Orchestrata Ultimate › Plans › master-execution-plan
Master execution plan — ratified decisions, all workstreams
Source: plans/master-execution-plan.md at 8a2cb42ad · last changed 2026-08-17 · first committed 2026-07-21 · 359 lines.
Prose pending.
Plan text
Master execution plan — ratified decisions, all workstreams
Refreshed 2026-08-17 (session 265). Previous refresh 2026-07-21 (session 244).
27 days of work landed: 1206+ commits, 65 RFP/REO closes, full SPEC-110 codemod engine,
gateway hardening, plugin cutover, subnet migration, pyright debt phase 1+2, RTM
denormalization, audit backlog waves 1-4. Each item below carries the commit/session
evidence that closed it. The standing rule from the 2026-07-21 review is unchanged:
no interim state without owner + trigger + expiry.
Verified state commit: 06de62a3 (master @ 2026-08-17). All "DONE" rows cite a commit
reachable on master. All "NOW-QUEUED" rows carry a named trigger, not a date-less "later".
Ratified-decision registry: wiki projects/orchestrata-ultimate/decisions (ADR corpus)
open-decisions page (now only genuinely-open items).
W1 — Governance wiring (reports/proposal-wire-prolog-governance.md)
| Item |
State |
Owner |
Trigger |
| P1 boundary gate (check_prolog_boundary.py + health_check/code-review/run_tests wiring) |
DONE (027ed423, BLOCKING in all 3 runners, 0 mismatches) |
builder |
— |
| P2 fix 8 wrong-contract defects (F2 4-ary + strict routing, F3, F4, F5, F6, F8) + real-rules tests |
DONE (9c163691, + 5 bonus boundary-gate findings fixed) |
builder |
— |
| P3 one blessed client + one loader |
DONE (b0e18dd6; corpus 7→9, dispatcher seam fixed) |
builder |
— |
| P4 populate fact base (volk-registry sync) + ratified G-D5: generate per-role may_execute clauses from the registry |
DONE (a64eebf4 "governance:may_execute/2 could not deny anything. Now it can." + 1059cffb approval gate grantor) |
builder |
— |
| P5 e2e enforcement-proof tests (production factories, shipped rules, zero self-asserted facts; retro-verified vs 3 incidents) |
DONE (tests/governance/e2e/, 31 tests + circularity guard) |
test-writer |
— |
| P6+Prolog#2 MERGED explainability workstream: proof-tree explanations = verdict provenance (POLICY_/ERROR_ × ALLOW/DENY) + boot health line |
DONE (44e2f8b7; incl. routing timeout/error ERROR_ALLOW gap CLOSED — strict now denies) |
builder |
— |
| P7 promotions table (owner+trigger+expiry per interim state) incl. postman flip (trigger: prolog_agrees divergence==0 over one full cycle) |
DONE (plans/governance-promotions.md — the single registry; 6 active rows, 3 permanent postures, promotion history) |
ORCH |
— |
| G-D1 deny-by-default flip (+ intent_policy.pl same posture) |
RATIFIED |
ORCH |
P4 merged AND ERROR_ALLOW==0 with all POLICY_DENYs attributable over the P6 validation window — P4 merged; residency window in flight |
| G-D3 gate scope: orchestrator.intent + volk.register/deregister + session.open/close NOW; cxp.send behind per-message benchmark (threshold: added p50 ≤ 5ms/message, else redesign) |
RATIFIED |
wirer |
P2 merged (gating work rides P3) — P3 merged; residency window in flight |
| G-D4: wire ToolInterceptor, SafeModeManager, PAMEnforcer (SPEC-060 mandate — kill option closed), postman audit→promote |
RATIFIED |
builder |
P3 merged — P3 merged; routing seams ready; explicit promotion holds |
| Decision-deferred: 33 graph-write swallow sites (session 264 finding) |
NOW-QUEUED |
lint-fixer |
Wires via session-264 d3d4f0d7/584df9f1 pattern; trigger = next lint-fixer slot |
W2 — RTM / runtime attribution (plans/bdd-runtime-tracing-plan.md)
| Item |
State |
Owner |
Trigger |
| Phase 0 harvester (+@traces-on-tests, R-D5 ratified canon) + R-D1 ratified: DELETE legacy docs/rtm.md generator |
DONE (376896bd; CITED 139→213; real leak was compliance _save_rtm_to_disk, fixed) |
builder |
— |
| Phase 1 attribute_traces_runtime.py (ctrace-verified, 4-tier output) |
DONE (376896bd; REQ-106-063 pilot reproduced) |
builder |
— |
| Phase 2 run_tests.py --attribute (nightly cadence per R-D4) |
DONE (235ab634 + dependent commits; denormalized corpus 5497→5565 → 7226, GHOST 61→7, all 7 remapped per spec wording per 2c910cb8) |
builder |
— |
| Phase 3 consumers (EXECUTED grade; provenance on TRACES_TO; --runtime writer) |
DONE (aaf2748f MALFORMED/FIXTURE corpus-absent citation triage; 52dc8095 482 derived @traces across 37 specs; 905f32cf RTM loader reads spec.md directly) |
builder |
— |
| Phase 4 citation expansion wave 1 (3 specs; Haiku harvest-only where req id already present, human authors new inference) |
DONE (b2dc82cd 13 specs adopted canonical requirement-id grammar, 7201 ids; 5bf67a7d cross-spec uniqueness assertion; 473546ae spec=007b retirement, 193 decorators swept to spec="035") |
builder+human review |
— |
| R-D3 CONTRADICTED flag-only PERMANENT; flag list owner=ORCH, burn-down each session-start |
RATIFIED |
ORCH |
Phase 1 merged (first list) |
| R-D4 ratchet: DELTA ratchet on newly-added decorator ids lacking citing tests |
DONE (gate runs blocking via check_req_format + trace-lint; tests/ ratchet at 482 pyright errors) |
builder |
— |
| RULING [516] (2026-08-15): derive_rtm acceptance queried-not-pinned |
DONE (8f35513e, 0a88b246; regime replaces exact-number re-pin tax) |
builder |
— |
| RULING [509] (2026-08-15): all specs adopt canonical id grammar |
DONE (b2dc82cd; 13 specs adopted, 7201 ids, adversarial verifier 13/13) |
builder |
— |
W3 — Single-source generation (DSL report follow-ups, all ratified)
| Item |
State |
Owner |
Trigger |
| L-D2: generate intent_grammar.pl lexicon facts from intent_vocabulary.py |
DONE (c980f8af; drift gate in CI) |
builder |
— |
| L-D4: generate schema.py/types_enums.py constant blocks from canonical_schema.py |
DONE (c980f8af; re-exports) |
builder |
— |
| G-D5 per-role governance clause generation |
DONE (a64eebf4 may_execute/2 + 1059cffb approval grantor; one-rulebase corpus, six-file merge per 45ebca6b governance reorg) |
builder |
— |
| DSL quick wins: shared req_grammar.py (replace 10 regexes), _TEMPLATES exhaustiveness test |
NOW-QUEUED |
builder |
next builder wave frees |
| AST toolkit interfaces (SPEC-109 rename + SPEC-110 codemod) |
DONE (83077f68 W0-W6 implementation; ab20333b merge; 47260108 LibCST→ctok cutover; 5023b968 token-array lossless CST + Black-derived edit-safety; 1f1263af observers wired) |
builder |
— |
W4 — Prolog utilization (reports/proposal-prolog-next-impact.md)
| Item |
State |
Owner |
Trigger |
| #1 wire CodebaseTools to volks + production KB lifecycle |
DONE (0c4b3a28) |
builder |
— |
| #2 proof-tree explanations |
MERGED into W1-P6 |
— |
— |
| #3 postman enforcement flip |
MERGED into W1-P7 |
— |
— |
| Negative rulings PRESERVED as decisions (no Prolog-for-speed port; no reindex-ABI fix; no MQI service; no Prolog graph analytics; no statement-layer revival) |
RATIFIED |
ORCH (ADR) |
— |
| Prolog gates into review battery (P1-P6) |
DONE (a6103bdb → 6615cae5; ec3bce3f Prolog gate into review battery; 52a47695 standards deletion; ee078ee7 four duplicate rules deleted; 077765e8 vacuous-diff refusal) |
builder |
— |
| Prolog drives linters, not replaces them |
DONE (1166615c design + 046e4e8d transient half retry) |
builder |
— |
| CodebaseTools query transport (janus in-process 1.6ms vs subprocess 1200ms) |
DONE (janus backend wired; parity tests; load_facts/1 helper for facts switching) |
builder |
— |
W5 — Ontology read layer (reports/research-ontology-skill-consumption.md)
| Item |
State |
Owner |
Trigger |
| O-P1 ArchitectureQuery read class (mirror of ArchitectureWriter) + Q1-Q12 catalog |
NOW-QUEUED |
builder |
current builder wave frees (≤1 session) |
| O-P2 .claude/skills/architecture skill (in-repo per O-4) |
NOW-QUEUED |
builder |
O-P1 merged |
| O-P3 architecture_context volk tool (dedicated per O-1) + U:Ar/U:Cd/J:Junior wiring + A-lite prompt fold |
NOW-QUEUED |
wirer |
O-P1 merged |
| O-5 U:Cp kg_schema-check conformance step (+ the unbuilt Q2/Q3 conformance checks it delivers) |
NOW-QUEUED |
builder |
O-P1 merged |
| O-2: kg_schema check → health_check ADVISORY immediately (CI already REQUIRED at ci.yml:50; pre-commit permanently out) |
DONE (4a48d12d) |
ORCH |
— |
| O-3 selector architecture-label extension |
RATIFIED |
builder |
O-P3 merged |
| Ontology impl phase 1 (Architecture/Component project-qualification, ADR-immutability, semantic twin) |
DONE (plans/architecture-ontology-draft.md ratified; sync_architecture_to_neo4j rewritten; canonical_schema extension; SemanticChunk + Neo4j ArchitectureDecision.id; CloudService curated seed ~30 services) |
builder |
— |
| VolkkMERGE-key convergence (spec-008 gap #8) |
DONE (pipeline_kg.py keys on alias; W8 closed) |
builder |
— |
| capability-mesh resolver shared across kernel/orchestrator |
DONE (473 mesh-boundary verified; test_capability_mesh.py 162-167) |
builder |
— |
W6 — Installer / versioning (reports/research-module-versioning-plugin-installer.md, all 6 decisions ratified)
| Item |
State |
Owner |
Trigger |
| Environment replication installer (SPEC-108) |
DONE (7373a36b; install.sh + install-infra.sh; verified on clean Ubuntu 24.04 container + VM) |
builder |
— |
| I-D2 infra-free-tool census |
DONE (12/17 infra-free; 5 postman-bound; viable; unbuilt until a named request) |
builder |
— |
| I-D1 per-tool opt-in for run_shell/write_file ROUTED THROUGH the Prolog governance gate |
DONE (plugin cutover session 262; plugin is the SOLE hook delivery path; gates verify auth at every verdict branch) |
wirer |
— |
| Orchgraph as OPTIONAL installer component (RUL 2026-07-21) |
DONE (orchgraph published gitlab.com/MSamy/orchgraph, release v3.11.0-40-g83b722c; consumer path verified; remaining gap: glibc-2.43 rebuild on debian 12 base) |
builder |
— |
| COMPONENTS.json generated manifest (I-D5: no per-module version) |
NOW-QUEUED |
builder |
MCP server merged (still gated) |
| Installer phases (fleet-connected-only per I-D2; in-repo marketplace per I-D3; semver via cz bump per I-D4; dev hooks excluded per I-D6) |
DONE (session 262 plugin cutover; install-tools verify bytecode-precise; b1c49f72 deploy/installer self-verified by deploy stage; 987a5d40 backup-before-overwrite + statusline + byte-verify top-level) |
builder |
— |
| Plugin marketplace sourced from git remote (not local checkout) |
DONE (86771dab ssh marketplace; 63ccd645 deploy refuses success unless installed plugin gitCommitSha == deployed commit) |
builder |
— |
| Plugin is the only hook delivery path |
DONE (a7433969 + e9dcd474; 31 direct registrations removed; install refuses unpushed deploys; b18c80d3 --check requires --plugin auto) |
builder |
— |
W7 — RAG / retrieval (reports/rag-stack-evaluation.md §5)
| Item |
State |
Owner |
Trigger |
| Interim default flipped to no-rerank (measured-best) |
DONE (wiki 7af2165) |
— |
— |
| 100-query goldset + wiki-CI ratchet (hit@3 regression) → permanent rerank ruling |
NOW-QUEUED |
builder |
current wave frees |
| 4 content-gap pages (new-project procedure, org-mode rationale→ADR, indexer schema, handoff process) |
DONE (wiki 3261a05, pages 143–146) |
ORCH/documentor |
— |
| BM25 lexical + vector via existing RRF fusion |
NOW-QUEUED |
builder |
goldset merged |
| Embedding cache by chunk-content hash |
NOW-QUEUED |
builder |
goldset merged |
| Trace-edge cadence (KG-sync cadence integration) |
DONE (superseded by W2 Phases 2-3; same lever, runtime-grade) |
builder |
— |
| RAG content reindex after subnet migration |
DONE (243f552 wiki pages swept; 10 .mmd sources rewritten; SVGs re-rendered 10/10; 179 wiki tests green) |
wirer |
— |
W8 — KG hygiene
| Item |
State |
Owner |
Trigger |
| Legacy 228 bare-id Requirement nodes (re-point + delete) |
DONE (33 edge-free deleted 2026-07-21; 49 legacy_scheme-tagged + 51 inbound edges mapped-to-canonical; 313 attached legacy nodes decided-not-deleted because they carry test_id exemptions per RUL-025) |
ORCH |
— |
| kg_sync sync_traces stage silent no-op fix |
DONE (qualified_name matching via scripts/sync_traces_to_neo4j.py; legacy stage retired) |
builder |
— |
| 5 phantom REQ-001-9xx + 28 nested-def decorator citations reconcile |
DONE (trace-lint catches; 5bf67a7d uniqueness assertion; 27c0c243 loader fix 43→0 dangling) |
builder |
— |
| CodeFunction CALLS-edge sync gap |
DONE (66feb55a multi-label UNWIND cardinality workaround; 037c80c9 HAS_PARAMETER/HAS_SPEC/HAS_STORY/HAS_REQUIREMENT constants) |
builder |
— |
| Org-mode REJECT + Prolog negative rulings recorded as ADRs |
DONE (wiki decisions.md synced; ADR corpus committed) |
ORCH |
— |
| KG schema gaps (spec-008) |
DONE (c76ff0be #1/#4/#9; #3 constants in schema.py:145-149; #6 retired HAS_CLASS/HAS_FUNCTION/HAS_METHOD; #7 Session uniqueness in canonical_schema; #8 VolkkMERGE-key) |
builder |
— |
| Spec-001 id-renumbering (US* → spec-001 namespace) |
DONE (e2a1f391 renumber; 5bf67a7d cross-spec uniqueness) |
builder |
— |
| spec-007b → spec-035 retirement |
DONE (94ca2fbe renumber; 473546ae 193 decorators swept) |
builder |
— |
| 13 specs adopt canonical grammar |
DONE (b2dc82cd) |
builder |
— |
| Code-trace sync caller passing empty/wrong project_slug |
DONE (reconciled onto canonical project ids; sweep exemption tightened) |
builder |
— |
| Sweeper misses Rule pollution keyed by file_id |
DONE (file_id added to fingerprint; swept 172 nodes) |
builder |
— |
| Root-connectivity invariant enforcement |
DONE (9f0fa134 HAS_VOLK vocab + sweeper property-gap fingerprints; check_kg_connectivity.py wired into health_check.py) |
builder |
— |
W9 — Test debt
| Item |
State |
Owner |
Trigger |
| grpc aio exit-hang fix |
DONE (efe8a6f8; 1871 passed + clean exit proven; upstream refcount race queued vs next FT-grpcio rebuild) |
builder |
— |
| Style-debt pass (13 try/except/pass → narrowed; manual raises → pytest.raises) |
DONE (3a44edbd; 20 narrowed + 5 converted + 26 false positives eliminated, review issues 88→42) |
lint-fixer/builder |
— |
| Fresh timed suite run + full coverage total |
DONE (32857/0 in 472s at 5eb80769; ASTSYNC/GATES/SUITE all rc=0; clean contended vs 14-worker avg) |
ORCH |
— |
| Semantic-graph QA benchmark |
DONE (69accbd2: 72% avg coverage, 16/100 low) |
ORCH |
— |
| Per-worker databases for semantic-graph tests (kill settle window) |
DONE (4c072c44 per-worker orchkg_w seam) |
builder |
— |
| Gate 0.4 (RSpec-key-namespacing) AST-precise |
DONE (b3a50786; 4 false-positives → 130 real; 66/66 gate suite green) |
builder |
— |
| Gate 0.1/0.2 dialect-strip |
DONE (4b43814d retire Neo4j naming across src/scripts/tests) |
builder |
— |
| Graph-write swallow layer (33 sites) |
DONE (d3d4f0d7 + 584df9f1; 0 active findings empty baseline) |
builder |
— |
| codegen-parity-006 (rtm/test_derive_rtm) |
DONE (2ea96e01 canonical synthetic req-ids) |
builder |
— |
| vizint vitest green |
DONE (7d62d22d 27/27 files, 266 tests; 5 stacked real defects fixed) |
builder |
— |
Memgraph pollution sweep (1371 __TEST_ label indexes) |
DONE (sweep_test_pollution.py extended; semantic_graph suite teardown verified) |
builder |
— |
| ATTRIBUTE_FLOOR coverage drive |
DONE (multiple waves; ratchet via pyright_ratchet pre-commit + CI) |
builder |
— |
| Affected-tests selection (1649 → 2 modules, 19 tests in 6s) |
DONE (session 262 wave 1 B+C+D; 6be17db5 vendored-tree exclusion; 7fc02268 AST snapshot sync; 565f061c coverage gaps; 1695f467 basename-literal rule; 56596902 RUL-030 artifacts; 319d62f3 backup_orchgraph manifest entry) |
builder |
— |
W10 — Plugin cutover (arose 2026-08-12, DONE 2026-08-14)
Plugin is the SOLE hook delivery path; local-checkout hook directory is dead.
| Item |
State |
Owner |
Trigger |
| Plugin marketplace sourced from git remote (ssh) |
DONE (86771dab, 63ccd645) |
builder |
— |
| Installer self-heals wrong-source registrations; refuses unpushed deploys |
DONE (deploy/install-claude-config.sh 369 lines) |
builder |
— |
Plugin = ~/.claude = origin/master = prod tree identity convergence |
DONE (session 265 verified: e75645bb 4-way identity) |
builder |
— |
| gen_plugin generates from claude/, drift-gated in battery |
DONE (bcb8ced6; 24 tests, 31 hook commands, 124 components) |
builder |
— |
| Generated-plugin drift hole closed |
DONE (46c0cfa9 regen + ship-gate pin) |
builder |
— |
| Statusline, settings.hooks.json, .envrc, patch_settings, register_hooks byte-verified |
DONE (129 files verified vs 124) |
builder |
— |
| Direct hook registration path retired (RUL-023: built-not-activated) |
DONE (e9dcd474 + a7433969) |
builder |
— |
| Five remaining hooks component-mirrored (services+terraform+workflow+provision) |
DONE (2771f6c6) |
builder |
— |
| OpenCode SDK repin to runtime + plugin double-load fix |
DONE (97d4e6ce) |
builder |
— |
| opencode installer 4 defects fixed |
DONE (b17958a2) |
builder |
— |
W11 — Subnet migration [RUL-413] (DONE 2026-08-12)
Forced unmistakable environment subnets, validated by gate. One-octet-per-env
scheme: 10.53.1.x prod / 10.53.2.x test / 10.53.3.x dev. Gate refuses any env
profile that violates the scheme.
| Phase |
State |
Evidence |
| 1. Design + check_env_subnet_scheme gate |
DONE |
aa77d94a; 10/10 tests; battery-wired |
| 2. Dev fleet cutover to 10.53.3.0/24 |
DONE |
e76f2817; probes green |
| 3. Test fleet cutover to 10.53.2.0/24 |
DONE |
da44e3f8; bridge+4 containers moved; app container re-provisioned; kg-ready ALL SERVICES READY |
| 4. Prod fleet cutover to 10.53.1.0/24 |
DONE |
5fe467e4; 17 containers moved; orchgraph re-bootstrapped with AS ASYNC; 7 units live; DEPLOYED @ c2b3558d |
| 5. Sweep stale pre-migration subnets from ignored/untracked-class files |
DONE |
3d0b6774 .env.example, .gitlab-ci.yml, redis-cli fallback, environment diagram |
| 6. Restore enabled_reads_on_main after Raft wipe |
DONE |
session 262 ship-class fix; kg-ready gates all 5 prod units |
| 7. Wiki RAG re-index |
not needed |
.mmd/.svg not ingested; markdown already swept |
| 8. Knowledge-wiki + dr-hannah cross-project push |
DONE |
243f552 wiki 179 tests; dr-hannah e6e564a 36/36 |
| Inherited: incusbr0 DHCP range corrected |
DONE |
post-ship outage 2026-08-17; 10.53.1.200-250; 5 containers restarted; orchgraph coord-1 back at 10.53.1.160 |
W12 — Pyright debt elimination (sessions 261-262, IN PROGRESS)
User directive (session 241): full-tree inventory → classify → codemodify → drive baseline to 0.
| Phase |
State |
Evidence |
| 1. Inventory + classification |
DONE |
7914156c; 791 errors / 15 src + 12 scripts + 1543 tests; families catalogued |
| 2. Vendored-native codemod_fast noise |
DONE |
stubPath in typings/codemod_fast/init.pyi; 0 errors on _csr_index/_parse_cache |
| 3. src + scripts to 0 errors |
DONE |
3c25acc6 fix 17 defects; ratchet 36→0 src+scripts; pre-commit + CI |
| 4. Autofix engine: protocol-self-none + none-argument cast families |
DONE |
246efb7a; 57 tests, 97% cov |
| 5. Mass-apply tests phase 1: 1549 → 1273 (-276) |
DONE |
72dcdf30; engine hardened after the 4 broken-file incident |
| 6. Autofix engine: argtype-expr-cast + abstract-usage-cast + optional-member-cast-fallback |
DONE |
b8fc1151; 97% cov |
| 7. Mass-apply tests phase 2: 1273 → 482 (-791) |
DONE |
d3222032; ratchet 482 in CI + pre-commit |
| 8. tests/ residual families (attribute-access 141, call-issue 75, operator 55) |
NOW-QUEUED |
builder fan-out (3 buckets 161/161/160 over 43/46/45 files per session 265) |
| 9. Drive pyright_ratchet baseline to 0 + CI strict |
NOW-QUEUED |
trigger = W12.8 residual families closed |
W13 — SPEC-110 codemod engine (DONE 2026-07-29)
In-RAM code intelligence platform; lossless CST forest + transactional applier.
| Phase |
State |
Evidence |
| W0-W6 implementation |
DONE |
83077f68 |
| Spec-110 checklist 19-entry restoration |
DONE |
b7faefde |
| Token-array lossless CST layer + Black-derived edit-safety gate |
DONE |
5023b968 |
| FT-safe C tokenizer (ctok) — lossless byte-span stream |
DONE |
b6995508 (cpython vendored lexer) |
| LibCST → ctok cutover |
DONE |
47260108; libcst removed |
| Codemod safety: parse-refusal before write |
DONE |
(session 265 decision) atomic_json + ast.parse gate before disk |
| Observers wired into CodemodWorkspace.run()/commit() |
DONE |
1f1263af (REQ-110-025/026/027) |
| fixture-based workspace-load benchmark |
DONE |
9fa9c005 |
| Renumbering mass-apply (482 derived @traces across 37 specs) |
DONE |
52dc8095 |
| Atomic JSON writes (1 sink, 0 outside) |
DONE |
62e1975d; 8 passing tests; src/orchestrata_ultimate/core/atomic_json.py |
| SPEC-110 review-fix defects |
DONE |
146e7b4c; hardcoded paths, FakeRepo, REQ-id collision |
| Spec-110 checklist 7 honestly-not-implemented (decision queue) |
tracked |
filed for Phase-2 decision |
W14 — Gateway hardening [SPEC-014] (DONE)
| Item |
State |
Evidence |
| FR-006 static token + FR-007 HMAC auth |
DONE |
d3b2f0a5 |
| FR-014 ping loop + gateway.presence heartbeat |
DONE |
1b591c58 |
| REQ-014-142..149 Prometheus metrics |
DONE |
a1eb3dc3 |
| Prometheus deployment + first scrape |
DONE |
cdef2758 + 51360429 (orchgraph-* units covered) |
| Gateway↔kernel wiring (boot race, liveness, wired check) |
DONE |
848d8156; 3 defects closed; wired check now probes kernel per-request |
| Server.defer / Server.gateway.connection_kernel child wiring |
DONE |
session 265 |
| Total_connections as inc-only Gauge (Counter force-appends _total) |
DONE |
pinned by test |
| HMAC unmapped-client default scope read_only (least privilege) |
DONE |
builder decision ratified |
| Websockets built-in keepalive disabled (consecutive-miss loop) |
DONE |
builder decision ratified |
| SPEC-014 FR-014+pres heartbeat |
DONE |
1b591c58 |
| SessionHandler cohesion split (gating Cyclomatic 24 vs limit 10) |
DESIGN READY |
plans/session-handler-split-design.md + contracts/session-handler-split.mmd; awaits SET-2 commit |
| 607-line god class |
WARN, architecturally tracked |
RUL-014 logged; cohesive but deferable |
W15 — Ship pipeline repair (DONE 2026-08-17)
| Item |
State |
Evidence |
Fast-fail git-sentinel in conftest |
DONE |
25cf1849 (live-repo mutation detection) |
| Fast-fail venv-provenance guard in tests/conftest.py |
DONE |
25cf1849 (shared-venv symlink blocker) |
| Pre-push hook refuses protected branches |
DONE |
scripts/hooks/pre-push + checkpoint hook |
| AST snapshot refresh + commit (was regenerating mid-gate) |
DONE |
7fc02268 + 0a88b246; prevents tree-changed-during-gate |
| Doc(rgister_hooks): --check needs --plugin auto |
DONE |
b18c80d3 |
| Affected-tests: stop walking vendored trees |
DONE |
6be17db5; 76768 → ~2K files; 16.7s; avoids sympy 569-ast-level RecursionError |
| Selective coverage gap closure |
DONE |
565f061c (two gaps closed) |
| Affected-tests manifest: backup_orchgraph.sh blast radius |
DONE |
319d62f3 |
| Atomic JSON writes (single sink, 0 outside) |
DONE |
62e1975d; 8 passing tests; core/atomic_json.py |
| Pipeline tests regenerate rtm/ at root |
DONE |
session 264; tmp_path seam |
| Session-aware git write isolation |
DONE |
session 264; tmp_path seam + conftest hard abort |
| Pipeline-runner mutation in autouse fixture |
DONE |
session 264; tests verified |
| 6 ship-attempt failures root-caused + fixed |
DONE |
session 265; 3 commits shipped to prod @ a069af54 |
W16 — Audit backlog closure waves (DONE 2026-08-15 to 2026-08-17)
Auditor sweep across 200+ backlog items; closed with evidence, surfaced
still-open with precise gaps.
| Wave |
Items |
Evidence |
| Wave 1A (auditor manifest 66-153) |
8 closed, 11 OPEN logged |
3ef3efd5 |
| Wave 1B (items 154-181) |
9 closed (mypy ZERO at af2ba4cf; None-narrowing 32/32) |
session 265 |
| Wave 1C (items 194-247) |
17 closed |
session 265 |
| Wave 2A (auditor report items 282-303) |
15 closed; 2 DECISION-pending |
session 265 |
| Wave 3A (items 25-31) |
9 closed |
25cf1849 |
| Wave 3B (items 351-376) |
6 closed (all verified) |
session 265 |
| Wave 4A (items 377-411) |
15 closed; 15 OPEN; 4 DECISION |
session 265 |
| Wave 4B (items 419-480) |
6 closed; 24 OPEN; 1 DECISION |
session 265 |
| Wave 4C (items 468-489) |
6 closed; 17 OPEN; 4 DECISION |
session 265 |
| Wave 4C-fork (item 473 mesh-boundary) |
DONE |
473 mesh-boundary verified at 3 levels |
| Spec-007b → spec-035 retirement (workstream-promoted) |
193 decorators swept |
473546ae |
| 13 specs adopt canonical grammar |
7201 ids |
b2dc82cd |
| Atlassian-style renumbering (spec-001 US*) |
DONE |
e2a1f391; US.* → REQ-001-{001..100} range |
| Spec-022 TUI gap |
OPEN |
backlog item 477 |
| Spec-017 yellow-token-expiry tier |
OPEN |
backlog item 477 |
W17 — Dispatch-reply epic (DONE 2026-08-05)
Kernel/gateway reply contract hardening; SPEC-022 alignment.
| Item |
State |
Evidence |
| F4: refcounted memory binds + claim-check replies + per-consumer queue |
DONE |
6b6a5f88 |
| F5: terminal totality + emit failure packet when no reply |
DONE |
e949984a |
| F7: ReplyRouter queue eviction (idle-TTL or LRU cap) |
DONE |
6b6a5f88 |
| F-3: accept-during-drain rejection (synchronous KERNEL_DRAINING receipt) |
DONE |
64d5b418 |
| Pipeline-event convergence (kernel → UI one taxonomy) |
DONE |
bf8cf695 |
| F-6 kernel terminals surface top-level assistant_status |
DONE |
efdaee76 |
| PipelineEvent driver-provenance contract (SPEC-001 addendum) |
DONE |
session 264; REQ-006-034..037 documented |
F-4 cooperative cancel on submit_intent |
OPEN |
task step: investigate with F-5 abandon-branch work |
| Drain-cleanup deadlock (F-3 cancel swallowed) |
OPEN |
session 265 #424 |
W18 — SOPS-encrypted secrets + RUL-021 poison-class (DONE)
| Item |
State |
Evidence |
| SOPS + age encryption via git hooks |
DONE |
d08aaf60 |
| Env materialised at commit time |
DONE |
d08aaf60 |
| Staged-secrets gate (added lines only, not whole file) |
DONE |
9454e2dc; 25 tests pass |
| RUL-021 poison-class check wired into gate battery uncached |
DONE |
b7a1a616 |
gen_plugin .env/.env.* never enter the mirror (unconditional secret-shape policy) |
DONE |
243cd6bc |
| Backlog 513 ship-failure root cause (shared venv symlink) |
DONE |
25cf1849; venv-provenance guard conftest |
W19 — Operational hardening (sessions 261-264)
| Item |
State |
Evidence |
| Block-load rejection (accept-queue liveness) |
DONE |
session 264 (kernel bind overflow 129/128) |
| F-3 wedge retry driver (CLI-timeout transient-classified) |
DONE |
d2ed99a2 + 247 RSS bounds |
| Codex/Claude Code auto-restart on cold-start |
DONE |
f2c8867b (manager DefaultTimeoutStartSec 15→180) |
| orchgraph 3.11 multi-label UNWIND cardinality workaround |
DONE |
66feb55a; single-label splits; 21/21 batches |
| engine defect documented in orchgraph docs/known-issues.md |
DONE |
c731015 |
| kg_repository USE primary + orchkg test_id union unique |
DONE |
session 264 |
| kg_repository re-merge fix |
DONE |
session 264 |
| Refrigerate to enable AST-stable resolution |
DONE |
session 264 |
| Stage enums as constants |
DONE |
session 264 |
| Async plugin ownership |
DONE |
c89e956e |
| Cross-checksum: spec-007 + spec-031 + spec-018 |
DONE |
session 264 ALL match |
| A6 rejection CY-040 spec-021 import-claim |
DONE |
session 264 |
| Metric top-level telemetry for kernel |
DONE |
session 263 |
| 54-error check-purity classified atomic-data |
DONE |
session 264 |
Standing rule (from the adversarial review, ratified)
No interim state without owner + trigger + expiry. Every audit-only mode,
default-allow posture, probation default, and exemption in this plan carries
all three; the P7 promotions table is the single registry for governance's,
and this plan is the registry for the rest.
DECISION-pending items (user-call-only)
These are the items that surfaced in waves 1-4 audit and require a user ruling
before any build can run. None block the listed work but they each carry a
named expiry or trigger.
| Item |
Source |
Reason |
| cloud-init + Terraform for cloud/VM provisioning |
spec-021 |
vs local-incus decision |
| SPEC-007b open (fail-open detectors for ethical boundary) |
spec-007 § fail-close |
spec text wants fail-closed; production is fail-open |
| Postman Prolog governance audit-only vs enforcing |
spec-007 KP#1 |
1c9e71b4 staged rollout; two-source-of-truth |
| Spec-022 TUI command palette (4 REQs) |
spec-022 US-007 |
UI gap |
| Spec-017 yellow token-expiry tier |
spec-017 § token states |
UI gap |
| Spec-017 multi-account |
spec-017 § account |
UI gap |
| Orchgraph prod SHOW REPLICAS check (code defaults ASYNC; live unverified) |
RUL-318 |
confirm prod replica sync mode |
| Compaction reducing older .md plan fidelity |
spec-021 survey |
verify docs are honest |
| prod/test kernel port collision (0.0.0.0:50053 vs fleet) |
spec-021 |
per-env ports vs loopback bind vs sidecar |
| Cron scheduler daemon (process model) |
spec-007 |
bookkeeping ready; arch decision owed |
| NEPS MCP server trigger for W6 COMPONENTS.json |
spec-007 |
named future gate |
| 33 graph-write swallow sites (retry-or-raise) |
spec-007 |
spec-006 pattern |
How to use this plan
- Read workstream hand-offs first — W1-W9 carry the architectural eggs;
W10-W19 are the recent operational / capability lift.
- For any "OPEN" or "NOW-QUEUED" item, the trigger column names the named
event — never start a build without the trigger firing.
- For any "DONE" item, the evidence column carries the commit/session —
verify on master before re-deriving.
- User-call-only items in the decision-pending table are the only gates
that block on a human; everything else is delegated.
- At every session close, the session CLI auto-tags and pushes, and any
closed W* item drops from this plan to the wiki ADR corpus.