chore: planner run 2026-04-17

- Updated prerequisite tree: Nomad+Vault orchestration (Steps 0–4) DONE
- #425 closed, #758 HUMAN_BLOCKED (ops repo branch protection)
- Created vault/pending/disinto-ops-branch-protection.md
- Created vault lifecycle directories (pending/, approved/, fired/, rejected/)
- Closed #947 (already fixed by #948)
- Graph: 224 nodes, 251 edges, healthy

RESOURCES.md

@@ -0,0 +1,5 @@
+# RESOURCES
+
+## Overview
+
+<!-- Add content here -->

knowledge/planner-memory.md

@@ -1,37 +1,28 @@
-<!-- summarized-through-run: 13 -->
+<!-- summarized-through-run: 2 -->
 # Planner Memory
-Last updated: 2026-04-17
+Last updated: 2026-04-08
 
 ## Run history
 - Run 1 (2026-04-05): First planning run. Established prerequisite tree from VISION.md.
-- Run 2 (2026-04-08): Foundation milestone completed. Triaged 4 predictions. Filed #425, #426.
-- Runs 3-12 (2026-04-12 to 2026-04-15): Maintained tree locally. Ops repo push blocked by #758 (branch protection). Nomad migration sprint filed and tracked. hire-an-agent bugs surfaced.
-- Run 13 (2026-04-17): Updated tree with Nomad migration and hire-an-agent objectives. Filed vault procurement for #758. Memory update (10 runs since last summary).
+- Run 2 (2026-04-08): Foundation milestone completed. All 5 blockers resolved. Triaged 4 predictor predictions (all actioned). Filed #425 (ops repo migration) and #426 (website observability). Focus shifted to Adoption milestone.
 
 ## Current constraint focus
-1. **Ops repo branch protection** (#758) — HUMAN_BLOCKED. All agent writes to ops repo frozen since 2026-04-08. Vault procurement filed (vault/pending/disinto-ops-branch-protection.md). Gardener flagged 2x. Root blocker for Adoption.
-2. **hire-an-agent defects** (#834 umbrella) — compose generator, TOML parser, collaborator setup, image rebuild (#887). Blocks multi-agent parallel operation. Multiple priority sub-issues in-progress.
-3. **issue_claim race** (#830) — verify assignee after PATCH to prevent duplicate work. Priority, in-progress.
-4. **Re-seed ops dirs** (#820) — blocked on #758. Once branch protection resolved, seeds vault/evidence/sprint dirs.
-5. **Website observability** (#426) — vision-level. No analytics on disinto.ai. Blocks Adoption landing page completion.
+1. **Ops repo migration** (#425) — existing deployments missing evidence/, sprints/, portfolio.md, RESOURCES.md, vault subdirs. Blocks evidence collection for all agents. Priority+backlog.
+2. **Website observability** (#426) — disinto.ai has no analytics/measurement. Blocks Adoption landing page and Ship engagement measurement. Vision-level (design decisions needed).
+3. **Example project** — none exists. Blocked on bootstrap verification after #425.
+4. **Deploy profiles** — not started. Vision-level design needed for per-artifact-type deployment.
+5. **Assumptions register** — not started. Ship (Fold 2) prerequisite.
 
 ## Patterns observed
-- #425 closed but effect blocked by #758 — code-level fix ≠ deployment-level fix. Pattern: migration code landing without the ops repo push path being verified.
-- Nomad migration is a major new initiative (step-0 through step-2, ~20 issues). Emerged organically from architect sprints. Not in original VISION.md milestones but supports Adoption (alternative backend).
-- hire-an-agent flow has cascading bugs: TOML parser → compose generator → entrypoint → collaborator setup. Each fix surfaces the next. Pattern: untested integration path now under first real multi-agent use.
-- Graph grew from 165→215 nodes, 137→259 edges. No cycles or bottlenecks. 11 orphans (benign: unused formulas/labels + orphan issue #843).
-- Predictor has been quiet — 0 unreviewed predictions in run 13. May indicate predictor hasn't run recently or all predictions were already triaged.
-- High dev velocity on Nomad work despite ops repo write freeze — work proceeds because it's in the code repo, not ops repo.
+- Foundation milestone completed in ~10 days (2026-03-28 to 2026-04-08). High bug fix velocity once dev-agent pipeline was reliable.
+- Predictor-planner loop working: predictor filed 4 accurate predictions, planner actioned all 4. The adversarial feedback catches stale state and planner drift effectively.
+- Predictor correctly identified planner filing Fold 2/3 vision issues (#418, #419) while Foundation was incomplete — planner must verify milestone completion before advancing.
+- Ops repo structural debt: setup_ops_repo() creates dirs for new repos but doesn't migrate existing ones. Pattern will recur with future schema changes.
+- No observables exist — all 4 addressables (website, repo, skill, github org) lack measurement. This is the fundamental gap between Adoption and Ship.
 
 ## Strategic direction
-- Foundation DONE. Adoption active with two new sub-objectives: Nomad backend and multi-agent operation.
-- **Critical path**: #758 (human action) → #820 (re-seed) → ops repo writes resume → evidence/vault/knowledge persistence.
-- Nomad migration is the largest active workstream but does NOT block other Adoption objectives. Track but don't gate on it.
-- hire-an-agent bugs are the main dev-pipeline constraint — until resolved, only single-agent operation is reliable.
-- Do NOT file Ship/Learn issues. Adoption has 3 blocked objectives and 2 in-progress workstreams.
-- After #758: immediately push accumulated ops state, then focus on example project (#697).
-
-## Lessons learned
-- Ops repo branch protection created a 9-day knowledge blackout (2026-04-08 to 2026-04-17). Container restart would lose all intermediate state. Vault procurement items for human-blocked constraints should be filed immediately, not deferred.
-- "Code fix merged" ≠ "deployed effect realized" — verify the push path, not just the code path.
-- Umbrella issues (#834) are useful for tracking cascading bug chains in integration paths.
+- Foundation DONE. Adoption is now the active milestone.
+- #425 is the single blocking issue — once ops repo dirs exist, evidence collection unblocks and bootstrap is complete.
+- After #425: focus on example project (demonstrates full lifecycle) and website observability (#426).
+- Do NOT file Ship/Learn issues until Adoption objectives show progress. Predictor will check.
+- Graph report is healthy: 165 nodes, 137 edges, no cycles, no bottlenecks. 7 orphans are benign (closed issues, unused formulas/labels).

portfolio.md

@@ -0,0 +1,5 @@
+# Portfolio
+
+## Overview
+
+<!-- Add content here -->

prerequisites.md

@@ -18,7 +18,7 @@ Status: DONE
 ## Objective: Foundation — Planner gap analysis against vision
 - [x] Planner formula exists (run-planner.toml v4)
 - [x] planner-run.sh cron wrapper exists
-- [x] Planning runs established and maintaining prerequisite tree
+- [x] Planning runs established and maintaining prerequisite tree (runs 1–3)
 Status: DONE
 
 ## Objective: Foundation — Multi-project support
@@ -29,7 +29,7 @@ Status: DONE
 ## Objective: Foundation — Knowledge graph for structural defect detection
 - [x] networkx package installed in agents container (#220 — closed)
 - [x] build-graph.py exists in lib/
-- [x] Graph report generating successfully (215 nodes, 259 edges as of 2026-04-17)
+- [x] Graph report generating successfully (224 nodes, 251 edges as of 2026-04-17)
 Status: DONE
 
 ## Objective: Foundation — Predictor-planner adversarial feedback loop
@@ -45,11 +45,10 @@ Status: DONE
 - [x] disinto init re-run stability (#158 — closed)
 - [x] disinto init repo creation API endpoint (#164 — closed)
 - [x] Prediction labels created during init (#225 — closed)
-- [x] Ops repo migration code landed (#425 — closed)
-- [ ] Ops repo branch protection blocks agent writes (#758 — open, HUMAN_BLOCKED, blocked-on-vault vault/pending/disinto-ops-branch-protection.md)
-- [ ] Re-seed ops repo directories on live deployment (#820 — open, blocked on #758)
-- [ ] issue_claim race — verify assignee after PATCH (#830 — open, priority)
-Status: BLOCKED — #758 ops repo branch protection requires human admin action
+- [x] Ops repo migration issue filed (#425 — closed)
+- [ ] Ops repo branch protection blocks remote writes (#758 — blocked, HUMAN_BLOCKED, blocked-on-vault vault/pending/disinto-ops-branch-protection.md)
+- [ ] Re-seed ops repo directories (#820 — backlog+priority, blocked on #758)
+Status: BLOCKED — #758 ops repo branch protection needs human admin action
 
 ## Objective: Adoption — Built-in Forgejo + Woodpecker CI
 - [x] Docker compose with Forgejo + Woodpecker
@@ -57,37 +56,13 @@ Status: BLOCKED — #758 ops repo branch protection requires human admin action
 - [x] WOODPECKER_HOST override fix (#178 — closed)
 Status: DONE
 
-## Objective: Adoption — Nomad deployment backend
-- [ ] --backend=nomad flag + stub (#821 — in-progress)
-- [ ] Nomad + systemd install (#822 — in-progress)
-- [ ] Vault install + auto-unseal (#823 — in-progress)
-- [ ] Orchestrator init (#824 — in-progress)
-- [ ] CI validation for nomad/vault artifacts (#825 — in-progress)
-- [ ] S0.1-fix: --backend swallowed as positional (#835 — in-progress)
-- [x] S0.2-fix: install.sh must install docker daemon (#871 — closed)
-- [ ] Nomad job forgejo.hcl (#840 — in-progress)
-- [ ] deploy.sh dependency-ordered job run (#841 — open)
-- [ ] Wire --with forgejo into init --backend=nomad (#842 — in-progress)
-- [ ] CI: nomad job validate (#843 — open, orphan in graph)
-- [ ] Vault policies + apply script (#879 — in-progress)
-- [ ] vault-import.sh (#880 — open)
-- [ ] Vault JWT auth + nomad workload identity (#881 — in-progress)
-- [ ] forgejo.hcl reads Vault secrets via template stanza (#882 — in-progress)
-- [ ] disinto init --import-env / --import-sops (#883 — in-progress)
-- [ ] CI: vault policy fmt + validate (#884 — backlog)
-- [ ] S2-fix bugs blocking step 2 verification (#912, #920-#922, #926, #928)
-Status: IN PROGRESS — step-0 through step-2 active, multiple S2 verification bugs
-
-## Objective: Adoption — Multi-agent parallel operation (hire-an-agent)
-- [ ] hire-an-agent + compose generator defects (#834 — in-progress, priority)
-- [ ] TOML agent section name with dash crashes load-project.sh (#862 — in-progress, priority)
-- [ ] hire-an-agent does not add collaborator (#856 — open, priority)
-- [ ] hire-an-agent TOML editor corrupts on re-run (#886 — open, priority)
-- [ ] entrypoint clone path vs TOML parse mismatch (#861 — open, priority)
-- [ ] Parametric llama bots via LLAMA_BOTS env (#831 — open, priority)
-- [ ] Generate one compose service per LLAMA_BOTS entry (#832 — backlog, priority)
-- [ ] Compose generator duplicate service name detection (#850 — blocked)
-Status: IN PROGRESS — multiple critical bugs in hire-an-agent flow
+## Objective: Adoption — Nomad+Vault orchestration
+- [x] Step 0: Nomad+Vault installers (cluster-up.sh, install.sh, vault-init.sh, lib-systemd.sh)
+- [x] Step 1: Forgejo on Nomad (nomad/jobs/forgejo.hcl, deploy.sh, S1.3 wiring, S1.4 CI validation)
+- [x] Step 2: Vault policies + secret import (S2.1–S2.6, plus fixes S2-A through S2-G)
+- [x] Step 3: Woodpecker on Nomad (S3.1–S3.4 jobspecs + OAuth + wiring, plus fixes S3-1 through S3-5)
+- [x] Step 4: Agents on Nomad (S4.1 agents.hcl with 7 roles + llama + vault-templated tokens, S4.2 --with agents wiring)
+Status: DONE
 
 ## Objective: Adoption — Landing page communicating value proposition
 - [x] Website addressable exists (disinto.ai)
@@ -95,20 +70,24 @@ Status: IN PROGRESS — multiple critical bugs in hire-an-agent flow
 Status: BLOCKED — no evidence process connected to website
 
 ## Objective: Adoption — Example project demonstrating full lifecycle
-- [ ] No example project exists (#697 — vision, priority)
-- [ ] Requires verified bootstrap (blocked on #758 → #820)
-Status: BLOCKED — depends on ops repo write access
+- [ ] No example project exists (#697 — vision+priority)
+- [ ] Requires verified bootstrap (blocked on #758/#820)
+Status: BLOCKED — depends on bootstrap completion and ops repo migration
+
+## --- ADOPTION MILESTONE: IN PROGRESS ---
 
 ## Objective: Ship (Fold 2) — Deploy profiles per artifact type
 - [ ] No deploy profiles defined
 - [x] CI pipeline working (Woodpecker OAuth fixed)
+- [x] Nomad jobspec infrastructure available (Steps 1–4 complete)
 Status: BLOCKED — not started, needs design (vision-level)
 
 ## Objective: Ship (Fold 2) — Vault-gated fold transitions
 - [x] Vault redesign complete (#73-#77 — all closed)
 - [x] Vault PR workflow documented (docs/VAULT.md)
-- [ ] Vault directories in ops repo (#820 — blocked on #758)
-Status: BLOCKED — #820 ops repo dirs needed for vault workflow
+- [x] Vault + Nomad integration (template stanzas, JWT auth, policies)
+- [ ] Vault lifecycle directories on remote ops repo (blocked on #758/#820)
+Status: BLOCKED — #758/#820 ops repo dirs needed for vault workflow
 
 ## Objective: Ship (Fold 2) — Engagement measurement baked into deploy pipelines
 - [ ] No engagement measurement exists

vault/pending/disinto-ops-branch-protection.md

@@ -1,29 +1,24 @@
 # Request: Remove or relax ops repo branch protection
 
 ## What
-The ops repo (`disinto-ops`) has branch protection on `main` that requires approvals, but no bot account has sufficient permissions to merge. Agents (planner, architect, supervisor) can commit locally but cannot push to remote.
+The `disinto-ops` repo has branch protection on `main` that requires approvals, but no bot account has merge permissions. All agent writes (prerequisites.md, planner-memory.md, vault items, evidence) have been accumulating locally only since planner run 2 (2026-04-08).
 
 ## Why
-Blocks #758, #820, and transitively all ops repo writes.
-- prerequisites.md has not been pushed since 2026-04-08 (run 2)
-- Vault pending items cannot be persisted
-- Sprint artifacts from architect are not pushed
-- Any container restart loses all ops repo state accumulated since 2026-04-08
-Waiting since 2026-04-15 (first gardener flag).
+Blocks #758, which blocks #820 (re-seed ops dirs), which blocks the vault lifecycle workflow, evidence collection, and planner remote persistence. The ops repo remote `main` has been frozen for 9 days.
 
 ## Human action
-1. In Forgejo, go to the `disinto-ops` repo → Settings → Branch Protection for `main`
-2. Either remove branch protection entirely (agents are the primary writers), OR add `planner-bot` to the merge whitelist
-3. Verify by pushing a test commit or confirming `planner-bot` can push directly
+1. Go to Forgejo admin: disinto-ops repo → Settings → Branches → Branch protection for `main`
+2. Either:
+   a. Add `planner-bot` to the push/merge allowlist, OR
+   b. Remove branch protection from `disinto-ops` entirely (ops repo is internal, not public-facing)
+3. Verify: `planner-bot` can push to `origin/main` on `disinto-ops`
 
 ## Factory will then
-- Push accumulated ops repo changes (prerequisites, memory, vault items, sprints)
-- Close #758 and #820
-- Re-seed missing vault directories (approved/, fired/, rejected/)
-- Resume persisting planner knowledge across container restarts
+- Close #758 (ops repo branch protection)
+- Execute #820 (re-seed ops dirs: vault/pending, vault/approved, vault/fired, vault/rejected, evidence/*, portfolio.md, RESOURCES.md)
+- Resume remote persistence of prerequisites.md and planner-memory.md
+- Unblock vault lifecycle workflow (pending → approved → fired)
 
 ## Unblocks
-- #758 — ops repo branch protection blocks all agent writes
-- #820 — re-seed ops repo directories
-- Vault workflow (pending/approved/fired/rejected lifecycle)
-- Evidence collection for all agents
+- #758 — bug: ops repo branch protection blocks all agent writes
+- #820 — fix: re-seed ops repo directories after branch protection resolved