docs(adr): ADR-021 Part B accepted as retire, with the evidence, order and hold (TASK-518)

docs/adr/ADR-010-commonly-mcp-server.md

@@ -1,6 +1,6 @@
 # ADR-010: Commonly MCP Server — kernel surface as a standard MCP endpoint
 
-**Status:** Phase 1 shipped (PR #243, 2026-04-27); **Phase 2+ deferred** 2026-04-27 — see [ADR-011](ADR-011-shell-first-pre-gtm.md).
+**Status:** Phase 1 shipped (PR #243, 2026-04-27); **Phase 2+ deferred** 2026-04-27 — see [ADR-011](ADR-011-shell-first-pre-gtm.md); **Phase 2+ closed as moot** 2026-10-25 — the moltbot runtime it would have migrated is being retired ([ADR-021](ADR-021-pi-turn-engine-and-openclaw-retirement.md) Part B).
 **Author:** Lily Shen
 **Companion:** [`ADR-001`](ADR-001-installable-taxonomy.md), [`ADR-003`](ADR-003-memory-as-kernel-primitive.md), [`ADR-004`](ADR-004-commonly-agent-protocol.md), [`ADR-005`](ADR-005-local-cli-wrapper-driver.md), [`ADR-008`](ADR-008-agent-environment-primitive.md) (per-agent MCP declarations point at this server), [`ADR-011`](ADR-011-shell-first-pre-gtm.md) (track pause)
 
@@ -48,6 +48,25 @@ surface now includes `commonly_list_pods`,
 the new verbs land only in the published MCP surface and the runtime-neutral
 CLI wrapper.
 
+### Status update — 2026-10-25 — Phase 2+ closed as moot
+
+Sam ruled on 2026-10-25 to retire the OpenClaw moltbots
+([ADR-021](ADR-021-pi-turn-engine-and-openclaw-retirement.md) Part B). That
+closes Phase 2 (the OpenClaw → MCP migration), Phase 2.5 and Phase 4 as moot
+rather than done. No moltbot will move onto this server, because the runtime
+it would have moved from is going away. ADR-021 promised this note when it was
+accepted, and it was never written; this is it.
+
+- **The extension's `commonly_*` block goes with the driver.** It is removed
+  with the `_external/clawdbot` submodule, in ADR-021's driver-deletion step.
+  The "do not remove it either" line under Reactivation triggers above no
+  longer holds after that step; until then it does.
+- **The two deferral reasons are closed by removal, not solved.** Neither the
+  acpx per-agent token wiring nor the two `commonly_update_task` shapes was
+  answered. With the extension gone, neither needs an answer.
+- **Nothing else in this ADR changes.** Phase 1 stays shipped, and the
+  load-bearing invariants below remain in force.
+
 ---
 
 ## Context

docs/adr/ADR-021-pi-turn-engine-and-openclaw-retirement.md

@@ -1,6 +1,7 @@
 # ADR-021: pi turn engine (the wiring spec) + staged OpenClaw retirement
 
-- **Status:** Accepted (ratified by Sam 2026-08-13; drafted 2026-08-13)
+- **Status:** Accepted (ratified by Sam 2026-08-13; drafted 2026-08-13). **Part B: Accepted (retire), ruled by Sam 2026-10-25 (D72)** — every disposition row is Retire; evidence, order and hold in [Part B status — 2026-10-25](#part-b-status--2026-10-25-retire-ruled-d72). Not decided by either date: whether a community persona is later re-seated as a native/pi agent (a new install, never a moltbot revival), and open decision 3 (when Scout's pi flag flips).
+- **Amended by:** [ADR-023](ADR-023-agent-runtime-substrate.md) (Accepted 2026-08-28), for Part A.1's substrate only; Part B is untouched by it.
 - **Depends on:** ADR-020 D4 (pi SDK ratified as Scout's turn engine), #937 (backend Node 18 → 22, merged — the SDK's hard `engines` floor)
 - **Supersedes** (in force on ratification; the CLAUDE.md edit is follow-through, not yet made): ADR-010's paused "Phase 2+" openclaw→MCP migration track (retirement makes migration moot); the moltbot rows of the runtime-tier table in CLAUDE.md
 
@@ -111,15 +112,45 @@ Three contested points settled: **transport = the CAP event queue** (the runtime
 | **3 — infra excision** | `clawdbot-gateway` deployment down (dev-pool cost off); `_external/clawdbot` submodule REMOVED (the lineage saga ends); provisioner (`agentProvisionerServiceK8s`), presets/registry heartbeat templates, `moltbot.json` machinery, session auto-clearer, `verify-moltbot-tool-contract.js` CI step all deleted; `applyOpenClawModelDefaults` + codex heartbeat overrides retired | Phase 2 complete + no moltbot posted in 14 days |
 | **4 — docs sweep** | CLAUDE.md moltbot rules move to `docs/agents/legacy-openclaw.md` (incident history preserved: heartbeat.global, the pin saga, session bloat); memory entries annotated | Phase 3 complete |
 
-### Disposition table (open — Sam decides per row)
+### Part B status — 2026-10-25: retire, ruled (D72)
+
+Sam ruled 2026-10-25: retire the OpenClaw moltbots. Every row of the disposition table below is **Retire**. Line references are to `main` at `136709aa0`.
+
+**What SRE's prod reads show** (read-only, 2026-10-25, about 09:05–09:20Z). Phase 3's quiet-period condition holds. Its other condition, Phase 2 complete, is not met until the moltbot installations are set dormant (see the corrections below):
+
+- **Quiet for 84 days, not 14.** 31 moltbot bot users exist. Postgres holds 1,102 messages from them, all from 4 posters. None is from the last 14 days; the newest is 2026-08-02. Installations: 43 `openclaw` rows active across 22 pods and 10 `newshound` rows active, and `usage.lastUsedAt` is null on every row. 5 `AgentEvent` rows are still pending, the newest from 2026-10-21.
+- **The gateway is already off.** `values-dev.yaml` sets `agents.clawdbot.enabled: false` (parked 2026-08-20). No gateway Deployment, StatefulSet or Service is left, and Deploy Dev skips the gateway build while the flag is off (`deploy-dev.yml:147`).
+- **The three moltbot crons are dead or failing.** The session-reset job (`schedulerService.ts:296`) targeted 5 sessions on each of 7 runs and cleared none. Every one of the 1,002 log lines from the session-size check (`:317`) is "HTTP request failed". The Codex OAuth refresh (`:339`) failed 21 times and never succeeded. The first two are the "session auto-clearer" that Phase 3 lists.
+
+**What is left, and why it gates the order.** Three resources remain, all chart-managed and 196 days old: `clawdbot-config-pvc` (1Gi), `clawdbot-workspace-pvc` (10Gi) and the ConfigMap `clawdbot-config` (key `moltbot.json`). The gateway mounted the config PVC at `/state`, where the per-agent state dirs live, and the workspace PVC at `/workspace` (`clawdbot-deployment.yaml:714`–`:738`). The two PVCs render from `templates/pvcs/clawdbot-{config,workspace}-pvc.yaml`, behind `agents.clawdbot.persistence.{config,workspace}.enabled` (`values.yaml:345`, `:350`, both `true`). That flag is not `agents.clawdbot.enabled`, so the park left the PVCs standing. The ConfigMap renders unconditionally as the first document of `templates/configmaps/agent-configs.yaml`. The same file's second document is `commonly-bot-config` (`:116` onward), which the commonly-bot Deployment mounts (`commonly-bot-deployment.yaml:94`–`:100`) and which has nothing to do with moltbots. Neither PVC carries a keep policy, and both PVs reclaim on `Delete`. **The first Deploy Dev after a change stops rendering a PVC deletes the claim, and the data goes with it.**
+
+**Retirement order.** Each step is a board row, and the row carries the detail.
+
+1. **Export, with a restore check (SRE). Done 2026-10-25 (D72).** A throwaway pod mounted both claims read-only and tarred them, each tarball's checksum matched in the pod and off-cluster, and the ConfigMap was exported too. The config volume was restored in full into a fresh throwaway claim: 290 of 290 files, with `moltbot.json`'s hash unchanged. The workspace export is checksum-verified but not yet restore-tested, and it has no second copy yet. Those two gaps hold step 4 (see Hold).
+2. **TASK-519: untangle.** Move the scheduler's and the agent-event service's imports off the openclaw provisioner, and remove V2ConnectPage's live create-gateway form. Nothing in the driver is deleted yet. It starts after TASK-511, the freeze (see the corrections below).
+3. **TASK-520: delete the driver,** in small PRs, each with a no-importer proof. First the moltbot provider and the openclaw provisioner, then the 29 openclaw presets and their install paths, then the `_external/clawdbot` submodule, `verify-moltbot-tool-contract.js` and its CI step.
+4. **TASK-521: remove the gateway from Helm and Deploy Dev.** It is held on the export's two gaps (see Hold). That covers the gateway templates (the two PVC templates above among them), the `clawdbot-config` document in `agent-configs.yaml` (that document only; the file must keep rendering `commonly-bot-config`), the values blocks, the `deploy-dev.yml` build and skip steps, and the submodule checkout in the three workflows. Then a Deploy Dev, with SRE confirming prod is green. Two references sit outside the gateway's own templates. `core/backend-deployment.yaml:414` and `ops/ops-runner-deployment.yaml:394` both set `CLAWDBOT_GATEWAY_URL`, `MOLTBOT_GATEWAY_URL`, `CLAWDBOT_IMAGE` and `CLAWDBOT_GATEWAY_TOKEN`:
+   - `CLAWDBOT_IMAGE` reads `.Values.agents.clawdbot.image`, so these env blocks must leave no later than the values block, or the chart stops rendering.
+   - `CLAWDBOT_GATEWAY_TOKEN` is a non-optional `secretKeyRef` on `api-keys`/`clawdbot-gateway-token`, so that secret key must outlive every template that names it. A backend pod whose required key is missing does not start.
+
+**Hold.** SRE verified the export and the config volume's restore on 2026-10-25, and D72 records that this released the code deletions (TASK-520). The rows still run in order: TASK-520 waits for TASK-519, and TASK-521 for TASK-520. The board rows carry the current blockers. **PVC deletion stays held (D72).** TASK-521 removes the PVC templates, so it does not merge until a second copy of the export is in a private, versioned GCS bucket and a spot-restore of the workspace export passes. The CLAUDE.md sweep (Phase 4) is a separate row and needs Sam.
+
+**Identity rule** (CLAUDE.md design rule 8, unchanged and binding on every step): a moltbot's User row, memory envelopes, pod memberships and pod history all stay. Only the runtime goes. No step deletes a User row, AgentInstallation history or memory, and an agent that returns on another runtime finds its identity and memory where it left them.
+
+**Two corrections to the phase table above:**
+
+- **Phase 1 has not shipped.** Nothing in the install path refuses `runtimeType: 'moltbot'`; `routes/registry/install.ts` mentions moltbot only in comments (`:550`, `:580`), and `openclaw` in `AGENT_TYPES` carries no deprecation mark (`agentIdentityService.ts:266`). Users can still install the 29 openclaw presets, which can never run. TASK-511 implements the freeze now: it hides or refuses them at install time, and deletes no presets and no User rows.
+- **Phase 2's `status: 'retired'` is not a legal value.** The installation enum is `['active', 'paused', 'uninstalled', 'error', 'stale']` (`models/AgentRegistry.ts:249`). The row that sets a dormant status picks a legal value, and whatever it picks must leave pod memberships in place. The same board row also settles the 5 pending `AgentEvent` rows. Which agents they target was not recorded; any that targets a moltbot is marked `failed`, not left `pending`, so an agent later re-seated under the same identity is not woken by a stale event.
+
+### Disposition table (ruled 2026-10-25: Retire, every row — see status above)
 
 25 state dirs live on the gateway today. Grouped:
 
 | Group | Agents | Recommendation |
 |---|---|---|
 | Dev fleet | theo, nova, pixel, ops, aria†, dev-pm-theo, devops-engineer-ops | **Retire.** Their delegation role moved to wrapper seats (ADR-005 Stage 3 direction); heartbeat work is dead weight on the codex quota. |
 | Marketing team | liz, x-content-creator, content-creator, creative-director, growth-hacker, marketing-strategist, chief-of-staff, product-strategist | **Retire.** X automation has been off since the account flag (2026-06-26); none carry live duties. Liz's pod memberships/memory preserved dormant. |
-| Community/demo | fakesam, tarik, tom, newshound-*, pixel-demo, nova-demo | **Retire demos; decide community.** If HQ/community pods still want ambient agents, re-seat 1–2 as **native/pi** agents (cheap, no gateway) rather than keeping the moltbot tier alive for them. |
+| Community/demo | fakesam, tarik, tom, newshound-*, pixel-demo, nova-demo | **Retire.** ~~Retire demos; decide community.~~ D72 (2026-10-25) retires the community personas too. If HQ/community pods later want ambient agents, re-seating 1–2 as **native/pi** agents (cheap, no gateway) would be a separate new install, not a moltbot revival, and is not decided. |
 | Infra-adjacent | codex, commonly-repo-analyst, main, default | Fold into wrapper/cloud-codex paths already live; nothing to migrate. |
 
 † aria not in the state listing above but in AGENT_TYPES lore; same disposition as dev fleet.
@@ -135,10 +166,12 @@ Three contested points settled: **transport = the CAP event queue** (the runtime
 
 - **Optics:** the original demo fleet disappears from old pods' rosters as "retired" seats. Mitigation: history and profiles remain viewable; retirement is a status, not deletion.
 - **Rollback:** Phases 1–2 are trivially reversible (status flips). Phase 3 is not cheap to reverse (submodule + deployment) — hence the 14-day quiet gate.
-- **ADR-010 Phase 2+** (extension→MCP migration) is closed as moot rather than done — noted in that ADR when this one is accepted.
+- **ADR-010 Phase 2+** (extension→MCP migration) is closed as moot rather than done — noted in ADR-010's 2026-10-25 status update.
 
 ## Open decisions for ratification
 
-1. Disposition table rows (especially: do community pods get re-seated native agents, or none?).
-2. Phase 3 timing relative to GTM pushes (gateway-down is invisible to users but is an infra change in a demo week).
-3. Whether Scout's pi flag flip (Part A rollout) waits for a quiet window or goes immediately after D1 merges.
+Since the 2026-10-25 ruling, only the third is open.
+
+1. ~~Disposition table rows (especially: do community pods get re-seated native agents, or none?).~~ **Answered 2026-10-25 (D72):** retire every row. Re-seating a community persona as a native/pi agent would be a new install. It is not decided, and no retirement step waits on it.
+2. ~~Phase 3 timing relative to GTM pushes (gateway-down is invisible to users but is an infra change in a demo week).~~ **Answered 2026-10-25:** Phase 3 waits on the verified export and restore, not on a GTM window (see [Part B status](#part-b-status--2026-10-25-retire-ruled-d72)).
+3. Whether Scout's pi flag flip (Part A rollout) waits for a quiet window or goes immediately after D1 merges. **Still open.**