From b76e54c1f1b9e225f9296b901a28bc9b38d82831 Mon Sep 17 00:00:00 2001 From: JinWoo Lee Date: Tue, 8 Sep 2026 23:16:30 +0900 Subject: [PATCH 1/7] docs: synchronize R1/R2/R3 delivery plan Map the maintainer-accepted three-release sequencing onto the existing issue inventory without changing G01's recovery Goal, native parent edges, or historical M0-M5/Agent records. --- AGENTS.md | 2 +- README.md | 20 ++--- docs/BACKLOG.md | 85 ++++++++++++------- docs/EXECUTION.md | 11 ++- docs/HANDOFF.md | 172 ++++++++++++++++++++++--------------- docs/ISSUES.md | 73 ++++++++++++++-- docs/PLAN.md | 43 +++++++++- docs/backlog.json | 212 +++++++++++++++++++++++++++++++++++++++++----- 8 files changed, 473 insertions(+), 145 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 4632050..488dbd9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -3,7 +3,7 @@ This is a plan-first repository. Do not treat example CLI commands as implemented features. - Work from a GitHub issue and its Goal, acceptance criteria and dependencies. One issue, one branch/worktree, one active goal when the task requests goal execution. -- Follow docs/EXECUTION.md. The current user-authorized policy routes all future implementation, review and coordination work through Luna (`gpt-5.6-luna`, `max`), regardless of area. Preserve the TDD, independent-review and live-operation authorization gates. Historical records keep the model that actually produced them. Do not override an explicit current user setting. +- Follow docs/EXECUTION.md. The repository default routes implementation, review and coordination through Luna (`gpt-5.6-luna`, `max`) unless an explicit current user override is recorded on the issue. The maintainer-authorized override for delivery-reframe issue #66 and R1 children #67/#68/#69 is main author Grok 4.6 xhigh with independent Luna max review. Preserve the TDD, independent-review, exact-head Codex+CI and live-operation authorization gates. Historical records keep the model that actually produced them. Do not override an explicit current user setting. - Use TDD for implementation: meaningful failing test -> minimal implementation -> refactor -> relevant verification. Document actual results; never claim planned/skipped/live tests passed. - Preserve live manually installed runners during development. No global Docker prune/context change, broad process kill, unreviewed destructive cleanup or automatic workflow replay. - Credentials, raw SDK response errors, JIT configs, personal machine paths and private test logs must not enter commits/issues/diagnostic bundles. diff --git a/README.md b/README.md index cb98621..6875d31 100644 --- a/README.md +++ b/README.md @@ -14,20 +14,20 @@ gh-runnerd logs tests --follow gh-runnerd stop tests --drain ``` -## Intended first release +## Intended delivery -- A native macOS ARM64 Go executable, with a CLI and separately supervised daemon. -- User-owned GitHub App authentication; no management SaaS, shared vendor private key, public inbound endpoint, or Kubernetes requirement. -- Linux runners through an explicit Docker Engine connection. Existing Docker Desktop or Lima engines can be used without changing the user's global Docker context. -- Native macOS process runners for explicitly trusted repositories only. A fresh working directory is **not** OS or credential isolation. macOS VM isolation is a later, separately gated provider. -- Multiple organizations, per-pool limits, and a shared host-wide capacity budget. -- One-job runners, durable state reconciliation, safe scale-down, structured diagnostics, and tests that exercise crashes and concurrent work. +The original product envelope is still a native macOS ARM64 Go CLI plus supervised daemon, user-owned GitHub App authentication, Linux workers through an explicit Docker Engine connection, trusted-only native macOS processes, multiple organizations and a shared host budget. **There is no runnable product yet** (`cmd/gh-runnerd` is an empty entry point). Maintainer-accepted sequencing in [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) splits that envelope: -Linux still needs a Linux kernel/runtime on macOS. The first release connects to an existing engine; it does not make Linux containers native macOS processes or provision a Kubernetes cluster. +- **R1 Internal MVP:** this Mac, one organization, one private test repository, the existing Linux-container backend, concurrency one, manual App, foreground command. Full G01 ACK/acquisition/JIT recovery remains required. +- **R2 Everyday operations:** install/start/stop/status, restart recovery, bounded scaling. +- **R3 General distribution:** multi-organization support, additional native backend, automated onboarding, signing/update/diagnostics. +- **Future:** optional macOS VM / multi-host research ([#21](https://github.com/1XP-AI/gh-runnerd/issues/21)). + +Linux still needs a Linux kernel/runtime on macOS. R1 connects to an existing engine; it does not make Linux containers native macOS processes, add a second backend, or provision a Kubernetes cluster. See [approved delivery releases](docs/PLAN.md#approved-delivery-releases). ## Track implementation -[GitHub Project](https://github.com/orgs/1XP-AI/projects/2) provides [Goals](https://github.com/orgs/1XP-AI/projects/2/views/1), [Ready](https://github.com/orgs/1XP-AI/projects/2/views/2) and [Board](https://github.com/orgs/1XP-AI/projects/2/views/3) views. All 21 issues carry a goal, model/effort, TDD cases, acceptance criteria and dependencies. Start with G01/G02/G03; the board does not dispatch agents automatically. +[GitHub Project](https://github.com/orgs/1XP-AI/projects/2) provides [Goals](https://github.com/orgs/1XP-AI/projects/2/views/1), [Ready](https://github.com/orgs/1XP-AI/projects/2/views/2) and [Board](https://github.com/orgs/1XP-AI/projects/2/views/3) views. The original 21 goal issues remain; the live board has 36 items after additive Release metadata and R1 children. Start from currently Ready work; the board does not dispatch agents automatically. ## Read the plan @@ -42,7 +42,7 @@ Linux still needs a Linux kernel/runtime on macOS. The first release connects to - [Ordered backlog](docs/BACKLOG.md) - [Sources and unresolved experiments](docs/SOURCES.md) -The implementation target begins with one Apple Silicon Mac and two organizational installations. Organization examples in configuration are illustrative. No existing runner is migrated or removed by this repository. +R1 is one Apple Silicon Mac and one organizational installation. Two-organization qualification remains the G16/R3 target. Organization examples in configuration are illustrative. No existing runner is migrated or removed by this repository. ## License diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md index 9d1d4d0..1ecaaa4 100644 --- a/docs/BACKLOG.md +++ b/docs/BACKLOG.md @@ -1,41 +1,64 @@ # Ordered implementation backlog -Every row is an unimplemented goal. G01/G02 are evidence gates; G03 is independently ready. See [execution policy](EXECUTION.md) and each GitHub issue for acceptance and TDD details. +Every original row is a full-scope goal. G01/G02 remain evidence gates; G03 is done. See [execution policy](EXECUTION.md), [approved delivery releases](PLAN.md#approved-delivery-releases) and each GitHub issue for acceptance and TDD details. -| Key | Goal area | Stage | Primary agent | Depends on | +**Release classification is authoritative for user-visible sequencing.** Historical M0–M5 stages, original Goal text, Agent history and native `blockedBy` edges are retained. Relabeling does not make a blocked full-scope issue Ready and does not close a parent when a child lands. + +The live 36-item map is in [ISSUES.md](ISSUES.md). Default implementer is Luna max unless the issue records an explicit current user override; #66 and R1 children #67/#68/#69 are Grok 4.6 xhigh with independent Luna max review. + +## R1 critical path + +Foreground MVP on this Mac: one org, one private repository, existing Linux-container backend, capacity one, manual App. Daemon/install/service are not implemented and are not R1. + +| Key | Issue | Role | Native blockers | Live status | |---|---|---|---|---| -| G01 | Prove Scale Set delivery, acquisition and drain contracts | M0 - Evidence gates | Luna max | None — Ready | -| G02 | Prove local App enrollment and launchd credential access | M0 - Evidence gates | Luna max | None — Ready | -| G03 | Bootstrap Go module and independent public CI | M0 - Evidence gates | Luna max | None — Ready | -| G04 | Freeze CLI configuration, provider and scaling contracts | M0 - Evidence gates | Luna max | G01, G02, G03 | -| G05 | Implement durable state and operation journal | M1 - Control plane | Luna max | G03, G04 | -| G06 | Implement the supervised daemon and authorized local IPC | M1 - Control plane | Luna max | G05 | -| G07 | Implement GitHub App credential and installation binding | M1 - Control plane | Luna max | G02, G05 | -| G08 | Implement guided init and optional Manifest enrollment | M1 - Control plane | Luna max | G06, G07 | -| G09 | Implement the recoverable Scale Set adapter | M1 - Control plane | Luna max | G01, G05, G07 | -| G10 | Implement disposable Linux workers with isolated Docker services | M2 - Execution and scaling | Luna max | G04, G05, G07 | -| G11 | Implement trusted native macOS worker identity and lifecycle | M2 - Execution and scaling | Luna max | G02, G04, G05, G07 | -| G12 | Implement deterministic shared capacity and fair scheduling | M2 - Execution and scaling | Luna max | G04, G05 | -| G12a | Pure scaling targets and capacity arithmetic (child of G12) | M2 - Execution and scaling | Luna max | G03 + reviewed numeric contract; independently ready | -| G13 | Integrate reconciliation, drain and safe restart | M2 - Execution and scaling | Luna max | G06, G09, G10, G11, G12 | -| G14 | Implement status, logs and sanitized diagnostics | M3 - Reliability qualification | Luna max | G06, G13 | -| G15 | Implement startup, shutdown and safe configuration updates | M3 - Reliability qualification | Luna max | G02, G06, G13 | -| G16 | Build repeatable two-organization runtime qualification | M3 - Reliability qualification | Luna max | G08, G13, G14, G15 | -| G17 | Qualify crash recovery, soak and resource budgets | M3 - Reliability qualification | Luna max | G16, G19 | -| G18 | Package signed releases and reproducible distribution | M4 - Pilot and release | Luna max | G03, G15, G17 | -| G19 | Audit trust admission and cross-worker secret boundaries | M3 - Reliability qualification | Luna max | G08, G10, G11, G13 | -| G20 | Pilot migration with reversible legacy runner handoff | M4 - Pilot and release | Luna max | G17, G18 | -| G21 | Evaluate optional macOS VM and multi-host providers | M5 - Future | Luna max | G17 | - -The machine-readable source is [backlog.json](backlog.json). Published issue numbers and links are in [ISSUES.md](ISSUES.md); all dependencies are native GitHub blocking relationships. All first-release implementation goals remain open. +| G01 | [#1](https://github.com/1XP-AI/gh-runnerd/issues/1) | **Full original** ACK/acquisition/JIT recovery Goal; no subset and no false completion | none | In progress | +| G02-R1 | [#67](https://github.com/1XP-AI/gh-runnerd/issues/67) | R1 subset of G02 #2 (manual single-org credentials). Parent #2 stays R3 In progress | none | Ready | +| G01g | [#60](https://github.com/1XP-AI/gh-runnerd/issues/60) | Bounded broker handoff for the paired Linux-container path | #54 (Done) | In progress | +| P66 | [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) | Delivery-plan documentation | none | In progress | +| G13-R1 | [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of G13 #13: one foreground command. Freeze the minimal contract before implementation | #60, #66, #67 | Blocked | +| G16-R1 | [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | R1 subset of G16 #16: authorized real job plus required recovery | #1, #68 | Blocked | + +#68 must not start implementation while blocked. Completing a child does not complete G02, G04–G15 or G16. + +## Original full-scope backlog (M0–M5 preserved) + +| Key | Goal area | Stage | Release (full original) | Primary agent | Depends on | +|---|---|---|---|---|---| +| G01 | Prove Scale Set delivery, acquisition and drain contracts | M0 - Evidence gates | R1 | Luna max | None — originally Ready; live In progress | +| G02 | Prove local App enrollment and launchd credential access | M0 - Evidence gates | R3 | Luna max | None — originally Ready; live In progress. R1 subset is #67 | +| G03 | Bootstrap Go module and independent public CI | M0 - Evidence gates | R1 | Luna max | None — Done | +| G04 | Freeze CLI configuration, provider and scaling contracts | M0 - Evidence gates | R2 | Luna max | G01, G02, G03 (unchanged; not bypassed by #68) | +| G05 | Implement durable state and operation journal | M1 - Control plane | R2 | Luna max | G03, G04 | +| G06 | Implement the supervised daemon and authorized local IPC | M1 - Control plane | R2 | Luna max | G05. Not in R1; not implemented | +| G07 | Implement GitHub App credential and installation binding | M1 - Control plane | R2 | Luna max | G02, G05 | +| G08 | Implement guided init and optional Manifest enrollment | M1 - Control plane | R3 | Luna max | G06, G07 | +| G09 | Implement the recoverable Scale Set adapter | M1 - Control plane | R2 | Luna max | G01, G05, G07 | +| G10 | Implement disposable Linux workers with isolated Docker services | M2 - Execution and scaling | R2 | Luna max | G04, G05, G07. R1 reuses the existing paired Linux-container path; full G10 remains | +| G11 | Implement trusted native macOS worker identity and lifecycle | M2 - Execution and scaling | R3 | Luna max | G02, G04, G05, G07. Not in R1 | +| G12 | Implement deterministic shared capacity and fair scheduling | M2 - Execution and scaling | R2 | Luna max | G04, G05 | +| G12a | Pure scaling targets and capacity arithmetic (child of G12) | M2 - Execution and scaling | R2 | Luna max | G03 + reviewed numeric contract; Done | +| G13 | Integrate reconciliation, drain and safe restart | M2 - Execution and scaling | R2 | Luna max | G06, G09, G10, G11, G12 (unchanged). R1 subset is #68 | +| G14 | Implement status, logs and sanitized diagnostics | M3 - Reliability qualification | R2 | Luna max | G06, G13 | +| G15 | Implement startup, shutdown and safe configuration updates | M3 - Reliability qualification | R2 | Luna max | G02, G06, G13 | +| G16 | Build repeatable two-organization runtime qualification | M3 - Reliability qualification | R3 | Luna max | G08, G13, G14, G15. R1 subset is #69 | +| G17 | Qualify crash recovery, soak and resource budgets | M3 - Reliability qualification | R3 | Luna max | G16, G19 | +| G18 | Package signed releases and reproducible distribution | M4 - Pilot and release | R3 | Luna max | G03, G15, G17 | +| G19 | Audit trust admission and cross-worker secret boundaries | M3 - Reliability qualification | R3 | Luna max | G08, G10, G11, G13 | +| G20 | Pilot migration with reversible legacy runner handoff | M4 - Pilot and release | R2 | Luna max | G17, G18 (R3). Historical edge preserved; no bypass | +| G21 | Evaluate optional macOS VM and multi-host providers | M5 - Future | Future | Luna max | G17 | + +The machine-readable source is [backlog.json](backlog.json). Published issue numbers and links are in [ISSUES.md](ISSUES.md); all original dependencies remain native GitHub blocking relationships. Full-scope first-release implementation goals except G03/G12a remain open. ## Parallel work boundaries -- Start G01 (Luna max), G02 (Luna max), and G03 (Luna max) independently. -- G04 integrates the gates and freezes contracts before shared implementation. -- After G05, IPC, auth, and pure scheduling can proceed with separate file ownership. -- Linux and native macOS providers can proceed independently once shared contracts/credentials exist. -- Integration, security verdict, soak and rollout are sequential evidence gates. +- Continue G01 (full recovery Goal) and G02 (full Manifest/multi-org/launchd Goal) independently; they are not replaced by #67. +- #67 may proceed as isolated R1 credential evidence without waiting on G02's remaining R3 criteria; it does not authorize live App/Keychain/launchd mutation. +- G04 still integrates the full gates before shared full-scope implementation. #68 is not a G04 bypass. +- After G05, IPC, auth, and pure scheduling can proceed with separate file ownership for R2/R3 work. +- Linux and native macOS providers can proceed independently once shared contracts/credentials exist; native macOS is R3. +- Integration, security verdict, soak and rollout remain sequential evidence gates. +- Do not edit #60/#62 or #59 runtime/CI/evidence surfaces from the #66 documentation branch. ## Independent G12 arithmetic slice diff --git a/docs/EXECUTION.md b/docs/EXECUTION.md index 34318dc..e13d387 100644 --- a/docs/EXECUTION.md +++ b/docs/EXECUTION.md @@ -6,9 +6,12 @@ The [GitHub Project](https://github.com/orgs/1XP-AI/projects/2) is the planning/ | Work | Implementer | Review | |---|---|---| -| All implementation areas, including auth, protocol, concurrency, resource admission, lifecycle, providers, architecture, tests, packaging and docs | Luna / `gpt-5.6-luna`, `max` | Independent Luna `max`; use a second independent Luna `max` pass for security/recovery boundaries | +| Default, including auth, protocol, concurrency, resource admission, lifecycle, providers, architecture, tests, packaging and docs | Luna / `gpt-5.6-luna`, `max` | Independent Luna `max`; use a second independent Luna `max` pass for security/recovery boundaries | +| Explicit current override on [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) and R1 children [#67](https://github.com/1XP-AI/gh-runnerd/issues/67)/[#68](https://github.com/1XP-AI/gh-runnerd/issues/68)/[#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | Grok 4.6 xhigh | Independent Luna `max` | -Use Luna max for every issue, including contract-setting evidence gates such as G01, G02 and G04. Verify each issue's contract and dependencies before dependent implementation begins. Escalate discovered architecture, secret handling, process isolation or concurrency changes to an additional independent Luna max review; do not stretch a small issue into an unreviewed redesign. Parallelize only independent issues with non-overlapping file ownership; no simultaneous edits to shared protocol/state definitions. Earlier Astra/Luna allocations in historical review and evidence records are preserved as historical facts. +The repository default is Luna max, including contract-setting evidence gates such as G01, G02 and G04, unless an explicit current user override is recorded on the issue. Do not overwrite that override with the default. Historical Astra/Luna assignments in review and evidence records stay unchanged. The Project `Agent` field currently offers Astra xhigh and Luna max; Grok 4.6 xhigh is recorded in the named issue bodies until a Project option exists. Do not rewrite #1/#2/#60 Agent values to make this planning change look like those issues changed owners. + +Verify each issue's contract and dependencies before dependent implementation begins. Escalate discovered architecture, secret handling, process isolation or concurrency changes to an additional independent Luna max review; do not stretch a small issue into an unreviewed redesign. Parallelize only independent issues with non-overlapping file ownership; no simultaneous edits to shared protocol/state definitions. ## Per-issue goal workflow @@ -36,8 +39,8 @@ was complete at merge time. ## Board fields -Status, Stage, Priority, Agent, Risk, Goal, Dependencies and Test profile. Initial gates/bootstrap work is Ready; dependent work is Backlog. VM/fleet research is explicitly Future. Machine-readable `status` and `test_profile` values are in `backlog.json`; trusted-runtime and trusted-live-github profiles require maintainer-controlled execution and never run on public PR code. +Status, Stage, Priority, Agent, Risk, Goal, Dependencies, Test profile and Release. Stage/milestones preserve the original M0–M5 taxonomy. Release is additive sequencing (R1 Internal MVP, R2 Everyday operations, R3 General distribution, Future research) and does not change acceptance text or native dependency gates. Initial gates/bootstrap work is Ready; dependent full-scope work is Backlog. R1 children use their own documented dependencies: #67 is Ready with no production dependency; #68 is Blocked by #60/#66/#67 until those complete and its minimal contract is reviewed; #69 is Blocked by #1/#68. Ready on a child is not a bypass of the parent's remaining blockers. VM/fleet research is explicitly Future. Machine-readable `status` and `test_profile` values are in `backlog.json`; trusted-runtime and trusted-live-github profiles require maintainer-controlled execution and never run on public PR code. -G08 enrollment and G15 service lifecycle remain gated by their contracts and independent review. Luna max handles both implementation and review; G12 computes pure proposals, while G05/G13 own atomic reservation and live admission under the same Luna max review policy. +G08 enrollment and G15 service lifecycle remain gated by their contracts and independent review. Default implementation and review are Luna max; recorded overrides such as Grok 4.6 xhigh on #66/#67/#68/#69 still require independent Luna max review. G12 computes pure proposals, while G05/G13 own atomic reservation and live admission under the parent full-scope gates. Use one issue per bounded outcome and linked dependencies instead of assigning all future work active goals at once. diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index e3674fe..9c92c70 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -7,7 +7,7 @@ Treat the live GitHub Project and the issue body as authoritative when they diff from this snapshot. Re-read this file, `AGENTS.md` and the linked design documents before changing code. -Snapshot: 2026-09-08 KST, repository `main` at `0d0412981d766350d15dfa667ffe74f81ea88edc` (`docs: route future work through Luna max (#56)`). +Snapshot: 2026-09-08 KST, documentation branch `orca/release-reframe` based on `main` `31ae8102f6f20f8e79258eb824af1400eba21954` (`[CI] Split default G01 deadline checks (#65)`). Live Project #2 has 36 items after the maintainer-accepted release reorganization ([#66](https://github.com/1XP-AI/gh-runnerd/issues/66)). This file is a snapshot; the live Project and issue bodies win when they differ. ## Mission and product boundary @@ -19,19 +19,33 @@ safe drain, durable reconciliation and a shared host resource budget. The repository is still a design and implementation backlog. The commands in the README are intended interfaces, not a runnable product or a stability claim. -The first release is deliberately bounded: +The original product envelope is deliberately bounded and is now sequenced as +three maintainer-accepted releases ([PLAN.md](PLAN.md#approved-delivery-releases)): -- one macOS ARM64 manager on one Mac; +- **R1 Internal MVP:** this Mac, one organization, one private test repository, + the existing reviewed Linux-container backend, concurrency one, manual App, + foreground command. Full G01 ACK/acquisition/JIT recovery remains required. + Daemon/install/launchd service are not implemented. +- **R2 Everyday operations:** install/start/stop/status, restart recovery and + bounded scaling. +- **R3 General distribution:** multi-organization support, trusted native macOS + backend, automated onboarding, signing/update/diagnostics. +- **Future:** G21 optional macOS VM / multi-host research. + +Shared envelope limits that still apply: + +- one macOS ARM64 manager on one Mac for R1/R2/R3; - Linux workers through an explicitly selected Docker Engine connection (an existing Lima or Docker Desktop engine may be used without changing the global Docker context); - one-job Linux workers with a worker-specific Docker daemon for service/container actions; -- native macOS one-job processes only for an explicitly trusted repository/domain; +- native macOS one-job processes only for an explicitly trusted repository/domain + (R3, not R1); - GitHub App authentication owned by the operator and outbound GitHub connections; - no public inbound endpoint, management SaaS, Kubernetes requirement, Windows provider, cloud overflow, fleet controller, billing service or macOS VM provider - in v0.1; + in this envelope; - no automatic replay of an interrupted workflow and no claim that reconciliation is checkpointing or exactly-once execution; - no implicit installation of software or global Docker context changes. @@ -39,7 +53,7 @@ The first release is deliberately bounded: Linux still needs a Linux kernel/runtime on macOS. A native macOS runner cannot run a Linux Actions job, and a Linux container cannot provide a macOS runner. Native macOS execution remains a host process; optional VM/multi-host work is future -research in G21. +research in G21. Issue #1's exact Goal is unchanged. ## Host and current fallback runners @@ -105,7 +119,12 @@ current board; verify them with `gh project field-list` if GitHub reports a mism | Project | `2` / `PVT_kwDOD2M2gs4Bismw` | | Agent field | `PVTSSF_lADOD2M2gs4Bismwzhhjobs` | | Agent: Astra xhigh | `cf617d72` (historical only for completed work) | -| Agent: Luna max | `9317c27f` (all current/future dispatch) | +| Agent: Luna max | `9317c27f` (repository default dispatch) | +| Release field | `PVTSSF_lADOD2M2gs4Bismwzhhr3bc` | +| Release: R1 - Internal MVP | `a0a78eb0` | +| Release: R2 - Everyday operations | `58b696ee` | +| Release: R3 - General distribution | `428d845e` | +| Release: Future research | `c52ca8fd` | | Status field | `PVTSSF_lADOD2M2gs4BismwzhhjoZA` | | Status: Backlog | `a4ee9f7f` | | Status: Ready | `b2cc6cc3` | @@ -117,26 +136,35 @@ current board; verify them with `gh project field-list` if GitHub reports a mism `Agent` is routing metadata. Setting it does not start a Codex agent. A goal in a Project item is a durable work specification; it is not an active Codex goal. +Grok 4.6 xhigh is recorded on #66/#67/#68/#69 issue bodies; it is not currently a +Project Agent option. Do not overwrite #1/#2/#60 Agent values for this planning +change. ### Live board snapshot Run `gh project item-list 2 --owner 1XP-AI --limit 1000 --format json` before -dispatch. The last verified snapshot is: - -| Issues | Project status | Current routing | -|---|---|---| -| #1 G01, #2 G02 | In progress | Luna max; evidence gates unresolved | -| #3 G03, #40 G12a | Done | completed; historical review facts remain in docs | -| #4 G04 through #20 G20 | Backlog | Luna max | -| #21 G21 | Future | optional macOS VM/multi-host research | -| #44 G01a, #46 G01b, #47 G01c, #50 G01d, #52 G01e | Done | historical Astra xhigh work; preserve the record | -| #54 G01f | In review | Luna max; PR #55 is still held | -| #30 | Done | merged-PR audit item; no current Agent value | +dispatch. The last verified snapshot is 36 items. The full map is in +[ISSUES.md](ISSUES.md). Compact routing: + +| Issues | Project status | Release | Current routing | +|---|---|---|---| +| #1 G01 | In progress | R1 | Luna max; **full** ACK/acquisition/JIT Goal unresolved | +| #2 G02 | In progress | R3 | Luna max; Manifest/multi-org/launchd remains here | +| #67 | Ready | R1 | Grok 4.6 xhigh / Luna review; child of #2; no native blockers | +| #60 G01g | In progress | R1 | Luna max; separate worktree/PR #62; do not edit from #66 | +| #66 | In progress | R1 | Grok 4.6 xhigh / Luna review; this documentation change | +| #68 | Blocked | R1 | child of #13; blocked by #60/#66/#67; contract-before-implementation | +| #69 | Blocked | R1 | child of #16; blocked by #1/#68 | +| #3 G03, #30, #40 G12a, #44, #46, #47, #50, #52, #54 G01f, #61, #64 | Done | R1 except #40 R2 | historical records preserved; #54 Done does not close #1 | +| #4–#7, #9, #10, #12–#15, #20 | Backlog | R2 | Luna max; original dependencies unchanged | +| #8, #11, #16–#19 | Backlog | R3 | Luna max | +| #21 G21 | Future | Future | optional macOS VM/multi-host research | Issue labels and the initial planning inventory can retain historical Astra values. For current dispatch, use the Project `Agent` field and the issue's current execution contract. Do not rewrite historical records to make them look like new -work. +work. Do not add further child issues or native edges without an explicit ask; +the R1 mapping is already applied. ### Status meanings @@ -155,23 +183,28 @@ to Done when only a PR was opened or a test was planned. ## Model and delegation policy -The current user policy routes **all future implementation, contract work, -architecture, authentication, protocol, concurrency, documentation, coordination -and independent review through `gpt-5.6-luna` with `max` reasoning**. This includes -G01/G02/G04 evidence gates. Historical Astra/Luna assignments in old review and -evidence records are facts about who did that work and must stay unchanged. If a -later task contains an explicit current user model or effort override, that override -takes precedence and the Project Agent field must retain the selected routing. +The repository default routes **implementation, contract work, architecture, +authentication, protocol, concurrency, documentation, coordination and independent +review through `gpt-5.6-luna` with `max` reasoning**. This includes G01/G02/G04 +evidence gates unless an issue records an explicit current user override. +Historical Astra/Luna assignments in old review and evidence records are facts +about who did that work and must stay unchanged. If a later task contains an +explicit current user model or effort override, that override takes precedence. + +The maintainer-authorized override for [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) +and R1 children [#67](https://github.com/1XP-AI/gh-runnerd/issues/67)/[#68](https://github.com/1XP-AI/gh-runnerd/issues/68)/[#69](https://github.com/1XP-AI/gh-runnerd/issues/69) +is main author Grok 4.6 xhigh with independent Luna max review. Do not create a +second native Goal on #1 while this planning work runs. For every new issue, after checking for an explicit current user override: - set the Project Agent field to `Luna max` when no override exists, otherwise set - it to the explicitly requested routing; + it to the explicitly requested routing when that option exists; - use one active goal whose objective is exactly the issue's `Goal` statement; - do not invent a token budget; -- use an independent contract review with the current selected model/effort (the - default is Luna max), plus a second independent pass with that same routing for - security, recovery, secret handling, ownership or concurrency boundaries; +- use an independent contract review with the current selected review model/effort + (the default is Luna max), plus a second independent Luna max pass for security, + recovery, secret handling, ownership or concurrency boundaries; - parallelize only independent issues with explicit non-overlapping file ownership; one integrator owns shared protocol/state definitions; - a Project field never launches work by itself. @@ -428,52 +461,54 @@ Use this compact map to orient a new agent; the live Project decides what is Rea | G19 | #19 | Trust admission and cross-worker secret boundaries | | G20 | #20 | Reversible pilot/migration with legacy fallback | | G21 | #21 | Optional macOS VM and multi-host provider research (Future) | - -G01 and G02 are evidence gates. G04 and all dependent implementation remain behind -their acceptance evidence. G10/G16 require real ARM64 Docker and private test -repositories. G11/G19 require trusted native-process evidence. G17 is the reliability +| G02-R1 | #67 | R1 manual single-organization credentials (child of #2; parent remains R3) | +| G13-R1 | #68 | R1 foreground command, capacity one (child of #13; blocked by #60/#66/#67) | +| G16-R1 | #69 | R1 authorized real job plus required recovery (child of #16; blocked by #1/#68) | +| P66 | #66 | Delivery-plan documentation; not a runtime Goal | + +G01 and G02 are evidence gates. G01's exact Goal and full ACK/acquisition/JIT +recovery remain required; child merges are not completion. G04 and all dependent +full-scope implementation remain behind their acceptance evidence. #68 is not a +G04/G13 bypass. G10/G16 require real ARM64 Docker and private test repositories. +G11/G19 require trusted native-process evidence and are R3. G17 is the reliability release gate. G20 is the reversible pilot, not a license to remove the fallback -runners early. +runners early. G20 remains natively blocked by #17/#18. ## Current review state and next action -### Merged policy PR #56 +### Merged policy and G01f PR [#56](https://github.com/1XP-AI/gh-runnerd/pull/56) (`docs: route future work through Luna max`) -is merged at the snapshot SHA. It aligned `AGENTS.md`, `docs/EXECUTION.md`, the -current issue contracts, backlog routing and review/evidence policy with the Luna -max user policy. It intentionally preserved historical Astra records. - -### Held PR #55 / issue #54 - -PR [#55](https://github.com/1XP-AI/gh-runnerd/pull/55) implements G01f, linked to -issue [#54](https://github.com/1XP-AI/gh-runnerd/issues/54). At the snapshot: - -- branch: `feat/g01-terminal`; -- head: `8a848ad5b373866e1a6a01ce2a462ecfe37655df`; -- Project status: In review, Agent Luna max; -- a generated storage witness name collision was fixed and the targeted tooling - partition passed locally; -- hosted run `34168590856` still failed in environment-sensitive timeout paths: - one attempt failed a G02 manual delayed-EOF partition, and a rerun failed - `TestResponseBudgetAppliesAfterGzipDecompression` after 45 seconds; -- a local exact subtest race run passed, but no blind rerun or “clean” exact-head - Codex verdict should be inferred from that; -- keep the PR unmerged until current CI and current-head Codex review are clean. - -The first action for an agent inheriting this state is to inspect the current PR -head, hosted checks and Codex findings with the wrapper. Do not start a second -implementation of G01f, do not merge on a stale review, and do not mask a timeout -by widening limits or deleting tests without a reproduced root cause and a reviewed -contract change. +aligned default routing to Luna max and preserved historical Astra records. +PR [#55](https://github.com/1XP-AI/gh-runnerd/pull/55) / issue [#54](https://github.com/1XP-AI/gh-runnerd/issues/54) +G01f is merged and Done. Do not start a second G01f implementation. #1 remains +open because its full recovery Goal is not complete. + +### Active runtime work in other worktrees (do not edit from #66) + +- [#60](https://github.com/1XP-AI/gh-runnerd/issues/60) G01g / open PR [#62](https://github.com/1XP-AI/gh-runnerd/pull/62): bounded broker handoff. Blocks #68. +- [#2](https://github.com/1XP-AI/gh-runnerd/issues/2) readiness review / open PR [#59](https://github.com/1XP-AI/gh-runnerd/pull/59): G02 macOS live-validation packet. Do not treat it as R1 completion of #67. + +Inspect those PRs in their own worktrees. This documentation change must not +modify runtime, CI or evidence docs belonging to those PRs. + +### This planning change + +Issue [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) on `orca/release-reframe`. +Main author Grok 4.6 xhigh; independent Luna max review; exact-head Codex+CI before +merge. #68 stays Blocked until #60, #66 and #67 are complete and the minimal +foreground contract is reviewed. No live authorization and no merge of blocked +implementation are implied. ## Live-operation gate -The next live integration draft is a paired private canary after PR #55 has passed -its gates. It must use a reviewed immutable commit, a disposable private -repository/App installation, scoped runner-group access and explicit maintainer -authorization for the concrete target. No live authorization is present in this -handoff. +The next live integration draft remains a paired private canary after current +G01 recovery evidence and the R1 command path exist. PR #55 / G01f is already +merged and does not by itself authorize live work. It must use a reviewed +immutable commit, a disposable private repository/App installation, scoped +runner-group access and explicit maintainer authorization for the concrete +target. No live authorization is present in this handoff. Issue #69 tracks R1 +qualification and stays blocked by #1 and #68. Until that authorization exists, an agent may build offline fakes, local temporary SQLite journals, private TLS/Unix fixtures and static tooling checks. It may not @@ -489,7 +524,8 @@ Before handing work onward, confirm: - [ ] The issue Goal was copied exactly into one active goal; no invented budget. - [ ] Dependencies and Project status were checked live. - [ ] Project Agent matches the current user-selected model/effort (default: - `Luna max`); historical records were not rewritten. + `Luna max`, with the recorded Grok 4.6 xhigh override on #66/#67/#68/#69); + historical records and #1/#2/#60 Agent values were not rewritten. - [ ] A meaningful red case, minimal green fix and relevant boundary tests are recorded, with actual commands/results and remaining gaps. - [ ] No secrets, personal paths, raw SDK errors, live tokens or unreviewed runner diff --git a/docs/ISSUES.md b/docs/ISSUES.md index af2f91f..1fe1bd3 100644 --- a/docs/ISSUES.md +++ b/docs/ISSUES.md @@ -29,19 +29,76 @@ These are issue goals. The table records the initial planning inventory; the liv | G20 | [#20 Pilot migration with reversible legacy runner handoff](https://github.com/1XP-AI/gh-runnerd/issues/20) | Astra xhigh | Backlog | offline, trusted-runtime, trusted-live-github | | G21 | [#21 Evaluate optional macOS VM and multi-host providers](https://github.com/1XP-AI/gh-runnerd/issues/21) | Astra xhigh | Future | offline | -The original plan's 48 dependency edges are recorded as native GitHub blocking relationships and linked in issue bodies. Start G01/G02/G03; evidence gates control dependent work. +The original plan's 48 dependency edges are recorded as native GitHub blocking relationships and linked in issue bodies. Start G01/G02/G03; evidence gates control dependent full-scope work. -This table intentionally preserves the initial planning inventory. Current dispatch is recorded in the live Project Agent field and the open issue execution contracts; all future dispatches use Luna max. +This table intentionally preserves the initial planning inventory. Current dispatch is recorded in the live Project Agent field and the open issue execution contracts. The repository default is Luna max; #66 and R1 children #67/#68/#69 record main author Grok 4.6 xhigh with independent Luna max review. Do not rewrite historical Astra records. -Each issue has one Goal statement, scope, TDD cases, acceptance criteria, model/effort, risk and dependencies. See [backlog.json](backlog.json) for machine-readable specifications. +Each original issue has one Goal statement, scope, TDD cases, acceptance criteria, model/effort, risk and dependencies. See [backlog.json](backlog.json) for machine-readable specifications. Release placement is additive; see [approved delivery releases](PLAN.md#approved-delivery-releases). + +## Live 36-item release map + +Verified 2026-09-08 against Project #2 (`36` items) and native GitHub parent/`blockedBy` relations. **Release** is the stage that needs the complete original scope. **R1 subset** is an explicit child when the parent mixes MVP and later acceptance. Children do not close parents. Native edges below were not added by this documentation change. + +| Issue | Live status | Release (full original) | R1 subset / notes | Live Agent | +|---|---|---|---|---| +| [#1](https://github.com/1XP-AI/gh-runnerd/issues/1) G01 | In progress | R1 | Full original Goal retained; children #44/#46/#47/#50/#52/#54 are Done slices and do not complete G01 | Luna max | +| [#2](https://github.com/1XP-AI/gh-runnerd/issues/2) G02 | In progress | R3 | Broad Manifest/multi-org/launchd remains here. R1 subset is #67 | Luna max | +| [#3](https://github.com/1XP-AI/gh-runnerd/issues/3) G03 | Done | R1 | Full original bootstrap | Luna max | +| [#4](https://github.com/1XP-AI/gh-runnerd/issues/4) G04 | Backlog | R2 | Full contracts. Still blocked by #1/#2/#3. Not bypassed by #68 | Luna max | +| [#5](https://github.com/1XP-AI/gh-runnerd/issues/5) G05 | Backlog | R2 | Full durable journal | Luna max | +| [#6](https://github.com/1XP-AI/gh-runnerd/issues/6) G06 | Backlog | R2 | Supervised daemon/IPC; not implemented; not R1 | Luna max | +| [#7](https://github.com/1XP-AI/gh-runnerd/issues/7) G07 | Backlog | R2 | Full App credential binding | Luna max | +| [#8](https://github.com/1XP-AI/gh-runnerd/issues/8) G08 | Backlog | R3 | Guided init / Manifest enrollment | Luna max | +| [#9](https://github.com/1XP-AI/gh-runnerd/issues/9) G09 | Backlog | R2 | Full recoverable Scale Set adapter | Luna max | +| [#10](https://github.com/1XP-AI/gh-runnerd/issues/10) G10 | Backlog | R2 | Full Linux Docker workers. R1 reuses the existing paired Linux-container path | Luna max | +| [#11](https://github.com/1XP-AI/gh-runnerd/issues/11) G11 | Backlog | R3 | Trusted native macOS backend; not R1 | Luna max | +| [#12](https://github.com/1XP-AI/gh-runnerd/issues/12) G12 | Backlog | R2 | Full shared capacity/fairness | Luna max | +| [#13](https://github.com/1XP-AI/gh-runnerd/issues/13) G13 | Backlog | R2 | Full reconcile/drain/restart. R1 subset is #68. Original blockers including #11 remain | Luna max | +| [#14](https://github.com/1XP-AI/gh-runnerd/issues/14) G14 | Backlog | R2 | Full status/logs | Luna max | +| [#15](https://github.com/1XP-AI/gh-runnerd/issues/15) G15 | Backlog | R2 | Full service lifecycle | Luna max | +| [#16](https://github.com/1XP-AI/gh-runnerd/issues/16) G16 | Backlog | R3 | Full two-organization qualification. R1 subset is #69 | Luna max | +| [#17](https://github.com/1XP-AI/gh-runnerd/issues/17) G17 | Backlog | R3 | Soak/recovery qualification | Luna max | +| [#18](https://github.com/1XP-AI/gh-runnerd/issues/18) G18 | Backlog | R3 | Signed distribution | Luna max | +| [#19](https://github.com/1XP-AI/gh-runnerd/issues/19) G19 | Backlog | R3 | Trust admission audit | Luna max | +| [#20](https://github.com/1XP-AI/gh-runnerd/issues/20) G20 | Backlog | R2 | Full original placement R2; still natively blocked by #17/#18. No bypass | Luna max | +| [#21](https://github.com/1XP-AI/gh-runnerd/issues/21) G21 | Future | Future | Optional VM/multi-host research | Luna max | +| [#30](https://github.com/1XP-AI/gh-runnerd/issues/30) | Done | R1 | Merged-PR audit | unset | +| [#40](https://github.com/1XP-AI/gh-runnerd/issues/40) G12a | Done | R2 | Child of #12; numeric arithmetic only | Luna max | +| [#44](https://github.com/1XP-AI/gh-runnerd/issues/44) G01a | Done | R1 | Child of #1 | Astra xhigh | +| [#46](https://github.com/1XP-AI/gh-runnerd/issues/46) G01b | Done | R1 | Child of #1 | Astra xhigh | +| [#47](https://github.com/1XP-AI/gh-runnerd/issues/47) G01c | Done | R1 | Child of #1 | Astra xhigh | +| [#50](https://github.com/1XP-AI/gh-runnerd/issues/50) G01d | Done | R1 | Child of #1 | Astra xhigh | +| [#52](https://github.com/1XP-AI/gh-runnerd/issues/52) G01e | Done | R1 | Child of #1 | Astra xhigh | +| [#54](https://github.com/1XP-AI/gh-runnerd/issues/54) G01f | Done | R1 | Child of #1; merged paired execution | Luna max | +| [#60](https://github.com/1XP-AI/gh-runnerd/issues/60) G01g | In progress | R1 | Native parent unset; `blockedBy` #54; blocks #68. Do not retarget from this docs change | Luna max | +| [#61](https://github.com/1XP-AI/gh-runnerd/issues/61) | Done | R1 | CI paired-fixture deadline | Luna max | +| [#64](https://github.com/1XP-AI/gh-runnerd/issues/64) | Done | R1 | CI default G01 deadline coverage | Luna max | +| [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) | In progress | R1 | Planning only. Main author Grok 4.6 xhigh; independent Luna max review | unset | +| [#67](https://github.com/1XP-AI/gh-runnerd/issues/67) | Ready | R1 | Child of #2. Manual single-org credentials. No native blockers | unset | +| [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | Blocked | R1 | Child of #13. `blockedBy` #60/#66/#67 | unset | +| [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | Blocked | R1 | Child of #16. `blockedBy` #1/#68 | unset | + +### Verified native relations (do not duplicate) + +| Issue | Parent | `blockedBy` | Blocks | +|---|---|---|---| +| #67 | #2 | none | #68 | +| #68 | #13 | #60, #66, #67 | #69 | +| #69 | #16 | #1, #68 | none | +| #66 | none | none | #68 | +| #60 | none | #54 | #68 | +| #40 | #12 | #3 | none | +| #44/#46/#47/#50/#52/#54 | #1 | none for these children | #54 blocks #60/#61 | + +Original G04 `blockedBy` #1/#2/#3 and original G13 `blockedBy` #6/#9/#10/#11/#12 are unchanged. Further new issues or edge edits need an explicit ask; the mapping above is already applied. ## Project views -- [Goals](https://github.com/orgs/1XP-AI/projects/2/views/1): every issue with status, stage, model, Goal, risk, dependencies and test profiles. -- [Ready](https://github.com/orgs/1XP-AI/projects/2/views/2): only work whose initial dependencies are clear; its initial entries were G01/G02/G03 and independent G12a. Dispatch only issues currently marked Ready in the live Project. -- [Board](https://github.com/orgs/1XP-AI/projects/2/views/3): status columns with stage, priority and model on cards. +- [Goals](https://github.com/orgs/1XP-AI/projects/2/views/1): every issue with status, stage, model, Goal, risk, dependencies, test profiles and Release. +- [Ready](https://github.com/orgs/1XP-AI/projects/2/views/2): dispatch only issues currently marked Ready in the live Project. As of this snapshot that includes #67; it does not include #68 or #69. +- [Board](https://github.com/orgs/1XP-AI/projects/2/views/3): status columns with stage, priority, model and Release on cards. -The initial board contains 4 Ready, 17 Backlog and 1 Future issue, including the independent G12a child. These are initial planning counts; consult the live Project for current status. Move later issues to Ready only when their dependencies are Done. Model metadata is a dispatch instruction, not an automatic agent scheduler. +The initial board contained 4 Ready, 17 Backlog and 1 Future issue, including the independent G12a child. The live board now has 36 items after additive Release labels and R1 children. Consult the live Project for current status. Move later full-scope issues to Ready only when their dependencies are Done. Model metadata is a dispatch instruction, not an automatic agent scheduler. ## Parallel arithmetic child @@ -49,5 +106,5 @@ Issue [#40](https://github.com/1XP-AI/gh-runnerd/issues/40) is a native sub-issu of G12 #12 with a native dependency on completed G03 #3. Its independently reviewed numeric contract permits isolated target/resource arithmetic now; existing parent dependencies and live evidence gates remain in place. The live -Project records its current progress. See the child issue for exact scope and +Project records G12a as Done. See the child issue for exact scope and acceptance; this addition does not mark G12 or its integration complete. diff --git a/docs/PLAN.md b/docs/PLAN.md index a2e44c9..aa6d6ba 100644 --- a/docs/PLAN.md +++ b/docs/PLAN.md @@ -27,6 +27,8 @@ The first host is an Apple Silicon Mac with 48 GiB RAM. An existing Linux VM has - No automatic replay of interrupted workflows. A host reboot can fail a running job; show its outcome and leave rerun semantics to GitHub/the operator. Reconciliation is not job checkpointing. - The manager will not install arbitrary runtime software or change global Docker contexts implicitly. +Those bullets describe the original product envelope. Maintainer-accepted delivery now sequences that envelope as R1 / R2 / R3 plus Future research; see [Approved delivery releases](#approved-delivery-releases). R1 does not delete these limits and does not reduce issue [#1](https://github.com/1XP-AI/gh-runnerd/issues/1)'s recovery Goal. + ## Architecture ```mermaid @@ -69,11 +71,48 @@ CPU/memory reservations must include Docker service daemons and services, creati ## Delivery stages -M0 settles compatibility and contracts; M1 establishes durable control/authentication; M2 adds execution/scaling; M3 validates security and recovery; M4 packages and migrates through a canary; M5 contains optional VM/fleet research. The ordered issue backlog is the execution source of truth. A blocked gate blocks dependent implementation, not unrelated work. +M0 settles compatibility and contracts; M1 establishes durable control/authentication; M2 adds execution/scaling; M3 validates security and recovery; M4 packages and migrates through a canary; M5 contains optional VM/fleet research. Historical Stage/milestone values stay on the issues. **Release classification is authoritative for user-visible sequencing**; M0–M5 remain the capability taxonomy. A blocked gate still blocks dependent implementation of that issue's full original scope. Relabeling does not bypass native GitHub `blockedBy` edges. Public PR checks run in GitHub-hosted standard environments without credentials. Trusted Mac hardware checks are explicit maintainer runs against reviewed commits. Building gh-runnerd must not depend on gh-runnerd already operating, or rollout failures would block its repair. -After a single trusted canary workflow passes, expand to both organizations with separate pool labels. Drain old workers after new capacity has proven itself. Keep a reversible configuration migration and the original services for rollback until the pilot exit criteria pass. +## Approved delivery releases + +Issue [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) records the maintainer-accepted split. Placement on a release means that release needs the **complete original scope**. It is not a claim that no safe subset is required earlier, and it is not permission to mark a parent Done. Where an original issue mixed internal-MVP and later acceptance, explicit children hold the R1 subset; parents stay open until their own criteria pass. + +The live 36-item map is in [ISSUES.md](ISSUES.md). Production implementation of dependency-blocked full-scope issues is not authorized by this planning change. + +### R1 — Internal MVP + +Operator-visible exit: on this Mac, one organization, one private test repository, the existing reviewed Linux-container backend, concurrency one, and a manually configured App, run one owned job, clean up only owned resources, and demonstrate recovery or quarantine at ACK, acquisition and JIT boundaries. + +Foreground only. `cmd/gh-runnerd` is still an empty entry point; unattended daemon, install, launchd service, reboot persistence, native macOS jobs, Lima or Docker-context changes, a second backend, multi-organization operation, automated Manifest enrollment and general scheduling are not R1 and are not implemented. + +| Issue | R1 role versus original acceptance | +|---|---| +| [#1](https://github.com/1XP-AI/gh-runnerd/issues/1) G01 | **Full original Goal** remains: "Select and pin a supported Scale Set integration path with demonstrated recovery at message acknowledgement, acquisition and JIT boundaries." In progress. No false completion from child merges or a happy-path job. | +| [#67](https://github.com/1XP-AI/gh-runnerd/issues/67) | R1 subset of [#2](https://github.com/1XP-AI/gh-runnerd/issues/2): manual single-organization credentials. Ready; no live App/Keychain/launchd authorization. Parent #2 stays In progress on R3. | +| [#60](https://github.com/1XP-AI/gh-runnerd/issues/60) G01g | Bounded broker handoff for the paired Linux-container path. In progress in a separate worktree. | +| [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) | Planning and documentation synchronization. | +| [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of [#13](https://github.com/1XP-AI/gh-runnerd/issues/13), coordinated slice of #4–#15: one foreground command, capacity one. Blocked by #60, #66 and #67. Freeze the minimal contract before implementation. Completing #68 does not complete #4–#15. | +| [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | R1 subset of [#16](https://github.com/1XP-AI/gh-runnerd/issues/16): authorized real private job plus required ACK/acquisition/JIT recovery. Blocked by #1 and #68. A passing happy-path job is not sufficient. | + +Completed R1-placed records (#3, #30, #44, #46, #47, #50, #52, #54, #61, #64) are historical evidence slices. They do not close #1. + +### R2 — Everyday operations + +Practical install/start/stop/status, restart recovery, bounded scaling and repeated operational use. Full original acceptance of #4, #5, #6, #7, #9, #10, #12, #13, #14, #15, #20 and completed #40. Original G04 blockers (#1/#2/#3) and G13 blockers, including native-macOS #11, remain in force. + +### R3 — General distribution + +Multi-organization support, additional execution modes including trusted native macOS, automated onboarding, signing/update/diagnostics and broad qualification. Full original acceptance of #2, #8, #11, #16, #17, #18, #19. Completing #67 or #69 does not complete #2 or #16. + +### Future research + +[#21](https://github.com/1XP-AI/gh-runnerd/issues/21) G21 remains Future and is not a release dependency. + +[#20](https://github.com/1XP-AI/gh-runnerd/issues/20) is placed on R2 for full original acceptance and remains natively blocked by R3 issues #17 and #18. That historical edge is preserved; this plan does not claim a dependency bypass. + +After a single trusted canary workflow passes, expand to both organizations with separate pool labels. That expansion is G16/R3, not R1. Drain old workers after new capacity has proven itself. Keep a reversible configuration migration and the original services for rollback until the pilot exit criteria pass. ## Runner version freshness diff --git a/docs/backlog.json b/docs/backlog.json index e0db6c0..6aac0a2 100644 --- a/docs/backlog.json +++ b/docs/backlog.json @@ -31,7 +31,8 @@ "github_issue": { "number": 1, "url": "https://github.com/1XP-AI/gh-runnerd/issues/1" - } + }, + "release": "R1 - Internal MVP" }, { "key": "G02", @@ -64,7 +65,9 @@ "github_issue": { "number": 2, "url": "https://github.com/1XP-AI/gh-runnerd/issues/2" - } + }, + "release": "R3 - General distribution", + "r1_subset": "G02-R1" }, { "key": "G03", @@ -95,7 +98,8 @@ "github_issue": { "number": 3, "url": "https://github.com/1XP-AI/gh-runnerd/issues/3" - } + }, + "release": "R1 - Internal MVP" }, { "key": "G04", @@ -131,7 +135,8 @@ "github_issue": { "number": 4, "url": "https://github.com/1XP-AI/gh-runnerd/issues/4" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G05", @@ -165,7 +170,8 @@ "github_issue": { "number": 5, "url": "https://github.com/1XP-AI/gh-runnerd/issues/5" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G06", @@ -199,7 +205,8 @@ "github_issue": { "number": 6, "url": "https://github.com/1XP-AI/gh-runnerd/issues/6" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G07", @@ -236,7 +243,8 @@ "github_issue": { "number": 7, "url": "https://github.com/1XP-AI/gh-runnerd/issues/7" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G08", @@ -271,7 +279,8 @@ "github_issue": { "number": 8, "url": "https://github.com/1XP-AI/gh-runnerd/issues/8" - } + }, + "release": "R3 - General distribution" }, { "key": "G09", @@ -307,7 +316,8 @@ "github_issue": { "number": 9, "url": "https://github.com/1XP-AI/gh-runnerd/issues/9" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G10", @@ -346,7 +356,8 @@ "github_issue": { "number": 10, "url": "https://github.com/1XP-AI/gh-runnerd/issues/10" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G11", @@ -386,7 +397,8 @@ "github_issue": { "number": 11, "url": "https://github.com/1XP-AI/gh-runnerd/issues/11" - } + }, + "release": "R3 - General distribution" }, { "key": "G12", @@ -421,7 +433,8 @@ "github_issue": { "number": 12, "url": "https://github.com/1XP-AI/gh-runnerd/issues/12" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G12a", @@ -455,7 +468,8 @@ "github_issue": { "number": 40, "url": "https://github.com/1XP-AI/gh-runnerd/issues/40" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G13", @@ -494,7 +508,9 @@ "github_issue": { "number": 13, "url": "https://github.com/1XP-AI/gh-runnerd/issues/13" - } + }, + "release": "R2 - Everyday operations", + "r1_subset": "G13-R1" }, { "key": "G14", @@ -529,7 +545,8 @@ "github_issue": { "number": 14, "url": "https://github.com/1XP-AI/gh-runnerd/issues/14" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G15", @@ -565,7 +582,8 @@ "github_issue": { "number": 15, "url": "https://github.com/1XP-AI/gh-runnerd/issues/15" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G16", @@ -603,7 +621,9 @@ "github_issue": { "number": 16, "url": "https://github.com/1XP-AI/gh-runnerd/issues/16" - } + }, + "release": "R3 - General distribution", + "r1_subset": "G16-R1" }, { "key": "G17", @@ -641,7 +661,8 @@ "github_issue": { "number": 17, "url": "https://github.com/1XP-AI/gh-runnerd/issues/17" - } + }, + "release": "R3 - General distribution" }, { "key": "G18", @@ -677,7 +698,8 @@ "github_issue": { "number": 18, "url": "https://github.com/1XP-AI/gh-runnerd/issues/18" - } + }, + "release": "R3 - General distribution" }, { "key": "G19", @@ -716,7 +738,8 @@ "github_issue": { "number": 19, "url": "https://github.com/1XP-AI/gh-runnerd/issues/19" - } + }, + "release": "R3 - General distribution" }, { "key": "G20", @@ -752,7 +775,8 @@ "github_issue": { "number": 20, "url": "https://github.com/1XP-AI/gh-runnerd/issues/20" - } + }, + "release": "R2 - Everyday operations" }, { "key": "G21", @@ -785,6 +809,152 @@ "github_issue": { "number": 21, "url": "https://github.com/1XP-AI/gh-runnerd/issues/21" + }, + "release": "Future research" + }, + { + "key": "P66", + "title": "Reframe delivery into MVP, operations and distribution releases", + "stage": "M0 - Evidence gates", + "agent": "Grok 4.6 xhigh", + "review_agent": "Luna max", + "dependencies": [], + "release": "R1 - Internal MVP", + "goal": "Reorganize delivery into an internal single-host MVP, an everyday operations release, and a general-distribution release without weakening the existing Scale Set recovery objective or safety/review gates.", + "scope": "Documentation and mapping only. Preserve G01 issue #1 exact Goal and acceptance evidence. Do not create another native goal. No live operations. No production implementation of dependency-blocked issues.", + "tdd": [ + "Prose-only planning change: use link checks, diff review and issue/Project mapping verification. Do not invent application tests." + ], + "acceptance": [ + "Three release stages and concrete user-visible exit criteria documented.", + "All current issues mapped, with native dependency updates only where justified and no false Done states.", + "Minimum executable MVP critical path identified, with unimplemented CLI/daemon/install work explicit.", + "Existing G01 full objective preserved; no live evidence represented as complete.", + "Focused independently reviewed PR, exact-head clean Codex verdict and CI before merge." + ], + "risk": "Medium", + "kind": "planning", + "priority": "P0", + "status": "In progress", + "test_profile": [ + "offline" + ], + "github_issue": { + "number": 66, + "url": "https://github.com/1XP-AI/gh-runnerd/issues/66" + } + }, + { + "key": "G02-R1", + "parent": "G02", + "title": "Prove manual single-organization credentials for the foreground MVP", + "stage": "M0 - Evidence gates", + "agent": "Grok 4.6 xhigh", + "review_agent": "Luna max", + "dependencies": [], + "release": "R1 - Internal MVP", + "goal": "Demonstrate a manually configured single-organization credential path for the foreground MVP that binds the intended installation and never exposes management credentials to workers.", + "scope": "Extract the R1 credential subset of #2 without closing or rewriting its broader Manifest, multi-organization or launchd qualification. Foreground-only; unattended login/logout/reboot service behavior is not supported in R1. No implicit live authorization.", + "tdd": [ + "Red: missing/wrong/expired credentials, wrong installation and partial setup refuse safely without extra Apps or leaked values.", + "Management credentials never reach worker argv/environment/files; only per-worker JIT follows the reviewed G01 transport.", + "Live/runtime checks require reviewed commits and explicit concrete maintainer authorization." + ], + "acceptance": [ + "Explicit minimal permission, org/repository/installation identity and credential source validation before remote effects.", + "Actual authorized manual configuration works; negative cases refuse safely.", + "Credentials are not persisted or imported to Keychain implicitly.", + "Broader #2 remains open until its own criteria pass." + ], + "risk": "High", + "kind": "gate", + "priority": "P0", + "status": "Ready", + "test_profile": [ + "offline", + "trusted-runtime", + "trusted-live-github" + ], + "github_issue": { + "number": 67, + "url": "https://github.com/1XP-AI/gh-runnerd/issues/67" + } + }, + { + "key": "G13-R1", + "parent": "G13", + "title": "Deliver one foreground command for a bounded single-worker lifecycle", + "stage": "M2 - Execution and scaling", + "agent": "Grok 4.6 xhigh", + "review_agent": "Luna max", + "dependencies": [ + "#60", + "P66", + "G02-R1" + ], + "release": "R1 - Internal MVP", + "goal": "Provide a foreground MVP command that connects the reviewed broker and paired worker lifecycle for one organization, one private repository and one worker, with durable fail-stop state and safe owned cleanup.", + "scope": "Vertical R1 slice of #4/#5/#6/#7/#9/#10/#13/#14 with primary parent #13. Reuse the reviewed paired Linux-container execution path. No second backend, native macOS jobs, daemon/install or context switch. Freeze the minimal contract before implementation.", + "tdd": [ + "Contract review precedes implementation; do not start while blocked by #60/#66/#67.", + "Negative tests for authority mutation, partial state, timeout, cancellation and non-owned cleanup.", + "No claim that the existing empty product entry point already implements the command." + ], + "acceptance": [ + "One documented user-facing entry point, explicit configuration and safe status output.", + "Bound org/repository/installation and one owned worker, shared capacity hard-limit one.", + "Foreground interruption stops new admission and preserves busy/unknown work.", + "Completing this child does not complete #4\u2013#15." + ], + "risk": "High", + "kind": "implementation", + "priority": "P0", + "status": "Blocked", + "test_profile": [ + "offline" + ], + "github_issue": { + "number": 68, + "url": "https://github.com/1XP-AI/gh-runnerd/issues/68" + } + }, + { + "key": "G16-R1", + "parent": "G16", + "title": "Qualify the internal MVP with an authorized real job and recovery evidence", + "stage": "M3 - Reliability qualification", + "agent": "Grok 4.6 xhigh", + "review_agent": "Luna max", + "dependencies": [ + "G01", + "G13-R1" + ], + "release": "R1 - Internal MVP", + "goal": "Qualify the single-host internal MVP with an explicitly authorized real private-repository job, safe cleanup and demonstrated ACK, acquisition and JIT recovery or quarantine behavior.", + "scope": "R1 qualification subset of #16. One Mac, one org/private repository, first reviewed execution backend and maximum one active worker. A passing happy-path job is not evidence for lost ACK/acquisition/JIT recovery.", + "tdd": [ + "Cover #1 required ACK, acquisition and JIT loss boundaries and idle-assignment/drain race with real evidence.", + "Demonstrate no busy-job termination under normal scale-down, no duplicate execution, no non-owned cleanup.", + "List every skipped case as unresolved." + ], + "acceptance": [ + "Exact reviewed commit, pinned identities, private runner-group/repository policy and bounded concrete maintainer authorization recorded before dispatch.", + "Real hosted control-plane/private canary workflow executes one owned worker with independently observed terminal/absence evidence.", + "Keep R1 qualification open until all required cases pass or reach the specified safe quarantine outcome.", + "Broader #16 remains open." + ], + "risk": "High", + "kind": "gate", + "priority": "P0", + "status": "Blocked", + "test_profile": [ + "offline", + "trusted-runtime", + "trusted-live-github" + ], + "github_issue": { + "number": 69, + "url": "https://github.com/1XP-AI/gh-runnerd/issues/69" } } ] From ee4d47b68e651d0174b1ad57855d1d119b51d6a8 Mon Sep 17 00:00:00 2001 From: JinWoo Lee Date: Tue, 8 Sep 2026 23:31:32 +0900 Subject: [PATCH 2/7] docs: address Codex review of the delivery-plan map Skip Project Agent writes for issue-body-only Grok overrides, keep #68 contract-first without new native edges, and add a keyed G01g backlog record so #68 dependencies resolve. --- docs/BACKLOG.md | 8 ++++---- docs/EXECUTION.md | 2 +- docs/HANDOFF.md | 31 ++++++++++++++++++++++++------- docs/ISSUES.md | 4 ++-- docs/PLAN.md | 12 +++++++----- docs/backlog.json | 32 ++++++++++++++++++++++++++++++-- 6 files changed, 68 insertions(+), 21 deletions(-) diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md index 1ecaaa4..084ebc0 100644 --- a/docs/BACKLOG.md +++ b/docs/BACKLOG.md @@ -2,7 +2,7 @@ Every original row is a full-scope goal. G01/G02 remain evidence gates; G03 is done. See [execution policy](EXECUTION.md), [approved delivery releases](PLAN.md#approved-delivery-releases) and each GitHub issue for acceptance and TDD details. -**Release classification is authoritative for user-visible sequencing.** Historical M0–M5 stages, original Goal text, Agent history and native `blockedBy` edges are retained. Relabeling does not make a blocked full-scope issue Ready and does not close a parent when a child lands. +**Release placement names which user-visible release needs the complete original scope.** Historical M0–M5 stages, original Goal text, Agent history and native `blockedBy` edges are retained. Relabeling does not make a blocked full-scope issue Ready, does not close a parent when a child lands, and does not make an R2 original-acceptance set independently shippable while it is natively blocked by R3-placed issues. The live 36-item map is in [ISSUES.md](ISSUES.md). Default implementer is Luna max unless the issue records an explicit current user override; #66 and R1 children #67/#68/#69 are Grok 4.6 xhigh with independent Luna max review. @@ -16,7 +16,7 @@ Foreground MVP on this Mac: one org, one private repository, existing Linux-cont | G02-R1 | [#67](https://github.com/1XP-AI/gh-runnerd/issues/67) | R1 subset of G02 #2 (manual single-org credentials). Parent #2 stays R3 In progress | none | Ready | | G01g | [#60](https://github.com/1XP-AI/gh-runnerd/issues/60) | Bounded broker handoff for the paired Linux-container path | #54 (Done) | In progress | | P66 | [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) | Delivery-plan documentation | none | In progress | -| G13-R1 | [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of G13 #13: one foreground command. Freeze the minimal contract before implementation | #60, #66, #67 | Blocked | +| G13-R1 | [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of G13 #13. First authorized work is a reviewed minimal contract, not production daemon/CLI and not a G01/G02/G04 bypass. Live recovery stays on #1→#69 | #60, #66, #67 | Blocked | | G16-R1 | [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | R1 subset of G16 #16: authorized real job plus required recovery | #1, #68 | Blocked | #68 must not start implementation while blocked. Completing a child does not complete G02, G04–G15 or G16. @@ -45,7 +45,7 @@ Foreground MVP on this Mac: one org, one private repository, existing Linux-cont | G17 | Qualify crash recovery, soak and resource budgets | M3 - Reliability qualification | R3 | Luna max | G16, G19 | | G18 | Package signed releases and reproducible distribution | M4 - Pilot and release | R3 | Luna max | G03, G15, G17 | | G19 | Audit trust admission and cross-worker secret boundaries | M3 - Reliability qualification | R3 | Luna max | G08, G10, G11, G13 | -| G20 | Pilot migration with reversible legacy runner handoff | M4 - Pilot and release | R2 | Luna max | G17, G18 (R3). Historical edge preserved; no bypass | +| G20 | Pilot migration with reversible legacy runner handoff | M4 - Pilot and release | R2 | Luna max | G17, G18 (R3). Full original R2 placement cannot close until those R3 blockers finish; no bypass | | G21 | Evaluate optional macOS VM and multi-host providers | M5 - Future | Future | Luna max | G17 | The machine-readable source is [backlog.json](backlog.json). Published issue numbers and links are in [ISSUES.md](ISSUES.md); all original dependencies remain native GitHub blocking relationships. Full-scope first-release implementation goals except G03/G12a remain open. @@ -54,7 +54,7 @@ The machine-readable source is [backlog.json](backlog.json). Published issue num - Continue G01 (full recovery Goal) and G02 (full Manifest/multi-org/launchd Goal) independently; they are not replaced by #67. - #67 may proceed as isolated R1 credential evidence without waiting on G02's remaining R3 criteria; it does not authorize live App/Keychain/launchd mutation. -- G04 still integrates the full gates before shared full-scope implementation. #68 is not a G04 bypass. +- G04 still integrates the full gates before shared full-scope implementation. #68 is not a G04 bypass: its first authorized work is a reviewed R1 contract, and live G01 recovery remains #69 blocked by #1. - After G05, IPC, auth, and pure scheduling can proceed with separate file ownership for R2/R3 work. - Linux and native macOS providers can proceed independently once shared contracts/credentials exist; native macOS is R3. - Integration, security verdict, soak and rollout remain sequential evidence gates. diff --git a/docs/EXECUTION.md b/docs/EXECUTION.md index e13d387..b09fd6d 100644 --- a/docs/EXECUTION.md +++ b/docs/EXECUTION.md @@ -39,7 +39,7 @@ was complete at merge time. ## Board fields -Status, Stage, Priority, Agent, Risk, Goal, Dependencies, Test profile and Release. Stage/milestones preserve the original M0–M5 taxonomy. Release is additive sequencing (R1 Internal MVP, R2 Everyday operations, R3 General distribution, Future research) and does not change acceptance text or native dependency gates. Initial gates/bootstrap work is Ready; dependent full-scope work is Backlog. R1 children use their own documented dependencies: #67 is Ready with no production dependency; #68 is Blocked by #60/#66/#67 until those complete and its minimal contract is reviewed; #69 is Blocked by #1/#68. Ready on a child is not a bypass of the parent's remaining blockers. VM/fleet research is explicitly Future. Machine-readable `status` and `test_profile` values are in `backlog.json`; trusted-runtime and trusted-live-github profiles require maintainer-controlled execution and never run on public PR code. +Status, Stage, Priority, Agent, Risk, Goal, Dependencies, Test profile and Release. Stage/milestones preserve the original M0–M5 taxonomy. Release is additive sequencing (R1 Internal MVP, R2 Everyday operations, R3 General distribution, Future research) and does not change acceptance text or native dependency gates. Initial gates/bootstrap work is Ready; dependent full-scope work is Backlog. R1 children use their own documented dependencies: #67 is Ready with no production dependency; #68 is Blocked by #60/#66/#67 until those complete and its **minimal contract is independently reviewed before implementation**; #69 is Blocked by full G01 #1 and #68. Ready on a child is not a bypass of the parent's remaining blockers and does not satisfy AGENTS.md G01/G02 gates for G04+ full-scope work. VM/fleet research is explicitly Future. Machine-readable `status` and `test_profile` values are in `backlog.json`; trusted-runtime and trusted-live-github profiles require maintainer-controlled execution and never run on public PR code. G08 enrollment and G15 service lifecycle remain gated by their contracts and independent review. Default implementation and review are Luna max; recorded overrides such as Grok 4.6 xhigh on #66/#67/#68/#69 still require independent Luna max review. G12 computes pure proposals, while G05/G13 own atomic reservation and live admission under the parent full-scope gates. diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index 9c92c70..74b88e0 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -198,8 +198,11 @@ second native Goal on #1 while this planning work runs. For every new issue, after checking for an explicit current user override: -- set the Project Agent field to `Luna max` when no override exists, otherwise set - it to the explicitly requested routing when that option exists; +- set the Project Agent field to `Luna max` when no override exists; +- when an override exists and the Project Agent field has that option, set it to + that option; when the override has **no** Project option (today: Grok 4.6 xhigh + on #66/#67/#68/#69), **skip the Agent edit** and leave the field unset — do not + write Luna as a substitute implementer. Independent review remains Luna max; - use one active goal whose objective is exactly the issue's `Goal` statement; - do not invent a token budget; - use an independent contract review with the current selected review model/effort @@ -248,7 +251,7 @@ invariants. If a blocker is open, stop and report that state for the authorized issue. Select another issue only when a separate user task explicitly authorizes that new scope. -### 2. Resolve the Project item and route it to Luna +### 2. Resolve the Project item and route the Agent field ```sh PROJECT_ID=PVT_kwDOD2M2gs4Bismw @@ -256,8 +259,16 @@ STATUS_FIELD_ID=PVTSSF_lADOD2M2gs4BismwzhhjoZA AGENT_FIELD_ID=PVTSSF_lADOD2M2gs4Bismwzhhjobs STATUS_IN_PROGRESS_ID=7a569f61 AGENT_LUNA_MAX_ID=9317c27f -# Use the explicit current user-selected Project option when one exists. +# Default implementer is Luna max. Issue-body-only overrides with no Project +# Agent option must not be rewritten to Luna; leave Agent unset. +SKIP_AGENT_EDIT=0 AGENT_OPTION_ID="$AGENT_LUNA_MAX_ID" +case "$ISSUE" in + 66|67|68|69) + SKIP_AGENT_EDIT=1 + AGENT_OPTION_ID="" + ;; +esac ITEM_JSON="$(gh project item-list "$PROJECT_NUMBER" --owner "$OWNER" \ --limit 1000 --format json)" @@ -280,8 +291,13 @@ if [ "$ITEM_STATUS" != "Ready" ]; then exit 1 fi -gh project item-edit --id "$ITEM_ID" --project-id "$PROJECT_ID" \ - --field-id "$AGENT_FIELD_ID" --single-select-option-id "$AGENT_OPTION_ID" +if [ "$SKIP_AGENT_EDIT" = 1 ]; then + printf 'issue %s has a Grok 4.6 xhigh override with no Project Agent option; leaving Agent unset (was %s)\n' \ + "$ISSUE" "$ITEM_AGENT" +else + gh project item-edit --id "$ITEM_ID" --project-id "$PROJECT_ID" \ + --field-id "$AGENT_FIELD_ID" --single-select-option-id "$AGENT_OPTION_ID" +fi ``` If the item is already In progress for another active agent, the guard above stops @@ -290,7 +306,8 @@ the issue's durable Goal/Dependencies fields and `docs/backlog.json` aligned onl when the contract actually changes. If the current user selected another supported model/effort, resolve its Project Agent option ID with `gh project field-list` and replace `AGENT_OPTION_ID`; never overwrite -an explicit current selection with the default. +an explicit current selection with the default, and never write Luna over an +issue-body-only override that has no Agent option. Independent review stays Luna max. ### 3. Start one active goal and an isolated worktree diff --git a/docs/ISSUES.md b/docs/ISSUES.md index 1fe1bd3..927e1dd 100644 --- a/docs/ISSUES.md +++ b/docs/ISSUES.md @@ -37,7 +37,7 @@ Each original issue has one Goal statement, scope, TDD cases, acceptance criteri ## Live 36-item release map -Verified 2026-09-08 against Project #2 (`36` items) and native GitHub parent/`blockedBy` relations. **Release** is the stage that needs the complete original scope. **R1 subset** is an explicit child when the parent mixes MVP and later acceptance. Children do not close parents. Native edges below were not added by this documentation change. +Verified 2026-09-08 against Project #2 (`36` items) and native GitHub parent/`blockedBy` relations. **Release** is the stage that needs the complete original scope; it is not a closed DAG that can ship before natively blocking issues on later releases. **R1 subset** is an explicit child when the parent mixes MVP and later acceptance. Children do not close parents. Native edges below were not added by this documentation change. | Issue | Live status | Release (full original) | R1 subset / notes | Live Agent | |---|---|---|---|---| @@ -75,7 +75,7 @@ Verified 2026-09-08 against Project #2 (`36` items) and native GitHub parent/`bl | [#64](https://github.com/1XP-AI/gh-runnerd/issues/64) | Done | R1 | CI default G01 deadline coverage | Luna max | | [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) | In progress | R1 | Planning only. Main author Grok 4.6 xhigh; independent Luna max review | unset | | [#67](https://github.com/1XP-AI/gh-runnerd/issues/67) | Ready | R1 | Child of #2. Manual single-org credentials. No native blockers | unset | -| [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | Blocked | R1 | Child of #13. `blockedBy` #60/#66/#67 | unset | +| [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | Blocked | R1 | Child of #13. `blockedBy` #60/#66/#67. Contract review before implementation; not a G01/G02/G04 bypass. Live recovery is #69←#1 | unset | | [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | Blocked | R1 | Child of #16. `blockedBy` #1/#68 | unset | ### Verified native relations (do not duplicate) diff --git a/docs/PLAN.md b/docs/PLAN.md index aa6d6ba..222bcd1 100644 --- a/docs/PLAN.md +++ b/docs/PLAN.md @@ -71,7 +71,7 @@ CPU/memory reservations must include Docker service daemons and services, creati ## Delivery stages -M0 settles compatibility and contracts; M1 establishes durable control/authentication; M2 adds execution/scaling; M3 validates security and recovery; M4 packages and migrates through a canary; M5 contains optional VM/fleet research. Historical Stage/milestone values stay on the issues. **Release classification is authoritative for user-visible sequencing**; M0–M5 remain the capability taxonomy. A blocked gate still blocks dependent implementation of that issue's full original scope. Relabeling does not bypass native GitHub `blockedBy` edges. +M0 settles compatibility and contracts; M1 establishes durable control/authentication; M2 adds execution/scaling; M3 validates security and recovery; M4 packages and migrates through a canary; M5 contains optional VM/fleet research. Historical Stage/milestone values stay on the issues. **Release placement names which user-visible release needs the complete original scope**; M0–M5 remain the capability taxonomy. Native `blockedBy` edges remain the implementation start gate. Relabeling does not reorder those edges or make a full-scope issue Ready. Public PR checks run in GitHub-hosted standard environments without credentials. Trusted Mac hardware checks are explicit maintainer runs against reviewed commits. Building gh-runnerd must not depend on gh-runnerd already operating, or rollout failures would block its repair. @@ -93,14 +93,16 @@ Foreground only. `cmd/gh-runnerd` is still an empty entry point; unattended daem | [#67](https://github.com/1XP-AI/gh-runnerd/issues/67) | R1 subset of [#2](https://github.com/1XP-AI/gh-runnerd/issues/2): manual single-organization credentials. Ready; no live App/Keychain/launchd authorization. Parent #2 stays In progress on R3. | | [#60](https://github.com/1XP-AI/gh-runnerd/issues/60) G01g | Bounded broker handoff for the paired Linux-container path. In progress in a separate worktree. | | [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) | Planning and documentation synchronization. | -| [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of [#13](https://github.com/1XP-AI/gh-runnerd/issues/13), coordinated slice of #4–#15: one foreground command, capacity one. Blocked by #60, #66 and #67. Freeze the minimal contract before implementation. Completing #68 does not complete #4–#15. | -| [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | R1 subset of [#16](https://github.com/1XP-AI/gh-runnerd/issues/16): authorized real private job plus required ACK/acquisition/JIT recovery. Blocked by #1 and #68. A passing happy-path job is not sufficient. | +| [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of [#13](https://github.com/1XP-AI/gh-runnerd/issues/13), coordinated slice of #4–#15. Native blockers remain #60, #66 and #67; do not add #1/#2 without an explicit ask. **First authorized work is a reviewed minimal contract**, not `cmd/gh-runnerd` production behavior and not a G04/G13 bypass. Implementation after that contract still reuses the reviewed G01 paired Linux-container path (#54/#60) and R1 credentials (#67). It must not claim G01 or G02 complete. Completing #68 does not complete #4–#15. | +| [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | R1 subset of [#16](https://github.com/1XP-AI/gh-runnerd/issues/16): authorized real private job plus required ACK/acquisition/JIT recovery. Blocked by **full** [#1](https://github.com/1XP-AI/gh-runnerd/issues/1) and #68. A passing happy-path job is not sufficient. This is the G01 recovery gate for the R1 operator exit. | -Completed R1-placed records (#3, #30, #44, #46, #47, #50, #52, #54, #61, #64) are historical evidence slices. They do not close #1. +Completed R1-placed records (#3, #30, #44, #46, #47, #50, #52, #54, #61, #64) are historical evidence slices. They do not close #1. G01/G02 full-scope gates still bind G04 and later parents. ### R2 — Everyday operations -Practical install/start/stop/status, restart recovery, bounded scaling and repeated operational use. Full original acceptance of #4, #5, #6, #7, #9, #10, #12, #13, #14, #15, #20 and completed #40. Original G04 blockers (#1/#2/#3) and G13 blockers, including native-macOS #11, remain in force. +Operator-visible target: install/start/stop/status, restart recovery, bounded scaling and repeated use of the R1 foreground path as a supervised service. + +**Complete original acceptance** of #4, #5, #6, #7, #9, #10, #12, #13, #14, #15, #20 and completed #40 is still placed on R2. That set is **not independently shippable before R3-placed blockers**: #4 waits on #2, #13 waits on #11, #20 waits on #17/#18. Everyday-operations work may start only when its own native dependencies are Done (for example completed #40). Further R2 children would be required to split those mixed issues; do not create them without an explicit ask. ### R3 — General distribution diff --git a/docs/backlog.json b/docs/backlog.json index 6aac0a2..6fe5f61 100644 --- a/docs/backlog.json +++ b/docs/backlog.json @@ -812,6 +812,34 @@ }, "release": "Future research" }, + { + "key": "G01g", + "title": "Wire paired terminal execution through a bounded broker handoff", + "stage": "M0 - Evidence gates", + "agent": "Luna max", + "dependencies": [], + "release": "R1 - Internal MVP", + "goal": "Connect the reviewed paired terminal path to one same-process experimental executable and a narrowly bound broker handoff, with offline evidence that authority, credential separation and fail-stop recovery boundaries are preserved.", + "scope": "Tracked on issue #60 and PR #62 in a separate worktree. This keyed record exists so R1 dependencies resolve. It is not G01 completion and does not duplicate runtime or CI evidence.", + "tdd": [ + "See issue #60. Do not edit #60/#62 from the #66 documentation branch." + ], + "acceptance": [ + "Issue #60 remains the source of acceptance.", + "Completing G01g does not complete G01 #1." + ], + "risk": "High", + "kind": "gate", + "priority": "P0", + "status": "In progress", + "test_profile": [ + "offline" + ], + "github_issue": { + "number": 60, + "url": "https://github.com/1XP-AI/gh-runnerd/issues/60" + } + }, { "key": "P66", "title": "Reframe delivery into MVP, operations and distribution releases", @@ -888,7 +916,7 @@ "agent": "Grok 4.6 xhigh", "review_agent": "Luna max", "dependencies": [ - "#60", + "G01g", "P66", "G02-R1" ], @@ -896,7 +924,7 @@ "goal": "Provide a foreground MVP command that connects the reviewed broker and paired worker lifecycle for one organization, one private repository and one worker, with durable fail-stop state and safe owned cleanup.", "scope": "Vertical R1 slice of #4/#5/#6/#7/#9/#10/#13/#14 with primary parent #13. Reuse the reviewed paired Linux-container execution path. No second backend, native macOS jobs, daemon/install or context switch. Freeze the minimal contract before implementation.", "tdd": [ - "Contract review precedes implementation; do not start while blocked by #60/#66/#67.", + "Contract review precedes implementation; do not start while blocked by G01g/#60, P66/#66 and G02-R1/#67.", "Negative tests for authority mutation, partial state, timeout, cancellation and non-owned cleanup.", "No claim that the existing empty product entry point already implements the command." ], From dbd20b1c2ca5e44ae7609b8c3b8969ef9a3d0cc4 Mon Sep 17 00:00:00 2001 From: JinWoo Lee Date: Tue, 8 Sep 2026 23:42:35 +0900 Subject: [PATCH 3/7] docs: keep Luna as independent reviewer under Grok overrides Distinguish implementer selection from reviewer selection in the handoff prompt, dispatch text and verification checklist. --- docs/EXECUTION.md | 4 ++-- docs/HANDOFF.md | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/EXECUTION.md b/docs/EXECUTION.md index b09fd6d..50c8424 100644 --- a/docs/EXECUTION.md +++ b/docs/EXECUTION.md @@ -19,7 +19,7 @@ Verify each issue's contract and dependencies before dependent implementation be 2. In the implementation task, create **one active goal** from the issue's Goal statement. Do not invent a token budget. Record issue URL and goal status in that task. 3. Create a dedicated branch/worktree. Keep one issue's behavior in one PR; split only if the issue's acceptance contract requires it. 4. Follow red -> green -> refactor, with meaningful failure evidence before the fix and relevant automated checks afterward. -5. Ask the assigned independent reviewer to check invariants and failure cases. Record reviewer/model and outcomes in the PR. This internal review is separate from the GitHub Codex review. +5. Ask the assigned independent reviewer to check invariants and failure cases. Independent review is Luna max unless the issue records a different reviewer; an implementer override does not change the reviewer. Record reviewer/model and outcomes in the PR. This internal review is separate from the GitHub Codex review. 6. Move Project status to In review. Wait for GitHub Codex to finish reviewing the exact current PR head. Use the configured `codex-review` skill to read both inline reviews and issue-comment findings, including stale/outdated findings. Reproduce each finding; fix it or provide a specific evidence-based rebuttal. After pushing fixes, request `@codex review` and wait for the new result. Merge only when required CI and both review paths are complete, no actionable finding remains unresolved, and the issue's existing authorization permits it. Check the current head immediately before merge and constrain the merge to that SHA. 7. Close the issue and mark its goal complete only when all acceptance criteria and evidence are satisfied. If the goal includes merge, a merely opened PR is not completion. @@ -35,7 +35,7 @@ was complete at merge time. ## Reusable dispatch text -> Work on ISSUE_URL using the issue's assigned model/effort and one active goal equal to its Goal statement. Read AGENTS.md and linked design decisions. Verify dependencies first. Use a separate worktree, write the meaningful failing test before implementation, and preserve the no-secrets/no-busy-kill/owned-cleanup invariants. Do not change existing live runners or enroll new Apps unless the issue explicitly authorizes that operation. Open a reviewed PR with commands/results, red evidence, limitations and rollback notes. Update the Project accurately; do not mark the goal complete while required work remains. +> Work on ISSUE_URL using the issue's implementer (default Luna max; #66/#67/#68/#69 are Grok 4.6 xhigh) and one active goal equal to its Goal statement. Independent review is Luna max even when the implementer is overridden. Read AGENTS.md and linked design decisions. Verify dependencies first. Use a separate worktree, write the meaningful failing test before implementation, and preserve the no-secrets/no-busy-kill/owned-cleanup invariants. Do not change existing live runners or enroll new Apps unless the issue explicitly authorizes that operation. Open a reviewed PR with commands/results, red evidence, limitations and rollback notes. Update the Project accurately; do not mark the goal complete while required work remains. ## Board fields diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index 74b88e0..129892d 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -214,7 +214,7 @@ For every new issue, after checking for an explicit current user override: Suggested handoff prompt to give the next agent: -> Work on ISSUE_URL in `1XP-AI/gh-runnerd`. Use the current user-selected model/effort (the default is `gpt-5.6-luna` with `max`) and one active goal exactly equal to the issue's Goal statement; do not invent a token budget. Read `AGENTS.md`, `docs/EXECUTION.md`, the plan, the linked ADRs and the current Project item. Verify dependencies first. Create the goal and isolated branch/worktree, then set the item to In progress. Follow meaningful red test -> minimal green implementation -> refactor -> boundary/failure tests. Preserve no-secrets, no-busy-kill, owned-cleanup, stable-idempotency and trusted-native invariants. Do not change live runners, Docker context, App/Keychain/launchd state or GitHub credentials without explicit maintainer authorization. Open one focused PR with exact commands/results, red evidence, gaps and rollback notes. Obtain independent review using the current user-selected model/effort, then the exact-head GitHub Codex review before merge. Update the Project, issue and goal only when their actual state changes. +> Work on ISSUE_URL in `1XP-AI/gh-runnerd`. Use the issue's implementer (default `gpt-5.6-luna` with `max`; #66/#67/#68/#69 are Grok 4.6 xhigh) and one active goal exactly equal to the issue's Goal statement; do not invent a token budget. Independent review is Luna max even when the implementer is overridden. Read `AGENTS.md`, `docs/EXECUTION.md`, the plan, the linked ADRs and the current Project item. Verify dependencies first. Create the goal and isolated branch/worktree, then set the item to In progress. Follow meaningful red test -> minimal green implementation -> refactor -> boundary/failure tests. Preserve no-secrets, no-busy-kill, owned-cleanup, stable-idempotency and trusted-native invariants. Do not change live runners, Docker context, App/Keychain/launchd state or GitHub credentials without explicit maintainer authorization. Open one focused PR with exact commands/results, red evidence, gaps and rollback notes. Obtain independent Luna max review, then the exact-head GitHub Codex review before merge. Update the Project, issue and goal only when their actual state changes. Do not write Luna into the Project Agent field over an issue-body-only Grok override. ## Per-issue Project workflow @@ -540,16 +540,16 @@ Before handing work onward, confirm: - [ ] `git status` is clean or the changes are on the declared issue branch. - [ ] The issue Goal was copied exactly into one active goal; no invented budget. - [ ] Dependencies and Project status were checked live. -- [ ] Project Agent matches the current user-selected model/effort (default: - `Luna max`, with the recorded Grok 4.6 xhigh override on #66/#67/#68/#69); - historical records and #1/#2/#60 Agent values were not rewritten. +- [ ] Implementer matches the current user-selected model/effort (default: + `Luna max`; #66/#67/#68/#69 are Grok 4.6 xhigh with Agent left unset). + Historical records and #1/#2/#60 Agent values were not rewritten. - [ ] A meaningful red case, minimal green fix and relevant boundary tests are recorded, with actual commands/results and remaining gaps. - [ ] No secrets, personal paths, raw SDK errors, live tokens or unreviewed runner operations entered files, issues, logs or artifacts. - [ ] Busy work was never killed and cleanup is ownership-bound. -- [ ] Internal independent review using the current user-selected model/effort - (default: Luna max) is recorded. +- [ ] Internal independent Luna max review is recorded. An implementer override + does not change the reviewer. - [ ] Codex reviewed the exact current PR head; inline and issue-comment findings were read and resolved/rebutted; post-fix review was requested and awaited. - [ ] Required CI is green for the SHA being merged. From 29f54e9c6765fb71fd347f9dd67be602a845fb98 Mon Sep 17 00:00:00 2001 From: JinWoo Lee Date: Tue, 8 Sep 2026 23:52:23 +0900 Subject: [PATCH 4/7] docs: record G01f as the keyed blocker of G01g Keep #60's native blockedBy #54 resolvable in backlog.json without copying runtime evidence. --- docs/backlog.json | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/docs/backlog.json b/docs/backlog.json index 6fe5f61..6f70c3a 100644 --- a/docs/backlog.json +++ b/docs/backlog.json @@ -812,12 +812,43 @@ }, "release": "Future research" }, + { + "key": "G01f", + "parent": "G01", + "title": "Finalize paired execution with bounded owned cleanup", + "stage": "M0 - Evidence gates", + "agent": "Luna max", + "dependencies": [], + "release": "R1 - Internal MVP", + "goal": "Complete one private, same-invocation normal-success terminal path after issue #52's paired execution. Prove exact session closure, non-force worker deletion with its separate absence receipt, and owned scale-set deletion through real C/W journals and private SDK/TLS and Docker/Unix fixtures. This child does not authorize a live run, release admission claims or complete parent #1.", + "scope": "Tracked on issue #54 (Done). This keyed record exists so G01g's native blockedBy #54 is resolvable in backlog.json. Do not duplicate runtime evidence here.", + "tdd": [ + "See issue #54. Do not edit G01f evidence from the #66 documentation branch." + ], + "acceptance": [ + "Issue #54 remains the source of acceptance and is Done.", + "Completing G01f does not complete G01 #1." + ], + "risk": "High", + "kind": "gate", + "priority": "P0", + "status": "Done", + "test_profile": [ + "offline" + ], + "github_issue": { + "number": 54, + "url": "https://github.com/1XP-AI/gh-runnerd/issues/54" + } + }, { "key": "G01g", "title": "Wire paired terminal execution through a bounded broker handoff", "stage": "M0 - Evidence gates", "agent": "Luna max", - "dependencies": [], + "dependencies": [ + "G01f" + ], "release": "R1 - Internal MVP", "goal": "Connect the reviewed paired terminal path to one same-process experimental executable and a narrowly bound broker handoff, with offline evidence that authority, credential separation and fail-stop recovery boundaries are preserved.", "scope": "Tracked on issue #60 and PR #62 in a separate worktree. This keyed record exists so R1 dependencies resolve. It is not G01 completion and does not duplicate runtime or CI evidence.", From 9df9eaad00cb7b4e53eb0775f2310636603d4364 Mon Sep 17 00:00:00 2001 From: JinWoo Lee Date: Wed, 9 Sep 2026 09:45:33 +0900 Subject: [PATCH 5/7] docs: keep #68 production behind G01/G02 evidence gates Restrict #68 to reviewed contract and offline evidence until full #1 and #2 pass. Native blockedBy stays #60/#66/#67. --- AGENTS.md | 2 +- docs/BACKLOG.md | 6 +++--- docs/EXECUTION.md | 4 ++-- docs/HANDOFF.md | 16 ++++++++++------ docs/ISSUES.md | 2 +- docs/PLAN.md | 8 ++++---- docs/backlog.json | 8 +++++--- 7 files changed, 26 insertions(+), 20 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 488dbd9..399ef73 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -8,7 +8,7 @@ This is a plan-first repository. Do not treat example CLI commands as implemente - Preserve live manually installed runners during development. No global Docker prune/context change, broad process kill, unreviewed destructive cleanup or automatic workflow replay. - Credentials, raw SDK response errors, JIT configs, personal machine paths and private test logs must not enter commits/issues/diagnostic bundles. - Native macOS runners are for explicitly trusted code. Do not claim same-user workdirs or Keychain provide hostile-code isolation. -- Keep GitHub SDK behavior behind an adapter and pin versions. Resolve G01/G02 evidence gates before dependent implementation. +- Keep GitHub SDK behavior behind an adapter and pin versions. Resolve G01/G02 evidence gates before dependent production implementation. Completing the G02 R1 subset does not complete G02. - Limit concurrency and resources globally across pools; ordinary scale-down drains busy work. - Public PR tests use hosted environments without secrets. Real Mac/self-hosted tests require reviewed commits and explicit maintainer dispatch under runner-group policy. - Use Go unless an ADR supported by evidence changes the decision. Keep dependency count small and review licenses. No restricted virtualization binary or macOS image bundled by default. diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md index 084ebc0..8a799fd 100644 --- a/docs/BACKLOG.md +++ b/docs/BACKLOG.md @@ -16,10 +16,10 @@ Foreground MVP on this Mac: one org, one private repository, existing Linux-cont | G02-R1 | [#67](https://github.com/1XP-AI/gh-runnerd/issues/67) | R1 subset of G02 #2 (manual single-org credentials). Parent #2 stays R3 In progress | none | Ready | | G01g | [#60](https://github.com/1XP-AI/gh-runnerd/issues/60) | Bounded broker handoff for the paired Linux-container path | #54 (Done) | In progress | | P66 | [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) | Delivery-plan documentation | none | In progress | -| G13-R1 | [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of G13 #13. First authorized work is a reviewed minimal contract, not production daemon/CLI and not a G01/G02/G04 bypass. Live recovery stays on #1→#69 | #60, #66, #67 | Blocked | +| G13-R1 | [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of G13 #13. Native blockers #60, #66, #67. Until full G01 #1 and G02 #2 pass, authorized work is a reviewed minimal contract and offline evidence only; production implementation starts only then. Not a G01/G02/G04 bypass. Completing #67 does not complete G02. Live recovery stays on #1→#69 | #60, #66, #67 | Blocked | | G16-R1 | [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | R1 subset of G16 #16: authorized real job plus required recovery | #1, #68 | Blocked | -#68 must not start implementation while blocked. Completing a child does not complete G02, G04–G15 or G16. +#68 must not start production implementation while natively blocked or while full G01 #1 or G02 #2 remain open. Native `blockedBy` stays #60/#66/#67; do not add #1/#2 without an explicit ask. Completing a child does not complete G02, G04–G15 or G16. ## Original full-scope backlog (M0–M5 preserved) @@ -54,7 +54,7 @@ The machine-readable source is [backlog.json](backlog.json). Published issue num - Continue G01 (full recovery Goal) and G02 (full Manifest/multi-org/launchd Goal) independently; they are not replaced by #67. - #67 may proceed as isolated R1 credential evidence without waiting on G02's remaining R3 criteria; it does not authorize live App/Keychain/launchd mutation. -- G04 still integrates the full gates before shared full-scope implementation. #68 is not a G04 bypass: its first authorized work is a reviewed R1 contract, and live G01 recovery remains #69 blocked by #1. +- G04 still integrates the full gates before shared full-scope implementation. #68 is not a G04 bypass: until full G01 #1 and G02 #2 pass, authorized work is a reviewed R1 contract and offline evidence only; production implementation starts only then. Completing #67 does not complete G02. Live G01 recovery remains #69 blocked by #1. - After G05, IPC, auth, and pure scheduling can proceed with separate file ownership for R2/R3 work. - Linux and native macOS providers can proceed independently once shared contracts/credentials exist; native macOS is R3. - Integration, security verdict, soak and rollout remain sequential evidence gates. diff --git a/docs/EXECUTION.md b/docs/EXECUTION.md index 50c8424..7b32546 100644 --- a/docs/EXECUTION.md +++ b/docs/EXECUTION.md @@ -23,7 +23,7 @@ Verify each issue's contract and dependencies before dependent implementation be 6. Move Project status to In review. Wait for GitHub Codex to finish reviewing the exact current PR head. Use the configured `codex-review` skill to read both inline reviews and issue-comment findings, including stale/outdated findings. Reproduce each finding; fix it or provide a specific evidence-based rebuttal. After pushing fixes, request `@codex review` and wait for the new result. Merge only when required CI and both review paths are complete, no actionable finding remains unresolved, and the issue's existing authorization permits it. Check the current head immediately before merge and constrain the merge to that SHA. 7. Close the issue and mark its goal complete only when all acceptance criteria and evidence are satisfied. If the goal includes merge, a merely opened PR is not completion. -Keep dependent issues blocked until evidence gates pass. A blocked issue needs a concrete blocker and an independently useful next step if one exists. Follow the host's actual goal-tool blocked threshold; do not mark a goal blocked after a single inconvenience. GitHub Project Goal text is a durable work specification, not an active Codex goal or an automatic scheduler. +Keep dependent issues blocked until evidence gates pass. Production implementation of #68 is dependent work under that rule and waits for full G01 #1 and G02 #2; completing #67 does not complete G02. Native #68 blockers remain #60/#66/#67 and authorize only reviewed contract and offline evidence work until those gates pass. A blocked issue needs a concrete blocker and an independently useful next step if one exists. Follow the host's actual goal-tool blocked threshold; do not mark a goal blocked after a single inconvenience. GitHub Project Goal text is a durable work specification, not an active Codex goal or an automatic scheduler. If review arrives after a PR was merged, audit the finding against current `main` and use a fresh issue-linked fix PR. Keep the original review thread open until @@ -39,7 +39,7 @@ was complete at merge time. ## Board fields -Status, Stage, Priority, Agent, Risk, Goal, Dependencies, Test profile and Release. Stage/milestones preserve the original M0–M5 taxonomy. Release is additive sequencing (R1 Internal MVP, R2 Everyday operations, R3 General distribution, Future research) and does not change acceptance text or native dependency gates. Initial gates/bootstrap work is Ready; dependent full-scope work is Backlog. R1 children use their own documented dependencies: #67 is Ready with no production dependency; #68 is Blocked by #60/#66/#67 until those complete and its **minimal contract is independently reviewed before implementation**; #69 is Blocked by full G01 #1 and #68. Ready on a child is not a bypass of the parent's remaining blockers and does not satisfy AGENTS.md G01/G02 gates for G04+ full-scope work. VM/fleet research is explicitly Future. Machine-readable `status` and `test_profile` values are in `backlog.json`; trusted-runtime and trusted-live-github profiles require maintainer-controlled execution and never run on public PR code. +Status, Stage, Priority, Agent, Risk, Goal, Dependencies, Test profile and Release. Stage/milestones preserve the original M0–M5 taxonomy. Release is additive sequencing (R1 Internal MVP, R2 Everyday operations, R3 General distribution, Future research) and does not change acceptance text or native dependency gates. Initial gates/bootstrap work is Ready; dependent full-scope work is Backlog. R1 children use their own documented dependencies: #67 is Ready with no production dependency; #68 is natively Blocked by #60/#66/#67, and after those complete authorized work is the independently reviewed minimal contract and offline evidence only until full G01 #1 and G02 #2 pass, with production implementation starting only then; #69 is Blocked by full G01 #1 and #68. Ready on a child is not a bypass of the parent's remaining blockers. Completing #67 does not complete G02 and does not satisfy AGENTS.md G01/G02 gates for #68 production or for G04+ full-scope work. VM/fleet research is explicitly Future. Machine-readable `status` and `test_profile` values are in `backlog.json`; trusted-runtime and trusted-live-github profiles require maintainer-controlled execution and never run on public PR code. G08 enrollment and G15 service lifecycle remain gated by their contracts and independent review. Default implementation and review are Luna max; recorded overrides such as Grok 4.6 xhigh on #66/#67/#68/#69 still require independent Luna max review. G12 computes pure proposals, while G05/G13 own atomic reservation and live admission under the parent full-scope gates. diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index 129892d..ade2b4d 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -153,7 +153,7 @@ dispatch. The last verified snapshot is 36 items. The full map is in | #67 | Ready | R1 | Grok 4.6 xhigh / Luna review; child of #2; no native blockers | | #60 G01g | In progress | R1 | Luna max; separate worktree/PR #62; do not edit from #66 | | #66 | In progress | R1 | Grok 4.6 xhigh / Luna review; this documentation change | -| #68 | Blocked | R1 | child of #13; blocked by #60/#66/#67; contract-before-implementation | +| #68 | Blocked | R1 | child of #13; native blockedBy #60/#66/#67; contract/offline evidence only until full #1/#2; production implementation only then | | #69 | Blocked | R1 | child of #16; blocked by #1/#68 | | #3 G03, #30, #40 G12a, #44, #46, #47, #50, #52, #54 G01f, #61, #64 | Done | R1 except #40 R2 | historical records preserved; #54 Done does not close #1 | | #4–#7, #9, #10, #12–#15, #20 | Backlog | R2 | Luna max; original dependencies unchanged | @@ -479,14 +479,16 @@ Use this compact map to orient a new agent; the live Project decides what is Rea | G20 | #20 | Reversible pilot/migration with legacy fallback | | G21 | #21 | Optional macOS VM and multi-host provider research (Future) | | G02-R1 | #67 | R1 manual single-organization credentials (child of #2; parent remains R3) | -| G13-R1 | #68 | R1 foreground command, capacity one (child of #13; blocked by #60/#66/#67) | +| G13-R1 | #68 | R1 foreground command, capacity one (child of #13; native blockedBy #60/#66/#67; production waits on full G01/G02) | | G16-R1 | #69 | R1 authorized real job plus required recovery (child of #16; blocked by #1/#68) | | P66 | #66 | Delivery-plan documentation; not a runtime Goal | G01 and G02 are evidence gates. G01's exact Goal and full ACK/acquisition/JIT recovery remain required; child merges are not completion. G04 and all dependent full-scope implementation remain behind their acceptance evidence. #68 is not a -G04/G13 bypass. G10/G16 require real ARM64 Docker and private test repositories. +G04/G13 bypass: until full G01 #1 and G02 #2 pass, its authorized work is +contract and offline evidence only; production implementation starts only then. +Completing #67 does not complete G02. G10/G16 require real ARM64 Docker and private test repositories. G11/G19 require trusted native-process evidence and are R3. G17 is the reliability release gate. G20 is the reversible pilot, not a license to remove the fallback runners early. G20 remains natively blocked by #17/#18. @@ -513,9 +515,11 @@ modify runtime, CI or evidence docs belonging to those PRs. Issue [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) on `orca/release-reframe`. Main author Grok 4.6 xhigh; independent Luna max review; exact-head Codex+CI before -merge. #68 stays Blocked until #60, #66 and #67 are complete and the minimal -foreground contract is reviewed. No live authorization and no merge of blocked -implementation are implied. +merge. #68 stays natively Blocked until #60, #66 and #67 are complete. After that, +authorized work is the reviewed minimal contract and offline evidence only until +full G01 #1 and G02 #2 pass; production implementation starts only then. +Completing #67 does not complete G02. No live authorization and no merge of +blocked implementation are implied. ## Live-operation gate diff --git a/docs/ISSUES.md b/docs/ISSUES.md index 927e1dd..86599e0 100644 --- a/docs/ISSUES.md +++ b/docs/ISSUES.md @@ -75,7 +75,7 @@ Verified 2026-09-08 against Project #2 (`36` items) and native GitHub parent/`bl | [#64](https://github.com/1XP-AI/gh-runnerd/issues/64) | Done | R1 | CI default G01 deadline coverage | Luna max | | [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) | In progress | R1 | Planning only. Main author Grok 4.6 xhigh; independent Luna max review | unset | | [#67](https://github.com/1XP-AI/gh-runnerd/issues/67) | Ready | R1 | Child of #2. Manual single-org credentials. No native blockers | unset | -| [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | Blocked | R1 | Child of #13. `blockedBy` #60/#66/#67. Contract review before implementation; not a G01/G02/G04 bypass. Live recovery is #69←#1 | unset | +| [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | Blocked | R1 | Child of #13. Native `blockedBy` #60/#66/#67. Contract/offline evidence only until full G01 #1 and G02 #2 pass; production implementation only then. Not a G01/G02/G04 bypass. Completing #67 does not complete G02. Live recovery is #69←#1 | unset | | [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | Blocked | R1 | Child of #16. `blockedBy` #1/#68 | unset | ### Verified native relations (do not duplicate) diff --git a/docs/PLAN.md b/docs/PLAN.md index 222bcd1..60a608e 100644 --- a/docs/PLAN.md +++ b/docs/PLAN.md @@ -71,7 +71,7 @@ CPU/memory reservations must include Docker service daemons and services, creati ## Delivery stages -M0 settles compatibility and contracts; M1 establishes durable control/authentication; M2 adds execution/scaling; M3 validates security and recovery; M4 packages and migrates through a canary; M5 contains optional VM/fleet research. Historical Stage/milestone values stay on the issues. **Release placement names which user-visible release needs the complete original scope**; M0–M5 remain the capability taxonomy. Native `blockedBy` edges remain the implementation start gate. Relabeling does not reorder those edges or make a full-scope issue Ready. +M0 settles compatibility and contracts; M1 establishes durable control/authentication; M2 adds execution/scaling; M3 validates security and recovery; M4 packages and migrates through a canary; M5 contains optional VM/fleet research. Historical Stage/milestone values stay on the issues. **Release placement names which user-visible release needs the complete original scope**; M0–M5 remain the capability taxonomy. Native `blockedBy` edges remain the GitHub start gate. Relabeling does not reorder those edges or make a full-scope issue Ready. Release placement is not production-implementation authorization: G01/G02 evidence gates still bind dependent production work even when a child's native blockers differ. Public PR checks run in GitHub-hosted standard environments without credentials. Trusted Mac hardware checks are explicit maintainer runs against reviewed commits. Building gh-runnerd must not depend on gh-runnerd already operating, or rollout failures would block its repair. @@ -79,7 +79,7 @@ Public PR checks run in GitHub-hosted standard environments without credentials. Issue [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) records the maintainer-accepted split. Placement on a release means that release needs the **complete original scope**. It is not a claim that no safe subset is required earlier, and it is not permission to mark a parent Done. Where an original issue mixed internal-MVP and later acceptance, explicit children hold the R1 subset; parents stay open until their own criteria pass. -The live 36-item map is in [ISSUES.md](ISSUES.md). Production implementation of dependency-blocked full-scope issues is not authorized by this planning change. +The live 36-item map is in [ISSUES.md](ISSUES.md). Production implementation of dependency-blocked full-scope issues is not authorized by this planning change. R1 placement of #68 is release scope, not a waiver of the full G01/G02 production gates. ### R1 — Internal MVP @@ -93,10 +93,10 @@ Foreground only. `cmd/gh-runnerd` is still an empty entry point; unattended daem | [#67](https://github.com/1XP-AI/gh-runnerd/issues/67) | R1 subset of [#2](https://github.com/1XP-AI/gh-runnerd/issues/2): manual single-organization credentials. Ready; no live App/Keychain/launchd authorization. Parent #2 stays In progress on R3. | | [#60](https://github.com/1XP-AI/gh-runnerd/issues/60) G01g | Bounded broker handoff for the paired Linux-container path. In progress in a separate worktree. | | [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) | Planning and documentation synchronization. | -| [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of [#13](https://github.com/1XP-AI/gh-runnerd/issues/13), coordinated slice of #4–#15. Native blockers remain #60, #66 and #67; do not add #1/#2 without an explicit ask. **First authorized work is a reviewed minimal contract**, not `cmd/gh-runnerd` production behavior and not a G04/G13 bypass. Implementation after that contract still reuses the reviewed G01 paired Linux-container path (#54/#60) and R1 credentials (#67). It must not claim G01 or G02 complete. Completing #68 does not complete #4–#15. | +| [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of [#13](https://github.com/1XP-AI/gh-runnerd/issues/13), coordinated slice of #4–#15. Native blockers remain #60, #66 and #67; do not add #1/#2 without an explicit ask. **Until full G01 [#1](https://github.com/1XP-AI/gh-runnerd/issues/1) and G02 [#2](https://github.com/1XP-AI/gh-runnerd/issues/2) pass, authorized work is a reviewed minimal contract and offline evidence only**, not `cmd/gh-runnerd` production behavior and not a G04/G13 bypass. Production implementation starts only after those full gates pass; it may then reuse the reviewed G01 paired Linux-container path (#54/#60) and R1 credentials (#67). Completing #67 does not complete G02. Completing #68 does not complete #4–#15 or claim G01 or G02 complete. | | [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | R1 subset of [#16](https://github.com/1XP-AI/gh-runnerd/issues/16): authorized real private job plus required ACK/acquisition/JIT recovery. Blocked by **full** [#1](https://github.com/1XP-AI/gh-runnerd/issues/1) and #68. A passing happy-path job is not sufficient. This is the G01 recovery gate for the R1 operator exit. | -Completed R1-placed records (#3, #30, #44, #46, #47, #50, #52, #54, #61, #64) are historical evidence slices. They do not close #1. G01/G02 full-scope gates still bind G04 and later parents. +Completed R1-placed records (#3, #30, #44, #46, #47, #50, #52, #54, #61, #64) are historical evidence slices. They do not close #1. G01/G02 full-scope gates still bind G04 and later parents, and they bind #68 production implementation. Completing #67 does not satisfy G02. ### R2 — Everyday operations diff --git a/docs/backlog.json b/docs/backlog.json index 6f70c3a..5f163d4 100644 --- a/docs/backlog.json +++ b/docs/backlog.json @@ -953,9 +953,10 @@ ], "release": "R1 - Internal MVP", "goal": "Provide a foreground MVP command that connects the reviewed broker and paired worker lifecycle for one organization, one private repository and one worker, with durable fail-stop state and safe owned cleanup.", - "scope": "Vertical R1 slice of #4/#5/#6/#7/#9/#10/#13/#14 with primary parent #13. Reuse the reviewed paired Linux-container execution path. No second backend, native macOS jobs, daemon/install or context switch. Freeze the minimal contract before implementation.", + "scope": "Vertical R1 slice of #4/#5/#6/#7/#9/#10/#13/#14 with primary parent #13. Reuse the reviewed paired Linux-container execution path. No second backend, native macOS jobs, daemon/install or context switch. Native dependencies remain G01g/#60, P66/#66 and G02-R1/#67. Until full G01 #1 and G02 #2 evidence gates pass, authorized work is a reviewed minimal contract and offline evidence only; production implementation starts only then. Completing G02-R1/#67 does not complete G02.", "tdd": [ - "Contract review precedes implementation; do not start while blocked by G01g/#60, P66/#66 and G02-R1/#67.", + "Native blockers G01g/#60, P66/#66 and G02-R1/#67 remain the GitHub blockedBy set; do not add #1/#2 as native edges from this docs change.", + "Until full G01 #1 and G02 #2 pass, work is contract/offline evidence only; production implementation is unauthorized.", "Negative tests for authority mutation, partial state, timeout, cancellation and non-owned cleanup.", "No claim that the existing empty product entry point already implements the command." ], @@ -963,7 +964,8 @@ "One documented user-facing entry point, explicit configuration and safe status output.", "Bound org/repository/installation and one owned worker, shared capacity hard-limit one.", "Foreground interruption stops new admission and preserves busy/unknown work.", - "Completing this child does not complete #4\u2013#15." + "Completing this child does not complete #4\u2013#15.", + "Completing G02-R1/#67 does not complete G02. Production implementation waits for full G01 #1 and G02 #2." ], "risk": "High", "kind": "implementation", From b16f52bc650a0912cbc10847366a2660cdbae623 Mon Sep 17 00:00:00 2001 From: JinWoo Lee Date: Wed, 9 Sep 2026 10:06:20 +0900 Subject: [PATCH 6/7] docs: distinguish R1 scope from the G02 pre-release gate State that R1 is not independently deliverable until R3-placed full G02 passes, and that JSON status/agent are historical snapshots. --- AGENTS.md | 2 +- README.md | 6 +++--- docs/BACKLOG.md | 6 ++++-- docs/EXECUTION.md | 4 ++-- docs/HANDOFF.md | 29 +++++++++++++++++++---------- docs/ISSUES.md | 6 +++--- docs/PLAN.md | 6 +++++- docs/backlog.json | 8 +++++++- 8 files changed, 44 insertions(+), 23 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 399ef73..3e9f852 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2,7 +2,7 @@ This is a plan-first repository. Do not treat example CLI commands as implemented features. -- Work from a GitHub issue and its Goal, acceptance criteria and dependencies. One issue, one branch/worktree, one active goal when the task requests goal execution. +- Work from a GitHub issue and its Goal, acceptance criteria and dependencies. One issue, one branch/worktree, one active goal when the task requests goal execution. Live GitHub Project status is dispatch authority; do not redispatch from historical `docs/backlog.json` Ready values. - Follow docs/EXECUTION.md. The repository default routes implementation, review and coordination through Luna (`gpt-5.6-luna`, `max`) unless an explicit current user override is recorded on the issue. The maintainer-authorized override for delivery-reframe issue #66 and R1 children #67/#68/#69 is main author Grok 4.6 xhigh with independent Luna max review. Preserve the TDD, independent-review, exact-head Codex+CI and live-operation authorization gates. Historical records keep the model that actually produced them. Do not override an explicit current user setting. - Use TDD for implementation: meaningful failing test -> minimal implementation -> refactor -> relevant verification. Document actual results; never claim planned/skipped/live tests passed. - Preserve live manually installed runners during development. No global Docker prune/context change, broad process kill, unreviewed destructive cleanup or automatic workflow replay. diff --git a/README.md b/README.md index 6875d31..9644262 100644 --- a/README.md +++ b/README.md @@ -18,16 +18,16 @@ gh-runnerd stop tests --drain The original product envelope is still a native macOS ARM64 Go CLI plus supervised daemon, user-owned GitHub App authentication, Linux workers through an explicit Docker Engine connection, trusted-only native macOS processes, multiple organizations and a shared host budget. **There is no runnable product yet** (`cmd/gh-runnerd` is an empty entry point). Maintainer-accepted sequencing in [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) splits that envelope: -- **R1 Internal MVP:** this Mac, one organization, one private test repository, the existing Linux-container backend, concurrency one, manual App, foreground command. Full G01 ACK/acquisition/JIT recovery remains required. +- **R1 Internal MVP:** this Mac, one organization, one private test repository, the existing Linux-container backend, concurrency one, manual App, foreground command. Full G01 ACK/acquisition/JIT recovery remains required. Full G02 #2 remains a required pre-release evidence gate classified R3; R1 is not independently deliverable until that gate passes. - **R2 Everyday operations:** install/start/stop/status, restart recovery, bounded scaling. -- **R3 General distribution:** multi-organization support, additional native backend, automated onboarding, signing/update/diagnostics. +- **R3 General distribution:** multi-organization support, additional native backend, automated onboarding, signing/update/diagnostics. Full G02 original acceptance remains here and also gates R1 #68 production. - **Future:** optional macOS VM / multi-host research ([#21](https://github.com/1XP-AI/gh-runnerd/issues/21)). Linux still needs a Linux kernel/runtime on macOS. R1 connects to an existing engine; it does not make Linux containers native macOS processes, add a second backend, or provision a Kubernetes cluster. See [approved delivery releases](docs/PLAN.md#approved-delivery-releases). ## Track implementation -[GitHub Project](https://github.com/orgs/1XP-AI/projects/2) provides [Goals](https://github.com/orgs/1XP-AI/projects/2/views/1), [Ready](https://github.com/orgs/1XP-AI/projects/2/views/2) and [Board](https://github.com/orgs/1XP-AI/projects/2/views/3) views. The original 21 goal issues remain; the live board has 36 items after additive Release metadata and R1 children. Start from currently Ready work; the board does not dispatch agents automatically. +[GitHub Project](https://github.com/orgs/1XP-AI/projects/2) provides [Goals](https://github.com/orgs/1XP-AI/projects/2/views/1), [Ready](https://github.com/orgs/1XP-AI/projects/2/views/2) and [Board](https://github.com/orgs/1XP-AI/projects/2/views/3) views. The original 21 goal issues remain; the live board has 36 items after additive Release metadata and R1 children. Start from currently Ready work on the live Project; do not redispatch from historical `docs/backlog.json` Ready values. The board does not dispatch agents automatically. ## Read the plan diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md index 8a799fd..2505cf0 100644 --- a/docs/BACKLOG.md +++ b/docs/BACKLOG.md @@ -10,6 +10,8 @@ The live 36-item map is in [ISSUES.md](ISSUES.md). Default implementer is Luna m Foreground MVP on this Mac: one org, one private repository, existing Linux-container backend, capacity one, manual App. Daemon/install/service are not implemented and are not R1. +User-visible R1 scope is not independently deliverable: #68 production waits for full G02 #2, which remains classified R3. Completing #67 does not complete G02. Release placement names original-scope ownership; it is not a claim of stage independence. + | Key | Issue | Role | Native blockers | Live status | |---|---|---|---|---| | G01 | [#1](https://github.com/1XP-AI/gh-runnerd/issues/1) | **Full original** ACK/acquisition/JIT recovery Goal; no subset and no false completion | none | In progress | @@ -19,7 +21,7 @@ Foreground MVP on this Mac: one org, one private repository, existing Linux-cont | G13-R1 | [#68](https://github.com/1XP-AI/gh-runnerd/issues/68) | R1 subset of G13 #13. Native blockers #60, #66, #67. Until full G01 #1 and G02 #2 pass, authorized work is a reviewed minimal contract and offline evidence only; production implementation starts only then. Not a G01/G02/G04 bypass. Completing #67 does not complete G02. Live recovery stays on #1→#69 | #60, #66, #67 | Blocked | | G16-R1 | [#69](https://github.com/1XP-AI/gh-runnerd/issues/69) | R1 subset of G16 #16: authorized real job plus required recovery | #1, #68 | Blocked | -#68 must not start production implementation while natively blocked or while full G01 #1 or G02 #2 remain open. Native `blockedBy` stays #60/#66/#67; do not add #1/#2 without an explicit ask. Completing a child does not complete G02, G04–G15 or G16. +#68 must not start production implementation while natively blocked or while full G01 #1 or G02 #2 remain open. Native `blockedBy` stays #60/#66/#67; do not add #1/#2 without an explicit ask. Completing a child does not complete G02, G04–G15 or G16. Full G02 stays R3; that cross-release prerequisite is why R1 cannot ship independently. ## Original full-scope backlog (M0–M5 preserved) @@ -48,7 +50,7 @@ Foreground MVP on this Mac: one org, one private repository, existing Linux-cont | G20 | Pilot migration with reversible legacy runner handoff | M4 - Pilot and release | R2 | Luna max | G17, G18 (R3). Full original R2 placement cannot close until those R3 blockers finish; no bypass | | G21 | Evaluate optional macOS VM and multi-host providers | M5 - Future | Future | Luna max | G17 | -The machine-readable source is [backlog.json](backlog.json). Published issue numbers and links are in [ISSUES.md](ISSUES.md); all original dependencies remain native GitHub blocking relationships. Full-scope first-release implementation goals except G03/G12a remain open. +The machine-readable source is [backlog.json](backlog.json). Original JSON `status` and `agent` fields are the initial/historical planning snapshot, not live dispatch authority; the live GitHub Project is authoritative after work begins. Do not redispatch from historical Ready values. Published issue numbers and links are in [ISSUES.md](ISSUES.md); all original dependencies remain native GitHub blocking relationships. Full-scope first-release implementation goals except G03/G12a remain open. ## Parallel work boundaries diff --git a/docs/EXECUTION.md b/docs/EXECUTION.md index 7b32546..13bee65 100644 --- a/docs/EXECUTION.md +++ b/docs/EXECUTION.md @@ -15,7 +15,7 @@ Verify each issue's contract and dependencies before dependent implementation be ## Per-issue goal workflow -1. Select a Ready issue whose dependencies are Done; read the plan, relevant ADR and current repository instructions. +1. Select a Ready issue from the live GitHub Project whose dependencies are Done; read the plan, relevant ADR and current repository instructions. Do not treat `backlog.json` `status` as live Ready. 2. In the implementation task, create **one active goal** from the issue's Goal statement. Do not invent a token budget. Record issue URL and goal status in that task. 3. Create a dedicated branch/worktree. Keep one issue's behavior in one PR; split only if the issue's acceptance contract requires it. 4. Follow red -> green -> refactor, with meaningful failure evidence before the fix and relevant automated checks afterward. @@ -39,7 +39,7 @@ was complete at merge time. ## Board fields -Status, Stage, Priority, Agent, Risk, Goal, Dependencies, Test profile and Release. Stage/milestones preserve the original M0–M5 taxonomy. Release is additive sequencing (R1 Internal MVP, R2 Everyday operations, R3 General distribution, Future research) and does not change acceptance text or native dependency gates. Initial gates/bootstrap work is Ready; dependent full-scope work is Backlog. R1 children use their own documented dependencies: #67 is Ready with no production dependency; #68 is natively Blocked by #60/#66/#67, and after those complete authorized work is the independently reviewed minimal contract and offline evidence only until full G01 #1 and G02 #2 pass, with production implementation starting only then; #69 is Blocked by full G01 #1 and #68. Ready on a child is not a bypass of the parent's remaining blockers. Completing #67 does not complete G02 and does not satisfy AGENTS.md G01/G02 gates for #68 production or for G04+ full-scope work. VM/fleet research is explicitly Future. Machine-readable `status` and `test_profile` values are in `backlog.json`; trusted-runtime and trusted-live-github profiles require maintainer-controlled execution and never run on public PR code. +Status, Stage, Priority, Agent, Risk, Goal, Dependencies, Test profile and Release. Stage/milestones preserve the original M0–M5 taxonomy. Release is additive sequencing (R1 Internal MVP, R2 Everyday operations, R3 General distribution, Future research) and does not change acceptance text or native dependency gates. Initial gates/bootstrap work is Ready; dependent full-scope work is Backlog. R1 children use their own documented dependencies: #67 is Ready with no production dependency; #68 is natively Blocked by #60/#66/#67, and after those complete authorized work is the independently reviewed minimal contract and offline evidence only until full G01 #1 and G02 #2 pass, with production implementation starting only then; #69 is Blocked by full G01 #1 and #68. Ready on a child is not a bypass of the parent's remaining blockers. Completing #67 does not complete G02 and does not satisfy AGENTS.md G01/G02 gates for #68 production or for G04+ full-scope work. R1 is not independently deliverable until the R3-placed full G02 #2 gate passes; do not move full G02 onto R1. VM/fleet research is explicitly Future. Machine-readable `test_profile` values are in `backlog.json`. JSON `status` and `agent` on original records are the initial/historical planning snapshot, not live dispatch authority; see `field_semantics` in that file. The live GitHub Project is authoritative after work begins. Do not redispatch from historical Ready values. trusted-runtime and trusted-live-github profiles require maintainer-controlled execution and never run on public PR code. G08 enrollment and G15 service lifecycle remain gated by their contracts and independent review. Default implementation and review are Luna max; recorded overrides such as Grok 4.6 xhigh on #66/#67/#68/#69 still require independent Luna max review. G12 computes pure proposals, while G05/G13 own atomic reservation and live admission under the parent full-scope gates. diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index ade2b4d..6f29bd6 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -25,11 +25,15 @@ three maintainer-accepted releases ([PLAN.md](PLAN.md#approved-delivery-releases - **R1 Internal MVP:** this Mac, one organization, one private test repository, the existing reviewed Linux-container backend, concurrency one, manual App, foreground command. Full G01 ACK/acquisition/JIT recovery remains required. - Daemon/install/launchd service are not implemented. + Full G02 #2 remains a mandatory pre-release evidence gate for the R1 command + path and stays classified R3; R1 is not independently deliverable until that + gate passes. Completing #67 does not complete G02. Daemon/install/launchd + service are not implemented. - **R2 Everyday operations:** install/start/stop/status, restart recovery and bounded scaling. - **R3 General distribution:** multi-organization support, trusted native macOS - backend, automated onboarding, signing/update/diagnostics. + backend, automated onboarding, signing/update/diagnostics. Full G02 original + acceptance remains here and is also a pre-release gate for R1 #68 production. - **Future:** G21 optional macOS VM / multi-host research. Shared envelope limits that still apply: @@ -149,7 +153,7 @@ dispatch. The last verified snapshot is 36 items. The full map is in | Issues | Project status | Release | Current routing | |---|---|---|---| | #1 G01 | In progress | R1 | Luna max; **full** ACK/acquisition/JIT Goal unresolved | -| #2 G02 | In progress | R3 | Luna max; Manifest/multi-org/launchd remains here | +| #2 G02 | In progress | R3 | Luna max; Manifest/multi-org/launchd remains here; also pre-release gate for R1 #68 production | | #67 | Ready | R1 | Grok 4.6 xhigh / Luna review; child of #2; no native blockers | | #60 G01g | In progress | R1 | Luna max; separate worktree/PR #62; do not edit from #66 | | #66 | In progress | R1 | Grok 4.6 xhigh / Luna review; this documentation change | @@ -162,9 +166,11 @@ dispatch. The last verified snapshot is 36 items. The full map is in Issue labels and the initial planning inventory can retain historical Astra values. For current dispatch, use the Project `Agent` field and the issue's current -execution contract. Do not rewrite historical records to make them look like new -work. Do not add further child issues or native edges without an explicit ask; -the R1 mapping is already applied. +execution contract. Original `backlog.json` `status`/`agent` values are the same +class of historical snapshot; do not redispatch from historical Ready. Do not +rewrite historical records to make them look like new work. Do not add further +child issues or native edges without an explicit ask; the R1 mapping is already +applied. ### Status meanings @@ -303,7 +309,8 @@ fi If the item is already In progress for another active agent, the guard above stops before any field edit; coordinate instead of starting a second implementation. Keep the issue's durable Goal/Dependencies fields and `docs/backlog.json` aligned only -when the contract actually changes. If +when the contract actually changes. Do not rewrite original JSON `status`/`agent` +snapshots to look live; the Project is dispatch authority. If the current user selected another supported model/effort, resolve its Project Agent option ID with `gh project field-list` and replace `AGENT_OPTION_ID`; never overwrite an explicit current selection with the default, and never write Luna over an @@ -488,7 +495,8 @@ recovery remain required; child merges are not completion. G04 and all dependent full-scope implementation remain behind their acceptance evidence. #68 is not a G04/G13 bypass: until full G01 #1 and G02 #2 pass, its authorized work is contract and offline evidence only; production implementation starts only then. -Completing #67 does not complete G02. G10/G16 require real ARM64 Docker and private test repositories. +Completing #67 does not complete G02. Because full G02 remains classified R3, +R1 is not independently deliverable until that gate passes. G10/G16 require real ARM64 Docker and private test repositories. G11/G19 require trusted native-process evidence and are R3. G17 is the reliability release gate. G20 is the reversible pilot, not a license to remove the fallback runners early. G20 remains natively blocked by #17/#18. @@ -518,8 +526,9 @@ Main author Grok 4.6 xhigh; independent Luna max review; exact-head Codex+CI bef merge. #68 stays natively Blocked until #60, #66 and #67 are complete. After that, authorized work is the reviewed minimal contract and offline evidence only until full G01 #1 and G02 #2 pass; production implementation starts only then. -Completing #67 does not complete G02. No live authorization and no merge of -blocked implementation are implied. +Completing #67 does not complete G02. Because full G02 remains classified R3, +R1 is not independently deliverable until that gate passes. No live authorization +and no merge of blocked implementation are implied. ## Live-operation gate diff --git a/docs/ISSUES.md b/docs/ISSUES.md index 86599e0..5719a5f 100644 --- a/docs/ISSUES.md +++ b/docs/ISSUES.md @@ -33,16 +33,16 @@ The original plan's 48 dependency edges are recorded as native GitHub blocking r This table intentionally preserves the initial planning inventory. Current dispatch is recorded in the live Project Agent field and the open issue execution contracts. The repository default is Luna max; #66 and R1 children #67/#68/#69 record main author Grok 4.6 xhigh with independent Luna max review. Do not rewrite historical Astra records. -Each original issue has one Goal statement, scope, TDD cases, acceptance criteria, model/effort, risk and dependencies. See [backlog.json](backlog.json) for machine-readable specifications. Release placement is additive; see [approved delivery releases](PLAN.md#approved-delivery-releases). +Each original issue has one Goal statement, scope, TDD cases, acceptance criteria, model/effort, risk and dependencies. See [backlog.json](backlog.json) for machine-readable specifications. Original JSON `status` and `agent` values are the initial/historical snapshot, not live dispatch authority; the live Project is authoritative after work begins. Do not redispatch from historical Ready values. Release placement is additive; see [approved delivery releases](PLAN.md#approved-delivery-releases). ## Live 36-item release map -Verified 2026-09-08 against Project #2 (`36` items) and native GitHub parent/`blockedBy` relations. **Release** is the stage that needs the complete original scope; it is not a closed DAG that can ship before natively blocking issues on later releases. **R1 subset** is an explicit child when the parent mixes MVP and later acceptance. Children do not close parents. Native edges below were not added by this documentation change. +Verified 2026-09-08 against Project #2 (`36` items) and native GitHub parent/`blockedBy` relations. **Release** is the stage that needs the complete original scope; it is not a closed DAG that can ship before natively blocking issues on later releases, and R1 is not independently deliverable until the R3-placed full G02 #2 evidence gate passes. **R1 subset** is an explicit child when the parent mixes MVP and later acceptance. Children do not close parents. Native edges below were not added by this documentation change. | Issue | Live status | Release (full original) | R1 subset / notes | Live Agent | |---|---|---|---|---| | [#1](https://github.com/1XP-AI/gh-runnerd/issues/1) G01 | In progress | R1 | Full original Goal retained; children #44/#46/#47/#50/#52/#54 are Done slices and do not complete G01 | Luna max | -| [#2](https://github.com/1XP-AI/gh-runnerd/issues/2) G02 | In progress | R3 | Broad Manifest/multi-org/launchd remains here. R1 subset is #67 | Luna max | +| [#2](https://github.com/1XP-AI/gh-runnerd/issues/2) G02 | In progress | R3 | Broad Manifest/multi-org/launchd remains here. R1 subset is #67. Full #2 is also a mandatory pre-release evidence gate for #68 production; R1 is not independently deliverable until it passes | Luna max | | [#3](https://github.com/1XP-AI/gh-runnerd/issues/3) G03 | Done | R1 | Full original bootstrap | Luna max | | [#4](https://github.com/1XP-AI/gh-runnerd/issues/4) G04 | Backlog | R2 | Full contracts. Still blocked by #1/#2/#3. Not bypassed by #68 | Luna max | | [#5](https://github.com/1XP-AI/gh-runnerd/issues/5) G05 | Backlog | R2 | Full durable journal | Luna max | diff --git a/docs/PLAN.md b/docs/PLAN.md index 60a608e..91c2ebd 100644 --- a/docs/PLAN.md +++ b/docs/PLAN.md @@ -79,12 +79,14 @@ Public PR checks run in GitHub-hosted standard environments without credentials. Issue [#66](https://github.com/1XP-AI/gh-runnerd/issues/66) records the maintainer-accepted split. Placement on a release means that release needs the **complete original scope**. It is not a claim that no safe subset is required earlier, and it is not permission to mark a parent Done. Where an original issue mixed internal-MVP and later acceptance, explicit children hold the R1 subset; parents stay open until their own criteria pass. -The live 36-item map is in [ISSUES.md](ISSUES.md). Production implementation of dependency-blocked full-scope issues is not authorized by this planning change. R1 placement of #68 is release scope, not a waiver of the full G01/G02 production gates. +The live 36-item map is in [ISSUES.md](ISSUES.md). Production implementation of dependency-blocked full-scope issues is not authorized by this planning change. R1 placement of #68 is user-visible release scope, not a waiver of the full G01/G02 production gates. Because full G02 remains classified R3, R1 is not independently deliverable until that pre-release evidence gate passes. ### R1 — Internal MVP Operator-visible exit: on this Mac, one organization, one private test repository, the existing reviewed Linux-container backend, concurrency one, and a manually configured App, run one owned job, clean up only owned resources, and demonstrate recovery or quarantine at ACK, acquisition and JIT boundaries. +That exit is user-visible R1 **scope**, not an independently shippable stage. Full G02 [#2](https://github.com/1XP-AI/gh-runnerd/issues/2) remains a mandatory pre-release evidence gate for #68 production implementation and is classified R3 (Manifest, multi-organization, launchd). Completing #67 does not satisfy it. **R1 is not independently deliverable until that R3-placed full G02 gate passes.** Do not move full G02 onto R1 without an explicit ask. + Foreground only. `cmd/gh-runnerd` is still an empty entry point; unattended daemon, install, launchd service, reboot persistence, native macOS jobs, Lima or Docker-context changes, a second backend, multi-organization operation, automated Manifest enrollment and general scheduling are not R1 and are not implemented. | Issue | R1 role versus original acceptance | @@ -108,6 +110,8 @@ Operator-visible target: install/start/stop/status, restart recovery, bounded sc Multi-organization support, additional execution modes including trusted native macOS, automated onboarding, signing/update/diagnostics and broad qualification. Full original acceptance of #2, #8, #11, #16, #17, #18, #19. Completing #67 or #69 does not complete #2 or #16. +Full G02 #2 stays on R3 for original-scope placement. It is also a mandatory pre-release evidence gate for R1 #68 production. R3 placement does not mean R1 can ship first; this remaining planning limitation is a cross-release prerequisite, not stage independence. Do not move full G02 onto R1 without an explicit ask. + ### Future research [#21](https://github.com/1XP-AI/gh-runnerd/issues/21) G21 remains Future and is not a release dependency. diff --git a/docs/backlog.json b/docs/backlog.json index 5f163d4..ede72c1 100644 --- a/docs/backlog.json +++ b/docs/backlog.json @@ -1,5 +1,11 @@ { "schema_version": 1, + "field_semantics": { + "status": "initial_historical_planning_snapshot", + "agent": "initial_historical_planning_snapshot", + "live_dispatch_authority": "GitHub Project #2 and current issue bodies", + "do_not_redispatch_from_snapshot": true + }, "issues": [ { "key": "G01", @@ -953,7 +959,7 @@ ], "release": "R1 - Internal MVP", "goal": "Provide a foreground MVP command that connects the reviewed broker and paired worker lifecycle for one organization, one private repository and one worker, with durable fail-stop state and safe owned cleanup.", - "scope": "Vertical R1 slice of #4/#5/#6/#7/#9/#10/#13/#14 with primary parent #13. Reuse the reviewed paired Linux-container execution path. No second backend, native macOS jobs, daemon/install or context switch. Native dependencies remain G01g/#60, P66/#66 and G02-R1/#67. Until full G01 #1 and G02 #2 evidence gates pass, authorized work is a reviewed minimal contract and offline evidence only; production implementation starts only then. Completing G02-R1/#67 does not complete G02.", + "scope": "Vertical R1 slice of #4/#5/#6/#7/#9/#10/#13/#14 with primary parent #13. Reuse the reviewed paired Linux-container execution path. No second backend, native macOS jobs, daemon/install or context switch. Native dependencies remain G01g/#60, P66/#66 and G02-R1/#67. Until full G01 #1 and G02 #2 evidence gates pass, authorized work is a reviewed minimal contract and offline evidence only; production implementation starts only then. Completing G02-R1/#67 does not complete G02. Full G02 remains classified R3; user-visible R1 scope is not independently deliverable until that pre-release gate passes.", "tdd": [ "Native blockers G01g/#60, P66/#66 and G02-R1/#67 remain the GitHub blockedBy set; do not add #1/#2 as native edges from this docs change.", "Until full G01 #1 and G02 #2 pass, work is contract/offline evidence only; production implementation is unauthorized.", From bec9c0ae074d5ad70a9a45e613137f8bbd86446c Mon Sep 17 00:00:00 2001 From: JinWoo Lee Date: Wed, 9 Sep 2026 10:26:22 +0900 Subject: [PATCH 7/7] docs: route Agent edits from the inspected override Replace the #66-#69 skip list with operator-inspected IMPLEMENTER_OVERRIDE and live Project field-list exact match. --- docs/EXECUTION.md | 2 +- docs/HANDOFF.md | 103 ++++++++++++++++++++++++++++++++-------------- 2 files changed, 72 insertions(+), 33 deletions(-) diff --git a/docs/EXECUTION.md b/docs/EXECUTION.md index 13bee65..ecbfbd2 100644 --- a/docs/EXECUTION.md +++ b/docs/EXECUTION.md @@ -35,7 +35,7 @@ was complete at merge time. ## Reusable dispatch text -> Work on ISSUE_URL using the issue's implementer (default Luna max; #66/#67/#68/#69 are Grok 4.6 xhigh) and one active goal equal to its Goal statement. Independent review is Luna max even when the implementer is overridden. Read AGENTS.md and linked design decisions. Verify dependencies first. Use a separate worktree, write the meaningful failing test before implementation, and preserve the no-secrets/no-busy-kill/owned-cleanup invariants. Do not change existing live runners or enroll new Apps unless the issue explicitly authorizes that operation. Open a reviewed PR with commands/results, red evidence, limitations and rollback notes. Update the Project accurately; do not mark the goal complete while required work remains. +> Work on ISSUE_URL using the issue's implementer (default Luna max unless an explicit current user override is recorded) and one active goal equal to its Goal statement. Independent review is Luna max even when the implementer is overridden. Read AGENTS.md and linked design decisions. Verify dependencies first. Use a separate worktree, write the meaningful failing test before implementation, and preserve the no-secrets/no-busy-kill/owned-cleanup invariants. Do not change existing live runners or enroll new Apps unless the issue explicitly authorizes that operation. Open a reviewed PR with commands/results, red evidence, limitations and rollback notes. Update the Project accurately; do not mark the goal complete while required work remains. Do not write Luna over an inspected override that has no Project Agent option; preserve the existing Agent value. ## Board fields diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index 6f29bd6..961e1b3 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -204,11 +204,16 @@ second native Goal on #1 while this planning work runs. For every new issue, after checking for an explicit current user override: -- set the Project Agent field to `Luna max` when no override exists; -- when an override exists and the Project Agent field has that option, set it to - that option; when the override has **no** Project option (today: Grok 4.6 xhigh - on #66/#67/#68/#69), **skip the Agent edit** and leave the field unset — do not - write Luna as a substitute implementer. Independent review remains Luna max; +- set `IMPLEMENTER_OVERRIDE` to the inspected current implementer name, or to an + empty string when there is no override (repository default `Luna max`); +- look up that name in live `gh project field-list` Agent options by exact match; +- when the name matches one option, write that option unless the item is not Ready + or already has a conflicting Agent; +- when an override exists and has **no** Project option (current example: Grok 4.6 + xhigh on #66/#67/#68/#69), **skip the Agent edit** and preserve the existing + field — do not write Luna as a substitute implementer and do not clear Agent. + Independent review remains Luna max. Do not keep a permanent issue-number + whitelist; - use one active goal whose objective is exactly the issue's `Goal` statement; - do not invent a token budget; - use an independent contract review with the current selected review model/effort @@ -220,7 +225,7 @@ For every new issue, after checking for an explicit current user override: Suggested handoff prompt to give the next agent: -> Work on ISSUE_URL in `1XP-AI/gh-runnerd`. Use the issue's implementer (default `gpt-5.6-luna` with `max`; #66/#67/#68/#69 are Grok 4.6 xhigh) and one active goal exactly equal to the issue's Goal statement; do not invent a token budget. Independent review is Luna max even when the implementer is overridden. Read `AGENTS.md`, `docs/EXECUTION.md`, the plan, the linked ADRs and the current Project item. Verify dependencies first. Create the goal and isolated branch/worktree, then set the item to In progress. Follow meaningful red test -> minimal green implementation -> refactor -> boundary/failure tests. Preserve no-secrets, no-busy-kill, owned-cleanup, stable-idempotency and trusted-native invariants. Do not change live runners, Docker context, App/Keychain/launchd state or GitHub credentials without explicit maintainer authorization. Open one focused PR with exact commands/results, red evidence, gaps and rollback notes. Obtain independent Luna max review, then the exact-head GitHub Codex review before merge. Update the Project, issue and goal only when their actual state changes. Do not write Luna into the Project Agent field over an issue-body-only Grok override. +> Work on ISSUE_URL in `1XP-AI/gh-runnerd`. Use the issue's implementer (default `gpt-5.6-luna` with `max` unless an explicit current user override is recorded) and one active goal exactly equal to the issue's Goal statement; do not invent a token budget. Independent review is Luna max even when the implementer is overridden. Read `AGENTS.md`, `docs/EXECUTION.md`, the plan, the linked ADRs and the current Project item. Verify dependencies first. Create the goal and isolated branch/worktree, then set the item to In progress. Follow meaningful red test -> minimal green implementation -> refactor -> boundary/failure tests. Preserve no-secrets, no-busy-kill, owned-cleanup, stable-idempotency and trusted-native invariants. Do not change live runners, Docker context, App/Keychain/launchd state or GitHub credentials without explicit maintainer authorization. Open one focused PR with exact commands/results, red evidence, gaps and rollback notes. Obtain independent Luna max review, then the exact-head GitHub Codex review before merge. Update the Project, issue and goal only when their actual state changes. Do not write Luna into the Project Agent field over an inspected override that has no Agent option; preserve the existing Agent value. ## Per-issue Project workflow @@ -255,7 +260,9 @@ every blocker must be closed and its acceptance actually complete before dispatc Then read the exact Goal, TDD cases, acceptance checklist, test profile and safety invariants. If a blocker is open, stop and report that state for the authorized issue. Select another issue only when a separate user task explicitly authorizes -that new scope. +that new scope. Record the inspected current implementer override as +`IMPLEMENTER_OVERRIDE` (empty string when there is none). Do not infer it from +the issue number and do not scrape issue prose automatically into the Agent write. ### 2. Resolve the Project item and route the Agent field @@ -264,17 +271,12 @@ PROJECT_ID=PVT_kwDOD2M2gs4Bismw STATUS_FIELD_ID=PVTSSF_lADOD2M2gs4BismwzhhjoZA AGENT_FIELD_ID=PVTSSF_lADOD2M2gs4Bismwzhhjobs STATUS_IN_PROGRESS_ID=7a569f61 -AGENT_LUNA_MAX_ID=9317c27f -# Default implementer is Luna max. Issue-body-only overrides with no Project -# Agent option must not be rewritten to Luna; leave Agent unset. -SKIP_AGENT_EDIT=0 -AGENT_OPTION_ID="$AGENT_LUNA_MAX_ID" -case "$ISSUE" in - 66|67|68|69) - SKIP_AGENT_EDIT=1 - AGENT_OPTION_ID="" - ;; -esac +DEFAULT_IMPLEMENTER="Luna max" + +# Operator-inspected current contract. Must be set: empty string means no +# override (repository default Luna max). Unset is fail-closed. Exact Project +# option names only; do not branch on issue numbers. +: "${IMPLEMENTER_OVERRIDE?set IMPLEMENTER_OVERRIDE after inspecting the current issue override; empty string means no override}" ITEM_JSON="$(gh project item-list "$PROJECT_NUMBER" --owner "$OWNER" \ --limit 1000 --format json)" @@ -297,24 +299,60 @@ if [ "$ITEM_STATUS" != "Ready" ]; then exit 1 fi +if [ -n "$IMPLEMENTER_OVERRIDE" ]; then + INTENDED_IMPLEMENTER="$IMPLEMENTER_OVERRIDE" +else + INTENDED_IMPLEMENTER="$DEFAULT_IMPLEMENTER" +fi + +AGENT_OPTIONS_JSON="$(gh project field-list "$PROJECT_NUMBER" --owner "$OWNER" --format json)" +if ! AGENT_OPTION_ID="$(printf '%s' "$AGENT_OPTIONS_JSON" | jq -r --arg name "$INTENDED_IMPLEMENTER" --arg fid "$AGENT_FIELD_ID" ' + [.fields[] | select(.id == $fid) | .options[]? | select(.name == $name) | .id] + | if length == 1 then .[0] + elif length == 0 then empty + else error("ambiguous Agent option name") + end')"; then + printf 'Agent option lookup failed; fail closed\n' >&2 + exit 1 +fi + +if [ -n "$IMPLEMENTER_OVERRIDE" ] && [ -z "$AGENT_OPTION_ID" ]; then + SKIP_AGENT_EDIT=1 +elif [ -z "$AGENT_OPTION_ID" ]; then + printf 'default implementer %s is not a Project Agent option; fail closed\n' \ + "$INTENDED_IMPLEMENTER" >&2 + exit 1 +else + SKIP_AGENT_EDIT=0 +fi + +if [ "$SKIP_AGENT_EDIT" = 0 ] && [ "$ITEM_AGENT" != "(unset)" ] && [ "$ITEM_AGENT" != "$INTENDED_IMPLEMENTER" ]; then + printf 'selected issue already has Agent %s; will not overwrite with %s\n' \ + "$ITEM_AGENT" "$INTENDED_IMPLEMENTER" >&2 + exit 1 +fi + if [ "$SKIP_AGENT_EDIT" = 1 ]; then - printf 'issue %s has a Grok 4.6 xhigh override with no Project Agent option; leaving Agent unset (was %s)\n' \ - "$ISSUE" "$ITEM_AGENT" + printf 'issue %s override %s has no Project Agent option; preserving Agent (was %s)\n' \ + "$ISSUE" "$IMPLEMENTER_OVERRIDE" "$ITEM_AGENT" else gh project item-edit --id "$ITEM_ID" --project-id "$PROJECT_ID" \ --field-id "$AGENT_FIELD_ID" --single-select-option-id "$AGENT_OPTION_ID" fi ``` -If the item is already In progress for another active agent, the guard above stops -before any field edit; coordinate instead of starting a second implementation. Keep -the issue's durable Goal/Dependencies fields and `docs/backlog.json` aligned only -when the contract actually changes. Do not rewrite original JSON `status`/`agent` -snapshots to look live; the Project is dispatch authority. If -the current user selected another supported model/effort, resolve its Project Agent -option ID with `gh project field-list` and replace `AGENT_OPTION_ID`; never overwrite -an explicit current selection with the default, and never write Luna over an -issue-body-only override that has no Agent option. Independent review stays Luna max. +If the item is already In progress or otherwise not Ready, the guard above stops +before any field edit; coordinate instead of starting a second implementation or +overwriting a currently owned Agent. Keep the issue's durable Goal/Dependencies +fields and `docs/backlog.json` aligned only when the contract actually changes. +Do not rewrite original JSON `status`/`agent` snapshots to look live; the Project +is dispatch authority. The script does not branch on issue numbers. +`IMPLEMENTER_OVERRIDE` is the operator-inspected current contract, not an LLM +scrape and not a permanent whitelist. Live Agent options come from +`gh project field-list`. Exact match writes; a missing option preserves Agent +and does not clear it; non-Ready and conflicting Agent fail closed. Independent +review stays Luna max. Current #66/#67/#68/#69 still record Grok 4.6 xhigh with +no Project option; that is today's inspected override, not a routing table. ### 3. Start one active goal and an isolated worktree @@ -553,9 +591,10 @@ Before handing work onward, confirm: - [ ] `git status` is clean or the changes are on the declared issue branch. - [ ] The issue Goal was copied exactly into one active goal; no invented budget. - [ ] Dependencies and Project status were checked live. -- [ ] Implementer matches the current user-selected model/effort (default: - `Luna max`; #66/#67/#68/#69 are Grok 4.6 xhigh with Agent left unset). - Historical records and #1/#2/#60 Agent values were not rewritten. +- [ ] Implementer matches the inspected current user override (default + `Luna max` if none). If that override has no Project Agent option, the + Agent field was left unchanged. Historical records and #1/#2/#60 Agent + values were not rewritten. - [ ] A meaningful red case, minimal green fix and relevant boundary tests are recorded, with actual commands/results and remaining gaps. - [ ] No secrets, personal paths, raw SDK errors, live tokens or unreviewed runner