chore: gardener housekeeping 2026-04-19

AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # Disinto — Agent Instructions
 
 ## What this repo is

architect/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # Architect — Agent Instructions
 
 ## What this agent is

dev/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # Dev Agent
 
 **Role**: Implement issues autonomously — write code, push branches, address

gardener/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # Gardener Agent
 
 **Role**: Backlog grooming — detect duplicate issues, missing acceptance

gardener/dust.jsonl

@@ -0,0 +1 @@
+{"issue":850,"group":"lib/generators.sh","title":"compose dup-detection smoke CI failures","reason":"4+ consecutive ci_exhausted failures across PRs #872 #908 #971; planner flagged for human re-scope","ts":"2026-04-19T00:00:00Z"}

gardener/pending-actions.json

@@ -1 +1,42 @@
-[]
+[
+  {
+    "action": "edit_body",
+    "issue": 1025,
+    "body": "## Goal\nVerify that Forgejo, Woodpecker, and chat all function correctly when served\nunder /forge/, /ci/, and /chat/ subpaths on a single domain. Catch redirect\nloops, OAuth callback failures, and asset 404s before they hit production.\n\n## Sprint\nPart of sprint [edge-subpath-chat](https://forgejo:3000/disinto-admin/disinto-ops/pulls/37) — vision issue #623.\n\n## Acceptance criteria\n- [ ] Forgejo login at /forge/ completes without redirect loops\n- [ ] Forgejo OAuth callback for Woodpecker succeeds under subpath\n- [ ] Woodpecker dashboard loads all assets at /ci/ (no 404s on JS/CSS)\n- [ ] Chat OAuth login flow works at /chat/login\n- [ ] Forward_auth on /chat/* rejects unauthenticated requests with 401\n- [ ] Staging content loads at /staging/\n- [ ] Root / redirects to /forge/\n- [ ] CI pipeline added to .woodpecker/ to run this test on edge-related changes\n\n## Affected files\n- `nomad/jobs/edge.hcl` — edge Caddy routing config under test\n- `docker/edge/` — edge container and Caddyfile template\n- `tools/edge-control/register.sh` — route registration\n- `.woodpecker/` — CI pipeline for edge smoke test\n\n## Dependencies\nNone — first issue in sprint.\n"
+  },
+  {
+    "action": "add_label",
+    "issue": 1025,
+    "label": "backlog"
+  },
+  {
+    "action": "edit_body",
+    "issue": 1026,
+    "body": "## Goal\nReplace the blocking one-shot claude --print invocation in the chat backend with\na WebSocket connection that streams tokens to the UI as they arrive.\n\n## Sprint\nPart of sprint [edge-subpath-chat](https://forgejo:3000/disinto-admin/disinto-ops/pulls/37) — vision issue #623.\n\n## Acceptance criteria\n- [ ] /chat/ws endpoint accepts WebSocket upgrade with valid session cookie\n- [ ] /chat/ws rejects upgrade if session cookie is missing or expired\n- [ ] Chat backend streams claude output over WebSocket as text frames\n- [ ] UI renders tokens incrementally as they arrive\n- [ ] Rate limiting still enforced on WebSocket messages\n- [ ] Caddy proxies WebSocket upgrade correctly through /chat/ws with forward_auth\n\n## Affected files\n- `docker/chat/server.py` — chat backend WebSocket endpoint\n- `docker/chat/ui/` — frontend WebSocket client rendering\n- `nomad/jobs/edge.hcl` — Caddy WebSocket proxy config\n- `nomad/jobs/chat.hcl` — chat Nomad job\n\n## Dependencies\n- Depends on #1025 — subpath routing smoke test\n"
+  },
+  {
+    "action": "add_label",
+    "issue": 1026,
+    "label": "backlog"
+  },
+  {
+    "action": "edit_body",
+    "issue": 1027,
+    "body": "## Goal\nGive the chat container Claude session read-write access to the project working\ntree so the operator can inspect, explain, or modify code — scoped to that tree\nonly, with no access to factory internals, secrets, or Docker socket.\n\n## Sprint\nPart of sprint [edge-subpath-chat](https://forgejo:3000/disinto-admin/disinto-ops/pulls/37) — vision issue #623.\n\n## Acceptance criteria\n- [ ] Chat container bind-mounts the project working tree as a named volume\n- [ ] Claude invocation in server.py sets cwd to the workspace directory\n- [ ] Claude permission mode is acceptEdits (not bypassPermissions)\n- [ ] verify-chat-sandbox.sh updated to assert workspace mount exists\n- [ ] Compose generator adds the workspace volume conditionally\n\n## Affected files\n- `docker/chat/server.py` — Claude invocation and cwd setup\n- `tools/edge-control/verify-chat-sandbox.sh` — sandbox verification\n- `lib/generators.sh` — Compose generator workspace volume\n- `nomad/jobs/chat.hcl` — chat container bind-mount config\n\n## Dependencies\n- Depends on #1025 — subpath routing smoke test\n"
+  },
+  {
+    "action": "add_label",
+    "issue": 1027,
+    "label": "backlog"
+  },
+  {
+    "action": "edit_body",
+    "issue": 1028,
+    "body": "## Goal\nIf the smoke test reveals unfixable subpath issues, automate the pivot to\nper-service subdomains so the switch is a single config change.\n\n## Sprint\nPart of sprint [edge-subpath-chat](https://forgejo:3000/disinto-admin/disinto-ops/pulls/37) — vision issue #623.\n\n## Acceptance criteria\n- [ ] generators.sh _generate_caddyfile_impl accepts EDGE_ROUTING_MODE env var\n- [ ] In subdomain mode, Caddyfile emits four host blocks per edge-routing-fallback.md\n- [ ] register.sh registers additional subdomain routes when EDGE_ROUTING_MODE=subdomain\n- [ ] OAuth redirect URIs in ci-setup.sh respect routing mode\n- [ ] .env template documents EDGE_ROUTING_MODE with a comment referencing the fallback doc\n\n## Affected files\n- `lib/generators.sh` — _generate_caddyfile_impl routing mode switch\n- `tools/edge-control/register.sh` — subdomain route registration\n- `lib/ci-setup.sh` — OAuth redirect URI handling\n- `projects/*.toml.example` — .env template documentation\n\n## Dependencies\n- Depends on #1025 — subpath routing smoke test\n"
+  },
+  {
+    "action": "add_label",
+    "issue": 1028,
+    "label": "backlog"
+  }
+]

lib/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # Shared Helpers (`lib/`)
 
 All agents source `lib/env.sh` as their first action. Additional helpers are

nomad/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # nomad/ — Agent Instructions
 
 Nomad + Vault HCL for the factory's single-node cluster. These files are

planner/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # Planner Agent
 
 **Role**: Strategic planning using a Prerequisite Tree (Theory of Constraints),

predictor/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # Predictor Agent
 
 **Role**: Abstract adversary (the "goblin"). Runs a 2-step formula

review/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # Review Agent
 
 **Role**: AI-powered PR review — post structured findings and formal

supervisor/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # Supervisor Agent
 
 **Role**: Health monitoring and auto-remediation, executed as a formula-driven

vault/policies/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- last-reviewed: 3fb2de4a8ab500707665adfbf954aa1921ae7775 -->
+<!-- last-reviewed: a467d613a44b9b475a60c14c4162621e846969ea -->
 # vault/policies/ — Agent Instructions
 
 HashiCorp Vault ACL policies for the disinto factory. One `.hcl` file per