Burn-down: open issues after v1 go-live (done 2026-10-11; next: #62; parked: #54) #24

Burn-down of processor's open issues after v1 went live (#1, 2026-10-02). Protocol: gregoryfoster/skills#348 (burning-down-an-epic, a draft). The operator implements one issue at a time in a separate agent thread on co-processor. At each check-in, the coordinator thread verifies the work, ticks it here, re-scans for new issues, and names the next one.

• Last check-in: 2026-10-21T23:06:49Z
• Last probe: 2026-10-21T23:08Z
• Last issue seen: Replace the brainstorming override with a vendor symlink and an AGENTS.md preference #62
• Last verified SHA: 18deb3c
• Next: Replace the brainstorming override with a vendor symlink and an AGENTS.md preference #62 (the brainstorming override becomes a vendor link plus an AGENTS.md preference); hand-off. Then parking lot (Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54).

Milestones (read first at every check-in):

• Watcher's soak ends 2026-10-09T21:35Z. Passed; Switch WATCHER_EXTRACT_MODE to processor: processor-decided apply path, flip, soak, delete local extraction and the co-core [extract] extra watcher#326 closed 2026-10-09T22:07Z: 80/80 fetches and 80/80 process commands succeeded, 4/4 items ok, 0 WARNING+, and 6 processor-decided changes, across 17 Watcher restarts. The soak deploy policy no longer applies. Rollback (shadow/local) stays available until Delete local extraction after #326's soak: the pipeline's extract path, the mode variable, the shadow leg and its columns, and the co-core[extract] extra watcher#350 lands.
• Delete local extraction after #326's soak: the pipeline's extract path, the mode variable, the shadow leg and its columns, and the co-core[extract] extra watcher#350 deletes Watcher's local extraction. Closed 2026-10-10T01:52Z (207e9be..bb1b1f9). Rollback to shadow/local no longer exists: Processor is the only extractor. Follow-up filed as Close out the cutover: spec §6 step 5 done, and re-decide D5 (lockstep pin, Watcher-generated goldens) now that Watcher doesn't extract #47 (close Become the cohort text-extraction processor: consume content.process, extract from one source_spec, store canonical text by hash, publish content.derived #1, mark spec §6 step 5 done, and re-decide D5 and Watcher-generated goldens).
• Broker patch windows (Adopt the scheduled patching posture: commit .skills/patching-hosts, then run the first monthly patch (reworked from automatic updates) broker#67, Bump the vendored skills to cd61b77+ and adopt patching-hosts' Redis fixes before the next run (gregoryfoster/skills#379 to #385) broker#91): the next opens Mon 2026-11-16 23:00Z (15:00 PST) [stated: CannObserv/broker#91]. Expected signature here, as in run 1 (2026-10-13 04:17–04:22Z): consumer loop error; backing off WARNINGs at the Redis restart and at the reboot, tailscaled open-conn-track timeouts during the reboot, then ack: complete resumes with NRestarts=0. Not a flap; triage only if Processor doesn't resume.
• Watch: Redis 7.0 is upstream EOL (2024-07-29): decide the broker's next Redis broker#85 (Redis 7.0 is upstream EOL; the broker's next Redis). When decided, Processor moves BROKER_REDIS, the CI image and the scratch redis-server, and needs the +client|setinfo grant in the same restart window (from 7.2, redis-py sends CLIENT SETINFO).

Measured state (2026-10-15T15:01Z)

The heading's time is the section's last restructure, which v1 can't rename; each bullet carries its own.

• Production (2026-10-21T23:08Z): since 2026-10-21T18:52Z, 8 ack: complete (all records INFO), no restart, NRestarts=0. live → releases/a1a9e91ef684; origin/main is 18deb3c, docs and tests only since (Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57).
• Monitors (2026-10-21T23:08Z): drift ok/202 on all 4 runs, reading main at 359e102 then 18deb3c (a non-runtime lag, correctly ok); no liveness WARNING; 0 tailscaled open-conn-track timeouts.
• Upstream (2026-10-21T23:08Z): co-core v0.38.0 is the pin. Archiver finished its 0.38.0 work (Source specs: restore jsonpath and the json family once co-core has a JSON extractor (cannobserv#354) archiver#356 closed too).
• Broker (2026-10-21T23:08Z): Redis 7.0 is upstream EOL (2024-07-29): decide the broker's next Redis broker#85 (Valkey 7.2.13) still gated on Revoke Watcher's content.fetch-policy publish grant broker#95 (open). Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 stays parked. The Milestones line above predates the decision; v1 has no op for that block.

Parking-lot mode (since 2026-10-11T00:51Z; operator, 2026-10-10T23:36Z)

#5 was verified at 2026-10-11T00:51Z, so #24 stays open as a parking lot. A check-in happens only when:

• a parked item's trigger fires: the broker's post-window notice on Redis 7.0 is upstream EOL (2024-07-29): decide the broker's next Redis broker#85 (Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54). (CannObserv/cannobserv#536 fired on 2026-10-17, Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21 shipped 2026-10-17; CannObserv/cannobserv#354 fired on 2026-10-19, JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37 shipped 2026-10-20.) Open work since 2026-10-21: Drift check-ins carry no metadata.fault: a change of kind inside one fault waits for the daily reminder #58 and Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57 (both shipped 2026-10-21), then Replace the brainstorming override with a vendor symlink and an AGENTS.md preference #62; parking-lot mode resumes when Replace the brainstorming override with a vendor symlink and an AGENTS.md preference #62 is done.
• a new issue arrives;
• or the operator asks.

Protocol (since 2026-10-15, #52): coordinating-epics v1, vendored at .claude/skills/coordinating-epics. Every body edit goes through its epic-edit.sh, and every check-in starts with scan.sh. scan.sh reads CannObserv/cannobserv refs as 404 with this repo's token, so check those by hand with the cannobserv token. The intro paragraph's "burning-down-an-epic, a draft" predates this; v1 has no op that edits it.

Each check-in still runs the milestone read and the probe from Last probe. The co-core catch-up (v0.30.0 against a 0.19.7 pin) is folded into whichever of #29/#37 bumps first (operator, 2026-10-10T23:36Z). Done by #29 (2026-10-12: 0.19.7 → 0.32.0, the whole range read). The next bump starts from 0.38.0 (#37).

Ordering rule

The operator gave no rule this time. The coordinator applied the following; challenge it here.

1. Time windows first. The window before shadow closes when Watcher flips WATCHER_EXTRACT_MODE=shadow. Work that is cheapest with the bus empty goes in it.
2. Then work that must land before the cutover (Switch WATCHER_EXTRACT_MODE to processor: processor-decided apply path, flip, soak, delete local extraction and the co-core [extract] extra watcher#326, spec §6 step 5), smallest first. Tier complete: the cutover happened 2026-10-06T21:35:24Z.
3. Then deploy safety (added 2026-10-06 for deploy.sh: gate a deploy on the commit's CI (status#11's CI gate) #34 and A drift signal when live lags origin/main (status#12's drift check) #35): guards on how code reaches production. Not cutover preconditions, but production-facing, so ahead of agent tooling.
4. Then agent tooling, which has no effect on production.
5. Blocked items stay parked, each with a re-entry test.

Standing rule: any Processor failure under real traffic goes above everything else in this list. Since 2026-10-06T21:35Z that is a production failure: a failed command takes the item's failure path in Watcher.
The probe, run at every check-in:

• read Switch WATCHER_EXTRACT_MODE to processor: processor-decided apply path, flip, soak, delete local extraction and the co-core [extract] extra watcher#326's newest comment (the soak; shadow verdicts ended at the switch);
• summarise the journal: journalctl -u processor --since <last probe> -o cat, counting outcomes by message and listing every record above INFO;
• run the probe last, just before writing the epic, and stamp Last probe with its time;
• look for new output digests per info_source_id (a real change) and check that Watcher reports no failure for it;
• check the broker's and Watcher's operational issues for planned events (reboots, rehearsals) since the last check-in;
• liveness: the starting record says liveness: on …, and no liveness WARNING; Status's co-processor-live ok;
• journalctl -u processor-drift --since <last probe> -o cat: every run kind: ok and checkin: 202 (a lag, an alert, or a gap of more than an hour gets triaged).

Any record above INFO, a processing_failed for a live item, or NRestarts > 0 is triaged before the next hand-off.

Tiebreaks:

• Tailnet path to the broker: DERP-relayed at idle, direct only under traffic (NAT hairpin) — confirm it holds for the running service #15 before Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20. Both are small. Tailnet path to the broker: DERP-relayed at idle, direct only under traffic (NAT hairpin) — confirm it holds for the running service #15 is worth most while the bus is empty; Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20 is worth the same either way.
• Contain the extraction child: it runs as the service user and can reach the service's secrets #2 lands during shadow, not after it. Watcher's shadow comparator then checks the contained child against real traffic before Switch WATCHER_EXTRACT_MODE to processor: processor-decided apply path, flip, soak, delete local extraction and the co-core [extract] extra watcher#326. The parity corpus alone covers only fixtures.
• Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5 after Contain the extraction child: it runs as the service user and can reach the service's secrets #2. Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5's memory work (MemoryLow= on processor.service, a capped SocratiCode server) edits the unit file, and Contain the extraction child: it runs as the service user and can reach the service's secrets #2 reworks the same unit and service user.

Checklist

Tags: type · size · surface. Gate = an approval the implementer will need partway through; ask for it early.

Before shadow

• Tailnet path to the broker: DERP-relayed at idle, direct only under traffic (NAT hairpin) — confirm it holds for the running service #15 Tailnet path: the reboot re-check · ops · S. Shipped in #15 docs: the broker path holds through a co-processor reboot #25 (0a3a85e, FF, 2026-10-03), CI green on both runs. Docs and a test only, so no restart. Graceful reboot at 16:53Z: the unit cold-started clean (NRestarts=0, consuming 2.1 s after start), and the path was direct on the first ping and still direct 5 min idle. Added tests/test_main.py, which pins the restart path. Follow-ups: none. Known limits recorded under Verification debt.
• Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20 Spec §4: Watcher's consumer rules · docs · S. Shipped in #20 docs: spec §4 states Watcher's consumer rules #27 (0a3a85e..525b263, FF, 13 commits, 2026-10-04), CI green on both runs. Docs plus one docstring, so no restart. All 5 boxes are done, plus the two-timers sub-bullet. The review found the failure-then-success edge needs no crash (a refused dead-letter re-runs the command), confirmed by two throwaway tests. Follow-up: Consumer: a re-run at the cap after the failure fact went out re-extracts instead of dead-lettering #28.

Before cutover (CannObserv/watcher#326)

• Outcome log records no digests: add input_digest, output_digest, size, empty and stored to every command outcome #26 Outcome log records no digests · observability · S. Shipped in #26 feat: outcome records log the command's input and output digests #30 (525b263..3f39ca2, FF, 7 commits, merged 2026-10-05 15:51:57Z), CI green on the PR head and the main push run. Restarted 15:52:12Z, NRestarts=0. Live record: 01M46EXP45TVCVAMQXK043N1Q7 at 16:39:02Z carries input_digest, output_digest sha256:b8f6d0f1…, output_size_bytes 17327, empty false and processor_version 0.19.7+1, which match Watcher's verdict row for that item. DEPLOYMENT's jq -R 'fromjson?' recipe works on the live journal. stored was dropped as recommended (co-core swallows the 412), and the box is struck in the PR. Closing comment: every box has evidence. Known limit worth keeping: tests and implementation landed in one commit (f96dffa), not red then green; splitting would have rewritten pushed history (CR 4). Possible follow-up (not filed): a cannobserv ask for store to report created vs. present at the next lockstep bump; drafted only with approval.
• Consumer: a re-run at the cap after the failure fact went out re-extracts instead of dead-lettering #28 A re-run at the cap re-extracts instead of dead-lettering · bug · S. Shipped in #28 A refused dead-letter at the cap retries only the give-up #31 (303595f..fc6ed4c, FF, 7 commits with the red test first, merged 2026-10-05 17:51:55Z), CI green on the PR head and the main push run. Restarted 17:52:05Z, NRestarts=0, healthy ack: complete records since. Consumer._gave_up is kept apart from _fact_out, as the brief advised; a throwaway run confirmed the trap (keying on _fact_out fails the tests at lines 563 and 613). Every decided consequence has its test. CR found and pinned a fourth case: a transiently refused failure fact. The dead-lettering record gains handle_skipped (DEPLOYMENT has its jq recipe). Closing comment. Known limits: a restart still forgets the give-up (spec §4); a DLQ refused every time logs two ERRORs per reclaim until fixed. Follow-ups: none.
• Spec §6: the cross-repo notices never posted (replicator charter, archiver#179, cannobserv, observo token) #23 Spec §6: the unposted cross-repo notices · docs/ops · S. Shipped in #23 docs: spec §6 — cross-repo rows' status, with links #32 (fc6ed4c..80165dd, FF, 9 commits, merged 2026-10-05 22:31:32Z), CI green on the PR head and the main push run. Docs only, so no restart. An earlier PR run (d7aa717) timed out at 15 min without either job getting a runner: GitHub capacity, not the change. Posted (operator-approved): CannObserv/archiver#179. Replicator moot, cannobserv resolved upstream, observo done. Spec §6 now has a Status column. Closing comment. The brief had two things wrong, both corrected by the thread: the stale cannobserv text was co-core's streams.py, not process.md, and the suggested archiver lead was already in Processing infrastructure for canonical derived artifacts — contract-first, leaning Observo (successor to replicator#69) archiver#179. Follow-ups, not ours: Processing infrastructure for canonical derived artifacts — contract-first, leaning Observo (successor to replicator#69) archiver#179's title still says "leaning Observo"; co-core 0.19.7 keeps the old observo.process docstrings until the next lockstep bump.
• Contain the extraction child: it runs as the service user and can reach the service's secrets #2 Contain the extraction child · hardening · L. Shipped in #2 Contain the extraction child #33 (80165dd..fe19a2b, FF, 21 commits, merged 2026-10-06 16:55:48Z), CI green on the PR head and the main push run. One red PR run (3d2cb54) was a real failure: on CI's runner the contained child couldn't load libgcc_s.so.1. Fixed in-PR by 4f7a6ec (library dirs from the loader's mapped objects). Stage A live 16:55:51Z; Stage B (gate 3) installed 19:05:30Z with scripts/deploy.sh (live -> fe19a2b6a06f (was nothing)). All three brief traps were taken up: a deploy tree under /srv/processor following the cohort standard (Design: production units run from a deploy checkout, not the dev working tree - a cohort pattern broker#22, Safe development on the co-status VM: production must not run the working tree status#9); a seccomp filter on every socket, since a test pins that Landlock alone lets a pathname unix socket through; an allowlist derived from sys.path and loaded libraries. Also: a boot canary, a refusal to contain a process with a second thread, and fail-closed startup. Closing comment: every box has evidence, including a live record as processor. Known limits: a shared kernel; a shared uid between parent and child; exedev owns the releases. Follow-ups filed: deploy.sh: gate a deploy on the commit's CI (status#11's CI gate) #34, A drift signal when live lags origin/main (status#12's drift check) #35.

Deploy safety (since #2: a merge no longer deploys)

• deploy.sh: gate a deploy on the commit's CI (status#11's CI gate) #34 deploy.sh gates on the commit's CI · ops · S. Shipped in #34 deploy.sh: gate a deploy on the commit's CI #36 (fe19a2b..428af0e, FF, 10 commits, merged 2026-10-06 21:33:58Z), CI green on the PR head and the main push run. Deployed through its own gate: CI passed for 428af0e2a016 (it waited about 3.5 min for the push run), then live -> 428af0e2a016, and a harmless refusal of an intermediate commit with nothing built. Rollbacks are gated too (option a), with --skip-ci as the logged escape. CR 5 found a fail-open (an empty jobs answer passed) that Status shares: deploy.sh: an empty jobs answer from GitHub passes the CI gate status#21, filed with approval. Closing comment. Known limits: the unauthenticated rate limit; GitHub down means --skip-ci; a renamed CI job needs CI_JOBS updated. Follow-ups: none here.
• A drift signal when live lags origin/main (status#12's drift check) #35 A drift signal when live lags origin/main · ops · M. Shipped in #35 A drift signal through Status: processor drift, its hourly timer, deploy.sh installs every unit #38 (428af0e..aa1d4a0, FF, 25 commits, merged 2026-10-07 16:11:53Z), CI green on the PR head and the main push run. Deployed through deploy.sh: gate a deploy on the commit's CI (status#11's CI gate) #34's gate, which installed the new units and enabled the timer. All three gates done: Tenant + drift monitor for Processor (co-processor / co-processor-drift) status#24 (tenant co-processor, monitor co-processor-drift); the tailnet rule; the key in /etc/processor. Live: first check-in 202, pending → ok, a test alert confirmed by the operator on email and Slack, and a missing/recovered rehearsal. Every trap was handled: deploy.sh installs every unit under deploy/ (deploy.sh never installs units: deploy/*.service drifts from /etc/systemd/system unnoticed status#18 ported), the check is runtime code in src/, GitHub silent means no check-in, and it runs as a separate oneshot. CR 1 stopped a key leak through requests' InvalidHeader. Closing comment. Known limits: hourly repeat alerts while a lag lasts; a relayed tailnet path. Follow-ups: Liveness check-in for processor run (co-status monitor co-processor-live) #39 (liveness, the operator said yes), Drift check: a file renamed out of a runtime path doesn't count (diff_counts ignores previous_filename) status#26 (Status's rename gap). A flaky test the thread didn't file was filed by the coordinator as Flaky: test_an_entry_that_raises_does_not_strand_the_ones_behind_it (0.6 s sleep against 500 ms idle), and since #34 a flake blocks deploys #40.
• Flaky: test_an_entry_that_raises_does_not_strand_the_ones_behind_it (0.6 s sleep against 500 ms idle), and since #34 a flake blocks deploys #40 De-flake the strand test · test · S. Shipped in #40 test: deterministic reclaim test; sweep of timing margins in tests/ #41 (7eb6c7b..f8f5534, FF, 5 commits, merged 2026-10-08 16:08:07Z), CI green on the PR head and the main push run. Tests only, so no deploy, and the drift check correctly says "none that runs". The brief's trace was confirmed: with a slow step 1 the old test gives ['cmd-1', 'cmd-1', 'cmd-2']. The fix is XCLAIM … IDLE 60000 JUSTID with no wall clock: 50/50 under CPU load, and the test still fails if the reclaim batches. The sweep fixed three more (a 1.5× deadline margin in test_drift, a lock race in test_deploy, unbounded polls in test_main) and listed 8 as safe. The CI loop was descoped by the operator. Closing comment. Follow-ups: none.
• Liveness check-in for processor run (co-status monitor co-processor-live) #39 Liveness check-in from processor run · observability · M. Shipped in #39 Liveness check-in for processor run (co-processor-live) #42 (f8f5534..fe0de17, FF, 18 commits, merged 2026-10-09 21:59:14Z), CI green on the PR head and the main push run (after re-runs through a Docker Hub outage: CI pulls redis:7.0.15 from Docker Hub unauthenticated; since #34 a Hub outage or rate limit blocks deploys #43). Deployed through the gate at 22:03:01Z, after the soak, so no heads-up was needed. Monitor co-processor-live 01M4H5FH3PTPGEB24XYQJ4NG7A (co-processor-live: Processor's liveness monitor (follows #24) status#29, 300/900/86400). Every trap was handled: the check-in runs off the loop with a timeout, and a hung Status doesn't delay a command (test); last_progress gating, so a wedged loop goes silent while the event loop stays up (test); the child is refused status-checkin-key (test, and live); the main unit loads the key. The live rehearsal was a PATCH to 60/0 agreed with Status instead of stopping the service; the operator confirmed both notices. Closing comment. Known limits: a broker outage counts as alive (backing_off is carried); failing every command doesn't page here; a wedge pages after about 30 min; the interval setting must track the monitor's. Follow-ups: none from the thread; the coordinator filed CI pulls redis:7.0.15 from Docker Hub unauthenticated; since #34 a Hub outage or rate limit blocks deploys #43.
• CI pulls redis:7.0.15 from Docker Hub unauthenticated; since #34 a Hub outage or rate limit blocks deploys #43 CI's Redis off anonymous Docker Hub · ci · S. Shipped in #43 fix: CI pulls redis:7.0.15 from mirror.gcr.io, not Docker Hub anonymously #44 (f36cebc, 2026-10-10 00:30Z) and #43 CR: the mirror's cache miss, docker:// steps, one parse #46 (CR fixes, e6febd3..2ecb9d4, 17:47Z), FF, CI green on both PR heads and both main push runs. No deploy (not runtime). Chose mirror.gcr.io/library/redis:7.0.15, not the brief's apt route: the same index digest as Hub, nothing else changes, and Watcher already does it. The traps the brief named for apt were the reason not to. A sweep test keeps every workflow image on the mirror. test job 3m14s → 2m44s; 577 → 580 tests passed. The main push run of e71f673 was red because of test_liveness flakes: a check-in thread can still be alive just after its tick returns #45's flake, not Docker Hub. Closing comments. Known limits: the mirror serves only cached tags, so the fallback is apt (named in ci.yml); the 7.0.15 pin now points at Redis 7.0 is upstream EOL (2024-07-29): decide the broker's next Redis broker#85. Follow-ups: test_liveness flakes: a check-in thread can still be alive just after its tick returns #45, Redis 7.0 is upstream EOL (2024-07-29): decide the broker's next Redis broker#85.
• test_liveness flakes: a check-in thread can still be alive just after its tick returns #45 The liveness test's in-flight race · test/bug · S. Shipped in #45 fix: liveness in-flight means the post hasn't returned, not that the thread is alive #48 (a39bb0d..2088d71, FF, 5 commits with the red test first, merged 2026-10-10 19:57:39Z), CI green on the PR head and the main push run. Deployed through the gate at 20:00:59Z. Fixed in code as the brief recommended: Heartbeat._in_flight is cleared by the thread once post returns and before call_soon_threadsafe, never by the timeout path (Liveness check-in for processor run (co-status monitor co-processor-live) #39's trap 1 kept, both halves tested). The race was reproduced deterministically, red then green, with no sleeps; a failed thread start doesn't wedge the heartbeat. 100/100 under CPU load. Live: liveness: on, first check-in 202, no WARNING. Closing comment. Follow-ups: none.
• Close out the cutover: spec §6 step 5 done, and re-decide D5 (lockstep pin, Watcher-generated goldens) now that Watcher doesn't extract #47 Close out the cutover · decision/docs · S–M. Shipped in #47: close out the cutover; D5 restated: Processor owns the pin; goldens from co-core directly #49 (2088d71..ab3ce5b, FF, 9 commits, merged 2026-10-10 23:26:19Z), CI green on the PR head and the main push run. No deploy (nothing runtime). Spec §6 steps 4 and 5 are done with links; D5 is restated (Processor owns the pin; Watcher only on contract changes, plus notice when processor_version moves); AGENTS.md lines 21 and 55 and the DEPLOYMENT bump procedure are rewritten. The generator was replaced in place (stdlib plus co_core.pure.extract only, enforced by an AST test) and reproduced all 13 of Watcher's v1 goldens byte for byte before anything was frozen; that stays as a standing test, with v1_provenance carried forward. Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29 and JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37 restated. Watcher notice posted (approved) on CannObserv/watcher#325. Closing comment. Follow-ups: none.
• Drift check-ins carry no metadata.fault: a change of kind inside one fault waits for the daily reminder #58 Drift check-ins carry metadata.fault · observability · S. Filed 2026-10-20 from Drift monitor for broker (co-broker / co-broker-drift) status#51 / #22 C6: broker-drift timer - live lagging origin/main alerts through co-status broker#110. Shipped in #58 Drift alerts carry metadata.fault; an ok sends none #59 (540975e..a1a9e91, FF, merged 2026-10-21T16:09:25Z), CI green by job (lint, test) on the PR run and the main push run. Deployed through the gate 2026-10-21T16:14:10Z (CI passed for a1a9e91ef684, then live -> a1a9e91ef684); starting has the build, 0.38.0+1, child_containment: required; NRestarts=0. Verdict.metadata() is {"fault": kind} on an alert, None on ok/silent; post_checkin adds the key only when given. Liveness body unchanged (its test passes as is). Drift runs ok/202 from the new release at 16:14Z, 17:15Z and 18:15Z. Test alert sent 17:50:16Z with the operator's approval: 202, arrival confirmed by the operator; coordinator confirmed the clearing ok at 18:15:35Z (202), which the closing comment hadn't seen. A follow-up note on Drift monitor for broker (co-broker / co-broker-drift) status#51 was posted 2026-10-21T18:42Z. Closing comment. Known limit: same-kind alerts with different bodies are one fault (intended). Follow-ups: none.
• Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57 The co-core bump rule: resolve_dispatch_essence is notice, not coordination · decision/docs + test · S. Filed 2026-10-20 from JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37. Shipped in #57 docs: a dispatch-essence change is notice, not coordination #60 (a1a9e91..359e102, FF, merged 2026-10-21T19:09:36Z) and review round 1 in #57 fix: CR round 1 — the escape clause names co-core's resolvers; readable guard ids #61 (..18deb3c, FF, merged 22:03:20Z), CI green by job (lint, test) on both PR runs and both main push runs. No deploy: only AGENTS.md, docs/ and tests/ changed; drift reads ok/202 with live at a1a9e91 (runtime unchanged). Four rule sites updated; §5 states the issuer-resolves premise once; history untouched; amendment entry 2026-10-21. Guard: tests/test_pin.py::test_processor_never_resolves_a_dispatch_essence (AST: imports, names, attributes), with a red shown on a planted import. Watcher notice posted with approval, edited after #57 fix: CR round 1 — the escape clause names co-core's resolvers; readable guard ids #61 to match. Closing comments: #60, #61. Known limit: a string-keyed getattr would evade the guard (deliberate evasion, not drift). Follow-ups: Replace the brainstorming override with a vendor symlink and an AGENTS.md preference #62.

Agent tooling

• Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5 Index on co-index's SocratiCode store · ops · M. Shipped in #5 SocratiCode on co-index's shared store #50 (ab3ce5b..b941173, FF, merged 2026-10-11T00:27Z), CI green on the PR head and the main push run. No deploy: nothing under the runtime paths changed (no MemoryLow=: cgroup2 has no memory_recursiveprot, so it would be inert; the threat is OOM, already covered by OOMScoreAdjust=-500 and the child's +1000). Operator installed the Qdrant key (64 chars, mode 600, git-ignored). Coordinator re-checked live: the running server is socraticode@1.16.0, codebase_health says Qdrant mode: external, and a linked search returned processor, watcher, replicator, archiver and broker. 1.16.0 reads the 1.14.0-format sibling collections (verified, was [stated]). The link stubs sit in plain directories under /home/exedev/, not sibling checkouts. Closing comment. Known limits: a 1.14.0 client that links processor reads zero rows (none does); the index is written from the main checkout only. Follow-ups: none.
• Adopt the coordinating-epics skill for #24 #52 Adopt the coordinating-epics skill for Burn-down: open issues after v1 go-live (done 2026-10-11; next: #62; parked: #54) #24 · agent tooling · S. Step 1 shipped in #52 chore: vendor coordinating-epics #53 (4b3a500, FF, merged 2026-10-15T15:47Z): skills/coordinating-epics and .claude/skills/coordinating-epics linked, docs/SKILLS.md inventory 12 → 13; the pointer reached fef0611 through the refresh hook's daily bump (98c5032). CI green by job (lint, test) on 4b3a500, PR and push runs. Coordinator checked: of the linked skills, only coordinating-epics changed across 5ff7a82..fef0611; the scripts resolve from .claude/skills/coordinating-epics/scripts. No runtime path, no deploy. Step 2, the adoption, is this write (2026-10-15, --adopt-live --lint-all, after the pre-flight decided the same day). Known limits: scan.sh reads CannObserv/cannobserv refs as 404 with this repo's token (checked by hand); v1 can't rename a heading or edit the intro paragraph.
• Replace the brainstorming override with a vendor symlink and an AGENTS.md preference #62 The brainstorming override becomes a vendor link plus an AGENTS.md preference · agent tooling · S · skills/brainstorming, AGENTS.md, docs/SKILLS.md, test comments. Filed 2026-10-21 from Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57's review: the override is a v6.4.2 fork, the vendor is v7.0.0 (rewritten; it adds builder-check-prompt.md), and v7 lets a stated preference set the design-doc path. Trap: v7 hands off to superpowers:writing-plans, which isn't linked here, so AGENTS.md must map it to this repo's writing-plans. No deploy. Next. Hand-off.

Parked (waiting on others)

• Become the cohort text-extraction processor: consume content.process, extract from one source_spec, store canonical text by hash, publish content.derived #1 Become the cohort text-extraction processor · umbrella. Closed 2026-10-10T23:27Z with evidence per requirement (closing): cutover 2026-10-06T21:35:24Z, soak passed 2026-10-09, Watcher's extraction deleted 2026-10-10 (Delete local extraction after #326's soak: the pipeline's extract path, the mode variable, the shadow leg and its columns, and the co-core[extract] extra watcher#350).
• Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21 Dead-letter give-ups publish dead_lettered · enhancement + co-core bump · M. Trigger fired 2026-10-17 (co-core v0.37.0 contains CannObserv/cannobserv#536). Shipped in #21 co-core 0.37.0: dead-lettered give-ups publish dead_lettered #55 (4b3a500..5829e4b, FF), CI green by job (lint, test) on the PR run and the main push run. Deployed through the gate 2026-10-17T23:08:51Z (CI passed for 5829e4b3a0aa, then live -> 5829e4b3a0aa); starting has the build, processor_version: 0.37.0+1, child_containment: required, liveness on; NRestarts=0. Catch-up 0.32.0 → 0.37.0 read in code: the contract types Processor uses are unchanged except the new Literal member. Goldens: 0 moved; real corpus unchanged. Watcher notice posted at 23:05:05Z, before the deploy (approved). Coordinator re-checked live: all 5 sources' first 0.37.0+1 digest equals their last 0.32.0+1 digest (F139). No dead-letter has fired since go-live. Harvest: Watcher shipped its processor-blaming route in Publish last_full_fetch_at, health_reason, health_status_code on info.watch-status watcher#370 (Route content.derived's dead_lettered to a processor-blaming failure, not the extraction-failure path (cannobserv#536) watcher#386 closed 2026-10-18), so dead_lettered now fails as a processor fault there. Closing comment. Known limits: dead_lettered is proven only on the scratch Redis; the handler's strike cap still reads extraction_error (upstream's scope). Follow-ups: none.
• Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29 Take co-core's XML and feed extractors · co-core bump · L. Re-entry met 2026-10-12 (cannobserv v0.32.0 contains CannObserv/cannobserv#523). Shipped in #29 co-core 0.32.0: XML and feed extractors, refusals as goldens #51 (415fa24..3b6f785, FF), CI green on the PR head and the main push run. Deployed through the gate 2026-10-12T18:33:51Z (CI passed for 3b6f785d4755, then live -> 3b6f785d4755); starting has the build, processor_version: 0.32.0+1, child_containment: required, liveness on; NRestarts=0. It was the catch-up too: 0.19.7 → 0.32.0, read in code and the CHANGELOG. The bus, stores, canonical_text, spec_fingerprint and both models are unchanged. The one contract change, resolve_dispatch_essence (.xml/.rss/.atom), was coordinated on CannObserv/watcher#366 (closed 18:00:10Z, before Processor's deploy), whose notice carried the new processor_version (D5). Parity: 16 cases added (feed, Atom, empty feed, generic XML, xpath on XML, and 10 refusals as {"refused": …} goldens); none of the 13 existing goldens moved; the feed golden equals co-core's pinned sha256:78e28497… (coordinator checked it's in goldens.json); real corpus 9/9. Live (coordinator's probe): the 4 existing sources gave the same digests as on 0.19.7, and the new Tailscale source's first command ack: complete. Closing comment. Follow-ups: none; CannObserv/cannobserv#557 will move refused_xpath_on_html at its bump.
• JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37 Take co-core's JsonExtractor, plus a jsonpath parity fixture · co-core bump · M. Trigger fired 2026-10-19 (cannobserv v0.38.0 contains CannObserv/cannobserv#354, CannObserv/cannobserv#557 and CannObserv/cannobserv#570). Shipped in #37 co-core 0.38.0: JsonExtractor, the jsonpath corpus #56 (9244fd0..540975e, FF, merged 2026-10-20T04:25:19Z), CI green by job (lint, test) on the PR run and the main push run. Deployed through the gate 2026-10-20T04:29:42Z (CI passed for 540975e10156, then live -> 540975e10156); starting has the build, processor_version: 0.38.0+1, child_containment: required; NRestarts=0. Catch-up 0.37.0 → 0.38.0 read in code: the content.process / content.derived models identical by AST. Goldens: exactly the 3 expected moved; renamed json_jsonpath / html_xpath, the fallback re-pointed at application/x-unknown; 8 cases added (the narrowing check json_jsonpath_titles, json_vnd_api, 4 refusals, html_ignore_selectors); real corpus 9/9 unchanged. python-jsonpath 2.2.2 runs in the contained child. Watcher notice posted at 04:25:10Z, before the deploy (pre-approved). Coordinator re-checked live: all 5 sources' first 0.38.0+1 digest equals their last 0.37.0+1 digest. Archiver notices after the live check: CannObserv/archiver#355, CannObserv/archiver#356, CannObserv/archiver#378; the Source specs: restore jsonpath and the json family once co-core has a JSON extractor (cannobserv#354) archiver#356 note corrects the brief (a no-match jsonpath is empty: true, confirmed at processors/extract.py:52). Harvest: Archiver bundled Source specs: let xpath target HTML once co-core honours it (cannobserv#557) archiver#355 and SourceSpec extraction: exclude selectors (ignore_selectors) to strip noise before extraction archiver#378 with the 0.38.0 bump about 2 h later (built, not shipped, 2026-10-21). Closing comment. Known limits: JSON not proven live (all items text/html); application/ld+json has no case of its own; ignore_selectors covered under full_page only. Follow-ups: Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57.
  • For Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29 and JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37 at re-entry: D5's lockstep rule ("during shadow, both move or neither does") and the parity goldens generated from Watcher's code both assume Watcher still extracts. Once Switch WATCHER_EXTRACT_MODE to processor: processor-decided apply path, flip, soak, delete local extraction and the co-core [extract] extra watcher#326 deletes the local path, re-decide with Watcher how a bump is checked, before planning either one. Resolved by Close out the cutover: spec §6 step 5 done, and re-decide D5 (lockstep pin, Watcher-generated goldens) now that Watcher doesn't extract #47 (2026-10-10): Processor owns the pin, goldens come from co-core directly.
• Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 Follow the broker to Valkey 7.2 · infra · S–M · CI image, BROKER_REDIS, the scratch server, 7.0.15-only claims, docs. Filed 2026-10-16 by the coordinator from Redis 7.0 is upstream EOL (2024-07-29): decide the broker's next Redis broker#85's decision (2026-10-15: Valkey 7.2.13 from Ubuntu's archive, after Revoke Watcher's content.fetch-policy publish grant broker#95; window not scheduled). Re-entry: the broker's post-window notice on Redis 7.0 is upstream EOL (2024-07-29): decide the broker's next Redis broker#85. Do nothing before it: a 7.0 aclfile refuses +client|setinfo, and CI on 7.2 would test an engine production doesn't run. Processor's client sends CLIENT SETINFO (redis-py default, consumer.py) [traced], so it needs the grant in the broker's window; answer posted with the operator's approval. Traps on the issue: no mirror.gcr.io/library/valkey (use mirror.gcr.io/valkey/valkey:7.2.13), and valkey-server's postinst migration on the scratch host (purge redis-server first).

How a check-in verifies a ship

1. The issue is closed and its PR merged to main (FF, never squashed).
2. CI is green on the merge commit and on origin/main's head, when docs-only commits came after it.
3. Since Contain the extraction child: it runs as the service user and can reach the service's secrets #2: cat /srv/processor/live/REVISION equals git -C ~/processor rev-parse --short=12 origin/main, and journalctl -t processor-deploy shows live -> <build>. For a docs-only change, live may lag, which is expected until A drift signal when live lags origin/main (status#12's drift check) #35 defines "runtime diff". (~/processor is the operator's clone; HEAD = origin/main there still matters for the skills hook's push.)
4. For a change under src/, deploy/, scripts/deploy.sh, pyproject.toml or uv.lock: systemctl show processor -p ActiveEnterTimestamp -p NRestarts shows a start after the deploy, 0 restarts, and the starting record has that build with child_containment: required.
5. Each "Done when" item has its evidence in the closing comment. Every "known limit" and "follow-up: none" gets a recorded answer.
6. The merged PR body is searched for follow-ups that weren't filed (follow-up|out of scope|not filed|deferred).

Verification debt

• No command has reached Processor through the real broker yet. Paid 18:39:37Z by 01M41H10MS8H92WXP2V8JTH0F0 (a match).
• NOPERM backoff shown only on scratch Redis. Paid 2026-10-04 by the rehearsal on the real broker (ACL user processor for the content.process consumer; retire observo's grants broker#75, f3783a1). OOM stays shown only on scratch Redis, by agreement: the cap refuses XADD for every participant.
• Processor reconnecting across a broker restart. Paid, see above.
• From Tailnet path to the broker: DERP-relayed at idle, direct only under traffic (NAT hairpin) — confirm it holds for the running service #15: a broker reboot is untested paid 2026-10-06T00:00Z by the broker's in-guest reboot (exe-init bug starts sessions at oom_score_adj -1000; replacement binary staged in /tmp broker#71): Processor reconnected without help. A hard reset of co-processor (exe.dev restart) with the unit installed is still untested, now with the Stage B unit.

Log

• 2026-10-03: Epic created over Become the cohort text-extraction processor: consume content.process, extract from one source_spec, store canonical text by hash, publish content.derived #1, Contain the extraction child: it runs as the service user and can reach the service's secrets #2, Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5, Tailnet path to the broker: DERP-relayed at idle, direct only under traffic (NAT hairpin) — confirm it holds for the running service #15, Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20 and Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21, plus Spec §6: the cross-repo notices never posted (replicator charter, archiver#179, cannobserv, observo token) #23, filed while building it: spec §6's unposted notices, which no issue tracked. Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20 got a "changed since filed" comment. Next: Tailnet path to the broker: DERP-relayed at idle, direct only under traffic (NAT hairpin) — confirm it holds for the running service #15.
• 2026-10-03T18:45Z: Tailnet path to the broker: DERP-relayed at idle, direct only under traffic (NAT hairpin) — confirm it holds for the running service #15 verified (#15 docs: the broker path holds through a co-processor reboot #25, 0a3a85e, CI green on the branch and main runs, unit clean after the reboot) and ticked. No new issues: #15 docs: the broker path holds through a co-processor reboot #25 is the PR, and its body names no unfiled follow-up. Watcher flipped to shadow at 18:36:30Z, which closed the window before shadow and fired Become the cohort text-extraction processor: consume content.process, extract from one source_spec, store canonical text by hash, publish content.derived #1's re-entry. Ranking unchanged. Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20's hand-off was posted. Next: Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20.
• 2026-10-03T18:50Z: The go-live round with Watcher (a Mayfly channel, closed 18:42Z, recorded on content.process issuer + content.derived consumer: process_commands, PROCESSING status, reaper, shadow comparator watcher#325 and Become the cohort text-extraction processor: consume content.process, extract from one source_spec, store canonical text by hash, publish content.derived #1): shadow on at 18:36:30Z, and the first real command matched. Outcome log records no digests: add input_digest, output_digest, size, empty and stored to every command outcome #26 was filed from that round (outcome logs have no digests) and slotted after Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20. Next: Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20.
• 2026-10-04T02:25Z: Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20 verified (#20 docs: spec §4 states Watcher's consumer rules #27, 525b263, CI green on both runs, docs only) and ticked. New: Consumer: a re-run at the cap after the failure fact went out re-extracts instead of dead-lettering #28 (from Spec §4: Watcher's consumer rules — first terminal fact per command_id wins; 24h expiry bounds a fact-less command #20's review) was decided (skip to the DLQ) and slotted after Outcome log records no digests: add input_digest, output_digest, size, empty and stored to every command outcome #26 as its own thread. Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29 (co-core's XML and feed extractors, a lockstep bump) was parked behind CannObserv/cannobserv#523 and Route extraction through co-core's dispatch table, so Watcher and Processor agree once XML and feed extractors land watcher#342, sized L because the release jumps 0.19.7 → ≥0.25. Shadow: 4/4 match. Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21 re-checked: still blocked. ACL user processor for the content.process consumer; retire observo's grants broker#75: no reply yet. Outcome log records no digests: add input_digest, output_digest, size, empty and stored to every command outcome #26's brief names a trap: store() can't report new vs no-op, so the recommendation is to drop the stored field. Next: Outcome log records no digests: add input_digest, output_digest, size, empty and stored to every command outcome #26.
• 2026-10-05T16:40Z: Outcome log records no digests: add input_digest, output_digest, size, empty and stored to every command outcome #26 verified (#26 feat: outcome records log the command's input and output digests #30, 3f39ca2, CI green, restart 15 s after the merge, live record at 16:39:02Z with the digests) and ticked. No new issues (#26 feat: outcome records log the command's input and output digests #30 is the PR). Probe: one WARNING, explained as the planned NOPERM rehearsal (passed, ACL user processor for the content.process consumer; retire observo's grants broker#75 closed). Spec §6: the cross-repo notices never posted (replicator charter, archiver#179, cannobserv, observo token) #23 narrowed (observo box answered; cannobserv row to re-read against CannObserv/cannobserv#503). Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29 still parked; Route extraction through co-core's dispatch table, so Watcher and Processor agree once XML and feed extractors land watcher#342 split. Consumer: a re-run at the cap after the failure fact went out re-extracts instead of dead-lettering #28's brief names a trap: _fact_out isn't "the give-up fact is out". Next: Consumer: a re-run at the cap after the failure fact went out re-extracts instead of dead-lettering #28.
• 2026-10-05T19:56Z: Consumer: a re-run at the cap after the failure fact went out re-extracts instead of dead-lettering #28 verified (#28 A refused dead-letter at the cap retries only the give-up #31, fc6ed4c, CI green, restart 10 s after the merge, healthy records since) and ticked. The brief's _fact_out trap was confirmed by a throwaway run. No new issues (#28 A refused dead-letter at the cap retries only the give-up #31 is the PR). Probe: clean. Re-reading Spec §6: the cross-repo notices never posted (replicator charter, archiver#179, cannobserv, observo token) #23's cross-repo references (New skill: burning-down-an-epic - a lightweight, interactive, operator-paced counterpart to orchestrating-issue-backlog gregoryfoster/skills#348 F86) shrank it from four notices to one post and one operator call. Next: Spec §6: the cross-repo notices never posted (replicator charter, archiver#179, cannobserv, observo token) #23, then Contain the extraction child: it runs as the service user and can reach the service's secrets #2.
• 2026-10-05T23:22Z: Spec §6: the cross-repo notices never posted (replicator charter, archiver#179, cannobserv, observo token) #23 verified (#23 docs: spec §6 — cross-repo rows' status, with links #32, 80165dd, CI green, docs only) and ticked; one approved post (Processing infrastructure for canonical derived artifacts — contract-first, leaning Observo (successor to replicator#69) archiver#179). No new issues. Probe: clean. Contain the extraction child: it runs as the service user and can reach the service's secrets #2's split was offered and declined (one PR); docker.socket off was pulled forward from Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5 after the host survey found the service user in group docker with the socket active. Contain the extraction child: it runs as the service user and can reach the service's secrets #2's brief names three traps (the deploy model, unix-socket connect, a derived allowlist). Next: Contain the extraction child: it runs as the service user and can reach the service's secrets #2, then Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5.
• 2026-10-06T00:02Z: Contain the extraction child: it runs as the service user and can reach the service's secrets #2's gate 1 done: docker.socket disabled and stopped by the coordinator, with the operator's authorization. /run/docker.sock refuses connections; processor unaffected. Next: Contain the extraction child: it runs as the service user and can reach the service's secrets #2.
• 2026-10-06T19:55Z: Contain the extraction child: it runs as the service user and can reach the service's secrets #2 verified (#2 Contain the extraction child #33, fe19a2b, CI green; Stage B installed 19:05:30Z; runs as processor from the release; 4 live commands match) and ticked. New: deploy.sh: gate a deploy on the commit's CI (status#11's CI gate) #34 (CI gate) and A drift signal when live lags origin/main (status#12's drift check) #35 (drift signal), Contain the extraction child: it runs as the service user and can reach the service's secrets #2's follow-ups, slotted in a new "deploy safety" tier ahead of Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5. The verify recipe's steps 3 and 4 were rewritten for releases. Probe: 3 WARNINGs explained as the broker's reboot (exe-init bug starts sessions at oom_score_adj -1000; replacement binary staged in /tmp broker#71), which also paid the broker-restart verification debt. Watch: Every grouped stream's producer can take delivery in its consumer's group and XACK the entry away broker#43 may narrow Processor's grant on content.derived (Processor only XADDs there); no ask yet. Next: deploy.sh: gate a deploy on the commit's CI (status#11's CI gate) #34, then A drift signal when live lags origin/main (status#12's drift check) #35, then Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5.
• 2026-10-06T23:00Z: deploy.sh: gate a deploy on the commit's CI (status#11's CI gate) #34 verified (#34 deploy.sh: gate a deploy on the commit's CI #36, 428af0e, CI green, deployed through its own gate, refusal shown) and ticked. Cutover: Watcher switched to processor at 21:35:24Z (87/87 shadow matches, a real change at 21:07:03Z); recorded on Become the cohort text-extraction processor: consume content.process, extract from one source_spec, store canonical text by hash, publish content.derived #1. The "before cutover" tier is complete, and the standing rule and probe were rewritten for production. New: JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37 (JSON extractor, lockstep) parked with Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29, plus a note that D5 needs re-deciding after Watcher's deletion. A drift signal when live lags origin/main (status#12's drift check) #35's alert channel decided: Status's job (a monitor, not healthchecks.io); no tailnet path to Status yet. Probe: clean. Next: A drift signal when live lags origin/main (status#12's drift check) #35, then Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5.
• 2026-10-07T21:36Z: A drift signal when live lags origin/main (status#12's drift check) #35 verified (#35 A drift signal through Status: processor drift, its hourly timer, deploy.sh installs every unit #38, aa1d4a0, CI green, deployed through the gate with the new units, Status monitor ok, test alert and rehearsal confirmed) and ticked. New: Liveness check-in for processor run (co-status monitor co-processor-live) #39 (liveness) slotted; Flaky: test_an_entry_that_raises_does_not_strand_the_ones_behind_it (0.6 s sleep against 500 ms idle), and since #34 a flake blocks deploys #40 filed by the coordinator (an unfiled flake that can block deploys since deploy.sh: gate a deploy on the commit's CI (status#11's CI gate) #34) and put next. Soak policy decided: deploys and short stops allowed, each with an approved heads-up on Switch WATCHER_EXTRACT_MODE to processor: processor-decided apply path, flip, soak, delete local extraction and the co-core [extract] extra watcher#326. Added a Milestones block (New skill: burning-down-an-epic - a lightweight, interactive, operator-paced counterpart to orchestrating-issue-backlog gregoryfoster/skills#348 F102). Probe: clean; drift runs ok. Next: Flaky: test_an_entry_that_raises_does_not_strand_the_ones_behind_it (0.6 s sleep against 500 ms idle), and since #34 a flake blocks deploys #40, then Liveness check-in for processor run (co-status monitor co-processor-live) #39, then Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5.
• 2026-10-08T16:21Z: Flaky: test_an_entry_that_raises_does_not_strand_the_ones_behind_it (0.6 s sleep against 500 ms idle), and since #34 a flake blocks deploys #40 verified (#40 test: deterministic reclaim test; sweep of timing margins in tests/ #41, f8f5534, CI green, tests only, no deploy) and ticked; the brief's diagnosis was confirmed by reproduction. Milestones: the soak is quiet (ends 2026-10-09T21:35Z), and Delete local extraction after #326's soak: the pipeline's extract path, the mode variable, the shadow leg and its columns, and the co-core[extract] extra watcher#350 waits on it. Processor decided three real changes alone during the soak (19:22Z, 19:29Z, 22:32Z on 2026-10-07): the evidence Watcher called strongest. Probe: clean; drift ok ×18. No new issues. Next: Liveness check-in for processor run (co-status monitor co-processor-live) #39, then Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5.
• 2026-10-10T00:15Z: Milestone: Watcher's soak passed (Switch WATCHER_EXTRACT_MODE to processor: processor-decided apply path, flip, soak, delete local extraction and the co-core [extract] extra watcher#326 closed 22:07Z); Become the cohort text-extraction processor: consume content.process, extract from one source_spec, store canonical text by hash, publish content.derived #1 now waits only on Delete local extraction after #326's soak: the pipeline's extract path, the mode variable, the shadow leg and its columns, and the co-core[extract] extra watcher#350. Liveness check-in for processor run (co-status monitor co-processor-live) #39 verified (#39 Liveness check-in for processor run (co-processor-live) #42, fe0de17, CI green, deployed through the gate after the soak, co-processor-live enabled, rehearsal confirmed) and ticked. New: CI pulls redis:7.0.15 from Docker Hub unauthenticated; since #34 a Hub outage or rate limit blocks deploys #43, filed by the coordinator from Liveness check-in for processor run (co-status monitor co-processor-live) #39's unfiled Docker Hub note (it blocks deploys since deploy.sh: gate a deploy on the commit's CI (status#11's CI gate) #34), put ahead of Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5 by the ordering rule. Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5's hand-off was posted first and then corrected to "after CI pulls redis:7.0.15 from Docker Hub unauthenticated; since #34 a Hub outage or rate limit blocks deploys #43". SocratiCode pin decided: 1.16.0. Probe (from Last probe): clean, 4 more processor-decided changes, drift and liveness ok. Next: CI pulls redis:7.0.15 from Docker Hub unauthenticated; since #34 a Hub outage or rate limit blocks deploys #43, then Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5.
• 2026-10-10T18:00Z: Milestone: Delete local extraction after #326's soak: the pipeline's extract path, the mode variable, the shadow leg and its columns, and the co-core[extract] extra watcher#350 closed (Watcher deleted local extraction); filed Close out the cutover: spec §6 step 5 done, and re-decide D5 (lockstep pin, Watcher-generated goldens) now that Watcher doesn't extract #47 (cutover close-out plus a D5 re-decision), which Become the cohort text-extraction processor: consume content.process, extract from one source_spec, store canonical text by hash, publish content.derived #1 now closes with. CI pulls redis:7.0.15 from Docker Hub unauthenticated; since #34 a Hub outage or rate limit blocks deploys #43 verified (#43 fix: CI pulls redis:7.0.15 from mirror.gcr.io, not Docker Hub anonymously #44 and #43 CR: the mirror's cache miss, docker:// steps, one parse #46, CI green, mirror chosen over apt with reasons) and ticked. New: test_liveness flakes: a check-in thread can still be alive just after its tick returns #45 (a liveness-test flake, red on main 3×) next; Close out the cutover: spec §6 step 5 done, and re-decide D5 (lockstep pin, Watcher-generated goldens) now that Watcher doesn't extract #47 after; Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5's hand-off re-slotted. Watch: Redis 7.0 is upstream EOL (2024-07-29): decide the broker's next Redis broker#85. Probe: a tailnet flap (02:26–04:12Z, both peers via the shared NAT) triaged with no command impact; a re-entry rule set. Next: test_liveness flakes: a check-in thread can still be alive just after its tick returns #45, then Close out the cutover: spec §6 step 5 done, and re-decide D5 (lockstep pin, Watcher-generated goldens) now that Watcher doesn't extract #47, then Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5.
• 2026-10-10T21:40Z: test_liveness flakes: a check-in thread can still be alive just after its tick returns #45 verified (#45 fix: liveness in-flight means the post hasn't returned, not that the thread is alive #48, 2088d71, CI green, deployed through the gate, liveness clean) and ticked. D5 decided (operator): Processor owns the co-core pin (Watcher only on contract changes, plus notice when processor_version moves), and goldens are regenerated from co-core directly; written into Close out the cutover: spec §6 step 5 done, and re-decide D5 (lockstep pin, Watcher-generated goldens) now that Watcher doesn't extract #47's hand-off. Measured: gen_parity_goldens.py imports Watcher code that Delete local extraction after #326's soak: the pipeline's extract path, the mode variable, the shadow leg and its columns, and the co-core[extract] extra watcher#350 deleted. No new issues. Probe: clean; no flap recurrence. Next: Close out the cutover: spec §6 step 5 done, and re-decide D5 (lockstep pin, Watcher-generated goldens) now that Watcher doesn't extract #47, then Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5.
• 2026-10-10T23:31Z: Close out the cutover: spec §6 step 5 done, and re-decide D5 (lockstep pin, Watcher-generated goldens) now that Watcher doesn't extract #47 verified (#47: close out the cutover; D5 restated: Processor owns the pin; goldens from co-core directly #49, ab3ce5b, CI green, no deploy; generator equivalence proven, 13/13) and ticked. Become the cohort text-extraction processor: consume content.process, extract from one source_spec, store canonical text by hash, publish content.derived #1 closed, ending the v1 umbrella. Watcher notified of the new D5. Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5's hand-off refreshed (facts unchanged; the key is still the gate). Noted: co-core is at v0.30.0 against our 0.19.7 pin; there's no issue for a catch-up bump, so the operator is asked. Probe: clean. Next: Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5, the last unparked item.
• 2026-10-10T23:36Z: Operator decisions: after Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5, Burn-down: open issues after v1 go-live (done 2026-10-11; next: #62; parked: #54) #24 becomes a parking lot (check-ins on triggers only); the co-core catch-up folds into the first of Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29/JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37 (noted on both).
• 2026-10-11T00:51Z: Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5 verified (#5 SocratiCode on co-index's shared store #50, b941173, CI green on both runs, no deploy, no MemoryLow=; SocratiCode 1.16.0 external, linked search across all five siblings) and ticked. The burn-down's last unparked item is done; Burn-down: open issues after v1 go-live (done 2026-10-11; next: #62; parked: #54) #24 is now a parking lot (Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21, Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29, JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37). No new issues (#5 SocratiCode on co-index's shared store #50 is Index processor on co-index's shared SocratiCode store (init-socraticode, STORE=external) #5's PR). Found while re-scanning: CannObserv/cannobserv#536 (Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21's ask, filed 2026-10-06) had never been linked from Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21 or the epic, and Route extraction through co-core's dispatch table, so Watcher and Processor agree once XML and feed extractors land watcher#342 had closed; both entries corrected, and Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21 told. co-core v0.31.0: no extract change. Probe: clean. Next: none until a trigger.
• 2026-10-12T19:33Z: Parking-lot check-in: Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29's trigger fired (cannobserv v0.32.0 contains CannObserv/cannobserv#523, 2026-10-12). Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29 verified (#29 co-core 0.32.0: XML and feed extractors, refusals as goldens #51, 3b6f785, CI green on both runs, deployed through the gate, processor_version 0.32.0+1) and ticked; the co-core catch-up is done with it. Watcher took 0.32.0 first (Take cannobserv v0.32.0 in step with Processor: resolve_dispatch_essence maps .xml/.rss/.atom to the XML essences watcher#366). No new issues (#29 co-core 0.32.0: XML and feed extractors, refusals as goldens #51 is Take co-core's XML and feed extractors in step with Watcher, and re-run parity with a feed fixture #29's PR). CannObserv/cannobserv#536 and CannObserv/cannobserv#354 missed v0.32.0, so Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21 and JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37 stay parked, each now its own bump. Probe: clean; the 4 existing sources gave the same digests across the bump. Next: none until a trigger.
• 2026-10-15T15:04Z: Parking-lot check-in, triggered by a new issue: Adopt the coordinating-epics skill for #24 #52 (adopt coordinating-epics, New skill: burning-down-an-epic - a lightweight, interactive, operator-paced counterpart to orchestrating-issue-backlog gregoryfoster/skills#348's v1). Slotted under Agent tooling as Next: step 1 (vendoring) goes to a thread; step 2 (the adoption) is this coordinator's next write. Dry-ran v1 against the live body, writing nothing: --lint-all finds 55 problems on 33 lines (48 short refs, 7 bare foreign numbers), and a header op can't make the paragraph header a list. Operator: pre-flight now. So this write, the last by the old protocol, put the header in the template's list (Last issue seen replaces Last number seen; Last probe's note and Last verified SHA are new) and wrote every cross-repo ref as owner/repo#N. Probe: 5 WARNINGs, all explained (Adopt the scheduled patching posture: commit .skills/patching-hosts, then run the first monthly patch (reworked from automatic updates) broker#67's patch run; one isolated read timeout on 2026-10-15); 3 real changes; co-core 0.33.0–0.35.1 cli-only. Added the broker's next patch window to Milestones. Next: Adopt the coordinating-epics skill for #24 #52 step 1.
• 2026-10-15T15:58Z: Adopt the coordinating-epics skill for #24 #52 step 1 verified (#52 chore: vendor coordinating-epics #53, 4b3a500, CI green by job on PR and push; only coordinating-epics changed among linked skills) and Burn-down: open issues after v1 go-live (done 2026-10-11; next: #62; parked: #54) #24 adopted onto coordinating-epics v1 in this call: --adopt-live --lint-all, cursors from scan.sh, a Protocol note in Parking-lot mode (a header op takes only cursor fields), Measured state replaced. From here every body edit goes through epic-edit.sh. Adopt the coordinating-epics skill for #24 #52 ticked; it closes after this read-back. Re-scan: #52 chore: vendor coordinating-epics #53 is Adopt the coordinating-epics skill for #24 #52's PR; no new issues. Parked triggers re-checked by hand (scan.sh can't read CannObserv/cannobserv): unchanged. Probe: clean. Next: none until a trigger.
• 2026-10-16T15:34Z: Parking-lot check-in, the operator asked for status. scan.sh: no commits, and no new issues except Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54, which this check-in filed. Redis 7.0 is upstream EOL (2024-07-29): decide the broker's next Redis broker#85 decided (Valkey 7.2.13): filed and parked Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 for Processor's post-window moves, and answered the broker's pre-window CLIENT SETINFO ask on Redis 7.0 is upstream EOL (2024-07-29): decide the broker's next Redis broker#85 with the operator's approval (Processor sends it, so it needs the grant). co-core v0.36.0 is cli-only. Probe: clean; …HHSAH9A's 4 new digests are real input changes. Next: none until a trigger.
• 2026-10-17T14:19Z: Parking-lot check-in: Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21's trigger fired (co-core v0.37.0 contains CannObserv/cannobserv#536; the operator reported it with a release comment on Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21). Verified against the CHANGELOG: the token is dead_lettered, scoped to publish_gave_up; Watcher's 0.32.0 decodes it (reason: str); Route content.derived's dead_lettered to a processor-blaming failure, not the extraction-failure path (cannobserv#536) watcher#386 holds Watcher's routing. Every parked item re-checked against the release: JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37's CannObserv/cannobserv#354 is not in it, and Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 is broker-side. scan.sh: no new issues, no commits. Probe: clean. Next: Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21, brief posted.
• 2026-10-19T03:17Z: Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21 verified (#21 co-core 0.37.0: dead-lettered give-ups publish dead_lettered #55, 5829e4b, CI green by job, deployed through the gate, 0.37.0+1; Watcher notified before the deploy; all 5 sources' digests unchanged across the bump, re-checked from the journal) and ticked. Harvest: Watcher already routes dead_lettered as a processor fault (Publish last_full_fetch_at, health_reason, health_status_code on info.watch-status watcher#370). scan.sh: #21 co-core 0.37.0: dead-lettered give-ups publish dead_lettered #55 is Dead-letter give-ups: adopt co-core 0.37.0's dead_lettered reason (cannobserv#536), with the 0.32.0 → 0.37.0 bump #21's PR; 10e167a is the daily skills bump. JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37's trigger is close (CannObserv/cannobserv#354 is next in cannobserv's order); a note on JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37 about Archiver's dependency. Probe: clean. Next: none until a trigger.
• 2026-10-20T03:43Z: JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37's trigger fired: cannobserv v0.38.0 (2026-10-19) contains CannObserv/cannobserv#354. The release comment on JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37 was checked against origin/main: its three moved goldens hold. Found one trap it missed (the generator's refused-flip test). Processor never calls resolve_dispatch_essence, so Watcher gets notice. Hand-off posted. scan.sh: no new issues; 9244fd0 is the daily skills bump. Probe: clean (31 ack: complete, drift ok ×24). Next: JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37.
• 2026-10-21T15:53Z: JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37 verified (#37 co-core 0.38.0: JsonExtractor, the jsonpath corpus #56, 540975e, CI green by job, deployed through the gate, 0.38.0+1; Watcher notified before the deploy; all 5 sources' digests unchanged, re-checked from the journal; Archiver notified after) and ticked. Harvest: Archiver bundled its 0.38.0 work within about 2 h. New: Drift check-ins carry no metadata.fault: a change of kind inside one fault waits for the daily reminder #58 (drift metadata.fault, from Drift monitor for broker (co-broker / co-broker-drift) status#51) slotted in Deploy safety and put next; Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57 (JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37's follow-up, the bump rule) after it. #37 co-core 0.38.0: JsonExtractor, the jsonpath corpus #56 is JSON: take co-core's JsonExtractor (cannobserv#354) and add a jsonpath parity fixture #37's PR. Probe: clean. Next: Drift check-ins carry no metadata.fault: a change of kind inside one fault waits for the daily reminder #58, then Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57.
• 2026-10-21T18:52Z: Drift check-ins carry no metadata.fault: a change of kind inside one fault waits for the daily reminder #58 verified (#58 Drift alerts carry metadata.fault; an ok sends none #59, a1a9e91, CI green by job, deployed through the gate; drift ok/202 ×3 from the new release; the approved test alert arrived and its clearing ok was confirmed by the coordinator) and ticked. Harvest: Archiver shipped its 0.38.0 bundle (Source specs: let xpath target HTML once co-core honours it (cannobserv#557) archiver#355, SourceSpec extraction: exclude selectors (ignore_selectors) to strip noise before extraction archiver#378). No new issues (#58 Drift alerts carry metadata.fault; an ok sends none #59 is Drift check-ins carry no metadata.fault: a change of kind inside one fault waits for the daily reminder #58's PR). Probe: clean. Next: Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57, the last open item; then parking lot (Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54).
• 2026-10-21T23:08Z: Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57 verified (#57 docs: a dispatch-essence change is notice, not coordination #60 and #57 fix: CR round 1 — the escape clause names co-core's resolvers; readable guard ids #61, 18deb3c, CI green by job on all four runs, docs/tests only so no deploy; Watcher notified with approval) and ticked. New: Replace the brainstorming override with a vendor symlink and an AGENTS.md preference #62 (Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57's review follow-up: the stale brainstorming override) slotted in Agent tooling and put next; hand-off names the superpowers:writing-plans trap. #57 docs: a dispatch-essence change is notice, not coordination #60 and #57 fix: CR round 1 — the escape clause names co-core's resolvers; readable guard ids #61 are Co-core bump rule: resolve_dispatch_essence is notice, not coordination #57's PRs. Probe: clean. Next: Replace the brainstorming override with a vendor symlink and an AGENTS.md preference #62, the last open item; then parking lot (Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54).