Epic: qualification, handoff reliability, and operational evidence through v1.5.0

[jeffhuber]

Part of roadmap #900. Implements revisions 1, 2, and 4 from the completed hosted-Devin campaign; coordinates revision 3 with Slack #903 and revision 5 with the live roadmap/feature scorecards.

Outcome

Before Code Mower expands supervised hosted execution, qualification is role-specific, every takeover proves source-writer quiescence, contribution history and reviewer exclusion agree, and release evidence distinguishes completion, provider exit, billing settlement, stored metadata, and fresh aggregate views. Default setup remains Claude + Codex; Devin is a bounded optional builder. This is a completion epic, not an umbrella implementation PR.

The campaign delivered 3/5 hosted-Devin samples. #865 and #935 were completed separately by Codex #971/#973; the final #935 recovery was user-cancelled before delivering a change. Preserve that outcome and the corrected malformed-request explanation. Settled campaign billing remains unavailable, not zero. Final scorecard.

PR map and sequencing

“Planned PR” means no PR exists yet. Each implementation row gets exactly one PR in the OSS repository; the named builder is a proposed lane assignment, not an active session. Reviewers must be qualified, independent of all contributors to the current diff, and valid under repository policy. If no eligible reviewer exists, stop for one explicit owner action rather than self-gating.

Unit	Issue / PR	Planned builder	Dependencies	Completion gate
R1 accurate commands and live roadmap docs	#965 / merged #981	Code Mower Claude	current released interfaces	before v1.4.1 #915
R2 optional review defaults	#967 / merged #980	Code Mower Codex	independent	before #915
R3 role-specific qualification and admission	#975 / merged #987	Code Mower Codex	existing capability/policy contracts; coordinate docs after #965	before #915; then supervisor #977 and Board qualification #951
R4 effective authority and migration reporting	#955 / merged #988	Code Mower Claude	#975	before #915; then #951 and Slack setup #922
R5 quiescent, capable, consistent takeover	#962 / merged #984	Code Mower Codex	existing #751/#906 contracts	before #915 and #963; then any automated takeover integration
R6 contributor lineage and reviewer exclusion	#963 / staged children #990 (#994) → #991 → #992; unaccepted #989 preserved and #993 closed without merge	Code Mower Codex core/producer; integration assignment pending	#962 and #975; contract → publication → atomic consumer activation	before #915; then local Board producer #949 and supervisor #977
R7 independent operational acceptance evidence	#976 / merged #985	Code Mower Codex	existing lifecycle/campaign/cloud facts	before #915; consumed by #950/#951/#920/#923
R8 verify existing hosted aggregate freshness	#974 / evidence-only verification	roadmap orchestrator / hosted service operator	existing accepted receipt	fresh visibility verified before #915; rechecked for #923

A confirmed hosted defect under #974 becomes a narrowly scoped implementation child and one separate hosted PR, recorded here before work begins. No defect or PR is invented from a transient stale response. Unavailable settled provider billing is reported as a limitation; it does not become a fabricated zero-cost result or an unbounded wait.

Dependency and ownership boundaries

• Graphify Graphify: bounded query normalization and context packets #914 proceeds independently with a qualified builder; Release: qualify and publish optional Graphify context in v1.4.1 #915 requires all R1–R8 completion evidence, alongside Graphify: bounded query normalization and context packets #914.
• Run Local builder handoff: make takeover quiescent, Git-write capable, and runner-consistent #962 before Builder takeover: make provenance, labels, and reviewer exclusion handoff-aware #963 where handoff/provenance files overlap. Board: connect exact local sessions, work, runs, and worktrees #949 and Slack: connect authorized tasks to a qualified Code Mower supervisor #977 consume the resulting shared lineage resolver rather than create their own.
• Participants: enforce role-specific qualification for hosted builders #975 controls role eligibility. Builder takeover: make provenance, labels, and reviewer exclusion handoff-aware #963 controls contributor-based independence. Adoption polish: report effective review authority and superseded Devin bridge drift #955 renders the effective result; these are different decisions with shared inputs.
• Board service lifecycle Board: manage persistent services and reject stale keepalive bindings during release restart #961 remains owned by Board Epic: Board clarity and provider-neutral session visibility for v1.4.2 #945 and is mandatory for Board: integrate head-bound evidence and qualify local and hosted session visibility #951/Release: publish and qualify Board clarity v1.4.2 #952. It is not duplicated here.
• Slack Slack: connect authorized tasks to a qualified Code Mower supervisor #977 supplies the actual qualified supervisor connection; Slack: durable inbox/outbox and start/status/cancel interaction #919/Slack: Devin dispatch, clarification, completion, and cancellation bridge #920 implement its hosted integration. Hosted Devin availability alone never satisfies supervisor readiness.
• Release evidence: separate completion, provider exit, usage settlement, and cloud freshness #976 adds local/release evidence, not cloud event fields. Slack's new event contract is Slack: freeze telemetry contract and implement OSS Board/cloud emitters #921 and its hosted PR is CodeMower.com: implement the frozen Slack telemetry contract and fresh views #978. Cloud: verify aggregate freshness after accepted release metadata #974 only reconciles already accepted events.
• Serialize edits to shared files across all tracks. Release/tag/deployment actions are serial even when independent implementation is parallel.

Acceptance and release checkpoints

• Docs: replace the nonexistent hosted-Devin work-order command #965 — all advertised commands and current roadmap documentation match released interfaces and the approved completion plan.
• Work orders: keep optional Gitar out of the default review lanes #967 — default generated reviews remain Claude + Codex; optional reviewers require selection.
• Participants: enforce role-specific qualification for hosted builders #975 — role-specific qualification is enforced before side effects; Devin remains unqualified for orchestration/merge-authority review absent separate evidence.
• Adoption polish: report effective review authority and superseded Devin bridge drift #955 — setup/doctor/review wording reports effective authority and supported transport; accepted Report effective review authority and superseded Devin bridge drift #988.
• Local builder handoff: make takeover quiescent, Git-write capable, and runner-consistent #962 — source writer quiescence and destination Git capability are verified before takeover; uncertain exit fails closed.
• Builder takeover: make provenance, labels, and reviewer exclusion handoff-aware #963 — one current writer, ordered contribution episodes, and contributor-based reviewer exclusion agree at the exact head.

R6 now uses three staged PRs rather than the original one-PR unit: #990 pure contract, #991 trusted delivery/publication, and #992 atomic admission/status/labeler/runner integration. A deterministic checkpoint at preserved unaccepted #989 head 0706c53922f67168dfbb6d2a6493a031a9b0f205 confirmed a cross-surface label-mutation inconsistency after 25 bounded same-session repair/completion rounds. The repair loop is stopped; its passing tests/CI do not override that invariant failure. The decomposition centralizes pure contracts and defers automatic label movement until all consumers use the accepted policy. #963 remains the outcome umbrella and closes only after all stages plus the final consumer matrix pass.

• Release evidence: separate completion, provider exit, usage settlement, and cloud freshness #976 — completion, exit, reviewed head, caps/settlement, ingest receipt, and aggregate freshness remain independent evidence.
• Cloud: verify aggregate freshness after accepted release metadata #974 — existing accepted events are visible in a verified fresh authenticated aggregate view; any confirmed defect's child PR is merged/deployed and retested.

Each implementation child records exact PR/head, eligible independent audit, P0/P1/P2 resolution, focused/relevant tests, CI, authoritative gate, privacy, and accepted outcome. The epic closes only after all eight checklist items have completion evidence; v1.4.1 #915 and final v1.5.0 #923 require this closeout. Record missing measurements as unavailable, preserve user cancellation separately from implementation failure, and retain all historical campaign evidence.

Paid execution limits

This plan establishes no new provider-create allowance. Each future live campaign needs an explicit initial and aggregate ACU cap, one stable private binding per delivery episode, exact PR/head collection, and no automatic retry after uncertain outcomes. Permit at most one or two explicitly budgeted recovery creates before splitting work or changing builders. Use well-scoped bounded Devin tasks for observation canaries; use qualified Codex/Claude builders for cross-cutting recovery and orchestration. Record elapsed time, orchestrator/owner interventions, all deliberate creates, observed and settled usage coverage, and outcome separately.

Active completion target

Owner priority moves this entire stabilization epic ahead of Graphify publication #915. All seven implementation children and #974 freshness verification must have accepted completion evidence before v1.4.1 is declared complete. #914 Graphify implementation runs concurrently where source ownership is independent. The original v1.4.0 artifacts remain immutable; stabilization changes ship in the subsequent verified v1.4.1 package. Board #945, including service lifecycle #961, is the next active release after v1.4.1. Slack remains later scope.

The timing in the table above is strengthened by this target: #975/#955/#962/#963 and #974 are now required before #915, not merely before their later consumers. Unknown settled billing remains explicitly unavailable and is not an indefinite completion dependency.

Current accepted evidence and adoption follow-up

• Work orders: keep optional Gitar out of the default review lanes #967 completed by Work orders: default to Codex and Claude reviews #980 at reviewed head 6b9478b62b9326eb0fb6ebe67a1607ff61869b3e, merged as 529b70697908c4748106740fb241698783609fc9. Independent Claude audit, relevant tests, CI and authoritative gate passed.
• Docs: replace the nonexistent hosted-Devin work-order command #965 completed by Docs: replace the nonexistent hosted-Devin work-order command #981 at reviewed head 11e2b8d6c7ed5812d6ef301490450b82dfe0dc34, merged as 392e6a6d26214a7f7f5eb8fea77fdb6f6ea97421. Independent Codex audit, documented-command checks, CI and authoritative gate passed.
• Both are on main; published v1.4.1 inclusion remains Release: qualify and publish optional Graphify context in v1.4.1 #915 acceptance work.
• The owner-supplied v1.4.0 hosted adoption report adds cohesive lease visibility/admission checks to Participants: enforce role-specific qualification for hosted builders #975 and portable remediation/quiet opt-in checks to Adoption polish: report effective review authority and superseded Devin bridge drift #955. Release: qualify and publish optional Graphify context in v1.4.1 #915 verifies the already merged Doctor: scope release-campaign auth readiness to campaign intent #966/Init: preview --builders from the packaged starter in a fresh checkout #969 fixes in the actual package and repeats the supported headless adoption path.
• Repository-aware Board stop belongs to Board: manage persistent services and reject stale keepalive bindings during release restart #961 for v1.4.2. New isolated headless campaign authentication Campaign: support isolated Codex authentication on headless Linux #983 is later roadmap work and is not an additional child or blocker of this stabilization epic.

Latest accepted progress

#976 completed through #985 at reviewed head 7afb76361c175f2f4bffbba19888df2bb1ec76c1, merged as f452bc918d222427edb94b954c4e3d988022de69; independent Claude PASS, focused/package checks, full Python CI matrix and authoritative gate passed. Published-package inclusion remains #915. #974 is closed with separately verified stored receipt and fresh authenticated aggregate visibility; no duplicate upload or hosted defect was invented. Seven of eight epic units are accepted (#965/#967/#962/#975/#976/#974/#955). #962/#984 passed independent Claude review on 4764c745e8e56953407025455bf8ce4011dca7af, all CI/gate checks, and the actual installed-Codex containment rehearsal; merged as cbd454e0ab883dc4c442c8ef82eec3dd80fe4752 after writer quiescence and lease release. #975/#987 passed independent Claude review on 498b37143a5034526a6133f9276bff8b0e9c5560, 3,565 local tests with 12 skips, all CI/gate checks, and merged as c542536d68a5774d5c7db5d2f33a0e860e908872 after writer quiescence and lease release. #955/#988 is accepted with independent exact-head Codex PASS and all focused/full/CI/gate checks, merged as db4506d2b3232e4c6a7c5683251eeb536b2b8355. Only #963 remains, now staged through #990/#991/#992; unaccepted #989 does not satisfy it.

#990 is now accepted through the smaller Codex-authored #994 at reviewed head 6b1642d561ee46987870f492f95d4222179d2374, merged as e818a3b639dfe903bdc16aff3674af98a5a08233. The complete 80,246-byte, 10-file diff passed independent Claude review with zero P0–P3 findings; all 14 artifact parts were verified from exact raw Read results. Owning checks passed 30 tests and 214 subcases; canonical full discovery passed 3,688 tests with 16 skips, guards and all CI/authoritative gate checks passed. Writer and review processes were quiescent; the broker lease was released from held and independently observed absent before merge. #993 is closed without merge; #989 remains superseded evidence. #991 starts from this accepted base, followed by #992. Seven of eight epic outcomes remain accepted until the whole #963 consumer contract passes.