Epic: backlog burn-down 2 — bugs, cohort waits, operational conformance #84

The whole open backlog after epic #24, plus the gaps a 2026-10-24 audit found that nothing tracked: host patching never run, a log-priority bug, a sibling's per-host ask, and cohort ports Processor lacks. Done when Tiers 1 and 2 are closed and live, and every Tier 3 line is closed or parked with a trigger.

• Last check-in: 2026-11-03T04:22:44Z
• Last probe: 2026-11-03T04:40Z
• Last issue seen: #80 docs: § CI pins and Dependabot records setup-uv v10.3.3, WIF under Dependabot, the 3-day cooldown #111
• Last verified SHA: ffcff4a
• Next: The exit criterion no longer holds: 11 lock advisories (pypdf ×7, all in the extraction child; pyasn1 ×4). A Tier 1 issue is drafted and awaits the operator's approval to file. Close-out waits for it and for the 2026-11-03 window.

Order

The operator's rule, verbatim: "Prioritize bugs, issues other repos are waiting on, and operational conformance and stability."

Tiebreaks the coordinator added, numbered so the operator can challenge one:

1. Live security exposure ranks as a bug. Adopt host patching: needrestart l, posture scheduled, first window #77 sits in Tier 1 for that reason: 60 -security updates pending, including the OpenSSL that processor run links.
2. A guard goes before what it guards. WARNING and ERROR records reach journald at INFO priority #76 goes before Adopt host patching: needrestart l, posture scheduled, first window #77, because a patch window's post-check reads journald priority. Inside Adopt host patching: needrestart l, posture scheduled, first window #77, needrestart's l mode is committed before the first apt run.
3. A sibling wait that is only an operator host step (Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78) runs alongside the code child in flight. It doesn't take the implementer's slot.
4. In Tier 3, shared files decide the order: the workflow files (see Overlaps). Bundling two children that share a file is offered at that child's gate, never assumed.
5. A child that needs an operator decision (Lock audit: a weekly finding notifies nobody #75) gets its question one check-in before it is next.

Overrides: none yet.

Boundary decisions

• Agent-tooling items (context cadence, SocratiCode bumps, the skills roster) are out of this epic unless a sibling asks something of Processor. Proposed 2026-10-24.
• A cohort practice Processor lacks is Tier 3, unless it is a live exposure (tiebreak 1). Proposed 2026-10-24.
• Close what is done or superseded. Park ideas, each with a re-entry trigger. Proposed 2026-10-24.

Exit criterion

Tiers 1 and 2 closed and live. Every Tier 3 line closed or parked with a trigger. #54 may stay parked: its trigger is the broker's, not ours.

Verify recipe

• Gate: CI lint and test, by job, on the merge SHA and on main's tip. uv audit (report-only) runs alongside and is not a gate. Run at creation: green on db8531a, 2026-10-24.
• Deploy: scripts/deploy.sh, only when the merge touches src/, deploy/, scripts/deploy.sh, pyproject.toml or uv.lock. Proof: /srv/processor/live/REVISION equals the merge, ActiveEnterTimestamp falls after it, NRestarts=0, and the drift check reports ok at its next hourly run.
• Baseline: uv run pytest -q, no .env sourced: 748 passed, 5 skipped, containment required (Landlock ABI 6), 2026-10-24. The 5 skips are all tests/test_child.py:290, credential paths unreadable to exedev. Compare skips by id.
• By deliverable:
  • host change: read before and after (systemctl is-enabled, stat, apt list --upgradable);
  • timer: its journal over one period;
  • log change: journalctl -o json PRIORITY on a real record;
  • workflow change: the job's check-run on the merge SHA, plus one scheduled or dispatched run where the trigger is a schedule;
  • docs: git diff against the claim.
• Cross-repo probes: scan.sh reads with GH_TOKEN, which can't reach CannObserv/cannobserv or CannObserv/provisioner (404). Read those refs by hand with GH_TOKEN_CANNOBSERV and GH_TOKEN_PROVISIONER at each check-in.

Tier 1: bugs and live exposure

• WARNING and ERROR records reach journald at INFO priority #76 WARNING and ERROR records reach journald at INFO priority · XS–S · bug, live · deploy · Shipped in PR #76 feat: records reach journald at their level's priority #85 (431b7b5), live 2026-10-25T15:50:36Z; docs PR #76 docs: the deploy instant in § Logs #86 (91652aa), no deploy. Verified 2026-10-25: a transient unit as processor logged at PRIORITY=4, live records carry no prefix, CI green by job on both SHAs. Still open: the first real live WARNING (see Verification debt).
• Adopt host patching: needrestart l, posture scheduled, first window #77 Adopt host patching: needrestart l, posture scheduled, first window · M · live exposure · approval gate: the window and every sudo step · Shipped in PR #77 Adopt host patching: needrestart l, posture scheduled #88 (5ef07e2, deployed 2026-10-26T14:56:44Z); PRs #77 docs: deploys don't wait for a window; the bulk runs without a recovery point #89–#77 chore: weekly patching, Monday night Pacific #92 docs/knob. Run 1: 2026-10-26 19:00–19:13Z, 85 packages, then an in-guest reboot; about 20 s of bus outage, nothing paged. Verified 2026-10-26T22:15Z: 0 upgradable, host files identical to the repo, AutoUpdate.Apply false, processor up since 19:13:20Z with NRestarts=0, 0 warnings, CI green by job. Window now weekly, Tue 05:00-10:00 (operator, 2026-10-26).

Tier 2: other repos waiting on Processor

• Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78 Disable exe-setup.service on co-processor (CannObserv/provisioner#4) · XS · operator host steps · Step 1 by the coordinator 2026-10-26T22:49:14Z (operator-approved); step 2 moot (none delivered on 5 boots). Reported on CannObserv/provisioner#4 2026-10-27 (operator-approved); re-read 17:05:19Z disabled, absent. Closed 2026-10-27. Step 3 is a standing check.
• SocratiCode on loopback (gregoryfoster/skills#494): bump skills-vendor to b5be0b55 so the health hook catches a managed-mode fallback #100 Bump skills-vendor to gregoryfoster/skills b5be0b55 (SocratiCode loopback, init-socraticode: SocratiCode's qdrant/ollama publish on 0.0.0.0 with qdrant telemetry on; check the binding unattended and set it up loopback gregoryfoster/skills#494) · XS · no code · The hook's daily bump c74e6ad (2026-10-30T04:31Z) moved it to 92ded2ab ⊇ b5be0b55; CI green by job on c74e6ad; preflight.sh --check PASSED (Docker not needed, external store). Closed by the coordinator 2026-10-30.

Tier 3: operational conformance and stability

• Lock audit: a weekly finding notifies nobody #75 Lock audit: a weekly finding notifies nobody · XS · option 4 (operator, 2026-10-26) · Shipped in PR #75 The weekly window reads the live lock: § Patching step 9, a guard, the claim corrected #94, fast-forward e73950d..135a740, 2026-10-27T15:02:51Z. Verified 2026-10-27T17:06Z: lint and test green by job on 135a740 (= main); no runtime path changed, so no deploy, and the drift check reports ok at 16:28Z; the checkout is clean on 135a740. First use: step 9 of the Tue 2026-11-03 window. Upstream: patching-hosts: the language reading can vanish silently — a unit off its lock reads complete, and run.md has no step that takes it gregoryfoster/skills#508 (filed with approval). Cohort note for broker and archiver on Lock audit: a weekly finding notifies nobody #75's 2026-10-27 comment.
• Run the wheelhouse sync from the lock (port CannObserv/broker#113) #79 Run the wheelhouse sync from the lock (port of The wheelhouse sync installs google-cloud-storage unpinned from PyPI on every run, with the reader key set broker#113) · S · deploy · Shipped in PR #79 fix: the wheelhouse sync runs from uv.lock's wheelhouse group #97 (fast-forward to 613b262, 2026-10-28T22:22:49Z), deployed with Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87. uv run --frozen --no-config --only-group wheelhouse at every site; tests/test_ci.py fails any other spelling. Verified 2026-10-29T23:02Z: CI green by job on 613b262; the merge's sync step installed google-cloud-storage 3.15.1 from the lock (the thread's reading of run 40779513944).
• Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87 Wheelhouse content check: pin co-core's sha256, verify it at sync and deploy (port of The co-core wheel has no content check: uv.lock pins it by path, the sync compares sizes, TLS is the only check broker#125) · S–M · deploy · Shipped in PR #87 feat: a locked wheelhouse file is held to a committed sha256 #98 (fast-forward to 9ff7584, 2026-10-28T22:27:25Z), deployed 22:31:59Z. [tool.processor.wheelhouse-sha256] pins the three 0.38.0 wheels; CI's from-empty bucket sync matched the local build byte for byte, but only on hatchling 1.32.4, now held in build_wheelhouse.sh (CannObserv/cannobserv#605 filed, operator-approved). Verified 2026-10-29T23:02Z: CI green by job on 9ff7584; the journal reads wheelhouse for 9ff7584fbfd5: … match their pinned sha256, then live is on 9ff7584fbfd5: pid 390517 …, and 390517 is MainPID, NRestarts=0; live/.wheelhouse holds only the three locked files; drift ok. Limits: a reused or pre-Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87 release isn't re-checked.
• deploy.sh: journal the verified verdict, not only the switch (port CannObserv/broker#122 item 1) #93 deploy.sh: journal the verified verdict (port of deploy.sh: journal the verified verdict; don't wait on an added unit whose timer is off; a build-only mode for a rebuild broker#122 item 1) · XS · deploy · Shipped in PR #93 deploy.sh journals the verified verdict (and an interrupt) #96 (fast-forward 09b483c..d5fccb8, 2026-10-28T16:24:59Z), deployed 16:30:19Z, with the interrupt trap (operator took the recommendation). Verified 2026-10-28T17:02Z: journalctl -t processor-deploy reads live is on d5fccb87b0d8: pid 270295 … the smoke run passed, and 270295 is MainPID; NRestarts=0; CI green by job on d5fccb8; drift ok, live d5fccb87b0d8 is main. Limits: the trap has never run live; SIGKILL can't be trapped.
• Pin Actions by SHA; Dependabot for github-actions only (port CannObserv/broker#90) #80 Pin Actions by SHA, and Dependabot for github-actions only (port of SHA-pinned actions have no updater: dependabot.yml for github-actions, minus the generated cadence workflow broker#90) · S · no deploy · Shipped in PR #80 Pin Actions by SHA; Dependabot for github-actions only #101 (fast-forward cab3ff7..b269a6c, 2026-10-30T00:18:20Z). Operator decision 2026-10-29, against the brief's recommendation: match broker's majors now (checkout v7.0.1, setup-uv v10.3.2, auth v3.0.0); the Node test became a floor, plus prune-cache: true (public repo, setup-uv v9 flips its default). Code security read by the operator: graph and alerts on, security updates off, recorded in docs/DEPLOYMENT.md. Verified 2026-10-30T04:32Z: push CI green by job on b269a6c (lint, test), audit green, all 8 uses: are SHAs with tag comments; Dependabot's first run succeeded, its first PR (setup-uv 10.3.3) held by GitHub's 3-day cooldown until after 2026-10-31; drift ok, live still 9ff7584fbfd5.
• shellcheck the shipped shell scripts (port CannObserv/broker#112) #81 shellcheck the shipped shell scripts (port of Lint shell scripts with shellcheck in a pre-commit hook, and in CI broker#112) · S · deploy · Shipped in PR #81 shellcheck the shipped shell scripts; CI on the node's image #102 (fast-forward c74e6ad..d29e240, 2026-10-30T15:53Z), deployed 15:58:47Z. scripts/shellcheck.sh + opt-in .githooks/pre-commit (uv run --frozen --no-config --only-group lint: find-links needs --no-config here); shellcheck-py 0.11.0.1 lock-pinned in a lint group that dev includes (ruff moved too); a step in lint, so CI_JOBS unchanged; nodesource.sh SC2064 disabled with its reason on the line before. Operator decision 2026-10-30: runs-on: ubuntu-24.04 on all three jobs, held by tests/test_ci.py. Red proof: throwaway #81 throwaway: prove the shellcheck step goes red (do not merge) #103, run 41077109065 failed at shellcheck (SC2164). Verified 2026-10-30T16:12Z: push CI green by job on d29e240 (lint with its shellcheck step, test), audit green; journal CI passed → wheelhouse match → live -> d29e240cb85f → live is on d29e240cb85f: pid 525281, which is MainPID, NRestarts=0; no ruff/shellcheck in the release's .venv/bin; drift ok (live d29e240cb85f is main).
• Root disk at 79% with nothing pruning or watching it #82 Root disk with nothing pruning or watching it · M · deploy · Shipped in PR #82 Adopt the cohort disk GC: config, links, pytest retention, runbook #95 (fast-forward to 875a18c, 2026-10-27T22:42:15Z), deployed 22:46:28Z. Host: GC VERSION 2 installed, config 85/80 from deploy/disk-gc/disk-gc.conf, key copied, timers on since 22:28:52Z, co-processor-disk-headroom (co-processor-disk-headroom: Processor's disk headroom sensor (CannObserv/processor#82) status#69, closed) enabled; rehearsal paged and cleared, the operator confirmed both notices. Verified 2026-10-28T13:55Z: first prune success, 3.6G in 10 items as predicted; / 76% → 54%, 60% by 13:55Z (Stable-e646868227… regrown 07:16:55Z, cause not established); 93 sensor 202s; CI green by job on 875a18c; live = main, drift ok. Closed 2026-10-28.
• Host resilience: record the earlyoom decision; test a hard reset #83 Host resilience: record the earlyoom decision, and test a hard reset · S · docs + operator event, no deploy · Part 1: PR #83 docs: record the earlyoom decision (not installed) #104 (FF d29e240..def8c28): DEPLOYMENT.md § Memory: no earlyoom, operator decision 2026-10-30 (not installed), with figures, the kernel's measured oom_score order and re-entry triggers (incl. page allocation failure). Part 2: ssh exe.dev restart co-processor at ~17:54:12Z by the operator; the signature and before-readings were written first. Bus outage ≤26.4 s (19.7 s graceful), no WARNING, no page (≈47 s silence vs 900 s grace), drift ok at boot+5 min, headroom checked in, nothing to reclaim, DLQ empty, kernel unchanged, no journal lost. Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78 step 3 passed (on Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78). PR #83 docs: record the 2026-10-30 hard reset in § At boot #105 adds the reset to § At boot. Verified 2026-10-30T20:23Z: CI green by job on def8c28 and a513e7c; boots 209872… ends 17:54:12, 2ba782… starts 17:54:32; processor MainPID 334, NRestarts=0, active 17:54:33Z, REVISION d29e240cb85f; acks since; drift ok ("7 commits ahead, none that runs").
• Disk GC VERSION 3: bump skills-vendor to gregoryfoster/skills b1d6e303, then update co-processor #99 Disk GC VERSION 3: bump skills-vendor, then update co-processor's GC · XS · host step + docs, no deploy · Step 1 by the hook (c74e6ad). Step 2 by the coordinator, operator-approved, 2026-10-30T16:11Z: update 2→3, timers enabled. The first V3 run, 2026-10-31 05:44:42Z: exit 0, 135.3M removed, the newer VS Code build (1.144.0) kept, 0 failed. PR #99 docs: § Disk GC records VERSION 3 and its first run #107 (FF e568fad..b5224c5): § Disk GC says VERSION 3, records the run, and corrects § With Patching's after-reboot line (V3 keeps the newest build). Verified 2026-10-31T18:47Z: CI lint and test green, audit green on b5224c5; docs-only diff; drift ok ("9 commits ahead, none that runs"); tests/test_disk_gc.py 16 passed on the node (implementer's report).
• spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106 spec §2: record the readers of gs://co-gcs-processor (Archiver's, from Notification composer, preview and test-send archiver#367 D4; and Provisioner's, which was missing) · XS · docs, no deploy · PR #106 docs: spec §2 records Archiver's and Provisioner's readers of gs://co-gcs-processor #108 (FF b5224c5..ef36136): an Amended entry, two Grants rows (archiver-processor-text-reader, co-gcs-provisioner-reader; both objectViewer, bucket-level), the convenience-bindings note, and the prefix note naming three readers. Written from the operator's IAM reading (etags CAY=, CAk=). Verified 2026-11-01T21:41Z: CI lint and test green, audit green on ef36136; spec-only diff; drift ok ("10 commits ahead, none that runs"). Residual resolved: PR #106 docs: the Amended 2026-10-31 entry drops the reading's wrong time #109 (FF 8742909..cfb8fa2) drops the coordinator's wrong "~20:20Z" from the Amended entry, so it now reads "read 2026-10-31"; CI lint and test green on cfb8fa2 (run 41521084063).

Waits

Parked

Out of epic

• SocratiCode 1.16.0 → 1.16.1: other repos are bumping, but nobody asked Processor to. Boundary decision 1.
• context-cadence.yml and curating-context: add CannObserv/processor to .skills/cohort — pair it with broker, or unpaired gregoryfoster/skills#343 (Processor's context ledger): agent tooling. Boundary decision 1.
• co-core 0.39.0 through 0.40.0: nothing Processor imports moved, so no bump. 0.40.0 (2026-10-30) tightens only ContentReplicateCommandEmit and SourceRevisionObservedEmit in co_core.pure.models.changes; Processor uses ContentProcessCommand and the Processing* models from that module [measured, compare v0.39.5…v0.40.0].

Verification debt

Watching

• test_on_without_the_bus_is_silence is flaky: a prior test's check-in thread posts into its respx route archiver#406's liveness-test thread leak: "Processor's tests probably have the same leak; not checked" [stated]. Measure before slotting. Since 2026-10-24.
• Ubuntu Pro is not attached: 25 esm-apps updates are visible, with 150 universe packages installed (Adopt host patching: needrestart l, posture scheduled, first window #77's record). The owner's decision, and cohort-wide. Not filed. Since 2026-10-26.
• patching-hosts: probe.sh escalates through sudo -n without asking, so a read-only probe is a sudo step gregoryfoster/skills#490 and patching-hosts: lists:stale fires right after a host apt-get update — it ages the archive's Last-Modified, not the fetch gregoryfoster/skills#493 (patching-hosts: the probe's sudo; list freshness): decided 2026-10-30 for the skills repo's Wave 5. Not before the 2026-11-03 window unless it ships by then. Since 2026-10-30.
• gs://co-gcs-processor carries GCS's default project convenience bindings: Viewer of project co-gcs can read objects (spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106's reading). Removing them is the operator's call for the whole cohort. The bucket already has uniform bucket-level access, and public access prevention is enforced (operator's describe, 2026-11-01, on spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106). Not filed. Since 2026-10-31.

Standing checks

• Due Tue 2026-11-03, 05:00–10:00Z: the first weekly patch window (knob window Tue 05:00-10:00). Confirm it ran with its record, -security pending 0, the language reading present from step 9 (Lock audit: a weekly finding notifies nobody #75; recorded as no read, never 0, if absent), and processor NRestarts=0. Each run is approved in this repo's session. The GC (Root disk at 79% with nothing pruning or watching it #82) runs daily at 05:15Z plus up to 30 min, inside the window, and patching reads its 85% alert_at_percent as a floor. The first deploy-free window: Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87's wheelhouse check isn't exercised by it.
• Before that window: the skills pin 170af367 (hook bump 8742909, 2026-11-02) contains b386bd2b. Read 2026-11-02T06:5xZ: read-knob.sh --today 2026-11-03 parses .skills/patching-hosts with report_only false, cadence weekly (the default; patching-hosts: scheduled says monthly; a host wants weekly. Deviation, or a stated cadence? gregoryfoster/skills#529), and window Tue 05:00-10:00 intact. New in run.md: a run with nothing pending ends at the readings and the record (no window, no approval), unless impact.reboot calls for one; both the probe's refresh and step 1 run apt-get update --error-on=any, so a NodeSource or Tailscale fetch failure stops the run (patching-hosts: a partly failed apt-get update reads as a whole refresh, so a lane can count against a source's old lists gregoryfoster/skills#542).
• At each check-in, while the WARNING and ERROR records reach journald at INFO priority #76 row in Verification debt is open: journalctl -u processor -p warning --since 2026-10-25T15:50:36Z. 2026-11-02: still none.
• Dependabot's uv security jobs: the first two ran 2026-11-03T01:27Z (pyasn1, pypdf), and both failed with PathDependenciesNotReachable: --find-links. § CI pins and Dependabot says security updates are off. At each check-in: gh api "repos/CannObserv/processor/actions/runs?event=dynamic", and any Dependabot PR touching uv.lock is closed unmerged. The operator re-reads the setting (the advisory issue's item 1).

Overlaps

Measured state

Rewritten from scratch at each check-in, never appended to.

• processor active, NRestarts=0, live releases/5ef07e29e06a since 2026-10-26T19:13:20Z (boot 19:13:18Z). origin/main 5f2336c differs in no runtime path. Kernel 6.12.113. Measured 2026-10-26T22:15Z.
• CI green by job on 5ef07e2, d0e73a2 and 5f2336c. Measured 2026-10-26T22:15Z.
• 0 packages upgradable. /etc/needrestart/conf.d/processor.conf and /etc/apt/preferences.d/tailscale.pref are identical to deploy/. Tailscale AutoUpdate.Apply is false. Measured 2026-10-26T22:15Z.
• 0 records at -p warning since 2026-10-25T15:50:36Z. Drift ok (202). Measured 2026-10-26T22:15Z.
• Root disk 79% (15G of 20G); ~/.vscode-server 5.6G. Measured 2026-10-24T18:40Z (not re-read).
• exe-setup.service enabled, /exe.dev/setup absent, none delivered on 5 boots. Measured 2026-10-26T22:15Z.
• Main checkout on main, clean, no worktrees; transient processor-patch-77 units gone. Measured 2026-10-26T22:15Z.

Log

• 2026-10-24: created from a whole-backlog audit. 2 open issues kept (Lock audit: a weekly finding notifies nobody #75 in Tier 3; Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 parked) and 8 filed (WARNING and ERROR records reach journald at INFO priority #76–Host resilience: record the earlyoom decision; test a hard reset #83). No closures proposed. Next: WARNING and ERROR records reach journald at INFO priority #76.
• 2026-10-24: handed off WARNING and ERROR records reach journald at INFO priority #76 (brief in its body; pre-flight comment upgrades option 1 to measured). Pointer comments on Lock audit: a weekly finding notifies nobody #75 and Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54.
• 2026-10-25: WARNING and ERROR records reach journald at INFO priority #76 verified and ticked (PR #76 feat: records reach journald at their level's priority #85 feat, PR #76 docs: the deploy instant in § Logs #86 docs; both of WARNING and ERROR records reach journald at INFO priority #76's own PRs). Harvest: For Adopt host patching: needrestart l, posture scheduled, first window #77 notes moved to Adopt host patching: needrestart l, posture scheduled, first window #77; WARNING and ERROR records reach journald at INFO priority #76's held CR 11 (reviewing-code unlinked) offered to ride Adopt host patching: needrestart l, posture scheduled, first window #77's skills-inventory step. Re-scan: The co-core wheel has no content check: uv.lock pins it by path, the sync compares sizes, TLS is the only check broker#125 closed with the broker's fix and a cohort table naming our gap, so its Waits row became Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87 (filed); the pin-time residual waits on CannObserv/cannobserv#591. Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78: the operator says the key is revoked. Other waits unchanged (Revoke Watcher's content.fetch-policy publish grant broker#95 open; provisioner, cannobserv and archiver refs read by hand). Next: Adopt host patching: needrestart l, posture scheduled, first window #77, with Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78 alongside.
• 2026-10-26: Adopt host patching: needrestart l, posture scheduled, first window #77 verified and ticked (PR #77 Adopt host patching: needrestart l, posture scheduled #88 feat, PRs #77 docs: deploys don't wait for a window; the bulk runs without a recovery point #89–#77 chore: weekly patching, Monday night Pacific #92 docs/knob; run 1 patched 85 packages and rebooted in-guest). Upstream notes filed with approval: patching-hosts: probe.sh escalates through sudo -n without asking, so a read-only probe is a sudo step gregoryfoster/skills#490, patching-hosts: dormancy reads Docker as in-use from a comment in deploy/ that says the service is not in group docker gregoryfoster/skills#491, patching-hosts: SKILL.md step 5 and run.md §2 send a no-datastore host to recovery-point.sh, which refuses gregoryfoster/skills#492, patching-hosts: lists:stale fires right after a host apt-get update — it ages the archive's Last-Modified, not the fetch gregoryfoster/skills#493 and process log patching-hosts process-log: 2026-10-26 co-processor — first run; the kernel moved at the reboot gregoryfoster/skills#498. WARNING and ERROR records reach journald at INFO priority #76's cohort FYI filed as init-project-fastapi: journald gets no priority from the JSON logging pattern; port processor#76's JOURNAL_STREAM check gregoryfoster/skills#500 (operator-approved). Harvest: For Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78 (none delivered on 5 boots; step 2 moot) and For Host resilience: record the earlyoom decision; test a hard reset #83 (RSS numbers; the kernel moved at the reboot) posted. Re-scan: Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87 (this epic's), PRs #77 Adopt host patching: needrestart l, posture scheduled #88–#77 chore: weekly patching, Monday night Pacific #92 (Adopt host patching: needrestart l, posture scheduled, first window #77's). deploy.sh: journal the verified verdict; don't wait on an added unit whose timer is off; a build-only mode for a rebuild broker#122 closed, so its item 1 was slotted as deploy.sh: journal the verified verdict, not only the switch (port CannObserv/broker#122 item 1) #93; items 2, 3 and 5 don't apply (measured). Revoke Watcher's content.fetch-policy publish grant broker#95 is still open, so Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 stays parked. Next: Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78, then Lock audit: a weekly finding notifies nobody #75.
• 2026-10-26: Lock audit: a weekly finding notifies nobody #75 decided (operator): option 4, lean on the patch window; brief posted. Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78 step 1 done here, with approval, read before and after; the CannObserv/provisioner#4 report is drafted. Next: Lock audit: a weekly finding notifies nobody #75.
• 2026-10-27: Lock audit: a weekly finding notifies nobody #75 verified and ticked (PR #75 The weekly window reads the live lock: § Patching step 9, a guard, the claim corrected #94, docs and tests, no deploy). Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78 closed: the CannObserv/provisioner#4 report posted with approval. Harvest: For Pin Actions by SHA; Dependabot for github-actions only (port CannObserv/broker#90) #80 on its line; patching-hosts: the language reading can vanish silently — a unit off its lock reads complete, and run.md has no step that takes it gregoryfoster/skills#508 filed by Lock audit: a weekly finding notifies nobody #75's thread. Re-scan: deploy.sh: journal the verified verdict, not only the switch (port CannObserv/broker#122 item 1) #93 and #75 The weekly window reads the live lock: § Patching step 9, a guard, the claim corrected #94 new; Root disk at 79% with nothing pruning or watching it #82 got the adoption path (New skill: maintaining-host-disk — adopt Provisioner's canonical disk GC + headroom sensor, plus the repo-side knobs (cohort-wide) gregoryfoster/skills#425 shipped), so it's resized to M and next, ahead of the first weekly window. Revoke Watcher's content.fetch-policy publish grant broker#95 still open (Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 parked); cannobserv refs open; no co-core tag past v0.39.1; CannObserv/provisioner#16 has no co-processor assessment. Next: Root disk at 79% with nothing pruning or watching it #82.
• 2026-10-28: Root disk at 79% with nothing pruning or watching it #82 verified after the first prune, and closed (PR #82 Adopt the cohort disk GC: config, links, pytest retention, runbook #95; host steps G1–G8, each approved; co-processor-disk-headroom: Processor's disk headroom sensor (CannObserv/processor#82) status#69 created and closed the monitor). Harvest: For deploy.sh: journal the verified verdict, not only the switch (port CannObserv/broker#122 item 1) #93 (host-config notes) on its line; For Host resilience: record the earlyoom decision; test a hard reset #83 (no MemoryPeak; reset checks) posted on Host resilience: record the earlyoom decision; test a hard reset #83. Re-scan: PR #82 Adopt the cohort disk GC: config, links, pytest retention, runbook #95 only. co-core v0.39.2 touches no extract, stream, envelope or bus path (legislative_session and transport only), so no bump. Revoke Watcher's content.fetch-policy publish grant broker#95 open (Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 parked); cannobserv refs open; CannObserv/provisioner#16 unchanged. deploy.sh: journal the verified verdict, not only the switch (port CannObserv/broker#122 item 1) #93 briefed, with broker's interrupt trap fenced as an option. Next: deploy.sh: journal the verified verdict, not only the switch (port CannObserv/broker#122 item 1) #93.
• 2026-10-28: deploy.sh: journal the verified verdict, not only the switch (port CannObserv/broker#122 item 1) #93 verified and ticked (PR #93 deploy.sh journals the verified verdict (and an interrupt) #96, deployed; the verdict line read live, its PID equal to MainPID). Filed maintaining-host-disk: loading the staged GC with Python writes a __pycache__ the installer then refuses; the skill doesn't warn gregoryfoster/skills#514 (the staged GC's __pycache__, from Root disk at 79% with nothing pruning or watching it #82's G1) with approval. Harvest: For Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87 and For shellcheck the shipped shell scripts (port CannObserv/broker#112) #81 on their lines. Re-scan: PR #93 deploy.sh journals the verified verdict (and an interrupt) #96 only; cannobserv refs open, no co-core tag past v0.39.2; CannObserv/provisioner#16 unchanged. Pre-flight for Run the wheelhouse sync from the lock (port CannObserv/broker#113) #79/Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87 measured the local-build reproducibility (0.37.0 matches) and broker's missing precondition. Next: Run the wheelhouse sync from the lock (port CannObserv/broker#113) #79 then Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87, bundled.
• 2026-10-29: Run the wheelhouse sync from the lock (port CannObserv/broker#113) #79 and Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87 verified and ticked (PRs #79 fix: the wheelhouse sync runs from uv.lock's wheelhouse group #97 and #87 feat: a locked wheelhouse file is held to a committed sha256 #98, one deploy; the wheelhouse verdict journaled). Wheelhouse content check: pin co-core's sha256 and verify it at sync and deploy (port CannObserv/broker#125) #87's thread filed CannObserv/cannobserv#605 (operator-approved), now a Wait. Re-scan: Disk GC VERSION 3: bump skills-vendor to gregoryfoster/skills b1d6e303, then update co-processor #99 and SocratiCode on loopback (gregoryfoster/skills#494): bump skills-vendor to b5be0b55 so the health hook catches a managed-mode fallback #100 filed by the skills side (skills-vendor bumps), slotted in Tier 3 and Tier 2. co-core v0.39.5 touches co-core-aio's fetch and transport and co-core-sync's transport, none of which Processor imports, so no bump. Notification subscriptions: model, API and UI (global/domain/item scopes) archiver#363 closed, but Notification composer, preview and test-send archiver#367 hasn't asked. patching-hosts: the language reading can vanish silently — a unit off its lock reads complete, and run.md has no step that takes it gregoryfoster/skills#508 decided, maintaining-host-disk: loading the staged GC with Python writes a __pycache__ the installer then refuses; the skill doesn't warn gregoryfoster/skills#514 in a wave. GC standing check settled: a staged build at 07:16:55Z daily. Pin Actions by SHA; Dependabot for github-actions only (port CannObserv/broker#90) #80 briefed. Next: Pin Actions by SHA; Dependabot for github-actions only (port CannObserv/broker#90) #80.
• 2026-10-30: Pin Actions by SHA; Dependabot for github-actions only (port CannObserv/broker#90) #80 verified and ticked (PR #80 Pin Actions by SHA; Dependabot for github-actions only #101, no deploy; the operator matched broker's majors, against the brief). SocratiCode on loopback (gregoryfoster/skills#494): bump skills-vendor to b5be0b55 so the health hook catches a managed-mode fallback #100 closed by the coordinator: the hook's bump c74e6ad carries b5be0b55, CI green, preflight passed. Disk GC VERSION 3: bump skills-vendor to gregoryfoster/skills b1d6e303, then update co-processor #99's step 1 landed with the same bump; VERSION 3 staged and planned unprivileged, so only the approved sudo step is left. Harvest: For shellcheck the shipped shell scripts (port CannObserv/broker#112) #81 (runner is 26.04) on shellcheck the shipped shell scripts (port CannObserv/broker#112) #81's line and brief; For Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 (Redis fallback needs the runner pin) on its Parked row; the first Dependabot PR is a standing check. Re-scan: PR #80 Pin Actions by SHA; Dependabot for github-actions only #101 only; no co-core tag past v0.39.5; CannObserv/cannobserv#605 open, no comments; CannObserv/provisioner#16 unchanged; maintaining-host-disk: loading the staged GC with Python writes a __pycache__ the installer then refuses; the skill doesn't warn gregoryfoster/skills#514 (our report) closed in the skills wave. Live 9ff7584fbfd5, NRestarts=0, drift ok, / 59%. shellcheck the shipped shell scripts (port CannObserv/broker#112) #81 briefed. Next: shellcheck the shipped shell scripts (port CannObserv/broker#112) #81.
• 2026-10-30: shellcheck the shipped shell scripts (port CannObserv/broker#112) #81 verified and ticked (PR #81 shellcheck the shipped shell scripts; CI on the node's image #102, deployed d29e240cb85f; runs-on: ubuntu-24.04 by operator decision; red proof on throwaway #81 throwaway: prove the shellcheck step goes red (do not merge) #103). Disk GC VERSION 3: bump skills-vendor to gregoryfoster/skills b1d6e303, then update co-processor #99's sudo step run by the coordinator with the operator's approval: VERSION 3 installed, plan current, timers enabled; closes after the first V3 run. Harvest: For Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 (the 24.04 fallback comment now holds; Valkey on 24.04 apt unverified) noted on shellcheck the shipped shell scripts (port CannObserv/broker#112) #81; for Dependabot's PR, @dependabot rebase, never push to its branch. Re-scan: PRs #81 shellcheck the shipped shell scripts; CI on the node's image #102 and #81 throwaway: prove the shellcheck step goes red (do not merge) #103 only. co-core v0.40.0 tagged: only the replicate and observed-revision Emit twins changed, none of Processor's models, so no bump. cannobserv refs and CannObserv/provisioner#16 unchanged; patching-hosts: SKILL.md step 5 and run.md §2 send a no-datastore host to recovery-point.sh, which refuses gregoryfoster/skills#492 and patching-hosts: the language reading can vanish silently — a unit off its lock reads complete, and run.md has no step that takes it gregoryfoster/skills#508 in lane G (Watching). WARNING and ERROR records reach journald at INFO priority #76's warning check: still none. Host resilience: record the earlyoom decision; test a hard reset #83 briefed. Next: Host resilience: record the earlyoom decision; test a hard reset #83.
• 2026-10-30: Host resilience: record the earlyoom decision; test a hard reset #83 verified and ticked (PRs #83 docs: record the earlyoom decision (not installed) #104 and #83 docs: record the 2026-10-30 hard reset in § At boot #105, docs; earlyoom not installed by operator decision; the first hard reset with the unit, ≤26.4 s outage, no page, Disable exe-setup.service on co-processor (CannObserv/provisioner#4) #78 step 3 passed). Harvest: Disk GC VERSION 3: bump skills-vendor to gregoryfoster/skills b1d6e303, then update co-processor #99's runbook still says VERSION 2 (on Disk GC VERSION 3: bump skills-vendor to gregoryfoster/skills b1d6e303, then update co-processor #99's line). Re-scan: PRs #83 docs: record the earlyoom decision (not installed) #104 and #83 docs: record the 2026-10-30 hard reset in § At boot #105. Notification composer, preview and test-send archiver#367 adopted D4: a new SA reading gs://co-gcs-processor, so the Waits row became spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106 (filed by the coordinator; trigger: the binding). patching-hosts: SKILL.md step 5 and run.md §2 send a no-datastore host to recovery-point.sh, which refuses gregoryfoster/skills#492 and patching-hosts: the language reading can vanish silently — a unit off its lock reads complete, and run.md has no step that takes it gregoryfoster/skills#508 shipped (lane G), reaching us with the next hook bump, before the window; patching-hosts: probe.sh escalates through sudo -n without asking, so a read-only probe is a sudo step gregoryfoster/skills#490 and patching-hosts: lists:stale fires right after a host apt-get update — it ages the archive's Last-Modified, not the fetch gregoryfoster/skills#493 decided for Wave 5. No co-core tag past v0.40.0; cannobserv refs open; Revoke Watcher's content.fetch-policy publish grant broker#95 open (Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 parked); CannObserv/provisioner#16's note is co-provisioner's. Next: Disk GC VERSION 3: bump skills-vendor to gregoryfoster/skills b1d6e303, then update co-processor #99's docs, then close-out.
• 2026-10-31: status check. Disk GC VERSION 3: bump skills-vendor to gregoryfoster/skills b1d6e303, then update co-processor #99's first V3 GC run exited 0 (05:44:42Z, 135.3M removed, the newer VS Code build kept); docs brief posted. The hook bump e568fad carries b386bd2b (lane G). Notification composer, preview and test-send archiver#367 closed and deployed with its reader bound, so spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106's trigger fired (its Waits row removed); brief posted, needs the operator's IAM reading. No Dependabot PR yet. No processor warning. Drift ok; REVISION d29e240cb85f, NRestarts=0. Revoke Watcher's content.fetch-policy publish grant broker#95 open (Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 parked). Next: Disk GC VERSION 3: bump skills-vendor to gregoryfoster/skills b1d6e303, then update co-processor #99 and spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106 (both XS docs), then close-out.
• 2026-10-31: Disk GC VERSION 3: bump skills-vendor to gregoryfoster/skills b1d6e303, then update co-processor #99 verified and ticked (PR #99 docs: § Disk GC records VERSION 3 and its first run #107, docs; the first V3 GC run exited 0). Harvest: § With Patching's after-reboot line was false under V3, now fixed in #99 docs: § Disk GC records VERSION 3 and its first run #107. Re-scan: PR #99 docs: § Disk GC records VERSION 3 and its first run #107 only. spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106 has no IAM paste yet. No Dependabot PR. Revoke Watcher's content.fetch-policy publish grant broker#95 open (Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 parked); no co-core tag past v0.40.0; nothing new on CannObserv/archiver. Next: spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106, then close-out.
• 2026-10-31: spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106 got the operator's IAM reading of both buckets (on spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106). Archiver's reader is present, and absent from co-gcs-blobs (D4 holds). Harvest: co-gcs-provisioner-reader reads our bucket per CannObserv/provisioner's spec D6, and our Grants table never listed it, so spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106 widens to it. The default project convenience bindings went to Watching. Next: spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106, then close-out.
• 2026-11-01: 6-hourly check. PR #106 docs: spec §2 records Archiver's and Provisioner's readers of gs://co-gcs-processor #108 (spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106) is open, and its diff matches the addendum. Correction: the reading's "~20:20Z" (in spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106's addendum and on this line) was the coordinator's error; the paste arrived between 20:18Z and 22:06Z. The addendum is fixed, and the fix was asked for on PR #106 docs: spec §2 records Archiver's and Provisioner's readers of gs://co-gcs-processor #108. co-core v0.40.1 changed ContentFetchCommand.render and RegistryAnnouncementState.render, which touch none of our imports, so no bump. Service unchanged, drift ok, no warnings, no Dependabot PR, Revoke Watcher's content.fetch-policy publish grant broker#95 open.
• 2026-11-01: spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106 verified and ticked (PR #106 docs: spec §2 records Archiver's and Provisioner's readers of gs://co-gcs-processor #108, spec only). Harvest: the bucket has uniform bucket-level access and public access prevention enforced, with soft delete at GCS's 7-day default (operator's describe, on spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106); Watching corrected. Residual: the merged Amended entry carries the coordinator's wrong "~20:20Z". The exit criterion is met: Tiers 1–3 closed, Follow the broker to Valkey 7.2 (CannObserv/broker#85): CI image, scratch server, 7.0.15-only claims #54 parked. Next: the close-out decision.
• 2026-11-02: 6-hourly check. PR #106 docs: the Amended 2026-10-31 entry drops the reading's wrong time #109 (spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106's residual: the Amended entry drops "~20:20Z") is open: a one-line spec diff, CI lint and test green, audit green, mergeable. The hook bump 8742909 moved skills to 170af367; the new patching-hosts parses our knob cleanly (Standing checks). info.watch-events consumer: shadow → dispatch archiver#369 reports its processor-text read proven live (ok 17735, 2026-11-01), and asks nothing of us. No Dependabot PR yet (its first weekly run is expected Mon 2026-11-02). Service unchanged, drift ok, no warnings, the GC ran 05:34Z exit 0.
• 2026-11-02: 6-hourly check. Dependabot's first PR, chore: bump astral-sh/setup-uv from 10.3.2 to 10.3.3 #110 (setup-uv 10.3.3), is green, with WIF passing under Dependabot's credentials; it's ready to land, then a docs PR (Refs Pin Actions by SHA; Dependabot for github-actions only (port CannObserv/broker#90) #80). PR #106 docs: the Amended 2026-10-31 entry drops the reading's wrong time #109 is still open; both are on 8742909. Service unchanged, drift ok, no warnings.
• 2026-11-03: 6-hourly check. PR #106 docs: the Amended 2026-10-31 entry drops the reading's wrong time #109 landed (cfb8fa2), resolving spec §2: record Archiver's reader on gs://co-gcs-processor (CannObserv/archiver#367 D4) #106's residual. PR #80 docs: § CI pins and Dependabot records setup-uv v10.3.3, WIF under Dependabot, the 3-day cooldown #111 (Refs Pin Actions by SHA; Dependabot for github-actions only (port CannObserv/broker#90) #80; the pin table moves to v10.3.3, the WIF confirmation, the 3-day cooldown) is open and green on cfb8fa2, and matches the kickoff. PR chore: bump astral-sh/setup-uv from 10.3.2 to 10.3.3 #110 is now behind main, so the landing order is @dependabot rebase on chore: bump astral-sh/setup-uv from 10.3.2 to 10.3.3 #110, land it, then rebase and land #80 docs: § CI pins and Dependabot records setup-uv v10.3.3, WIF under Dependabot, the 3-day cooldown #111. Disk is 59% (7.7G free, was 57%). Service unchanged, drift ok, no warnings.
• 2026-11-03: chore: bump astral-sh/setup-uv from 10.3.2 to 10.3.3 #110 (Dependabot, setup-uv 10.3.3, 312552a) and #80 docs: § CI pins and Dependabot records setup-uv v10.3.3, WIF under Dependabot, the 3-day cooldown #111 (Refs Pin Actions by SHA; Dependabot for github-actions only (port CannObserv/broker#90) #80, docs, ffcff4a) landed in order. CI green by job on both; all 3 uses: read 68559e99 # v10.3.3; no deploy (drift: 14 ahead, none that runs). Pin Actions by SHA; Dependabot for github-actions only (port CannObserv/broker#90) #80's follow-up is done. New: the lock audit has reported 11 advisories since they were published 2026-10-30 ~23:05Z: pypdf 6.21.2 ×7 (fixed in 6.21.4; it runs in the extraction child, on untrusted PDFs) and pyasn1 0.6.4 ×4 (fixed in 0.6.5). The audit is report-only, and the coordinator's 6h check didn't read its count, so this is a coordinator miss (the check now reads it). Dependabot ran its first uv security jobs for both packages; they failed on the wheelhouse, and § CI pins says security updates are off. A Tier 1 issue is drafted, awaiting approval to file.