Checkpoint via cy-loop-tasks (iteration 10, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: add gateway exposure foundation

* feat: Tier listeners and device authentication #2

Checkpoint via cy-loop-tasks (iteration 5, phase B mode=tasks).

Adds daemon-owned tier listeners, device authentication, secure pairing and credentials, stream tickets, live revocation, transaction mutation fencing, transport parity, generated contracts, and gateway documentation.

Co-Authored-By: Codex <[email protected]>

* feat: add connectivity provider seam

* feat: add public gateway ingress

* feat: Remote CLI profiles, operation matrix, and SSH connect #5

Checkpoint via cy-loop-tasks (iteration 11, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: add gateway self-audit and native control

* feat: Gateway operator surface and documentation #7

Checkpoint via cy-loop-tasks (iteration 15, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: QA planning for remote gateway #8

Checkpoint via cy-loop-tasks (iteration 17, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: QA execution for remote gateway #9

Checkpoint via cy-loop-tasks (iteration 19, phase B mode=tasks).

QA execution settled all reset scenarios, re-walked six fixes, passed strict evidence audit, and ended with a clean teardown. Full workstream gate remains deferred until the single final review remediation is complete.

Co-Authored-By: Codex <[email protected]>

* fix: harden remote gateway for release

Resolve the sole deep-review round across the Gateway runtime, CLI, SDKs, web UI, documentation, package boundaries, and QA evidence.

Fix nullable bridge provider configuration and preserve exact public SDK and native-tool metadata contracts.

* refactor: categorize tailscale extension under extensions/connectivity

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix: final adjustments

* docs: add curated release notes for remote gateway

Co-Authored-By: Claude Fable 5 <[email protected]>

---------

Co-authored-by: Codex <[email protected]>
Co-authored-by: Claude Fable 5 <[email protected]>

Checkpoint via cy-loop-tasks (iteration 10, phase B mode=tasks).

Focused Go race suites, web tests, typecheck, and lint passed. Browser and visual evidence remain assigned to the QA tail.

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 10, phase B mode=tasks).

Focused Go race suites, web tests, typecheck, and lint passed. Browser and visual evidence remain assigned to the QA tail.

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 10, phase B mode=tasks).

Focused Go race suites, web tests, typecheck, and lint passed. Browser and visual evidence remain assigned to the QA tail.

Co-Authored-By: Codex <[email protected]>

* feat: Schema and worktree domain core #1

Checkpoint via cy-loop-tasks (iteration 2, phase B mode=tasks).

Focused evidence: worktree race unit suite, real-Git lifecycle integration, migration integrity/equivalence, and 80.8% package coverage. Heavy gates remain deferred to the QA tail by workflow direction.

Co-Authored-By: Codex <[email protected]>

* feat: Worktree public surface: API, CLI, native tools, streams #2

Checkpoint via cy-loop-tasks (iteration 3, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Session binding, containment, spawn inheritance, fork #3

Checkpoint via cy-loop-tasks (iteration 4, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Environment policies: task worktree policy + loop environment #4

Checkpoint via cy-loop-tasks (iteration 5, phase B mode=tasks).

Validated task and Loop worktree placement across queue snapshots, lease-fenced session binding, public contracts, real Git journeys, and generated artifacts.

Co-Authored-By: Codex <[email protected]>

* feat: Assisted exit, forge.provider surface, bundled GitHub extension #…

Checkpoint via cy-loop-tasks (iteration 6, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: add web worktree navigation and lifecycle

* feat: Web: environment surfaces and assisted exit #7

Checkpoint via cy-loop-tasks (iteration 10, phase B mode=tasks).

Focused Go race suites, web tests, typecheck, and lint passed. Browser and visual evidence remain assigned to the QA tail.

Co-Authored-By: Codex <[email protected]>

* docs: document Worktree operations and agent surfaces #8

* feat: QA Plan and Session Charters #9

Checkpoint via cy-loop-tasks (iteration 14, phase B mode=tasks).

Adds the durable Worktree QA plan and closes lint, optional-state, native-tool metadata, and bundled-skill inventory gaps exposed by the full gate.

Co-Authored-By: Codex <[email protected]>

* fix: preserve operator global config at daemon boot

* fix: mount desktop shell context before projection reads

* docs: record autonomous observer mismatch replay

* fix: preserve pending worktree creation state

* fix: expose worktree config lifecycle

* fix: reject invalid worktree bases before acceptance

* fix: preserve task fanout intent identity

* fix: start native task claims in bound sessions

* test: complete worktree real-user QA

* fix: keep worktree exit menu mounted

* fix: complete worktree review remediation

* fix: reconcile main rebase contracts

* fix: lint

* docs: update design

* fix: a lot of adjustments

---------

Co-authored-by: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 11, phase B mode=tasks).

Focused verification passed; full gate, live QA, review, and frontend work remain deferred to the post-task tail.

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 11, phase B mode=tasks).

Focused verification passed; full gate, live QA, review, and frontend work remain deferred to the post-task tail.

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 11, phase B mode=tasks).

Focused verification passed; full gate, live QA, review, and frontend work remain deferred to the post-task tail.

Co-Authored-By: Codex <[email protected]>

* feat: P0 cleanup: hash_fields deletion, predicate policy, per-gate coun…

Checkpoint via cy-loop-tasks (iteration 2, phase B mode=tasks).

Focused race, integration, codegen, web test, and web/site typecheck evidence passed. Full gate and QA remain deferred to the loop tail by user instruction.

Co-Authored-By: Codex <[email protected]>

* feat: P1 router: route node + gate verdict routing #2

Checkpoint via cy-loop-tasks (iteration 3, phase B mode=tasks).

Focused verification includes route planner/linter race suites, migration integrity, web codec/typecheck, and E2E-008 loop status route causes; heavy project gates and QA remain deferred by the accepted loop instructions.

Co-Authored-By: Codex <[email protected]>

* feat: P2 requests core: ask node, respond plane, ResponderPolicy #3

Checkpoint via cy-loop-tasks (iteration 4, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: P3 per-lane addressing, review gate, amend overlay #4

Checkpoint via cy-loop-tasks (iteration 5, phase B mode=tasks).

Focused race verification and codegen checks passed; batch gate and live QA remain deferred by the controlling loop plan.

Co-Authored-By: Codex <[email protected]>

* feat: add fan-out strategy settlement

* feat: window wide fan-out execution

* feat: P7+P8 time travel: diff, rerun, fork + cross-cutting suites #7

Checkpoint via cy-loop-tasks (iteration 11, phase B mode=tasks).

Focused verification passed; full gate, live QA, review, and frontend work remain deferred to the post-task tail.

Co-Authored-By: Codex <[email protected]>

* fix: adjustments

* fix: errors

* docs: graph eng design

* feat: P9 web run-page surfaces (S1–S8, S10–S12) + visual contract #8

Checkpoint via cy-loop-tasks (iteration 13, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: compose loop requests into attention

* test: plan graph completion QA

* fix: close graph QA regressions

* fix: preserve update contract after rebase

* fix: deep review

* fix: ci fixes

* fix: graph engineering request

* feat: add entity-backed typed Loop inputs

* docs: record typed Loop input QA fixes

* fix: resolve typed Loop input review findings

* fix: preserve composed request schemas in snapshots

* refactor: satisfy strict branch lint

* test: record typed Loop remediation QA

* fix: preserve workspace in native Loop config writes

* fix: satisfy React compiler checks after rebase

---------

Co-authored-by: Codex <[email protected]>

* feat: Terminal settlement invariant, reconciliation sweep & loops confi…

Checkpoint via cy-loop-tasks (iteration 2, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Catalog loop classification with 4-surface parity #2

Checkpoint via cy-loop-tasks (iteration 4, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: add loop run read layer and CLI verbs #3

* feat: add calm task views and loop provenance #4

* feat: redesign loop run registers and unblockers #5

* fix: remediate loop legibility review findings

* docs: plan loop legibility QA cycle

* fix: narrow generated loop read filters

* fix: update loop briefing duration fixtures

* fix: print runnable loop request unblockers

* fix: quote loop unblocker payloads for shells

* fix: expose loop timeline resume bounds

* fix: recover sessionless task leases

* fix: requeue expired loop coordinators

* docs: record loop runtime QA phase

* docs: close loop runtime QA lab

* fix: remediate loop runtime QA findings

* fix: observe runtime progress from public reads

* fix: label unnamed loop briefing outputs

* fix: harden runtime observer contracts

* fix: ignore loop heartbeat events in observer

* fix: require every run-page story to stage its served verdict

Visual Contract row VC-08 was recorded as PASS against a capture that showed
a terminal "Done" run with no partial signal at all. The story it targets
staged no briefing read, and buildScenarioProps filled the gap with a
manufactured verdict - tone "ok", a headline built from the loop name and
round, no outcome, no artifacts - so the capture photographed a state nobody
had staged. VC-03, VC-06 and VC-07 failed the same way inside their recorded
scope boundaries.

Make the omission impossible instead of papering over it: briefing is now
required on LoopRunStoryScenario, the placeholder is deleted, and briefingFor
copies the run's server-owned run_id, status, progress and usage while
requiring each scenario to state the tone and headline the daemon writes. The
compiler enumerates every site, so a scenario that has not staged a verdict
cannot render one.

Add registerPartialOutputsScenario for VC-08: a run that failed after seven of
ten fix workers returned, labelling its output partial in the default register
through the artifact's warning note, the join's partial chip and the fan-out's
"partial 7 of 10" coverage - all server-owned reads, none derived client-side.

Split the metric-ratchet scenarios and the durable lifecycle payloads into
their own files to stay under the 500-line cap.

Co-Authored-By: Claude Opus 5 <[email protected]>

* fix: make loop run stories stage the state they claim

The visual-contract evidence for task_04/task_05 was passing on captures that
did not show their named state. The fixture layer was the reason, and it is
what this fixes.

`briefingFor` documented that a scenario may not overwrite the server-owned
briefing fields, but `StoryVerdict` admitted all of them and `...verdict` was
spread last, so only the comment stood between a story and a briefing that
contradicted the run beside it. The type now excludes `run_id`/`status`/
`progress`/`usage`, the derived fields land after the caller's spread, and the
two usage facts the record cannot supply — `cost_usd`, `duration` — are kept as
a named optional. `makeBriefing` stopped being a second staging path: every
register and visual-contract scenario derives its briefing from its own run, so
the captures no longer photograph 82.4k tokens over a run recording 68k, a
"Done" strip over a failed run, or a calm verdict over a cancelled one.

Beat titles are the daemon's own (`Step <node> running`, `Round 2 started`)
rather than invented fixture copy, and the long story stages the fold the
daemon serves, so the paging row shows a coalesced beat and the way back
instead of a wall of identical rows. The story clock is stamped once per load
rather than pinned to a literal instant: projections took the pinned value and
components render against the wall clock, so every beat read "1d ago" and a
retry two minutes in the future read "next 1d ago".

Three surfaces were understating what the product does, and one was leaking
wire vocabulary into the default read:

- the needs-you card printed `needs_approval · <gate id>`, and
  `on_exceeded: <enum>` on the budget gate — two enums and a machine id in the
  register task_05 requirement 1 keeps them out of. It now names the asking
  gate in words with its round, and leaves the budget policy to the sentence
  the usage rail already carries.
- the request card never said who was asking, though `node_id` and
  `generation` were on the wire the whole time.
- a degraded runs roster said the rows were the last read without saying how
  old it was, which reads as "this is current".
- the roster answered "not started" about steps that had plainly run. A step
  whose timing did not survive now reads `unknown`.

Stories now stage what the host wires: Compare/Fork on the generation history,
`Browse loops` on the empty roster, an `attention` summary so the roster's
needs-you group exists, and reduced motion through `MotionConfig` rather than a
Storybook global that moved neither the context nor the media query. VC-22 gets
a deep graph of its own instead of re-staging VC-21's wide one.

Co-Authored-By: Claude Opus 5 <[email protected]>

* fix: give the loop run page the history and causes its rows claim

Inspecting the remaining twenty-one visual-contract rows one image at a time
turned up three more states the page was not actually in, plus a test that
asserted a number instead of an invariant.

The story pane reads the durable timeline, and several scenarios staged their
events richly while staging no timeline at all — so a run four rounds deep with
21k tokens spent rendered "Nothing has happened in this run yet." and four
contract rows captured that empty pane as their evidence. The read is now
derived from the scenario's own events, mirroring what the daemon does with
them at read time; kinds the mapping does not know are skipped rather than
given an invented sentence.

The terminal graph was drawing a finished run as though it were still on its
way: the scenario staged roster rows for two earlier rounds only, so the round
the graph draws had almost none and every unlisted step read "Reachable.
Nothing has reached it yet." The terminal round is staged in full now, and the
branch the run declined reads as declined.

Cancellation cause and actor move onto the roster row. Strategy-canceled and
operator-canceled share the neutral ramp by design, so the state word alone
cannot tell them apart — the roster showed two identical grey `canceled` chips
and the distinction US-012.EC-2 asks for was unreadable until the node panel
was opened. The node panel's builder is shared rather than copied, so the
runtime's own reason codes stay suppressed in both places.

`expect(scenarios.length).toBeGreaterThanOrEqual(18)` was a structural
threshold pretending to be a guard: the invariant is that a staged briefing
agrees with its run, and freezing a fixture count would fail on a scenario
being added or retired, neither of which can break that. It is now a plain
non-vacuity check, and the sweep reaches every module that exports scenarios
instead of two.

Co-Authored-By: Claude Opus 5 <[email protected]>

* fix: put the dozens in the active group the scale contract names

VC-35 stages "dozens active", and the reference note is specific about where the
scale goes: "Scale changes the count, not the composition. The needs-you group
still sorts first and stays small; active collapses into one scrollable table."

The story built its thirty runs by cycling every seed of `loopRunFixtures`. That
list is mostly terminal runs, so thirty drawn from it in order inherited the mix
two-fold and the roster sorted them into Needs you 2, Active 8, Recent 20 — the
dozens landed in Recent, the one group the row exists to show held eight, and
the needs-you group was twice the size the note calls small. The capture was
passing on a state it did not stage.

The scale fixture moves into its own module and partitions the seeds by the same
two facts `groupOf` groups on — a served `attention` summary, and whether the
status is terminal — rather than by naming ids. Thirty runs still, now one
needs-you, twenty-six active and a settled tail of three, so the composition
still reads as three groups while the count lands where the contract puts it.
Reusing the roster's own predicate means a change to the grouping rule carries
this fixture with it instead of silently dropping the bulk into the wrong group
again, which is how the defect survived the first pass.

The canonical `LoopRunsView` suite gains the invariant: at scale the three
groups keep their order, Active holds the dozens, Needs you stays small, every
run is accounted for, and no KPI band appears.

Co-Authored-By: Claude Opus 5 <[email protected]>

* feat: Real-User QA Execution #7

Checkpoint via cy-loop-tasks (iteration 8, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* test: refresh catalog subtest contexts

---------

Co-authored-by: Codex <[email protected]>
Co-authored-by: Claude Opus 5 <[email protected]>