# AWP I1 Dogfood Session Handoff — 2026-08-23

## Exact repository state

- Worktree: `/home/user/Projects/.worktrees/awp-i1-dogfood-deploy`
- Branch: `ops/i1-dogfood-deploy`
- Latest code/runtime-prep head before this handoff document: `7c5ab79` — `chore(execution): pin published agent runner digest`
- `7c5ab79` pins `ghcr.io/platform-modules/awp-agent-runner@sha256:b39ad1e2157770a042f182ccd956922e2dfc493055704f028f53e01e8b5368cb`
- This handoff document is committed immediately on top of that code head; use `git log -1` for the final handoff commit hash after push
- Remote branch was synchronized through `7c5ab79` before the handoff document commit was applied
- Worktree state at handoff creation: clean
- `GOLIVE.md`: 0/30 checked, 30/30 unchecked
- Canonical registry/controller validation at `8ecaa1e`:
  - registry structure: 30/30
  - semantic readiness: 0/30
  - owner acceptance: 0/30
  - every proof unit remains `pending`
  - live controller deliberately refuses `--execute` until proof migrations are ready

This distinction is important: substantial implementation and proof-harness work is now present on the branch, but none of the 30 owner acceptance criteria is considered satisfied yet.

## Live dogfood state observed while writing this handoff

Target: debian3 / `http://100.101.104.41:4173`

- `/health`: PostgreSQL healthy
- migrations: applied=14, expected=14, pending=0, drift=[]
- Projects=1
- FactoryRuns=0
- AgentRuns=0
- ChangeSets=0
- Reviews=0
- Workspaces=0
- Subrouter accounts: `[]`
- No owner FactoryRun has been started.

The service WorkingDirectory is `/home/user/services/awp-i1/repo`, which is a copied deployment tree without `.git`. Its runtime-source fingerprint does **not** match current branch head `8ecaa1e`. The last source head explicitly deployed and verified in this session history was `158991c` (`Stabilize provider replay identity`). Do not assume the live runtime contains the later 23 branch commits; redeploy from an exact verified head when runtime changes need to go live.

## Branch progress after the previous handoff

The branch advanced 24 code/runtime-prep commits after `8832a02` before this handoff document. In order:

- `fdca945` strengthen ChangeSet provenance proof
- `b75f112` add canonical journey orchestrator
- `ac6c09f` bind exact ChangeSet provenance
- `9788c1b` gate native ACP retry injection
- `2d695ad` add canonical journey orchestrator
- `87369fc` bind exact ChangeSet provenance
- `9ec88ca` gate native ACP retry injection
- `ff1e760` select exact prerequisite ChangeSet
- `d28e056` quarantine destructive bootstrap smokes
- `1ebdd05` keep deployment config tests in boundary
- `bea19e0` bind owner lifecycle identity
- `0dd55ce` make orchestrator binding truthful
- `d9850bf` separate repository identity and checkout
- `2dd1721` isolate live and destructive suites
- `809a1cb` inject native ACP post-prompt failure
- `76f4000` persist generated owner journey identity
- `6ec891b` stage generated journey identities
- `789ab75` add explicit destructive smoke config
- `e8e8f49` canonicalize remote provenance
- `06dac4f` enforce staged manifest transitions
- `b25ddec` preserve ACP compatibility and test injection
- `9fde825` prove and persist owner lifecycle
- `8ecaa1e` align lifecycle proof contracts
- `7c5ab79` pin the newly published agent-runner digest

These commits supersede the older handoff statement that AC-15 strengthening and native retry injection were merely uncommitted WIP. They are now committed and pushed. The new runner digest pin is also committed, but the live copied service tree does not match this current branch state, so do not claim that runner pin is deployed until an exact-head deployment is performed and verified.

## Current canonical GOLIVE harness

`tests/golive/run.ts` now owns the canonical proof registry/orchestration boundary.

Important current behavior:

- `--validate` / `--list` validate structure only and report current readiness.
- `--execute --manifest <path>` is explicitly refused because semantic proof migrations remain pending.
- owner journey is staged through a durable journey manifest rather than rediscovering arbitrary latest rows.
- repository identity distinguishes remote URL from checkout path and validates origin/default-branch identity before execution.
- owner authoring and owner approval are separate lifecycle handlers/stages.
- runtime proof environments are derived only from declared manifest selectors plus explicit runtime inputs.
- destructive bootstrap/smoke tests are quarantined from live acceptance semantics.

Current `--validate --list` result at `8ecaa1e` had every proof unit pending: UI load, PostgreSQL, restart snapshot, owner authoring/approval, K3s execution, dependency order, cleanup, ChangeSet identity, retry, agent push denial, review/merge, Plan completion, live transitions, tool log/diff, failure UI, restart proofs, self-project, self-change, and GOLIVE progress. `7c5ab79` changes only the runner image lock, so it does not alter semantic readiness by itself.

## Runtime/durability work already implemented and previously verified

The following production-path repairs were implemented before the latest harness series and remain part of branch history:

- trusted repository-scoped GitHub publication and merge;
- independent reviewer AgentRun;
- repository-required GitHub checks;
- exact durable Workspace checkpoint/cleanup lifecycle;
- immutable retry Attempt identity with preserved Workspace WIP;
- one FactoryRun per PlanRevision;
- durable FactoryRun account/model selection provenance;
- replay-safe Plan approval;
- startup recovery for durably dispatched Tasks;
- downstream post-merge dispatch recovery;
- pending reviewer provisioning recovery;
- stable Workspace/ACP/provider idempotency keys derived from durable identities;
- trusted merge replay reconciles an already-completed exact provider merge before consulting the necessarily advanced mutable target branch.

Latest full repository gate explicitly recorded before the later 23-commit harness series was 165 passed / 5 skipped, architecture 6/6, zero dependency violations, typecheck/lint/build/Prettier green. Do not reuse that as verification of `8ecaa1e`; run the appropriate current gate on debian1/2/3 before deploying current head.

## Owner constraints / safety boundaries

- Build/test/E2E only on debian1/debian2/debian3, never the workstation display.
- Do not restart LibreWolf without approval.
- Do not initiate FactoryRun/AgentRun on behalf of the owner.
- Do not initiate Subrouter/Codex OAuth/account login unless explicitly asked.
- Do not provision/import/copy GitHub publication credentials without explicit owner authorization.
- Never import workstation/Systray/Overdeck OAuth into K3s.
- Agent Workspace receives only Attempt-scoped model-gateway capability; no reusable OAuth/Subrouter/GitHub credential.
- No agent GitHub publication credentials.
- No synthetic/local-source replacement may satisfy canonical GOLIVE acceptance.
- Keep `GOLIVE.md` unchecked until the named canonical live verification actually passes.

## Immediate next work

1. Inspect `8ecaa1e` actual branch state and current proof registry before changing anything.
2. Run current static/full repository verification on debian2 (or another approved buildbox) for the exact pushed head; do not reuse the older 165/5 result as proof of the later 23 commits.
3. Review `criterion-registry.ts`, `journey-manifest.ts`, `run.ts`, and the staged owner lifecycle to determine why every proof unit still has `migrationStatus: pending` and what exact migrations/semantic contracts remain before the controller can truthfully enable execution.
4. Verify the native ACP retry-injection path (`809a1cb`, `b25ddec` and related commits) is real runner/native execution, not the deprecated synthetic Workspace fallback, and that its failure mode is gated only for the intended dogfood Attempt.
5. Verify strengthened AC-15 exact candidate provenance and AC-17 retry proofs against the current staged manifest selectors.
6. Continue migrating each proof unit from `pending` only when its implementation, declared inputs, barriers, and canonical production semantics are complete.
7. Once autonomous implementation/harness gaps are exhausted, request only the remaining explicit owner gates below.

## Explicit owner-gated completion boundary

The overall I1 project is **not complete**. After semantic readiness is genuinely complete, the live owner journey still requires explicit owner actions/authorization for:

1. repository-scoped GitHub publication/merge credential or GitHub App authority;
2. Subrouter/Codex account login/selection;
3. owner initiation/approval of the real FactoryRun journey.

Only after the real Project → Plan → Task → FactoryRun → AgentRun → ChangeSet → verification → independent Review → trusted merge → UI/restart/cleanup/self-dogfood journey passes should `GOLIVE.md` criteria be checked and I1 declared complete.