diff --git a/HANDOFF-2026-08-28-burnin-4.md b/HANDOFF-2026-08-28-burnin-4.md new file mode 100644 index 0000000..e8449dd --- /dev/null +++ b/HANDOFF-2026-08-28-burnin-4.md @@ -0,0 +1,193 @@ +# Handoff: the chain is live-proven, run 5 is mid-review + +Written 2026-08-28, 02:20 local (22:20 UTC). Read with `BURNIN.md` (the ledger, +current through F40), `HANDOFF-2026-08-27-burnin-3.md` (the session before +this one), `AUDIT.md` and `CLAUDE.md`. + +Everything below was observed live unless it says otherwise. + +## The headline + +Run 5 live-proved the whole workflow this project exists to build. Frame to +review, four autonomous rotations, sealed artifacts, and an operator correction +that reached shipped code. + +```text +frame -> research -> plan -> implement -> review +``` + +The render order in the implement launch is the load-bearing proof: + +```text +## Goal +## Acceptance +## Current human decisions <- the correction +## Current phase implement +## Repository rules +## Verified git state +## Accepted research +## Accepted plan +## Continuity from the previous session +### Dead ends already tried +``` + +Human correction above accepted plan, above accepted research, stale continuity +below all of them. The original failure mode is mechanically gone from this +path. A new session no longer follows whatever the handoff liked instead of the +latest human instruction. + +The correction went from issue comment to live plan pane in three seconds, and +was delivered exactly once. It was cited in `plan.json` as a human decision. It +appears in the shipped script as snake_case JSON keys, with the default text +path untouched. + +## Deployed state + +| Half | Revision | Evidence | +|---|---|---| +| Coordinator, homesrv container | `bcaf0cc` | image `a5683b1869ae`, `/readyz` 200, embedded stamp checked | +| Worker, workpc systemd | **operator to install** | staged, see below | + +Branch `webui-and-audit-reconciliation`, HEAD `bcaf0cc`. + +```text +revision bcaf0cc2851734f97105beb1cd608fda4e271964 +sha256 7f2bee3d3c45a347d2f747b1aed624b3e45f8d255a47aaf710daad6fd10bc5d3 +staged /home/kami/orchestra-deploy/orchestra-worker.bcaf0cc +``` + +```bash +sudo install -m 0755 /home/kami/orchestra-deploy/orchestra-worker.bcaf0cc /usr/local/bin/orchestra-worker +sudo systemctl restart orchestra-worker +``` + +**Confirm the installed worker checksum before believing anything else here.** +Half of tonight's diagnosis time went to reasoning about code that was not the +code running. + +## Run 5, where it stands + +Task `06G4A4F0TFXKZHJE48N05XN1HG`, issue `kami/test-e2e#5`, `workpc-claude`. + +It is parked in `review`. The review agent finished at 02:12 and stopped, +correctly, because nothing had told it how to finish. That is F40, fixed in +`bcaf0cc` but not deliverable to a session that already has its brief. + +The recovery is the lease expiring at `22:36:06Z` (02:36 local). The task +requeues, review relaunches with the corrected brief, and the agent can write +`.orchestra/done`. + +**Do not press anything into that pane.** The relaunch is the proof. + +Remaining chain after that: + +```text +.orchestra/done -> worker confirms idle -> finalise -> task PR -> human review -> merge -> completed +``` + +The implemented script is at +`/tmp/test-e2e-worktrees/06G4A4F0TFXKZHJE48N05XN1HG/scripts/orchestra_worktree_report.sh` +and satisfies the acceptance criteria and the correction. + +## What this session found + +Twelve defects, F29 through F40, each reachable only after the previous fix. +Tests passed throughout. Running the system is the only thing that surfaced any +of them. + +```text +F28 CLOSED, live-proven both directions +F29 fixed efd0a5e, DEPLOYED, live-proven operator could not act on a leased task +F30 fixed 2dc90bd, DEPLOYED, live-proven unpushed release pinned the only slot +F31 fixed 6523002, DEPLOYED, live-proven handoff action held to half its budget +F32 fixed 92adf04, DEPLOYED, live-proven empty tmux server's reply unrecognised +F33 fixed 32220d9, DEPLOYED, live-proven launch confirmed in 7ms against an unrendered editor +F34 fixed 92f32d6, DEPLOYED, live-proven first renewal exempt, free period for a dead launch +F35 fixed 92f32d6, DEPLOYED, untested live no way to re-poke a pane +F36 fixed b9ca365, DEPLOYED, live-proven validator refused the adapter's own reason +F37 fixed cb7782d, DEPLOYED, live-proven handoff carried the write Orchestra asked for +F38 fixed 0bd86e2, DEPLOYED, live-proven brief named the artifact, never its schema +F39 fixed 0bd86e2, DEPLOYED, live-proven local refusals reached nobody +F40 fixed bcaf0cc, worker install pending terminal phase never named .orchestra/done +``` + +Older entries, unchanged: + +```text +F15 closed by detection, transport fix pending live proof +F16 closed +F17 fixed +F18 open observability, now the highest-value open item +F19 fixed +F20 live-proven by run 5's correction +F21 exercised throughout +F22 exercised throughout +F23 live-proven by run 5's correction +F24 open correctness, dormant on current topology +F25 live-proven +F26 live-proven +F27 live-proven +``` + +### The pattern, worth carrying forward + +Every defect tonight was a contract with two halves that named different things. + +- F31: producer joined two lines, validator budgeted one +- F36: adapter emitted `phase_changed`, validator's list never gained it +- F37: prompt asked for a file, validator rejected the command that wrote it +- F38: brief named an artifact, never its schema +- F40: worker watched for `.orchestra/done`, no brief ever named it + +The durable fix shape is to ask the other half rather than restate it, as +`continuity.IsCircularCommand` does. The alternative is to assert the agreement +in a test, as `TestPhaseSealSchemasDecode` and +`TestEveryReasonTheAdapterProducesIsAcceptedByTheValidator` do. Prefer either to +another matching constant. + +F39 is the one that made the rest expensive. A local refusal recorded only in +worker health is a silent stall, and worker health holds one slot (F18). + +## Next session, in order + +1. Install the worker binary above, then confirm the checksum. +2. Let run 5's lease expire and watch the review relaunch. Do not intervene. + Expect `.orchestra/done`, an idle confirmation, then finalisation. +3. If it finalises, run 5 is a complete conformance proof. Record it and treat + remaining work as hardening rather than redesign. +4. F18 is now the highest-value open item. One error slot on the worker cost + real diagnosis time three times tonight. It is also what turns any local + refusal into a silent stall. +5. F35's `resubmit` action is deployed but never exercised live. The next stuck + pane is its proof. + +## Things that will bite + +- **Another session owns 22 uncommitted paths**, including `AUDIT.md`, + `deploy/build.sh`, `web/`, and new untracked `final/`, `iterations/`, + `orchestra-ui-spec.md`, `README.md`. Commit by path. Never `git add -A`. +- **Never `docker compose build`.** The build context is + `/home/kami/apps/orchestra`, the shared dirty checkout. Build from a detached + worktree, as every deploy in this session did: + `git worktree add --detach /tmp/orchestra-build- `, then + `docker build --build-arg BUILD_REVISION=... -f $T/Dockerfile.api -t orchestra-web-ui-orchestra-api $T`, + then `docker compose up -d --no-deps orchestra-api`. +- **`workpc-claude` now declares a `claude` capability** in the deployed + `config.jsonc`, added this session so an operator test can pin placement. + A task with `capability: ["claude"]` lands there deterministically. +- **The worker state file is a cache, not truth**, and editing it needs the + worker stopped. Backups from tonight are in + `/var/lib/orchestra/worker-state/`. +- **`/tmp` is tmpfs with a 10-day sweep.** Check `/tmp/test-e2e` and + `/tmp/test-e2e-worktrees` exist before every run. +- **Gitea writes need the token expanded on homesrv**: + `/usr/bin/ssh kami@192.168.1.104 'TOKEN=$(docker exec orchestra-api printenv ORCHESTRA_GITEA_TOKEN); curl -H "Authorization: token $TOKEN" ...'`. + Base `https://gitea.kvmx.ru`, owner `kami`, repo `test-e2e`. +- **The web surface is cookie-only.** No bearer token exists for it, so any + `/v1/ui/*` call needs a login through `POST /v1/ui/session`. +- **This machine is workpc**, `hostname` is `bugmachine`. homesrv is + `kami@192.168.1.104` with `/usr/bin/ssh`, not the `ssh` on PATH. +- **Worker capacity is 1 per harness.** One stuck task blocks the harness + entirely, which is what F30 did for an hour. +- **Three queued `correx` tasks will never lease.** No worker declares that + project.