Bobsled Factory Roadmap

This is the public project-status record. It describes product capabilities and safety boundaries without deployment-specific identifiers or private run evidence.

Status: DONE · ACTIVE · NEXT · PLANNED · BLOCKED

Northstar

Bobsled is a trusted software-development and maintenance control plane for the Frostyard GitHub organization. It turns repository events and operator intent into schema-validated jobs, runs workers in bounded workspaces, obtains independent review, proves repository-declared quality gates, and opens pull requests for human review. Bobsled never merges its own work.

Linux is the canonical production runtime. Multi-repository changes are a first-class destination: one change set may coordinate ordered work and compatible pull requests across several repositories while preserving each repository's policy and gates.

Milestones

M0 — Subscription-backed Flue runtime — `DONE`

Flue v2 on Node.js.
Native Pi OAuth providers for Codex and GitHub Copilot subscriptions.
Cross-process-safe credential login and refresh.
Standalone Codex and Copilot agents plus a Codex-led Bobsled team.

M1 — Typed control plane and read-only triage — `DONE`

Schema-validated repository, intake, triage, gate, and policy contracts.
Enrolled-repository registry with read-only GitHub issue intake.
Sandboxed triage with no GitHub mutation capability.
Operator interface for repository selection, issues, manual tasks, and dry-run triage.

M2 — GitHub App and durable job ledger — `DONE`

External-setup evidence: authenticated HTTPS operator access, signed ping and automatic installation webhook admission, invalid-signature rejection, idempotent redelivery, private-key-file rotation with the predecessor revoked, and post-revocation installation-token minting all passed on Linux. Organization-wide installation coverage is an accepted operator decision for near-term expansion; Bobsled's enrolled-repository policy remains the execution boundary. Event-driven dispatch and code publication remain disabled.

Permission-narrowing evidence: GitHub automatically delivered each reduction as a verified installation update, and the latest retained snapshot reports organization-wide repository coverage with no permission above Bobsled's declared capability ceiling.

Issue-action evidence: the explicitly authorized temporary Bobsled issue #17 received one bounded route label and one marker-bearing comment. A simulated interruption after GitHub accepted the comment left the durable action retryable; the next attempt recovered the existing marker without another comment POST, and subsequent label/comment execution made no additional requests. The issue was then closed, while worker execution, review, publication, force-push, and merge remained disabled by repository policy.

M2-L — Linux deployment foundation — `DONE`

Unprivileged Linux container and locked service account.
Immutable application releases separated from credentials, databases, and workspaces.
Narrow systemd write authority, health verification, and rollback support.
Host-native Codex and Copilot OAuth; refreshable credentials are never cloned between machines.

M3 — One-click single-repository fixes — `DONE`

Explicit Go fix this authorization with owner and version checks.
Disposable Git worktree and private sandbox home per attempt.
Repository-declared preparation command and required quality gates.
Schema-validated Codex implementation plans and results.
Trusted patch computation, protected-path enforcement, size limits, and unchanged-HEAD checks.
Durable plans, logs, gate results, patches, digests, and failure evidence.

M4 — Independent review and draft PR publication — `DONE`

Automatic fresh-context Copilot review over an immutable, read-only repository snapshot.
At most one bounded Codex remediation round followed by a new independent verdict.
Durable findings, verdicts, evidence, publication intent, and required-check state.
Exact-patch-bound, draft-only publication with deterministic Git objects and no force push.
Five-lane operator board with card actions, evidence details, and documented lane criteria.
Bounded authenticated-operator identity chip in the board header without exposing immutable IDs, roles, or session metadata.
Enable publication for one explicitly authorized non-test repository.
Live-prove draft branch/PR creation and observe required GitHub checks; human review and merge remain mandatory.

Acceptance target: frostyard/frostyard-org snapshots its immutable repository identity, runs npm ci before execution, requires npm run ci, sends successful patches through automatic fresh-context review, and may publish only generated non-force draft branches. Cloudflare's Workers Builds: frostyard-org check is required before handoff. Automation/deployment configuration is protected, and Bobsled retains no merge or deployment capability.

Live acceptance evidence: Bobsled triaged, implemented, gated, independently approved, and published frostyard-org PR #6 as a draft. The required Cloudflare Workers build passed, and a human merged the PR. A second approved change was correctly blocked when main advanced beyond its reviewed base; after the enrolled source was refreshed and the task rerun, Bobsled published frostyard-org PR #7, whose required Cloudflare check also passed.

Post-acceptance hardening:

Reconcile an externally closed or merged draft PR into durable publication and board state through the authenticated Refresh status action; closed PRs remain refreshable so reopening returns them to the correct delivery/check state.
When main advances cleanly after approval, reapply and revalidate the exact approved patch on the new base without another implementation-worker call; fail closed on conflicts or unverifiable context drift.
- Persist a principal-scoped superseding replay, authenticate the old patch and new base, reapply it in a fresh worktree, and rerun current preparation/gates with zero model calls.
- Run one fresh read-only adversarial review against the new repository snapshot, then promote only approved replay evidence into a new immutable publication intent.
- Add authenticated operator orchestration and board evidence for replay, fresh review, and promotion before live use.
- Retain an immutable zero-call supersession decision when a later human-merged publication already delivered the task and exact replay conflicts.

Live recovery evidence: the retained canonical/Open Graph publication entered the authenticated replay path after PR #44 deployment. Its first attempt correctly blocked because the trusted checkout was stale; after a clean fast-forward, a superseding replay authenticated the patch and current base, then retained an exact conflict in src/layouts/Site.astro with zero model calls. Website PR #7 had already delivered the same task with a different local identifier spelling, so no fresh review or duplicate recovered PR was authorized. Migration 25 records the explicit immutable supersession by that later merged publication instead of leaving the obsolete card permanently actionable.

M4-R — Standalone public repository preparation — `DONE`

Move live credentials, databases, and disposable workspaces outside the source tree.
Preserve private deployment/run history outside the public repository.
Generalize public deployment documentation and remove private identifiers.
Add project metadata, license, placeholder configuration, security/contribution guidance, and CI.
Harden ignore rules and add automated secret scanning.
Initialize Bobsled as a standalone Git repository.
Inspect the exact first-commit candidate and verify tests, build, package contents, dependencies, and secrets before publication.

Readiness criterion: the repository contains only intentional public source, tests, templates, and generalized documentation. No credential, runtime database, embedded checkout, private infrastructure identifier, or private operational evidence is present in its first commit or history.

Readiness evidence: local credentials and runtime state resolve outside the repository, tests use an isolated temporary runtime, both subscription credentials remain readable through the protected external store, all 80 deterministic tests pass on the minimum supported Node release, type checking and the production build pass, the package candidate is bounded, the production dependency audit reports no known vulnerabilities, and Gitleaks reports no leaks. CI repeats verification across supported Node lines and scans complete Git history. The public repository is frostyard/bobsled; its first push passed every CI job and contained no forbidden sensitive path.

M5 — Multi-worker plans — `DONE`

M5 DAG-contract evidence: version 1 remains readable and bounds task content/count, requires stable IDs and acceptance criteria, and rejects duplicate IDs/edges, missing targets, self-dependencies, and cycles. Version 2 adds literal file, directory-subtree, or repository-wide ownership; rejects ambiguous paths and redundant scopes; and permits overlap only when a transitive dependency orders the tasks. The deterministic readiness projection preserves declared order and explicitly grants no execution authority, fan-out, workspace lease, retry, or token spend. A separate typed disposition binds trusted Git changed paths to one version 2 task: exact file and directory-subtree ownership is enforced, invalid, duplicate, and outside-scope paths remain visible as deterministic violations, and unknown tasks or over-broad input fail closed. Integration assembly recomputes that scope authorization for the complete transitive prerequisite set, requires one base commit, and emits a deterministic topological patch stack only when no evidence is missing, duplicated, unrelated, mismatched, or out of scope. A bounded workspace service verifies payload identity and SHA-256 digests before mutation, applies the complete stack to a detached worktree, preserves explicit no-change prerequisites, recomputes actual paths and combined patch evidence, and blocks on conflicts without granting a worker call. A separate deterministic recovery strategy replays only a patch-rejected stack with Git three-way application in a new UUID-addressed worktree; it preserves the original failed workspace, records resolved output or exact unmerged paths under principal-scoped lineage, and makes zero model calls. Successful Git resolution is re-inspected against its base, staged digest, and clean worktree before a new immutable assembly identity can be promoted; failed inspections remain retryable as explicit superseding attempts, while one successful promotion may feed the existing invocation path. True conflicts may now reserve a principal-scoped agent invocation only from durable unresolved_conflict evidence. Migration 17 permits abandoned pre-dispatch attempts to be superseded but enforces one model-bearing claim per source resolution across processes; an ambiguous or failed claimed call consumes the allowance and cannot retry. Migration 18 retains a preparation-and-replay preflight before that claim: new three-way results authenticate the complete ordered patch manifest, the preflight reads only bounded regular evidence files with matching SHA-256 digests, creates a fresh detached worktree, runs the snapshotted repository preparation command, requires a clean unchanged base, and reproduces the exact applied prefix, failed task, and unmerged paths. Historical results without the manifest, tampered files, policy denial, preparation failure or mutation, and any replay drift block with zero model calls. Migration 19 attaches one native Pi/Codex conflict call to that passing preflight. The worker receives repository-wide read context but may edit and stage only the exact unmerged paths; trusted code revalidates replay state before claim, rejects moved HEAD, unresolved entries, non-conflict changes, duplicate or false path reports, unstaged files, marker residue, changed patch evidence, policy limits, and protected paths, then applies the authenticated remaining stack without another model call. Completed receipts, blocked dispositions, failures, and the promoted-compatible resolution are committed under the one-use lineage. Concurrent observers never duplicate the call, and expired ambiguity is terminal. This internal service still has no direct operator control, retry, fan-out, or GitHub capability. A native Pi/Codex integration runner separately makes one call per dependency-bearing task and requires prerequisite changes to remain staged while adding only unstaged task-scoped edits. Trusted disposition rejects moved HEAD, changed index digest, scope escapes, false path/disposition claims, inconsistent final paths or digests, aggregate size-limit breaches, and protected paths, and authorizes no follow-up. A principal-scoped one-use lease binds that invocation to its durable job, plan, and direct-or-promoted assembly parents. The snapshotted repository preparation command is serialized and recorded before preflight; failed, timed-out, or ambiguously interrupted preparation blocks with zero worker calls. Trusted preflight then derives the live workspace from durable lineage and requires the original HEAD, exact staged prerequisite digest, and no unstaged or untracked paths. The orchestration service reconstructs model input only from durable parentage, preserves the bounded native Codex receipt, inspects tracked and untracked output, stores trusted disposition, and continues successful work into required gates. After every gate sequence, a second trusted Git inspection rechecks HEAD, prerequisite index, worker paths, aggregate paths, limits, protected boundaries, and final patch digest; even all-passing gates cannot settle success if they altered the deliverable. Concurrent observers do not duplicate preparation or disturb an in-flight worker call; expired ambiguous claims fail without retry. Direct invocation controls, retry, and dispatching fan-out remain disabled.

Migration 20 adds the dormant factory budget boundary. New repository snapshots declare whether multi-worker execution is enabled plus maximum concurrent workspace attempts, total attempts, zero-call pre-dispatch retries per task, elapsed wall-clock runtime, and provider-specific Codex/Copilot calls. A plan snapshots that policy into one durable budget before any attempt may start. Immediate SQLite write transactions atomically reserve concurrency and retry slots across processes; a separate dispatch claim consumes the provider allowance immediately before Pi submission. Only a terminal pre-dispatch failure with zero model calls may retry. Once a model call is claimed—or its outcome is ambiguous—the task cannot retry. Current repository policies keep this capability disabled, and no scheduler, fan-out, UI action, or additional model call is introduced by this migration.

The dependency-ready scheduler now projects the immutable plan and budget ledger into deterministic task states. It reserves roots and newly unblocked descendants in declared order up to the snapshotted concurrency limit, propagates terminal prerequisite failures transitively, and permits only same-provider retries after durable zero-call pre-dispatch failures. Deterministic attempt identities plus an atomic newlyReserved result prevent idempotent cross-process replay from authorizing duplicate workspace creation. The scheduler selects the native Codex provider internally and always reports executionAuthorized: false and modelDispatchAuthorized: false; it creates no workspace, makes no model call, exposes no HTTP/UI action, and remains inert under the current disabled repository policies.

The authenticated operator board now joins each run through its owned job to the latest immutable multi-worker plan and read-only budget ledger. Cards show active workers, task completion, attempts, provider-call use, deadline, dependency blocks, and exhausted-budget reasons; active work projects into Working, while terminal exhaustion projects into Attention. The projection opens a short-lived read-only SQLite connection, never calls the scheduler, never reserves an attempt or provider slot, and always reports execution and dispatch authorization as false. Historical plan snapshots without multi-worker policy fail closed instead of blanking the board. Current repository policies still keep actual fan-out disabled.

M6 — Multi-repository change sets — `DONE`

Add a typed repository dependency graph and cross-repository change-set record.
Plan version/API compatibility and rollout order across repositories.
Maintain one isolated job, policy snapshot, gate set, branch, and PR per repository.
Bind all completed member evidence into a human-readable compatibility and rollout/rollback plan.
Authorize an exact repository-declared compatibility gate set for that immutable plan.
Execute cross-repository compatibility verification against that immutable plan.
Publish linked draft PRs only after every required repository reaches a publishable state.
Expose partial failure, retry, supersession, and rollback explicitly.

M6 contract evidence: version 1 bounds a change set to 2–16 distinct repositories, with one repository-scoped objective and acceptance-criteria set per participant. Dependencies use the shared deterministic DAG implementation, reject duplicate/missing/self/cyclic edges, and require exactly one typed compatibility contract for each direct dependency. Compatibility contracts classify API, schema, artifact, runtime, or documentation expectations and carry explicit verification criteria. Dependency-first layers preserve declared repository order. Readiness then verifies enabled enrollment and requires every participating repository pair—not only directly connected dependencies—to mutually allow coordination through multiRepo.coordinateWith. Violations remain typed evidence. Even a fully allowed plan explicitly grants no workspace, model-call, branch, publication, rollout, or merge authority.

Migration 26 adds that durable parentage without enabling execution. An idempotent, principal-scoped change-set row stores the canonical version-1 plan and digest. Each member receives one deterministic ledger run/job whose work item is derived from that repository's bounded objective and acceptance criteria; the run/job is deliberately admitted blocked, with zero attempts, because coordinated execution is not implemented. The member row duplicates and hashes its exact plan unit and immutable repository policy snapshot while referencing the original run/job. Every read recomputes the plan, unit, and policy digests and cross-checks the ledger owner, repository, and snapshot. Generic single-repository override, cancel, and supersede transitions reject linked member runs; future recovery must be an explicit coordinated action. Policy denial occurs before job creation; interrupted pre-parent admission reuses deterministic local job identities; changed idempotency input, duplicate plan parents, cross-principal reads, or tampered evidence fail closed. Current repository coordination allowlists remain empty, so production admission is dormant. No workspace, model call, gate, branch, publication, rollout, or merge authority is added.

Migration 27 adds the first explicit coordinated transition without making individual member jobs executable. One immutable, principal-scoped authorization binds the exact ordered member IDs, run/job IDs, unit digests, policy-snapshot digests, and plan digest. Admission rechecks current enabled enrollment and mutual pairwise coordination consent, then uses one immediate transaction to require every ledger parent to remain blocked with zero attempts, reviews, or artifacts before recording the decision. Exact replay converges across processes; competing decisions, changed idempotency input, revoked consent, cross-principal access, member-state drift, or stored evidence tampering fail closed. Unrelated current repository metadata does not invalidate the decision because later workspace/execution boundaries must independently revalidate their own current policy. Member runs remain blocked, generic single-repository transitions remain denied, and the authorization reports workspace, model-dispatch, and publication authority as false. Production coordination allowlists are still empty, so the path remains dormant.

Migration 28 adds that first execution-policy revalidation without granting execution. One principal-scoped, idempotent schedule rechecks current mutual consent, code-write capability, execution enablement, and required-gate references for every authorized repository. It snapshots each complete current repository contract under a fresh digest while retaining the original job policy as immutable admission history. Trusted dependency layers mark initial roots eligible and later repositories waiting; these states never mutate and grant no lease, so later orchestration must recompute readiness from durable prerequisite completion. The schedule is recorded in one immediate transaction only while every member run/job remains blocked with zero attempts, reviews, or artifacts. Exact replay converges across processes; competing schedules, changed input, policy denial, member drift, cross-principal access, or stored layer/member/policy tampering fails closed. Current coordination allowlists remain empty, and all member runs stay blocked with preparation, dispatch, publication, rollout, and merge authority false.

Migration 29 adds one expiring, principal-scoped member preparation lease per immutable schedule member and permits only one reserved member per change set schedule. Roots may reserve immediately; dependents require each direct prerequisite to have a succeeded run/job, a succeeded current attempt, and an approved review when the prerequisite's scheduled policy requires one. Reservation rechecks current mutual coordination, code-write capability, execution enablement, and required gates; snapshots the complete current target policy; derives expiry from the declared preparation timeout; and atomically requires the target member to remain blocked with zero attempts, reviews, or artifacts. Exact replay converges across processes. Premature dependencies, competing leases, policy denial, member drift, ownership mismatch, or stored evidence tampering fail closed. This is workspace-preparation authority only: it creates no workspace, runs no command, unblocks no member job, spends no subscription call, and grants no execution, GitHub, publication, rollout, or merge authority. Current production allowlists keep it dormant.

Migration 30 consumes that lease in a fresh detached worktree rooted beneath Bobsled's durable workspace directory. The source checkout must resolve beneath the trusted repository source root and be its Git top level; the member base is the snapshotted policy's local default-branch commit. Bobsled runs only the trusted snapshotted preparation command with the existing credential-free bounded command runner, then requires HEAD and all tracked/untracked paths to remain clean. Success records the base, workspace, preparation result, and zero-authority flags as one immutable prepared result. Missing sources, workspace collisions, command failure/timeout, changed files, moved HEAD, and inspection failures become bounded blocked evidence. An expired reservation creates no workspace, and an expired ambiguous preparation is failed closed without rerunning its command. Cross-process claim/settlement and stored result digests prevent duplicate commands or evidence replacement. Prepared work still cannot dispatch a model or mutate its blocked ledger job; an explicit execution transition remains required. Current production allowlists keep the path dormant.

Migration 31 adds a principal-scoped execution-preflight reservation for one successfully prepared member. It revalidates current mutual coordination and requires the current repository policy to exactly match the preparation snapshot, binds the preparation-result digest, base commit, workspace, and evidence paths, and atomically requires the member run/job to remain blocked with zero attempts, reviews, or artifacts. Exact replay converges across database connections; competing reservations, policy drift, changed ledger parentage, or stored evidence tampering fail closed. The reservation authorizes only a future trusted preflight. It creates no attempt, invokes no model, and grants no implementation, review, GitHub, publication, rollout, or merge authority.

Migration 32 re-inspects the exact prepared Git worktree immediately before provider submission. Passing evidence requires the worktree root, HEAD, index, tracked files, and untracked files to remain clean at the reserved base. One immediate transaction persists the preflight, creates attempt 1, moves the member run/job to active/running, records the coordinated approval/audit trail, and consumes the reservation's sole worker-call claim. Concurrent callers converge on the same attempt and cannot receive a second claim. Dirty, unreadable, mismatched, or changed parentage records a terminal zero-call block or fails closed; running reads independently verify the attempt ID, number, status, start time, and run/job state. The claim is internal and dormant under current empty coordination allowlists; no HTTP/UI action or worker orchestration is added yet, and GitHub, publication, rollout, and merge remain unauthorized.

Migration 33 consumes a newly claimed member attempt through the existing native Codex implementation, trusted Git evidence, and repository-gate pipeline without recreating its already prepared workspace or rerunning preparation. The reusable execution runner rechecks the trusted root, base HEAD, and clean status immediately before dispatch, stores artifacts under the change-set member lineage, and settles the shared run/job/attempt exactly once. A separate atomic reconciliation marks the reservation terminal and consumes its preparation lease; a restart between ledger completion and reconciliation converges without a second model call. Policy-required automatic review resolves the preserved workspace and evidence from the attempt outcome rather than a legacy directory convention. Concurrent callers, terminal replay, post-preflight tampering, worker/gate failure, and review races remain fail closed. This service is internal; it adds no HTTP/UI action, GitHub mutation, publication, rollout, or merge authority.

Migration 34 adds the all-member barrier before compatibility verification. One principal-scoped, idempotent plan may be admitted only after every scheduled run/job/current attempt has succeeded, every changed member with review enabled has exactly one approved review, and a trusted draft or reviewed-patch artifact digest exists. Compatibility checks bind each declared contract to both participating patch digests. Rollout layers preserve the immutable dependency schedule; rollback reverses both layer and within-layer order. Reads reconstruct the complete expected result from parent contracts, schedule layers, and current trusted ledger artifacts, so a forged JSON/digest pair or later member-evidence drift fails closed. The plan explicitly grants no verification execution, GitHub mutation, publication, rollout, or merge authority.

Migration 35 makes compatibility shell authority a separate immutable decision. A dependent repository may declare bounded compatibility gates for an explicitly coordinated peer; IDs are unique, commands and timeouts are bounded, and the initial contract permits neither workspace mutation nor network access. Authorization rechecks current mutual enrollment plus exact compatibility-gate equality with the scheduled policy, then binds every plan contract to its dependent gate and both reviewed patch digests. Missing coverage, policy drift, competing admission, ownership mismatch, or even a schema-valid forged gate/digest pair fails closed. The record authorizes a later compatibility executor only; it runs no command, creates no workspace, dispatches no model, and grants no GitHub, publication, rollout, or merge authority.

Migration 36 consumes that authorization through a separate one-use execution record. Before claiming shell authority, it resolves each member's selected draft or approved-review artifact beneath the trusted workspace root, verifies the artifact bytes, base HEAD, live binary diff, and absence of unmerged paths against the immutable plan, then persists a digest-bound peer manifest. Gate starts are atomically counted in authorization order. The Linux runner creates fresh user, mount, PID, and network namespaces plus a minimal chroot, bind-mounts only /usr, selected device/proc files, the read-only tool cache, the manifest, and every authenticated member workspace, drops capabilities and enables no_new_privs, then executes with a scrubbed environment and bounded output/time. Only a private sandbox home remains writable. Trusted code rechecks every member patch after each command. A failure, timeout, runner error, mutation, ambiguous claimed process, ownership mismatch, replay, or evidence drift cannot start another command. Terminal evidence grants no model, GitHub, publication, rollout, or merge authority.

Migration 37 adds the all-member linked-publication barrier without performing publication. Admission requires one successful, violation-free compatibility execution and rechecks current mutual coordination plus draft-only, no-force publication capability for every participant. Every member must have a non-empty approved review whose outcome, review-bound artifact, base commit, workspace, and patch digest exactly match the immutable verification plan and compatibility manifest. The record snapshots each current publication policy and binds deterministic rollout and reverse rollback layers. Exact replay converges; a competing authorization, partial/no-change member, revoked policy, cross-principal access, or stored evidence drift fails closed. Passing the barrier still grants no branch creation, GitHub mutation, draft-PR execution, rollout, or merge authority; a later one-use executor must revalidate current policy and all bytes before any external side effect.

Migration 38 consumes that barrier through one immutable linked-publication execution. Before any GitHub mutation, it admits every member into the existing exact-patch publication outbox and binds the generated publication identity, approved review, patch digest, deterministic branch, durable marker, and dependency rollout layer into one preflight manifest. Any non-pending intent blocks the whole execution with zero new external side effects. One atomic claim then grants the sole dependency-ordered rollout process; each member start is counted before invoking the existing draft-only, no-force publication service. Execution stops at the first failure, never advances dependent repositories, and records immutable succeeded, partial, blocked, or failed evidence. Ambiguous running work cannot be retried automatically. The outbox continues to enforce current scoped GitHub authority, exact patch bytes, deterministic commits, and marker-based reconciliation. Merge and deployment remain unauthorized; explicit partial-failure retry, supersession, and rollback are still separate work.

Migration 39 makes the first recovery decision explicit without performing another side effect. A principal-scoped, idempotent plan admits only a terminal incomplete linked-publication execution, reuses its immutable member and rollout evidence, snapshots every current publication status and attempt count, and classifies retained drafts, retry candidates, pending descendants, already merged/closed external progress, and ambiguous in-flight work. Retry order preserves dependency rollout order. Human rollback guidance preserves the exact reverse rollback layers and links only pull requests that actually exist. External progress or ambiguity requires an operator decision; supersession always requires a new change set rather than rewriting the old execution. Reads rederive the result from the immutable parent plus the retained status snapshot, rejecting malformed or forged ordering/evidence. This plan grants no GitHub retry, close/revert, supersession, merge, or deployment authority. A separate one-use executor and explicit terminal decisions remain required before the final M6 checklist item can close.

Migration 40 closes the recovery boundary. A retry execution first requires every publication status, attempt count, pull identity, and URL to match the immutable plan snapshot. One atomic claim then retries only the dependency-ordered failed/pending suffix through the existing draft-publication outbox; retained drafts are never called again, every external start is counted first, concurrent observers cannot duplicate work, and ambiguous running execution never retries. Terminal evidence records success, partial progress, policy blockage, or failure while keeping merge and rollback authority false. A mutually exclusive decision record instead preserves exact reverse human rollback guidance or links the source to a distinct same-repository-set change set. Supersession never rewrites the old rollout; human rollback remains unexecuted guidance. Both decisions make zero model calls and zero GitHub mutations. M6 is complete without a merge, close, revert, or deployment API.

M7 — Conversational intake — `DONE`

Add durable, principal-owned intake conversations with bounded turns, idempotent submissions, optimistic concurrency, and explicit terminal states.
Pair the chat transcript with a live schema-validated brief containing the selected repository, objective, context, acceptance criteria, constraints, non-goals, assumptions, and unresolved questions.
Freeze each submitted brief as an immutable versioned snapshot with exact source-turn provenance and a canonical digest; corrections create a superseding snapshot instead of rewriting history.
Run fresh-context triage from the stored snapshot and persist the result against its exact digest; admission references trusted server-side records rather than browser-resubmitted work-item or triage content.
Keep repository selection, admission, execution, review recovery, and publication as separate explicit operator actions. The intake model receives no authority to select arbitrary repositories, mutate policy, dispatch workers, spend execution budgets, or perform GitHub writes.
Support manual prompts and GitHub issues as conversation seeds while treating all issue, repository, and user text as untrusted data. Any repository research remains bounded and read-only, with no shell, credential, network, or mutation capability.
Deliver the first slice for one enrolled repository. Multi-repository conversational planning remains deferred until a separate contract can map an operator-confirmed brief into the existing M6 authorization chain.

Acceptance target: an authenticated operator can refine one ambiguous request through chat, inspect the evolving structured brief, freeze an immutable intake snapshot, and submit it to independent triage. Repeated or concurrent submissions converge without duplicate model calls or admissions; a finalized conversation cannot alter its snapshot; and no chat action can create a run, workspace, provider claim, branch, or pull request without the existing downstream authorization step.

Migration 41 establishes the durable conversation envelope before adding inference. Each conversation is principal-owned and binds one explicitly selected enrolled repository, a bounded manual or GitHub-issue seed, and a version-1 brief covering objective, context, acceptance criteria, constraints, non-goals, assumptions, and unresolved questions. Turns retain their complete brief revision and digest in strict sequence. Creation and append operations are idempotent; append uses optimistic version checks across processes; repository switching, more than 100 turns, malformed/tampered evidence, cross-principal reads, and post-cancellation edits fail closed. Cancellation is terminal. Every projection explicitly denies model calls, run admission, and GitHub mutation. Flue-based proposal, immutable final snapshots, fresh triage, and UI actions remain separate later boundaries.

Migration 42 adds one durable model-backed revision at a time. Reservation atomically appends the operator message and binds its request digest, source version, repository, reason, and current brief. A separate compare-and-set claim consumes exactly one native Pi/Codex call. The schema-only agent has no sandbox or repository tools and can return only a revised version-1 brief plus an operator response. Trusted settlement preserves the immutable assistant turn, receipt, digest, and explicit zero run/GitHub authority. Concurrent claims converge; running ambiguity and caught failures cannot retry the claimed call; later corrections require a distinct idempotency key and explicit reservation. Manual turns and cancellation are blocked while a revision is active. Historical successful revisions remain independently verifiable after newer turns. Authenticated, same-origin API routes and the operator UI now create, resume, revise, inspect, and cancel these conversations from manual or GitHub-issue seeds. Read-only refreshes surface durable revision state but cannot reserve or dispatch work. Immutable final snapshots, fresh triage, and admission remain separate.

Migration 43 adds explicit, model-free finalization. One immediate transaction binds the principal, conversation, exact optimistic version, current brief, complete ordered source-turn manifest, reason, and canonical SHA-256 digests into a single immutable snapshot, then terminalizes the conversation. Exact idempotent replay converges across processes; changed keys or input, active revisions, competing snapshots, repository drift, and stored source/snapshot tampering fail closed. Authenticated same-origin routes and the UI expose finalization and read-only snapshot inspection. A finalized conversation cannot accept turns, cancellation, revisions, or a replacement snapshot. Corrections require a distinct future superseding conversation/snapshot boundary rather than evidence mutation. The snapshot explicitly grants zero triage, run-admission, model-call, execution, or GitHub authority; fresh-context triage remains separate.

Migration 44 adds one independent triage per immutable snapshot. Reservation binds the principal, snapshot ID and brief digest, operator intent, and a complete repository-policy snapshot without accepting brief or decision content from the browser. An immediate compare-and-set claim revalidates current triage policy and consumes exactly one native Pi/Codex call; policy drift becomes terminal zero-call blocked evidence that may be explicitly superseded after policy recovery. The fresh agent receives no transcript, repository tools, shell, credentials, or GitHub capability and can return only the existing typed triage decision. Success or model-bearing failure is immutable, ambiguity cannot retry, a partial unique index prevents a second claimed call, concurrent observers converge, and retained evidence is rederived against the original snapshot and policy digests. The UI can explicitly request, retry only a zero-call block, and inspect the decision, while refresh stays read-only. Run admission remains false and separate.

Migration 45 adds that separate admission boundary without another model call. A principal-scoped, idempotent record binds the immutable snapshot, successful triage result digest, complete repository-policy digest, original seed identity, and a deterministic work item derived from the finalized objective and structured brief. The browser submits no work item, decision, repository, or run payload. Immediately before normal ledger admission, trusted code requires the current repository contract to equal the triage snapshot. The ledger idempotency key is derived from the admission identity, so a crash after run creation but before lineage settlement recovers the same run rather than duplicating it. Retained reads rederive the work item and verify the linked run's owner, policy, task, and decision. Non-one-click triage enters the existing human-approval lane. Admission itself grants no execution, model, GitHub, publication, merge, or deployment authority.

Migration 46 makes correction a new immutable lineage rather than a mutation. An authenticated operator may start a principal-owned correction only from a fully verified finalized snapshot with no run-admission activity. The new active conversation inherits the authenticated source seed, repository, and frozen brief, while a separate digest-bound record retains the source conversation/snapshot and operator reason. A source may have only one active or finalized correction; a cancelled attempt may be explicitly replaced. Admission performs the inverse check in its own immediate transaction, so correction and run creation cannot race into competing truth. Exact replay converges, changed idempotency input, cross-principal access, repository drift, or retained source/link tampering fail closed, and the action grants no model call, triage, run, execution, or GitHub authority.

Live acceptance evidence: an authenticated operator revised and finalized a structured brief for frostyard/frostyard-org, ran independent snapshot-bound triage, explicitly admitted the resulting work, and followed it through implementation, repository gates, fresh adversarial review, stale-base recovery, draft publication, required Cloudflare checks, and human merge in frostyard-org PR #9. Follow-up hardening accepted concise approval notes, correlated pre-Flue activity, refreshed trusted source state safely, reconciled signed pull-request/check events, and added reversible archival for noisy terminal test runs. No conversational action bypassed the existing execution, review, publication, or human-merge boundaries.

M8 — Organization-scale operations — `ACTIVE`

Migration 47 replaces the source-code array as runtime enrollment authority. On first application only, it validates and copies the three previously reviewed declarations into a durable current registry plus append-only version-1 bootstrap events, then records the migration so deletion or disablement can never cause the declarations to be silently replayed. Every current record binds the immutable GitHub repository ID, complete validated policy JSON, canonical SHA-256 digest, optimistic version, actor, reason, and timestamp to its retained event. Policy changes use immediate transactions, idempotency keys, immutable identity checks, and compare-and-set versions across processes. Existing services retain one stable in-process array reference populated from SQLite so their policy lookups continue to observe deliberate registry refreshes; direct repository resolution reads the durable current record and fails closed on disabled or tampered evidence. The migration itself grants no browser mutation or GitHub authority.

The first M8 operator projection is observation-only. The authenticated Access surface uses a repository-ID-scoped metadata:read installation token to fetch each durably enrolled repository by immutable GitHub ID. Trusted code compares the response with the versioned repository contract and reports aligned, drifted, or bounded unavailable evidence for identity, canonical name, default branch, archived state, and disabled state. It exposes the current policy digest and selected capability flags without returning tokens, permission grants, numeric GitHub IDs, or raw upstream errors. The read creates no enrollment, policy, run, workspace, model, scheduling, or GitHub-write authority.

Operator-managed enrollment uses installation-wide metadata:read only to enumerate or re-fetch GitHub-owned identity. A confirmed enrollment then mints a separate token restricted to the candidate's immutable repository ID and contents:read, loads at most 100 KB from .bobsled/repository.json on GitHub's current default branch, and validates the version-1 declaration before appending registry state. The browser submits only repository ID, optimistic registry version, idempotency key, and operator reason; it cannot submit policy or immutable identity. Disablement appends a new version with enabled: false, immediately removes the repository from intake and token authority, and preserves all historical policy and run evidence. Re-enablement repeats the GitHub identity and policy fetch and appends another version; stale disabled authority is never restored implicitly. None of these actions creates work, calls a model, writes GitHub, merges, or deploys.

Migration 48 makes drift evidence explicit and durable. Loading Access reads only the latest retained observations. Check repository drift performs bounded, sequential metadata reads and atomically appends one observation per enabled repository, bound to its exact enrollment version and policy digest. Historical observations remain verifiable against their retained enrollment event. The projection separately reports open, non-archived runs whose immutable policy snapshot differs from current enrollment; it does not rewrite, cancel, retry, or silently upgrade those runs.

Live migration-48 acceptance found three policy-old website parents whose delivery was already terminal. The impact projection now follows operator-actionable lifecycle truth: merged or closed publications, explicitly resolved stale-publication supersessions, verified no-change outcomes, and archived runs are excluded without changing their retained evidence.

The first fleet dashboard is a side-effect-free projection over existing durable ledgers. It reports pending and active runs, attempts, reviews, and publications by repository; aggregates active multi-worker attempts and provider calls against the immutable budgets that authorized those plans; and exposes retained Flue event count, bytes, and oldest/newest timestamps. It states that organization concurrency is not configured and retention remains indefinite. The projection cannot reserve a slot, change policy, remove evidence, schedule work, or dispatch a model.

Migration 51 bounds the shared capacity claim without treating timeout as success or failure. Each claim expires two hours after the atomic provider transition, beyond every supported model-call timeout. An explicit principal-scoped, idempotent recovery batch may mark only expired active claims ambiguous, release their aggregate occupancy, and retain the operator, reason, cutoff, provider slots, and digest-bound result. The unique source identity remains permanently consumed, so ambiguity recovery cannot retry a call or alter its source workflow. Reads expose only aggregate expired and ambiguous counts, and enforcement remains disabled pending live conformance.

Live acceptance on the production Linux runtime held one Codex capacity slot around a real Flue triage submission, settled that submission successfully on its first attempt, and released the claim as legacy_triage.succeeded; no run or GitHub mutation was created. Migration 52 adds a separate append-only enforcement stream. Activation binds to one exact policy version and digest, refuses unresolved expired occupancy, and makes the shared claim transition reject atomically before provider dispatch when a configured workflow or provider ceiling is full. A later policy revision never silently changes enforcement: provider claims fail closed until an operator explicitly rebinds the new version or disables enforcement. No enforcement event exists by default, so deployment alone changes no admission behavior.

Current safety boundary

Public ingress is bounded by Frostyard GitHub operator authentication and verified webhooks; event-triggered dispatch remains disabled, and GitHub mutations require explicit enrolled policy plus the durable action outbox.
Repository policies and deterministic gates outrank model recommendations.
Models cannot select arbitrary repositories or mutate repository policy.
Raw Flue observations and verified webhook bodies are sensitive operational records and are not exposed through a content API.
No automated merge, release, branch-protection change, or quality-gate weakening.
Public ingress keeps its private Incus upstream as a rollback path; changing the host's live Ethernet topology is outside the application milestone.

Prime Directive — preserve optionality

Hard-stop credentials and irreversible or public side effects by default.
Treat model classifications as advice, not authorization or permanent vetoes.
Allow a human to override recoverable policy blocks with an explicit recorded reason.
Preserve cancelled and failed history; create a superseding run rather than rewriting evidence.
Surface missing capabilities before spending model tokens on impossible work.
Version policies and snapshot them per job so later improvements do not invalidate old evidence.
Prefer warnings and bounded continuation when the consequence is local and recoverable.

Navigation Menu

Uh oh!

Bobsled Factory Roadmap

Northstar

Milestones

M0 — Subscription-backed Flue runtime — `DONE`

M1 — Typed control plane and read-only triage — `DONE`

M2 — GitHub App and durable job ledger — `DONE`

M2-L — Linux deployment foundation — `DONE`

M3 — One-click single-repository fixes — `DONE`

M4 — Independent review and draft PR publication — `DONE`

M4-R — Standalone public repository preparation — `DONE`

M5 — Multi-worker plans — `DONE`

M6 — Multi-repository change sets — `DONE`

M7 — Conversational intake — `DONE`

M8 — Organization-scale operations — `ACTIVE`

Current safety boundary

Prime Directive — preserve optionality

Uh oh!

FilesExpand file tree

ROADMAP.md

Latest commit

History

ROADMAP.md

File metadata and controls

Bobsled Factory Roadmap

Northstar

Milestones

M0 — Subscription-backed Flue runtime — DONE

M1 — Typed control plane and read-only triage — DONE

M2 — GitHub App and durable job ledger — DONE

M2-L — Linux deployment foundation — DONE

M3 — One-click single-repository fixes — DONE

M4 — Independent review and draft PR publication — DONE

M4-R — Standalone public repository preparation — DONE

M5 — Multi-worker plans — DONE

M6 — Multi-repository change sets — DONE

M7 — Conversational intake — DONE

M8 — Organization-scale operations — ACTIVE

Current safety boundary

Prime Directive — preserve optionality

M0 — Subscription-backed Flue runtime — `DONE`

M1 — Typed control plane and read-only triage — `DONE`

M2 — GitHub App and durable job ledger — `DONE`

M2-L — Linux deployment foundation — `DONE`

M3 — One-click single-repository fixes — `DONE`

M4 — Independent review and draft PR publication — `DONE`

M4-R — Standalone public repository preparation — `DONE`

M5 — Multi-worker plans — `DONE`

M6 — Multi-repository change sets — `DONE`

M7 — Conversational intake — `DONE`

M8 — Organization-scale operations — `ACTIVE`