Add v0.7 "Execution boundary" and move A2A to v0.8

[arpanghoshal]

What

Adds a v0.7 — Execution boundary section to the roadmap, moves v0.7 — Multi-agent to v0.8 unchanged, and renumbers v0.8–0.9 — Hardening to v0.9.

Docs only. No src/ change.

Why

Every guarantee shipped so far is a guarantee about what happens inside CTRLRun. Three edges are not:

• The kernel does not decide FAILED — an executor does. The correct rule is already written and already implemented, in src/ctrlrun/gateway/outcome.py: the connection was never established, or the peer said in band and before dispatch that it rejected the request; everything after the first byte is AMBIGUOUS. It is reachable only by installing ctrlrun[gateway], while @protect — the surface the README leads with — gets a docstring. A user who maps a post-dispatch ConnectionError to NotExecuted has re-enabled blind retry, with a receipt that says failed confidently.
• Lease liveness runs on the application clock. PostgresStateStore takes clock: Callable[[], datetime] = _utc_now and every liveness check goes through self._clock(). v0.6 moved the store to another host so several hosts could share it; the clock did not move with it. Skew is fail-closed and therefore quiet — a host running ahead marks a live reservation AMBIGUOUS while its real holder is mid-flight and about to succeed, and nothing names the cause.
• An approval binds to an action hash and an expiry, and to nothing about the world. A human approves a deletion when the balance is zero; thirty minutes later it is not, and the hash has not moved.

Plus two smaller ones found alongside them: plan_reservation has no ceiling on renewal after FAILED (grep -rn "max_attempt\|attempt >" src/ returns nothing), so one approval plus an executor that always reports "nothing happened" is unlimited dispatches; and a provider idempotency token, which has to derive from the effect key and the attempt — from the effect key alone it is stable across §5.4's renewal, and the provider would replay its cached failure for the one retry the kernel permits precisely because the executor proved nothing happened.

The renumber

A2A is unchanged in content and moves position only. Multi-agent authority propagation builds on a kernel whose executor boundary is sound; shipping a hop-counting authority model on top of an outcome mapping the primary surface leaves undefended would be building the next floor before the joists.

Recorded in the document rather than made silently, on the rule this file already follows for the v0.6 receipt-integrity line and the soak criterion.

Note on the precondition line

The roadmap entry says, and every later document must say, that precondition fingerprints narrow the window between decision and execution and do not close it. The recheck is a network call and cannot run inside the atomic reservation write, so a residual gap remains between compare and reserve. Minutes of human deliberation become milliseconds. That is worth having and it is not prevention.

Tests

1069 passed — every test that references ROADMAP, including the docs-site structural and word-budget suites.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
ctrlrun	🟢 Ready	View Preview	Sep 7, 2026, 9:32 PM

💡 Tip: Enable Automations to automatically generate PRs for you.