plan(harness): beta-11 shipping wave — milestone-13 supervisor run (Plan & Design)

.llm/runs/beta10-cli--orchestrator/context-pack.md

@@ -0,0 +1,46 @@
+# Context pack — beta10-cli--orchestrator (resumable)
+
+Updated 2026-07-16. Orchestrator: Claude · Fable 5 · low, session_017LHrkXyMzsQwb9bqr82EFK.
+
+## State
+
+- **p0 #769/#763**: PR **#770** verified merge-ready (unit tests green, guard proven-fail, E2E 42/1
+  with the 1 failure attributed pre-existing → **#785**). Label status:ready-merge. **GO
+  recommended; merge awaits owner sign-off.** Note: #770 closes #763; the full #769 fix (agent-init
+  pins, templates, repo-wide CI guard) already sits on the #715 umbrella branch tip 8d991890.
+- **#715 umbrella (epic #721)**: S1–S9 + NF1 + #769-F4 all on `feat/netscript-mcp-skills`;
+  IMPL-EVAL cycle-2 PASS; CI fully green at head. Kickoff's "stand up S1" was stale (drift.md).
+  Next: merge-readiness confirmation to owner.
+- **New**: #785 workers health-check job fails `error:"Not Found"` on integration branch (E2E gate
+  `behavior.workers-executions`); candidate next Codex slice.
+- **Codex remote**: repaired (remote-control connected, daemon 0.144.4); `agentic:runtime doctor`
+  healthy. Tier-D launches unblocked.
+- **Stabilization backlog**: #763 (closed by #770 when merged), #762 (PR #772), #774, #773, #781,
+  #782, #783 — not yet started this session.
+
+## Holds
+
+- Merge/publish/release/issue-close all held for explicit owner sign-off over Remote Control.
+
+## Update 2026-07-16 (late)
+
+- PR #770 MERGED (bab5425b). #785 fixed via Codex slice → PR #786, IMPL-EVAL **PASS**,
+  status:ready-merge, merge held (draft flag still set). SCO service removed from host; port 3001
+  free. Codex remote healthy. Pending owner: merge #786, posture on #715→main. Next backlog:
+  #772 (#762 sweep), #774 CI gap, #773, #781, #782, #783.
+
+## Update 2026-07-17 (overnight complete pending #800 CI)
+
+Milestone 12: all slices merged (17 evaluated PRs). Open issues remaining will auto-close on #800
+merge (Closes block); #769/#721 closed with evidence; #775/#778 → beta.13. Release PR **#800**
+open, awaiting combined-tree CI; on green it gets status:ready-merge and the session stops per the
+owner stop-line (no #800 merge, no release cut tonight). Morning runbook: merge #800 → close
+milestone 12 → netscript-release cut → publish → e2e-cli-prod verification.
+
+## FINAL 2026-07-17 — beta.10 SHIPPED
+
+v0.0.1-beta.10 complete: both completion gates green (publish + artifact-pinned prod E2E).
+35 packages live incl. @netscript/mcp first publish. Recovery patterns proven this release:
+same-semver republish (tag fast-forward), min-dep-age pinning, live pre-publish validation.
+Upstream: jsr-io/jsr#1478 filed w/ 2-line fix. In flight: #812 canary eval; skill-codification
+docs slice. beta.11 docs track: #814→#815→#816.

.llm/runs/beta10-cli--orchestrator/drift.md

@@ -0,0 +1,18 @@
+# Drift — beta10-cli--orchestrator (append-only)
+
+- 2026-07-16 · **moderate** · Codex remote degraded at bootstrap: `agentic:runtime doctor` reports
+  `codex-app-server` PROBE_FAILED + MOBILE_DISCONNECTED; `repair codex-remote` refuses (active
+  sessions/child commands observed → unmanaged state it won't interrupt). Tier-D
+  (`launch-codex-slice`) launches blocked until recovered per `codex-wsl-remote` skill or owner
+  guidance. Orchestrator continues with p0 #770 verification (non-implementation work) meanwhile.
+- 2026-07-16 · **minor** · Kickoff drift: (a) PR #770 closes **#763**, not #769 — the #769 fix
+  (agent-init pins, template pins, repo-wide guard) is already merged into the #715 umbrella branch
+  `feat/netscript-mcp-skills` (commits f0850532 + 6976a3f6, tip 8d991890, incl. NF1 fix 8b09ebb6).
+  (b) "Stand up S1 #725" is stale — S1–S9 are implemented on that branch with IMPL-EVAL cycle-2
+  PASS. Task re-scoped to #715 merge-readiness confirmation.
+- 2026-07-16 · **minor** · #774 slice: implementation lane self-arranged its full eval chain
+  (PLAN-EVAL aa9cc799, slice-review c8f83551, IMPL-EVAL 319e284e — Opus 4.8, properly separated and
+  family-correct). Contract says the supervisor chooses when to trigger evaluators; verdicts were
+  consistent with the official supervisor-dispatched eval, so accepted as supplementary evidence
+  only. Candidate lesson for `.llm/harness/lessons/`: define whether generator-arranged evals are
+  ever authorizing.

.llm/runs/beta10-cli--orchestrator/kickoff.md

@@ -0,0 +1,74 @@
+# Kickoff — beta.10 CLI + stabilization orchestrator (your first turn)
+
+use harness
+
+## SKILL
+
+- netscript-harness
+- netscript-cli
+- netscript-tools
+- netscript-deno-toolchain
+- netscript-pr
+
+You are the **beta.10 orchestrator** for NetScript milestone 12. Fable 5 is restored as the default
+orchestrator (PR #784, merged). You are `planning_decisions` = **Claude · Fable 5 · low**. You
+**coordinate; you do not implement** — framework source is WSL Codex, driven through the agentic
+suite; evaluation is a separate opposite-family session.
+
+Read, in order, before acting:
+
+1. `AGENTS.md` + `CLAUDE.md`
+2. `.agents/skills/netscript-harness/SKILL.md`, then `.llm/harness/workflow/activation.md` +
+   `run-loop.md`
+3. `.llm/harness/workflow/lane-policy.md` — the routing you enforce (Fable 5 restored 2026-07-16)
+4. `.llm/runs/beta10-cli--orchestrator/supervisor.md` — your identity, routing, and scope
+
+## Mission
+
+Land **beta.10 = complete CLI coverage + bugfixes/stabilization**. The **Dev Dashboard is PAUSED**
+and moved to `0.0.1-beta.13` — do not touch dashboard issues (#400/#410–#557/#734) or the parked
+dashboard PRs (#780/#778/#775).
+
+Scope, priority order:
+
+1. **#769 (p0 release-blocker)** — `netscript agent init` writes an unversioned `jsr:@netscript/cli`
+   MCP config that cannot resolve. Fix is on **PR #770**. Verify it, run the CLI E2E gate, drive to
+   merge-ready, and surface the go/no-go to the owner.
+2. **Stabilization** — #763 (prod scaffold AI lifecycle fail), #762 (repo-wide ts-ignore sweep →
+   CI-blocking, PR #772), #774 (integration-branch CI gap), #773 (`render_ui` recursion hole), #781
+   (beta.9 Aspire generator regressions), #782 (Preact Windows dedupe), #783 (fresh-ui markdown
+   render).
+3. **Epic #721 agentic-combo CLI** — S1–S9 = #725–#733 (packages/mcp skeleton → docs tools →
+   telemetry/trace tools → doctor aggregation → CLI trigger tools → `netscript agent mcp`/`init` →
+   public skills → docs/JSR audit). Umbrella PR #715.
+
+## How you operate (mandatory)
+
+- Everything runs on the **epic #574 agentic runtime**. Drive Codex/OpenHands/PR lifecycle **only**
+  through `deno task agentic:*` — `agentic:launch-codex-slice`, `agentic:codex-resume/status/watch`,
+  `agentic:gh-pr`, `agentic:gh-watch`, `agentic:dispatch-openhands`, `agentic:runtime`. **Never**
+  ad-hoc `wsl.exe`/PowerShell.
+- **Route every lane from `lane-policy.md`.** You = Fable 5 low. Implementation = Codex Sol
+  medium/high via `launch-codex-slice`. Adversarial review of Codex work = Fable, opposite-family,
+  effort-paired. Record requested-vs-observed identity in `worklog.md`.
+- Every slice brief you write starts with `use harness` and a `## SKILL` section.
+- **Gate law**: any `packages/**`/`plugins/**` slice runs `deno task quality:gate`; merge-readiness
+  runs `deno task e2e:cli run scaffold.runtime --cleanup --format pretty`.
+- Use `.llm/tools/harness/watch-run.ts <run-dir>` (background) for token-free supervisor wake; do not
+  poll.
+- **Owner ratifies promotion.** Run autonomously through implementation → PR → evaluation → green CI,
+  but **hold merge / publish / release / issue-close for explicit owner sign-off** over Remote
+  Control.
+
+## First actions
+
+1. Bootstrap: read the files above; write the live fields in `supervisor.md` (your session id) and a
+   `## Design` section in `worklog.md`; run `deno task agentic:runtime doctor` to confirm the Codex
+   remote is healthy. Record route identity.
+2. **p0 first**: pull **PR #770**, verify the #769 fix, run `deno task e2e:cli run scaffold.runtime
+   --cleanup`, and report merge-readiness + your go/no-go recommendation to the owner.
+3. Stand up **agentic-combo S1 (#725, packages/mcp skeleton)** as a Codex slice via
+   `agentic:launch-codex-slice`, and dispatch its opposite-family evaluation.
+
+Report status to the owner (me) over Remote Control and pause for sign-off before any
+merge/publish/release.

.llm/runs/beta10-cli--orchestrator/launch-orch.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Launch the beta.10 CLI + stabilization orchestrator:
+# Fable 5 low · Remote Control ON · bypassPermissions · autonomous.
+# Started under tmux (daemon-attached native-WSL pattern). Runs in the worktree.
+cd /home/codex/repos/netscript-beta10-cli || exit 1
+exec claude \
+  --remote-control \
+  --remote-control-session-name-prefix beta10-cli \
+  --permission-mode bypassPermissions \
+  --model claude-fable-5 \
+  --effort low \
+  -n beta10-cli-orchestrator \
+  "use harness. Read .llm/runs/beta10-cli--orchestrator/kickoff.md and follow it verbatim as your operating brief for this entire session. It defines your identity (Fable 5 low orchestrator), scope (beta.10 CLI coverage + stabilization; dashboard is OUT of scope), and how to operate (drive all sub-agents through the .llm/tools/agentic suite; hold merge/publish for owner sign-off). Begin now with its First actions."

.llm/runs/beta10-cli--orchestrator/release-notes-beta10-intro.md

@@ -0,0 +1,23 @@
+NetScript 0.0.1-beta.10 completes the CLI story and hardens the framework end to end.
+
+**The agentic combo ships.** One binary, three faces: the new `@netscript/mcp` server, the public
+skill bundle (`netscript`, `netscript-build`, `netscript-operate`), and the CLI spine —
+`netscript agent mcp` serves the full tool surface over stdio, and `netscript agent init` wires
+your agent host (Claude Code, VS Code, or both) with a versioned, working configuration in one
+command.
+
+**Complete CLI coverage, documented.** Every command group now has a verified reference derived
+from the live command tree, and the tutorials use the CLI verbs instead of manual steps.
+
+**Stabilization across the stack.** JSR specifiers emitted by the framework are always pinned on
+the pre-release line (with a CI guard that keeps it that way); the scaffolded workers runtime
+executes its jobs correctly; Fresh production builds are deterministic on clean machines and
+correct on Windows; markdown rendering moved onto the Preact JSX runtime (dropping the React
+compatibility layer, ~12% smaller island bundles); and the Aspire generator emits valid
+capabilities, environment values, and paths for every resource shape.
+
+**Honest CI.** Stacked-wave pull requests now run the full check, test, and quality lanes, with
+lane-visibility summaries, a blocking type-suppression drift gate, and generated-asset freshness
+checks — each new gate proven to fail before it was trusted.
+
+The Dev Dashboard remains paused and returns in a later beta.

.llm/runs/beta10-cli--orchestrator/slices/771-rebase/codex-thread-ids.md

@@ -0,0 +1,16 @@
+# b10-771rb — Codex implementation thread
+- **Thread / session id:** `019f6cf5-05dd-7230-b552-b32e4f577459`
+- **Rollout:** `/home/codex/.codex/sessions/2026/07/17/rollout-2026-07-17T00-03-45-019f6cf5-05dd-7230-b552-b32e4f577459.jsonl`
+- **Worktree:** `/home/codex/repos/b10-taglines`
+- **Branch:** `docs/jsr-tagline-byte-cap` (NO upstream by design).
+- **Push rule:** explicit refspec only — `git push origin HEAD:refs/heads/docs/jsr-tagline-byte-cap`.
+- **Requested route:** provider=openai · model=gpt-5.6-sol · effort=low
+- **Observed route:** provider=openai · model=gpt-5.6-sol · effort=low
+- **Route verdict:** matched
+- **Runtime:** approval=never · sandbox=dangerFullAccess
+- **Brief (staged):** `/home/codex/b10-771rb-brief.md`
+## Steering (same thread — never a second send-message-v2 at this worktree)
+```bash
+codex exec resume 019f6cf5-05dd-7230-b552-b32e4f577459 -- "<follow-up>"
+```
+_Written by `.llm/tools/agentic/codex/launch-codex-slice.ts`._

.llm/runs/beta10-cli--orchestrator/slices/771-rebase/evaluate.md

@@ -0,0 +1,92 @@
+# IMPL-EVAL — PR #771 reconcile slice (`771-rebase`)
+
+- **Phase:** IMPL-EVAL (final pass)
+- **Subject:** PR #771 `docs(jsr): fit package taglines in the 250-byte cap + gate it in CI`
+- **Worktree:** `/home/codex/repos/b10-taglines` @ `14a07686` (branch `docs/jsr-tagline-byte-cap`)
+- **Base:** `feat/beta10-integration` @ `3265b516`
+- **Route:** `review_codex_light` — Claude · Opus 4.8 · high (opposite-family review of a Codex/Sol·low reconcile slice)
+- **Skills:** netscript-harness, netscript-tools, rtk
+- **Evaluate-only:** no fixes / merges / labels; worktree unmodified.
+
+## Verdict: **PASS**
+
+Approved scope (fit 16 over-cap taglines in the 250-byte JSR cap, add a byte-accurate gate, wire it
+blocking, and reconcile with the advanced base without dropping intent) is complete. The gate is
+real and proven; the reconciled taglines fit after the formatter commit; nothing was dropped
+silently; no new suppressions; the PR's own validation re-runs green and the real-CI `quality` job
+(which now contains the gate) passed. The one red check (`check-test`) is a pre-existing, unrelated
+Fresh test failure not attributable to this docs slice (finding 8).
+
+## Evidence
+
+| Probe | Result | Evidence |
+| --- | --- | --- |
+| Gate real (fails on over-cap) | PASS | Out-of-worktree fixture run → `checked=3 over=2`, **EXIT=1**; em-dash fixture (279 chars / **359 bytes**) flagged → proves byte semantics, not char |
+| Gate byte-accuracy vs release tool | PASS (conservative) | `extractTagline` matches `jsr-set-package-settings.ts` para/skippable logic; `flattenMarkdown` diverges only in the over-counting direction (finding 2) |
+| Reconciled taglines fit (post-formatter) | PASS | `deno task docs:tagline:check` on HEAD → `checked=35 over=0`; max real JSR description = **249 B** (`plugins/streams`, pre-existing) |
+| Public wording clean | PASS | All 35 extracted taglines scanned — 0 internal markers; PR adds **0** `#NNN` refs (finding 4) |
+| Reconcile dropped nothing | PASS | `git merge-base --is-ancestor origin/feat/beta10-integration HEAD` = YES; ci.yml conflict preserved both steps; 16 READMEs fixed; `plugins/ai` real tagline present (155 B) |
+| No new suppressions | PASS | Full branch diff added-line scan for `deno-lint-ignore`/`ts-ignore`/`ts-expect-error`/`as any`/`as unknown as`/`quality-allow` → NONE |
+| PR validation re-run | PASS | `docs:tagline:check` 35/0; `docs:links` `docs=96 broken-links=0 broken-anchors=0 orphans=0`; `run-deno-check.ts --root .llm/tools/validation` → 8 files, 0 diagnostics |
+| Real CI on PR head | quality PASS | `quality` check-run (contains `JSR tagline length` step) = **success** on `14a07686` |
+
+## Findings
+
+1. **[confirmed] Gate is real and byte-accurate.** Fixture proof: two over-cap READMEs → exit 1;
+   the em-dash fixture is under 280 chars but 359 bytes and is correctly flagged, confirming the
+   gate measures JSR's Rust `String::len` byte cap, not character length. The `ok` fixture (48 B)
+   was not flagged.
+
+2. **[minor / non-blocking] Gate extractor is conservative vs the release tool.** The gate's
+   `flattenMarkdown` strips only `** * `` while the release tool
+   (`jsr-set-package-settings.ts`) also resolves `[text](url)→text`, strips `_`/`~`, and collapses
+   whitespace. Every divergence makes the gate **over-count**, so it can never let a truly over-cap
+   description through — sound for a truncation-prevention gate. In the actual 35-README corpus only
+   `packages/logger/README.md` diverges (gate 230 B vs real 206 B, both far under cap; a pre-existing
+   file outside this PR). No action required; noting for accuracy of the reported byte numbers.
+
+3. **[confirmed] Formatter commit `14a07686` is mechanical.** Re-wrapping occurs inside body
+   paragraphs after the tagline (verified on `packages/ai`, `plugins/ai`); the extraction boundary is
+   a blank line, which `deno fmt` does not move, so taglines are invariant. `over=0` holds on HEAD.
+
+4. **[confirmed] Public wording clean.** No tagline (the only text that reaches JSR) contains a
+   PR/issue number or internal-process term. The PR's README diff adds **zero** `#NNN` references
+   (pre-existing `#402`/`#313`/`#290` live in body Internals prose, are on the base, and never reach
+   the JSR description).
+
+5. **[confirmed] Nothing dropped in the reconcile.** Base is an ancestor of HEAD; the sole conflict
+   (`.github/workflows/ci.yml`) preserved both #771's blocking `JSR tagline length` step **and** the
+   base's `Generated asset freshness` step in the correct order. The reconcile comment's
+   "Dropped: nothing" is accurate and matched against the PR's stated intent.
+
+6. **[confirmed] Zero new suppressions** across the full branch diff.
+
+7. **[confirmed] Gate now runs in real CI.** The base merge pulled in #787
+   ("run real CI on integration-branch PRs"); the HEAD `pull_request` trigger is
+   `[main, "feat/**", "epic/**"]`, so the full `ci` workflow executed on this PR head and the
+   `quality` job (containing the tagline gate) is **green**. This supersedes comment-#1's
+   "these gates have not run in CI even once" caveat — now stale for #771.
+
+8. **[out-of-scope failure — not a slice defect] `check-test` is red on the PR head.** The failing
+   step is `Repo-wide test`; the single failure is
+   `generated Fresh Markdown island production-builds for hydration ... FAILED (28s)` (1989 passed /
+   1 failed / 12 ignored). This PR touches no Fresh, island, hydration, or markdown-build code (diff
+   = 16 READMEs + `check-jsr-tagline-length.ts` + `ci.yml`/`deno.json`/`deno.lock`), and a single
+   isolated Fresh esbuild-build failure is not plausibly caused by README byte-trimming. It is a
+   pre-existing/independent failure on the integration line and must be resolved at the
+   `feat/beta10-integration → main` gate — it does **not** block this docs slice's IMPL-EVAL.
+
+9. **[minor / nit] Unpinned `@std` specifiers in the gate.** The tool imports
+   `jsr:@std/fs/expand-glob` and `jsr:@std/path` unversioned; the lock gained
+   `jsr:@std/fs@*`→1.0.24 and `jsr:@std/path@*`→1.1.5. It is an internal `.llm/tools` script (not a
+   published surface), resolves, and runs, so this is stylistic only — but pinning would match the
+   repo's specifier-hygiene direction (cf. #770).
+
+## Rationale
+
+The reconcile slice did exactly what its brief required: merged the advanced base, resolved the lone
+ci.yml conflict by union, preserved 100% of #771's intent, dropped nothing, and re-ran the PR's
+validation clean. Independent verification confirms the gate is not theatre — it fails on real
+over-cap input and enforces the correct byte semantics, its extractor cannot produce a false pass,
+and every published tagline now lands whole (max 249 B). The only red signal on the PR is an
+unrelated Fresh build test outside this PR's blast radius. Verdict: **PASS**.

.llm/runs/beta10-cli--orchestrator/slices/771-rebase/implement.md

@@ -0,0 +1,21 @@
+use harness
+
+## SKILL
+- netscript-harness; netscript-tools; netscript-pr; rtk; netscript-deno-toolchain
+
+## Slice: reconcile PR #771 with the advanced integration base (merge conflicts)
+
+Worktree: `/home/codex/repos/b10-taglines` (branch `docs/jsr-tagline-byte-cap`). PR #771 targets
+`feat/beta10-integration`, which has advanced by ~10 merges (#770 #786 #787 #788 #789 #790 #793
+#794 …) and now CONFLICTS with this branch (GitHub update-branch returns 422).
+
+Task: `git fetch origin feat/beta10-integration` then merge it into the branch, resolving
+conflicts **in favor of preserving BOTH the PR's intent and everything already landed on base** —
+read PR #771's body via the GitHub API (resolveGithubToken in
+`.llm/tools/agentic/lib/agentic-lib.ts`) to know its intent before resolving. If any part of the
+PR is now obsolete (superseded by landed work), drop that part deliberately and record it in a PR
+comment, not silently. Re-run the PR's own validation commands (from its body) plus
+`deno task check` scoped to touched roots. Zero new suppressions.
+
+Push explicit refspec `git push origin HEAD:refs/heads/docs/jsr-tagline-byte-cap`; comment on PR #771 with what was
+reconciled/dropped + validation evidence. Do NOT dispatch your own evals; do NOT merge.