Request for Change

Design documents for changes that are large enough, risky enough, or contested enough to be worth writing down before building. An RFC here is a proposal and a record of a decision — not a description of what the code does today. For that, read the code, or the status field described below.

Index

Last audited 2026-08-03 against main 0ab6ed48. Every status below was verified against the code (definitions and callers) and against merged/open PR history, not taken from the document's own claims. The rfc-tailnet-dashboard-access row was added later and re-verified against 429cbad8, and rfc-session-address-model was added later still and verified against b23ab77af; the rfc-everything-is-an-app and rfc-amend-tenets-everything-is-an-app rows were added 2026-08-18 and verified against e6b06685e; the other rows have not been re-audited since 2026-08-03. The durable-run-coordinator row was added 2026-08-22 and the orchestrator-chat-sessions row was re-audited at c4f253891; the rfc-token-efficient-monitors row was added 2026-08-22 and verified against 6d3e30bbbd. The rfc-global-workflow-library row was added 2026-08-25 and audited against 749468d42; its implementation exists only in the active detached worktree. The rfc-crew-agent-sdk-boundary row was added 2026-08-28 and verified against dc88f142b. The rfc-transcript-section-markers row was added 2026-08-30 and verified against 202770d13.

Document	Status	What is actually on main
rfc-transcript-section-markers.md	draft	Nothing. No section_marker role exists; every collapse affordance is intra-turn (CollapsibleToolGroup, TurnBlock, ToolCallLine) and nothing collapses rows above a point
rfc-crew-agent-sdk-boundary.md	draft	Nothing. Audited at dc88f142b: providers/base.py:30 still aliases AcpEvent as the "provider-agnostic" event type, 68 direct kiro_crew.acp import edges remain across 42 files outside acp/ and providers/, and acp/worker_pool.py:49 still imports back from session_pid.py behind a cycle guard. No agent_sdk package and no import ratchet exist
rfc-global-workflow-library.md	in-progress	Nothing. The active detached worktree adds the global definition library, local adaptation and lineage, exact /workflow <name> invocation, MCP/HTTP contracts, and the Agent Capabilities management surface
rfc-durable-run-coordinator.md	draft	Nothing. Design and seven-PR additive migration stack only; the existing in-memory manager and run folders remain authoritative
rfc-issue-radar-crews.md	draft	Nothing. Design of record only; crew_brief.md and crew_ledger_spec.md sit beside the Issue Radar backend as companion specs, also unimplemented
rfc-orchestrator-chat-sessions.md	partial	Crew Mode shipped in #1295 and has since received store and routing fixes. The implementation deliberately diverges from the RFC in at least three places: no snapshot-generation CAS, no release decision action, and immediate per-result delivery instead of burst coalescing
rfc-channel-plugin-architecture.md	partial	Shared turn pipeline shipped; 4 of 7 channels adopted. Registry/seam collapse, telegram+discord, Feishu unstarted. Its §9 address rule is separately half-shipped — audit this row alongside rfc-session-address-model.md
rfc-session-address-model.md	partial	The dashboard half of the channel-plugin RFC's §9 rule 1 shipped (#1366 plus four follow-ups): a chat-app conversation opened in a dashboard tab is no longer copied into a second session, and has_dashboard_surface (7 callers) replaced the name-prefix capability tests. All four phases it proposes are unstarted — 23 named key converters and 5 copies of the session-type ladder remain, surface capability is still one boolean, and an unbound channel tab still starts a second session against the same transcript file
rfc-local-notification-bus.md	partial	Phases 1/3/4 complete. Phase 2 wired but has no producer; Phase 5 shipped 2 of 3
rfc-federated-app-platform.md	partial	Phase 1 substantially shipped, Phase 3 half-built. Phase 2, Phase 1's removals, Phase 4, Phase 5 unstarted
rfc-workspace-config-evolution.md	partial	Phases 1–2 shipped. Phase 3's vector isolation was reversed on purpose; Phase 4 unstarted
rfc-resumable-subagent-sessions.md	partial	Phase 0 ran and redirected the design: continuable conversations shipped instead of the record-store ladder
rfc-i18n-measurement.md	partial	Overflow gate shipped, localeCompare migration partial. All three measurement proposals unstarted
rfc-appstore-official-registry.md	partial	The official fetch and editorial-driven Discover are live (apps/official_catalog.py, apps/official_editorial.py); signature verification and tombstone resolution are deliberately absent and fail closed. §4 diverged — four of its decisions about categories were reversed in the sibling KiroCrewApps repo; the note at its head says which
rfc-notification-bridge.md	accepted	Nothing — zero implementation code
rfc-tips-kit.md	draft	Nothing. T1 was built and retracted (#775); the design section needs revising first
rfc-update-architecture.md	draft	Nothing — zero of three phases
rfc-app-sandbox-isolation.md	draft	Nothing. Apps still run in-process with full privileges (see src/kiro_crew/docs/app-platform-trust-model.md); no isolation code exists
rfc-issue-radar-dispatch.md	draft	Nothing. Issue Radar has Investigate and Review; no verb produces work, and issues carry no link to the change that resolves them
rfc-perpetual-agent.md	draft	Nothing. Verified at 9ac3716a: no schedule kind self-reschedules, and binding_key_for has no cron: branch
rfc-token-efficient-monitors.md	draft	Nothing. Probe-first replacement for token-heavy babysit loops; implementation begins in a stacked series after this RFC
rfc-tailnet-dashboard-access.md	partial	Phase 1 landed (#1761, f8afcff7) — reports the pin's real scope, does not fix it. Phases 2–4 unstarted; the pin repair is tracked as #1762
rfc-pluggable-model-providers.md	draft	Nothing, by design. agent.provider is still fixed to acp and AGENTS.md lists "Other providers" under Never re-add. This document recommends supporting provider choice and asks the maintainers to amend that rule; it proposes no design, and an exploratory implementation is shelved pending the answer (#1693)
rfc-s3-backup.md	draft	Nothing. Verified at f4d3327a7: VALID_COMPONENTS carries no session component and no code path writes crew state to a remote store
rfc-navigation-placement-seam.md	draft	Nothing. Verified at 2a665e735: UISidebar ships in the manifest and no frontend code reads ui.sidebar; appNavTarget still resolves pages[0] only, and registerBuiltinSurface is not one of the nine edition seams
rfc-append-only-session-transcript.md	draft	Nothing. Verified at 2a665e735: _save_slot_to_history still re-serializes the whole in-memory window on every flush, and rewrite_session / sliding_window still have no production caller
version-compliance-framework.md	draft	Nothing. Framework doc, not an RFC; premise is pre-fork and stale
rfc-everything-is-an-app.md	draft	Nothing. Phase 0's boundary section is in this document's own branch and not yet merged; the eleven declared-but-unread manifest fields it inventories are all still declared and still unread
rfc-amend-tenets-everything-is-an-app.md	draft	Nothing. TENETS.md still carries seven tenets on main. git log --follow on it shows two commits and no prior amendment, and grep -i tenet returns zero hits in GOVERNANCE.md
rfc-crew-projects.md	draft	Nothing. Verified at 5cd92ff99: no project manifest format exists, slot.project is a bare directory path, and grep -ril "confluence|servicenow" src/kiro_crew returns zero hits
rfc-tool-derived-diff-cards.md	in-progress	Ships with #5012: dashboard diff-card/summary promotion + runtime-selected prompt rule. The messaging OutputEvent extension (§3.3) is unstarted

Nothing in this directory is implemented or superseded today.

Front matter

Every document carries YAML front matter as the machine-readable record. The prose header below it stays human-readable and carries the why; front matter carries the what.

---
title: Channel Plugin Architecture — shared runtime, channels as app extension points
status: partial            # see vocabulary below
author: zezhexu
created: 2026-07-28
last-audited: 2026-08-03   # when status was last verified against code
audited-at: 0ab6ed48       # the commit it was verified against
doc-pr: 689                # the PR that merged this document
implementation-prs: [777, 1019, 1234]
tracking-issues: []
supersedes: []
superseded-by: []
---

Optional keys: kind: framework for docs that are policy rather than a reviewable change to a named component, and revision: where a document is versioned across review rounds.

last-audited and audited-at exist because a bare status: partial rots silently. If those two fields are far behind main, distrust the status.

Status vocabulary

Status	Meaning
draft	Proposed. Nothing built.
accepted	Design agreed and locked. Nothing built yet.
in-progress	Implementation is live in an open PR or an active branch.
partial	Some phases are on main; the rest are open. The prose status line names which.
implemented	Every phase is verifiably on main.
superseded	Replaced. superseded-by names the replacement.

partial is the most common status and the most dangerous one to read carelessly — several documents here describe a plan that main only partly follows, and two describe a plan main deliberately diverged from.

Reading a partial or divergent RFC

Three failure modes are live in this directory. Each document's prose status line calls out its own, but the patterns are worth knowing before you trust any of them:

1. The plan was overtaken. rfc-resumable-subagent-sessions.md had its Phase 0 probe return a negative verdict, which redirected the whole design — what shipped (continuable conversations) is not what the phases below it describe. rfc-workspace-config-evolution.md had its Phase 3 vector-store isolation affirmatively reversed by a later commit. Neither document was revised afterwards. rfc-appstore-official-registry.md is the same pattern caught late but revised: four of §4's decisions about categories were reversed as R1 shipped, and the section now opens with a note saying which, so the reasoning survives as a record without still reading as the contract.
2. The credit is not the RFC's. rfc-i18n-measurement.md shows partial, but the proposals that shipped were already in flight under a separate program, one of them merging 18 hours before the document did.
3. A dependency claim is overstated. rfc-notification-bridge.md asserts the bus RFC's phases "all shipped". The phases the bridge actually needs are real; the blanket claim is not.

When a document and the code disagree, the code wins and the document is a bug. Fix it in the same PR that discovers the drift.

Writing a new RFC

GOVERNANCE.md covers who decides whether an RFC is accepted, and the scope test for when a change needs one at all.

• File as rfc-<topic>.md, kebab-case. Framework or policy docs that propose no reviewable change to a named component drop the prefix and set kind: framework.
• Open with front matter, then an H1 # RFC: <Title>, then the prose header.
• Write in English.
• Structure that has worked here: Summary → Motivation (current state, problems) → Goals → Non-goals → Design → Migration plan (phased, each phase PR-sized with exit criteria) → Backward compatibility → Security considerations → Alternatives considered → Open questions.
• Phases earn their keep by being independently shippable and independently abandonable. State exit criteria as assertions someone can test, and mark any phase whose entry depends on an unanswered open question as blocked on it.
• Verify before asserting. Claims of the form "X does not exist" or "Y is unused" are the ones that most often turn out wrong. Grep for callers, not just definitions — a defined-but-uncalled symbol means the behavior does not happen, which is a different (and usually more interesting) finding than absence. Quote file:line. Name the commit you measured at, as rfc-i18n-measurement.md does.
• A probe phase that exists to answer a question must write its verdict down somewhere durable and the RFC must be updated to point at it. PR #1023 recorded its Phase 0 verdict in the PR description; the RFC still does not reference it, which is why that document now needs a reader's warning.

Keeping this honest

When you land an implementation PR for anything here, update the document's status, implementation-prs, last-audited and audited-at in the same PR, and re-audit the whole directory whenever the table above starts feeling plausible rather than checked. The audit is cheap: for each document, extract its named deliverables, grep for each one's definition and callers, and check the PR history for the phase that claims to have landed it.