Scope discipline¶
AWC is narrow on purpose. The whole user surface is five operations:
Everything outside that list is someone else's job, or a deferred idea. This page explains why the fence sits where it does, and what changes if you move it. For the product thesis, read What is AWC. For the composition contract with the systems around it, read on.
The narrowness is the product¶
The MVP is positioned as an agent workspace cache (spec §3.2). The word cache is the point, not a hedge:
"The object store contains durable immutable truth, while host-local state is disposable acceleration. The mounted workspace is a generated local view consisting of an immutable base and a private local delta." (spec §3.2)
That sentence rules out a family of neighbors. Spec §3.2 names them directly. The MVP is not:
- a general distributed POSIX filesystem;
- a block-storage service;
- an agent orchestration framework;
- an agent memory database;
- a vector database;
- a source-control replacement;
- a build system;
- a sandbox provider.
The design principle behind this is explicit. The system prefers "a small correct reference path over a broad feature set" and "measured workload traces over speculative optimization" (spec §3.3). A small path can be proven correct and measured. A broad feature set cannot, and it hides the economic wedge.
Scope creep is a tracked risk¶
The spec does not treat breadth as an accident. It lists it as a first-class risk:
"Risk: The team expands into sandboxing, orchestration, build caching, semantic memory, or a general filesystem before proving the wedge." (spec §26.12)
The mitigation is operational, not aspirational:
"maintain the five-operation product surface, require economic evidence for adjacent work, and reject features that do not improve fork, first use, shared read suppression, checkpoint, or recoverability." (spec §26.12)
Read those five verbs carefully. They are the test for any new work. A feature must move one of fork, first use, shared read suppression, checkpoint, or recoverability. Otherwise it does not belong in AWC.
The launch criteria repeat the same discipline. "No launch dependency exists on semantic memory, vector retrieval, agent orchestration, shared writes, or multi-region active-active operation" (spec §29.6). Any deferred feature that ships before launch must show "a measured direct effect on the core economic gate" (spec §29.6).
The non-goals are a contract¶
Section 4.2 is written as a MUST NOT list, not a wish (spec §4.2). The MVP MUST NOT attempt to provide:
- concurrent writers to one workspace;
- shared mutable POSIX semantics across hosts;
- distributed file locking;
- remote durability after every ordinary
write(2)orfsync(2); - live migration of an actively writable workspace between hosts;
- multi-region active-active writes;
- arbitrary block-device semantics;
- database-consistent snapshots of running database engines;
- semantic code merging;
- conflict-free replicated data types;
- cross-tenant deduplication;
- a custom Linux kernel module;
- complete support for every POSIX filesystem feature;
- Windows or macOS mounts;
- a package registry, build system, or remote execution engine;
- an agent scheduler or model gateway;
- persistent process, memory, or VM snapshots.
Each refusal protects the cache model. Remote durability after every write would force distributed locking and coherence. That turns a disposable local view into a shared mutable filesystem. The two ideas do not compose. Picking one means rejecting the other, and AWC picks the cache.
Why a job broker is a composition¶
Consider what a caller actually wants. It wants a durable Linux job that runs an agent, records evidence, and returns an accepted result. No single subsystem does all of that. A durable Linux-job broker is a composition of four systems:
The caller owns intent and acceptance. The broker owns job reconciliation. The scheduler owns placement. The sandbox owns processes and isolation. AWC owns workspace data and publication.
AWC's job in that chain is the smallest one. It hands an agent a private directory, fetches the shared bytes once, and publishes an immutable checkpoint when the agent is done. Reconciliation, placement, process isolation, and acceptance all live outside AWC. The composition contract turns each boundary into a named requirement, from idempotency keys to read-only evaluator mounts.
The temptation is to pull the neighbors in. An agent scheduler looks close to a workspace lease. A sandbox looks close to a mount. They are not the same problem. The spec states this directly: "AWC is not itself a complete sandbox. The agent platform remains responsible for process, network, syscall, and resource isolation" (spec §16.9). A mount is not an execution boundary.
Absorbing the scheduler or the sandbox would import cgroups, command policy, network limits, and placement heuristics into the correctness kernel. The kernel would stop being small. The five verbs above would stop being the whole test.
Deferred is not abandoned¶
Section 27 keeps a separate shelf for ideas that are real but not committed (spec §27). These are future directions, not MVP features:
- content-defined chunking (§27.1);
- small-object packing (§27.2);
- learned prefetch and cache admission (§27.3);
- package and build-cache views (§27.4);
- live rebase (§27.5);
- a shared mutable handoff directory (§27.6);
- multi-region replication (§27.7);
- virtio-fs and microVM integration (§27.8);
- a persistent world graph, the long-term memory-substrate vision (§27.9);
- generated storage policies (§27.10);
- semantic diff and merge (§27.11).
The distinction between §4.2 and §27 matters. A non-goal is a refusal that defines the product. A deferred capability is a candidate that needs economic evidence before it earns a place. Content-defined chunking ships only "after fixed-chunk traces show meaningful wasted upload or storage" (spec §27.1). Package and build-cache views carry a trust boundary. "Do not mix untrusted agent artifacts with production-trusted build caches" (spec §27.4).
The persistent world graph is the clearest case. It is "the long-term memory-substrate vision, not the initial wedge" (spec §27.9). AWC stores filesystem trees. It does not store agent memory. The launch criteria forbid depending on it (spec §29.6).
What changes if the fence moves¶
Run the counterfactual for any one guardrail.
If AWC provided shared mutable POSIX across hosts, every write(2) would need
cross-host agreement. That brings distributed locks, coherence, and failure
modes that disposable local state exists to avoid (spec §4.2). The cache stops
being a cache.
If AWC absorbed the sandbox, it would own process isolation and command policy. A workspace bug would then become a sandbox escape. A mount would become an execution boundary. The two must stay separate, so each can be correct on its own terms (spec §4.2, §16.9).
If AWC absorbed orchestration, it would schedule agents and gate models. That work has its own correctness demands. None of it improves fork, first use, shared read suppression, checkpoint, or recoverability. The §26.12 test fails on day one.
The pattern is consistent. Each guardrail exists because the thing it forbids would widen the correctness kernel and blur the economic wedge. The fence is what keeps the five operations the whole story.
Where this is firm and where it is open¶
The scope guardrails are normative spec text. They bind design decisions now, and the launch criteria in §29.6 enforce them at launch. They are not a description of a finished system. The current build still has gaps against the spec.
The composition boundary is a design, not a proven integration. It is a target contract, not a claim that every requirement is implemented or proven. The cross-host economic claim remains unmeasured. A second host and real shared storage are still required to turn the composition into evidence.
The deferred capabilities in §27 are specified but not implemented. Naming them here is not a commitment to build them. Each one must clear the §26.12 test on measured data before it enters the surface.
For the economic wedge that scope exists to protect, read Economics. For how AWC measures up against that wedge today, read Measuring AWC.