PTYCAP-05: throwaway-repo due->PR proof (code + owner runbook) [QC BLOCKED]

[finedesignz]

PTYCAP Phase 5 - Throwaway-Repo Due->PR Proof (code + owner runbook)

Stacked on #506 -> #505. Merge those first (base of this branch is the Phase 4 branch; this PR targets main so Woodpecker qc runs).

Status: DRAFT - /qc BLOCKED (2 open MAJOR after 2 fix rounds). Live proof is an OWNER GO/NO-GO gate and was NOT run.

What it builds (all flag-gated, default OFF = true no-op)

• orchestrator_proof_runs table + DAL (additive idempotent DDL; frozen budgets with CHECKs; single-flight partial unique indexes; canonical lowercase repo identity).
• Arm / disarm / enable cores + operator CLI under one hub-global advisory lock; arm is fail-closed (GitHub ruleset assertion, zero bypass actors, non-admin agent, no foreign session halt, no other enabled orchestrator task).
• Never-merge: GitHub ruleset as the preventive control (frozen id + digest, re-asserted before every dispatch), hub detective layer (any default-branch advance since base_sha terminates), merge-command refusal for proof repos (fail closed on null repo key). Prompt is advisory only; a proof-owned task can never render the dev macro under any flag combination.
• Hard budget gates (tokens / injects / wall time) on the orchestrator gate lists; durable attribution check; lifetime counter key pinned.
• Verifier: PR scope (pagination since armed_at, fork + off-prefix rejection), CI green -> pr_open_green, else a typed "did nothing and why" terminal.
• Read-only GET /api/orchestrator/proof (OpenAPI + docs synced).
• Owner runbook: docs/ptycap-05-proof-runbook.md (throwaway repo + ruleset, GitHub App permissions incl. the bypass_actors visibility decision, arming, rollback order: kill switch/disarm FIRST, then flags).

QC

Seats: sonnet correctness + adversary lenses, Codex read-only (agy MISSING). Record: .planning/phases/PTYCAP-05-throwaway-repo-due-to-pr-proof/QC/.
Open MAJOR (see QC/VERDICT.md): (1) attribution check compares aggregate counts, not per-turn; (2) a manual session halt engaged AFTER arm is indistinguishable from the proof-owned row. Both reachable only after an owner arms the proof.

Verification

• bun run check-baseline: OK (pass 3169, skip 259, fail 0). One known flaky timeout (transcript-adapter-codex, AgentAutofix 74489ffe) on a first run.
• Real-Postgres e2e helpers run only in Woodpecker (no local Postgres).

Not done here (owner-gated)

SC-2/SC-3 live proof: arming REMO_ORCHESTRATOR_AUTOSPAWN + proof flag + allowlist in prod. Runbook steps in docs/ptycap-05-proof-runbook.md.

🤖 Generated with Claude Code

[agentautofix-fixer]

AgentAutofix AI Review

claude

PASSED

• warning hub/src/dispatch/gates.ts: Default daily token cap halved (50M -> 20M) for any deployment that hasn't set REMO_ORCHESTRATOR_DAILY_TOKEN_CAP -- DEFAULT_DAILY_TOKEN_CAP changes from 50,000,000 to 20,000,000. This affects every environment that relies on the default and could unexpectedly throttle production usage (including the owner's own interactive PTY sessions, per the docs) immediately on deploy. The PR documents this risk extensively, but it's a meaningful behavioral change worth highlighting as a deploy-time risk rather than a pure doc/code tweak.
• info ``: Diff truncated before full review completed -- The supplied diff was cut off (exceeded the review size cap) partway through hub/src/dispatch/automation-controls.ts. Everything reviewed up to that point (kill-switch API, lifetime-counter ledger, proof-run DAL/transactions, heal-route reservation/release logic, schema migrations) is internally consistent, uses parameterized SQL throughout, and fails closed by design. The remainder of the diff beyond the truncation point was not visible and could not be reviewed.

codex

BLOCKED

• blocking hub/src/db/orchestrator-proof-dal.ts: Disarm deletes a pre-existing allowlist entry -- armProofRunTx permits the target repo to already exist in orchestrator_autospawn_allowlist and then uses ON CONFLICT DO NOTHING, but disarmProofRunTx unconditionally deletes that (user_id, repo_ident) row. Thus arming and disarming a proof can silently destroy configuration that predated the proof. Record whether the arm transaction created the entry and delete it only when proof-owned.
• blocking hub/src/db/orchestrator-proof-dal.ts: Re-arming accumulates duplicate proof rows -- Each arm unconditionally INSERTs an enabled orchestrator_rows row with command='proof', while disarm only disables prior rows and subsequent arms reuse the same scheduled task. Re-arming therefore either fails if a uniqueness constraint exists or creates multiple proof due rows that can trigger duplicate cycles. Reuse/reactivate exactly one row or remove the proof-owned row transactionally during disarm.

agy

advisory -- not part of the gate decision

PASSED

No findings.

Result: Blocking finding from: codex

Reviewer models (requested pin, not independently confirmed):

• claude: claude-haiku-4-5-20251001 (requested pin, not independently confirmed)
• codex: gpt-5.5 (requested pin, not independently confirmed)