feat(control-room): add fail-closed release control plane #125

Merged

janpeter merged 75 commits from codex/ops-control-room-task5-completion into main 2026-08-01 15:15:53 +02:00

Conversation 1 Commits 75 Files changed 65 +20113 -234

janpeter commented 2026-08-01 14:49:16 +02:00

Owner

Copy link

Summary

• add the durable single-host Ops Control Room foundation, authoritative journal/evidence handling, resource leases and recovery semantics
• add authenticated operator resolution, durable Postgres projection, reconnecting SSE and bounded evidence APIs
• close replay, pagination, post-mutation and redaction failure modes found during independent review

Reviewed design and plan

• Task-8 resolution protocol design
• Active Task-8 implementation plan
• Parent initial-deploy plan
• plan review reached GO after four rounds; final implementation review reached GO with 0 Critical / 0 Important / 0 Minor

Scrum4Me provenance

• Sprint S-2026-07-29-1 (cms69x5dk004jx617fviyb3pa)
• PBI PBI-13 (cms69xcmy004kx6172qwa9k70)
• Story ST-026 (cms69xmve004mx6176hn4lgt6)
• Task ST-026.8 (cms69yanq004ux617sh16afw2)

Task-8 implementation commits

• Task 1: dfb4bd8, 22f88cf
• Task 2: cd9a292, 85008f0, 28f7344
• Task 3: f743c68, 44a108e
• Task 4: fb05fe4, 8dfd7f4, 0bc3816
• Task 5: 29d4070, 7a1965f
• Task 6: d9c7fc2, 67711ac
• Task 7 review fixes: 7915927, 8477949, 2c234f8, fbef368, 387108b, 44b8427, 32aa475

Every Critical/Important finding was handled through RED/GREEN and a fresh scoped rereview. The final broad review covered a6409e0..32aa475.

Validation

• full test suite: 933 passed, 1 platform-specific skip
• focused Task-8 matrix: 610 passed
• npm run typecheck
• npm --prefix ops-agent run check
• Prisma validate and generate
• git diff --check
• clean worktree and conflict-free merge-tree against current origin/main

Safety

No deployment, product activation, public release, max2 mutation or ST-026.9 work has occurred. The max2 ops-agent remains authoritative; Postgres remains a non-secret repairable projection.

## Summary - add the durable single-host Ops Control Room foundation, authoritative journal/evidence handling, resource leases and recovery semantics - add authenticated operator resolution, durable Postgres projection, reconnecting SSE and bounded evidence APIs - close replay, pagination, post-mutation and redaction failure modes found during independent review ## Reviewed design and plan - [Task-8 resolution protocol design](https://git.jp-visser.nl/janpeter/Ops-dashboard/src/commit/32aa475369f83b534d87753814e58b40410e5b14/docs/superpowers/specs/2026-08-01-ops-control-room-task8-resolution-protocol-design.md) - [Active Task-8 implementation plan](https://git.jp-visser.nl/janpeter/Ops-dashboard/src/commit/32aa475369f83b534d87753814e58b40410e5b14/docs/superpowers/plans/2026-08-01-ops-control-room-task8-projection-resolution-implementation-plan.md) - [Parent initial-deploy plan](https://git.jp-visser.nl/janpeter/Ops-dashboard/src/commit/32aa475369f83b534d87753814e58b40410e5b14/docs/superpowers/plans/2026-07-29-ops-control-room-video-editor-initial-deploy-implementation-plan.md) - plan review reached GO after four rounds; final implementation review reached GO with 0 Critical / 0 Important / 0 Minor ## Scrum4Me provenance - Sprint `S-2026-07-29-1` (`cms69x5dk004jx617fviyb3pa`) - PBI `PBI-13` (`cms69xcmy004kx6172qwa9k70`) - Story `ST-026` (`cms69xmve004mx6176hn4lgt6`) - Task `ST-026.8` (`cms69yanq004ux617sh16afw2`) ## Task-8 implementation commits - Task 1: `dfb4bd8`, `22f88cf` - Task 2: `cd9a292`, `85008f0`, `28f7344` - Task 3: `f743c68`, `44a108e` - Task 4: `fb05fe4`, `8dfd7f4`, `0bc3816` - Task 5: `29d4070`, `7a1965f` - Task 6: `d9c7fc2`, `67711ac` - Task 7 review fixes: `7915927`, `8477949`, `2c234f8`, `fbef368`, `387108b`, `44b8427`, `32aa475` Every Critical/Important finding was handled through RED/GREEN and a fresh scoped rereview. The final broad review covered `a6409e0..32aa475`. ## Validation - full test suite: 933 passed, 1 platform-specific skip - focused Task-8 matrix: 610 passed - `npm run typecheck` - `npm --prefix ops-agent run check` - Prisma validate and generate - `git diff --check` - clean worktree and conflict-free merge-tree against current `origin/main` ## Safety No deployment, product activation, public release, max2 mutation or ST-026.9 work has occurred. The max2 ops-agent remains authoritative; Postgres remains a non-secret repairable projection.

janpeter added 75 commits 2026-08-01 14:49:17 +02:00

feat(control-room): expose durable agent API 044eadf2bd

fix(control-room): bind durable acceptance authority f0675e4129

fix(control-room): bind acceptance atomically 6054389882

fix(control-room): close foundation bootstrap boundary b16994d2d3

fix(control-room): persist agent enablement a0d8cee15b

test(control-room): prove final enablement rollback 492c603df5

docs(control-room): specify evidence capability tokens 9d575130a6

docs(control-room): clarify evidence token boundary e42c50082b

docs(control-room): close token framing contract 40451b6360

docs(control-room): close capability error surfaces 16e8e7091c

docs(control-room): bound token response and parent races 4f23830e5f

docs(control-room): close evidence integrity contract bd496d3332

docs(control-room): close capability review gaps 5424f00409

docs(control-room): complete capability verification gate e336ad3794

docs(control-room): bind capability execution branch 8422a007f2

docs(control-room): close final capability review gaps c46bef6332

docs(control-room): add plan metadata d18e3e7238

docs(control-room): activate plan metadata 40ea5b2292

docs(control-room): approve capability specification 03ddd56861

docs(control-room): plan capability transport implementation 62a4dab782

docs(control-room): close capability plan review gaps d68e3ebdbb

docs(control-room): close capability plan review round two a55c79faaa

docs(control-room): reuse deployed heartbeat authority 43977cc21f

docs(control-room): close plan review round four 28fa63a8c5

docs(control-room): close plan review round five 26b21f5bd7

docs(control-room): close plan review round six d93e9ad344

docs(control-room): close plan review round seven ca302d7855

docs(control-room): close plan review round eight 2e1f1df8fd

docs(control-room): bound plan review provenance e7d78f24e6

docs(control-room): record task six plan approval abde84c2dc

docs(control-room): narrow migration mutation guard 1b0190ea3e

docs(control-room): approve migration guard delta 12328bf953

feat(control-room): add additive projection schema 077489a07e

feat(control-room): resolve registered agent targets 0946651781

fix(control-room): harden foundation transaction 8cd434048d

fix(control-room): close foundation authority gaps 7611b25823

fix(control-room): validate effective compose authority 0bcd828e5f

fix(control-room): inspect profiled compose authority 922a32d07d

feat(control-room): issue bounded evidence capabilities 82548ad7a5

fix(control-room): close release candidate response 8d40b50640

test(control-room): fix route helper types 28dee58690

feat(control-room): add closed agent transport 73701a838f

fix(control-room): close agent client boundaries 5c97a287f8

test(control-room): close Task 6 completion gate 08352199ca

feat(control-room): enforce reviewed run acceptance e74a14292d

fix(control-room): validate accepted release proofs 3c9c5cc470

docs(control-room): define Task 8 resolution protocol fb6126b665

docs(control-room): close Task 8 review findings cb309d394f

docs(control-room): make forced resolution retry-safe dd03244bf5

docs(control-room): plan task 8 projection resolution 61b245d16c

docs(control-room): close task 8 plan review findings 3cd2045ec7

docs(control-room): harden task 8 projection plan 5c4bbbf2da

docs(control-room): align projection migration contract 1d0ed1ec10

docs(control-room): activate reviewed task 8 plan a6409e089d

feat(control-room): add durable event projection dfb4bd83eb

fix(control-room): harden event projection replay 22f88cf2a4

feat(control-room): bind operator resolution requests cd9a29297f

fix(control-room): reject C1 resolution controls 85008f00c0

test(control-room): pin legacy resolution rejection 28f73448be

feat(control-room): authorize operator resolution f743c68e12

fix(control-room): close forced release retries 44a108ed2c

feat(control-room): project authoritative run state fb05fe4445

fix(control-room): bind authoritative run snapshots 8dfd7f43cf

fix(control-room): reject stale run pages 0bc38169c1

feat(control-room): stream run evidence safely 29d40707b6

fix(control-room): preserve projection cursor and cancellation 7a1965ff10

feat(control-room): expose operator resolution api d9c7fc2fb7

fix(control-room): bind resolution responses 67711ac3ad

fix(control-room): repair replayed phase projection 7915927081

fix(control-room): resume authorized lease release 8477949c6f

fix(control-room): separate replay repair facts 2c234f8079

fix(control-room): close reason fallback validation fbef3686ce

fix(control-room): page durable event catch-up 387108bf23

fix(control-room): bound replay evidence pages 44b8427321

fix(control-room): bind replay snapshots to definition 32aa475369

s4m-codex-reviewer reviewed 2026-08-01 14:51:57 +02:00

s4m-codex-reviewer left a comment

Copy link

Verdict: COMMENT

Geen gekoppeld plan gevonden — beoordeeld op codekwaliteit + product-standaarden.

Findings

• warning — app/api/control-room/runs/route.ts:55 — De accept-route zet elke fout uit target resolution, agent I/O, release-candidate validatie en projectie om naar HTTP 403. Dat maskeert operationele onbeschikbaarheid of release-candidate drift als autorisatiefout, terwijl de Control Room-contracten juist stabiele fail-closed foutpartities gebruiken. Overweeg FRESH_REAUTH_REQUIRED/approval als 403/400 te houden, maar CONTROL_ROOM_UNAVAILABLE als 503 en candidate drift als 409 te retourneren.

Reviewlog

• Productstandaarden getoetst tegen Ops Control Room docs: agent blijft autoriteit, Postgres is projectie, max2 target resolution is fail-closed, resolution actions vereisen fresh reauth en HMAC-bound server-side operator identity.
• Geen inline-comments geplaatst.

# Verdict: COMMENT Geen gekoppeld plan gevonden — beoordeeld op codekwaliteit + product-standaarden. ## Findings - warning — app/api/control-room/runs/route.ts:55 — De accept-route zet elke fout uit target resolution, agent I/O, release-candidate validatie en projectie om naar HTTP 403. Dat maskeert operationele onbeschikbaarheid of release-candidate drift als autorisatiefout, terwijl de Control Room-contracten juist stabiele fail-closed foutpartities gebruiken. Overweeg `FRESH_REAUTH_REQUIRED`/approval als 403/400 te houden, maar `CONTROL_ROOM_UNAVAILABLE` als 503 en candidate drift als 409 te retourneren. ## Reviewlog - Productstandaarden getoetst tegen Ops Control Room docs: agent blijft autoriteit, Postgres is projectie, max2 target resolution is fail-closed, resolution actions vereisen fresh reauth en HMAC-bound server-side operator identity. - Geen inline-comments geplaatst.

janpeter merged commit 7851eca52c into main 2026-08-01 15:15:53 +02:00

janpeter referenced this pull request from a commit 2026-08-01 15:15:56 +02:00

Merge pull request 'feat(control-room): add fail-closed release control plane' (#125) from codex/ops-control-room-task5-completion into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

janpeter/Ops-dashboard!125

No description provided.