Correct the pane push finding and record the test-e2e flow 1 setup

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

BURNIN.md

@@ -260,12 +260,22 @@ through the JSONL watcher.
 
 ### `git push` from a pane will succeed, and no Orchestra setting stops it
 
-Panes run as `kami`, the same user as the worker, and `kami` has
-`credential.helper store` set globally. An agent in a herdr pane therefore
-inherits a usable Gitea credential over HTTPS. `worker.env` is irrelevant to
-this. Real isolation needs panes under a different unix user, or a credential
-store the pane cannot read. Expect `git push --dry-run` to succeed and record
-that as an operator-policy gap, not a code defect.
+Corrected 21:45. The mechanism is SSH, not HTTPS. HTTPS has no stored
+credential on workpc, where `git push` over `https://` fails with `could not
+read Username`. Pushing works over `ssh://git@gitea.kvmx.ru:2222` using kami's
+default RSA identity, which Gitea lists as the key named `workpc`. It carries no
+passphrase, so no agent is needed.
+
+That identity is what lets the *worker* push, and panes run as the same user
+with the same home directory, so an agent inherits it. `worker.env` is
+irrelevant to this. Real isolation needs panes under a different unix user.
+Expect `git push --dry-run` to succeed from a pane, and record it as an
+operator-policy gap rather than a code defect.
+
+The worker inherits ambient Git credentials by design: `git()` in
+`cmd/orchestra-worker/main.go` runs `exec.CommandContext` with no environment of
+its own. There is no separate credential path for the worker to hold something
+the pane does not.
 
 ### The agent surface is currently unauthenticated
 
@@ -290,3 +300,45 @@ unset.
 - `ORCHESTRA_REVIEW_ACTORS` is unset, which `human.Trust` reads as "anyone not
   explicitly ignored". Flow 4 will accept a task-moving comment from any Gitea
   actor. Set it to `kami`.
+
+## Flow 1 setup, 2026-08-26 21:45
+
+Target: `kami/test-e2e` on Gitea, a throwaway repo, rather than `correx`.
+
+Done:
+
+- **Ingest switched.** `ORCHESTRA_GITEA_REPO=test-e2e` in the coordinator `.env`
+  (previous file kept as `.env.pre-burnin-20260826`), container recreated, still
+  reporting `6f9300b`. The project id must equal the repo name, because
+  `main.go` sets `Project: os.Getenv("ORCHESTRA_GITEA_REPO")`. `test-e2e`
+  already exists in `config.jsonc` with `machine_affinity: ["workpc"]`.
+- **Durable repo on workpc.** Bare clone at
+  `/home/kami/orchestra/repos/test-e2e.git`, worktree root
+  `/home/kami/orchestra/worktrees/test-e2e`. Origin points at
+  `ssh://git@gitea.kvmx.ru:2222/kami/test-e2e.git`, and `git push --dry-run`
+  reports `Everything up-to-date`. The old `/tmp` paths did not survive the
+  reboot and must not come back.
+
+Remaining, needs root:
+
+```jsonc
+// /etc/orchestra/worker-projects.json
+{
+  "test-e2e": {
+    "repo": "/home/kami/orchestra/repos/test-e2e.git",
+    "worktree_root": "/home/kami/orchestra/worktrees/test-e2e",
+    "remote": "origin"
+  }
+}
+```
+
+Then `sudo systemctl restart orchestra-worker`.
+
+Store state, checked before the first run: 30 tasks, all `test-e2e`, with 23
+blocked, 6 completed and 1 failed. All are July leftovers and none holds a
+lease. The coordinator has run `ResumeAnsweredBlockers` every second for hours
+without resuming any of them, so they are inert rather than merely quiet. The
+July stuck task `06FT6CKD9Y98AZRX6X8K3QXFZG` is now `failed`.
+
+A stale branch `orchestra/scratch/oc-06ftgkjadcd2hwjn2zwjen90q4` exists on the
+remote from an earlier run. Harmless, but it is not from this burn-in.