# Master Delivery Plan — Fire Recovery

audience: AI coding agents first.

## Command

NEVER stop working because one lane fails, compacts, loses an agent, or needs reorganization. Reorganization means preserve WIP, update this file, choose next executable step, continue. NEVER interpret owner frustration, cost emergency, or request to reorganize as permission to halt.

Primary outcome: restore a usable workstation by moving Factory, builds, tests, browsers, and agent execution to Debian1/2/3. Cluster idle + laptop hot = emergency defect. Fix execution plane before product polish, review ceremony, transcript archaeology, or Git cleanup.

## Source of truth

Use together:

1. This file: complete lane registry, order, WIP, continuation rules.
2. `docs/plans/2026-08-10-emergency-recovery.md`: measured evidence, architecture constraints, exit criteria.
3. `/home/user/.local/share/overdeck/reports/2026-08-08-session-report.html`: owner-visible live receipt; refresh after every real transition.
4. Transcript: `/home/user/.claude/projects/-home-user/f5f6f15f-b816-485f-b134-63385afdc36e.jsonl.live.jsonl`.
5. Task registry: reconcile status against installed evidence; `completed` is not proof.

After every compaction or interruption: read these two plans, inspect exact active task/process receipts, resume highest executable rung. NEVER restart a duplicate deploy/agent. NEVER discard dirty WIP.

## Non-negotiable operating rules

- NEVER halt globally. Blocked lane → record exact blocker → continue next independent lane.
- NEVER run heavy build, test, browser, image, Factory, or agent workload on laptop.
- NEVER local-fallback. Remote failure must fail closed and name host/step/reason.
- NEVER kill by process name. Preserve owner sessions. Kill only exact agent-owned cgroup/scope or tracked task.
- One implementation worker per seam. No child explorers, panels, repeated reviews, or transcript rereads.
- Use `gpt-5.6-terra` medium for non-review subagents when available. Review-only agents may use review model.
- Install-before-land for local infra. Product code lands before deploy.
- Done = installed/deployed, invoked through real entrypoint, and owner-visible. Commit/test alone is not done.
- Every owner request gets a task plus durable lane entry before implementation.
- Every partial result records path/ref/commit/dirty files/test receipt/blocker here before worker termination.

## FIRE lane — restore execution now (#170, #96, #175)

### Current evidence

- Source and installed `buildbox-hosts.json` order both `build` and `e2e` as Debian1 → Debian2 → Debian3.
- Installed `local-gate --remote-only` executed a real Node canary on Debian1 with authoritative exit 0 and no local fallback.
- Earlier canary from `/home/user` timed out during oversized rsync; focused overdeck-worktree canary succeeded.
- Doctor passes SSH, rsync, Node/pnpm/bun parity on Debian1/2. Doctor still fails local GitHub-origin probe and 30-second host timeout; Debian3 has Node/pnpm drift.
- Workstation remained hot because multiple long-lived Claude CLIs are owner `human.slice` sessions; remote build success does not relocate those interactive frontends.
- Factory remains offline. k3s path remains incomplete.

### Preserved WIP

Worktree: `/home/user/Projects/overdeck/.worktrees/factory-agents-k3s`

Dirty/new files include:

- `modules/workstation/claude/bin/k3s-toolchain-provision`
- `modules/workstation/claude/test/k3s-toolchain-provision.test.sh`
- `modules/workstation/claude/lib/factory-agent-k3s.mjs`
- `modules/workstation/claude/tests/factory-agent-k3s.test.mjs`
- `modules/workstation/claude/bin/factory-result-apply.py`
- `modules/harness/factory/adw_modules/agent_pi.py`
- `modules/harness/factory/bin/factory`
- `modules/sandbox/image/Containerfile`
- `packaging/deploy-local.sh`
- `lib/deckctl/sync.sh`
- `tests/os/deckctl-sync.test.sh`

Known focused receipts: provisioner 7/7; k3s launcher 4/4. Full Factory suite was blocked because remote Python lacked pytest. Do not rerun locally.

### Required architecture

- Immutable GHCR image.
- Ephemeral Git input/result refs.
- Kubernetes Secrets for credentials.
- Kubernetes API for lifecycle/status.
- Restricted pod and namespace posture.
- No SSH workspace fan-out.
- No hostPath.
- No node affinity.
- No manual per-node image distribution.
- No runtime PATH surgery.
- No ConfigMap workspace archives.
- No pod-log result transport.

### Execution ladder

1. Measure and cap only agent-owned laptop work; never touch owner `human.slice` sessions.
2. Verify current remote canary receipt and installed three-host order. Do not repeat successful proof.
3. Repair remote doctor defects only where they block real dispatch: Git-origin probe, timeout, Debian3 parity.
4. Finish k3s launcher/result-applier integration from preserved WIP.
5. Provision required remote test dependency through immutable image/toolchain, not ad-hoc host mutation.
6. Run focused remote-only tests.
7. Install live Factory/k3s entrypoints.
8. Launch one real Factory job; prove pod scheduling, status, result ref, result application, and failure visibility.
9. Prove concurrent spill across at least two buildboxes without laptop-heavy work.
10. Land exact delta and deploy from landed source.
11. Refresh HTML report.

## Factory reliability lanes (#181, #182, #183)

Continue immediately after first real k3s job; do not wait for broad cleanup.

- #181 remote extension transport: preserve destination-symlink fix; previous rerun blocked by Debian1 ENOSPC. Reconcile with k3s Git-ref transport; delete obsolete SSH transport only after live replacement proof.
- #182 supervision/fail-loud: prior baseline 177 passed with four unresolved P1s. Factory must expose queued/running/succeeded/failed with authoritative reason; no silent no-op.
- #183 disk admission: preserve WIP. Debian2 previously recovered to 18,042,288 KiB free. Admission must reject before destructive work and distinguish unavailable metrics from zero.
- #171 Factory page repair is not authoritative while execution backend is offline. Re-prove UI after backend restoration.

## Runtime provenance and workstation safety (#178, #169, #172)

- #178: DONE. Frozen source `/home/user/Projects/overdeck/.worktrees/runtime-provenance-guard` at `0bfcbad15` remains preserved; current main supersedes it with landed provenance guard `4ba0589e8`. Current sync suite passes 60/60. Worktree install is refused, deploy-clone install succeeds, and live `~/.claude/hooks` resolves to the immutable deploy clone.
- #169: restore/harden Overdeck UI availability after execution plane works. Preserve `task169-release-controller` WIP. Prior local `sleep` failure is environment-invalid; verify remotely.
- #172: stop repeated Claude session kills without killing owner sessions. Use exact cgroup evidence.
- #41/#148/#164: every running agent session attachable; restore Ctrl+T recovered-task visibility. Preserve conflicting candidate refs until superset proven.
- #235: restore missing installed `/home/user/.local/bin/prompt-journal`; verify capture and query.

## Incidents product lane (#179, #233, #234, #236)

Preserved WIP: `/home/user/Projects/overdeck/.worktrees/incidents-179-233-234` contains copied 37-file `incident179-land` superset. Older refs: `efd273b4f`, `4584c4d2d`, `f81da5b46831`; do not assume complete.

Known blocker: `specs/0592a6e6_incident-selector-completion.md` is absent from searched worktrees and Git refs. Never invent classification taxonomy or historical provenance.

Required result:

1. Recover authoritative taxonomy and historical-source inventory from owner-message corpus, report, old refs, and surviving product data.
2. Complete required intake fields and account/model/effort/CLI selectors.
3. Complete canonical classification.
4. Build idempotent provenance-preserving historical DB backfill with deterministic deduplication and timestamp preservation.
5. Reconcile source counts and classification counts.
6. Make dispatch fail closed through intake → persistence → worktree/systemd → wrapper argv → status.
7. Run one focused independent security review: authorization, idempotency, shell/argv injection, prompt injection, path/symlink/TOCTOU, secrets, remote-only failure.
8. Land, deploy, and browser-prove `/incidents`.

## Request recovery lane (#231)

Owner requires every request from three-day transcript recovered and reconciled. This is mandatory but MUST NOT monopolize the emergency execution lane.

Partial preserved result: owner corpus mechanically reduced to 15 indexed sections (~54 KB), synthetic notifications excluded. Recovery agent was stopped before durable inventory creation.

Resume only on remote execution or as low-load deterministic processing. Process owner messages only. Produce `docs/plans/2026-08-10-owner-request-recovery.md` with:

- one row per actionable request;
- existing task ID or stable `REC-###`;
- exact quote/timestamp;
- preserved WIP/ref/path;
- DONE only with installed evidence;
- STALE only with superseding evidence;
- OPEN, genuine BLOCKED, or exact owner-deferred quote;
- next executable action.

Cross-check every registry item marked completed. Never allow transcript recovery to pause FIRE lane.

## Remaining registered owner requests

Preserve and execute after FIRE/Factory/Incidents unless independently remote-runnable:

- #40 reboot-proof rescue doors on Debian1/2.
- #125 keep HTML report synchronized after every transition.
- #140 contain security-gate LLM runner without per-call sandbox latency; test dangerous failure only in danger-lab.
- #147 orchestrate every runnable task through delivery; this is a standing control task, not a separate implementation project.
- #176/#219–225 QuietContext: clarify purpose, compare architecture, spec, reviews, plan, Factory run. Do not consume emergency capacity.
- #153 JPR-06 is local-only commit `40048087a`; preserve, do not accidentally deploy without requested integration.
- #235 prompt journal restoration as above.
- #236 Incidents dispatch security review as above.

Task statuses are claims requiring revalidation. Any task marked completed but not installed/user-visible returns to OPEN in request-recovery inventory.

## Scheduling

Maximum concurrent work until workstation usable:

1. One FIRE/k3s implementation lane, remote-heavy only.
2. One deterministic owner-request recovery lane, remote or low-load only.
3. No other agents.

After first live Factory job:

1. Factory reliability lane.
2. Incidents lane.
3. Request recovery lane.

Never run multiple local native subagents on laptop. Native interactive control may remain local; all heavy payloads go remote. If remote subagent dispatch is unavailable, continue deterministic main-thread edits or repair dispatch—never silently substitute local heavy workers.

## Continuation receipt

Before every response or compaction, update this section with:

- active lane and exact worker/task;
- installed behavior changed;
- authoritative command/host/exit;
- dirty worktree paths and commits;
- blockers;
- next command.

Current:

- Active: sole FIRE implementation worker on #175/#96 in `/home/user/Projects/overdeck/.worktrees/factory-agents-k3s`.
- Installed behavior changed: none in current continuation; Factory/k3s remains offline. Prior focused `local-gate --remote-only` canary on Debian1 exited 0.
- Inspected WIP: 10 modified + 3 untracked files. New launcher currently contains forbidden SSH fan-out/fallback, `hostPath`, node affinity, runtime PATH mutation, local-only image reference, and pod-log streaming; preserve useful Secret, Job identity, result-safety, and recovery contracts while replacing transport.
- Authoritative current commands: GitHub/cluster read-only probes exited 0. Origin is `https://github.com/alexcodeplace/overdeck.git`; `gh` auth has `repo` + `read:packages` but not `write:packages`; Kubernetes API lists Debian1/2/3; caller authorization returns `yes` for Job create, Secret create, and pod read in `overdeck-builds`. No heavy local test/build/image/Factory payload ran.
- Commits: branch remains six commits ahead and 53 behind `origin/main`; dirty WIP preserved, no new commit.
- Blockers: no lane blocker established. Local Podman manifest probe exited 125 (`unable to create a new pause process`); do not repair or use local Podman. Existing GHCR package `overdeck-agent-sandbox` exposes immutable digest `sha256:8b5a6220094dec6c8c07932b09345b09df4ed16e96f904117787b22d69e5b6f7` tagged `factory-latest`. Service account currently has no `imagePullSecrets`; namespace currently has no ResourceQuota, LimitRange, or NetworkPolicy.
- Next: replace launcher workspace/result transport with ephemeral Git refs and immutable GHCR image; constrain Job/Secret/RBAC contracts; run focused tests through remote-only wrapper; install live; invoke installed Factory entrypoint for one real k3s Job receipt.