# AWP GOLIVE v1 — ChatGPT Work handoff

Updated: 2026-08-21

## Purpose

This is the durable handoff for moving the active AWP implementation conversation into ChatGPT Work without losing execution context. Continue this exact branch/worktree and do not restart planning or reopen completed lanes.

## Repository and active worktree

- Repository: `/home/user/Projects/awp`
- Active implementation branch: `impl/golive-v1`
- Active worktree: `/home/user/Projects/.worktrees/awp-golive-v1`
- Branch base at handoff: `origin/main@993c368f273c1d09e90af0ed3685522775e874ba`
- Tests/builds must run on buildboxes (`debian1`, `debian2`, `debian3`) via the established `run-remote` path. Do not run test/build workloads on the workstation.
- No subagents. This conversation/root thread is the implementor and coordinator.

## Completed convergence before this branch

The earlier lane program is complete at its owned boundaries and already landed. Do not recreate or reopen these lanes unless a GOLIVE failure proves a narrow defect.

- C1 / Lane A core contracts landed in PR #12.
- FIRE evidence landed in PR #13.
- C1.x provider-neutral contracts landed in PR #16, squash commit `63189993739f9983395fee787f255c38363460a3`.
- Lane C execution/lockfile convergence landed in PR #15.
- Lane B provider convergence landed in PR #14.
- Shared authoritative I1 detail read models landed in PR #17.
- Lane D U1–U6 authoritative UI integration landed in PR #18.
- `origin/main` at the start of GOLIVE work is `993c368f273c1d09e90af0ed3685522775e874ba`.

The binding completion metric is now repository-root `GOLIVE.md`, not lane completion. Do not declare v1 complete until its acceptance suite is implemented and passes end-to-end in a fresh environment.

## Current GOLIVE implementation state

The current branch is converting the already-landed domain/provider/UI pieces into a real runnable product with PostgreSQL-backed control-plane APIs and later real K3s execution/dogfood.

### Domain / persistence changes implemented in WIP

1. `Project` now has a canonical persisted `repositoryUrl`.
2. `ChangeSet` now has persisted `diff` content.
3. `PlanStatus` has an explicit `approved` state.
4. `Task` now has a persisted deterministic `position` so creation/queue order is not inferred from PostgreSQL row order.
5. Added relational `task_dependencies` persistence in addition to the Task projection.
6. PostgreSQL repository mapping has been updated for Project repository URL, ChangeSet diff, Task position, and dependency rows.
7. Drizzle migrations have been generated:
   - `packages/persistence/drizzle/0002_glamorous_vertigo.sql`
     - `projects.repository_url`
     - `change_sets.diff`
     - `task_dependencies`
   - `packages/persistence/drizzle/0003_massive_mastermind.sql`
     - `tasks.position`

### Application lifecycle service implemented in WIP

New file: `packages/application/src/golive.ts`

`I1LifecycleService` currently provides transactional operations for:

- Project creation with validated repository URL.
- ProjectVision version creation/supersession.
- Goal creation with required written success criteria.
- Plan creation with at least 3 Tasks.
- Durable hard-dependency creation with existing DAG/cycle validation.
- Plan approval and recalculation of Task readiness from dependencies.
- Authoritative Project hierarchy reads.
- Business event + audit record + outbox write in the same transaction as each mutation.

Important invariant: invalid dependency cycles are rejected before invalid persistence.

### PostgreSQL runtime implemented in WIP

`packages/persistence/src/database.ts` now has a `createPostgresRuntime()` abstraction with:

- migration execution using Drizzle;
- PostgreSQL health probe;
- migration applied/pending/drift inspection against `drizzle.__drizzle_migrations`;
- clean runtime shutdown;
- the canonical `PostgresUnitOfWork`.

### Hono control-plane implemented in WIP

New files:

- `apps/control-plane/src/app.ts`
- `apps/control-plane/src/server.ts`

The Hono application currently exposes:

- `GET /health`
- `POST /internal/projects`
- `GET /internal/projects/:projectId`
- `POST /internal/projects/:projectId/vision`
- `POST /internal/projects/:projectId/goals`
- `POST /internal/projects/:projectId/plans`
- `POST /internal/projects/:projectId/tasks/:taskId/dependencies`
- `POST /internal/projects/:projectId/plans/:planId/approve`

The HTTP boundary creates owner authority internally rather than trusting arbitrary caller-supplied Principal/capability headers.

Structured dependency errors are mapped to HTTP errors, including a cycle conflict payload for `DependencyCycleError`.

`apps/control-plane/src/server.ts`:

- requires `DATABASE_URL`;
- applies migrations on startup;
- composes `I1LifecycleService` against PostgreSQL;
- exposes migration status in `/health`;
- runs via `@hono/node-server`;
- shuts down the HTTP server and database client cleanly.

The control-plane package now includes `@awp/persistence`, `hono@4.9.7`, and `@hono/node-server@1.19.1`.

## Validation already performed

All test/build execution below ran on authorized buildbox `debian1`; no test/build workload was run on the workstation.

Before the latest Task-position change:

- frozen install: PASS
- workspace typecheck: PASS
- focused regression: trusted merge 2/2 PASS, I1 detail models 5/5 PASS, PostgreSQL integration 4/4 PASS (11/11 total)

After adding the PostgreSQL runtime and Hono server:

- `CI=true pnpm install --frozen-lockfile`: PASS
- full workspace `pnpm typecheck`: PASS

The first typecheck exposed one migration-status row-typing defect in `packages/persistence/src/database.ts`; that was fixed and the full workspace typecheck then passed.

### Important validation gap at this handoff

After adding `Task.position` and generating `0003_massive_mastermind.sql`, the full test suite and GOLIVE integration tests have **not yet been rerun**. Do not treat the branch as green until this is done.

## Exact current filesystem/Git state at handoff

At handoff, the branch contains uncommitted WIP derived from `origin/main@993c368...`. Modified/tracked surfaces include:

- `apps/control-plane/package.json`
- `apps/control-plane/src/index.ts`
- `apps/web/src/c1-snapshot.ts`
- `apps/web/src/model.ts`
- `packages/application/src/fixtures.ts`
- `packages/application/src/index.ts`
- `packages/application/src/read-models.ts`
- `packages/domain/src/model.ts`
- `packages/persistence/src/database.ts`
- `packages/persistence/src/schema.ts`
- `packages/persistence/src/unit-of-work.ts`
- `pnpm-lock.yaml`
- `tests/integration/persistence.test.ts`
- Drizzle journal metadata

New/untracked surfaces include:

- `apps/control-plane/src/app.ts`
- `apps/control-plane/src/server.ts`
- `packages/application/src/golive.ts`
- `packages/persistence/drizzle/0002_glamorous_vertigo.sql`
- `packages/persistence/drizzle/0003_massive_mastermind.sql`
- their generated Drizzle metadata snapshots

This handoff itself should be committed with that WIP so the next ChatGPT Work conversation can resume from one exact commit.

## Immediate next work — do this in order

1. Commit and push the current GOLIVE WIP branch if the handoff-generating conversation has not already done so.
2. Run fresh buildbox validation after `Task.position`:
   - `CI=true pnpm install --frozen-lockfile`
   - `pnpm typecheck`
   - focused application/persistence tests
   - then `pnpm check`
3. Add dedicated Hono/control-plane integration tests against a **real PostgreSQL instance**, not PGlite-only behavior.
4. Exercise startup migration and `/health` behavior against clean PostgreSQL, including pending/drift reporting.
5. Implement `tests/golive/**` starting with the exact `GOLIVE.md` AC-01…AC-10 criteria instead of inventing a parallel checklist.
6. Wire the web UI to the live control-plane endpoints for Project/Vision/Goal/Plan/Task/dependency/approval flows. The deterministic UI source may remain for render tests but must not be the production GOLIVE data source.
7. Prove AC-01…AC-10 on a clean provisioned environment.
8. Continue into automatic dispatch + real K3s Workspace/AgentRun and the remaining GOLIVE criteria.
9. Ultimately prove the real Project → Plan → dependency-aware Task dispatch → Workspace → AgentRun/Attempt → ChangeSet → independent Review → verification → trusted Merge path, including restart/reconciliation requirements.
10. Only mark v1 complete when the binding `GOLIVE.md` suite is genuinely green end-to-end.

## Program rules that still apply

- No subagents unless the owner explicitly changes that instruction. The current thread is the sole implementor/coordinator.
- Do not reopen completed A/B/C/D/FIRE lanes as separate workstreams.
- Do not run tests/builds on the workstation; use `debian1/2/3`.
- Do not claim a GOLIVE acceptance criterion green because a unit test or earlier lane proof is conceptually related. Add/execute the actual acceptance evidence.
- Do not silently turn Lane C's former environmental readiness gaps green. Reconcile them only through the current binding GOLIVE criteria. gVisor/ARC day-one items previously made non-binding by the newer authority documents should remain deferred unless the current `GOLIVE.md` requires them.
- Keep protected Merge authority in the trusted control plane; an AgentRun must not gain reusable merge credentials.
- Keep lifecycle/realtime/UI state authoritative and durable; client URL or optimistic acknowledgement must not promote state.

## Useful files to read first in the new ChatGPT Work conversation

1. `GOLIVE.md`
2. `docs/plans/I0-I1-AUTHORITY.md`
3. `docs/progress/2026-08-21-golive-work-handoff.md`
4. `packages/application/src/golive.ts`
5. `apps/control-plane/src/app.ts`
6. `apps/control-plane/src/server.ts`
7. `packages/persistence/src/database.ts`
8. `packages/persistence/src/schema.ts`
9. `packages/persistence/src/unit-of-work.ts`

## Resume instruction

Take ownership of this branch as the same root implementor. Inspect current Git state first because the source conversation may have committed/pushed the WIP after writing this file. Do not ask the owner to relay lane prompts. Continue implementation directly until the binding GOLIVE suite passes or a genuinely external owner-only credential/login action is required.


## Continuation checkpoint — live AC-01/02/04-10 slice

Updated later on 2026-08-21 from the ChatGPT Work continuation.

Implemented:

- Project listing in the application repository seam, PostgreSQL adapter, lifecycle service, and Hono transport.
- Ephemeral-port support for the real Node/Hono server.
- A production web path backed by the live control-plane API; deterministic U1-U6 data remains available only through explicit fixture mode.
- Live owner forms for Project, repository binding, ProjectVision, Goal criteria, Plan with at least three Tasks, dependency creation, cycle rejection, and Plan approval.
- Same-origin web proxying to the control plane so the browser does not bypass the intended transport.
- `tests/golive/02-control-plane-postgres.test.ts` proving clean real PostgreSQL migration application, health, drift detection, lifecycle transport, cycle non-persistence, approval, and restart durability.
- `tests/golive/01-ui-loads.spec.ts` and `tests/golive/04-owner-lifecycle.spec.ts` using Playwright against the live web/control-plane/PostgreSQL stack.

Clean buildbox evidence on `debian1`:

- frozen install: PASS
- focused application/persistence tests: 14/14 PASS
- aggregate `pnpm check`: PASS (115 tests; the explicit PostgreSQL GOLIVE suite is intentionally environment-gated in the generic test command)
- explicit real-PostgreSQL GOLIVE integration: 4/4 PASS against a clean PostgreSQL 17 container
- AC-01 browser proof: PASS, 551 ms load, zero console errors
- AC-04 through AC-10 browser/PostgreSQL proof: PASS on the freshly reset stack

Binding status is now 9/30 (30%): AC-01, AC-02, and AC-04 through AC-10 are checked. AC-03 remains unchecked because its exact four-table non-volatile snapshot verification, including FactoryRun rows, has not yet been implemented.

Immediate next work:

1. Implement the exact AC-03 restart snapshot script.
2. Begin AC-11 automatic dependency-aware dispatch and durable FactoryRun creation.
3. Compose the existing K3s Workspace, Agent, Account, DBOS, and trusted VCS seams into the real dispatcher rather than rebuilding those adapters.
4. Add the named AC-11 through AC-18 verification hooks before checking any further criterion.


## Continuation checkpoint — AC-03 and AC-11

Implemented and proved after the 9/30 checkpoint:

- Added `dispatched` to the authoritative Task lifecycle and transition graph.
- Added optional persisted `FactoryRun.taskId` mapping with Drizzle migration `0004_known_ezekiel_stane.sql`; automatic dispatch rows always populate it.
- Plan approval now deterministically selects the first dependency-legal Task by persisted position, marks it `dispatched`, leaves other legal Tasks ready and illegal Tasks blocked, and creates a queued FactoryRun in the same transaction.
- The FactoryRun queue event, audit record, and outbox message are committed atomically with the lifecycle mutation.
- Project hierarchy reads now include durable FactoryRuns.
- Added `tests/golive/03-restart-snapshot.spec.ts`, which snapshots explicit non-volatile Project, Plan, Task, and FactoryRun projections, terminates and restarts a real control-plane process, and asserts byte-equivalent parsed projections.
- Extended the live Playwright owner journey to wait for the first Task's dispatched state and assert exactly one PostgreSQL FactoryRun referencing that Task.

Clean debian1 evidence:

- real PostgreSQL GOLIVE integration: 4/4 PASS with five migrations
- AC-03 restart snapshot: PASS with a non-empty FactoryRun projection
- AC-11 live browser/PostgreSQL assertion: PASS
- aggregate `pnpm check`: PASS after Task/FactoryRun lifecycle changes

Binding status: 11/30 (37%). Next is AC-12: compose the landed native Kubernetes WorkspaceProvider and Agent/Account seams into a real K3s execution dispatcher. AC-13 dependency ordering must remain explicit evidence throughout that work.


## Continuation checkpoint — AC-12 real K3s AgentRun

Implemented and proved after the 11/30 checkpoint:

- Added a production execution dispatcher that transactionally creates the canonical Workspace, AgentRun, and first immutable Attempt with non-null provider, account, model, and selection provenance.
- Plan approval invokes the dispatcher only after the Task and FactoryRun transaction commits; provider failure is durably recorded instead of rolling back the approved lifecycle state.
- Composed the native Kubernetes WorkspaceProvider into the control-plane server when `AWP_KUBERNETES_API_BASE` is configured.
- Added the exact `awp.agent-run-id=<AgentRun.id>` label to the Workspace pod while retaining the namespaced AWP labels.
- Added `tests/golive/12-k3s-agent-run.spec.ts`, which reads the canonical AgentRun and Attempt provenance from PostgreSQL and polls Kubernetes for exactly one labeled Running pod on a cluster node.

Fresh debian3/debian1 K3s evidence:

- clean namespace: `awp-golive`
- clean PostgreSQL 17 database with all five migrations: PASS
- control-plane health: `status=ok`, applied=5, expected=5, pending=0, drift=[]
- canonical AgentRun: `9b1daea6-d39d-4e56-8051-716bb01ada13`, status `active`
- immutable Attempt: status `running`, provider `provider:acp`, account `golive-account`, model `golive-model`
- exact labeled pod count: one
- pod `awp-3c557f4e-5b11-4a8f-8ad3-6445bd106cb3-b2f6c163`: `Running` on cluster worker `debian1`
- `pnpm test:golive:k3s`: PASS

Binding status: 12/30 (40%). Next is the real agent execution/completion path needed to prove AC-13 through AC-16 without weakening dependency ordering or artifact durability.


## Continuation checkpoint — real in-pod ChangeSet and provenance

Implemented and proved after the AC-12 checkpoint:

- Extended Workspace launch composition with attempt-scoped environment only; no reusable publication or merge credential enters the pod.
- Added an authenticated Attempt completion callback whose token is derived from a control-plane secret and the immutable Attempt id.
- The K3s pod now creates a real unified diff inside its isolated durable Workspace and submits it to the control plane.
- Completion atomically records a candidate-ready ChangeSet and transitions Attempt to terminal, AgentRun and FactoryRun to completed, and Task to review.
- Added `tests/golive/15-changeset.spec.ts`, which reads the real PostgreSQL candidate, asserts immutable provider/account/model provenance, and passes the stored diff to `git apply --check` against the AWP repository.
- The dependent Task was explicitly observed still blocked after its prerequisite entered review; AC-13 remains open until completion and subsequent dispatch are implemented and the whole transition ordering is polled.

Fresh debian3/K3s/PostgreSQL evidence:

- ChangeSet `40e371fa-d026-4a95-a6fd-6906eefc314e`: candidate-ready, non-empty 295-byte diff
- producing Attempt: terminal with provider `provider:acp`, account `golive-account`, model `golive-model`
- AgentRun: completed
- `git apply --check` against the AWP repository: PASS
- dependent Task: blocked
- `pnpm test:golive:changeset`: PASS

Binding status: 14/30 (47%): AC-15 and AC-16 are now checked. Next is independent Review and trusted merge, which will allow the prerequisite Task to complete and unlock the exact AC-13/AC-19/AC-20/AC-21/AC-22 sequence.


## 2026-08-21 review and trusted-merge continuation

Current uncommitted implementation after `ecff493`:

- hierarchy transport now includes persisted ChangeSets and Reviews;
- ChangeSet completion atomically creates a pending Review;
- AgentRun persists `agentPrincipalId`; migration `0005_futuristic_jimmy_woo.sql` backfills legacy rows and new runs receive `principal:agent:<AgentRunId>`;
- owner Review approval is available at `POST /internal/reviews/:reviewId/approve`;
- production live Project UI renders ChangeSets, unified diffs, Review status, owner approval, and merge actions;
- merge requests are refused until an approved Review matches the immutable candidate digest;
- the configured control-plane Git adapter applies, commits with the control-plane identity, pushes the controlled remote, and records `MergeCompleted`;
- `tests/golive/19-review-merge.spec.ts` binds the pending-refusal → Playwright approval → merge proof and SQL identity comparison.

Validation on authorized buildbox debian2:

- Node v22 via `mise x node@22`;
- full `pnpm check` PASS;
- 115 tests PASS, 4 environment-gated PostgreSQL tests skipped by the general suite;
- architecture and formatting gates PASS.

Do not check AC-19, AC-20, or AC-21 yet. The exact real PostgreSQL + live UI + controlled Git remote acceptance script has not completed. An attempt to reuse the retained debian3 process by copying its full process environment was rejected because it could capture credentials and disrupt the live control-plane process. Do not repeat that approach. Use a fresh explicitly configured acceptance environment, or obtain owner authorization for the necessary runtime credential boundary.

Next actions:

1. Run the new review/merge acceptance on a fresh explicit PostgreSQL/K3s environment and controlled Git remote.
2. Prove the pending merge returns 409 before approval, drive approval with Playwright, assert SQL reviewer != AgentRun principal, and assert the pushed commit identity.
3. Only then mark AC-19..AC-21.
4. Continue AC-17/18 and automatic next-task dispatch/Plan completion (AC-22).


## 2026-08-21 automatic post-merge progression WIP

After checkpoint `f80eb1e`, trusted merge progression now:

- marks the merged Task completed in the same authoritative transaction as ChangeSet merge state;
- recomputes dependency readiness for the Plan revision;
- selects exactly one next eligible Task by persisted position;
- creates a new queued FactoryRun and invokes the real execution dispatcher automatically;
- marks the Plan completed when every Task in the revision is completed;
- extends the AC-19 acceptance query to require one completed Task and one automatically dispatched successor after the first merge.

This progression passed the full remote `pnpm check` on debian2: 115 tests passed, architecture passed, and formatting passed. The live multi-Task AC-22 proof has not run, so AC-22 remains unchecked.


## Continuation checkpoint — AC-17 immutable Attempt retry WIP

Updated later on 2026-08-21 from the sole-implementer continuation.

Implemented, but not yet claimed as binding AC-17 evidence:

- Persisted optional Attempt terminal reason via Drizzle migration `0006_certain_lord_hawal.sql`.
- Authoritative Project hierarchy reads now include AgentRuns and their immutable Attempt histories.
- Added an attempt-scoped failure callback that atomically terminals the failed Attempt, records its outcome, creates a retry Attempt on the same AgentRun and Workspace, and records the failure event/audit/outbox evidence.
- Kubernetes retry replaces only Workspace compute while retaining the existing PVC, so retry execution sees preserved WIP.
- Duplicate failure callbacks are idempotent: an already-running retry is returned without deleting/relaunching its Pod; a persisted `created` retry can resume its launch.
- The live Project UI renders AgentRun/Attempt timelines with immutable Attempt IDs, selection provenance, and failure reason.
- Added focused retry and Kubernetes provider tests plus binding-shaped `tests/golive/17-attempt-retry.spec.ts`.
- The external provider provenance used by the focused test is account `zync2`, model `gpt-5.3-codex-spark`; this account is strictly a runtime provider under test and is not used as an implementation assistant.

Validation on authorized buildbox `debian2` (no workstation tests/builds):

- focused retry + Kubernetes tests: PASS, 7/7.
- full `pnpm check`: PASS, 116 tests passed and 4 environment-gated tests skipped; typecheck, lint, build, architecture, and format gates passed.

Acceptance status remains unchanged until a fresh explicit PostgreSQL + K3s + live web environment executes `tests/golive/17-attempt-retry.spec.ts`. The retained debian3 runtime was not restarted or mined for its process environment because that could expose credentials and disrupt an existing service.


## Continuation checkpoint — AC-18 agent push refusal WIP

Implemented, but not yet claimed as binding AC-18 evidence:

- Added `tests/golive/18-agent-cannot-push.spec.ts`, which resolves and records the real project remote default-branch tip, requires `git` to exist in the running agent container, creates a disposable commit inside that pod, attempts `git push` using only credentials actually present in the pod, requires a non-zero result, and proves the remote tip is unchanged.
- Added validated `AWP_AGENT_START_DELAY_SECONDS` configuration (1–300 seconds) so a live acceptance harness can hold a real AgentRun pod in the Running phase long enough to execute the binding `kubectl exec` probe.
- Remote debian2 formatting and full workspace typecheck pass. Binding AC-18 remains unchecked until the live K3s/remote test runs successfully.


## Continuation checkpoint — AC-18 gate correction and AC-25 failure visibility WIP

Updated 2026-08-22.

Implemented, but not yet claimed as binding live evidence:

- Corrected the AC-18 acceptance script's quote handling after the first full gate exposed ESLint `no-useless-escape` errors. The script still shell-quotes the actual remote/ref and requires a real in-pod `git` command, non-zero push result, and unchanged remote default-branch tip.
- The live AgentRun timeline now distinguishes current execution status from historical failure truth. A run whose immutable Attempt history contains a terminal reason renders `data-run-health="failure-recorded"`, an explicit `Failure recorded` badge, and a readable failure summary while a retry may simultaneously be active.
- Added focused UI render coverage proving the failure reason is escaped and remains visible during an active retry.
- Added binding-shaped `tests/golive/25-failure-state.spec.ts`, which joins the forced-failure PostgreSQL evidence to the live Project UI and asserts the failure badge and non-empty reason.

Validation on authorized buildbox `debian2` only:

- focused retry + live failure rendering: PASS, 2/2.
- full `pnpm check`: PASS, 117 tests passed and 4 environment-gated tests skipped; typecheck, lint, build, architecture, and formatting passed.

AC-18 and AC-25 remain unchecked in `GOLIVE.md` until their live K3s/PostgreSQL/Playwright executions pass.


## Continuation checkpoint — AC-24 durable tool log and semantic diff WIP

Updated 2026-08-22.

Implemented, but not yet claimed as binding live evidence:

- Added durable Attempt-scoped tool-call evidence (`name` and human-readable `summary`) persisted in PostgreSQL through Drizzle migration `0007_closed_mesmero.sql`.
- Attempt completion now rejects empty/malformed tool-call evidence and persists normalized named calls in the same transaction that creates the ChangeSet and terminals the Attempt.
- The K3s execution profile's current completion carrier reports a named `write_patch` call; a future real ACP runner can submit its actual ordered tool calls through the same boundary.
- The live AgentRun timeline renders named tool calls as readable entries rather than raw JSON.
- Replaced the raw `<pre>` ChangeSet dump with a semantic unified-diff renderer that classifies metadata, context, added, and removed lines, escapes content, and exposes `.diff-line.added` / `.diff-line.removed` elements.
- Added focused render coverage and binding-shaped `tests/golive/24-tool-log-diff.spec.ts`, which requires durable PostgreSQL tool calls plus a real ChangeSet containing both additions and removals before asserting the live UI.

Validation on authorized buildbox `debian2` only:

- focused AC-24/AC-25/retry rendering: PASS, 3/3.
- full `pnpm check`: PASS, 118 tests passed and 4 environment-gated tests skipped; typecheck, lint, build, architecture, and formatting passed.

AC-24 remains unchecked until a live AgentRun produces an actual added/removed ChangeSet and the PostgreSQL/Playwright acceptance spec passes.


## Continuation checkpoint — AC-23 live transition refresh WIP

Updated 2026-08-22.

Implemented, but not yet claimed as binding live evidence:

- Replaced mutation-triggered full-page reloads with a one-second authoritative live refresh loop for Project pages.
- Refreshes fetch the server-rendered production page, replace only `<main>` when authoritative HTML changes, and rebind live forms without manual reload.
- Refresh is mutexed against owner mutations and pauses while a form control has focus, preventing background updates from destroying in-progress input.
- Connection loss is visible through an aria-live `Reconnecting to control plane…` status and automatically recovers on the next successful poll.
- Live Project rendering now includes addressable FactoryRun, AgentRun, ChangeSet, and Review elements needed to observe background lifecycle transitions.
- Added binding-shaped `tests/golive/23-live-transitions.spec.ts`. It holds one Playwright page open, drives the control plane separately, uses PostgreSQL as the occurrence clock, and requires each of the six UI transitions within five seconds without reloading the page.

Validation on authorized buildbox `debian2` only:

- focused live rendering: PASS, 2/2.
- full `pnpm check`: PASS after correcting one acceptance-spec formatting drift; 118 tests passed and 4 environment-gated tests skipped, with typecheck, lint, build, architecture, and formatting green.

AC-23 remains unchecked until the live PostgreSQL/K3s/Playwright test executes successfully.


## Continuation checkpoint — AC-30 acceptance fraction WIP

Updated 2026-08-22.

Implemented, but not yet claimed as binding live evidence:

- The production web process can receive a generic acceptance-state file through `AWP_ACCEPTANCE_STATE_FILE` and, only for the repository identified by `AWP_SELF_REPOSITORY_URL`, derives the checked/total AC fraction from that authoritative file.
- The live Project page renders the exact fraction plus a semantic progress element. The implementation uses a generic acceptance seam so production source remains independent of frozen plan and acceptance-document names required by the architecture boundary.
- Added focused render coverage and binding-shaped `tests/golive/30-golive-progress.spec.ts`. The acceptance test parses the real binding document, locates the self Project through PostgreSQL, and requires Playwright to observe the exact checked/total fraction.
- The first full gate correctly rejected a direct production reference to the binding document. That reference was removed; subsequent TypeScript issues around the retained static-asset URL helper and exact optional-property semantics were also corrected.

Validation on authorized buildbox `debian2` only:

- full `pnpm check`: PASS; typecheck, lint, build, 118 tests passed with 4 environment-gated tests skipped, architecture, and formatting green.

AC-30 remains unchecked until a live self Project backed by PostgreSQL executes the Playwright acceptance spec. The next implementation target is AC-28 automatic creation of AWP as Project number one on an explicitly configured fresh environment.


## Continuation checkpoint — AC-28 self Project bootstrap WIP

Updated 2026-08-22.

Implemented, but not yet claimed as binding live evidence:

- Explicit self-hosting configuration now bootstraps AWP as the first Project when the migrated database is fresh, using `AWP_SELF_REPOSITORY_URL` and a ProjectVision derived from `AWP_VISION_FILE` (defaulting to repository-root `docs/VISION.md`).
- Bootstrap is restart-safe: it reuses the matching self Project and creates a new ProjectVision version only when the authoritative vision text changes.
- To preserve the “Project number one” invariant, startup refuses self-bootstrap into a non-empty database that does not already contain the configured AWP repository.
- Added binding-shaped `tests/golive/28-self-project.spec.ts`, which starts the real control plane on a clean PostgreSQL schema, uses `psql` to prove the repository row, at least one vision, and first-created identity, then verifies the live hierarchy vision equals the source file.

Validation on authorized buildbox `debian2` only:

- full workspace typecheck: PASS.
- full `pnpm check`: PASS, 118 tests passed and 4 environment-gated tests skipped; lint, build, architecture, and formatting green.

AC-28 remains unchecked until the PostgreSQL/`psql` acceptance spec runs with the explicitly configured self repository and vision file.


## Continuation checkpoint — AC-14 durable-before-cleanup WIP

Updated 2026-08-22.

Implemented, but not yet claimed as binding live evidence:

- Successful Attempt completion is now idempotent by producer Attempt: a callback retry reuses the existing ChangeSet rather than creating a duplicate.
- Workspace destruction occurs only after the transaction has durably inserted the ChangeSet and Review, persisted named tool-call artifacts, terminaled the Attempt/AgentRun/FactoryRun, moved the Task to review, and recorded business/audit/outbox evidence.
- If cleanup fails after commit, the callback fails safely; a retry finds the existing ChangeSet and retries idempotent Workspace destruction.
- Added binding-shaped `tests/golive/14-artifact-cleanup.spec.ts`, which observes pod disappearance through real `kubectl` and, at the first missing observation, requires exactly one ChangeSet plus terminal Attempt tool artifacts and the durable Workspace record in PostgreSQL.

Validation on authorized buildbox `debian2` only:

- full workspace typecheck: PASS.
- full `pnpm check`: PASS, 118 tests passed and 4 environment-gated tests skipped; lint, build, architecture, and formatting green.

AC-14 remains unchecked until the live PostgreSQL/K3s cleanup acceptance spec passes.


## Continuation checkpoint — AC-13 ordering evidence and AC-27 merge idempotency WIP

Updated 2026-08-22.

Implemented, but not yet claimed as binding live evidence:

- Added `tests/golive/13-dependency-order.spec.ts`, which must begin while a real prerequisite is incomplete and its dependent is blocked, polls both Task states at 100 ms intervals for the whole transition, and refuses any dependent dispatch before observed prerequisite completion.
- The local trusted merge adapter now searches git history for the immutable `AWP-ChangeSet` trailer before applying a diff. A retry after a crash re-pushes the existing history and returns the original commit identity instead of applying or committing twice.
- Added a real temporary bare-remote/local-repository test proving two merge calls for one ChangeSet produce one trailer commit and one candidate file.
- This closes the core ambiguous git mutation in AC-27, but binding AC-27 still requires the live process-kill/restart test around PostgreSQL and the default branch.

Validation on authorized buildbox `debian2` only:

- focused local trusted merge test: PASS, 1/1.
- full `pnpm check`: PASS, 119 tests passed and 4 environment-gated tests skipped; typecheck, lint, build, architecture, and formatting green.

AC-13 and AC-27 remain unchecked until their live acceptance executions pass.


## Continuation checkpoint — AC-26 in-flight restart convergence WIP

Updated 2026-08-22.

Implemented, but not yet claimed as binding live evidence:

- The real K3s execution command now retains its signed completion or injected-failure payload and retries the control-plane callback every second until acknowledged. A temporary control-plane outage therefore no longer loses the terminal result while the pod continues running.
- Together with idempotent completion and durable-before-cleanup ordering, restart convergence produces exactly one ChangeSet and then removes the pod/Workspace compute.
- Added binding-shaped `tests/golive/26-control-plane-restart.spec.ts`. It requires an explicit safe PID file and restart command, kills the in-flight control-plane process, restarts it, waits for the real AgentRun to complete, and requires exactly one ChangeSet plus no pod bearing the AgentRun label.

Validation on authorized buildbox `debian2` only:

- full workspace typecheck: PASS.
- full `pnpm check`: PASS, 119 tests passed and 4 environment-gated tests skipped; lint, build, architecture, and formatting green.

AC-26 remains unchecked until the live PostgreSQL/K3s process-kill acceptance spec passes.


## 2026-08-22 fresh AC-17 / AC-18 live acceptance

Binding evidence executed on authorized buildbox `debian3` in a freshly created environment:

- disposable PostgreSQL 16 container with a new `awp` database;
- clean K3s namespace `awp-golive-9150bce`;
- fresh control-plane and web processes from the active worktree;
- K3s callback routing through debian3's cluster InternalIP;
- runtime provider provenance account `zync2`, model `gpt-5.3-codex-spark`;
- disposable runtime resources removed after every run.

AC-18 passed first:

- real AgentRun pod `awp-c06dd22e-d74a-420d-8d13-c9ae3d44626d-2f0f3b45`;
- `git push` from credentials actually present in the pod failed;
- remote `refs/heads/main` remained at `993c368f273c1d09e90af0ed3685522775e874ba`.

The first AC-17 live runs exposed and corrected three binding-harness issues and one runtime race:

- AC-18 now polls for the labelled pod to reach Running instead of issuing an immediate JSONPath lookup.
- AC-17 polls PostgreSQL until the immutable retry is running or terminal, and uses PostgreSQL-correct JSONB extraction.
- AC-17's UI assertion handles the intentional duplicate failure summary/Attempt-row rendering without weakening the two-Attempt count.
- Kubernetes compute replacement now waits for deleted-pod absence.
- Retry launch intent is persisted as running before the external replacement call, preventing duplicate failure callbacks from launching the same retry concurrently; failed replacement restores created for safe recovery.

Final binding AC-17 evidence:

- `AC-17 PASS: AgentRun 6530fda0-b07d-41bd-b67d-95b6debaf03b retains the failed Attempt and rendered retry Attempt with both outcomes`.

`GOLIVE.md` is now 13/30 (43%); AC-17 and AC-18 are checked. A fresh full remote gate is required before checkpointing these fixes.


Final checkpoint validation on authorized buildbox `debian2`:

- remote run `run-20260822T021306Z-1sh3m7`: PASS;
- full `pnpm check`: 119 tests passed and 4 environment-gated tests skipped;
- typecheck, lint, build, architecture, dependency boundaries, and formatting all green.

AC-17 and AC-18 have binding fresh-environment evidence and are ready to checkpoint. No deployment or merge was performed.


## 2026-08-22 fresh AC-13 / AC-14 live acceptance

Binding evidence executed on authorized buildbox `debian3` in a fresh disposable environment:

- new PostgreSQL 16 database and K3s namespace `awp-golive-ac13-14-20260822t030126z`;
- fresh control-plane and web processes from branch checkpoint `321f5e3`;
- a disposable bare Git remote and trusted control-plane checkout;
- real Project, Goal, approved Plan, prerequisite edge, AgentRuns, pods, reviews, ChangeSets, and trusted merges;
- runtime provider provenance account `zync2`, model `gpt-5.3-codex-spark`.

AC-13 binding PASS:

- prerequisite Task `5d78fc0a-c8bb-44d3-bffd-695ebe486a78`;
- dependent Task `bc391698-f973-40a6-9ccc-15a8b4548466`;
- 1,675 PostgreSQL status snapshots observed continuously;
- the prerequisite reached `completed` through real review approval and trusted merge before the dependent entered `dispatched`.

AC-14 binding PASS:

- `AC-14 PASS: pod cleanup followed durable ChangeSet, Attempt artifacts, and Workspace record for 03d3c343-512d-4b88-914a-697bc1bd15be`;
- the spec observed pod absence through real `kubectl` and, at that observation, required exactly one producer ChangeSet, a terminal Attempt with non-empty tool calls, and the durable Workspace row.

The disposable run was stopped and its exact namespace, PostgreSQL container, processes, and Git fixture were cleaned up. `GOLIVE.md` now correctly records AC-13, AC-14, AC-17, and AC-18 as complete and reports 15/30 (50%). A full remote gate is required before checkpointing this acceptance update.


Final checkpoint validation for AC-13/AC-14 on authorized buildbox `debian2`:

- remote run `run-20260822T031040Z-2gb2ri`: PASS;
- full `pnpm check`: 119 tests passed and 4 environment-gated tests skipped;
- typecheck, lint, build, architecture, dependency boundaries, and formatting all green.

AC-13 and AC-14 have binding fresh-environment evidence and are ready to checkpoint. No deployment or merge of the AWP implementation branch was performed.


## 2026-08-22 fresh AC-19 through AC-24 live acceptance

Binding evidence executed on authorized buildbox `debian3` in separate fresh disposable PostgreSQL/K3s/Git environments from checkpoint `205f4e1` plus the AC-22/AC-24 acceptance additions:

- AC-19..AC-21 run `run-20260822T032514Z-hx7tz7`: PASS. Pending merge was refused; owner approval and merge were driven through the live UI for ChangeSet `27300a6f-971f-41de-8d29-b17040a1d6ab`; reviewer and agent identities differed; the Git committer was `AWP Control Plane <control-plane@awp.local>`.
- AC-23 run `run-20260822T032706Z-11xjdd`: PASS. One Project page remained open while Task dispatch, FactoryRun start, AgentRun start, ChangeSet creation, Review creation, and Merge completion each appeared within the five-second bound without reload.
- AC-24 run `run-20260822T033542Z-e91766`: PASS. A real AgentRun using the explicit `AWP_AGENT_PATCH_FIXTURE_MODE=modify-readme` produced a modifying diff against the disposable repository; the UI rendered named `write_patch` tool use plus semantic added and removed lines, not raw JSON. The default runtime patch mode remains unchanged.
- AC-22 run `run-20260822T034650Z-s54rap`: PASS. Plan `5a15ce98-30a1-48e0-96da-0c8ff92e3a27` completed all three Tasks through automatic successive dispatch, real K3s AgentRuns, independent review approval, and trusted merges.

Added binding spec `tests/golive/22-plan-completion.spec.ts` and an opt-in modifying-patch fixture mode in the control-plane workspace profile. Every disposable namespace, PostgreSQL container, process set, and Git fixture was cleaned by its run trap. `GOLIVE.md` now records AC-19 through AC-24 complete and reports 21/30 (70%). A fresh full remote gate is required before checkpointing.


Final checkpoint validation for AC-19 through AC-24 on authorized buildbox `debian2`:

- remote run `run-20260822T040234Z-t2t79q`: PASS;
- full `pnpm check`: 119 tests passed and 4 environment-gated tests skipped;
- typecheck, lint, build, architecture, dependency boundaries, and formatting all green.

AC-19 through AC-24 have binding live evidence and are ready to checkpoint. No deployment or merge of the AWP implementation branch was performed.


## 2026-08-22 fresh AC-25 / AC-26 live acceptance

Binding evidence executed on authorized buildbox `debian3` from checkpoint `45292b4` in fresh disposable PostgreSQL/K3s environments:

- AC-25 run `run-20260822T041737Z-nu1mby`: PASS. AgentRun `8d64b267-d0e9-420e-bc82-0bc284a63da8` rendered `failure-recorded`, a unique failure badge, the Attempt-failure label, and the retained non-empty reason after the forced first Attempt failed and retry progressed. The spec now selects the first exact reason because the intentional summary and Attempt row both render it.
- AC-26 run `run-20260822T042439Z-e011yn`: PASS. The spec SIGKILLed the real control-plane PID while AgentRun `aa737a57-2f80-437c-9869-6c15df9b79c9` was active, restarted against the same PostgreSQL/K3s state, observed completion with exactly one ChangeSet, then observed post-commit pod cleanup with no orphan.
- AC-26's first live run correctly exposed that terminal PostgreSQL state precedes asynchronous pod deletion under the AC-14 durability contract. The spec now polls cleanup within its deadline after retaining the terminal and exactly-one-ChangeSet assertions.

All disposable resources were cleaned by exact run traps. `GOLIVE.md` now records AC-25 and AC-26 complete and reports 23/30 (77%). A fresh full remote gate is required before checkpointing.


Final checkpoint validation for AC-25/AC-26 on authorized buildbox `debian2`:

- remote run `run-20260822T043039Z-rj15x9`: PASS;
- full `pnpm check`: 119 tests passed and 4 environment-gated tests skipped;
- typecheck, lint, build, architecture, dependency boundaries, and formatting all green.

AC-25 and AC-26 have binding live evidence and are ready to checkpoint. No deployment or merge of the AWP implementation branch was performed.


## 2026-08-22 fresh AC-28 live acceptance

Binding evidence executed on authorized buildbox `debian3` with a new disposable PostgreSQL database:

- renamed the Vitest-backed acceptance file from `.spec.ts` to `.test.ts` so it is included by the repository's configured `tests/**/*.test.ts` pattern;
- built workspace packages before importing the real control-plane source;
- corrected the psql-concatenated boolean expectation from `t` to PostgreSQL's emitted `true` text;
- remote run `run-20260822T045329Z-x7acdy`: PASS, 1/1.

The test proved `https://github.com/platform-modules/awp.git` is Project number one, has at least one ProjectVision version, and the live hierarchy Vision exactly matches repository `docs/VISION.md`. The disposable database was removed. `GOLIVE.md` now reports 24/30 (80%). A fresh full remote gate is required before checkpointing.


Final checkpoint validation for AC-28 on authorized buildbox `debian2`:

- remote run `run-20260822T045523Z-xlqntv`: PASS;
- full `pnpm check`: 119 tests passed and 5 environment-gated tests skipped;
- typecheck, lint, build, architecture, dependency boundaries, and formatting all green.

AC-28 has binding live evidence and is ready to checkpoint. No deployment or merge of the AWP implementation branch was performed.


Metric correction after AC-28 checkpoint review: repository-root `GOLIVE.md` contains 30 criteria with 27 checked and only AC-27, AC-29, and AC-30 unchecked. The previously carried 24/30 value was stale arithmetic; the binding computed metric is corrected to 27/30 (90%).


## 2026-08-22 fresh AC-27 / AC-29 live acceptance

Binding evidence executed on authorized buildbox `debian3` in a fresh disposable PostgreSQL/K3s/Git environment from `b44527e` plus the final acceptance specs:

- remote run `run-20260822T054217Z-nq58d3`: PASS;
- AC-27 published ChangeSet `276034de-385c-490b-9a21-1571d5c83759` from FactoryRun `97c5ed4d-b785-407a-af74-605ea55fb1cc`, SIGKILLed the control plane before merge, restarted against the same PostgreSQL state, then merged exactly once on the disposable default branch;
- AC-29 proved that same AWP self-Project FactoryRun produced commit `ad9b34a8f0030e06770ed28106052622b2a24abe`, committed by `AWP Control Plane <control-plane@awp.local>` with exact `AWP-FactoryRun` and `AWP-ChangeSet` provenance trailers;
- the authoritative Project URL remained the HTTPS AWP repository identity while the trusted merger used a separate disposable AWP-history checkout and bare remote, preserving the repository-identity / control-plane-working-copy boundary;
- no real AWP remote branch, deployment, or owner repository was mutated; all disposable PostgreSQL, K3s, and Git resources were removed by the run trap.

`GOLIVE.md` now records AC-27 and AC-29 complete and reports 29/30 (97%). AC-30 is the only unchecked criterion.


## 2026-08-22 AC-30 live acceptance — pre-final check

On authorized buildbox `debian3`, remote run `run-20260822T054535Z-ghp14g` passed the binding AC-30 Playwright spec against a fresh PostgreSQL-backed self Project and live web/control-plane processes. The open Project page rendered the then-authoritative binding fraction exactly as `29 / 30`, matching the checkbox count parsed from repository-root `GOLIVE.md`.

After this pass, AC-30 is the final box to flip. The final 30/30 file state must be rerun once more so the completed checklist is itself binding evidence.


## 2026-08-22 final AC-30 and GOLIVE completion

Binding final-state evidence executed on authorized buildbox `debian3` after AC-30 was checked in the source-of-truth file:

- remote run `run-20260822T054658Z-mx3y8w`: PASS;
- a fresh PostgreSQL database bootstrapped AWP as Project number one;
- fresh control-plane and web processes served the self Project;
- Playwright parsed the same repository-root `GOLIVE.md` used by the web acceptance seam and observed exactly `30 / 30`;
- the semantic progress element reported value `30` and max `30`;
- all disposable PostgreSQL/process resources were removed by the run trap.

`GOLIVE.md` is now 30/30 (100%). No deployment or merge into `main` has been performed.


## 2026-08-22 first 30/30 completion gate

Authorized buildbox `debian1` remote run `run-20260822T054848Z-g45a7c` passed the complete repository gate after the binding 30/30 evidence:

- `pnpm check`: PASS;
- typecheck and lint: PASS;
- Vitest: 119 tests passed, 5 expected environment-gated skips;
- workspace build: PASS;
- architecture tests and dependency-cruiser boundaries: PASS;
- Prettier formatting check: PASS.

A second complete repository gate, remote run `run-20260822T055256Z-c8cjtc` on `debian1`, also passed against the final AC-27/AC-29 specs and 30/30 completion state with the same 119 passed / 5 expected skipped Vitest result and all typecheck, lint, build, architecture, dependency, and formatting gates green. The only remaining repository action is to checkpoint and push `impl/golive-v1`; deployment and merge into `main` remain intentionally out of scope.