chore: planner run 2026-04-17

- Updated prerequisite tree: #425 closed, added Nomad backend and
  hire-an-agent objectives, tracked S2 verification bugs
- Filed vault procurement for #758 (ops repo branch protection)
- Memory update (runs 3-13 summarized): constraint focus shifted to
  #758 root blocker and hire-an-agent cascading bugs

vault/pending/disinto-ops-branch-protection.md

@@ -0,0 +1,29 @@
+# Request: Remove or relax ops repo branch protection
+
+## What
+The ops repo (`disinto-ops`) has branch protection on `main` that requires approvals, but no bot account has sufficient permissions to merge. Agents (planner, architect, supervisor) can commit locally but cannot push to remote.
+
+## Why
+Blocks #758, #820, and transitively all ops repo writes.
+- prerequisites.md has not been pushed since 2026-04-08 (run 2)
+- Vault pending items cannot be persisted
+- Sprint artifacts from architect are not pushed
+- Any container restart loses all ops repo state accumulated since 2026-04-08
+Waiting since 2026-04-15 (first gardener flag).
+
+## Human action
+1. In Forgejo, go to the `disinto-ops` repo → Settings → Branch Protection for `main`
+2. Either remove branch protection entirely (agents are the primary writers), OR add `planner-bot` to the merge whitelist
+3. Verify by pushing a test commit or confirming `planner-bot` can push directly
+
+## Factory will then
+- Push accumulated ops repo changes (prerequisites, memory, vault items, sprints)
+- Close #758 and #820
+- Re-seed missing vault directories (approved/, fired/, rejected/)
+- Resume persisting planner knowledge across container restarts
+
+## Unblocks
+- #758 — ops repo branch protection blocks all agent writes
+- #820 — re-seed ops repo directories
+- Vault workflow (pending/approved/fired/rejected lifecycle)
+- Evidence collection for all agents