# Incidents Completion audience: AI coding agents first. status: SUPERSEDED (2026-08-15) — see "Superseded" section at end of file worker: coordinator; final review clean, preparing current-main reconciliation and shipment task IDs: #179, #233, #234, #236 source request: Complete Incidents end-to-end. Replace the current stub with the requested full Incidents page redesign; restore canonical classification and abandoned database backfill; inventory every historical source; preserve and finish existing WIP instead of restarting; expose authoritative CLI/model/effort/account selectors; assemble incident-specific agent briefs and bounded similar-incident context; keep dispatch status authoritative; close every security defect; land, deploy, and browser-prove the page. The owner explicitly requested one full durable completion plan rather than chat-only detail. Owner correction 2026-08-10: page redesign is required and the current stub MUST NOT be treated as a completed UI. Owner recovery directive 2026-08-10: locate the exact owner-authored `/brainstorm` instructions and resulting Incidents specification; do not substitute an inferred redesign contract. Owner directive 2026-08-12: prior work was never completed or merged; resume preserved WIP through full acceptance, then merge to `main`. Owner directive 2026-08-12 for tasks #179/#233/#234: in the preserved worktree, recover authoritative historical incident sources from repository artifacts or deployed data; implement the smallest conflict-isolated inventory plus idempotent backfill/reconciliation slice with source IDs, original timestamps, deterministic deduplication, provenance, explicit unresolved classification, rerun safety, and per-source/type counts; use TDD; update this plan; do not commit or deploy. Owner correction 2026-08-12: fix every real diagnostic from `cd collector && pnpm exec tsc --noEmit` minimally, especially missing `BriefDeps.skillExists` fixtures, `LaunchClaimResult` literal widening, closure-lost `incident-service` narrowing, and newly introduced unused symbols; run focused incident tests and `git diff --check`; identify but do not modify the intermittent full-suite routing test unless this task proves a deterministic defect; preserve concurrent WIP; no commit, deploy, or subagents. Owner security-blocker directive 2026-08-12: preserve all current WIP and coordinate around the routing-test fixer; use TDD and no partial workarounds to (1) persist the exact brief before every launch, fail closed when persistence fails, pass only that persisted brief to the runner, and delimit owner/retrieved text as untrusted data; (2) route automatic and manual resolution through one evidence-gated idempotent transaction so a bare resolved result cannot close an incident without a verified artifact and durable learning; (3) make list/detail strictly read-only and move metadata repair to explicit reconciliation; (4) remove service-shared `activeLease`, keep lease identity and loss local to each operation, and explicitly fence every mutation; (5) enforce server-side default/max page size, query-length bounds, and pagination before hydration; (6) restore the authoritative type selector with an honest unresolved option using existing UI primitives only. Add a focused RED/GREEN reproduction for each blocker, run project typechecks and `git diff --check`, and make no commit, deployment, or subagent dispatch. Owner final-review directive 2026-08-13: preserve WIP and TDD-fix three blockers only: safe Codex mode MUST always pass `--sandbox workspace-write`, with dangerous bypass available only through explicit unsafe mode including local/non-incident fallback; verified/closed durable resolution operations MUST reconcile automatically at startup and periodically, idempotently completing closure and learning then advancing to learned with crash/restart coverage; launcher recovery after worktree creation MUST validate and reuse only the exact expected inactive worktree and return an explicit recoverable mismatch error otherwise. Run collector typecheck/focused tests, focused wrapper tests, mandatory full Factory tests, and `git diff --check`; no commit, deployment, or subagents. ## Outcome `/incidents` is deployed and browser-proven with complete historical records, canonical classification, required intake selectors, fail-closed remote dispatch, reconciled backfill, and focused security verdict. ## Acceptance criteria - Replace the current stub with a complete, responsive Incidents workspace built from existing `@platform-modules/ui-primitives` and `@overdeck/deck-ui` components; no page-local primitive reinvention. - The redesigned page exposes incident inventory, canonical type/status/priority, provenance and timestamps, intake/dispatch controls, dispatch progress/terminal result, and investigation/resolution context using honest authoritative data. - Required fields and CLI/model/effort/account selectors use authoritative options. - Every historical source is inventoried and reconciled. - Backfill is idempotent, provenance-preserving, deterministic, and timestamp-preserving. - Every incident has canonical classification or explicit unresolved state. - Dispatch state remains authoritative from intake through terminal status. - Focused security review has no unresolved ship blocker. - Production page is browser-proven with honest data. - Dispatch wraps owner text in an incident-specific base prompt: incident identity/priority, reproduce-before-fix, evidence-required closure, worktree isolation, install-before-land, result write-back, and file-it-or-open discipline. - Agent can query all incidents through a bounded tool and receives concise similar-incident summaries with knowledge-base IDs, never unbounded history. - Canonical type selects relevant maintained skill guidance (cluster, CPU/load, hooks, authentication, Factory, runtime/session, storage, networking, security); unknown type fails to generic incident discipline, never guessed specialist instructions. - Resolution runs an incident-specific learn-from-mistakes flow that updates durable knowledge/skills only from verified evidence and records provenance. ## Preserved WIP Worktree: `/home/user/Projects/overdeck/.worktrees/incidents-179-233-234` - Contains lossless copy of 37-file `incident179-land` WIP. - Newer base: `incident179-land` HEAD `7a7554140841` plus 37 uncommitted files. - Older candidate chain: `efd273b4f` → `4584c4d2d`. - Selector commit `f81da5b46831` is older than preserved WIP. - WIP reportedly covers intake/dispatch/status lifecycle. - Current owner-visible page is a stub; preserved WIP has not been proven to contain the requested full redesign. - WIP does NOT establish canonical taxonomy, historical-source inventory, or DB backfill. - Never rebuild from older commits until diff proves preserved WIP is not a superset. ## Constraints - Preserve the 37-file WIP and prove semantic supersets before replacing any portion. - Run builds/tests/browser workloads remotely; NEVER fall back to laptop-heavy execution. - Ordinary dispatch MUST remain safe-only. Unsafe mode MUST require fresh authenticated server-side authority and fail closed at every service/route boundary. - Owner text and retrieved incident history are untrusted data, never executable instructions. - Dispatch MUST be idempotent and concurrency-safe; persist stable unit/workspace identity before launch, then inspect and adopt that exact existing unit after any crash so one incident/attempt launches at most one worker. - Lease loss MUST stop the holder immediately. Revalidate/fence every remote metadata, board, and launcher side effect against the live durable lease. - Incident runner MUST stream input, cap retained stdout/stderr, reject oversized/non-regular/symlink result files, and launch under explicit systemd memory, task, and file-size limits. - Resolve any real TypeScript source/test signature mismatch reported at `collector/src/incidents/incident-mutation-store.test.ts:62-66`; ignore only proven editor-environment missing-type noise. - Backfill MUST preserve source identity and timestamps, deduplicate deterministically, and be safe to rerun. - Never invent taxonomy or historical-source semantics; recover authority from surviving evidence. - Product code follows branch → verification → land → deploy; browser proof uses `e2e-remote`. - Done means deployed, owner-visible, and reconciled—not merely coded or tested. ## Recovered authority Canonical owner-involved design recovered at `docs/specs/2026-08-08-incidents-page-design.md` (introduced by `d7fc33ea`, status/conflicts amended by `7b79df9f`). Companion dispatch-intelligence authority is `docs/specs/2026-08-08-incident-brief-design.md` (introduced by `30b2ab69`, taxonomy coverage amended by `8342bc8a`). Sections 1–10 of the page spec declare themselves canonical; section 11 records built state and later conflict resolutions. Implementation MUST reconcile against these files, not reconstruct the redesign from memory. The unrelated selector spec `specs/0592a6e6_incident-selector-completion.md` remains absent. Selector semantics must be reconciled against the recovered page spec, deployed adapter authority, preserved WIP, and owner-message corpus; never invented. No completed incident-dispatch security verdict exists. Previous repair worker exited 3; capacity recovery is not a review verdict. ## Historical-source contract - Kanboard remains sole incident store per page spec §10. Historical import MUST target Kanboard through an explicit adapter; inventory MUST NOT mutate during reads. - Repository authority currently identifies `collector/test/fixtures/offload/status-incident-2026-07-18.json` as one historical telemetry source. Source ID: `offload-status:2026-07-18`. Record IDs come only from stable source fields (`dispatch`, `queue.wedge`, `jobs[].id`). - This telemetry fixture supplies one observation timestamp (`reconciler.lastAt`) but does not prove each record's original event timestamp or canonical incident type. Inventory MUST classify affected records `unresolved`, state exact missing authority, and perform zero backfill writes. It MUST NOT reuse observation time as event time or infer type from free text. - Import eligibility requires stable source ID, stable record ID, original event timestamp, canonical type, title, and provenance. Missing any field fails closed as `unresolved`. - Dedup key is deterministic SHA-256 over versioned length-prefixed `(sourceId, recordId)`. Reruns MUST lookup by this key before create. Existing matching provenance reconciles as `existing`; conflicting provenance is `unresolved`, never overwritten. - Reports MUST include per-source and per-type totals for discovered, eligible, created, existing, and unresolved records. Unknown type is reported as `unresolved`, not guessed. ## Execution steps 1. Treat `docs/specs/2026-08-08-incidents-page-design.md` and `docs/specs/2026-08-08-incident-brief-design.md` as recovered authority; extract a spec-to-WIP coverage matrix before mutation. 2. Recover only the still-missing historical-source/backfill contract from authoritative evidence and record it here. 3. Reconcile all refs and 37-file WIP by semantic diff. 4. Implement the canonical responsive list/detail operations page—not a kanban board—with active/resolved sections, exact table columns, detail and filing drawers, stale/degraded states, responsive priorities, accessibility, and authoritative refresh behavior defined by page-spec §7. 5. Build the full Incidents workspace from registered platform/deck-ui components, including inventory, filters/classification, provenance, intake, dispatch lifecycle, investigation context, and resolution evidence. 6. Complete selectors/intake fields. 7. Implement canonical classification. 8. Implement idempotent backfill with provenance/timestamp/dedup contracts. 9. Reconcile counts per source and classification. 10. Build and test bounded all-incident lookup, similar-incident retrieval, typed skill selection, and evidence-gated knowledge updates. 11. Verify fail-closed dispatch: intake → persistence → base-prompt assembly → skill/context selection → worktree/systemd → argv → status. 12. Run focused security review over exact delta: authorization, idempotency, shell/argv injection, prompt injection, retrieved-incident data isolation, path/symlink/TOCTOU, secrets, remote-only failure. 13. Land, deploy, and browser-prove the redesigned page in both themes and responsive viewports. ## Current receipt WIP preserved; current owner-visible page remains a stub. Exact owner-involved page and dispatch-brief specifications are recovered and identified above. Historical-source inventory, backfill proof, WIP-to-spec coverage matrix, and complete deployment remain absent. First authorization patch added server-side permission-mode validation and reported focused tests 62/62. Independent review then confirmed five unresolved defects: concurrent dispatch can double-launch; hashless pre-existing Kanboard tasks can be adopted by UUID; missing options authority fails open on some filing/direct-service paths; dispatch request bodies are unbounded; incident type is not taxonomy-bound. Repair worker `b0jzcft1g` resumed the preserved WIP and reported closing all five across `incident-service.ts`, `server.ts`, and focused tests: shared incident mutation lock, provenance marker+title+description adoption, dispatch authority `503`, 64 KiB bounded body, taxonomy validation. Independent remote-only rerun `b0396j2zl` confirmed 78 pass/0 fail/256 assertions across four focused files. Fresh adversarial review rejected landing with four concrete blockers: process-local `mutationLocks` cannot serialize production requests because production creates a service per request; production `startServer` omits `loadIncidentOptions`, so mutation routes always return 503; orphan adoption permits inactive/resolved/non-Filed tasks without lifecycle provenance; dispatch does not revalidate persisted `incident_type` against fresh taxonomy. The 64 KiB byte bound passed review. Repair `bhl01n9ad` implemented a SQLite WAL `IncidentMutationStore` with durable leases and launch-claim CAS, production authority-loader wiring, lifecycle-restricted orphan adoption, and fresh dispatch-time taxonomy validation; added cross-instance and production-wiring regressions. Main-session authoritative remote verification `bhkh4q8ps` ran 51 tests: 49 passed, 2 failed. Focused repair `bz3lcvgvi` fixed both: tampered unsafe metadata rejects before authority loading, and `InvalidIncidentTypeError` is correctly imported/mapped. Those two fixes still need authoritative rerun. Independent review confirmed the other four repair areas but found one new High ship blocker: permanent launch claim can strand an incident if collector exits after claim, metadata write, or board move; retry generates a different UUID or rejects Dispatching state, so no runner can resume. Required fix is a recoverable phased launch state machine with canonical dispatch ID, holder lease/CAS renewal, and crash-injection tests after every side effect. Repair `b84h29w2j` is active. No repair commit, install, deployment, or browser proof yet. ## Next executable action Consume `bz3lcvgvi` without overlapping mutations. Then implement recoverable phased launch state with canonical dispatch ID, holder-bound lease/CAS renewal, resume at each phase, and crash-injection regressions after claim/metadata/board move/start. Rerun focused and existing suites remotely and obtain a fresh independent security verdict before committing. Routing isolation receipt 2026-08-12: the reported full-suite-only premise was disproved before mutation: `bun test test/routing-config.test.ts` failed deterministically at line 90 because preserved WIP had replaced the committed canonical account-slug schema with a trimmed non-empty string schema, accepting `.*`; no suite predecessor, shared global/environment/module state, pollution, or race was required. The existing focused regression was a valid RED test. Restoring the committed `^[a-z0-9][a-z0-9_-]{0,63}$` trust-boundary schema made the routing file pass 25 consecutive reruns (150/150 tests), and the complete collector suite passed twice (781 passed, 2 intentional live-Kanboard skips each run). A final diff showed concurrent work had independently restored the exact same committed schema, leaving `collector/src/routing-config.ts` with zero diff; no competing grammar or duplicate change was retained. Assertions were not weakened and no retry was added. `git diff --check` passed. Collector typecheck passed during verification, then a final rerun became red from concurrent unrelated edits requiring `limit` and `offset` in `ListIncidentsQuery` fixtures in `incident-service.test.ts` and `provider.test.ts`; this lane did not modify those moving files. No commit, deploy, or subagent. Type-diagnostic correction 2026-08-12: `BriefDeps.skillExists` was added to five affected fixtures, `claimLaunch` transaction callback now preserves the `LaunchClaimResult` discriminated literals, and validated wrapper/timeout values are captured before the async launcher callback so TypeScript retains narrowing. The requested focused incident run passes 75/75 tests with 260 assertions. `routes.test.ts` passed repeated execution. `git diff --check` is clean. Every diagnostic present at request start is cleared. Collector typecheck cannot reach a stable green receipt because a concurrent lane is actively creating and rewriting `resolution-learning.ts`, its tests, and verifier contracts: consecutive checks changed from missing module, to `ArtifactDocument.evidence`, to missing `rename`, then to seven verifier fixture signature mismatches plus service/provider contract mismatches. This correction did not modify or overwrite that moving concurrent WIP. Full collector suite identified the requested intermittent unrelated test as `routing config endpoints > rejects noncanonical account slugs` at `collector/test/routing-config.test.ts:90`: 779 passed, 2 skipped, 1 failed. No unrelated routing code was modified. No commit, deploy, or subagent. Owner supplied three independently verified ship blockers on 2026-08-12 and required preserved-WIP, no-commit TDD repair in the existing worktree. Launcher/result-file RED was observed as 3 expected failures; minimal repair then passed 22/22 focused launcher+runner tests with 57 assertions: canonical active-unit adoption, `MemoryMax=2G`, `TasksMax=512`, `LimitFSIZE=16M`, and no-follow regular-file/64 KiB result validation. Lease-loss RED was later observed; metadata save/read, board move, launcher admission, and launch-failure status projection now have before/after holder renewal fences, timer renewal loss is sticky, and lease errors bypass further side effects. Recovery suite passed 8/8 with 36 assertions. A real-process 200 KiB stdout/stderr cap regression was added, but two RED attempts were refused before execution when `/home/user/.claude/buildbox-hosts.json` disappeared again. Output-cap production code, focused typecheck, and full focused verification remain undone. Structural inspection found no `advanceLaunchPhase` signature mismatch: source and calls at `incident-mutation-store.test.ts:62-66` all use seven arguments. Latest `git diff --check` passed. No commit was made. Evidence-resolution receipt 2026-08-12: requested CLI baseline passed 12/12. TDD RED proved arbitrary prose artifact `I fixed it` reached the resolution mutation path. Minimal server-side enforcement now rejects resolution unless an injected authoritative verifier attests the artifact; rejection occurs before metadata, board, or close mutations. Existing resolution tests explicitly inject verified evidence. Provider propagates the named artifact refusal instead of misreporting collector outage. Focused `incident-service` + `provider` tests passed (54 total); `git diff --check` passed. Collector typecheck could not start source checking because this worktree lacks the configured `bun` type definition (`TS2688`). Durable KB write/provenance, idempotent update, and taxonomy-bound skill proposal behavior remain unimplemented; production has no verifier wired, so resolution fails closed rather than accepting unverified evidence. No owner/retrieved text is executed by this slice. No commit or deploy. Owner also assigned a bounded UI worker in the same preserved worktree: move filing into existing `DetailDrawer`; enforce exact canonical labels/order and `File and dispatch`; expose `Unsafe` only through authoritative permission capability; remove all incident-history selector fallback; add priority filtering and responsive `DataTable` priorities; show authoritative provenance, brief, similar-incident, resolution-evidence, and degraded-state detail. UI worker MUST preserve concurrent collector WIP, avoid collector launch/backfill files, use TDD, run focused web tests/typecheck when feasible plus `git diff --check`, and make no commit/deploy. UI receipt 2026-08-12: filing now opens in existing `DetailDrawer`, uses exact canonical field order, submits as `File and dispatch`, defaults Unsafe off, enables Unsafe only when selected authoritative capability declares it, and disables filing when authoritative options are absent. Incident-history selector fallback is no longer used. Priority filtering was added. Existing detail now renders authoritative brief provenance in addition to brief, lifecycle, summary, and coverage/degraded states. `git diff --check` passed. Focused test/typecheck commands reached a stale remote mirror that repeatedly ran the pre-edit test name, so those outputs are not accepted as verification; direct app check then stopped because `@astrojs/check` was unavailable locally and requested an interactive install, which was not performed. Responsive column priorities are blocked by an exact existing-primitive gap: installed `@platform-modules/ui-primitives` `DataTableColumn` exposes only id/header/cell/sort/search/resizing widths, with no responsive priority or hide API. Similar-incident and resolution-evidence UI remain blocked because the current authoritative browser `Incident` wire shape exposes neither field; no data was invented. No collector launch/backfill file, new primitive, commit, or deploy was made. Historical lane implemented conflict-isolated `collector/src/incidents/historical-reconciliation.ts` with focused tests. Repository artifact recovery found one authoritative candidate source: `collector/test/fixtures/offload/status-incident-2026-07-18.json`. Inventory emits stable source/record IDs for wedged dispatch, queue wedge, and failed jobs; preserves raw provenance; never substitutes observation time for missing original event timestamps; marks all four records explicitly unresolved because canonical type and original event time lack authority. Reconciler uses versioned length-prefixed SHA-256 dedup keys, compares stored provenance before create, treats exact reruns as existing, treats provenance conflicts as unresolved, and reports per-source/type discovered/eligible/created/existing/unresolved counts. Focused tests: 3 pass, 0 fail, 17 assertions. `git diff --check`: clean. Full collector typecheck has no errors in this slice; it remains blocked by concurrent launch-recovery WIP at `collector/src/incidents/incident-mutation-store.ts:143` (`result: string` is wider than `LaunchClaimResult`). No commit or deploy performed. Missing authority remains exact: no recovered source provides original event timestamp plus canonical type for these telemetry records, so reconciliation correctly creates zero Kanboard incidents. Historical next action: run inventory against any deployed source export that supplies stable record IDs, original event timestamps, and canonical types; absent that authority, keep records unresolved and perform zero writes. Evidence-resolution completion receipt 2026-08-12: production now uses a concrete verifier against the canonical strict runner result schema (`incident.result`, `resolved`, bounded non-empty summary). Verification uses one no-follow file handle, a 64 KiB cap, incident-bound artifact basename, canonical taxonomy lookup, and SHA-256 hashes for the source incident plus artifact. Resolution records canonical `incidents/kb/.md` content and a taxonomy-bound `incident-skill-update-proposal/v1` record because no direct skill-edit authority exists; arbitrary skill docs are never edited. Writes reject unsafe IDs, traversal, artifact symlinks, output-directory symlinks, conflicting provenance, and concurrent overwrite; same evidence is idempotent. Owner summary and result text remain serialized data. Durable learning MUST succeed before status, board, or close mutations. Provider production wiring uses deployed incident assets and preserves named artifact refusals. TDD RED covered missing implementation, canonical schema mismatch, and symlinked output escape. Final focused verification passed 60/60 tests across resolution learning, incident service, and provider; collector-local TypeScript check passed; `git diff --check` passed. No commit or deploy. Security-blocker repair receipt 2026-08-12: preserved concurrent routing WIP; coordinator confirmed canonical slug repair and two clean full collector runs. TDD RED/GREEN added server-side list bounds: default 50, max 100, query max 256 characters, non-negative offset, and slicing before metadata hydration. TDD RED/GREEN proved list/detail metadata repair writes and removed implicit read-time backfill; explicit reconciliation remains the mutation path. Runner request now accepts only the exact persisted dispatch brief, never raw title/description; owner text is delimited as ``, retrieved summaries retain escaped `` boundaries, and launch brief/provenance is included in the fenced metadata write before runner admission so persistence failure prevents launch. Service-shared `activeLease`/loss state was removed; each mutation carries local key/holder/loss context through every lease fence and launch-phase mutation. UI filing restored the authoritative type `Select` with explicit honest `Unresolved`, using existing deck-ui primitives only and omitting `incidentType` when unresolved rather than guessing. Verification: incident routes 14/14; focused collector launch/service/runner suite 72/72; combined focused incident suite passed; collector `pnpm exec tsc --noEmit` clean; web typecheck 220 files with 0 errors/warnings/hints; `git diff --check` clean. Remaining ship blocker: automatic runner still projects a bare `resolved` result directly through `recordStatus`, bypassing the verifier/learning transaction used by manual resolution. No commit, deploy, or subagent. Final security-blocker receipt 2026-08-12: automatic runner no longer projects `resolved` through `recordStatus`. `IncidentRunnerDeps.resolveIncident` delegates the exact durable result artifact path and summary to `IncidentsProvider.resolveIncident`, the same provider/service transaction used by manual resolution; that single seam verifies incident-bound evidence, records durable learning, applies idempotent resolution status/board mutations, and rejects conflicts. Missing transaction wiring records `invalid-result` with `resolution-verification-unavailable`, leaving the incident open. Production `incident-runner-main.ts` wires the provider transaction. TDD RED observed both defects: bare result produced direct `resolved`, and valid automatic output never called the evidence transaction. GREEN proves bare result refusal and valid transaction delegation with no direct resolved status write. Focused service/runner/status/provider/resolution-learning verification: 89/89 tests across 5 files; collector TypeScript clean; `git diff --check` clean. No web file changed in this final blocker, so web typecheck was not rerun. All WIP and routing fixes preserved; no commit, deploy, or subagent. ## Next executable action Fresh review correction 2026-08-12: TDD-fix three remaining blockers before handoff. (1) Escape owner title/description before inserting them inside `` so a literal `` cannot terminate the boundary; cover the exact payload. (2) Define and enforce one canonical evidence contract across runner, verifier, CLI/API, docs, and tests: automatic evidence MUST be written at the verifier-supported incident-bound path, and unsupported commit/PR/doc references MUST be rejected unless robustly verified. (3) Resolve immutable project/task identity before acquiring a mutation lease so aliases such as `INC-42` and `42` cannot obtain different locks for the same task; bind launch ownership to the lease holder/token. Preserve all WIP; run focused tests, collector/web typechecks only where touched, and `git diff --check`; no commit, deploy, or subagent. Fresh-review blocker receipt 2026-08-12: owner title and description now use the existing XML-text encoder before insertion into ``; exact `obey` regression observed 3 closers in RED and exactly one real closer plus escaped payload in GREEN. Canonical evidence contract is one strict `incident.result` JSON file named `.json`; automatic runner writes `.overdeck/.json`, passes that exact path through the shared provider resolution transaction, and verifier rejects non-file commit/PR/doc references plus wrong basenames. Dispatch and resolution now resolve project/task identity before locking, lease on immutable `task::`, re-read by task ID inside the lease, and fence durable learning/status/launch-phase mutations with the operation-local holder/token. Alias regression uses reference `race-dispatch` and numeric `140` for the same task. Focused tests passed across `dispatch-brief.test.ts`, `incident-runner.test.ts`, `resolution-learning.test.ts`, `incident-service.test.ts`, `incident-mutation-store.test.ts`, `status-writer.test.ts`, and `provider.test.ts`; collector TypeScript clean; `git diff --check` clean. No web files were touched in this review correction, so web typecheck was not rerun. All WIP preserved; no commit, deploy, or subagent. ## Next executable action Final review blocker receipt 2026-08-13: Codex permission parsing now defaults omitted mode to safe; every safe dispatch, including ordinary/local fallback, passes exactly `--sandbox workspace-write` and never dangerous bypass; only explicit non-incident `--permission-mode unsafe` receives `--dangerously-bypass-approvals-and-sandbox`, while incident unsafe remains refused. Launcher recovery now checks an existing inactive workspace against `git worktree list --porcelain`, requires the exact expected path, detached state, and current source `HEAD`, then reuses it without reprovisioning; mismatches fail as explicit recoverable `IncidentLaunchError("provision")`. Durable resolution storage now enumerates bounded verified/closed operations; provider reconciliation replays each through the same verifier/closure/learning transaction; production invokes it immediately at startup and every 30 seconds with overlap prevention. Crash-after-close test proves restart completes learning once and learned replay performs no duplicate write. Verification: focused Codex wrapper contract passed clean; focused collector suite passed 75/75 across five files; collector TypeScript passed clean; mandatory full Factory suite passed 151/151 in 532.52 seconds; `git diff --check` passed. All pre-existing WIP remains present. Per owner scope, no commit, deploy, or subagent occurred. Coordinator conclusive-review receipt 2026-08-13: fresh adversarial review found three HIGH ship blockers. (1) Active service adoption trusts predictable service name without verifying persisted dispatch identity, command, workspace, or request. (2) Inactive worktree reuse validates path/detached/source revision but accepts tracked modifications and hostile untracked files, and does not bind repository/worktree contents to dispatch identity. (3) resolution verifier accepts any readable correctly named artifact rather than deriving and enforcing `/.overdeck/.json` server-side. These findings invalidate prior "no known blocker" status and block landing. Existing WIP remains preserved; no commit or deployment occurred. Standalone `index.ts` missing-global diagnostics remain editor-environment noise unless collector project typecheck reproduces them. ## Acceptance delta - Active service reuse MUST verify persisted dispatch identity plus authoritative service command, workspace, and request properties; any mismatch MUST fail closed. - Inactive worktree reuse MUST verify canonical repository identity, exact path, expected commit, detached state, clean index, zero tracked modifications, zero untracked files, and dispatch-specific identity; unexpected state MUST fail closed. - Resolution artifact location MUST be derived server-side and equal `/.overdeck/.json`; caller-supplied readable paths outside that workspace MUST be rejected. ## Next executable action Three conclusive HIGH blockers were TDD-repaired on 2026-08-13. RED receipts: active service mismatch and dirty/dispatch-mismatched inactive worktree each resolved before repair when rejection was required. GREEN: active adoption now requires exact persisted dispatch ID, canonical workspace, runner command, executable, and encoded request from authoritative systemd properties; new units persist those properties. Inactive reuse now requires exact registered detached path/HEAD, canonical worktree root, empty porcelain status including all untracked files, and exact worktree-scoped dispatch identity. New worktrees persist dispatch identity before launch. Resolution verification now derives `/.overdeck/.json` from server-owned `workspaceFor` authority and rejects every caller path mismatch before opening it. Focused launcher/resolution tests passed 14/14 with 40 assertions; collector `pnpm exec tsc --noEmit` passed clean; `git diff --check` passed. No commit, deployment, or subagent occurred. Warning: no broad collector suite was requested or run; existing unrelated WIP remains unverified by this lane. ## Next executable action Fresh independent review receipt 2026-08-13: three reported findings require reproduction before shipment. (1) Production `incident-runner-main.ts` may omit durable mutation-store and canonical workspace authority, preventing successful resolution completion. (2) Strict agent-authored `incident.result` verifies artifact integrity/location but may not independently verify commit, test receipt, or live state; NEVER treat agent assertion alone as verified evidence if authoritative contract requires external proof. (3) `incident-service.ts` may fetch/hydrate full history before slicing despite bounded response pagination. Review was read-only; runtime proof absent. Existing WIP preserved; no commit/deploy. ## Acceptance delta - Production automatic resolution MUST use durable mutation storage and server-owned canonical workspace authority through one authenticated collector transaction; prove terminal resolution and restart recovery. - Resolution MUST NOT close or teach from agent assertion alone. Evidence MUST bind to independently server-verified canonical commit, durable test receipt, or allowlisted live-state check defined by authoritative contract. - Listing MUST bound upstream scan and metadata hydration, not only returned rows. Apply filters/pagination before hydration and fetch large searches in bounded chunks. ## Next executable action Fresh three-finding verification receipt 2026-08-13: findings (1) and (3) were confirmed. Production `incident-runner-main.ts` created its provider without the durable `IncidentMutationStore` or `workspaceFor`; automatic resolution therefore failed at verifier workspace authority before it could complete or persist the shared resolution transaction. Production runner now opens `incidentMutationDbFile()`, passes that store, and binds workspace authority to the decoded server-owned runner request while rejecting any different incident ID. Listing RED proved a `limit: 3` request hydrated metadata for all 120 upstream tasks. Filtering and pagination now operate on authoritative task fields before metadata hydration; GREEN hydrates exactly three records. Finding (2) was refuted against canonical authority: `docs/specs/2026-08-08-incident-brief-design.md:150-156` explicitly defines the required resolution artifact as a non-empty free-form reference recorded with the summary, not independently verified commit/test/live-state proof. The later strict incident-bound JSON file contract strengthens artifact integrity but does not create authority for those new evidence kinds. Implementing review-proposed commit/test/live-state verification would invent a conflicting contract, so no evidence-schema mutation was made. Exact parser test at `collector/src/incidents/incident-runner.test.ts:50-54` remains only syntax validation; closure still routes through the server verifier. Focused verification passed 120/120 tests across incident service, runner, resolution learning, and provider; collector TypeScript passed clean; `git diff --check` passed. All preserved WIP remains; no commit, deploy, or subagent. ## Next executable action Fresh post-repair review receipt 2026-08-13: two verified HIGH ship blockers remain. (1) `provider.ts` recovery rebuilds and re-verifies evidence after durable `verified` phase; changed/missing artifact or rebuilt hash can conflict forever. Recovery MUST resume persisted evidence and phase without re-verification. (2) pre-hydration slicing reduced metadata work but `incident-service.ts` still fetches, materializes, sorts, and filters full upstream task history before slicing. A small limit does not bound network/memory/CPU. Existing WIP preserved; no commit/deploy. Installed service identity and runtime artifacts remain unverified. ## Acceptance delta - Durable resolution recovery MUST treat persisted evidence and phase as authority after claim. NEVER reconstruct or re-verify `verified`/`closed` operations. Resume remaining transitions idempotently. - Listing MUST use deterministic upstream pagination and stop after requested page fills. If upstream filters cannot satisfy request within bounded work, enforce hard scan budget and expose incomplete coverage honestly. ## Next executable action Add or adopt an authoritative Kanboard server-side bounded task-list procedure with stable ordering, opaque cursor, requested limit, supported filters, and an exhaustion indicator. Then extend `KanboardRpcClient`, implement collector scan-budget/incomplete coverage semantics, and add `limit=1` upstream-call/filter/offset tests. Do not approximate pagination by fetching full history or scanning guessed IDs. Owner execution update 2026-08-13: work directly in preserved worktree; inspect Kanboard API/client capability before design; recovery after durable `verified`/`closed` MUST consume persisted evidence and phase without artifact reconstruction or re-verification; prove changed and deleted artifacts, idempotent remaining transitions, and no permanent conflict. Listing MUST bound upstream calls, scanned/materialized rows, sorting, and filtering; deterministic pagination MUST preserve filters/offset; hard scan-budget exhaustion MUST expose incomplete coverage honestly. Preserve WIP. No subagents, commit, or deployment. Run focused tests, full collector test/typecheck if feasible, and `git diff --check`. Kanboard capability receipt: canonical Kanboard 1.2.52 task API exposes `getAllTasks(project_id,status_id)` and `searchTasks(project_id,query)` only; neither supports limit, offset, page, ordering, range, or cursor. Current client accurately exposes only `getAllTasks` parameters. Implementation MUST NOT invent pagination parameters; bounded listing must use supported point reads or report incomplete coverage. Two-blocker execution receipt 2026-08-13: durable resolution recovery now calls a dedicated `resumeResolution` seam with the persisted task ID, evidence JSON/hash, and phase. Recovery never calls the artifact verifier or rebuilds evidence after durable claim. Shared completion logic resumes only remaining `verified → closed → learned` transitions under the task lease; same evidence remains idempotent. Focused tests explicitly cover both changed-artifact and deleted-artifact verifier failures and prove zero verifier calls, one learning write, and no pending operation. Focused incident-service/provider/mutation-store gate passed 69/69; collector TypeScript passed clean; full collector suite passed; `git diff --check` passed. No commit, deployment, or subagent occurred. Listing blocker: exact requested upstream bound is impossible through canonical Kanboard 1.2.52 JSON-RPC. `getAllTasks` and `searchTasks` both force Kanboard to materialize the complete result and provide no cursor/range/order/page controls; Kanboard exposes no `getAllTaskIds`. Client-side slicing, chunked filtering, or guessed numeric `getTask` scans would either leave upstream work unbounded or produce incorrect pagination. No API was invented and no incomplete listing implementation was added. Robust next action requires an authoritative bounded Kanboard plugin procedure (stable order + cursor + limit + exhausted flag), then collector hard scan budget and honest incomplete coverage can be implemented against it. Bounded Kanboard extension receipt 2026-08-13: production authority was exhausted rather than accepting the prior blocker. Live service inspection proved Kanboard runs the pinned 1.2.52 image, persists `/var/www/app/data`, and has a writable plugin mount but no installed plugins. Repository deployment previously declared the container but never installed its unit during `deploy-local`. Added tracked read-only `OverdeckIncidents` plugin mount and fail-closed installer/deploy step. Plugin procedure `overdeck.listTasksBounded` validates limit 1–100, non-negative offset, query ≤256 bytes, optional status/priority filters, applies all filters in SQL, orders by task ID descending, fetches only `limit + 1`, and returns bounded tasks, next offset, exhaustion, completeness, and order identity. Collector now requires this procedure for incident listing, passes filters/offset upstream, hydrates only returned rows, and fails closed on absent/malformed/incomplete/unstable procedure results; it no longer falls back to `getAllTasks` for list requests. Plugin contract tests and PHP syntax checks pass; focused collector service tests pass 54/54; collector TypeScript and `git diff --check` pass. Full collector test run was attempted but the command exited during the existing broad suite after an unrelated hook-controls test; captured output contained no failure before termination, so it is not a green full-suite receipt. Per owner scope, no commit or deployment occurred. ## Next executable action Fresh bounded-listing review receipt 2026-08-13: six concrete ship blockers remain. (1) Service discards plugin pagination metadata; inventory silently truncates after 50 with no traversal. (2) offset pagination shifts under concurrent insert/delete; plugin MUST use immutable-ID keyset cursor and stable high-water mark. (3) filing idempotency recovery still calls unbounded `getAllTasks` after reference miss; add project-scoped indexed exact-reference procedure or durable mapping. (4) SQL `LIKE` treats `%`/`_` as wildcards; literal query semantics require escaping with explicit escape character. (5) deployment checks one file plus unauthenticated root only; complete plugin tree, PHP load/registration, and authenticated bounded JSON-RPC schema canary MUST gate success and roll back failure. (6) one malformed/failing persisted resolution aborts batch and starves later operations; validate/quarantine per record and recover with fair cursor. Existing WIP preserved; no commit/deploy. Prior persisted-evidence phase resume remains necessary but insufficient. ## Acceptance delta - Propagate validated pagination metadata through service, route, CLI/browser client; provide page traversal/load-more until exhausted. - Replace offset with keyset cursor over immutable task ID plus stable high-water mark. Concurrent changes MUST NOT skip/duplicate snapshot rows. - Remove all filing-recovery `getAllTasks` calls. Use bounded indexed exact-reference lookup or transactionally persisted idempotency mapping. - Escape `%`, `_`, and escape character for literal SQL `LIKE` semantics. - Deployment MUST validate full plugin tree, PHP loading/registration, and authenticated `limit=1` JSON-RPC response schema; roll back on failure. - Resolution reconciliation MUST isolate each record, validate persisted evidence, quarantine invalid operations, and advance fairly so one poison record cannot starve others. ## Next executable action TDD-fix six blockers as one coherent plugin/client/service/deploy contract. Run plugin unit/contract tests, collector focused/full tests and typecheck, deployment rollback tests, UI/CLI traversal tests, `git diff --check`, then fresh independent review. Shipment remains blocked. Six-blocker implementation receipt 2026-08-13: bounded listing now uses immutable task-ID keyset pagination with a server-issued stable high-water snapshot; validated `highWater`, `nextCursor`, exhaustion, and order metadata propagate through collector service/route, browser infinite-query load-more, and CLI traversal. Literal query matching escapes `!`, `%`, and `_`. Filing recovery no longer scans `getAllTasks`; canonical project-scoped indexed `getTaskByReference` is the sole recovery lookup because creation persists the immutable request ID as the task reference. Resolution reconciliation persists a fair cursor, validates each persisted evidence envelope, isolates failures, quarantines poison records, and continues later operations. Kanboard deployment validates the complete PHP tree, restarts atomically, requires authenticated JSON-RPC `limit=1` schema canary success, and restores the previous unit on failure. Verification: plugin contract/PHP syntax/install-script syntax clean; focused collector 39/39; full collector suite passed; collector TypeScript clean; web typecheck 220 files with zero errors/warnings/hints; web suite passed including 18 incident tests; CLI 12/12; `git diff --check` clean. Remote-only test wrappers briefly refused unavailable fleet dispatch; direct project test commands then completed cleanly without browser/dev-server workload. No commit or deployment occurred. ## Next executable action Fresh six-blocker review receipt 2026-08-13: four ship blockers remain. (1) `provider.ts` quarantines all reconciliation failures; transient Kanboard/readiness/projection/storage outages become permanent. Quarantine only proven validation failures; persist bounded retry metadata for transient failures. (2) resumed resolution validates project but not full operation/task/project/incident/evidence identity; stale task reuse can apply old evidence to wrong incident. Require exact identity match before side effects. (3) deployment rollback restarts prior unit while rejected plugin tree remains mounted. Use immutable plugin releases with atomic active target; on failure restore and canary previous target. (4) pinned Kanboard query builder ignores requested LIKE escape argument, so `%`, `_`, `!` remain wildcard/escape hazards. Use supported parameterized `ILIKE ? ESCAPE '!'` and test against pinned database. Existing WIP preserved; no commit/deploy. Branch remains 381 commits behind current main. ## Acceptance delta - Classify reconciliation errors. Quarantine only deterministic malformed/identity failures. Retry transient failures fairly with bounded attempts/backoff metadata and no starvation. - Before resumed side effect, bind and compare operation ID, task ID, project ID, incident ID, evidence hash, and persisted evidence incident identity. - Deploy plugin as immutable release plus atomic active target. Failed canary MUST restore previous target and prove previous authenticated canary before declaring rollback successful. - Literal search MUST use parameterized SQL condition with explicit `ESCAPE '!'` supported by pinned database/query layer. Test `%`, `_`, `!`, and mixed text against actual pinned database behavior. ## Next executable action TDD-fix four blockers. Run focused/full collector gates, pinned-database plugin integration tests, deployment success/failure/rollback canaries, `git diff --check`, then fresh review. Shipment remains blocked. Four-blocker execution receipt 2026-08-13: resolution reconciliation now quarantines only deterministic persisted-envelope/hash identity corruption. Operational failures remain pending with capped exponential backoff, bounded retry counters, last-error metadata, and cursor advancement after every record so one outage cannot starve later operations. Resume rechecks task ID, project ID, canonical incident ID, persisted evidence incident ID, and evidence hash before status, board, close, or learning side effects. Kanboard plugin deployment now copies content-addressed immutable releases, atomically switches one active symlink, and on failed authenticated canary restores the prior target, restarts, and requires a successful prior authenticated canary before reporting rollback. Plugin SQL now uses prepared positional parameters with explicit `ILIKE ? ESCAPE '!'`; a pinned PostgreSQL integration test proves literal `%`, `_`, `!`, and mixed strings. Verification: focused collector 25/25, full collector suite passed, collector TypeScript clean, PHP contract and syntax clean, pinned PostgreSQL literal integration passed, installer shell syntax clean, and `git diff --check` clean. Pinned image emitted an upstream missing-locale warning during integration despite no-locale initialization; result was otherwise clean. Missing receipt: no automated deployment success/failure/rollback harness existed, and this lane did not add or run one before stop. No commit or deployment occurred. ## Next executable action Add a hermetic installer test with fake `systemctl` and authenticated canary responses covering candidate success, candidate failure with prior-target restoration, and failed previous-target canary. Then rerun focused/full gates. Do not commit or deploy. Owner execution update 2026-08-13: worker `claude` is adding the remaining hermetic immutable-deployment gate in preserved worktree `/home/user/Projects/overdeck/.worktrees/incidents-179-233-234`. Tests MUST isolate `HOME`, deploy assets, service control, and authenticated canary responses; MUST NOT mutate live runtime. TDD receipt MUST show the new test failing before the test boundary exists, then passing for candidate success, candidate canary failure with previous-target restoration, and successful/failed previous authenticated rollback canaries. Preserve all WIP. Run new tests, shell/PHP checks, relevant collector tests/typecheck, and `git diff --check`. No commit, deployment, or subagents. Conclusive review receipt 2026-08-13: two blockers remain. (1) First-ever Kanboard plugin install has no previous target. Candidate canary failure removes active symlink but does not stop/restart service, so rejected plugin code remains loaded. Safe first-install rollback MUST unload rejected code and verify plugin absence/inactivity. (2) bundled harness WIP in `modules/harness/wrappers/lib/remote-seat.sh` breaks established explicit unsafe non-incident local fallback; unsafe incident dispatch MUST remain rejected, while non-incident explicit unsafe retains local fallback. This second defect is outside Incidents scope but is present in preserved delta; fix it or exclude exact unrelated files before shipment. Existing WIP preserved; no commit/deploy. ## Acceptance delta - First-install candidate failure MUST remove active target, stop/restart Kanboard into plugin-absent state, and verify rejected procedure is unavailable. Add hermetic no-previous-release rollback test. - Explicit unsafe non-incident remote refusal MUST return established local-fallback result. Unsafe incident dispatch MUST remain fail-closed. Add end-to-end wrapper test or exclude unrelated harness delta if semantically independent. ## Next executable action Conclusive two-blocker execution receipt 2026-08-13: first-install Kanboard candidate failure now removes the active target, restarts Kanboard without the plugin, and requires an authenticated JSON-RPC `-32601 Method not found` response before reporting safe rollback. Hermetic RED proved the rejected candidate remained loaded because only one restart occurred; GREEN covers candidate success, prior-release rollback, failed prior rollback canary, and no-prior plugin-absence rollback. Bundled remote-seat dispatch now returns immediately to the established local path for explicit unsafe non-incident Codex work, while explicit unsafe incident dispatch remains rejected before remote or local execution. End-to-end seat contract regressions observed the unsafe ordinary fallback RED and now prove both branches. The pre-existing Codex session fixture was minimally corrected to identify the engine invocation after the new binary-level safe approval flag; production behavior was unchanged. Verification: installer tests and shell syntax clean; seat contract 92/92; Codex wrapper session 12/12; mandatory Factory suite 131/131; focused incidents 141 passed, 2 intentional live skips; full collector 752 passed, 2 intentional live skips; collector TypeScript clean; `git diff --check` clean. All preserved WIP remains. No commit, deployment, or subagent occurred. ## Next executable action First-install rollback correction receipt 2026-08-13: hermetic installer test now makes fake `systemctl restart` fail when the Quadlet bind source is absent, reproducing the final P1. RED proved removing `$ACTIVE` leaves restart without its bind source. GREEN installs a read-only empty plugin directory as an immutable release target, atomically points `$ACTIVE` to it, restarts successfully, and requires authenticated `-32601 Method not found` before reporting rollback. Prior installs still atomically restore the exact previous target and require its authenticated canary. Installer scenarios pass for success, candidate failure, rollback-canary failure, and first-install failure; shell syntax, all plugin PHP syntax, bounded-page plugin test, pinned literal-search integration, and `git diff --check` pass. The pinned PostgreSQL image again emitted its known missing-locale warning; the test does not use locale-dependent behavior, and all literal-match assertions passed. No commit, deployment, or subagent occurred. Final review receipt 2026-08-13: independent narrow verification found no P0/P1/P2 blocker after empty-release rollback correction. Active bind source exists before restart; authenticated absence canary is strict; prior release restores exactly. Broad sequential gates immediately before narrow installer correction were clean: collector, Factory, deck-ui, web, plugin, wrapper, CLI, and diff checks. Narrow post-correction installer/plugin/PostgreSQL/diff gates passed; known pinned PostgreSQL missing-locale warning is benign because tested literal comparisons are locale-independent. Standalone editor missing-global/JSX diagnostics remain non-authoritative; canonical project typechecks passed. No commit/deploy yet. ## Next executable action Merge reconciliation receipt 2026-08-13: semantically resolved eight conflicted files against current main. Preserved Incidents pagination, durable mutation/recovery, evidence-gated resolution, production launcher, and complete receipts; retained current-main Factory detail limits, server config persistence, report paths, React query cancellation, every unrelated index row, and current plan additions. Removed superseded duplicate launcher types while keeping compatibility for current-main provider fixtures. Collector typecheck passed. Focused incident/routes tests passed: 152 pass, 2 intentional live-Kanboard skips, 0 fail, 492 assertions. Both staged and unstaged `git diff --check` passed; no conflict markers or unresolved index entries remain. ## Next executable action Create the merge commit. Then return control to the Incidents delivery plan for landing, deployment, and owner-visible browser proof. ## Superseded (2026-08-15) Superseded by [2026-08-14-request-intake.md](2026-08-14-request-intake.md): the owner ruled that incidents and tasks are ONE store with an `origin` field distinguishing them, not two separate systems — and that unified request-intake model shipped (`08a88c193`, verified ancestor of `origin/main`). This file stays as the record of the incidents redesign, backfill, and security-hardening work it delivered.