Experiment with read-only catalog plan inspection

[myobie]

Outcome

Nathan revised the experiment after the previous exact head. Agent declarations now use only the existing childless Agent Spec Resource envelope to link to a plan-owned plan.kdl. The target file owns plan identity, owner, version graph, reasons, and intent.

st2 plan validate|list|show|inspect remains read-only, direct-KDL, catalog-bounded, no-CAS, and non-executing.

Agent Resource link

agent "worker" {
  resource "receipt-report" _tag="plan" uri="file:plans/receipt-report/plan.kdl"
}

The Resource envelope remains exactly local name + _tag + uri, with no children. The name is the agent-local role. The link can contribute the agent identity to referencedBy; it does not contribute owner or other plan truth. The file: URI resolves from the agent KDL file and must remain within the selected catalog.

The old custom plan-ref node and agent { plan { ... } } truth are rejected.

Target form A: referenced Markdown content

plan "receipt-report" {
  owner "cos"
  version "0000" content="file:versions/0000.md"
  version "0001" content="file:versions/0001.md" {
    parent "0000"
    why "The acceptance boundary changed."
  }
}

content resolves from the declaring plan.kdl and stays within the selected catalog.

Target form B: complete inline intent

plan "receipt-report" {
  owner "cos"
  version "0000" {
    intent #"""
Produce the receipt report.

Done means the report contains independently verified evidence.
"""#
  }
}

Each version must contain exactly one content="file:..." or one inline intent. A version cannot contain both. Parent existence, uniqueness, cycle rejection, required revision reasons, deterministic ordering, and the derived concurrent frontier remain unchanged.

CLI and JSON boundary

• validate: exit 0 with result=valid, plan count, and zero errors; invalid input emits the classified JSON receipt when --json is present and exits nonzero.
• list: preserves identity, owner, and frontier.
• show: preserves normalized identity, owner, versions, parents, reasons, and frontier; each version now exposes content or intent.
• inspect: preserves source provenance, sourceKind=external, and referencedBy; a content version exposes resolvedContent, while an inline version exposes intent.
• Invalid selection, parsing, missing identity, or missing plan lookup exits nonzero. No command writes, executes, schedules, reconciles, or emits an event.

Deliberate exclusions

There is no current pointer, controller, execution, schedule, step graph, retry, claim, receipt, event, reconciliation mutation, agent restart, content digest, immutable-history proof, CAS, merge, or deployment behavior. Direct KDL and direct human-to-agent planning remain complete workflows. No paid or model evaluation is included or authorized.

Evidence

Exact head: 8a76b6e71355140e5b89cd9313fcfd88c82b5cad

Merged base: 4262c195899d9e5cacf6c5ea0e792ca176d431e9

Rework after the live-main merge: 9 files, +430/-138.

Full PR against current main: 11 files, +1653/-0.

• focused model tests: 4 passed
• focused CLI parity and rejection tests: 3 passed
• strict example catalog validation: 2 agents, 0 errors, 0 warnings
• cargo check --workspace --all-targets: passed
• cargo test --workspace --doc: passed
• plan-owned Clippy with warnings denied and the four inherited lint classes allowed: passed
• changed-file rustfmt and git diff --check: passed
• serialized full workspace/all-target remainder: passed with four exact-current-main failures excluded
• hosted Nix: run 30835684680, job 91760161352 passed

The four excluded tests reproduce on exact merged base 4262c195899d9e5cacf6c5ea0e792ca176d431e9:

• tracked_product_surface_contains_only_native_names
• presentation_changes_patch_the_exact_live_pty_without_restarting_it
• managed_agents_do_not_inherit_launcher_no_color_unless_declared
• managed_agent_color_contract_crosses_systemd_scope

This PR is draft and unmerged. Nathan must review the new exact head before any ready transition or merge.

[myobie]

Nathan revised the experiment contract: agent declarations will now contribute only a childless Agent Spec Resource link to a plan-owned plan.kdl. I am moving this PR back to draft while I replace the custom plan-ref and inline agent plan forms, preserve both target intent forms, merge current main normally, and rerun the full evidence matrix. No review or merge is requested until I publish the new exact head.