# Incidents Completion

audience: AI coding agents first.

status: ACTIVE
worker: remote Composer 2.5 repair `b84h29w2j` implementing recoverable launch state machine in preserved WIP
task IDs: #179, #233, #234, #236
source request: Complete Incidents end-to-end. Replace the current stub with the requested full Incidents page redesign; restore canonical classification and abandoned database backfill; inventory every historical source; preserve and finish existing WIP instead of restarting; expose authoritative CLI/model/effort/account selectors; assemble incident-specific agent briefs and bounded similar-incident context; keep dispatch status authoritative; close every security defect; land, deploy, and browser-prove the page. The owner explicitly requested one full durable completion plan rather than chat-only detail. Owner correction 2026-08-10: page redesign is required and the current stub MUST NOT be treated as a completed UI. Owner recovery directive 2026-08-10: locate the exact owner-authored `/brainstorm` instructions and resulting Incidents specification; do not substitute an inferred redesign contract.

## Outcome

`/incidents` is deployed and browser-proven with complete historical records, canonical classification, required intake selectors, fail-closed remote dispatch, reconciled backfill, and focused security verdict.

## Acceptance criteria

- Replace the current stub with a complete, responsive Incidents workspace built from existing `@platform-modules/ui-primitives` and `@overdeck/deck-ui` components; no page-local primitive reinvention.
- The redesigned page exposes incident inventory, canonical type/status/priority, provenance and timestamps, intake/dispatch controls, dispatch progress/terminal result, and investigation/resolution context using honest authoritative data.
- Required fields and CLI/model/effort/account selectors use authoritative options.
- Every historical source is inventoried and reconciled.
- Backfill is idempotent, provenance-preserving, deterministic, and timestamp-preserving.
- Every incident has canonical classification or explicit unresolved state.
- Dispatch state remains authoritative from intake through terminal status.
- Focused security review has no unresolved ship blocker.
- Production page is browser-proven with honest data.
- Dispatch wraps owner text in an incident-specific base prompt: incident identity/priority, reproduce-before-fix, evidence-required closure, worktree isolation, install-before-land, result write-back, and file-it-or-open discipline.
- Agent can query all incidents through a bounded tool and receives concise similar-incident summaries with knowledge-base IDs, never unbounded history.
- Canonical type selects relevant maintained skill guidance (cluster, CPU/load, hooks, authentication, Factory, runtime/session, storage, networking, security); unknown type fails to generic incident discipline, never guessed specialist instructions.
- Resolution runs an incident-specific learn-from-mistakes flow that updates durable knowledge/skills only from verified evidence and records provenance.

## Preserved WIP

Worktree: `/home/user/Projects/overdeck/.worktrees/incidents-179-233-234`

- Contains lossless copy of 37-file `incident179-land` WIP.
- Newer base: `incident179-land` HEAD `7a7554140841` plus 37 uncommitted files.
- Older candidate chain: `efd273b4f` → `4584c4d2d`.
- Selector commit `f81da5b46831` is older than preserved WIP.
- WIP reportedly covers intake/dispatch/status lifecycle.
- Current owner-visible page is a stub; preserved WIP has not been proven to contain the requested full redesign.
- WIP does NOT establish canonical taxonomy, historical-source inventory, or DB backfill.
- Never rebuild from older commits until diff proves preserved WIP is not a superset.

## Constraints

- Preserve the 37-file WIP and prove semantic supersets before replacing any portion.
- Run builds/tests/browser workloads remotely; NEVER fall back to laptop-heavy execution.
- Ordinary dispatch MUST remain safe-only. Unsafe mode MUST require fresh authenticated server-side authority and fail closed at every service/route boundary.
- Owner text and retrieved incident history are untrusted data, never executable instructions.
- Dispatch MUST be idempotent and concurrency-safe; one incident/attempt launches at most one worker.
- Backfill MUST preserve source identity and timestamps, deduplicate deterministically, and be safe to rerun.
- Never invent taxonomy or historical-source semantics; recover authority from surviving evidence.
- Product code follows branch → verification → land → deploy; browser proof uses `e2e-remote`.
- Done means deployed, owner-visible, and reconciled—not merely coded or tested.

## Recovered authority

Canonical owner-involved design recovered at `docs/specs/2026-08-08-incidents-page-design.md` (introduced by `d7fc33ea`, status/conflicts amended by `7b79df9f`). Companion dispatch-intelligence authority is `docs/specs/2026-08-08-incident-brief-design.md` (introduced by `30b2ab69`, taxonomy coverage amended by `8342bc8a`). Sections 1–10 of the page spec declare themselves canonical; section 11 records built state and later conflict resolutions. Implementation MUST reconcile against these files, not reconstruct the redesign from memory.

The unrelated selector spec `specs/0592a6e6_incident-selector-completion.md` remains absent. Selector semantics must be reconciled against the recovered page spec, deployed adapter authority, preserved WIP, and owner-message corpus; never invented.

No completed incident-dispatch security verdict exists. Previous repair worker exited 3; capacity recovery is not a review verdict.

## Execution steps

1. Treat `docs/specs/2026-08-08-incidents-page-design.md` and `docs/specs/2026-08-08-incident-brief-design.md` as recovered authority; extract a spec-to-WIP coverage matrix before mutation.
2. Recover only the still-missing historical-source/backfill contract from authoritative evidence and record it here.
3. Reconcile all refs and 37-file WIP by semantic diff.
4. Implement the canonical responsive list/detail operations page—not a kanban board—with active/resolved sections, exact table columns, detail and filing drawers, stale/degraded states, responsive priorities, accessibility, and authoritative refresh behavior defined by page-spec §7.
5. Build the full Incidents workspace from registered platform/deck-ui components, including inventory, filters/classification, provenance, intake, dispatch lifecycle, investigation context, and resolution evidence.
6. Complete selectors/intake fields.
7. Implement canonical classification.
8. Implement idempotent backfill with provenance/timestamp/dedup contracts.
9. Reconcile counts per source and classification.
10. Build and test bounded all-incident lookup, similar-incident retrieval, typed skill selection, and evidence-gated knowledge updates.
11. Verify fail-closed dispatch: intake → persistence → base-prompt assembly → skill/context selection → worktree/systemd → argv → status.
12. Run focused security review over exact delta: authorization, idempotency, shell/argv injection, prompt injection, retrieved-incident data isolation, path/symlink/TOCTOU, secrets, remote-only failure.
13. Land, deploy, and browser-prove the redesigned page in both themes and responsive viewports.

## Current receipt

WIP preserved; current owner-visible page remains a stub. Exact owner-involved page and dispatch-brief specifications are recovered and identified above. Historical-source inventory, backfill proof, WIP-to-spec coverage matrix, and complete deployment remain absent.

First authorization patch added server-side permission-mode validation and reported focused tests 62/62. Independent review then confirmed five unresolved defects: concurrent dispatch can double-launch; hashless pre-existing Kanboard tasks can be adopted by UUID; missing options authority fails open on some filing/direct-service paths; dispatch request bodies are unbounded; incident type is not taxonomy-bound. Repair worker `b0jzcft1g` resumed the preserved WIP and reported closing all five across `incident-service.ts`, `server.ts`, and focused tests: shared incident mutation lock, provenance marker+title+description adoption, dispatch authority `503`, 64 KiB bounded body, taxonomy validation. Independent remote-only rerun `b0396j2zl` confirmed 78 pass/0 fail/256 assertions across four focused files. Fresh adversarial review rejected landing with four concrete blockers: process-local `mutationLocks` cannot serialize production requests because production creates a service per request; production `startServer` omits `loadIncidentOptions`, so mutation routes always return 503; orphan adoption permits inactive/resolved/non-Filed tasks without lifecycle provenance; dispatch does not revalidate persisted `incident_type` against fresh taxonomy. The 64 KiB byte bound passed review. Repair `bhl01n9ad` implemented a SQLite WAL `IncidentMutationStore` with durable leases and launch-claim CAS, production authority-loader wiring, lifecycle-restricted orphan adoption, and fresh dispatch-time taxonomy validation; added cross-instance and production-wiring regressions. Main-session authoritative remote verification `bhkh4q8ps` ran 51 tests: 49 passed, 2 failed. Focused repair `bz3lcvgvi` fixed both: tampered unsafe metadata rejects before authority loading, and `InvalidIncidentTypeError` is correctly imported/mapped. Those two fixes still need authoritative rerun. Independent review confirmed the other four repair areas but found one new High ship blocker: permanent launch claim can strand an incident if collector exits after claim, metadata write, or board move; retry generates a different UUID or rejects Dispatching state, so no runner can resume. Required fix is a recoverable phased launch state machine with canonical dispatch ID, holder lease/CAS renewal, and crash-injection tests after every side effect. Repair `b84h29w2j` is active. No repair commit, install, deployment, or browser proof yet.

## Next executable action

Consume `bz3lcvgvi` without overlapping mutations. Then implement recoverable phased launch state with canonical dispatch ID, holder-bound lease/CAS renewal, resume at each phase, and crash-injection regressions after claim/metadata/board move/start. Rerun focused and existing suites remotely and obtain a fresh independent security verdict before committing.