chore: planner run 2026-04-18

- Updated prerequisite tree: added Nomad+Vault orchestration (S0-S5 done),
  #982 engagement data loss, stuck issues section
- Created vault procurement for #758 (ops branch protection)
- Graph: 226 nodes, 223 edges

prerequisites.md

@@ -18,7 +18,7 @@ Status: DONE
 ## Objective: Foundation — Planner gap analysis against vision
 - [x] Planner formula exists (run-planner.toml v4)
 - [x] planner-run.sh cron wrapper exists
-- [x] Planning runs established and maintaining prerequisite tree (runs 1–3)
+- [x] Planning runs established and maintaining prerequisite tree (runs 1–4)
 Status: DONE
 
 ## Objective: Foundation — Multi-project support
@@ -29,7 +29,7 @@ Status: DONE
 ## Objective: Foundation — Knowledge graph for structural defect detection
 - [x] networkx package installed in agents container (#220 — closed)
 - [x] build-graph.py exists in lib/
-- [x] Graph report generating successfully (224 nodes, 251 edges as of 2026-04-17)
+- [x] Graph report generating successfully (226 nodes, 223 edges as of 2026-04-18)
 Status: DONE
 
 ## Objective: Foundation — Predictor-planner adversarial feedback loop
@@ -45,7 +45,7 @@ Status: DONE
 - [x] disinto init re-run stability (#158 — closed)
 - [x] disinto init repo creation API endpoint (#164 — closed)
 - [x] Prediction labels created during init (#225 — closed)
-- [x] Ops repo migration issue filed (#425 — closed, superseded by #820)
+- [x] Ops repo migration issue filed (#425 — closed)
 - [ ] Ops repo branch protection blocks remote writes (#758 — blocked, HUMAN_BLOCKED, blocked-on-vault vault/pending/disinto-ops-branch-protection.md)
 - [ ] Re-seed ops repo directories (#820 — backlog+priority, blocked on #758)
 Status: BLOCKED — #758 ops repo branch protection needs human admin action
@@ -58,18 +58,18 @@ Status: DONE
 
 ## Objective: Adoption — Nomad+Vault orchestration
 - [x] Step 0: Nomad+Vault installers (cluster-up.sh, install.sh, vault-init.sh, lib-systemd.sh)
-- [x] Step 1: Forgejo on Nomad (nomad/jobs/forgejo.hcl, deploy.sh, S1.3 wiring, S1.4 CI validation)
+- [x] Step 1: Forgejo on Nomad (forgejo.hcl, deploy.sh, S1.3 wiring, S1.4 CI validation)
 - [x] Step 2: Vault policies + secret import (S2.1–S2.6, plus fixes S2-A through S2-G)
-- [x] Step 3: Woodpecker on Nomad (S3.1–S3.4 jobspecs + OAuth + wiring, plus fixes S3-1 through S3-6)
-- [x] Step 4: Agents on Nomad (S4.1 agents.hcl with 7 roles + llama + vault-templated tokens, S4.2 --with agents wiring, plus fixes S4-1 through S4-5)
-- [ ] Step 5: Dispatcher Nomad backend + retire docker-compose dispatch (#981 — vision)
-Status: DONE (S0–S4 complete; S5 is Ship-milestone work, not Adoption-blocking)
+- [x] Step 3: Woodpecker on Nomad (S3.1–S3.4 + OAuth + wiring, plus fixes S3-1 through S3-6)
+- [x] Step 4: Agents on Nomad (S4.1 agents.hcl + S4.2 wiring, plus fixes S4-1 through S4-7)
+- [x] Step 5: Edge + staging + chat + vault-runner on Nomad (S5.1–S5.5, plus fixes S5-1 through S5-7)
+- [ ] S5 full cutover: dispatcher Nomad backend + retire docker-compose dispatch (#981 — vision)
+Status: READY — Steps 0–5 deployed; cutover to Nomad-only dispatch is vision-level design work
 
 ## Objective: Adoption — Landing page communicating value proposition
 - [x] Website addressable exists (disinto.ai)
 - [ ] Website observability — no engagement measurement (#426 — vision)
-- [ ] Engagement data pipeline non-functional — data collected but never committed (#982 — backlog+priority, blocked on #820)
-Status: BLOCKED — no evidence process connected to website; engagement pipeline broken
+Status: BLOCKED — no evidence process connected to website
 
 ## Objective: Adoption — Example project demonstrating full lifecycle
 - [ ] No example project exists (#697 — vision+priority)
@@ -81,7 +81,7 @@ Status: BLOCKED — depends on bootstrap completion and ops repo migration
 ## Objective: Ship (Fold 2) — Deploy profiles per artifact type
 - [ ] No deploy profiles defined
 - [x] CI pipeline working (Woodpecker OAuth fixed)
-- [x] Nomad jobspec infrastructure available (Steps 1–4 complete)
+- [x] Nomad jobspec infrastructure available (Steps 1–5 complete)
 Status: BLOCKED — not started, needs design (vision-level)
 
 ## Objective: Ship (Fold 2) — Vault-gated fold transitions
@@ -94,6 +94,7 @@ Status: BLOCKED — #758/#820 ops repo dirs needed for vault workflow
 ## Objective: Ship (Fold 2) — Engagement measurement baked into deploy pipelines
 - [ ] No engagement measurement exists
 - [ ] No observables yet (AGENTS.md confirms)
+- [ ] collect-engagement.sh data silently lost (#982 — backlog+priority)
 Status: BLOCKED — depends on deploy profiles + website observability (#426)
 
 ## Objective: Ship (Fold 2) — Rent-a-human for gated channels
@@ -105,12 +106,6 @@ Status: READY
 - [ ] No assumptions register exists
 Status: BLOCKED — not started
 
-## Objective: Ship (Fold 2) — Nomad S5 dispatcher cutover
-- [ ] Implement _launch_runner_nomad() in dispatcher (#981 — vision)
-- [ ] Implement _dispatch_sidecar_nomad() in dispatcher (#981 — vision)
-- [ ] End-to-end test before retiring docker-compose dispatch
-Status: BLOCKED — vision-level design decisions needed
-
 ## Objective: Learn (Fold 3) — Observable-driven planning
 - [ ] No observables exist yet
 Status: BLOCKED — depends on Ship milestone (engagement measurement)
@@ -122,3 +117,7 @@ Status: BLOCKED — depends on Ship milestone
 ## Objective: Learn (Fold 3) — Audience variation + signal detection
 - [ ] Requires observables
 Status: BLOCKED — depends on Ship milestone
+
+## --- STUCK ISSUES ---
+- #850 (Compose duplicate service detection) — 4+ consecutive ci_exhausted failures, needs human re-scope or different approach
+- #758 (Ops repo branch protection) — HUMAN_BLOCKED since 2026-04-08, vault procurement pending

vault/pending/disinto-ops-branch-protection.md

@@ -1,30 +1,33 @@
-# Request: Remove ops repo branch protection blocking agent writes
+# Request: Remove or relax ops repo branch protection for agent writes
 
 ## What
-The ops repo (disinto-ops) has branch protection rules on `main` that block all agent git pushes AND Forgejo API file commits. Agents need to write prerequisites.md, evidence files, vault items, and planner memory.
+The ops repo (`disinto-ops`) has branch protection on `main` that blocks all agent writes. `planner-bot` has push access but cannot merge. `review-bot` can approve but cannot push. No admin token is available to agents.
 
 ## Why
-Blocks #758 and #820, which block the entire Adoption milestone:
-- Evidence collection (predictor, planner, engagement)
-- Vault lifecycle workflow (pending/approved/fired directories)
-- Prerequisites.md updates (planner stuck at run 2 data since 2026-04-08)
-- RESOURCES.md creation
-- Engagement data persistence (#982)
-Waiting since 2026-04-08 (first identified in planner run 2).
+Blocks #758 (ops repo branch protection), which blocks:
+- #820 (re-seed ops repo directories) — vault lifecycle dirs, evidence dirs, portfolio.md, RESOURCES.md
+- Vault-gated fold transitions — vault/pending/, approved/, fired/ directories needed
+- All planner ops pushes — prerequisites.md frozen since run 2 (2026-04-08)
+- Evidence collection for all agents
+
+Waiting since 2026-04-08 (10 days). This is the single root blocker for the Adoption milestone.
 
 ## Human action
-1. Go to Forgejo admin: disinto-ops repo → Settings → Branches → Branch protection
-2. Either remove branch protection on main, OR add planner-bot/gardener-bot/predictor-bot to the whitelist
-3. Verify by running: `git push` from the planner container (or confirm agents can write via API)
+1. Go to Forgejo admin → `disinto-ops` repo → Settings → Branches → Branch protection for `main`
+2. Either:
+   a. Add `planner-bot` to the push/merge allowlist, OR
+   b. Remove branch protection from `disinto-ops` `main` entirely (ops repo is internal, not public-facing)
+3. Verify by pushing a test commit or confirming `planner-bot` can push
 
 ## Factory will then
-- #820: re-seed ops repo directories (evidence/, vault/pending/, vault/approved/, vault/fired/, vault/rejected/, portfolio.md, RESOURCES.md)
-- Planner will resume updating prerequisites.md each run
-- Engagement evidence will persist (#982)
-- Vault PR workflow will become operational
+- #758 auto-closes (dev-agent or planner detects push succeeds)
+- #820 picks up immediately (re-seed ops directories)
+- Planner pushes prerequisite tree, memory, and vault items to remote
+- Vault lifecycle workflow becomes operational
+- Evidence collection pipeline unblocks
 
 ## Unblocks
 - #758 — ops repo branch protection blocks all agent writes
 - #820 — re-seed ops repo directories
-- #982 — collect-engagement.sh data loss
-- #426 — website observability (downstream)
+- #697 — example project (transitively, via bootstrap verification)
+- Vault-gated fold transitions (Ship milestone)