Confirmed product contract — final, 2026-09-30

Project: https://github.com/orgs/BotHarness/projects/11 · Milestone: v1.1. The product decision frontier is settled; superseded proposals remain in historical details only.

Full committed Memory Git repository

• Share the complete committed Memory Git repository, including Git history and all ordinary branches/tags. Author selects the initial checkout branch. A published version fixes that branch HEAD and the published refs.
• No file selection, history cleaning or no-history toggle. Author/Human/Bot controls files, branches, commits and any history reinitialization through ordinary Git before publication.
• Publish only committed branch/tag content and its reachable history. Do not include staged/uncommitted/untracked files or internal refs such as refs/botharness/recovery/*, which can contain working-tree checkpoints. Do not replace this ref contract with git bundle --all.
• Git data is not source-machine .git/config, credential helpers, hooks, recovery/ledger databases or runtime state. Do not implicitly export Profile credentials, live IM bindings/grants, Sessions or Bot identity. Authors remain responsible for the contents they intentionally commit to the shared repository; this is not a historical-file redaction feature.

Presentation lives in Git; identity stays local

• Commit a portable sharing descriptor and avatar assets into the repository before publishing. Human/Bot can prepare them using normal file/Git operations; publication does not silently insert uncommitted metadata.
• Avatar sharing defaults on. If enabled, a fresh import uses the shared appearance, including preservation of generated appearance. If omitted/disabled, it uses the fresh Bot's normal default avatar.
• Descriptor includes display name, description and role badges. Missing optional presentation has defined normal local defaults; optional Persona remains optional under current CONTEXT.
• Import creates a fresh local PersonaBot identity. Later git pull updates repository files; it does not automatically overwrite local Bot presentation preferences. Human/Bot decides whether to apply updated presentation.

Public publication and account contract

• Cloudflare Workers + D1 + R2; GitHub is optional. Public publication only, no private/unlisted publication mode in v1.1. Each publication is publicly listed with author, version, provenance and license; richer discovery UI follows the first tracer.
• Anonymous browsing. Platform sign-in is required to publish and import through Marketplace. Ordinary external Git operations are a separate path.
• Better Auth: passwordless Email OTP sent through Cloudflare Email, Google and GitHub sign-in, optional Passkey. Start with verified Email OTP or social sign-in, then enroll Passkey. Passkey sign-ins do not require an OTP email every time; OTP remains a fallback.
• License is author-confirmed: read an existing repository license or require an explicit declaration when absent.
• Withdrawal blocks future platform downloads/imports of the withdrawn publication. Already imported local repositories remain usable. Public GitHub sources remain under their author's GitHub control.

Native Git updates and simple publication

• No fork/PR/pull/push/merge/rebase/update-management UI. Human/Bot uses Git and ordinary GitHub collaboration directly.
• GitHub-backed author selects a tracked publication branch at initial publication. Subsequent pushes to that branch automatically produce new immutable Marketplace versions. Stable Bot link resolves the latest successfully published version; version-specific links stay fixed. Failed refresh does not advance the latest pointer.
• For authors without GitHub, Human asks Bot to publish the prepared committed repository through the platform publication API. The platform provides a read-only Git remote, updated on successful republication, so consumers can use ordinary git pull. Do not expand this into a platform Git push/receive-pack service or GitHub-like collaboration hosting.
• Imported repositories have a usable trusted origin/upstream and the selected branch's original commit ancestry; do not leave origin pointing at a temporary bundle file.
• Fast-forward is conditional on compatible ancestry and worktree state. Local commits or rewritten upstream may diverge. Human/Bot handles native merge/rebase; the platform does not force-reset or overwrite local work to manufacture fast-forward.

Honest popularity measurements

Completed local-import receipts are platform clone activity. Failed/replayed receipts do not inflate the count. Views, artifact downloads and distinct importers are separately named. External Git/GitHub clone/fork activity is not counted as a completed platform import. Authorization and version identity bind receipts to the actual completed import path.