Module driver 

The canonical operation driver — the plan function of [KernelTransaction] (spec §5.4, §6, §7.4, §10.1, §10.2).

This is the layer the migration’s semantic half turns on. Everything above it is contract (envelope → record → transaction); everything below it is the kernel’s existing semantic machinery (the scheduler’s [LoopStateMachine], the P1 syscall gate, the P2 task table, the P3 context VM). The driver is the only place the two meet, and §5.4 fixes exactly how: every wire input reduces to a P1/P2/P3 primitive, and none of them is allowed to grow a parallel business state machine here.

Three properties define it:

1. No protocol adapter. The driver reads NormalizedPayload directly and reduces it to scheduler/context primitives such as LoopStateMachine::start, load_workflow, resolve_workflow_spawn, and feed. The canonical envelope is the only wire contract.
2. RootKind is immutable and ExecutionFocus moves only on a committed transition (§6.1.5/6.1.6, §7.4). Both live in CanonicalOperationDriver, and plan never writes them — it stages the next value, and CanonicalOperationDriver::note_committed is what installs it. There is no input, host command or otherwise, that sets a focus directly.
3. A root start is one atomic input. ConfigureOperation builds the engine; StartOperation seeds the initial context, enters the root, and publishes the first effect — a provider call for an agent root, a task spawn for a workflow root — in the same planned step. The historical 12+ separate accepted inputs before a first provider call (§3.3 item 20) have no equivalent path here.
4. One resolution entry, one decision per failure (§7.9). Every pending effect — provider, tools, approval, spawn, preempt, memory, page-out, milestone — is answered through ResolveEffect and nothing else, and a Failed outcome buys exactly one policy decision: abandon, switch recovery ladder, or commit a terminal. The kernel never re-emits the same intent (DEC-5), so the historical unbounded retry_approval / retry_workflow_spawn / retry_preempt round trips are not expressible on this path. ContextOverflow is not a failure at all: it is the one semantic provider outcome, and it feeds the compaction ladder.

What plan may mutate

[KernelTransaction::prepare] guarantees that a non-Prepared outcome leaves the transaction byte-for-byte unchanged, and it can reject after the planner has already run (an unsupported effect kind, a duplicate effect identity, the tail hard limit). The driver answers that in two layers:

• every refusal the driver itself owns — root authority, focus depth, an unreducible input — is decided before the semantic engine is touched, so it is a genuine zero-mutation rejection;
• the engine advance that a successful plan performs is guarded by a staging slot. A second plan without an intervening note_committed means the previous plan was discarded while the engine had already moved, and the driver fails closed with a poison fault that names the only legal recovery — rebuild from the journal (§8.3).

Structs

CanonicalOperationDriver

Reduces the five canonical input classes onto the kernel’s existing semantic mechanisms.

PlannedStep

One planned transition, as the canonical driver produces it.

Constants

ROOT_TASK_ID

The internal id of the root agent task. The kernel’s task table has used it since M1d; the canonical TaskId is the same string so an AgentTurn focus names a row that exists.

SYSCALL_TOOL_NAMES

Tool names that reduce to a P1 syscall instead of to a host tool execution.