Transducer

Transducer is Homeostat's boundary CLI. Its namespaces keep observation, evaluation, action, AI invocation, graph expansion, and reconciliation distinct while sharing Forgejo authentication, Protocol validation, correlation, redaction, and OTLP emission.

transducer schema validate --schema protocol/result.schema.json --instance result.json
transducer observe revision
transducer observe command -- python3 -m unittest
transducer observe http --url http://127.0.0.1:3080/api/v1/version --revision "$HEAD"
transducer observe telemetry --query '{service_name="homeostat-transducer"}'
transducer observe environment --environments deployment/environments.json --name homeostat-local
transducer evaluate exit-code --reading reading.json --expected 0
transducer evaluate expectation --reading reading.json --pointer /status --equals 200
transducer graph start --policy .forgejo/homeostat/policy.json ...
transducer graph expand --policy .forgejo/homeostat/policy.json --result result.json
transducer graph materialize --policy ... --parent invocation.json --result result.json
transducer graph join --policy ... --parent invocation.json --forgejo "$FORGEJO"
transducer act comment-upsert ...
transducer act review ...
transducer act merge ...
transducer invoke command ...
transducer invoke run ...
transducer telemetry emit ...

Merges are always scheduled with Forgejo's merge_when_checks_succeed, so act merge records authorization against the exact head and lets Forgejo gate on its own checks.

A graph is bounded in two directions. budget.depth is enforced from invocation lineage alone. budget.max_graph_invocations is enforced against an append-only ledger — one Forgejo issue per graph, one comment per entry, keyed on budget.root and located by budget.ledger.repository. The same entries answer which invocations are still outstanding. Ready children reserve before their parent retires, so handoff never looks spuriously quiet. continuations[].after parks dependency-blocked work until every descendant of each prerequisite branch is terminal. The same release pass opens a capability declaring join: graph_quiescent only after running and blocked work are gone.

The verified_operation boundary is evidenced by operations performed against a running deployment, not by reading code. observe http, observe command, and observe telemetry record what the deployment did without judging it; evaluate expectation turns one reading into one finding bound to a subject revision; forgejo.completion.verify records the boundary only after authorize_operation accepts the evidence against both the exact head and the exact environment descriptor revision reported by observe environment.

Observe mode is containment on both providers: Codex runs in a literal read-only sandbox, and Claude's Bash access is an explicit allowlist of read-only git introspection. A git.commit_push effect stages exactly the files its author declares in parameters.paths — undeclared workspace debris never reaches a commit.

Install and test:

python3 -m pip install -e .
python3 -m unittest discover -s tests -v

No command creates a Forgejo organization or repository.