[acamarata]

Changes by debt row

• D-0104 — BLOCKED: Verified against origin/main at 1a96c7bb. CLI has no AI-provider breaker implementation. Planning explicitly assigns the command to P7-PLUG and plugins-pro:paid/ai's command declaration (hq/quality/debt.yaml, D-0104 scheduled_in/progress; hq/plan/p7/epics/CANON/EPIC.md, D-0104 exclusion). No change for this row; implementing it here would cross repository and P7 ownership boundaries.
• D-1115 — FIXED: When leading root flags skip mounting, breakout relocation now discovers the installed, enabled plugin and executes its validated manifest binary before considering auto-install. NSELF_NO_AUTO_ADD=1 permits existing installations. Regression covers canonical and relocated commands, a custom binary name, leading --json, and auto-install enabled/disabled. Updated plugin architecture docs.
• D-1147 — FIXED: Snapshot explicitly allowlisted marked site files in the scratch copy before building and restore only missing files after a successful build. Regenerated files take precedence. Regression simulates the build prune at the subprocess seam and verifies staging, exclusion of unlisted files, and regenerated content precedence. Updated deploy docs.

Verification

• Both new regressions failed before their respective fixes: D-1115 returned E404 in all four cases; D-1147 lost the allowlisted site from scratch and staging.

• CGO_ENABLED=0 GOTOOLCHAIN=go1.26.10 go test -mod=vendor -p=2 ./cmd/commands -run 'TestRelocateInstalledWithLeadingFlags|TestScratchAllowlistedMarkedSiteSurvivesBuildPrune' -count=1 — passed with both fixes.

• make fmt-check — passed.

• git diff --check — passed.

• CGO_ENABLED=0 GOTOOLCHAIN=go1.26.10 go test -mod=vendor -p=2 ./cmd/commands -count=1 -timeout=8m — passed (358.555s).

• CGO_ENABLED=0 GOTOOLCHAIN=go1.26.10 make build BINARY=<scratch>/nself — passed; output confined to task scratch.

• CGO_ENABLED=0 GOTOOLCHAIN=go1.26.10 go vet -mod=vendor -p=2 ./cmd/commands — passed.

• CGO_ENABLED=0 GOTOOLCHAIN=go1.26.10 GOFLAGS=-mod=vendor golangci-lint run --concurrency=2 --timeout=10m ./cmd/commands/... — passed with v2.13.2.

• Independent static review — no findings. All checks passed, so no clean-main failure comparison was needed. No hook exclusions were used.

No Docker integration tests, deployment, release, or version change was performed. HQ was read for ownership evidence and left unchanged.

[acamarata]

Rebased onto origin/main (9 commits behind). The only remaining go:test failure was TestNginxDirSites: deploy_scratch_nginx_preserve.go added a hand-built nginx path join, and the allowlist basis is shrink-only. The code now resolves the dir via nginxtopo.ServedNginxDir(scratch, "") (same path as before). No allowlist or basis change. internal/repoqa and the scratch deploy tests pass locally.

[acamarata]

Rebased onto current origin/main (it had moved by 5 commits). With CGO_ENABLED=0 go test -mod=vendor -count=1 ./... every package passes on the rebased head, including the repo ratchet tests (nginx call-site list, docker funnel allowlist, 300-line budget, panic baseline). No ratchet was loosened and no code change was needed beyond the rebase. The previous gate failure came from the stale base, and its log path was unreadable (zsh glob no-match), so I could not see the original test output.

[acamarata]

Rebased onto origin/main (e16c2ae). The go:test failure did not reproduce on the rebased head: nself ci --check passes all stages (gitleaks, fmt, vet, test, vendor-sync, sdk-remote-mutation) and go test ./... is green across all packages. The gate log you posted was only a zsh glob error (no log file matched), so there was no test output to act on. No ratchet changed and no code changes were needed beyond the rebase.