[DROOdotFOO]

Proposes ADR-0042: Raxol stops being a coding harness and leans on OMP (omp, https://omp.sh). Raxol becomes what agents plug into.

Decisions in the ADR

#	Decision
1	Story. Write one app; people and AI agents both use it, on every surface, and the agents behind it don't fall over. Hermes-parity claims are retired, and a coding harness goes on the "Do NOT build" list.
2	Apps into OMP first. Step one is making derived write tools actually change app state (today they never reach update/2, and the playground demos derive none of the tools the benchmark needs). Names become session-scoped (<session>.<widget>.<action>), descriptions static, and ids validated. Tool sets are sticky, and each call resolves the live widget. Users can shed tools: a per-session cap hides out-of-view tools, raxol_compact hides tools no longer in view, raxol_stop drops a session. Hidden tools stay callable. raxol mcp ships in @raxol/cli, and the OMP plugin lives in this repo.
3	Delete the coding harness in one cutover PR (~25k lines, measured). It is preceded by behaviour-preserving decoupling, a Symphony omp runner (write-mode approval overlay), and the ACP rebuild.
4	Model access. Anthropic and Ollama stay direct, plus omp_gateway (omp auth-gateway stdio, explicit-only :gateway kind, priced via LlmPrices). The HTTP backend is split; the other providers go.
5	ACP stays, re-aimed. raxol acp --agent <app>[:<id>] runs a session-scoped Raxol agent. A respawn continues its journal with fresh state; restoring state is later work. The permission bridge is re-targeted, not deleted.
6	Later: Raxol surfaces front an OMP session via RPC mode, with write-mode approvals routed to an authenticated user: Telegram through gateway pairing, chat gateways, SSH with per-tenant keys. LiveView is left out until it has authentication.
7	Raxol agents into OMP. Agent and team tools in raxol mcp, session-scoped, journals per project, locked at spawn (refused on Windows until #1299), allowlisted apps, owner-only access. The npm binary bundles raxol_payments. Spending tools need an operator policy, durable single-owner payment state (file ledger and idempotency store), an explicit tool list (no mandates or raw transfers), explicit approved recipients per chain, and a currency derived from the token; anything needing confirmation is refused.

Evidence behind it

• An OMP session drove TableDemo through mcp.server, but only via raxol_send_key. The derived sort tool's message goes to the dispatcher as an event, and the dispatcher crashes on it.
• The cross-session tool takeover was traced through ToolSynchronizer.do_sync.
• Checked against OMP 18.12.6 (bundled source plus throwaway plugins over omp --mode rpc, no model calls):
  • plugin mcp.json confinement, tool naming and hashing (static start tool mcp__raxol_raxol_raxol_start);
  • MCP tools at the end of the system prompt by default, provider tools under --no-tools, re-listed at the next model request;
  • headless approvals fail closed;
  • marketplace git-subdir sources pinned by ref and sha;
  • OMP answers only ping/roots/list (no elicitation);
  • default approval mode is yolo.
• An adversarial pass (three personas plus an ADR and docs prune inventory) produced verdict BLOCK; the owner decided D1 to D6.
• Round 3 (OMP source and probe, Raxol runtime and release research, citation re-check, test audit, sizing, and a Saboteur plus Security Auditor pass on the new decisions) found that agent sessions never replay their journal and that the payments ledger lives in memory. The owner amended D5 and D6 and decided D7 (no LiveView in the surfaces phase) and D8 (no agent spawning on Windows for now).

Status is Accepted (2026-10-24). Docs only: no code changes.

Manual testing

• Prose and link lint pass on the ADR and the index.
• File paths and modules named in the ADR re-checked against master.
• Plan review pass 1.
• Adversarial pass 2; findings folded in.
• Owner decisions D1 to D6 recorded.
• Round 3 research and adversarial mini-pass; findings folded in.
• Owner decisions D5 and D6 amended, D7 and D8 recorded.
• Owner read the ADR diff; Accepted 2026-10-24.