Activity

1. egdev6

   added this to the B01: CI guardrails and first release readiness milestone on Oct 8, 2026
2. egdev6

   added

   type:choreMaintenance, tooling, or automation changeMaintenance, tooling, or automation change

   status:approvedApproved for implementationApproved for implementation

   on Oct 8, 2026
3. egdev6

   added 6 commits that reference this issue on Oct 9, 2026

   test(bootstrap): add pure project-sync renderer

   ...

   f35fc96

   test(bootstrap): add inert project-sync runtime asset

   ...

   226f335

   test(bootstrap): guard project-sync pagination and events

   ...

   3ed43ca

   chore(bootstrap): guard fixed-template file collisions

   ...

   f9a9ccb

   chore(bootstrap): extract stateless command transport

   ...

   b6c5717

   chore(bootstrap): share native CLI test fixtures

   ...

   80feb7b
4. egdev6 commented on Oct 10, 2026

   

   egdev6

   on Oct 10, 2026

   OwnerAuthor

   More actions

   ODD reconciliation: complete package, migration and release readiness

   • Issue: Verify package completeness, migration, and release readiness #15 (B01-03), dependencies Pin CI tools and workflows to verified immutable SHAs with least privilege #13 and Verify regression fixtures for the secret and workflow-lint gates #14.
   • Planning revision: bootstrap-odd-reconcile-v2, published only after explicit approval.
   • Supersedes historical progress observations and supplies the current ODD; preserves the original acceptance criteria.
   • Goal: verify the complete approved package from an immutable delivered commit, document the human SemVer/migration decision and assess release readiness.

   Full scope and boundaries

   Include every newly approved skill/asset and the associated behavior, validation, migration and documentation commitments. Packaging inert assets alone does not establish supported activation or fulfill those commitments.
   The injected plan API is a separate feature candidate, not a new package prerequisite. Its separation does not discard existing lifecycle, project-sync or branch-protection closure obligations.
   Exclude CD changes, live credentials/secrets, blanket Projects/token/sandbox/agent-load claims, automatic label migration, resource deletion and implementation/release authority granted merely by this plan.

   Retained acceptance criteria

   • The package from an immutable commit contains all newly approved assets and skills.
   • SemVer migration review documents the decision and open risks.
   • Current auto-publish behavior is documented honestly; any future version/push approval includes its resulting auto-release or gates the publishing change first.
   • No CD change is made in this unit.

   Current delivery versus remaining work

   Area	Current evidence	Remaining acceptance
   Approved advisory skills, safety guidance, lifecycle/project-sync assets and offline tests	Merged delivery series #37–#48; current source tree	Complete inventory and verification of promised behavior, not just package presence
   Native command transport and fixtures	#47 transport and #48 fixture extraction are merged PRs. The existing minimal-config native CLI test uses the shared helpers; one new fixture guard also passes	Enabled-family/native-discovery characterization is not proven by the historical suite alone; no public plan API is delivered
   Package and platforms	Main 80feb7b; 64 regular source files; main CI, Node 20.20.2, Ubuntu 182 passed, macOS/Windows 180 passed +2 inherited skips	Bind final package contents/security evidence to the accepted immutable candidate after all in-scope work
   Lifecycle	Offline workflow tests delivered	Defaults/canonical-label behavior; authorization-hash/preflight behavior; opt-out and legacy README behavior remain explicit completion obligations
   Project sync	Offline renderer/runtime/guard cases delivered	Fifteen remaining donor scenarios and the normalized adapter path; preserve the complete checklist during scoping rather than dropping tests
   Activation and closure	Default-on/deferred policies are design decisions, not schema/runtime activation	Validate wiring, migration and bounded deferred behavior; decide branch-protection closure boundary against #17 explicitly
   SemVer/release	Package version remains 1.1.0. Actual main logs preserve its existing tag and skip existing GitHub Release creation	Human compatibility/migration decision and open risks; future release/version remains separately authorized

   ODD phases

   Phase	Result	Validation	Exit condition
   1. Acceptance inventory	Map every approved asset/skill and retained behavior obligation to delivered source, evidence or an explicit blocker; reconcile #13/#14	Compare original bodies, immutable source and current evidence	Human accepts a complete closure checklist, including boundary with #17/#18; no silent deferral or reduced assets-only scope
   2. Complete in-scope delivery	Individually authorized cohesive units for remaining behavior/wiring/docs	Functional tests and applicable test-first evidence; complete RAM measurement before any write; independent verification by risk	Every retained obligation satisfied or a separately approved scope revision recorded, never disguised as completed
   3. Immutable package and migration review	Final package manifest, security evidence, compatibility decision and honest auto-publish explanation	Verify package bytes against the chosen immutable source and all declared skills/assets; review risks/platform limits	Retained package/migration criteria accepted by the maintainer
   4. Readiness reconciliation	Publish evidence of outcomes and unresolved risks	Recheck dependencies, criteria and final CI	Human decides issue/block closure separately; release remains a later action

   No release is a prerequisite for closing B01. A release candidate is recommended, not mandated; version/type stay undecided until human SemVer review. A bootstrap apply hash is not release consent.
   A complete unit must fit 400 additions+deletions before writing anywhere, including helpers/tests/docs and moves counted twice. If not, stop without trimming assertions, compressing code or hiding deferred payloads.

   Coordination

   This planning review neither assigns nor starts work. Recheck current assignees, claims and PR before explicit authorization for a unit. Preserve existing issue bodies/comments and evidence. The shared roadmap will link this verified review; until dependencies and closure scope are accepted, do not announce #15 as ready or complete.
5. egdev6 commented on Oct 10, 2026

   

   egdev6

   on Oct 10, 2026

   OwnerAuthor

   More actions

   ODD review: offline branch protection and explicit workflow migration

   Issue: #15, dependencies #13 and #14.
   Supersedes the v2 ODD review for current planning and closure boundaries, retaining every original acceptance criterion and outstanding behavior commitment. Publication records the approved planning decision, not implementation or closure.

   Complete scope and decisions

   Verify the complete approved package from an immutable delivered commit and document human SemVer/migration decisions and open risks.
   #15 owns the branch-protection contract, product implementation and simulated/offline tests. #17 owns actual auth/apply verification in an approved sandbox. No live sandbox run is a prerequisite to close B01.
   Retain conditional default-on for lifecycle/project-sync workflows, with explicit opt-out, requirements and legacy compatibility review before implementation. Do not weaken stronger protection or bypass per-module decisions/final-SHA authorization.
   The plan API #49 remains separate and is not a prerequisite for #15. Exclude CD changes, credential creation, live target mutations, automatic legacy migration/deletion and release authority.

   Retained acceptance criteria

   • The package from an immutable commit contains all newly approved assets and skills.
   • SemVer migration review documents the decision and its open risks.
   • Current auto-publish behavior is documented honestly; future version/push approval includes its resulting auto-release or gates publishing first.
   • No CD change is made in this unit.

   Delivered foundations and remaining obligations

   • Three declared skills, workflow assets, pure renderer, functional offline VM tests and command transport/fixtures are delivered. Packaging inert assets does not establish activation.
   • Reuse delivered file hashes, authorization kernel, symlink preflight and fixed-template collision guards. They are not missing work.
   • Complete lifecycle defaults/canonical-label validation, workflow-specific source/destination hashing and preflight binding, opt-out preservation and README/example agreement.
   • Complete the fifteen outstanding project-sync scenarios and normalized-manifest adapter; retain delivered S13–S17 offline coverage. Add schema/normalization, discovery, plan/hash/install and bounded deferred behavior without silently dropping essential tests.
   • Complete branch-protection discovery/desired-state contract, plan/apply implementation and offline status/error/preservation tests. Stronger observed protection must remain unless an exact reviewed weakening diff receives separate approval.
   • New runtime fields remain invalid until their complete owned implementation is delivered; no accepted-but-unused flag scaffolding.

   ODD and verification

   Phase	Outcome	Exit condition
   Contract and migration	Specify activation requirements, opt-out, legacy manifest changes and branch-protection semantics	Human accepts complete compatibility/migration contract before Source implementation; no version selected or changed automatically
   Bounded delivery	Cohesive, explicitly authorized runtime units with all tests/docs	Whole proposed bodies measured in RAM before writing anywhere: at most 400 additions+deletions, including helpers/tests/docs and moves twice; stop on overflow without compression or omissions
   Final immutable candidate	Package contents, source-byte identity, security/platform evidence and migration record	All retained behavior and original criteria reviewed and accepted, not assets-only
   Readiness	Reconcile outcomes and outstanding risks	Human decides issue/block closure separately; release is later and not a closure prerequisite

   Use meaningful test-first evidence where applicable and independent verification by risk. Offline tests do not prove stored credentials, live Projects, sandbox security, agent loading or LLM behavior.
   No assignment, implementation, issue closure, version bump, tag/release, workflow run or cleanup is authorized by this review. Revalidate claims and related PR before any separately authorized start.
6. egdev6

   added 6 commits that reference this issue on Oct 10, 2026

   refactor(bootstrap): share fixed-template descriptors and rendering

   ...

   806a042

   fix(tests): canonicalize native fixture temporary roots

   ...

   c31fc37

   fix(tests): bind legacy oracle to Git repository root

   ...

   17ee875

   fix(templates): bind native authorization to fixed-template bytes

   ...

   ca3b038

   fix(tests): canonicalize native fixture temporary roots

   ...

   0cbdc0b

   fix(tests): bind legacy oracle to Git repository root

   ...

   b743013
7. egdev6

   closed this as completedin #53on Oct 10, 2026
8. egdev6

   reopened this on Oct 10, 2026
9. egdev6

   added a commit that references this issue on Oct 11, 2026

   refactor(templates): share native byte capture kernel

   ...

   65927d8