RFL-154: cut the operator seam — contracts-only vocabulary, no app-side deps in the spine

CHANGELOG.md

@@ -6,6 +6,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+### Changed (RFL-154 — helm operator seam cut)
+- `helm-module-contracts` now owns the complete operator vocabulary: `operator_receipts` module (`JobReadinessPacket`, `OperatorLedgerEntry`, all receipt families, `OperatorControlError`, hash/ledger helpers) and `operator_preview` module (`OperatorControlPreview`, `OperatorControlPreviewBacking`, `OperatorReceiptFamilyView`, `operator_receipt_families()`). sha2 added as direct dep.
+- `prio-agent-ops` is now manifest-only: capability advertisement remains, operator-control vocabulary removed. Dep-tree no longer includes truth-catalog→prism-analytics→polars; that transitive chain is Plan-B scope.
+- `workbench-backend` repoints operator-control types to `helm-module-contracts`.
+- `helm-operator-control` depends on `helm-module-contracts` only (drops `workbench-backend`, `prio-agent-ops`, `polars`). Seed loading extracted to `seed-gen` via `ShowcaseSeedSource` injection. No shim re-exports.
+- `seed-gen` gains a library target (`src/lib.rs`) exposing `pub mod showcase_seed`, removing the `#![allow(dead_code)]` suppression.
+- arena `cross-extension-smoke` repoint (prio-agent-ops → helm-module-contracts) lands in arena-tests immediately after this merge (RFL-154 T6).
+
+- `helm-module-contracts` bumped to 0.3.0: three new public modules (`showcase_pipeline`, `operator_receipts`, `operator_preview`) plus `sha2` as a direct runtime dep constitute minor surface expansion (RFL-154). All in-repo consumers updated.
+
+### Added (RFL-154 — helm operator seam cut)
+- trybuild compile-fail suite in `helm-module-contracts`: one case proves private validation helpers (`validate_sha256`) are not callable from external code (parse-don't-validate gate).
+- trybuild regression guards in `helm-operator-control`: two compile-fail cases prove `workbench_backend` and `prio_agent_ops` are no longer dep-resolvable.
+- `#[ignore]`d soak test in `helm-operator-control/tests/module_test.rs` (`soak_packet_ledger_preview_no_drift`): 100 000 iterations of packet→ledger→preview via `StaticReadinessFeed`, asserts no id/hash drift; proof run at 10 000 iter in 1.65s (6 061 iter/s).
+- `kb/Architecture/Foundation Contracts.md` — operator vocabulary row in contracts surface table.
+- `kb/Architecture/Operator Control Common Module.md` — reflects RFL-154 ownership; contracts is the canonical import path.
+- `kb/Architecture/Module Map.md` — `prio-agent-ops` scoped to manifest-only; new `Seam Contracts` section for `helm-module-contracts`.
+
 ### Changed
 - `HelmModule` trait and `ModuleState` enum extracted from `runtime-runway/runway-app-host` into `helm-module-contracts` (RFL-128). `init()` no longer takes `&HostContext` — parameter was unused by all five modules. `helm-operator-control` and `helm-truth-execution` now import directly from `helm-module-contracts` with no `runway-app-host` dep; `helm-coordination`, `helm-governed-jobs`, and `helm-session-host` retain the dep for EventHub/SSE/SessionOwnershipLayer under approved `# RP-HELMS-SUBSTRATE-SEAM` seams.
 

apps/desktop/src-tauri/Cargo.toml

@@ -10,12 +10,13 @@ tauri-build = { version = "2", features = [] }
 
 [features]
 default = ["embedded-backend"]
-embedded-backend = ["dep:application-kernel", "dep:application-storage", "dep:workbench-backend"]
+embedded-backend = ["dep:application-kernel", "dep:application-storage", "dep:workbench-backend", "dep:helm-module-contracts"]
 
 [dependencies]
 organism-intelligence = { workspace = true, features = ["ocr"] }
 organism-notes = { workspace = true, features = ["sources-apple-notes", "sources-web"] }
 prio-expenses = { path = "../../../crates/prio-expenses" }
+helm-module-contracts = { version = "0.3.0", path = "../../../contracts/crates/helm-module-contracts", optional = true }
 workbench-backend = { path = "../../../crates/workbench-backend", optional = true }
 application-kernel = { path = "../../../crates/application-kernel", optional = true }
 application-storage = { path = "../../../crates/application-storage", features = ["surrealdb"], optional = true }

apps/desktop/src-tauri/src/main.rs

@@ -31,12 +31,13 @@ use tauri::State;
 #[cfg(feature = "embedded-backend")]
 use uuid::Uuid;
 #[cfg(feature = "embedded-backend")]
+use helm_module_contracts::operator_preview::OperatorControlPreview;
+#[cfg(feature = "embedded-backend")]
 use workbench_backend::{
     AccountWorkspaceSummary, ApprovalFilter, ApprovalListItem, CatalogItemListItem, OperatorApp,
-    OperatorControlPreview, OperatorDashboard, OpportunityListItem, OrganizationListItem,
-    RecordReferenceItem, SubscriptionListItem, SystemProfile, TruthDetailItem,
-    TruthExecutionSession, TruthListItem, WorkbenchAppManifest, WorkflowCaseFilter,
-    WorkflowCaseListItem,
+    OperatorDashboard, OpportunityListItem, OrganizationListItem, RecordReferenceItem,
+    SubscriptionListItem, SystemProfile, TruthDetailItem, TruthExecutionSession, TruthListItem,
+    WorkbenchAppManifest, WorkflowCaseFilter, WorkflowCaseListItem,
 };
 
 #[cfg(feature = "embedded-backend")]

contracts/crates/helm-module-contracts/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "helm-module-contracts"
 description = "Shared contracts for Helm modules mounted into Runtime Runway."
-version = "0.2.1"
+version = "0.3.0"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/Reflective-Lab/helms"
@@ -12,7 +12,10 @@ anyhow = "1"
 async-trait = "0.1"
 axum = "0.8"
 serde = { version = "1", features = ["derive"] }
+sha2 = "0.11"
 
 [dev-dependencies]
+proptest = "1"
 serde_json = "1"
 tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
+trybuild = { version = "1", features = ["diff"] }

contracts/crates/helm-module-contracts/src/lib.rs

@@ -5,6 +5,25 @@
 //! (`HelmModule`, `ModuleState`) so the interface lives in a neutral crate
 //! that both helms crates and Runtime Runway can consume without creating a
 //! foundation→substrate dependency (RP-LAYERING, RFL-128).
+//!
+//! The [`operator_receipts`] submodule owns the full operator-control receipt
+//! vocabulary (all 18 types, hashing helpers, and `OperatorControlError`),
+//! promoted here from `prio-agent-ops` as part of RFL-154.
+//!
+//! The [`operator_preview`] submodule provides read-only view types over the
+//! receipts vocabulary (`OperatorControlPreview`, `OperatorControlPreviewBacking`,
+//! `OperatorReceiptFamilyView`, `operator_receipt_families()`), promoted here
+//! from `workbench-backend` as part of RFL-154 T2.
+//!
+//! The [`showcase_pipeline`] submodule owns the injection boundary types for
+//! the showcase pipeline: [`showcase_pipeline::ShowcasePipelineInput`],
+//! [`showcase_pipeline::SeedSourceError`], and the
+//! [`showcase_pipeline::ShowcaseSeedSource`] trait the mounting app implements
+//! (RFL-154 T5b).
+
+pub mod operator_preview;
+pub mod operator_receipts;
+pub mod showcase_pipeline;
 
 use std::sync::Arc;