Adopt GitHub Issues as DaemonCraft task authority and retire the legacy Kanban

[nicoechaniz]

Context

DaemonCraft still has a legacy local Hermes Kanban board even though project task authority has moved to GitHub Issues.

The legacy board contains 136 non-terminal cards (80 todo, 55 blocked, 1 ready) plus 113 completed cards. Read-only reconciliation found that 48 active cards already had a completed ancestor and 78/136 were bulk-created on 2026-06-15, mostly duplicating completed or superseded work.

This is not a card-for-card migration. GitHub Issues represent only work that remains relevant after checking Git, current runtime state, tests, and the known-good lab behavior.

Migration policy

• GitHub Issues are the sole actionable task authority for repository-owned work.
• The legacy Kanban database is retained as historical evidence, not as a live tracker.
• Completed, obsolete, superseded, and abandoned cards are not recreated as Issues.
• Relevant historical card IDs may be cited for provenance, but stale statuses are not imported.
• The repository is public; no credentials, private infrastructure details, or sensitive local state belong in Issues.

Relevant workstreams retained

• Reconcile and preserve the dirty worktree before restarting DaemonCraft #22 — Reconcile and preserve the dirty worktree before restarting DaemonCraft.
• Restore the known-good interactive lab embodiment baseline #23 — Restore the known-good interactive lab embodiment baseline.
• Diagnose autonomous-mode context divergence and action thrash #24 — Diagnose autonomous-mode context divergence and action thrash.
• Reconcile the runtime cognition contract and retire dormant persistent-plan paths #28 — Reconcile the runtime cognition contract and retire dormant persistent-plan paths.

Acceptance criteria

• Retained workstreams exist as focused GitHub Issues with acceptance criteria and legacy provenance where useful.
• Every non-terminal legacy card is classified at theme level as implemented, obsolete/superseded, or retained in GitHub.
• The single legacy ready task is made non-dispatchable.
• All remaining non-terminal DaemonCraft Kanban cards are archived after the GitHub Issues are verified.
• README.md no longer presents Lattice or local Kanban as the current tracker.
• AGENTS.md documents GitHub Issues as task authority and the runtime safety contract.
• docs/INDEX.md treats MEMORY.md as historical and defaults to read-only preflight.
• The legacy Kanban SQLite database is preserved as read-only migration evidence.

Mechanical archival blocker

A verified SQLite backup exists. Archival through the official Hermes CLI is currently blocked because the session that performed the migration also launched read-only delegated auditors; Hermes correctly refuses Kanban mutations from delegation-marked contexts. Do not bypass this protection with direct SQL. Perform the archival once from a fresh, non-delegated parent session, then close this Issue.

Non-goals

• Reopening every historical idea.
• Recreating auto-decomposed child cards as Issues.
• Deleting project memory, historical runtime evidence, or the legacy Kanban database.
• Starting DaemonCraft services as part of the tracker migration.

[nicoechaniz]

Legacy board reconciliation — 2026-08-27

Inventory source: read-only inspection of the per-board SQLite database plus current Git/code/runtime evidence.

Retained as GitHub work

GitHub Issue	Legacy provenance retained
#22 — dirty worktree reconciliation	t_813472c6 and related June dashboard/bot fragments, plus July runtime work that had no reliable live card
#23 — known-good lab baseline	t_4b04d67e, t_62d80cdb, and the useful baseline portion of t_8f57edca
#24 — autonomous context divergence	t_436909c6, t_813472c6, t_0e6f3f5e, and the autonomous portion of t_8f57edca

The GitHub Issues own the work now. Legacy status, assignee, decomposition, and completion claims were not copied.

Implemented in current Git/code — no new Issue

• Movement/pathfinder: velocity-based step-up prediction, recovery FSM, sprint policy, and related navigation work are present in commits including c66186d, b17a5e8, e551e2a, 202e593, 3323906, and the current bot code.
• Body/reflex/interoception: Reactive Runner, BodyMutex integration, action registry, interoception endpoint, compact body activity, and judge plumbing are present in b13ed0b, 634d3fe, 125bac5, and current agent_loop.py/server.js.
• Perception/mBit: visual CJK mapping, typed outcomes, enriched navigation, and visualizers are present in 7e9bf59, 3defe4a, 4c8c92f, 4467fa8, b553d87, 0344a31, and current code.
• Singleton stream/event bridge: context stream and event queue exist in 4f6dc3b, 8fa952e, and current agent_loop.py.
• Controller/lab infrastructure: lab default and controller persistence exist in 23f69ff and 7ca483a; the unsafe persisted autonomous value is handled by Restore the known-good interactive lab embodiment baseline #23.
• Embodied Qwen support: present in ec42c22, a811a15, and the embodied service configuration.

Obsolete or superseded — preserved only as history

• Auto-generated profile/tool injection cards (scan_nearby, push_tick, per-profile YAML tool definitions) are superseded by native Hermes platform_toolsets.daemoncraft and registered Minecraft tools.
• Old wake_steve, Steve-timonea, and canonical-loop decomposition trees are not the current CompAII lab/autonomous architecture.
• Quest engine, persistent plan, and save/load-plan experiments are outside the restored baseline and have no current owner or runtime acceptance target.
• Reusable skill-packaging and setup-script cards are premature; no current work requires publishing a separate embodiment package.
• Dashboard redesign, steered-message panels, and old observability decomposition are not migrated. Any salvageable uncommitted code is reviewed only through Reconcile and preserve the dirty worktree before restarting DaemonCraft #22.
• Per-primitive and auto-decomposed test matrices are collapsed into the focused lab baseline (Restore the known-good interactive lab embodiment baseline #23) and autonomous A/B investigation (Diagnose autonomous-mode context divergence and action thrash #24).
• Historical cards claiming the anti-loop problem was fully solved are superseded by current operator evidence that autonomous mode remains dysfunctional.

Retirement action

After verifying Issues #21–#24 and backing up the board database, all 136 non-terminal legacy cards will be archived. The SQLite database remains preserved as migration evidence and will not be used as an actionable tracker.

[nicoechaniz]

Security fix

The public repository used a literal RCON password as both a Compose fallback and a documentation/example value. Because Git history is public, removing the string alone cannot make that credential secret.

This change:

• requires RCON_PASSWORD explicitly through the root .env
• makes Compose fail closed when it is absent
• guarantees Minecraft and mc-backup receive the same resolved value
• replaces tracked documentation and example credentials with environment-variable usage
• changes .env.example to a non-secret placeholder

Runtime rotation

The stopped local stack was rotated to a new 48-character random secret before publication. The root .env is ignored and mode 0600; the ignored server/data/server.properties value matches it. No secret value is included in this PR.

Verification

• no tracked file at this head contains the published default
• runtime .env and server.properties values match, are non-default, and are 48 characters
• rendered Compose configuration gives the same non-default value to minecraft and mc-backup
• docker compose config --format json succeeds
• git diff --check succeeds

The DaemonCraft stack remained stopped throughout the rotation.