesser boundary imposed on an unwitting tenant.
+
+The carve-out is scoped precisely: it does not reopen the KVM-only
+amendment's retirement of the *permanent KVM-absent degrade-to-container
+fallback* for the multi-tenant boundary (that stays retired); it rules that
+self-host single-tenant is a distinct deployment where podman is a chosen
+tier, not a degrade.
+
+## Alternatives considered
+
+- **Leave the KVM-only amendment as-is and rely on DL-325's override.**
+  Rejected for the same reason that amendment rejected the identical move for
+  its own parent: a frozen record read as an absolute, with no pointer to the
+  override, falsifies the end-state for a reader grounding in it. This
+  amendment is that pointer.
+
+## Tasks
+
+- [x] Self-host carve-out ruled (Matt, 2026-08-31) and recorded as DL-325.
+- [x] Pointer from the KVM-only amendment's directory to DL-325 recorded here.
+
+Spec-impact: none (the authoritative ruling is DL-325; this is the
+record-level pointer). Ledger-impact: none (DL-325 already carries the
+ruling; this amendment mints no row). Refs RIG-3070 RIG-1717 RIG-2394