# Restore e2e-remote registry lookup integrity

status: DONE
task IDs: #1 (DONE), #5 (DONE), #6 (DONE), #7 (DONE)
source request: 2026-08-11 owner reports work blocked again. Browser verification reproduces an `e2e-remote` harness defect: second PATH-shimmed registry lookup can offload independently and fail despite reachable hosts. Fix runtime and return to blocked work as soon as possible. 2026-08-13 task #5: installed `e2e-remote` falsely executes payloads on workstation `e14` despite reachable registry order `debian1,debian2,debian3`; repair dispatcher identity end to end, restore installed remote Chromium, then unblock and finish observability task #4. 2026-08-14 task #6: explicit registry-approved `--hosts debian1` is rejected because its pinned subset is compared with complete build order. Accept explicit approved subsets while retaining default unpinned E2E/build order equality and registry rejection; test first, install, verify through dry-run seam, commit, update, and push end to end.

## Acceptance criteria

- Reproduce failed second registry lookup through installed `~/.claude/bin/e2e-remote`.
- Ensure one invocation resolves registry/host state without independently offloading its internal lookup.
- Add focused regression covering PATH-shim behavior.
- Preserve atomic rollback for installed runtime.
- Install candidate through canonical deployment path; prove installed entrypoint runs real browser workload remotely on reachable host.
- Confirm no browser/dev-server workload runs locally and report measured laptop state.
- Run applicable full gates cleanly; commit, land, redeploy landed source, then re-prove installed behavior.
- Return control to previously blocked browser-verification work.

## Preserved WIP

- Shared checkout untouched; existing dirty files and active plans remain owned by other sessions.
- Repair worktree: `/home/user/Projects/overdeck/.worktrees/e2e-remote-registry-fix`, branch `wt/e2e-remote-registry-fix`, base `a3e00a664`.
- Installed runtime before repair: `/home/user/.claude/bin/e2e-remote`.

## Constraints

- Emergency order: reproduce → focused seam check → isolated candidate + rollback → live install → installed browser proof → broad gates → Git.
- NEVER launch headless browser/dev-server pair locally.
- Use buildbox registry as sole host source; reachable hosts only; fail closed.
- Keep source and installed runtime byte-identical after canonical deployment.
- Do not modify unrelated active WIP.

## Execution steps

1. Capture installed-path identity, live load, registry state, and deterministic failing invocation.
2. Trace source and PATH shim boundaries; identify exact second lookup process boundary.
3. Write regression reproducing independent offload; implement smallest fail-closed fix.
4. Run focused tests and isolated candidate canary.
5. Save immutable rollback artifact; install via canonical deploy; invoke installed browser path and verify remote execution.
6. Run full applicable workstation tests and resolve all signals.
7. Commit locally, update from `origin/main`, direct-land emergency fix, deploy landed source, re-prove runtime.
8. Mark restoration done and resume blocked browser verification.

## Task #5 acceptance delta

- Compare installed `/home/user/.claude/bin/e2e-remote` with landed source, symlink ownership, dispatcher chain, and registry machine identity. Prove why payload reports workstation `e14`.
- Add deterministic tests for registry order, workstation rejection, remote identity attestation, and spill after a failed reachable host.
- Fix source of truth fail-closed: server and browser MUST execute on one registry-reachable e2e host. NEVER local fallback. NEVER bypass headless guard.
- Preserve atomic installed rollback. Install through canonical deploy/link mechanism before Git; prove installed identity canary and Chromium `newPage` on a registered host.
- Run relevant full gates clean; commit, integrate, canonical land/deploy, then re-prove installed runtime.
- Resume preserved observability worktree `/home/user/Projects/overdeck/.worktrees/observability-count-semantics`; complete current-source both-theme proof, ship/deploy, installed reconciliation, report, and DONE receipts.

## Task #5 preserved WIP

- Repair worktree: `/home/user/Projects/overdeck/.worktrees/e2e-dispatch-identity-repair`, branch `wt/e2e-dispatch-identity-repair`, base `1e4b3e6f0`.
- Observability candidate remains untouched in `/home/user/Projects/overdeck/.worktrees/observability-count-semantics`.

## Task #5 current receipt

2026-08-13: emergency active in isolated repair worktree. Installed canary through `e2e-remote --hosts debian1,debian2,debian3` reports `(no server; e14)`; remote audit returns workstation kernel and headless-guard identity `workstation`. Registry marks debian1/2/3 reachable in that e2e order. No code edit or runtime mutation yet.

## Next executable action

Compare installed entrypoint, landed source, symlink target, and dispatcher wrapper chain to identify the local-execution seam.

## Task #6 acceptance delta

- Add failing regression first: explicit registry-approved `--hosts box1` MUST reach existing dry-run capture even when build order also contains `box2`.
- Retain deterministic coverage: default unpinned E2E/build order mismatch MUST exit 97; unknown or unreachable explicit host MUST be rejected by registry and exit 97.
- Change authoritative `modules/workstation/claude/bin/e2e-remote` only: compare complete E2E order with build order only when caller omitted `--hosts`.
- Run focused tests plus applicable workstation gates with every signal resolved.
- Install via repository canonical deployment procedure before landing; invoke installed `~/.claude/bin/e2e-remote` with approved pinned subset through existing dry-run/test seam; MUST NOT launch workload.
- Commit one terse imperative sentence without co-author; update against current remote and push without force under repository landing rules.

## Task #6 preserved WIP

- Shared checkout and unrelated dirty files untouched.
- Repair worktree: `/home/user/Projects/overdeck/.worktrees/fix-e2e-remote-pinned-host`, branch `wt/fix-e2e-remote-pinned-host`, fresh `origin/main` base `e49aaa1de`.
- International Press Zone plugin is out of scope and MUST NOT be modified.

## Task #6 execution steps

1. Read applicable instructions, current plan, source, existing tests, test runner, and deployment path.
2. Amend focused test with explicit pinned subset success plus preserved default mismatch and registry rejection; run to prove red.
3. Make smallest source fix; run focused and applicable gates clean.
4. Install through canonical procedure; use existing capture seam against installed entrypoint to prove approved pinned subset without workload execution.
5. Commit, refresh remote, land through canonical guarded workflow, deploy landed source, and re-prove installed seam.
6. Record exact receipts and mark DONE.

## Task #6 current receipt

2026-08-14: DONE. RED regression exited 97 before source fix. Focused config and attestation tests, shell syntax, diff check, repository typecheck, and guarded landing typecheck/test gates passed. Source commit `532c24dccf4254e6187a362f825cb9c47e580c38` uses terse message `Accept pinned E2E host subsets`; guarded landing commit `44d30aafdc81ecbc5d95a121cfea18da646a0f77` is present on canonical `origin/main` and in clean deploy clone. Canonical deploy completed with `status=deployed`, web `http://127.0.0.1:31337`, collector HTTP `401` as authenticated endpoint. Installed `/home/user/.claude/bin/e2e-remote` resolves to deploy source and both hash to `b5bde37998a8b98486e00c31f985f01a00f8c281c281c3f3cbdfc6b8836a03da`. Installed safe capture seam invoked real registry-approved `--hosts debian1`, exited 0, wrote generated config with `local_fallback=false`, and launched no workload. Initial land attempt failed closed on source-export identity mismatch; clean-state verification and tracked retry succeeded. Post-land `od-live-report-refresh` warned because its installed root calculation resolved `//collector`; deployment itself continued and succeeded. CI inventory separately reports seven pre-existing unclassified tests; delivery-contract remote run separately lacked `ajv/dist/2020`; neither touched or weakened for this surgical fix.

## Next executable action

None. Task #6 is landed, deployed, and verified through installed entrypoint.

## Task #7 acceptance delta

- Reproduce exact International Press Zone admin command unchanged; wrapper MUST proceed beyond local-gate dispatch on registry-approved `debian1`.
- Add RED regression reaching generated dispatch configuration and admission, not capture-only seam.
- Explicit `--hosts` MUST constrain generated `BUILD_REMOTE_CONFIG` consumed by local-gate. Default unpinned order behavior and registry rejection MUST remain fail-closed.
- Make smallest authoritative-source fix. Do not modify International Press Zone plugin.
- Run focused and applicable gates clean. Install before landing through established runtime-safe procedure; verify exact command on `debian1`; commit, update, push without force, canonical deploy, and re-verify.

## Task #7 preserved WIP

- Shared checkout and plugin tree untouched.
- Worktree: `/home/user/Projects/overdeck/.worktrees/e2e-remote-pinned-dispatch`; branch `wt/e2e-remote-pinned-dispatch`; fresh `origin/main` base `e7e05d11d`.

## Task #7 current receipt

2026-08-15: DONE. Host-constrained dispatch and payload readiness landed incrementally in `e7332591c`, `82c418c4d`, `85ba2a3c6`, `cd764d5e9`, and `a90904f3c`; package-owner runner support followed in `8c6ebc6de`. Installed `e2e-remote` accepts the approved `debian1` subset, prepares the full payload runtime before admission, constrains dispatch to that host, and retains fail-closed registry identity checks with no local fallback.

Fresh installed proof used unique key `observability-installed-counts-219efa5f2-20260815-b`, explicit `--hosts debian1`, a reverse tunnel to installed Overdeck, and remote Chromium. It completed with `client exit=0 (no server; debian1)`, produced and returned all requested artifacts, and recorded zero console errors and zero action requests. No headless browser ran on workstation `e14`. This also unblocked and completed observability task #4.

## Next executable action

None — registry lookup, pinned dispatch, payload readiness, and installed remote Chromium are proven.

## Current receipt

- 2026-08-11: task #1 created, assigned to `main`, status `in_progress`.
- Isolated worktree created at `a3e00a664`; shared checkout not modified.
- Live measurement: installed entrypoint resolves to `/home/user/.claude/bin/e2e-remote`; `overdeck-web.service` active; load average `21.74 26.74 25.32` at 21:11 local.
- Mandatory cross-project docs indexed and queried; preservation-first and shared-root isolation constraints confirmed.
- Root cause proven in source: PATH-shimmed `node ... hosts --order build` is classified as heavy from literal `build` before `CPU_GUARD_ACTIVE` bypass is evaluated; this registry query can therefore dispatch through `local-gate` independently.
- Candidate pins control-plane registry/config execution to `/usr/bin/node`; focused config regression injects a PATH node shim that fails only `hosts --order build`.
- Focused checks green: config regression, attestation suite, and shell syntax. Attestation emitted `netns inode mismatch` from its expected rejection case; benign and asserted by the test.
- Emergency runtime overlay created at `~/.local/state/overdeck/emergency/e2e-remote-registry-20260811T1420Z`; rollback target recorded as deploy clone bin. Atomic rollback-to-old and candidate switch both succeeded; 108 non-target bin entries are byte-identical.
- First candidate install accidentally copied the shared-checkout source because Bash retained the primary cwd; live hash check caught the mismatch before acceptance. Corrected from the absolute isolated-worktree path; installed source now contains `NODE_BIN` registry calls and matches candidate bytes.
- First browser canary on the stale candidate reproduced exit 97: `local-gate ... host=fleet reason=unavailable`, followed by no usable host. This is the target defect, not accepted restoration evidence.
- Corrected installed-entrypoint browser canary exited 0 and pulled `.ci-results/e2e-remote-canary.png`; visual inspection shows expected `remote` page. Actual local browser executable count remained zero during the run. Owner browser-verification path is restored now.
- Independent review found one valid defect: fixed `/usr/bin/node` preflight ran before remote-seat fast path and could reject a seat that never needs Node. Check moved after seat branch; attestation regression pins that ordering. Focused config/attestation/syntax checks pass after correction.
- Reviewed candidate reinstalled; second real browser canary exited 0 and visually rendered `remote-reviewed` remotely.
- Final broad host-safe aggregator: 65/84 passed; 19 are not accepted as change regressions because QuietContext ran them inside its `/tmp/.ctx-mode-*` jail. Failures explicitly include suites that self-refuse there (`agent-session-ledger`, `agent-session-passthrough`), fixture binaries lost through the jail, and pre-existing unrelated expectation drift (`agent-seat-slice`, retired Cursor dispatch). Focused changed-seam tests remain clean. Bare canonical runner cannot legally select all safe suites while excluding danger-lab files.
- Optional ShellCheck surfaced existing intentional diagnostics: SC2163 dynamic `export "$kv"` (covered by spacing regression), SC2016 deferred child-shell expansion, SC2155 fixture assignment. None originate in this change; no suppression or unrelated cleanup added.
- Normal fetch and negotiation-tip fetch both fail on pre-existing shared dangling ref `refs/rescued/claude-20260811T134909Z-006422`; no shared ref was modified. `git ls-remote` proves `origin/main` remains exactly worktree base `a3e00a664`.

- Landed commit `f1028e745` directly to `main`; remote fast-forward base was verified by `ls-remote` immediately before push.
- Canonical deploy clone checked out landed `f1028e745` and contains byte-identical fixed `e2e-remote`. Full `deploy-local.sh` later stopped at `sync apply claude bin` because another active change made `modules/workstation/claude/lib/remote-build.mjs` dirty (4 additions, 1 deletion). That WIP was inspected and preserved; no reset, checkout, or overwrite occurred.
- Live `~/.claude/bin` atomically switched from emergency overlay to landed deploy-clone bin. Final installed-entrypoint Playwright screenshot exited 0, visually rendered `landed`, and local browser executable count was zero.
- Final runtime: `~/.claude/bin` resolves to `/home/user/.local/share/overdeck/deploy/modules/workstation/claude/bin`; deploy HEAD and remote main are `f1028e745`; web/controller/collector services active. Load average after proof: `18.15 20.49 23.19`; browser workload itself was proven remote.
- Rollback overlay remains immutable at `~/.local/state/overdeck/emergency/e2e-remote-registry-20260811T1420Z`; changed seam rollback switch was tested before promotion.

## Next executable action

Resume the browser verification work that this harness defect blocked. The unrelated deploy-clone `remote-build.mjs` owner must finish or preserve their WIP before the next full canonical deployment; this e2e runtime is already landed and live.