chore: planner run 2026-04-17

- Updated prerequisite tree: #425 closed, added Nomad backend and
  hire-an-agent objectives, tracked S2 verification bugs
- Filed vault procurement for #758 (ops repo branch protection)
- Memory update (runs 3-13 summarized): constraint focus shifted to
  #758 root blocker and hire-an-agent cascading bugs

prerequisites.md

@@ -1,5 +1,5 @@
 # Prerequisite Tree
-<!-- Last updated: 2026-04-08 -->
+<!-- Last updated: 2026-04-17 -->
 
 ## Objective: Foundation — Core agent loop (dev → CI → review → merge)
 - [x] dev-agent picks up backlog issues (dev/dev-agent.sh exists)
@@ -18,7 +18,7 @@ Status: DONE
 ## Objective: Foundation — Planner gap analysis against vision
 - [x] Planner formula exists (run-planner.toml v4)
 - [x] planner-run.sh cron wrapper exists
-- [x] Planning runs established and maintaining prerequisite tree (run 1: 2026-04-05, run 2: 2026-04-08)
+- [x] Planning runs established and maintaining prerequisite tree
 Status: DONE
 
 ## Objective: Foundation — Multi-project support
@@ -29,7 +29,7 @@ Status: DONE
 ## Objective: Foundation — Knowledge graph for structural defect detection
 - [x] networkx package installed in agents container (#220 — closed)
 - [x] build-graph.py exists in lib/
-- [x] Graph report generating successfully (165 nodes, 137 edges as of 2026-04-08)
+- [x] Graph report generating successfully (215 nodes, 259 edges as of 2026-04-17)
 Status: DONE
 
 ## Objective: Foundation — Predictor-planner adversarial feedback loop
@@ -45,8 +45,11 @@ Status: DONE
 - [x] disinto init re-run stability (#158 — closed)
 - [x] disinto init repo creation API endpoint (#164 — closed)
 - [x] Prediction labels created during init (#225 — closed)
-- [ ] Ops repo migration for existing deployments (#425 — backlog+priority)
-Status: BLOCKED — #425 ops repo missing dirs on existing deployments
+- [x] Ops repo migration code landed (#425 — closed)
+- [ ] Ops repo branch protection blocks agent writes (#758 — open, HUMAN_BLOCKED, blocked-on-vault vault/pending/disinto-ops-branch-protection.md)
+- [ ] Re-seed ops repo directories on live deployment (#820 — open, blocked on #758)
+- [ ] issue_claim race — verify assignee after PATCH (#830 — open, priority)
+Status: BLOCKED — #758 ops repo branch protection requires human admin action
 
 ## Objective: Adoption — Built-in Forgejo + Woodpecker CI
 - [x] Docker compose with Forgejo + Woodpecker
@@ -54,15 +57,47 @@ Status: BLOCKED — #425 ops repo missing dirs on existing deployments
 - [x] WOODPECKER_HOST override fix (#178 — closed)
 Status: DONE
 
+## Objective: Adoption — Nomad deployment backend
+- [ ] --backend=nomad flag + stub (#821 — in-progress)
+- [ ] Nomad + systemd install (#822 — in-progress)
+- [ ] Vault install + auto-unseal (#823 — in-progress)
+- [ ] Orchestrator init (#824 — in-progress)
+- [ ] CI validation for nomad/vault artifacts (#825 — in-progress)
+- [ ] S0.1-fix: --backend swallowed as positional (#835 — in-progress)
+- [x] S0.2-fix: install.sh must install docker daemon (#871 — closed)
+- [ ] Nomad job forgejo.hcl (#840 — in-progress)
+- [ ] deploy.sh dependency-ordered job run (#841 — open)
+- [ ] Wire --with forgejo into init --backend=nomad (#842 — in-progress)
+- [ ] CI: nomad job validate (#843 — open, orphan in graph)
+- [ ] Vault policies + apply script (#879 — in-progress)
+- [ ] vault-import.sh (#880 — open)
+- [ ] Vault JWT auth + nomad workload identity (#881 — in-progress)
+- [ ] forgejo.hcl reads Vault secrets via template stanza (#882 — in-progress)
+- [ ] disinto init --import-env / --import-sops (#883 — in-progress)
+- [ ] CI: vault policy fmt + validate (#884 — backlog)
+- [ ] S2-fix bugs blocking step 2 verification (#912, #920-#922, #926, #928)
+Status: IN PROGRESS — step-0 through step-2 active, multiple S2 verification bugs
+
+## Objective: Adoption — Multi-agent parallel operation (hire-an-agent)
+- [ ] hire-an-agent + compose generator defects (#834 — in-progress, priority)
+- [ ] TOML agent section name with dash crashes load-project.sh (#862 — in-progress, priority)
+- [ ] hire-an-agent does not add collaborator (#856 — open, priority)
+- [ ] hire-an-agent TOML editor corrupts on re-run (#886 — open, priority)
+- [ ] entrypoint clone path vs TOML parse mismatch (#861 — open, priority)
+- [ ] Parametric llama bots via LLAMA_BOTS env (#831 — open, priority)
+- [ ] Generate one compose service per LLAMA_BOTS entry (#832 — backlog, priority)
+- [ ] Compose generator duplicate service name detection (#850 — blocked)
+Status: IN PROGRESS — multiple critical bugs in hire-an-agent flow
+
 ## Objective: Adoption — Landing page communicating value proposition
 - [x] Website addressable exists (disinto.ai)
 - [ ] Website observability — no engagement measurement (#426 — vision)
 Status: BLOCKED — no evidence process connected to website
 
 ## Objective: Adoption — Example project demonstrating full lifecycle
-- [ ] No example project exists
-- [ ] Requires verified bootstrap (#425)
-Status: BLOCKED — depends on bootstrap completion and ops repo migration
+- [ ] No example project exists (#697 — vision, priority)
+- [ ] Requires verified bootstrap (blocked on #758 → #820)
+Status: BLOCKED — depends on ops repo write access
 
 ## Objective: Ship (Fold 2) — Deploy profiles per artifact type
 - [ ] No deploy profiles defined
@@ -72,8 +107,8 @@ Status: BLOCKED — not started, needs design (vision-level)
 ## Objective: Ship (Fold 2) — Vault-gated fold transitions
 - [x] Vault redesign complete (#73-#77 — all closed)
 - [x] Vault PR workflow documented (docs/VAULT.md)
-- [ ] Vault directories complete in ops repo (#425 — approved/fired/rejected missing)
-Status: BLOCKED — #425 ops repo dirs needed for vault workflow
+- [ ] Vault directories in ops repo (#820 — blocked on #758)
+Status: BLOCKED — #820 ops repo dirs needed for vault workflow
 
 ## Objective: Ship (Fold 2) — Engagement measurement baked into deploy pipelines
 - [ ] No engagement measurement exists