fix(submodules): map external/Automation_ui and external/minibook, retire two gitlinks (task-coding-0006)

[Flissel]

What

Closes the mapping half of finding B2. Five gitlinks under external/ become three, with a clean 1:1 correspondence between the remaining gitlinks and the .gitmodules path entries.

before                                   after
external/Automation_ui           3a413ae2  →  mapped, Flissel/Automation_ui.git
external/minibook                b19c61e2  →  mapped, Flissel/minibook.git
external/NemoClaw                3ba517dd  →  retired
external/free-llm-api-resources  c3ac9113  →  retired
la_fungus_search                 f731c19a  →  untouched, block byte-identical

Diff is 3 files: .gitmodules (+6), and the two removed index entries. Nothing else.

Authority

Risk class destructive. The two removals are covered by durable user authority claude-user-message:session_01SdA3ftgP3wciDbcFzKw4uk@2026-08-17T09:35:00Z, which grants exactly external/NemoClaw and external/free-llm-api-resources and nothing further. Verified by mode-field enumeration that no third gitlink moved.

Both retired paths were empty, uninitialized directories (find -mindepth 1 returned zero entries for each), so only the index entry was removed and no file content was lost. The empty directories were deliberately left on disk — git does not track them, so they contribute nothing to the commit, and deleting them would have been a filesystem mutation beyond the granted scope.

The gate is NOT green, and this PR does not make it green

This is the decisive evidence, and I reproduced it myself in two throwaway clones:

Before (81ab938): fatal: No url found for submodule path 'external/Automation_ui' in .gitmodules, EXIT=128 — dies at the first of five paths.

After (035b357):

Submodule path 'external/Automation_ui/moire_tracker': checked out '7a11bbb4…'
Submodule path 'external/minibook': checked out 'b19c61e2…'
fatal: remote error: upload-pack: not our ref f731c19a…
EXIT=128

— both new mappings serve their pins (including the level-4 moire_tracker), then it dies at the last path.

The abort moved from the first of five paths to the last. That is the entirety of the readiness change. Reaching ready: true still needs a re-pin or retirement of la_fungus_search, whose pin f731c19a is not reachable from any ref on its own remote. That was excluded by user decision because the upstream is being updated right now, so it was not touched.

Upstream claims re-verified — all four held

The session was told to re-verify rather than trust the brief. Nothing had to stop fail-closed, and one claim came back stronger than I had put it:

• Automation_ui — my brief offered "SHA reachable there", which is weak on its own. Stronger test used instead: fetching only refs/heads/* with --filter=blob:none, never the SHA, already brings the object into the closure, and git merge-base --is-ancestor shows 3a413ae2 is an ancestor of origin/main. Fork-network object serving cannot explain that. Corroborated four ways, including one strand I had not cited: vibemind-os's own .gitmodules already maps spaces/desktop/Automation_ui to the same remote.
• minibook — ref-tip comparison: Flissel/minibook has exactly one head, refs/heads/master = b19c61e2, which is the pin; c4pt0r/minibook's master is 3b0ae99b, a different commit. Proven functionally downstream — the recursive init actually cloned this URL and checked out that pin.
• NemoClaw retirement safe — grep for the path returns zero hits repo-wide. mcp_plugins/servers/nemoclaw_bridge.py is an in-repo module whose docstring says "Inspired by NemoClaw's sandboxed agent model" and whose every import is stdlib/yaml/httpx/playwright/json — nothing from the tree. task_executor.py:51 imports that in-repo module, not the submodule.
• free-llm-api-resources retirement safe — zero hits for the path, the underscore variant, or cheahjs. No URL was invented, and none of the third-party forks that happen to carry the object was proposed as a remote.

Method carried over from task-git-0034: fetch-by-SHA decides nothing across a fork network, so ref-tip and ref-reachability were used; gitlinks counted with awk '$1=="160000"', never a bare grep 160000.

Evidence

Gate	Result
docker compose config	exit 0 — and docker-validate is this repo's only blocking CI job; all three compose validations pass, before and after
pytest tests/	49 failed, 13242 passed, 55 skipped, 9 errors — byte-for-byte identical to baseline on unmodified master
recursive init	reproduced above, independently

No regression, as it must be: this touches .gitmodules and two index entries, no Python.

Two pre-existing problems found, not caused here

This repo's test suite is substantially broken on unmodified master. tests/orchestrator/conftest.py:15 imports run_orchestrator, which was moved to _archive/old_runners/ and is not importable; being a conftest failure it aborts the entire pytest session. 49 failures and 9 collection errors exist at baseline. CI hides all of it behind continue-on-error: true on the lint, test and security jobs.

CI never hit the bug this PR fixes because .github/workflows/ci.yml uses actions/checkout@v4 without submodules: recursive.

Both are out of scope here and worth a cockpit-coding follow-up.

Hygiene

No dirty state was produced in either repository and no clean-up primitive was run — every measurement and both init probes used throwaway clones outside both worktrees. One git refusal was hit (please stage your changes to .gitmodules or stash them to proceed on git rm) and it was resolved by completing the operation, not by stashing, forcing or discarding.

---

Generated by Claude Code