{"type":"meta","slug":"delivery-controller-receipts","base_branch":"main","gate0_mode":"strict","preset":"cursor-codex","land_mode":"merge-to-main"}
{"type":"goal","text":"Implement amended delivery-controller and validation-receipt foundation as one buildable DAG while plans without delivery_controller retain byte-identical legacy gate and land behavior."}
{"type":"methodology","text":"Contract-first TDD; strict gate0 after every task; opt-in policy then durable store; isolated controller/receipt/workspace seams; wrap existing gate/ship/publication paths; integrate daemon ownership last; no retention machinery."}
{"type":"intent","text":"Make harnessd sole durable delivery authority, validate each exact tree once, publish through credential-isolated compare-and-swap, and terminate no-smoke repositories at truthful PUBLISHED success."}
{"type":"direction","verbatim":"legacy byte-identical when policy field absent"}
{"type":"direction","verbatim":"Never counterfeit PREVIEW_READY stays."}
{"type":"deferred","text":"CI topology and one-job candidate workflow","reason":"Phase 1 wraps current gate0 path only."}
{"type":"deferred","text":"Risk-tiered gate selection, changed-flow selector, bisection, candidate coalescing, and remote executor migration","reason":"Requires later gate-graph and executor phases."}
{"type":"deferred","text":"Full multi-repository gate registry and per-check conversion","reason":"Phase 1 uses one broad gate0/v1 node."}
{"type":"deferred","text":"Artifact build-once and deploy-exact integration","reason":"Current repository land adapter emits no artifact digest."}
{"type":"deferred","text":"Preview UI, notifications, and Works close/reopen workflow","reason":"No UI surface in controller foundation."}
{"type":"deferred","text":"Multideal preview-smoke adapter using deploy-probe verification","reason":"Current .claude/scripts/ship.sh exposes land only; phase-1 success terminates at PUBLISHED."}
{"type":"deferred","text":"Recovery bundles and one-time ref/worktree cleanup","reason":"Owned by recovery phase."}
{"type":"deferred","text":"delivery.db backup and retention policy","reason":"Confirmed recovery-phase scope; this plan adds no retention schema, jobs, or configuration."}
{"type":"deferred","text":"Existing pre-push and CI workflow removal","reason":"Compatibility phase retains current workflows."}
{"type":"deferred","text":"Legacy delivery-policy retirement","reason":"Requires proof of zero active legacy runs after deployment."}
{"type":"gated","id":"g-protected-delivery","category":"policy","needs":"Authorize declared harness source/spec/test changes","why":"Implementation touches protected src/ and spec/ paths; user explicitly requested a run-plan implementing the amended delivery spec.","options":["proceed","abort"],"status":"RESOLVED","answer":{"protectedPaths":["src/","spec/"]},"resolved_by":"user","source":"author","binds_meta":null}
{"type":"anchor","path":"docs/specs/2026-07-18-delivery-controller-receipts-design.md","what":"Amended delivery-controller and receipt design source of truth, including terminal PUBLISHED state."}
{"type":"anchor","path":"docs/specs/2026-07-18-delivery-controller-receipts-design.md","what":"Non-negotiable compatibility contract: absent delivery_controller selects legacy; current gate loop, journals, and land behavior remain byte-identical."}
{"type":"task","id":"t1","wave":1,"seat":"coder","tier":"high","desc":"Implement amended spec Contract 1: sole opt-in delivery policy boundary, exact delivery_controller v1 activation, unknown-value preflight rejection, and absent-field legacy selection. Acceptance evidence: src/test/delivery-policy.test.js and src/test/delivery-legacy.test.js via `node --test src/test/delivery-policy.test.js src/test/delivery-legacy.test.js`. Commit only: src/delivery/policy.js, src/test/delivery-policy.test.js, src/test/delivery-legacy.test.js, test/fixtures/delivery-legacy/.","deps":[],"requires_decision":"g-protected-delivery"}
{"type":"task","id":"t2","wave":2,"seat":"coder","tier":"high","desc":"Implement amended spec Contract 3 durable store: delivery/transition/workspace/publication/receipt/check schema, WAL FULL durability, CAS transactions, immutable terminal proofs, atomic blob writes, integrity/version fail-closed behavior, and no backup/retention machinery. Acceptance evidence: src/test/delivery-store.test.js via `node --test src/test/delivery-store.test.js`. Commit only: src/delivery/store.js, src/test/delivery-store.test.js.","deps":["t1"],"requires_decision":"g-protected-delivery"}
{"type":"task","id":"t3","wave":3,"seat":"coder","tier":"high","desc":"Implement amended spec Contract 2 state machine and crash replay, including terminal PUBLISHED for repositories without smoke adapters, configured-only PREVIEW_SMOKE/PREVIEW_READY, REPAIRING only for actual failures, and product-decision proof. Acceptance evidence: src/test/delivery-controller.test.js via `node --test src/test/delivery-controller.test.js`. Commit only: src/delivery/controller.js, src/test/delivery-controller.test.js.","deps":["t2"],"requires_decision":"g-protected-delivery"}
{"type":"task","id":"t4","wave":3,"seat":"coder","tier":"high","desc":"Implement amended spec Contracts 4-5 receipt identity and reuse: exact Git tree hash, canonical graph/lockfile keys, minimal phase-1 env fingerprint from OS/arch, node -v, pnpm -v, lib/gates.sh digest, and gate-config digest, durable once-per-tree lookup, failed-proof behavior, and blob invalidation. Acceptance evidence: src/test/delivery-receipts.test.js via `node --test src/test/delivery-receipts.test.js`. Commit only: src/delivery/receipts.js, src/test/delivery-receipts.test.js.","deps":["t2"],"requires_decision":"g-protected-delivery"}
{"type":"task","id":"t5","wave":3,"seat":"coder","tier":"high","desc":"Implement amended spec Contract 6 workspace lease seam: clean base-bound task workspaces, owner-generation CAS, clean candidate assembly, safe expiration reconciliation, and current rescue-branch preservation. Acceptance evidence: src/test/delivery-workspaces.test.js via `node --test src/test/delivery-workspaces.test.js`. Commit only: src/delivery/workspaces.js, src/test/delivery-workspaces.test.js.","deps":["t2"],"requires_decision":"g-protected-delivery"}
{"type":"task","id":"t6","wave":4,"seat":"coder","tier":"high","desc":"Implement amended spec Contract 7 receipt-wrapped gate seam: delivery-v1 lookup before gate0, one broad gate0/v1 execution per identity, saved deterministic failure, durable-success requirement, and untouched legacy runGateLoop retries. Acceptance evidence: src/test/delivery-receipts.test.js and src/test/engine-gates.test.js via `node --test src/test/delivery-receipts.test.js src/test/engine-gates.test.js`. Commit only: src/engine/gates.js, src/test/engine-gates.test.js, src/test/delivery-receipts.test.js.","deps":["t4"],"requires_decision":"g-protected-delivery"}
{"type":"task","id":"t7","wave":4,"seat":"coder","tier":"high","desc":"Implement amended spec Contract 8 standalone publication authority: publication lease, receipt/tree/base preconditions, intent/result replay, fast-forward push, exact post-publish tree verification, and exit-code-plus-stderr classification fixtures for [rejected], fetch first, non-fast-forward, stale info, and generic land-failed. Acceptance evidence: src/test/delivery-publication.test.js via `node --test src/test/delivery-publication.test.js`. Commit only: src/delivery/publication.js, src/test/delivery-publication.test.js, test/fixtures/delivery-publication/.","deps":["t3","t4"],"requires_decision":"g-protected-delivery"}
{"type":"task","id":"t8","wave":4,"seat":"coder","tier":"high","desc":"Implement amended spec Contract 9 runner credential boundary: activate delivery IDs and lease tokens without publication credentials, construct delivery-v1 command environment from controller allowlist, reject credential-helper exposure, and preserve full current environment for legacy runs. Acceptance evidence: src/test/delivery-credentials.test.js, src/test/runner-transcript.test.js, and test/runner-integration.sh via `node --test src/test/delivery-credentials.test.js src/test/runner-transcript.test.js && bash test/runner-integration.sh`. Commit only: src/runner.js, src/test/delivery-credentials.test.js, src/test/runner-transcript.test.js, test/runner-integration.sh.","deps":["t1"],"requires_decision":"g-protected-delivery"}
{"type":"task","id":"t9","wave":5,"seat":"coder","tier":"high","desc":"Integrate amended spec Contracts 6-8 into commit/ship path: enforce durable workspace leases around current helpers, assemble candidate, bind receipt proof, pass controller transaction context to landIntegrationOnce, prohibit unguarded land.intent, and route no-smoke published-tree match to PUBLISHED. Acceptance evidence: src/test/delivery-workspaces.test.js and src/test/engine-ship.test.js via `node --test src/test/delivery-workspaces.test.js src/test/engine-ship.test.js`. Commit only: src/engine/lease.js, src/engine/ship.js, src/test/delivery-workspaces.test.js, src/test/engine-ship.test.js.","deps":["t5","t6","t7"],"requires_decision":"g-protected-delivery"}
{"type":"task","id":"t10","wave":6,"seat":"coder","tier":"high","desc":"Integrate amended spec Contracts 9-10 with harnessd: controller-owned sanitized spawn, delivery tick after promote and before statusCache, transition/lease/receipt/publication reconciliation, bounded worker scopes, and zero standalone timers/services. Acceptance evidence: src/daemon.test.js and src/test/delivery-credentials.test.js via `node --test src/daemon.test.js src/test/delivery-credentials.test.js`. Commit only: src/daemon.js, src/daemon.test.js, src/test/delivery-credentials.test.js.","deps":["t3","t8","t9"],"requires_decision":"g-protected-delivery"}
{"type":"task","id":"t11","wave":7,"seat":"coder","tier":"high","desc":"Prove amended spec Contracts 1-10 end to end: crash replay, once-per-tree receipts, CAS/base-moved fixtures, credential denial, current land-only adapter terminating at PUBLISHED, configured-smoke PREVIEW_READY path, legacy byte identity, warning-free full suite, production build, and actual bin/runplan/bin/harnessd launcher resolution. Acceptance evidence: test/delivery-controller-runtime.test.sh via `bash test/delivery-controller-runtime.test.sh && make test`. Commit only: test/delivery-controller-runtime.test.sh, test/fixtures/delivery-controller/.","deps":["t10"],"requires_decision":null}