From 5b874c394d687e396903a61b1a7151562592f0e1 Mon Sep 17 00:00:00 2001 From: Alex Barclay Date: Sun, 9 Aug 2026 12:57:21 -0600 Subject: [PATCH 1/3] docs(status): refresh after the 2026-08-09 work-audit pass Rewrites the State summary in place and appends one session-log entry, per the running-document convention. Substantive corrections to the previous summary: - 'main is unprotected' -- resolved; protection is on and enforced for admins. - 'superseded guard digests remain in history' -- removed via a targeted 9-commit rewrite. Replaced with the narrower gap that actually remains: the objects are still fetchable from GitHub by exact SHA until Support GCs them. - Build-order item 2 claimed the embedding swarms were unstarted roadmap work. They were built three weeks ago and are now in draft PR #49. - Records that P3 was LEANING GO, not GO as the swarm handoff states, with Gate 5 (lifecycle / no orphans) never closed. - Records the deliberate deferral of release tagging pending signing certs, so it stops resurfacing as an audit finding. Also aligns cockpit/ui/package.json 0.0.0 -> 0.1.0 with Cargo.toml and tauri.conf.json, so a future tag is consistent. --- cockpit/ui/package.json | 2 +- docs/STATUS.md | 121 +++++++++++++++++++++++++++++----------- 2 files changed, 89 insertions(+), 34 deletions(-) diff --git a/cockpit/ui/package.json b/cockpit/ui/package.json index 66de2c8..c3f6369 100644 --- a/cockpit/ui/package.json +++ b/cockpit/ui/package.json @@ -1,7 +1,7 @@ { "name": "ui", "private": true, - "version": "0.0.0", + "version": "0.1.0", "type": "module", "scripts": { "dev": "vite", diff --git a/docs/STATUS.md b/docs/STATUS.md index d1f3369..1ef3c2e 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -1,7 +1,7 @@ --- stage: Build readiness: "control plane publication-ready; product shell on roadmap" -updated: "2026-07-25" +updated: "2026-08-09" name: "Command Center" base_branch: "main" test_cmd: "cargo test --workspace" @@ -16,14 +16,14 @@ its own `STATUS.md`, so the Command Center appears on its own board as a `local: ## State summary -**TL;DR.** The **control plane and workflow layer are feature-complete and tested**, and the repo is -**public**. Publication prep merged (**PR #41**) — README, MIT LICENSE, a real periodic **reconcile -loop**, an automated **WebSocket `/stream` integration test**, and a runnable **restart-recovery -demo**. Verified from a clean clone (`cargo build --release` + `cargo test` = **116 passed**), restart -demo runs verbatim, and the **Tauri installers build** (MSI 7.4M + NSIS 5.0M). Going public exposed a -**leak in this very file** — the embargo attestation named the string it asserted was absent; removed -from HEAD (**PR #44**) and made non-repeatable by a digest-based **embargo guard** (**PR #45**). The -**product shell** — plugin embedding, a design pass, remote control — remains on the roadmap. +**TL;DR.** The **control plane and workflow layer are feature-complete and tested**, the repo is +**public**, and `main` is now **branch-protected** with `embargo guard` + `cargo test (workspace)` as +required checks, enforced for admins. The **superseded guard digests are out of public history** — a +targeted 9-commit `filter-repo` rewrite, not the 193-commit rewrite that was correctly ruled out for +the embargoed name. The **product shell is no longer purely roadmap**: the plugin-runtime swarm's work +turned out to be **complete, not stranded**, and now sits in **draft PR #49** with all three automated +gates re-verified against current `main`, blocked only on an interactive smoke that needs a GUI +session. A design pass and remote control remain on the roadmap. **Vision (unchanged):** the Command Center is the operator's **one-stop shop for agentic engineering** — dispatch work, see every project's stage, act without alt-tabbing, host the other @@ -33,44 +33,99 @@ launch.** **Locked build order (auth-foundation-first):** 1. **Local-Tracker Phase 2 dispatch** — the keystone (viewer → command surface) + the loopback-auth foundation Remote Control reuses. Specced (Option A), **not built**. -2. **Resolve P4 → dispatch the app-plugin + view-plugin embedding swarms.** +2. **Embedding swarms — BUILT, in draft PR #49**, pending the interactive smoke. Not "roadmap" + any more; this line was wrong for three weeks. 3. **Design overhaul** (needs Claude Design output). 4. **Remote Control** — brainstorm→spec after Phase-2 auth lands. -**Open PRs.** None. (#41, #42, #43, #44, #45 all merged.) +**Open PRs.** **#49 (draft)** — cockpit plugin runtime (view-plugins + app-plugins). Merge-blocked on +the interactive smoke only; see `spikes/SPIKE-RESULTS-app-plugins.md` and the Lane S human gate. **Known gaps / blockers.** -- **Embargoed token remains in git history** (~193 commits) — deliberately out of scope. Removing it - from HEAD drops it out of code search, which was the goal; rewriting published history on a public - repo is a separate call. Nothing on any branch tip carries it. -- **Superseded guard digests remain in history** (#45, #46) and are crackable. Immaterial for the - embargoed name (its plaintext is already in that history); a **new, small exposure for the two - personal-contact patterns**, which were never otherwise in this repo. Needs a decision — see the - correction entry in the session log. -- **`main` is unprotected**, so the `embargo` CI job *reports* but does not *enforce* — nothing stops - a merge over a red check. Add a branch-protection rule with `embargo guard` as a required check. +- **Embargoed token remains in git history** (~193 commits) — deliberately out of scope, unchanged. + Removing it from HEAD drops it out of code search, which was the goal. Nothing on any branch tip + carries it. +- **Old digest objects are still fetchable from GitHub by exact SHA.** The rewrite removed them from + the branch, from history browsing, from code search, and from every future clone — but a force-push + does **not** delete unreachable objects. Verified still served: commits `6016495` / `eb832bd` and + blob `ee0ed06`. **Requires a GitHub Support ticket** asking them to garbage-collect unreachable + objects on this repo. Until then the exposure is "attacker needs the 40-char SHA", not "gone". +- **P3's Gate 5 (app-plugin lifecycle / no orphans) was never closed**, and + `docs/SWARM-HANDOFF-plugin-runtime.md` nevertheless describes P3 as "GO" when its own record says + **LEANING GO** with packaged gates 2/4 and Gate 5 outstanding. The swarm was dispatched on the + stronger claim. Those gates are now folded into #49's smoke checklist. - **Optional cockpit screenshot** for the README (needs a GUI session; the architecture diagram stands in). -- **Product shell is roadmap:** P3/P4 plugin-embedding spikes, cockpit design overhaul, Local-Tracker - Phase 2 dispatch, Remote Control. +- **Roadmap remainder:** cockpit design overhaul, Local-Tracker Phase 2 dispatch, Remote Control. - **Launch gates (out-of-repo):** code-signing certs, one signed release run, one live paid T1 mission. - No release tag exists yet. -_Resolved this session: repo went public; CI runner billing is moot (Actions is free for public repos -— the full matrix ran green in ~4 min). The TDD-gate hook is **not** path-blind as previously recorded -here: it is content-aware and counts `#[test]` additions. The real failure was a **stale local `main`** -making the gate diff against an old baseline; keep it synced (`git branch -f main origin/main`)._ +_**Release tagging is deliberately deferred**, decided 2026-08-09 — not an oversight, and it should +stop surfacing as an audit finding. `release.yml` fires on any `v*` tag and publishes a **public** +GitHub Release with bundles attached; the only repo secret configured is `EMBARGO_GUARD_CONFIG`, so +none of the seven signing secrets exist and a tag today would publish **unsigned** installers +(SmartScreen / Gatekeeper friction). The first release should be a signed one. Revisit once certs are +purchased._ + +_Resolved 2026-07-25: repo went public; CI runner billing is moot (Actions is free for public repos). +The TDD-gate hook is **not** path-blind: it is content-aware and counts `#[test]` additions; the real +failure was a **stale local `main`**. Resolved 2026-08-09: branch protection, the digest rewrite, and +the branch/worktree pruning below._ **Next steps.** -1. **Enable branch protection on `main`** with `embargo guard` + `cargo test` as required checks — - without it the guard is advisory on the server side. -2. Run `git config core.hooksPath "$(pwd)/.githooks"` (**absolute** — see the 2026-07-26 entry) in - every other clone; it is per-clone config, so it does **not** travel with the merge. Worktrees of - this clone are already covered. -3. Resume the roadmap: **Local-Tracker Phase 2** (keystone + auth foundation), then embedding swarms. +1. **Run the interactive smoke for PR #49** (dev + packaged) and record PASS/FAIL in + `spikes/SPIKE-RESULTS.md`. Repo is parked on `feat/plugin-runtime` with the build pre-warmed. + Note: free port **8080** first (a `java` process holds it) or the Audience health probe is + inconclusive, and Docker must be up for the managed lifecycle. +2. **File the GitHub Support ticket** to GC unreachable objects — the last step of the digest removal. +3. Run `git config core.hooksPath "/.githooks"` (**absolute**) in every other clone; it is + per-clone config and does **not** travel with a merge. +4. Resume the roadmap: **Local-Tracker Phase 2** (keystone + auth foundation), then the design pass. ## Session log +### 2026-08-09 — Work audit, then worked the findings + +Ran a full work-audit after ~10 days idle and executed the results rather than just filing them. + +- **Branch protection on `main` (was next-step #1 for two weeks).** `embargo guard` + + `cargo test (workspace)` required, strict, **enforced for admins**, force-push and deletion off, + conversation resolution required. The `embargo` CI job now actually *enforces* instead of reporting. +- **Superseded guard digests removed from public history.** The earlier framing treated this as the + same 193-commit rewrite that was ruled out for the embargoed name. It wasn't: the digests entered at + `6016495` (#45) / `eb832bd` (#46), so only **9 commits** were at or after that point, and the repo + had **0 forks / 0 stars / 0 watchers**. Scoped `git filter-repo --path .embargo-guard.json + --invert-paths --refs 6016495~1..main` in a throwaway clone; force-pushed; protection restored. + Verified: 208 commits before and after, **199 SHAs preserved**, HEAD tree byte-identical + (`b8ad776`), the 4 commits that carried the file differ only by it, the other 5 are unchanged, + and CI is green on the rewritten head. + - **First attempt was wrong and was discarded.** An unscoped `filter-repo` rewrote **177 of 208** + commits back to the repo's second day, because `fast-export` strips GPG signatures and 47 merge + commits are GitHub-signed — changing those cascades to every descendant. Caught by comparing the + old and new SHA sets before pushing anything. The `--refs` range fixed it; 43 of 47 signatures + survive (the 4 lost are the rewritten merges, unavoidable). + - **Still outstanding:** GitHub keeps unreachable objects. `6016495`, `eb832bd` and blob `ee0ed06` + are **still served by the API**. Needs a Support ticket. Recorded as a gap above. +- **The plugin-runtime swarm was never stranded — it finished.** `feat/plugin-runtime` already + contained Lane V (`dc37806`) and Lane A (`e3a688f`) as ancestors plus Lane S integration, and merges + into current `main` **conflict-free**. Re-ran all three gates against today's `main`, not trusting + the 3-week-old record: `cargo test` **28 passed**, `npm test` **133 passed** (18 files), + `npm run check` **0 errors / 0 warnings** (352 files) — identical to what Lane S recorded. + Opened as **draft PR #49**. +- **Rescued `spikes/SPIKE-RESULTS-app-plugins.md`.** It existed **only as an untracked file inside a + worktree** — in no commit, on no branch — while `docs/SWARM-HANDOFF-plugin-runtime.md` on `main` + cited it as a source. It is the provenance for #49's park-off-screen design (`hide()`/`show()` + forces a repaint/reload), the async-command deadlock fix, and the verbatim webview API. Committed + onto #49. **It also contradicts main:** it records P3 as **LEANING GO**, not GO, with packaged + gates 2/4 and **Gate 5 (lifecycle / no orphans)** open. Gate 5 had fallen through the gap entirely + and is now in the smoke checklist. +- **Pruned.** Deleted 4 redundant branches after verifying with `git cherry` that every patch was + already upstream (`feat/oracle-freeze`, `feat/oracle-hash-persist`, `docs/status-refresh`, + `docs/status-embargo-remediation` — the last two were also the local refs keeping the removed digest + blobs alive). Removed the 2 agent worktrees whose commits are contained in #49, reclaiming ~1.8 GB. + The two P3/P4 spike worktrees were **kept deliberately** until the smoke passes — they are the only + working reproduction if it fails. +- **Release tagging deferred**, with the reasoning recorded above so it stops resurfacing. + ### 2026-07-26 — Correction: the guard was fail-open in every worktree (PR #48) - **Found while sweeping for leftovers.** `core.hooksPath` was set to the *relative* `.githooks`, which git resolves against **each worktree's own root**. All four worktrees sit on branches that From a7200733359fbe52b5b033f4fd4cc9c7c64c9286 Mon Sep 17 00:00:00 2001 From: Alex Barclay Date: Sun, 9 Aug 2026 13:08:00 -0600 Subject: [PATCH 2/3] docs(status): link next steps to the tracking issues (#51-#59) --- docs/STATUS.md | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 1ef3c2e..bb7256a 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -71,15 +71,23 @@ The TDD-gate hook is **not** path-blind: it is content-aware and counts `#[test] failure was a **stale local `main`**. Resolved 2026-08-09: branch protection, the digest rewrite, and the branch/worktree pruning below._ -**Next steps.** -1. **Run the interactive smoke for PR #49** (dev + packaged) and record PASS/FAIL in +**Next steps.** _All open work is tracked as GitHub issues (#51–#59); this list is the ordering._ +1. **#51 — Run the interactive smoke for PR #49** (dev + packaged) and record PASS/FAIL in `spikes/SPIKE-RESULTS.md`. Repo is parked on `feat/plugin-runtime` with the build pre-warmed. Note: free port **8080** first (a `java` process holds it) or the Audience health probe is inconclusive, and Docker must be up for the managed lifecycle. -2. **File the GitHub Support ticket** to GC unreachable objects — the last step of the digest removal. -3. Run `git config core.hooksPath "/.githooks"` (**absolute**) in every other clone; it is +2. **#52 — File the GitHub Support ticket** to GC unreachable objects. The last step of the digest + removal, and the only one that closes the residual exposure. +3. **#54 — Retire the spike branches/worktrees**, but *only after* #49 merges — they are the sole + working reproduction if the smoke fails. +4. Run `git config core.hooksPath "/.githooks"` (**absolute**) in every other clone; it is per-clone config and does **not** travel with a merge. -4. Resume the roadmap: **Local-Tracker Phase 2** (keystone + auth foundation), then the design pass. +5. Resume the roadmap: **#55 Local-Tracker Phase 2** (keystone + auth foundation), then **#56** the + design pass, then **#57** Remote Control. + +_Also open: **#53** (`.embargo-guard.local.json` not gitignored on `feat/plugin-runtime` — the guard +scans for plaintext, so it would not block committing its own salts+digests), **#58** (signing certs → +first signed release), **#59** (README screenshot)._ ## Session log From 9753063f36296c87864c32114e609f39cd501c75 Mon Sep 17 00:00:00 2001 From: Alex Barclay Date: Sun, 9 Aug 2026 13:09:54 -0600 Subject: [PATCH 3/3] docs(handoff): work-audit execution pass; link from STATUS --- docs/STATUS.md | 4 + .../f168e21d-9124-4dbd-b962-11f5116d47ab.md | 100 ++++++++++++++++++ 2 files changed, 104 insertions(+) create mode 100644 docs/handoffs/f168e21d-9124-4dbd-b962-11f5116d47ab.md diff --git a/docs/STATUS.md b/docs/STATUS.md index bb7256a..f71fcea 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -133,6 +133,10 @@ Ran a full work-audit after ~10 days idle and executed the results rather than j The two P3/P4 spike worktrees were **kept deliberately** until the smoke passes — they are the only working reproduction if it fails. - **Release tagging deferred**, with the reasoning recorded above so it stops resurfacing. +- **All outstanding work filed as issues #51–#59.** Session handoff brief: + [`docs/handoffs/f168e21d-9124-4dbd-b962-11f5116d47ab.md`](handoffs/f168e21d-9124-4dbd-b962-11f5116d47ab.md) + — includes the history-rewrite trap (scope `filter-repo` with `--refs`, or signature-stripping + cascades it to 177 of 208 commits) and the unresolved questions carried out of this session. ### 2026-07-26 — Correction: the guard was fail-open in every worktree (PR #48) - **Found while sweeping for leftovers.** `core.hooksPath` was set to the *relative* `.githooks`, diff --git a/docs/handoffs/f168e21d-9124-4dbd-b962-11f5116d47ab.md b/docs/handoffs/f168e21d-9124-4dbd-b962-11f5116d47ab.md new file mode 100644 index 0000000..664ebad --- /dev/null +++ b/docs/handoffs/f168e21d-9124-4dbd-b962-11f5116d47ab.md @@ -0,0 +1,100 @@ +# Handoff — Command Center work-audit execution pass + +**Written:** 2026-08-09 · **Branch:** `feat/plugin-runtime` (main working copy is parked here on purpose) · **Session:** `f168e21d-9124-4dbd-b962-11f5116d47ab` + +## ⏳ Operations in flight + +**1. CI on PR #50 (the branch this brief is committed to).** +- **Where:** `gh pr checks 50` +- **Done when:** `embargo guard` and `cargo test (workspace)` both `SUCCESS`. Those two are the only + *required* checks; the three `tauri build ()` jobs are advisory and take far longer. +- **On success:** `gh pr merge 50 --merge`. Auto-merge is **not** enabled on this repo + (`enablePullRequestAutoMerge` is refused), so it must be merged manually. +- **On failure:** unexpected — #50 is docs plus a one-line `package.json` version bump. Read the + failing job before changing anything. + +**2. Nothing is running locally.** No background build, test, or deploy. The Tauri debug build was +pre-warmed to completion (exit 0). + +## Goal + +Work through the findings of a work-audit on this repo rather than just filing them. Seven items +were identified and all seven were worked. What remains is one GUI-dependent verification and one +action that requires the account owner. + +## State + +- **`main` = `c86cd3b`** — rewritten history (see below), CI green, **branch-protected** + (`embargo guard` + `cargo test (workspace)` required, enforced for admins, force-push off). +- **PR #49** (`feat/plugin-runtime`, **draft**) — cockpit plugin runtime, 8 commits, 28 files. + Merges conflict-free. All three automated gates re-verified against current `main` on 2026-08-09: + `cargo test` 28 passed · `npm test` 133 passed (18 files) · `npm run check` 0 errors/0 warnings + (352 files). **Blocked only on the interactive smoke.** +- **PR #50** (`docs/status-2026-08-09`) — STATUS.md refresh + `cockpit/ui/package.json` `0.0.0`→`0.1.0`. + Required checks were green before the last push; re-running. +- **Issues #51–#59** — all outstanding work is filed. #51 (smoke) and #52 (Support ticket) are the + two that matter now. +- **Working tree:** clean. Main copy is checked out on `feat/plugin-runtime` **deliberately**, with + the sidecar built and the Tauri debug build pre-warmed, so the smoke can start immediately. + `git checkout main` to undo. +- **Worktrees:** two remain, both P3/P4 spikes, **kept on purpose** until the smoke passes — they are + the only working reproduction if it fails. `agent-a709…` has an uncommitted throwaway `App.svelte` + harness. Retire via #54 *after* #49 merges. + +### History rewrite — read before touching git +`main` was rewritten on 2026-08-09 to drop the superseded embargo-guard digests: scoped +`git filter-repo --path .embargo-guard.json --invert-paths --refs 6016495~1..main`, force-pushed. +**9 commits rewritten, 199 of 208 SHAs preserved, HEAD tree byte-identical.** Any clone or worktree +that predates this and contains commits after `6016495` needs re-syncing (`git fetch && git reset +--hard origin/main`). A pre-rewrite backup bundle exists in the session scratchpad +(`command-center-backup-pre-rewrite.bundle`) — **it contains the removed digests**; delete it once +you're satisfied. + +**Trap for anyone repeating this:** an unscoped `filter-repo` rewrites **177 of 208** commits, back +to the repo's second day, because `fast-export` strips GPG signatures and 47 merge commits are +GitHub-signed — changing those cascades to every descendant. Always scope with `--refs ` and +diff the old/new SHA sets *before* pushing. + +## Successor autonomy + +**UNRESOLVED — see Open questions.** Not defaulted. The user requested this handoff while ending the +session and did not state how much latitude a successor has. Confirm before acting on anything +beyond the read-only checks above. + +## Successor's next action + +1. **Confirm autonomy** (see Open questions) — this comes before the work. +2. `gh pr checks 50`; if the two required checks are green, `gh pr merge 50 --merge`. +3. Then the real work is **#51, the interactive smoke** — but it needs a watched GUI session, so it + is the *operator's* action, not an agent's. An agent cannot close it. + +## Live decisions (settled) + +- **Release tagging is deliberately deferred** pending code-signing certs. Not an oversight; recorded + in STATUS.md and #58 so it stops resurfacing in audits. A `v*` tag today would publish **unsigned** + installers to a public repo (only `EMBARGO_GUARD_CONFIG` is configured; none of the seven signing + secrets exist). +- **The digest history rewrite was chosen over leaving it**, and executed. +- **The P3 spike results doc was rescued onto #49** rather than landed separately to main. +- **The two P3/P4 spike worktrees stay** until the smoke passes. +- **P3 was never actually "GO."** `docs/SWARM-HANDOFF-plugin-runtime.md` says P3 and P4 were "both + GO"; the rescued `spikes/SPIKE-RESULTS-app-plugins.md` records P3 as **LEANING GO** with packaged + gates 2/4 and **Gate 5 (lifecycle / no orphans)** open. Gate 5 — quit the cockpit, confirm + `docker ps` is clean — had fallen through entirely and is now item 9 of #51. Treat it as a real + merge blocker, not a formality. + +## ⚠️ Open questions (unresolved — do NOT settle implicitly) + +1. **Successor autonomy** — `autonomous` / `checkpoint-each` / `discuss-first`? Never stated. + Proceeding assumption, **unconfirmed**: treat as `discuss-first`, since the remaining work is a + GUI smoke the operator must run and an account-owner Support ticket. Confirm first. +2. **Should the swarm handoff's "both GO" line be corrected in place?** The contradiction is recorded + in STATUS.md and #49, but `docs/SWARM-HANDOFF-plugin-runtime.md` on `main` still overstates P3. + Offered during the session; the user chose to commit the rescued doc without amending the handoff. + Worth revisiting once #49 merges. +3. **#53 — fix the `.embargo-guard.local.json` gitignore gap on `feat/plugin-runtime`?** Flagged and + filed, explicitly **not** fixed (scope discipline). One line, or merge `main` into the branch. + The user was asked and had not answered when the session ended. +4. **Should the guard also refuse its own config file by name**, independent of content? Raised in + #53. The guard scans for token *plaintext*, so it would not block a commit of its own + salts+digests — the same class of bug #47 fixed. Unanswered design question.