Record run 1: three bugs fixed, five open and classified

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

BURNIN.md

@@ -342,3 +342,72 @@ July stuck task `06FT6CKD9Y98AZRX6X8K3QXFZG` is now `failed`.
 
 A stale branch `orchestra/scratch/oc-06ftgkjadcd2hwjn2zwjen90q4` exists on the
 remote from an earlier run. Harmless, but it is not from this burn-in.
+
+## Run 1: task 06G3YR34117MAYT6KEAC9RJHD0, 2026-08-26
+
+Evidence ledger:
+
+```
+harness         workpc-opencode (herdr backend)
+task            06G3YR34117MAYT6KEAC9RJHD0
+source          gitea:test-e2e/1  "Add a --version flag to the healthcheck script"
+attempts        3 leases: two nacked, third launched
+pane            wN:p1, agent oc-06g3yr34117mayt6keac9rjhd0
+agent session   ses_fc096de31ffelZeMngQEyBTxfh
+worktree        /tmp/test-e2e-worktrees/06G3YR34117MAYT6KEAC9RJHD0
+branch          orchestra/06G3YR34117MAYT6KEAC9RJHD0
+head at launch  5e6c4783d4213a934dc486160b888b6014bc2d03
+launch context  .orchestra/launch.md, 2138 bytes
+phase           frame
+decisions       none
+```
+
+### What worked
+
+- **The launch context is right.** Authority order, the ambiguity ladder, the
+  phase brief with `frame: ... Do not change code`, `Current human decisions:
+  None recorded`, and a verified git state with worktree, branch and head.
+- **The agent respected the phase.** `agent_status: done`, no code changes, only
+  Orchestra's own scratch directory in the tree.
+- **A bad launch nacked cleanly.** The first attempt failed on the base checkout
+  and the task went back to `queued` with `lifecycle_phase: launch_nacked` and
+  `attempt: 1`. No orphan pane, no stuck lease.
+
+### Fixed during the run
+
+- **F1, authority bug, `2753a8d`.** Every federated launch died with `effective
+  intent: federation: 401 Unauthorized: unauthorized surface`.
+  `GET /v1/tasks/<id>/intent` exists for workers, and the authz worker-path
+  exemption never included it. Twenty test packages passed throughout.
+- **F2, authority bug, `09e572f`.** The rendered goal was the issue title alone
+  and acceptance read `Not stated.`, because `Gitea.event` parsed the issue body
+  and dropped it from the `TaskCreated` payload. The store already read
+  `description`. Every Gitea-sourced task so far ran on its title.
+- **F3, self-inflicted, `a0209a2`.** The launch dump left `.orchestra/`
+  untracked in a worktree whose own context said `uncommitted changes: false`.
+  It would have polluted the gate, the review diff and the agent's `git status`.
+
+### Open, classified
+
+- **F4, adapter/harness.** `rotation ... activity degraded: activity unknown:
+  adapter: resolve session file: adapter: harness "opencode" has no
+  session-file resolver`. Thrash and activity triggers are permanently degraded
+  on opencode. Observable in the worker's `last_error`, non-fatal.
+- **F5, lifecycle.** The router never leased this task. Every gate checks out by
+  hand: worker `online: true`, `herdr_status: reachable`, fresh `checked_at`,
+  `supported_projects: ["test-e2e"]`, quota empty, no active leases, capability
+  empty. A direct `POST /v1/tasks/<id>/lease` succeeded instantly. The refusal
+  is upstream of `Store.Lease` and silent by construction
+  (`internal/router/router.go:197`). All three runs were leased by hand.
+- **F6, observability.** Worker health reports `active_task: null` while the
+  store shows the task leased and herdr shows a live opencode agent in the
+  task's worktree.
+- **F7, operator policy.** `ORCHESTRA_TUI_TOKEN` is unset, and an unset surface
+  token means no authentication for that surface. That is how the manual leases
+  above were issued, unauthenticated, from another machine. The TUI surface is
+  `FullControl`, so this is the whole control plane, not just the two agent
+  request endpoints. Set the token.
+- **F8, correctness.** `human.Reconciler.Reconcile` iterates every configured
+  source for every task, so the three queued `correx` tasks have their external
+  ids looked up in `kami/test-e2e`. A source should only reconcile the tasks
+  that came from it. Likely why those three never lease.