Implement one pinned-plan orchestration stream (0073 + 0077)

[justinhelmer]

Implement accepted decision records 0073 and 0077 as one external work stream. Replace repository-seeded and generated execution inputs with canonical pinned plans, preserve the deterministic unit machine, and retire the executable graph only after the accepted 0073 shadow/fixture/ownership gates pass.

No implementation plan belongs under docs/plans/.

Authority

• Decision 0073 is accepted and owns orchestration, parent cardinality, composer fencing, durable adoption and retirement of the graph composer.
• Decision 0077 is accepted at 5eb4fd40f81ae86e84749ffd9bed0fe79484cf6f. Its maintainer-authorized acceptance gate is the five-question receipt; there is no broader acceptance hold.
• docs/plans/2026-09-21-002-feat-the-ship-pipeline-dissolves-into-the-orchestrator-plan.md is bootstrap input imported once, not a continuing repository execution address.

One execution contract

• A validated PlanArtifact is pinned immutably under (planId,digest) in the coordinator store.
• Canonicalization sorts object keys, preserves array order, rejects duplicate source/unit IDs and non-canonical numbers, and hashes the exact UTF-8 bytes with SHA-256.
• Execution accepts only PlanRef{planId,digest,providerUrl} and loads exact pinned bytes. GitHub is a human projection, never an execution loader or digest source.
• Mutable publication metadata is stored separately from canonical bytes.
• Every source and unit has a stable typed identity. Model-authored prose cannot populate execution identity, authority, operation targets or publication destinations.
• The existing deterministic unit machine retains leases, one owner, code → review → fix → checks → merge, rebase-before-push, changed-set gates, work preservation, reviewed-head equality, checks, authorization, confirmation and the merge door.

Independent repository facts

Do not replace #2238 with another repository-ranking rule. Carry these independently:

• RequestContext: inherited workspace/default for unqualified material.
• OperationTarget: typed repository, pull request or plan unit acted on.
• PublicationDestination: destination for each provider effect.
• EvidenceReference[]: cited repositories/issues/pull requests/files with no target or write authority.

Required examples:

Ask	Context	Operation target	Publication
in owner/a: review owner/b#5	A	B#5	verdict on B#5
in owner/a: implement owner/b#5	A	A; B#5 is evidence	branch/PR in A
review B#5, implement findings in A	A	review B#5; code A	verdict B#5; PR A
cross-repository plan	request context	each unit’s typed target	parent in configured planning repo; unit issue/PR in target repo

Ambiguous roles ask or refuse before write identity. Citation order, thread recency and repository ranking never decide an operation target.

Prerequisite order

• Before S1: implement decision 0072 U1’s durable live-state projection. Accepted 0073 requires that exact field for its atomic parent relation.
• Before S2 publication or admission: close P0 ship: a run binds a different repository than the accepted bind names — write-identity child loose in nominal #2238 with the independent-facts contract above; retain P0 ship: the runner dies on a read-record 404 after a review verdict, stranding an approved unit mid-pipeline #2236/fix(ship): recover read-record races and reissues #2264’s recovery regressions; make Ship aborts after coding completion without opening submitted PR #2219’s PR creation a typed provider receipt.
• Before S3 multimodal admission: represent operator contract violations separately from provider failures for door: an operator bind violation is reported to the person as "the model provider refused the call" #2281.
• Before S4 can enable automerge: implement review: re-run the review when a reviewed PR's head changes, with one update message, configurable per repo; branch protection as an optional layer #2145/decision 0076 unit one and review: one ask spawns two runs whose verdicts disagree, and the LGTM twin auto-approves #2244’s one-review-owner rule.
• review: re-run the review when a reviewed PR's head changes, with one update message, configurable per repo; branch protection as an optional layer #2145 is not an S1–S3 or pre-0073 prerequisite. Those slices preserve the existing in-flight reviewed-head and merge-door guards.

Required 0077 amendment before S2 admission

The accepted delivery list says S2 admits direct tasks while S3 introduces plan. To preserve direct-task behavior without restoring generated execution, amend only the slice boundary:

• S2 introduces the text-only plan contract needed for fresh direct tasks.
• S3 extends that same contract to files, images, issues and threads and adds standalone/revision behavior.

No architecture, artifact, authority or loader rule changes. Until that amendment is accepted, fresh direct-task admission remains an owner decision, not an inferred requirement.

Slices

1. S1 — canonical pins and one loader, dark. Add artifact validation, canonical pinning, complete migration inventory and the fenced off/shadow/on composer seam. Migrate every resumable generated/repository-seeded pipeline and the bootstrap plan. Delete both old loaders. Start or resume no code.
2. S2 — publication, text planning and 0073 retirement. Publish/adopt the required parent URL, form complete PlanRefs, introduce text-only plan, resume migrated work, run the complete 0073 fixture corpus, transfer/drain all legacy owners, and delete the legacy composer only after its retirement gate.
3. S3 — every source through plan. Add file, image, issue and thread adapters plus standalone plan/revision, all ending in the same validator, pin and publication path.
4. S4 — rename and merge policy. Rewrite persisted coding values to code once and add default-off global ship.automerge, bounded by the initiating actor’s current authority and review: re-run the review when a reviewed PR's head changes, with one update message, configurable per repo; branch protection as an optional layer #2145/review: one ask spawns two runs whose verdicts disagree, and the LGTM twin auto-approves #2244.

Composer versus loader

After S1 there is one loader in every mode: (planId,digest) from PlanStore.

The temporary legacy composer may read only migrated graph state belonging to already-resumable instances. It receives the same immutable pin and normalized fact snapshot as the orchestrator. New PlanRefs are orchestrator-owned and never compile sequencing reasons into dependency edges.

plane.shipReconcile: off|shadow|on selects one active composer. Shadow has read-only ports. A composer transfer waits for the current deterministic machine act to return and atomically advances relation sequence, composer epoch and owner generation with the parent’s tagged {child|wait|ending} relation and live state.

S2 retires the composer only after every fallback-only fixture is represented by a typed orchestrator act and the durable inventory reports zero legacy owners, zero dual owners and zero unknown rows requiring graph semantics.

Incident mapping

• P0 ship: a run binds a different repository than the accepted bind names — write-identity child loose in nominal #2238: independent context, operation target, publication destination and evidence.
• P0 ship: the runner dies on a read-record 404 after a review verdict, stranding an approved unit mid-pipeline #2236/fix(ship): recover read-record races and reissues #2264: bounded retry for an expected own record, superseded-instance resolution, foreign/absent opacity.
• review: one ask spawns two runs whose verdicts disagree, and the LGTM twin auto-approves #2244: one review owner per PR/head before automerge.
• ship: a generated plan that writes a design record gets no record reservation, so decisions:check fails and the unit aborts before review #2261: typed writesDecisionRecord; reservation before child admission.
• ship: a completed fix round with its push landed is read as interrupted and the unit aborts #2285: completed child plus dispositions and repository-held head advances to review regardless of a salvage label.
• execution: repo:use refuses a directive run's push to the branch it was told to work on when that branch heads an open PR #2200/Router sends a thread follow-up with review findings to ship (new plan, new branch) instead of coding on the PR's branch #1820: unit target, base, branch and PR head remain separate durable facts; continuation adopts the same unit.
• door: an operator bind violation is reported to the person as "the model provider refused the call" #2281: operator violation is not provider failure.
• Ship aborts after coding completion without opening submitted PR #2219: description submission is not PR creation; only a typed GitHub receipt records pr_opened.

Release boundary

• S1 and S2 must both be merge-ready before S1 reaches production.
• Deploy with admission and resume closed; inventory and pin; publish/adopt parents; attach URLs; verify cardinality and migration completeness; then resume migrated work under the composer rollout.
• S2 may require a retirement follow-up after live shadow evidence. S3 cannot begin until the legacy composer is deleted.
• No previous binary is promised after pin-only rows are admitted. Rollback then means close admission and forward-recover, not restore a deleted loader.
• No new repository plan file.

Completion

• Exactly one executable plan loader remains.
• Exactly one composer remains after S2.
• Every 0073 ending, wait, ownership and recovery fixture passes through real durable adapters.
• Every fresh source accepted after S3 goes through plan.
• code is the only live core name after S4.
• Automerge defaults off and cannot bypass current actor, head, verdict, checks, repository rules or the merge door.

[justinhelmer]

Planning reconciliation update: the delegated correction pass completed on accepted head 5eb4fd40f81ae86e84749ffd9bed0fe79484cf6f, run 4404220e-40d8-4bf9-b48a-03a7d8f78617 (thread). No slice implementation has started.

Settled corrections:

• 0077 is accepted; the authorized five-question gate passed. No additional acceptance gate remains.
• 0072 U1 is genuinely required before S1: accepted 0073 explicitly depends on its durable live-state field. Its existing-plan U1 is now being implemented in this thread.
• The source-backed correction places #2145 and #2244 before S4 automerge. S1–S3 must still preserve every existing reviewed-head, authorization and merge-door guard; this is not permission to weaken them.
• Repository context, operation target, publication destination and evidence references are independent facts. Neither a global ranking rule nor a single renamed repository field settles #2238.
• The single loader is distinct from the temporary composer rollout. Any temporary legacy composer may consume only migrated retained state and the same immutable pins, and must retire after the accepted fixture/ownership gates.

One real slice-boundary contradiction remains: S2 promises fresh direct-task admission, while S3 introduces the planner that must produce those tasks’ complete artifacts. The planner recommends a minimum dated amendment: text-only planning in S2, with non-text adapters and standalone revision in S3. That is a proposal awaiting record-level disposition, not a silently adopted requirement or a reason to invent a temporary generated-task compiler. S1 → S2 → S3 → S4 remains; S1/S2 must both be ready and deploy together. Previous-binary rollback is not claimed without a retained-state compatibility proof.

Current parent/slice bodies remain intake until that disposition is incorporated into the returned source-grounded bodies. The external parent and its four native sub-issues remain the sole execution tracker; no new repository plan will be created.

[justinhelmer]

Replaced the parent and S1–S4 bodies with the source-grounded result from run 4404220e-40d8-4bf9-b48a-03a7d8f78617. The real S2/S3 direct-task contradiction is now explicit: the bodies use the recommended text-only plan boundary but block fresh S2 admission until decision 0077 receives a dated re-evaluation amendment and that amendment is accepted. No generated-task compiler or second execution loader is assumed.

[justinhelmer]

Maintainer-requested consolidation: external PR shepherding

Fold external-author PR shepherding into this existing orchestration stream. The separate shepherd implementation/kickoff is retired; no implementation was started from it. This amendment passed independent correctness review. It does not release source reservations or authorize deployment.

Placement

• S1 (#2292): common work identity, typed target, composer epoch and tagged child/wait/ending relation must represent existing external PR work. Coordination ownership is distinct from permission to change a branch. Prove the state shape through the real durable contract; preserve S1's dark/no-code/no-resume exit.
• S2 (#2291): ordinary implementation continues to call the existing deterministic coding unit unchanged. External PR work consumes shared PR observation/head/CI guards plus review, feedback-publication and bounded-wait primitives through the same orchestrator owner and effect executor. It never disables the coding unit's branch-ownership guard or automatically calls coding. Add this second consumer to the shadow/retirement fixture corpus.
• S3 (#2293) and S4 (#2294) retain their current scope. Multimodal planning, rename and automerge are not prerequisites for the external-author workflow.
• S5, scheduled external PR intake, follows S2's common contracts and retirement gates. Existing catalog scheduling discovers eligible PRs and wakes the same orchestrator. It adds no separate shepherd composer, owner, retry/lease authority or execution loader. S2 needs the deterministic external-author fixture, not S5's live pilot, so this ordering has no circular gate.

Preserve the current S1+S2 joint-release and migration boundaries. Any necessary change to accepted 0073/0077 semantics requires a dated re-evaluation/amendment before implementation. The proposed direct-review subscription work in 0076 must reuse the same PR-to-work index and owner; default-on enrollment, optional checks and automerge remain outside this slice.

Canonical admission

Each bounded admitted discovery supplies an authorized typed PR target and normalized task source under the schedule's durable ExecutionInitiator. Use S2's text-plan validation, pinning and parent publication to obtain a complete PlanRef before admitting orchestrator-owned work. A stable enrollment key binds target/policy to that PlanRef and owner. Repeated ticks adopt it; head movement changes runtime observations rather than immutable artifact bytes. Missing pin, parent URL, initiator authority or enrollment binding refuses. Discovery itself starts no work, and GitHub issue bodies never become executable bytes.

Required acceptance criteria

1. Enter from any observed PR state, including prior reviews/fixes. Fresh lifecycle, head/base, review and CI facts override old phases. Reuse existing reviewed-head guards and proven unchanged-rebase carry.
2. Both consumers share one fact/act contract, ownership admission, bounded waiting and typed publication receipts. A subscription only indexes its work/owner; it is not a second controller. Tests show ordinary ship behavior preserved and external work never starts a branch-writing coding child.
3. Reuse the authenticated current-head Switchboard verdict rule; outside human/bot reviews supply feedback. Preserve severity handling and required CI completeness. Green is not permission to bypass additional GitHub approvals or the merge door.
4. Source IDs are namespaced by installation/repository/PR/type/ID. External bodies use existing untrusted-content fencing. Extend the existing typed review assessment rather than invent coding dispositions. Validate current observation revision and known source/finding/batch references.
5. Canonical finding IDs persist. Cross-source equivalence requires an evidence-linked reviewer sameAs, not fuzzy title/path matching. Only accepted changed remedies increment remedy versions. One outstanding remediation batch spans intermediate pushes; consume a final author-response revision once. Only assessed, batch-relevant progress updates the response clock.
6. COMMENT reviews already trigger the first external bot's follow-up, deduped by review ID. A findings review is the trigger; no duplicate notification. The external bot does not enforce a SHA on this trigger: read head before/after posting, preserve historical review commit and never certify a newer head from an older result. Other agents retain responsibility for their own concurrency.
7. Assessment identity includes head AND base SHA plus relevant revision. Delivery identity uses canonical remedies and response episode, avoiding resends for incidental edits, CI chatter or policy changes. Cold enrollment adopts proven prior deliveries; ambiguity blocks new triggers.
8. Persist effect intent before sending. Trusted publisher metadata, immutable remote IDs and permanent receipts support readback after an uncertain response. Reject copied/echoed markers using provenance/target/commit/payload checks. Do not treat an outbox acknowledgement as permanent dedupe or blindly retry an ambiguous write. Any fresh-run reservation requirement must be implemented once in shared admission with context/collision fencing, not as a parallel shepherd API.
9. Test two generations, duplicate wakes, head movement during attachment/review/publication/readiness, base-only movement, lost admission/publication responses, stale-owner completion/release, and disablement/revocation during an in-flight review through real shared adapters.
10. Preserve durable start/round counts and author-wait anchors across restarts/config edits. Confirmed remediation delivery starts waiting; imported delivery uses the later of submission and enrollment. PR age, unrelated pushes and acknowledgements do not reset the clock. Caps gate new work, not recognition that the final allowed review reached green.
11. Discovery paginates a 160-plus-PR fixture with fair bounded admissions, per-repository/global capacity and API limits. Incomplete/oversized reads never become green or starve other work. Use existing catalog/config/registry/reporting and a dedicated narrowly authorized schedule identity. Enrollment defaults off.
12. Disabling the policy blocks new dispatch and pending publication; read-only recovery retains prior receipts. Ready remains observable until merge/close/stop; new relevant facts reopen evaluation.
13. End-to-end fixture: schedule → shared orchestrator → review → one COMMENT feedback batch → external push → re-review → complete CI green; replay restart, nonresponse, duplicate tick and concurrent push. After separately authorized deployment, one selected resumable external PR must supply actual review IDs, heads, response/push, current-head review/CI and no-duplicate receipts. Code completion does not close that live outcome.

Delivery ownership and timing

The migration session owns this stream; the existing fleet orchestrator retains today's active/planned source reservations and daily delivery/release sequence. First candidate: only new src/core/planArtifact.ts, src/core/planArtifact.test.ts and docs/reference/specs/plan-artifact.md, with no stores/loaders/runtime wiring/index/README/release edits. This candidate is not self-admitted.

Disjoint coding/review/CI may proceed only after exact path reconciliation. Migration merges, auto-merge, merge-queue entry, releases, deployment and pilot remain held until the fleet owner names today's delivery set and records its required landings satisfied. Neither a merged repair nor zero active runs releases these gates. Shared wiring waits for explicit release after both active and planned work are checked.

[justinhelmer]

Proposed minimum public amendment for #2290 / S1 / S2 / S5

Status: draft for parent judgment and publication. It changes no canonical issue until the parent publishes and reads it back.

Parent #2290 addition

Combined-plan corrections from full S1–S5 review

This amendment is the first review of the complete combined S1–S5 migration. Reviews of the retired standalone shepherd plan are not evidence for this boundary.

1. Canonical admission is a deterministic join, not schema validation of model claims. Intake owns immutable source envelopes and a typed target-binding set. A plan turn may reference their opaque IDs but cannot create or alter source identity, digest, provenance, reader/completeness, operation target/base, publication destination, initiator or grant. Before pinning, deterministic code requires exact agreement with the admitted sets and refuses omissions, substitutions, additions and ambiguity. Canonical bytes use RFC 8785/JCS over a host-constructed PlanArtifact JSON value. Raw typed-output decoding rejects duplicate object keys before conversion; the artifact permits only finite safe integers for numeric schema/version/count fields and rejects negative zero and all other numeric forms; strings receive no Unicode normalization; UTF-8 bytes are hashed with SHA-256. Cross-runtime vectors cover key order, escaping, Unicode/non-normalization, arrays, integer boundaries and rejection cases.
2. A pin and a PlanRef are different facts. The immutable pin is (planId,digest,canonicalBytes). Separately versioned publication metadata supplies providerUrl; only {planId,digest,providerUrl} is executable.
3. Migration preserves the original unit, not only its plan text. The migration mapping retains instance ID, unit ID/key and idempotency namespace; thread, branch and PR; consumed/pending events; rounds, waits, counts, recovery claim and lease; pushed/reviewed/check heads; initiator; exact source ending/cause and retained work. Mid-round seeded/generated fixtures resume through that same identity and dispatch no replacement unit. The failed plan-implement-only-the-pure-44ccea:U1 attempt remains failed-before-code and grants no replacement work.
4. Execution has one loader while migration retains a non-executable reader bridge. Before implementation, land a dated 0077 re-evaluation: the accepted rationale and five answers remain, but delivery uses a retained, build-stamped bridge release because the deployed migration must still read legacy source material. The bridge adds PlanStore, bounded inventory, pin/publication attachment and an operator-authorized recovery command. Legacy readers are callable only by that migration/recovery command; no new or resumed execution may use them, so PlanRef remains the sole executable loader. Keep the bridge artifact deployable until migration and composer retirement finish. After every resumable row has a verified pin and complete PlanRef, a later release deletes the readers. Before pin-only admission, replay the bridge command after every irreversible boundary and prove it can close admission, inventory rows, repair/attach PlanRefs or park owners, and emit an audit receipt when the active bot/composer release is unavailable. Its credential is restricted to migration inventory, PlanStore/publication attachment, admission closure and owner parking; it cannot start/resume code or merge.
5. One owner does not imply every capability. The durable PR/work index is unique per installation/repository/PR and carries closed capabilities. Ordinary ship owns branch-writing code/fix effects. External-author work owns only observe, assess/review, publish authorized feedback and wait. Every effect checks capability and current initiator authority. Mutable policy revisions remain on the same enrollment row and cannot create a second owner, PlanRef, counter set, receipt set or remediation batch.
6. One effect and review authority. Before any external-author admission, the fleet-owned record-0074 comment/review effect unit must land with one RunEffects port and permanent receipt authority strengthened by a dated re-evaluation: copied/echoed markers are insufficient without authenticated publisher, target, commit/version, nonce/action identity and payload digest. The fleet-owned 0076/review: one ask spawns two runs whose verdicts disagree, and the LGTM twin auto-approves #2244 unit must also land one durable installation/repository/PR subscription and one PR/head review owner shared by direct review and ship. Implement one pinned-plan orchestration stream (0073 + 0077) #2290 and S5 consume those exact seams. S5 enrollment metadata is a non-authoritative child keyed to that subscription; no S2/S5-specific owner, subscription, outbox-dedupe or effect ledger is permitted.
7. Publication cannot widen source visibility. Deterministic code compares every source's authorized-reader boundary with parent/unit destination visibility, emits redacted citations rather than protected content or locators, and refuses when compatibility is unknown or the destination is broader. Source snapshots and permanent receipts get explicit retention, deletion and operator-read rules.
8. Retirement and release gates are separate. “Initial S2” is the publication/text-plan/migration bridge deployed jointly with S1 while admission and resume are closed. The later “S2 retirement follow-up” uses live shadow evidence to delete the legacy composer and flag. Composer retirement is gated only by 0073 legacy parity, zero legacy/dual owners and zero graph-dependent or unknown rows. External-author fixtures gate the external extension/S5, not retirement of legacy behavior. Migration merge/release/deploy/pilot remains behind the fleet owner's daily-set receipt; technical readiness does not release that embargo.
9. S5 may not mint unauthorized approval. A scheduled review that emits LGTM: can trigger GitHub approval and existing per-PR auto-merge. Every S5 admission, including S5a, therefore waits for item 6's shared 0076/review: one ask spawns two runs whose verdicts disagree, and the LGTM twin auto-approves #2244 PR/head owner and 0074 effect receipt. Approval publication is an authority-bearing effect authorized from the durable ExecutionInitiator; the schedule's review/publication grant alone cannot mint it. Existing GitHub auto-merge enabled before enrollment is a required refusal/fixture, not an implicit permission path. There is no temporary advisory near-verdict that can satisfy current-head green while bypassing this gate.
10. S5 schedule identity is exact. The bearer authenticates transport only. The fixed registry entry resolves schedule:pr-shepherd; that exact principal is persisted as ExecutionInitiator and re-authorized for dispatch and every effect. An http:*, registry, initiator or grant mismatch refuses.
11. S5 is staged around outcome learning. S5a explicitly enrolls one authorized resumable external PR through normalized text → validated pin → parent publication → complete PlanRef and the shared owner, with scheduled discovery disabled. Its live receipt records every operator intervention; manual reconcile, corrective recovery, allowance extension or blocker resume makes the run diagnostic rather than a successful autonomous outcome. After the pilot, the named owner records one decision: remain disabled with blocker, retire, or authorize a bounded cohort with rollback criteria. S5b then adds scheduled paginated discovery, fairness and fleet-capacity controls. No direct/subscription execution shortcut is introduced.

The parent numbered slice list must include S5 — staged external PR intake, dependent on S2 rather than S3/S4, and Completion must distinguish S5a's clean live receipt from S5b's disabled-by-default scheduled service.

S1 #2292 scoped delta

• Replace “sort object keys” with the RFC 8785/JCS contract, restricted numeric domain, raw duplicate-key rejection and exact cross-runtime vectors above.
• Make source envelopes and target bindings host-owned inputs to PlanArtifact construction; typed model output references them.
• Add the lossless original-instance/unit migration mapping and same-unit mid-round continuation proofs.
• Split S1 completion into the build-stamped additive migration bridge and later reader deletion. The bridge cannot execute legacy plan inputs and requires the dated 0077 re-evaluation before implementation.
• Add destination-audience data needed by S2 publication, but perform no publication or external admission in S1.

The current three-file candidate remains only the pure artifact/ref contract. It must not define store, loader, owner, migration, scheduler or runtime behavior, and it remains blocked by the current drain hold. Its contract is reviewable only after the normative canonicalization and host-owned/trusted-field boundary above are included.

S2 #2291 scoped delta

• Rename the first deployment “initial S2” and the later deletion “S2 retirement follow-up.”
• The external-author extension consumes the fleet-owned 0074 comment/review effect-receipt and 0076/review: one ask spawns two runs whose verdicts disagree, and the LGTM twin auto-approves #2244 PR/head owner seams before its admission; do not create shepherd-specific dedupe/ownership authority. This adds no new 0076/review: one ask spawns two runs whose verdicts disagree, and the LGTM twin auto-approves #2244 prerequisite to S1, ordinary initial S2, S2 legacy retirement or S3. External cases may be tested against the shared contract before activation; their live admission remains gated separately.
• Introduce the closed owner-capability contract and one immutable PR enrollment identity with mutable policy revision.
• Keep external-author parity fixtures as a gate for the external extension, not a legacy-composer retirement predicate.
• Require the independently invocable migration/recovery operation before pin-only admission.

S5 #2353 scoped delta

• Gate all S5 admission on the landed shared 0076/review: one ask spawns two runs whose verdicts disagree, and the LGTM twin auto-approves #2244 PR/head owner and 0074 initiator-authorized approval effect.
• Implement the exact schedule:pr-shepherd principal handoff before scheduled admission.
• Split explicit one-PR S5a pilot from S5b scheduled discovery/capacity.
• Add publication-audience/refusal cases, existing GitHub auto-merge, duplicate direct-review owner, intervention accounting and the post-pilot adoption/retirement decision to required proof.

[justinhelmer]

Clarification to item 4 of the combined-plan amendment: the dated 0077 bridge re-evaluation is required before implementing or deploying the bridge, legacy-row reads, pin/publication attachment writes, executable-loader routing changes, or reader deletion. It does not block the already scoped three-file pure artifact/ref groundwork, which has no runtime consumer or migration effect. That groundwork still requires its existing source and original-unit recovery gates; this clarification authorizes no retry or replacement.

Also preserve the existing loader/composer distinction: the temporary legacy composer loads content through PlanRef and may use verified retained graph/cursor state of already-resumable migrated units. It never compiles new executable edges from artifact sequencing reasons. Unknown or inconsistent retained state parks; verified state is not parked merely because it has a legacy cursor. The migration bridge itself cannot resume code.

The proposed append-only record amendment is in final independent review. No accepted record, product code or deployment is changed by this clarification.

[justinhelmer]

Amended 2026-09-25 — retain a non-executable migration bridge until retirement

Status: proposed append-only amendment for maintainer acceptance. It changes no accepted record or runtime behavior. Re-evaluated against main at b7f8f15f4bb351a30811697a93d6bac4d67a5db9, accepted record 0073, and current #2290/#2292/#2291.

Re-evaluation. Record 0077 was accepted because every source form converges on one validated canonical pin, a provider URL supplies the human address, and execution starts only from a complete PlanRef. This removed repository paths and generated requests as executable inputs while preserving durable identity, budgets, current initiator authority and guarded merge behavior. The rationale and five acceptance answers stand.

The delivery order nevertheless deletes readers before a deployed migration can read legacy repository-seeded and generated source material. That couples recovery to the possibly broken new runtime. The minimum non-regressing change is a retained, build-stamped migration/recovery bridge, followed by reader deletion in a later release.

Delivery-order text replaced. In Delivery order item 1, replace deletion of the generated-plan execution kind, repository-path request grammar and readers with: remove the execution kind and request grammar from every admission, dispatch, resume, planning and unit-machine path; confine both readers to the bridge command. Replace “migration fails before deleting either reader unless every resumable pipeline has a pin” with: no build deletes either reader until the deletion gate below passes. The bridge ships across S1 and initial S2 while admission and resume are closed; deletion follows record 0073 cut three. No checked-in plan executes beside a pin, and no flag selects a legacy loader.

PlanRef{planId,digest,providerUrl} remains the sole executable loader. While 0073 fallback exists, its composer loads content only through PlanRef and may use verified retained graph/cursor state belonging to already-resumable migrated units. It never rebuilds executable edges from artifact sequencing reasons or gives a new admission legacy graph state. Unknown or inconsistent retained state parks; verified rows may continue under ordinary authorization after the fleet reopens resume, until fenced composer transfer. The bridge itself never resumes them. Rollback never re-enables an execution reader.

The independently invocable bridge reads only the admission-closure inventory: resumable generated/repository-seeded rows already in the coordinator store plus 0077’s named bootstrap plan. It accepts no path, ref or task text and admits no plan. It constructs the host-owned PlanArtifact from each row's admitted source through the same RFC 8785/JCS validator, canonicalizer and SHA-256 implementation as the pure three-file contract; no migration-specific encoding or artifact framework. It never rewrites a pin or changes an existing digest; invalid or ambiguous rows park with a named cause.

Its separate operator credential permits bounded inventory reads, immutable PlanStore writes, idempotent parent create-or-adopt and publication attachment through the same destination authority/marker adapter, admission closure, and owner parking. Before create/adopt or attachment, deterministic code compares every source's authorized-reader boundary with the destination audience, refuses unknown or broader visibility, and emits only redacted citations/receipts. Snapshots and receipts use the configured run-history/artifact retention, deletion and authorized-read policies; referenced pins remain while any work is resumable. Missing policy parks the operation, not a wider audience or indefinite retention default. The bridge cannot open admission; start/resume code; write branches; publish reviews/approvals; merge; release; or change grants. The operator appears in the receipt but never replaces ExecutionInitiator; a row without a resolvable initiator parks. Invocation depends on neither chat nor the new bot/composer runtime.

Migration preserves instance and unit ID/key, idempotency namespace, source, initiator, request context, operation target/base, publication destination/version, evidence references, source reader/completeness boundaries, client-requested merge policy, thread/branch/PR, events, rounds/waits/counts, lease/recovery claim, heads, ending cause, retained work, active composer/epoch, pending-question key, tagged {child|wait|ending} relation and sequence, salvage receipts, owner generation and parent/child budgets. A required binding that is missing or contradictory parks; no prose reconstruction or authority-widening default fills it. Versioned legacy-field mappings must prove the same facts; explicitly optional absence stays absent. Current grants are freshly resolved, never copied as authority. No replacement unit, budget or authority is created.

The pure #2292 three-file artifact/ref groundwork (types, validation, canonicalization/digest and PlanRef) need not await bridge completion; it has no store, loader, owner, migration or runtime effect and remains behind its own drain/source gates. Acceptance is necessary but insufficient before implementing or deploying any legacy-row read, pin/publication write, loader-routing change or reader deletion. Each still needs reviewed planning and fleet-owned code, merge and release authority. Acceptance permits no implementation, admission, resume, merge, release or deployment.

Safety and deletion gate. Admission closure and owner parking are durable compare-and-swap facts under expected sequence, composer epoch and owner generation; every capable runtime must already honor their fence or be drained before the first pin. The bridge never owns/composes and advances an epoch only to park. After the first pin, rollback targets only the bridge build or later. Provider publication may be irreversible; legacy-encoding removal, pin-only admission and reader deletion are explicit later boundaries.

Keep the exact bridge artifact deployable and schema-compatible until every resumable row has a verified pin and complete PlanRef, no unknown/dual owner or graph-dependent row remains, 0073 fallback parity passes, and forward recovery succeeds. Newer schema versions must remain readable/fenceable by the bridge or be refused before rollout. Before pin-only admission, prove recovery after every crossed irreversible boundary with bot/composer unavailable, first against a production-shaped snapshot and then within the authorized production admission-closed migration window: close admission, inventory, repair/attach a reference or park an owner, and emit a receipt. Do not create an extra production outage solely for proof. Only a later build deletes readers and bridge.

Proof covers: mixed binaries refusing legacy execution; same-unit mid-round continuation with budgets; bridge recovery from broken new runtime; unavailable publication leaving a retryable non-executable pin; independent credential/runtime support with no code/merge power; visibility incompatibility refusing attachment with a redacted receipt; and rollback stopping at each named irreversible boundary.

Five-answer recheck. The canonical pin plus provider URL remains the only executable reference; projection remains non-canonical; admitted execution survives provider outage through its pin; merge still requires fresh initiator authority; and legacy inputs collapse once into the pinned path, never a compatibility execution path.