docs: the status block said nothing existed while nine issues were live

Phases 1-4 and 6 are done on the instance. This file still opened with "Nothing
exists on the instance: no agent users, no API tokens, no labels, no milestones,
no branch protection" -- every clause of which was false by the time the merge
that carried it landed.

Replaced with a table of measured state, and each row says what was MEASURED
rather than what was run:

  * protection is verified behaviourally -- a real push to main refused with
    `pre-receive hook declined`, as the repository owner -- not read off a
    settings page. That distinction is the whole subject of this file.
  * the tokens are probed: right identity, 403 on branch_protections for both
    agents, so the Write-not-Admin carve-out is demonstrated and not asserted.
  * the labels are 11 because the instance holds 11.

And a standing note that this block is the part most likely to be wrong, with
what to believe instead: `gitea-protect --verify` and the issue list MEASURE,
this block REMEMBERS. A remembered status is a cache with no invalidation, which
is the same failure as a 1,227-line BLOCKED.md and as the two documents this
runbook was split across an hour ago.
This commit is contained in:
MechaCat02
2026-09-04 17:55:28 +02:00
parent ce9fc6eea6
commit fcf6ec0497

View File

@@ -9,17 +9,25 @@ Steps are marked **👤 you** (a decision or a credential only you can make) or
## Where things stand
*`main` carries the play-tested port work and the rewritten briefs (`cd3a81af`).
* ✅ The briefs already describe this workflow. **They describe tooling that does
not exist yet** — which is why the agents are stopped and must stay stopped
until Phase 7.
* ❌ Nothing exists on the instance: no agent users (only `fabi`), no API
tokens, no labels, no milestones, no branch protection.
* ⏳ The MCP wiring (Phase 5) is written and in the tree; the images have not
been rebuilt, and no token exists for it to use yet.
**Updated 2026-09-04, against the live instance.** Phases 14 and 6 are done.
⚠️ **Do not start an agent before Phase 7.** Its brief will tell it to read
notifications and open issues, and it will have no tool that can.
| phase | state |
|---|---|
| 1 · identities | ✅ `sylph-decoder`, `sylph-port`, both collaborators at **Write** |
| 2 · protection | ✅ applied and **verified behaviourally** — a real push to `main` was refused with `pre-receive hook declined`, as the repository owner |
| 3 · tokens | ✅ three, each functionally probed: right identity, `403` on `branch_protections` for both agents |
| 4 · labels | ✅ 11 labels, 4 milestones, idempotence confirmed by a second run creating nothing |
| 5 · MCP | ⏳ **written and merged; the images are NOT rebuilt.** This is the remaining blocker |
| 6 · items | ✅ 9 issues seeded with 3 dependency edges, read back. All `state/proposed`**awaiting the human's approval of the shapes** |
| 7 · restart | ⏳ after the rebuild |
⚠️ **Do not start an agent before Phase 7.** Until the images are rebuilt, the
briefs tell it to read notifications and open issues with no tool that can.
📌 **This block goes stale first.** It was already wrong once — it read "nothing
exists on the instance" while nine issues were live. If it disagrees with
`gitea-protect --verify` or the issue list, believe those: they measure, this
remembers.
---