{"type":"meta","slug":"offload-phase3","base_branch":"origin/main","gate0_mode":"strict","preset":"cursor-only","land_mode":"merge-to-main"}
{"type":"goal","text":"Offload Phase-3 post-land operations: O1 shared Bearer provisioning, O2 controller live on laptop, O3 live spine hooks in ~/.claude, O4 debian1 watchdog, O5 deck E2E acceptance. Sequential live ops after offload-phase2 landed."}
{"type":"methodology","text":"Operational acceptance only — repo code already on origin/main. Execute O1-O5 in order per docs/plans/2026-07-20-offload-phase2.md §Post-land. Record outcomes in docs/plans/offload-phase3-run-record.md. cursor-only preset; land via frozen ship.sh merge-to-main."}
{"type":"intent","text":"Close the live-infra gap between landed Phase-2 code and a running control plane the deck can observe and act on."}
{"type":"direction","verbatim":"continue to phase 3 after offload-phase2 land; use runplan only; follow through like phase 2"}
{"type":"anchor","path":"docs/plans/2026-07-21-offload-phase3.md","what":"plan"}
{"type":"anchor","path":"docs/plans/2026-07-20-offload-phase2.md","what":"O1-O5 full contracts"}
{"type":"anchor","path":"docs/specs/2026-07-18-offload-control-plane-spec.md","what":"wire contracts"}
{"type":"task","id":"o1","wave":1,"seat":"coder","tier":"medium","desc":"Read docs/plans/2026-07-21-offload-phase3.md Task O1 and docs/plans/2026-07-20-offload-phase2.md §O1. Provision shared Bearer: verify laptop $HOME/.config/overdeck/token non-empty mode 0600; copy once to debian1 $HOME/.config/overdeck/token via ssh -p 2222 -i ~/.ssh/id_ed25519_buildbox; remote mode 0600; compare sha256sum local vs remote (never print token). Append outcome to docs/plans/offload-phase3-run-record.md. Acceptance: test -f token && stat -c '%a' token = 0600 locally; same remotely; sha256 match.","requires_decision":null,"verify":["test -f \"$HOME/.config/overdeck/token\" && [ \"$(stat -c '%a' \"$HOME/.config/overdeck/token\")\" = 0600 ]"],"acceptance":["test -f token && stat -c '%a' token = 0600 locally; same remotely; sha256 match"]}
{"type":"task","id":"o2","wave":2,"seat":"coder","tier":"medium","desc":"Read docs/plans/2026-07-21-offload-phase3.md Task O2 and phase-2 §O2. git -C $HOME/.local/share/overdeck/deploy fetch --quiet origin && git -C $HOME/.local/share/overdeck/deploy checkout --quiet --detach origin/main; bash $HOME/.local/share/overdeck/deploy/packaging/deploy-local.sh; systemctl --user enable overdeck-controller.service. Verify curl health 200 with Bearer, 401 without. Record in offload-phase3-run-record.md.","requires_decision":null,"verify":["curl -fsS -o /dev/null -w '%{http_code}' -H \"Authorization: Bearer $(cat \"$HOME/.config/overdeck/token\")\" http://127.0.0.1:8787/health | grep -qx 200"],"acceptance":["`curl` health checks pass","deck offload panels no longer show `controller-down` within one poll cycle"]}
{"type":"task","id":"o3","wave":3,"seat":"coder","tier":"medium","desc":"Read docs/plans/2026-07-21-offload-phase3.md Task O3 and phase-2 §O3 (full contract + executable verification). Mandatory backup remote-build.mjs.pre-phase2-<epoch>. Hand-apply hooks to ONLY ~/.claude/lib/remote-build.mjs per manifest. Run phase-2 O3 executable verification block and fault scenarios on debian1+debian2. Record backup path+sha256 and pass/fail in offload-phase3-run-record.md.","requires_decision":null,"verify":["awk '/^## O3 verification log/{f=1;next} /^## /{f=0} f' docs/plans/offload-phase3-run-record.md | grep -q '| PASS |'"],"acceptance":["O3 executable verification block exits 0","fault scenarios pass","controller stop/restart fail-open test passes"]}
{"type":"task","id":"o4","wave":4,"seat":"coder","tier":"medium","desc":"Read docs/plans/2026-07-21-offload-phase3.md Task O4 and phase-2 §O4. Use OVERDECK_WATCHDOG_WEBHOOK_URL from env (never commit). Provision debian1 watchdog.json mode 0600; run deploy-watchdog.sh from deploy clone. Verify tunnel+watchdog active; heartbeat via 127.0.0.1:18787; tunnel stop triggers exactly one ntfy page per target. Record in offload-phase3-run-record.md.","requires_decision":null,"verify":["awk '/^## O4 verification log/{f=1;next} /^## /{f=0} f' docs/plans/offload-phase3-run-record.md | grep -q '| PASS |'"],"acceptance":["units active","tunnel heartbeat OK","ntfy pages received on tunnel stop (exactly one per target)"]}
{"type":"task","id":"o5","wave":5,"seat":"coder","tier":"medium","desc":"Read docs/plans/2026-07-21-offload-phase3.md Task O5 and phase-2 §O5. Deck /ci shows live offload panels. Pick available host from authenticated /status. box-drain from deck → verify host ineligible; box-restore → available again. Commit docs/plans/offload-phase3-run-record.md with host + outcomes.","requires_decision":null,"verify":["awk '/^## O5 verification log/{f=1;next} /^## /{f=0} f' docs/plans/offload-phase3-run-record.md | grep -q '| PASS |'"],"acceptance":["drain blocks dispatch","restore returns host available/eligible","run record committed"]}