type: meta

base_branch: origin/main

gate0_mode: strict

preset: cursor-only

land_mode: merge-to-main


type: goal

text: Offload Phase-3 post-land operations: O1 shared Bearer provisioning, O2 controller live on laptop, O3 live spine hooks in ~/.claude, O4 debian1 watchdog, O5 deck E2E acceptance. Sequential live ops after offload-phase2 landed.


type: methodology

text: Operational acceptance only — repo code already on origin/main. Execute O1-O5 in order per docs/plans/2026-07-20-offload-phase2.md §Post-land. Record outcomes in docs/plans/offload-phase3-run-record.md. cursor-only preset; land via frozen ship.sh merge-to-main.


type: intent

text: Close the live-infra gap between landed Phase-2 code and a running control plane the deck can observe and act on.


type: direction

verbatim: continue to phase 3 after offload-phase2 land; use runplan only; follow through like phase 2


type: task

seat: coder

tier: medium

desc: Read docs/plans/2026-07-21-offload-phase3.md Task O1 and docs/plans/2026-07-20-offload-phase2.md §O1. Provision shared Bearer: verify laptop $HOME/.config/overdeck/token non-empty mode 0600; copy once to debian1 $HOME/.config/overdeck/token via ssh -p 2222 -i ~/.ssh/id_ed25519_buildbox; remote mode 0600; compare sha256sum local vs remote (never print token). Append outcome to docs/plans/offload-phase3-run-record.md. Acceptance: test -f token && stat -c '%a' token = 0600 locally; same remotely; sha256 match.

verify: test -f "$HOME/.config/overdeck/token" && [ "$(stat -c '%a' "$HOME/.config/overdeck/token")" = 0600 ]


desc: Read docs/plans/2026-07-21-offload-phase3.md Task O2 and phase-2 §O2. git -C $HOME/.local/share/overdeck/deploy fetch --quiet origin && git -C $HOME/.local/share/overdeck/deploy checkout --quiet --detach origin/main; bash $HOME/.local/share/overdeck/deploy/packaging/deploy-local.sh; systemctl --user enable overdeck-controller.service. Verify curl health 200 with Bearer, 401 without. Record in offload-phase3-run-record.md.

verify: curl -fsS -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $(cat "$HOME/.config/overdeck/token")" http://127.0.0.1:8787/health | grep -qx 200

acceptance: deck offload panels no longer show `controller-down` within one poll cycle


desc: Read docs/plans/2026-07-21-offload-phase3.md Task O3 and phase-2 §O3 (full contract + executable verification). Mandatory backup remote-build.mjs.pre-phase2-<epoch>. Hand-apply hooks to ONLY ~/.claude/lib/remote-build.mjs per manifest. Run phase-2 O3 executable verification block and fault scenarios on debian1+debian2. Record backup path+sha256 and pass/fail in offload-phase3-run-record.md.

verify: awk '/^## O3 verification log/{f=1;next} /^## /{f=0} f' docs/plans/offload-phase3-run-record.md | grep -q '| PASS |'

acceptance: O3 executable verification block exits 0

acceptance: controller stop/restart fail-open test passes


desc: Read docs/plans/2026-07-21-offload-phase3.md Task O4 and phase-2 §O4. Use OVERDECK_WATCHDOG_WEBHOOK_URL from env (never commit). Provision debian1 watchdog.json mode 0600; run deploy-watchdog.sh from deploy clone. Verify tunnel+watchdog active; heartbeat via 127.0.0.1:18787; tunnel stop triggers exactly one ntfy page per target. Record in offload-phase3-run-record.md.

verify: awk '/^## O4 verification log/{f=1;next} /^## /{f=0} f' docs/plans/offload-phase3-run-record.md | grep -q '| PASS |'

acceptance: ntfy pages received on tunnel stop (exactly one per target)


desc: Read docs/plans/2026-07-21-offload-phase3.md Task O5 and phase-2 §O5. Deck /ci shows live offload panels. Pick available host from authenticated /status. box-drain from deck → verify host ineligible; box-restore → available again. Commit docs/plans/offload-phase3-run-record.md with host + outcomes.

verify: awk '/^## O5 verification log/{f=1;next} /^## /{f=0} f' docs/plans/offload-phase3-run-record.md | grep -q '| PASS |'

acceptance:
drain blocks dispatch
restore returns host available/eligible
run record committed