PTYCAP-05: throwaway-repo due->PR proof (code + owner runbook) [QC BLOCKED]

.planning/ROADMAP.md

@@ -30,7 +30,7 @@
 
 - [ ] **Phase 1: PTY Token Accounting** — live, mid-turn token accounting for a PTY turn (post-hoc is too late; a TUI turn can run for many minutes).
 - [x] **Phase 2: PTY Pre-Flight Gate** — a programmatic turn cannot be written to the PTY without passing the full gate chain.
-- [ ] **Phase 3: Governed-Automation Guard** — `humanOnlyPtyGate` → `governedAutomationPtyGate`, new flag, default OFF.
+- [x] **Phase 3: Governed-Automation Guard** — `humanOnlyPtyGate` → `governedAutomationPtyGate`, new flag, default OFF.
 - [ ] **Phase 4: Lifetime Inject Counter + Kill Switch** — rate ceilings don't stop a slow grind; add a lifetime per-task counter and a real kill switch.
 - [ ] **Phase 5: Throwaway-Repo Due→PR Proof** — prove the thing actually works, once, on a repo nobody cares about.
 - [ ] **Phase 6: Hardening + Docs + Release** — real-Postgres e2e, docs, version bump, ship, smoke-verify.
@@ -114,6 +114,12 @@ ceiling (and the programmatic-credit halt).
   3. Alarm emails the owner at 60% of the daily token ceiling.
   4. Default daily token cap lowered from 50M to a survivable figure (~20M).
 
+**Hand-off from Phase 3**: DELIVERED in Phase 4. The fail-closed `kill_switch` and `lifetime_counter` governor bodies in `hub/src/dispatch/governed-pty.ts` are now real; an admitted automation PTY turn is COUNTED in a durable append-only ledger (`automation_inject_ledger`) by an atomic reserve-before-send. See [docs/usage-cost.md](../docs/usage-cost.md) "PTYCAP Phase 4".
+
+**Delivery notes (Phase 4)**: the lifetime cap is LITERAL (default 1000 per counter key, env-raisable, owner reset, one-shot warning page at 80 percent and an exhaustion page); `POST /api/sessions/heal` is classified a machine surface; with `REMO_GOVERNED_AUTOMATION_PTY` ON the ask, work and telegram governed lists carry no counter key, so the `lifetime_counter` governor refuses `lifetime_counter_key_missing` until Phase 5/7 supply keys (fail closed, flag default OFF). The 20M default token cap applies only where `REMO_ORCHESTRATOR_DAILY_TOKEN_CAP` is unset.
+
+**Deferred to Milestone GOV (from Phase 4)**: a Telegram or UI kill-switch trigger; opt-in `stop_running` cancellation of active runs once automation ownership is tracked; a counter policy for QC keys (Phases 7/8) beyond the heal key; the cap-hit QC kind (Phase 9).
+
 ### Phase 5: Throwaway-Repo Due→PR Proof
 
 **Goal**: The orchestrator produces one reviewable PR, unattended, on a repo nobody cares about.
@@ -124,6 +130,21 @@ ceiling (and the programmatic-credit halt).
   2. It produces a reviewable PR with a green CI check, or it cleanly does nothing and says why.
   3. This has **never once happened**. Until it does, the orchestrator is unproven and unsellable.
 
+**Plans:** 9 plans (the live proof is OWNER-GATED; these plans build, test and document the machinery and the arming runbook, they arm nothing)
+
+Plans:
+- [x] 05-01-PLAN.md -- tracer (armed run to terminal outcome through every layer, flag OFF a true no-op) + orchestrator_proof_runs state layer + ProofGithub contract and fake (wave 1)
+- [x] 05-02-PLAN.md -- read-only GitHub adapter + protection assertion/freeze/drift (ruleset shape, zero bypass, permission probe) (wave 2)
+- [x] 05-03-PLAN.md -- hub verifier: default-branch advance via compare, PR scope, CI/green decision (wave 2)
+- [x] 05-04-PLAN.md -- read-only GET /api/orchestrator/proof + OpenAPI + docs:sync (wave 2)
+- [x] 05-05-PLAN.md -- proofBudgetGate + proofProtectionGate in both orchestrator gate lists, coverage scans, merge-routing refusal (wave 3)
+- [x] 05-06-PLAN.md -- ordered evaluators, tick-side budget termination, inject-outcome mapping, counter-key pin (wave 3)
+- [x] 05-07-PLAN.md -- arm/disarm/enable cores + operator CLI (exactly-one allowlist, frozen budget and protection) (wave 3)
+- [x] 05-08-PLAN.md -- flag-OFF differential matrix, real-Postgres proof helper (CI only), baseline (wave 4)
+- [x] 05-09-PLAN.md -- owner runbook (permissions, repo + ruleset, ordered rollback), CLAUDE.md/docs, runbook pin test (wave 4)
+
+**Delivery notes (Phase 5)**: the machinery is built and tested against a fake GitHub client and, in CI, against real Postgres; nothing was armed and no flag, GitHub or prod system was touched. The live run is OWNER-GATED (`docs/ptycap-05-proof-runbook.md`); Phase 5 stays unchecked until SC-3 closes live, so SC-2/SC-3 are "armed-ready, live proof pending owner GO", never PASS. Deferred: the automation `term.input` PTY producer (D-01, drives the stream-json macro path instead). Recorded dependency: arming refuses `proof_protection_unverifiable` (`bypass_actors_not_visible`) unless the GitHub App token can see ruleset bypass actors (GitHub shows them only to a caller with write access); that is an owner decision about the App's permission level, with no override path.
+
 ### Phase 6: Hardening + Docs + Release
 
 **Goal**: Shipped, documented, verified live.
@@ -190,9 +211,9 @@ fix the CAUSE, and escalates to the human when it cannot.
 |-------|--------|
 | 1. PTY Token Accounting | In Progress|
 | 2. PTY Pre-Flight Gate | Done |
-| 3. Governed-Automation Guard | Not started |
-| 4. Lifetime Counter + Kill Switch | Not started |
-| 5. Throwaway-Repo Due→PR Proof | Not started |
+| 3. Governed-Automation Guard | Complete (4/4 plans) - PR #505 open |
+| 4. Lifetime Counter + Kill Switch | Executed (8/8 plans) - QC BLOCKED (2 open races), draft PR #506 |
+| 5. Throwaway-Repo Due→PR Proof | Executed (9/9 plans) - QC BLOCKED (2 open MAJOR), draft PR - live proof pending owner GO |
 | 6. Hardening + Docs + Release | Not started |
 | 7. Unified Self-Heal Routing | Specced, not started (blocked on #346 + Phase 4) |
 | 8. Periodic Task QC + Optimization | Specced, not started (blocked on Phase 4) |

.planning/STATE.md

@@ -1,19 +1,21 @@
 ---
-gsd_state_version: 1.0
+gsd_state_version: "1.0"
 milestone: PTYCAP
 milestone_name: Milestone PTYCAP (Token-Gate the Interactive PTY Path)
-current_phase: 02
-current_phase_name: pty-preflight-gate
+current_phase: 04
+current_phase_name: lifetime-inject-counter-kill-switch
 status: executing
-last_updated: "2026-09-28T00:00:00.000Z"
+stopped_at: PTYCAP-04 executed 8/8 plans; QC BLOCKED after 2 fix rounds (2 open HIGH races); draft PR #506
+last_updated: "2026-10-13T18:00:00.000Z"
 last_activity: 2026-09-28
-last_activity_desc: BLEED milestone reconciled CLOSED (all four fixers verified shipped on main); milestone pointer advanced to PTYCAP; Phase 1 confirmed shipped (#395); Phase 2 execution started
+last_activity_desc: "BLEED milestone reconciled CLOSED (all four fixers verified shipped on main); milestone pointer advanced to PTYCAP; Phase 1 confirmed shipped (#395); Phase 2 execution started"
+state_head: a745ab9efb8e26c340e87a1f56cc55d3b2f35497
 progress:
   total_phases: 9
-  completed_phases: 1
-  total_plans: 4
-  completed_plans: 4
-  percent: 11
+  completed_phases: 3
+  total_plans: 17
+  completed_plans: 16
+  percent: 33
 ---
 
 > **BLEED milestone reconciled CLOSED 2026-09-28.** This file and `.planning/PROJECT.md` had
@@ -89,9 +91,9 @@ connection is the Tauri Supervisor MSI.
 
 ## Current position
 
-Phase: PTYCAP-02 (pty-preflight-gate) — EXECUTING
-Status: Executing Phase PTYCAP-02 (Phase 1, pty-token-accounting, shipped complete via #395)
-Last activity: 2026-09-28 — BLEED reconciled closed; PTYCAP-02 execution started
+Phase: PTYCAP-04 (lifetime-inject-counter-kill-switch) - EXECUTED, QC BLOCKED (stacked on PTYCAP-03 / PR #505)
+Status: 8/8 plans executed (branch phase-ptycap-04-lifetime-counter-kill-switch, draft PR #506 base main for Woodpecker postgres). /qc: 2 fix rounds done (B1+5 MAJOR+4 minor, then R1-R3); Codex still OPEN on 2 HIGH races: (a) orphan-resume reopen UPDATE...NOT EXISTS needs the per-user advisory lock launchOrchestrator holds; (b) supervisor/teab/work senders rearm once tasks on schedule_kind alone, must gate on onceClaimed. Verifier NO-SHIP at 8447cdf (CI red: 2 e2e fixture defects, fixed in bf3f51d, CI re-run pending).
+Last activity: 2026-10-13 - PTYCAP-04 executed + QC'd; BLOCKED on findings (a)(b) per the 2-round QC cap
 
 ### OBSRV phase ledger (`.planning/phases/`)
 
@@ -144,3 +146,19 @@ reset 2026-05-29 to unblock owner login. `jamie@theleadingpractice.com` is NOT a
 | Date | Slug | Summary | Commits |
 |---|---|---|---|
 | 2026-09-27 | cloud-sessions | Chat with claude.ai cloud sessions: `claude -p --cloud` send + Stop-hook reply webhook | 4f9b35b..83abd55 |
+
+## Performance Metrics
+
+| Plan | Duration | Tasks | Files |
+|------|----------|-------|-------|
+| Phase PTYCAP-03 P01 | 25min | 3 tasks | 10 files |
+
+## Decisions
+
+- [Phase PTYCAP-03]: 03-01: governedAutomationPtyGate hard-renamed (no alias); flag REMO_GOVERNED_AUTOMATION_PTY default OFF is a proven no-op; kill_switch and lifetime_counter are fail-closed Phase-4 slots — Differential vs frozen legacy oracle; D-02/D-04/D-05/D-06
+
+## Session
+
+**Last session:** 2026-10-07T23:32:22.340Z
+**Stopped at:** Completed PTYCAP-03-01-PLAN.md
+**Resume file:** None

.planning/architecture/SESSION-ASK-API-SPEC.md

@@ -46,7 +46,7 @@ Two independent walls, both live in prod (`REMO_PTY_INTERACTIVE=1` since the 202
 **Wall A — the gate.** `sessions.runner_type` is `'stream-json' | 'pty-interactive'`
 (`hub/src/db/schema.sql:615–621`). The human web/phone surface runs `pty-interactive`.
 `humanOnlyRejectsActor(actor, runnerType)` (`hub/src/dispatch/gates.ts:371–374`) returns true
-for **any** actor ≠ `'human'` when `runnerType === 'pty-interactive'`, and `humanOnlyPtyGate`
+for **any** actor ≠ `'human'` when `runnerType === 'pty-interactive'`, and `governedAutomationPtyGate`
 (gates.ts:388–401) turns that into `automation_blocked_on_pty:<actor>`. An external ask is
 by definition non-human (server-inferred from an api_key), so it is rejected before send.
 
@@ -71,7 +71,7 @@ prod (#247) and Telegram outbound falls back to the host-agnostic stream-json ev
 `~/.claude/projects/.../memory/project_direction_pty_orchestrator_monetize.md` (2026-07-12):
 the owner has **deliberately** decided automation will eventually drive the interactive PTY,
 with a **mandatory ordering**: (1) caps proven on all dispatch paths, (2) **cap the PTY path
-FIRST** (it has no token gate today; usage is post-hoc), (3) *then* relax `humanOnlyPtyGate`
+FIRST** (it has no token gate today; usage is post-hoc), (3) *then* relax `humanOnlyPtyGate` (renamed governedAutomationPtyGate in PTYCAP Phase 3)
 into a governed-automation gate (new flag, default OFF, server-inferred actor), (4) prove
 due→PR, (5) 30-night receipts.
 
@@ -164,12 +164,12 @@ Desktop doesn't have to memorize UUIDs.
 
 - `token: 'ask:<ask_id>'` (queue token + finalize key).
 - **Gates, in order — all non-bypassable:**
-  `thresholdGate` → `dailyCostCapGate` → **`dailyTokenCapGate`** → `humanOnlyPtyGate` →
+  `thresholdGate` → `dailyCostCapGate` → **`dailyTokenCapGate`** → `governedAutomationPtyGate` →
   `askRateGate` (new: N asks/hour/session, default 10) → `concurrencyGate(supervisorId)` when
   autospawning.
   `dailyTokenCapGate` is mandatory on every gate list and is scanned by
   `hub/test/token-cap-coverage.test.ts` — a new `gates: [...]` array missing it **fails CI**.
-  `humanOnlyPtyGate` stays in the list: if the resolved target is a `pty-interactive` row, the
+  `governedAutomationPtyGate` stays in the list: if the resolved target is a `pty-interactive` row, the
   ask is **rejected** (`automation_blocked_on_pty:external-ask`) rather than silently
   redirected — the redirect to a stream-json ask-session is an explicit resolution step
   (§2.1), decided *before* dispatch, not a gate bypass.
@@ -229,7 +229,7 @@ guard test (`hub/test/automation-routing-guard.test.ts`) still passes.
 2. Supervisor→hub **transcript streaming** over `/ws/agent` (new `transcript_delta` /
    `turn_complete` frames) so the hub can extract a reply from a PTY without reading the
    supervisor's disk. Requires a new signed MSI.
-3. `humanOnlyPtyGate` → `governedAutomationGate` (new flag, default OFF, server-inferred
+3. `humanOnlyPtyGate` → `governedAutomationPtyGate` (new flag, default OFF, server-inferred
    actor, + lifetime per-ask counter + kill switch).
 Until all three exist, **a PTY-native ask is not implementable and must not be attempted.**
 
@@ -292,7 +292,7 @@ only escalate to `remo_ask` when the free reads are inconclusive.
 | **1. Read surface (do this first)** | External api-key-authed READ of a session's transcript tail + memory + state. Zero tokens, zero PTY writes, works for PTY *and* stream-json sessions. | supervisor: new allowlisted `session_transcript_tail` / `session_memory` commands (registry alongside `teab_run`); reuse `hub/src/telegram/transcript/{claude,codex}-adapter.ts` for parsing. hub: `hub/src/api/ext.ts` (`/sessions`, `/:id/transcript`, `/:id/memory`, `/:id/state`), mount in `hub/src/index.ts` after L248, `api_keys.scopes` DDL in `schema.sql`, `hub/test/mount-order.test.ts` case. | **Needs a new signed supervisor MSI.** |
 | **2. Ask** | `POST /api/ext/sessions/:id/ask` + poll/long-poll, answered by a stream-json ask-session bound to the target's `project_dir`. | `hub/src/ask/{dispatch,result-schema,prompt,reaper}.ts` (mirroring `hub/src/revanote/*`), `session_asks` DDL, ask-session resolution/autospawn reusing `launchSessionForUser`, gates list incl. `dailyTokenCapGate` + new `askRateGate` in `hub/src/dispatch/gates.ts`, finalize hook wired via existing `onSessionReply` (no change to `hub/src/ws/agent.ts:729`). | Hub-only. No supervisor change, no PTY change, no gate relaxation. |
 | **3. MCP server** | `mcp-servers/apps/remo-code/` (5 tools above) + gateway registration + `docs/api.md` regen (`bun run docs:sync`). | `mcp-servers/apps/remo-code/*`, remo-code `hub/src/api/_openapi.ts` + `docs/api.md`. | — |
-| **4. PTY-native ask (OWNER-GATED — do not start early)** | Ask the *live* human PTY session and read its reply. | (a) token gate on the PTY path; (b) supervisor `transcript_delta`/`turn_complete` frames on `/ws/agent` + hub-side consumer replacing the disk tail; (c) `humanOnlyPtyGate` → `governedAutomationGate` (new flag, default OFF, lifetime ask counter, kill switch). | Blocked on the owner's mandatory ordering in `project_direction_pty_orchestrator_monetize`. |
+| **4. PTY-native ask (OWNER-GATED — do not start early)** | Ask the *live* human PTY session and read its reply. | (a) token gate on the PTY path; (b) supervisor `transcript_delta`/`turn_complete` frames on `/ws/agent` + hub-side consumer replacing the disk tail; (c) `humanOnlyPtyGate` → `governedAutomationPtyGate` (new flag, default OFF, lifetime ask counter, kill switch). | Blocked on the owner's mandatory ordering in `project_direction_pty_orchestrator_monetize`. |
 
 ### Test strategy