README: two human gates (clarifier + plan-decision), the approve/request-changes/
abandon verbs, free-text-defaults-to-request-changes, MAX_PLAN_GATE_VISITS, and
the planner max_turns reliability fix.
OPERATOR-RUNBOOK: how the gate appears in Slack, the three decision paths
(buttons/modal/free-text), the single-open-gate invariant, ceiling→PARKED, and
the 24h expiry→PARKED→recovery (re-assign / force-resume).
DEPLOY-R720: the pending_questions.kind ledger migration (SCHEMA_VERSION→4,
idempotent additive ALTER on startup) + rollback (restore the ledger backup
before restart if the migration fails).
- run-team.py: add the 'dispatch <thread_id>' operator command (P3 option-b).
The read-only box parks at DISPATCH; this completes it with a just-in-time
WRITE token: reads candidate_diff + scope from the checkpoint (or --diff/--scope
files), pushes the head branch + fires workflow_dispatch via dispatch_apply_verify,
prints the located run_id, and (--write-back) writes it into the task checkpoint
so VERIFY binds. +2 tests.
- OPERATOR-RUNBOOK: fix the misleading 'systemctl show -p Environment' check (it
does NOT show EnvironmentFile= vars) -> use /proc/<MainPID>/environ +
_p3_env_is_configured(); document the operator-initiated dispatch flow + the
fine-grained-token write-probe caveat.
Suite green, ruff clean. Branch only; not merged.
* docs(agent-team): fold round-2 GPT-4.1 plan-review findings into P3-live-flip plan
Round-2 cross-review (REQUEST CHANGES) folded:
- B1 deploy-before-merge made a concrete CI-enforced gate (required status check
fed by a box-exercised dispatch dry-run), not prose.
- B2 added rollback for a prematurely-flipped privileged job that actually RAN
(token rotate, revert opened PR/branch, audit the window) — distinct from an
accidental merge.
- B3 rollback is a tested, re-runnable script over ALL privileged surfaces
(workflow, environment, App perms, branch protection), not a one-time manual run.
- B4 Phase 3 explicitly gated on Phase 2 being fully provisioned + verified.
- B5 /sh-security-review + GPT-4.1 cross-review RE-RUN on the actual enabled
workflow before the flip, not only the inert version.
- B6 docs/memory updated incrementally at each privileged step; Phase 6 is the
final reconciliation pass.
Plus FIX/NIT/QUESTION: gate-weakening pattern review, check-name discovery test,
memory update on denylist change, snapshot retention in Phase 0, draft-PR
notification (Phase 4) + conservative-rollout controls (Phase 5) made concrete.
GH_TOKEN->GITHUB_TOKEN gate marked done (box alias added).
* docs(agent-team): close B1 — deploy-before-merge is a committed hard gate, not a manual fallback
Round-3 re-review resolved B2-B6 but flagged B1 still-open: the prior wording left
a 'enforced by hand until the check exists' escape hatch. Reframe B1 as a REQUIRED
Phase-1 build deliverable that blocks the flip (no manual fallback), with the
required-status-check + admin-bypass-disabled branch protection, and a dry-run
faithfulness note (same workflow file/jobs as live, only the privileged if: differs).
* docs(agent-team): close B1 ordering — admin-bypass disabled before any flip via the B4 precondition
Round-4 confirmatory re-review noted (c) admin-bypass-disable sits in Phase 2 while
the gate is framed Phase-1. Clarify there is no ordering window: the flip (Phase 3)
is gated on Phase 2 completion (B4), so branch protection incl. admin-bypass-disable
is necessarily in place before any flip. The check's implementation being a Phase-1
build task (not yet physically built) is expected for a pre-build plan; it is
non-optional and flip-blocking, enforced at the Phase-1 hard stop. Stopping the
plan-review cycle here per the project's '3 cycles, residual is build-time' rule.
Phased plan to take Plane-2 from clarify+plan to producing reviewable draft PRs:
locked decisions (GitHub App pull-requests:write, zero-AWS, read-only box), the
mandatory gates (/sh-plan-review + /sh-security-review + GPT-4.1 cross-review on
the CI surface), the B4 CI trust boundary (split CI, denylist, diff-hash, pure-code
green gate), phases 0-6 with owners + exercised rollbacks, what changes vs what
does not, risks, and definition of done. Input to /sh-plan-review before any build.
The Socket Mode inbound listener crashed at registration time on first live
run: `@app.action({})` raised `BoltError: action ({}) must be any of str,
Pattern, and dict` under slack_bolt 1.28.0, killing the listener thread (the
whole inbound answer path — message/app_mention/block_actions — went down,
caught only by the coordinator's respawn watchdog). serve() is marked
`# pragma: no cover - live socket`, so this was never exercised until the R720
bring-up. Replace the unsupported empty-dict matcher with a catch-all
`re.compile(r".*")` action_id regex; handle_event still does the real filtering
+ AUTHZ-01 owner-allowlist gate, so over-matching is safe.
Verified on sh-secrev: listener connects (live Socket Mode WebSocket), outbound
chat.postMessage works, 0 errors. /sh-security-review PASS (no confirmed
critical/high; matcher change introduces no new findings).
Also adds the dedicated Slack app (manifest + README) backing the clarifier
gate — "Sea Haven agent-team" (A0BC7AT8NUD), workspace-scoped install to avoid
the Enterprise-Grid `scope_not_allowed_on_enterprise` org-install trap — and
patches the provisioning runbook's stale langgraph pin (1.1.10 -> 1.2.5).
* fix(agent-team): serve() starts the inbound Slack listener (D-1)
Coordinator.serve() now constructs and starts the SlackListener concurrently
with the tick/drain loop on a background daemon thread, but ONLY when the live
transport is a SlackTransport AND SLACK_APP_TOKEN is configured. When Slack is
not the transport or the app token is absent, serve() behaves exactly as before
(tick/recover only) — Slack is never made mandatory.
- New injectable build_listener seam + default_slack_listener_factory sharing
the coordinator's own transport, ledger db_path, and resume_queue put.
- AUTHZ-01 owner-allowlist + open-status CAS untouched: serve() sources
AGENT_TEAM_SLACK_OWNER_IDS in SlackListener.serve, which still fails closed.
- SlackListener.close() added for clean Socket Mode teardown on shutdown;
serve() stops the listener + joins the thread in a finally.
- Tests: start-when-Slack+app-token, no-start otherwise, clean shutdown,
idempotent start, serve start/stop around the loop, listener close().
* fix(agent-team): systemd unit loads ~/orchestrator/.env + uses venv python (D-2/D-7)
D-2: add EnvironmentFile=-/home/adam/orchestrator/.env (optional '-') so the P2
GPT-4.1 review loop's cross_reviewer sub-process can read the non-Claude provider
key once a task reaches REVIEW. Mirrors the sea-haven-secrev unit.
D-7: point ExecStart at the agent-team venv interpreter
(/home/adam/orchestrator/agent-team/.venv/bin/python) instead of
/usr/bin/env python3, which resolved the system interpreter without the
installed deps under systemd's PATH.
All hardening (NoNewPrivileges / ProtectSystem=full / ProtectHome=read-only /
ReadWritePaths) is retained unchanged (locked decision).
* docs(agent-team): land provisioning + operator runbooks under docs/provisioning
- PROVISIONING-RUNBOOK.md: merged final state (6 checkers, dep-bump fixer, P5
intake-checker loop), SLACK_CHANNEL_ID, the gated P3-live flip steps (GitHub
App + agent-apply env + gated_build_verify_wiring), and D-1/D-2/D-7 marked
FIXED so the demo can use the live Slack answer path.
- P1-DEMO-SCRIPT.md: live Slack answer path now available (D-1 fixed); both the
Slack and operator-CLI answer paths documented for all four exit criteria.
- DEPLOY-AUDIT.md: D-1/D-2/D-7 RESOLVED (this PR); D-4/D-5 dep pinning and the
operator-CLI divergence kept as provisioning notes.
- OPERATOR-RUNBOOK.md (new): incident handling for pipeline stalls, parked tasks,
failed HITL resumes, budget exhaustion, transport outages, and
COMPLACENCY/COVERAGE alarms — each grounded in real run-team.py verbs, plus the
re-alarm-backoff -> Jira-after-N-nights escalation ladder (design §5/§6.6).
* fix(agent-team): supervise the Slack listener thread — recurring ALARM + respawn
sh-security-review (logic) MEDIUM: a crashed listener thread was logged once,
then the daemon ran on 'deaf' — posting clarifier questions but receiving no
answers, every gate silently parking, process never exiting so systemd
Restart=on-failure never fired. serve() now calls _supervise_slack_listener()
each pass: when the listener is enabled but its thread is dead, it emits a
recurring ERROR ALARM and respawns via the idempotent starter (self-heal).
No-op when alive or disabled. +3 tests. (authz detector: wiring clean — AUTHZ-01
fail-closed allowlist + open-status CAS intact, dead listener fails SAFE.)
