diff --git a/cloudflare/GITHUB.md b/cloudflare/GITHUB.md index f0657824..e8a50924 100644 --- a/cloudflare/GITHUB.md +++ b/cloudflare/GITHUB.md @@ -25,8 +25,10 @@ The manifest subscribes to push, issues, issue comments, pull requests, reviews, review threads, inline review comments, checks and statuses. Existing App registrations must enable `pull_request_review_thread` and `pull_request_review_comment` in their webhook subscriptions so resolving discussions and replying inline wake merge jobs. GitHub also sends installation lifecycle and repository -selection events automatically. The App also requests the **Email addresses: read** +selection events automatically. The App also needs the **Email addresses: read** user permission, which Better Auth needs to sign in users whose email is private. +GitHub rejects account permissions in a manifest, so the operator adds it in the +App's settings after registering. It grants no repository authority: the user token is used only for the sign-in profile and email reads and to list the [project picker](#project-enrollment)'s repositories, and never for repository writes or authority checks. No organization, diff --git a/cloudflare/README.md b/cloudflare/README.md index 83b4dc0e..9de6305d 100644 --- a/cloudflare/README.md +++ b/cloudflare/README.md @@ -356,8 +356,8 @@ secrets. Configure the GitHub app's homepage as `http://localhost:8787` and callback as `http://localhost:8787/api/auth/callback/github`. The file is ignored by Git. Its `AUTH_URL` overrides the production origin in `wrangler.jsonc`. Use a -separate GitHub App for production. The App needs the manifest's Email addresses -read permission for accounts with private email addresses; see [GITHUB.md](GITHUB.md). +separate GitHub App for production. The App needs the Email addresses read +user permission, added in its settings since a manifest cannot request it, for accounts with private email addresses; see [GITHUB.md](GITHUB.md). ```sh just worker-dev @@ -526,12 +526,8 @@ bun run deploy ``` D1 schema migrations are applied separately before deployment. The `exports` -tombstone in `wrangler.jsonc` deletes the legacy `RepositoryCoordinator` -Durable Object namespace, and any storage it held, from Workers deployed before -it was removed; Wrangler reports a stale tombstone where none exists. Remove the -tombstone after the next production deploy. This does not affect the D1 auth -database. The same `exports` block creates the SQLite-backed `RunnerHub` class -bound as `RUNNERS`; it stores only its owner's ID, so it needs no data migration. +block in `wrangler.jsonc` creates the SQLite-backed `RunnerHub` class bound as +`RUNNERS`; it stores only its owner's ID, so it needs no data migration. After deploying, verify `/health`, `/setup`, and a theme asset, then complete sign-in/sign-out in the browser. diff --git a/cloudflare/github-app-manifest.json b/cloudflare/github-app-manifest.json index 3b0b5bcf..012c28ec 100644 --- a/cloudflare/github-app-manifest.json +++ b/cloudflare/github-app-manifest.json @@ -17,8 +17,7 @@ "administration": "read", "secrets": "read", "actions": "read", - "environments": "read", - "email_addresses": "read" + "environments": "read" }, "default_events": [ "push", diff --git a/cloudflare/worker-configuration.d.ts b/cloudflare/worker-configuration.d.ts index 16279511..d100b317 100644 --- a/cloudflare/worker-configuration.d.ts +++ b/cloudflare/worker-configuration.d.ts @@ -1,11 +1,11 @@ /* eslint-disable */ -// Generated by Wrangler by running `wrangler types` (hash: 551f8eb7dddde3394179c3e9fffcfd11) +// Generated by Wrangler by running `wrangler types` (hash: 54c80306cdbeff834f3462d841b6f7b0) // Runtime types generated with workerd@1.20261023.1 2026-10-01 nodejs_compat interface __BaseEnv_Env { OUTPUT: R2Bucket; DB: D1Database; AUTH_URL: "https://quest.moq.dev"; - GITHUB_APP_ID: ""; + GITHUB_APP_ID: "5622964"; GOOGLE_CLIENT_ID: ""; VAPID_PUBLIC_KEY: ""; ENROLL_OWNERS: [248218914,432854]; diff --git a/cloudflare/wrangler.jsonc b/cloudflare/wrangler.jsonc index 5082751f..90d164cf 100644 --- a/cloudflare/wrangler.jsonc +++ b/cloudflare/wrangler.jsonc @@ -15,7 +15,7 @@ "workers_dev": false, "vars": { "AUTH_URL": "https://quest.moq.dev", - "GITHUB_APP_ID": "", + "GITHUB_APP_ID": "5622964", "GOOGLE_CLIENT_ID": "", // The Web Push application server key; see README.md. Notifications stay off while it is empty. "VAPID_PUBLIC_KEY": "", @@ -54,8 +54,5 @@ "durable_objects": { "bindings": [{ "name": "RUNNERS", "class_name": "RunnerHub" }] }, "exports": { "RunnerHub": { "type": "durable-object", "storage": "sqlite" }, - // Deletes the legacy RepositoryCoordinator namespace and its storage if an earlier deploy - // provisioned it; a no-op otherwise. Remove this tombstone once every deploy has applied it. - "RepositoryCoordinator": { "type": "durable-object", "state": "deleted" }, }, } diff --git a/quest/m0/README.md b/quest/m0/README.md index ae59277d..568de976 100644 --- a/quest/m0/README.md +++ b/quest/m0/README.md @@ -92,16 +92,13 @@ ownership-manifest design: - [Land through the merge queue with an async fixer](/quest/m0/queue-watcher/README.md) - GitHub's merge queue lands one PR at a time, and a host watcher fixes and re-enqueues each PR it drops - [Merge through a host gate](/quest/m0/host-land/README.md) - the host's fixer containers, and the frozen batched gate for the repositories not yet switched, with merge-commit landing as its one exception -- [The land fixer resolves every mechanical failure](/quest/m0/land-fixer/README.md) - workflow pushes and the PR's own CI as context +- [The land fixer resolves every mechanical failure](/quest/m0/land-fixer/README.md) - the docs listing what the fixer resolves and hands back - [Review sessions keyed by upstream branch](/quest/m0/review-session-key.md) - a round from a local branch tracking the PR branch continues that branch's review session - [Kix decision UI](/quest/m0/kix/README.md) - planning and implementation through prompts and summaries, run on the maintainer's own runners - [Route quests to models by size](/quest/m0/model-routing/README.md) - `/quest-spawn` starts each quest on the first model of its size's ranked list that can run, reviews rank the same way, and PRs record size, implementer, and reviewer - [Model check](/quest/m0/model-check.md) - recurring: the first audit of the routed PRs retunes the built-in size lists - [Codex cloud off](/quest/m0/codex-cloud-off.md) - automatic Codex cloud reviews stop once no open PR relies on them - [Codex project-config skip](/quest/m0/codex-project-config.md) - once Codex keeps a supported way to skip a project's `.codex/` layer, reviews keep the user's config -- [Gate bench](/quest/m0/gate-bench.md) - measure headroom admission on an idle host -- [Agent workflow helpers](/quest/m0/helpers/README.md) - CLI commands for CI waits, PR status, claims, quest moves, and serialized merges - [Agents get the dev shell from user settings](/quest/m0/user-dev-shell/README.md) - maintainers' own Claude and Codex settings load the dev shell; repositories drop dev-shell hooks, Quest worktree hooks, and `nix develop` instructions, and `quest init` writes no hooks -- [Remote control worktrees](/quest/m0/worktree-routes.md) - live-check `claude remote-control --spawn worktree` against the hooks, from a session spawned on claude.ai - [Session checkouts released](/quest/m0/session-checkouts.md) - a Claude session's own checkout is released when the session ends and reclaimed on resume -- [claude rm upstream report](/quest/m0/claude-rm-upstream.md) - waiting on approval: ask Claude Code to run `WorktreeRemove` instead of advising an unlock +- [claude rm upstream report](/quest/m0/claude-rm-upstream.md) - posting approved: ask Claude Code to run `WorktreeRemove` instead of advising an unlock diff --git a/quest/m0/claude-rm-upstream.md b/quest/m0/claude-rm-upstream.md index 49d6ee26..9efd15c5 100644 --- a/quest/m0/claude-rm-upstream.md +++ b/quest/m0/claude-rm-upstream.md @@ -14,6 +14,14 @@ Decided 2026-11-02 (coordinator, /quest-spawn follow-ups, after the user asked the coordinator to decide follow-ups from evidence): plan it, [XS], m0, waiting on the maintainer's approval to post. +Decided 2026-11-04 (maintainer, /quest-unblock): posting on +anthropics/claude-code is approved. + +- Can I file the issue on anthropics/claude-code? + - ✅ Approve posting + - Decline + - Skip for now + - [moq-dev/quest#425](https://github.com/moq-dev/quest/pull/425)'s probe with Claude Code 2.1.316: `claude rm` on an agent-view session's hook-made checkout reports it "locked … by something other than Claude @@ -28,7 +36,3 @@ m0, waiting on the maintainer's approval to post. them in the report. - Include the Claude Code version, the minimal reproduction from #425's scratch repository, and the expected behaviour. - -## Waiting - -- Maintainer: approve posting on anthropics/claude-code, which is outside the kixelated and moq-dev orgs where agents may post without asking; check by a ✅ recorded in this quest's Plan diff --git a/quest/m0/gate-bench.md b/quest/m0/gate-bench.md deleted file mode 100644 index f23d88d2..00000000 --- a/quest/m0/gate-bench.md +++ /dev/null @@ -1,31 +0,0 @@ -# [XS] Measure gate headroom on an idle host - -## Goal - -The gate's idle-host behaviour is measured: `scripts/gate-bench.sh gated 8` -and `ungated 8` run on an otherwise idle host, and the results are recorded -in a PR. A gated burst that starts together, close to the ungated makespan, -confirms headroom admission; anything else becomes a follow-up. - -## Plan - -Decided 2026-10-22 (user) as a follow-up of -[moq-dev/quest#189](https://github.com/moq-dev/quest/pull/189), whose -benchmarks ran while other agents kept the host's load at 19-42 on 24 CPUs, -so they measured the busy-host path, not the idle burst the quest was for. -The earlier baseline, from -[moq-dev/quest#177](https://github.com/moq-dev/quest/pull/177), was 104 s -gated against 19 s ungated for a burst of 8. - -- Record the 1-minute load before each run alongside the results. -- Delete this quest in the PR that records the results. -- Dropped (user): asking Bun upstream to make `os.userInfo().homedir` ignore - `$HOME` (the child-process lookup costs about 10 ms), and handling a macOS - hostname that changes with the network, until it is seen in practice. - -## Waiting - -- Maintainer: leave the host idle, with no other agents, builds or land - daemons running, for a few minutes of runs; an agent can't pause the - others' work. Check that `uptime`'s 1-minute load is near zero before each - run. diff --git a/quest/m0/helpers/README.md b/quest/m0/helpers/README.md deleted file mode 100644 index 2d25d3e3..00000000 --- a/quest/m0/helpers/README.md +++ /dev/null @@ -1,74 +0,0 @@ -# Agent workflow helpers - -## Goal - -Agents stop hand-writing `gh`, `jq`, and `sed` loops for routine quest -workflow steps, because `quest` commands cover them and the skills point at -those commands: CI results while waiting, a one-shot PR status, claiming -quests and PRs, moving and deleting quests, and unattended work. Skill -rules that remove the maintainer's repeated steering belong here too. - -Only generic helpers belong here. Non-goals: the kix.quest UI, a daemon, and -deciding whose review or which result counts; the agent still decides. - -## Plan - -Decided 2026-10-19 from an audit of Claude Code transcripts in moq-dev/moq and -moq-dev/moq.pro: 396 sessions from Oct 17-19, 2026, plus about 339k Bash -commands from Sep-Oct. Session counts in each child come from that window. - -- Decided (user): plan only the really generic helpers. Replying to and - resolving review threads (103 and 68 sessions) is dropped: its attribution - footer and wording are user and repository policy, and `gh api` already - does the call. Parsing open decisions from a PR body is dropped from - `quest status`, since that body format is a skill convention. -- GitHub calls live in `src/cli/` beside `quest wait`, outside the - forge-agnostic core. Pure tree edits, such as link rewriting, go in the - core. GitHub commands share the client in `src/cli/github.ts` (auth, - rate-limit retry, same-origin pagination, GraphQL) instead of copying it. -- Decided (user): no separate documentation page. Each child updates - `--help`, README examples, and the skill prose it replaces; the user asked - for those skill edits through this plan. -- Decided 2026-10-20 (user), from a wider audit of Claude Code and Codex - sessions: claims and PR ownership live on GitHub as a draft PR per claimed - quest and one `quest:*` state label per owned PR, replacing the planned - `quest claim`. The named gate lock is dropped: it replaced moq.pro's mkdir - merge mutex, which - [moq-dev/moq.pro#2510](https://github.com/moq-dev/moq.pro/pull/2510) - replaced with a label queue, and PR ownership covers the remaining - collisions. -- Decided 2026-10-21 (user): no `quest:start` label; a draft belongs to its - starter until its body has a `## Waiting` section (formerly - `## Decisions needed`, which still counts), which the guide defines as the - hand-back marker. Commands read only whether it is present. - This narrows the 2026-10-19 decision above: `quest status` still does not - parse the decisions listed in a PR body. It also amends the 2026-10-20 - decision: a PR is owned while it carries a `quest:*` label or is a draft - without that section. -- Decided (user): this epic ranks after the worktree and gate quests and - before the Kix decision UI. Children rank by sessions affected. -- Decided 2026-10-21 (user), from a month of moq maintainer transcripts: - quests that remove the maintainer's repeated steering join this epic. - `/quest-afk` and the guide rules rank first, since they save the most - maintainer time and change only prose. The complete loop ranks right after - the PR state commands, which also rewrite `complete`. Findings that fit an - existing child went into it: the merge method and the merged-PR refusal - into the PR state commands, which landed in - [moq-dev/quest#185](https://github.com/moq-dev/quest/pull/185). - -- Decided 2026-10-26 (user), from moq-dev/moq's serial merge queue: a batched - merge gate, `quest land`, joins this epic. It ranks after the existing - children, and moq-dev/quest adopts it first. moq-dev/moq, moq-dev/moq.pro, - and moq-dev/rust2 plan their own adoption. -- Decided 2026-10-27 (user), from the follow-ups of - [moq-dev/quest#229](https://github.com/moq-dev/quest/pull/229): the - gate's rule and setup fixes rank after its adoption, which verifies forks - live. -- Decided 2026-10-28 (user), from the follow-ups of - [moq-dev/quest#271](https://github.com/moq-dev/quest/pull/271): the - delegated follow-up rule ranks right after the review rules, as a prose - rule, and dropping `review-rounds` follows it. - -## Required - -- [Headless agents](/quest/m0/helpers/headless-agents.md) - auto mode allows `quest agent` launches, resumes, and stops with no per-user settings diff --git a/quest/m0/helpers/headless-agents.md b/quest/m0/helpers/headless-agents.md deleted file mode 100644 index 13661143..00000000 --- a/quest/m0/helpers/headless-agents.md +++ /dev/null @@ -1,43 +0,0 @@ -# [S] Auto mode allows headless agent launches - -## Goal - -Claude Code's auto mode allows `quest agent start`, `resume`, and `stop` on -the user's invocation of a dispatching skill alone, with no per-user -settings, so a `/quest-spawn` can start the other vendor's agents without -classifier blocks. - -## Plan - -`quest agent` now runs agents on each CLI's logged-in account, and -`/quest-spawn api` and `QUEST_API_KEYS` are gone -([moq-dev/quest#492](https://github.com/moq-dev/quest/pull/492)). That -removed the credential steps the classifier flagged. - -- Found on 2026-10-20 running `/quest-spawn api` in moq-dev/moq (16 quests, - three keys): the auto-mode classifier blocked 5 commands, including 3 of - about 25 launches and resumes that matched ones it allowed, under "Create - Unsafe Agents", "Unauthorized Persistence", and "Credential - Materialization". The classifier reads user messages, CLAUDE.md, and tool - calls, not tool results - ([docs](https://code.claude.com/docs/en/permission-modes)). Decided (user, - 2026-10-20): no settings fix; a prose `autoMode.allow` entry would work, - but every user would have to add it. -- Only if blocks remain: each dispatching skill's stub body states what - invoking it authorizes (starting, resuming, and stopping background agents - in isolated worktrees), since stub text is part of the user turn the - classifier reads. That changes the stub body once: `init` and `uninstall` - recognize a stub of any version by its body (`STUB` in - `src/core/init.ts`), so it must accept both the old and the new body. -- The command does no load or CPU admission: the guide routes the agents' - expensive commands through `quest gate`. - -## Waiting - -- Maintainer: in Claude Code's auto mode, in a repository with no - `autoMode` settings, run a `/quest-spawn` that starts Codex agents through - `quest agent` (ask for them on Codex), then answer one so it resumes, and - stop one while it runs. An agent cannot: the classifier judges only an - interactive auto-mode session's own user turns, and background agents run - with permissions bypassed. Done when no `start`, `resume`, or `stop` was - blocked; delete this quest then, or take the stub change above if one was. diff --git a/quest/m0/kix/README.md b/quest/m0/kix/README.md index 0f01efba..56e1a35c 100644 --- a/quest/m0/kix/README.md +++ b/quest/m0/kix/README.md @@ -139,7 +139,6 @@ fixes what it finds: ## Required -- [Deploy quest.moq.dev](/quest/m0/kix/deploy.md) - the operator registers the App and deploys the Worker with GitHub sign-in at quest.moq.dev - [Operator setup](/quest/m0/kix/operator-setup.md) - pilot installations and a verified test PR on moq-dev/moq and moq-dev/quest - [Private repositories](/quest/m0/kix/private.md) - moq-dev/moq.pro enrolls, visible only to signed-in users who can read it - [Job sandbox](/quest/m0/kix/sandbox/README.md) - head approval for kix-pushed heads, and opencode sandboxed diff --git a/quest/m0/kix/deploy.md b/quest/m0/kix/deploy.md deleted file mode 100644 index b05744b4..00000000 --- a/quest/m0/kix/deploy.md +++ /dev/null @@ -1,72 +0,0 @@ -# [S] Deploy the Worker to quest.moq.dev - -## Goal - -An operator registers the GitHub App and deploys `main` to -`https://quest.moq.dev`, the origin the checked-in config, App manifest, -`quest runner`'s default `--url`, and docs already name, with GitHub sign-in -pointed at it. The condition clears when `https://quest.moq.dev/health` -returns `{"status":"ok"}`, `https://quest.moq.dev/setup` redirects to -`SETUP.md`, a browser sign-in and sign-out succeed, and the App's ping to -`https://quest.moq.dev/webhooks/github` shows a successful delivery. Follow -the Deployment section of `cloudflare/README.md` and steps 1, 2 and 4 of -`cloudflare/GITHUB.md`; then remove the `exports` tombstone below and delete -this quest. - -## Plan - -- ✅ Decided 2026-10-30 (user, /quest-plan): host at quest.moq.dev, not - kix.quest, until [the public release](/quest/m1/open.md), so nothing public - is launched before it works for moq-dev. The product keeps the kix name. -- ✅ Decided 2026-10-14: deprecate kixel.quest without redirects or legacy - auth handling, because nobody uses it. quest.moq.dev is the only site and - authentication origin. The checked-in config no longer lists kixel.quest. -- As of 2026-11-02, quest.moq.dev has no DNS record and kixel.quest still - serves an earlier deploy (`/health` returns `{"status":"ok"}`). -- Merging to `main` does not deploy: no workflow runs Wrangler, and - deployment is a manual `bun run deploy` from `cloudflare/`. -- Keep the Worker name, D1 database ID, and `AUTH_SECRET`; do not create a - new production database. -- ✅ Decided 2026-11-03 (user, /quest-complete): if the `moq.dev` zone is - not in the Worker's Cloudflare account, add the zone to that account, - which keeps the Worker and its D1 database. Moving the Worker to the - zone's account was rejected, since it needs a new production database. -- The deploy deletes the legacy `RepositoryCoordinator` Durable Object and - any storage it held, approved 2026-10-14 since nothing is stored. - Afterwards remove its `exports` tombstone from `cloudflare/wrangler.jsonc` - in the PR that deletes this quest. - -## Waiting - -- Maintainer: confirm the `moq.dev` zone, which already hosts `token.moq.dev`, - sits in the same Cloudflare account as the `quest-cloudflare` Worker, since - a Workers custom domain requires it; if it does not, add the zone to the - Worker's account, as the Plan decides. Check it in the Cloudflare - dashboard, where `moq.dev` is listed under the Worker's account. Agents hold - no Cloudflare credentials. -- Maintainer: register the production GitHub App from - `cloudflare/github-app-manifest.json` (homepage `https://quest.moq.dev`, - callback `https://quest.moq.dev/api/auth/callback/github`, webhook - `https://quest.moq.dev/webhooks/github`) after reviewing its permissions and - events, or update an existing App to those URLs, and set `GITHUB_APP_ID` in - `cloudflare/wrangler.jsonc`. Registration returns secrets an agent must - never handle. -- Maintainer: set the Workers secrets `AUTH_SECRET` (kept from the existing - deployment), `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET`, - `GITHUB_APP_PRIVATE_KEY` and `GITHUB_WEBHOOK_SECRET` with - `bun run wrangler secret put NAME`; every deploy fails until they are set. - Secrets stay out of git and agent worktrees. -- Maintainer: create the `quest-output` R2 bucket and its 30-day `output/` - lifecycle rule if missing, confirmed with - `bun run wrangler r2 bucket lifecycle list quest-output`, then apply the D1 - migrations with `bun run wrangler d1 migrations apply DB --remote` and run - `bun run types`, `bun run check` and `bun run deploy` from `cloudflare/`. - These need Cloudflare credentials. -- Maintainer: remove the Worker's kixel.quest custom domain in the Cloudflare - dashboard (Workers, Settings, Domains & Routes) if the deploy leaves it - attached. Needs Cloudflare access. -- Maintainer: verify `https://quest.moq.dev/health` returns - `{"status":"ok"}`, `/setup` redirects to `SETUP.md`, a browser sign-in and - sign-out succeed, and the App's ping to `/webhooks/github` shows a - successful delivery. Sign-in and the App's delivery log need the - maintainer's GitHub account. diff --git a/quest/m0/kix/operator-setup.md b/quest/m0/kix/operator-setup.md index 06adb86a..72a52093 100644 --- a/quest/m0/kix/operator-setup.md +++ b/quest/m0/kix/operator-setup.md @@ -8,8 +8,10 @@ bounded test PR verify the integration before contributors are invited. ## Plan -- This is an operator/setup outcome. App registration and its secrets belong - to [Deploy quest.moq.dev](/quest/m0/kix/deploy.md), because every deploy needs them. +- This is an operator/setup outcome. The Worker is live at quest.moq.dev + (deployed 2026-11-04, /quest-unblock) with the production App + [kixel-quest](https://github.com/apps/kixel-quest) (ID 5622964, owned by + moq-dev); its registration and secrets were part of that deploy. - Pilot repositories decided 2026-10-27 (user): moq-dev/quest and moq-dev/moq, ranked first so kix is usable on moq-dev/moq soonest. Decided 2026-10-30 (user): start with moq-dev/moq; the private @@ -55,7 +57,3 @@ bounded test PR verify the integration before contributors are invited. operator account. - Record nonsecret setup/run instructions and deployment identifiers. Remove the quest when the setup condition is fulfilled. - -## Required - -- [Deploy quest.moq.dev](/quest/m0/kix/deploy.md) - the live origin and registered App diff --git a/quest/m0/land-fixer/README.md b/quest/m0/land-fixer/README.md index dc71728d..f7ed53ac 100644 --- a/quest/m0/land-fixer/README.md +++ b/quest/m0/land-fixer/README.md @@ -1,4 +1,4 @@ -# The land fixer resolves every mechanical failure itself +# [S] The land fixer resolves every mechanical failure itself ## Goal @@ -149,11 +149,9 @@ Decision prompts, selected options marked ✅: The README's landing section and `CONTRIBUTING.md` list what the fixer resolves itself and what it hands back. That docs update is the epic's own -work, done once the Required quests below have merged. - -## Required - -- [Workflow permission](/quest/m0/land-fixer/workflows-permission.md) - waits on the maintainer to grant moq-bot `workflows`, so pushes touching workflows are accepted +work, now unblocked: on 2026-11-04 the moq-dev installation of moq-bot +showed `workflows: write` for all its repositories, so its last child, +Workflow permission, was deleted (/quest-unblock). ## Related diff --git a/quest/m0/land-fixer/workflows-permission.md b/quest/m0/land-fixer/workflows-permission.md deleted file mode 100644 index 99188c0d..00000000 --- a/quest/m0/land-fixer/workflows-permission.md +++ /dev/null @@ -1,35 +0,0 @@ -# [XS] moq-bot can push workflow changes - -## Goal - -The moq-bot GitHub App (ID 1039466) has the `workflows: write` repository -permission, and every installation the land fixer pushes to, through the -queue watcher or the host gate, has accepted it: moq-dev/moq, moq.pro, rust2, -rind and quest. GitHub then accepts -a fixer push that touches `.github/workflows`, including a base merge pushed -to a fork's branch. - -## Plan - -Decided 2026-11-01 (user, /quest-plan): - -- What happens when a fixer push touches `.github/workflows`: - - ✅ Grant moq-bot `workflows` - - The fixer avoids workflows, and the PR parks for a decision - -GitHub refused the fixer's push on -[moq-dev/moq#7439](https://github.com/moq-dev/moq/pull/7439) (twice), -[#7467](https://github.com/moq-dev/moq/pull/7467), and -[#7370](https://github.com/moq-dev/moq/pull/7370); a maintainer session pushed -each by hand. Once this permission is granted, the refusal that -[moq-dev/quest#358](https://github.com/moq-dev/quest/pull/358)'s -`quest land apply` handback handles should stop happening. - -Delete this quest once the permission is granted and accepted. - -## Waiting - -- Maintainer: grant moq-bot `workflows: write` and accept it on each - installation above; only an App owner can change its permissions. To - check, open the App's settings under Permissions; GitHub lists pending - permission requests on each installation. diff --git a/quest/m0/queue-watcher/runners.md b/quest/m0/queue-watcher/runners.md index 3113e4f1..cc06576f 100644 --- a/quest/m0/queue-watcher/runners.md +++ b/quest/m0/queue-watcher/runners.md @@ -52,6 +52,11 @@ Done in [moq-dev/quest#439](https://github.com/moq-dev/quest/pull/439): [moq-dev/rind#289](https://github.com/moq-dev/rind/pull/289) and [moq-dev/rust2#536](https://github.com/moq-dev/rust2/pull/536). +Deployed 2026-11-04 (/quest-unblock): kixelated/nixos#20 is live on the +land host (generation 80, deploy/quest-land b5d46f3); only +`quest-land-moq-pro-check.socket` remains and `/dev/kvm`'s ACL names no +check UID. + What remains: - Once a repository's first step is on main, switch its `queue.yml` call to @@ -60,7 +65,6 @@ What remains: workflow and fails. Say in that repository's contributing guide that a PR's edit to `queue-build.yml` runs only after it lands. - Then restrict each group (see Waiting). -- Deploy kixelated/nixos#20 with the rest of the stack. - Verify that a fork PR's workflow waits for approval. ## Waiting @@ -77,11 +81,6 @@ What remains: Team plan, though the API accepts the fields; if GitHub rejects or drops them, revert with `-F restricted_to_workflows=false` and fall back to option (2) above. -- Maintainer: deploy [kixelated/nixos#20](https://github.com/kixelated/nixos/pull/20) - through `deploy/quest-land`, since only the maintainer activates the live - host. Check that `systemctl list-units 'quest-land*check*'` shows only - `quest-land-moq-pro-check.socket`, and that `getfacl /dev/kvm` names no - check UID. - Maintainer: the next time an outside contributor opens a fork PR on moq-dev/quest, moq-dev/rind or moq-dev/rust2, check that its workflow runs wait for approval. diff --git a/quest/m0/session-checkouts.md b/quest/m0/session-checkouts.md index b3756c3e..682136f6 100644 --- a/quest/m0/session-checkouts.md +++ b/quest/m0/session-checkouts.md @@ -35,13 +35,12 @@ Work: reclaims it. An idle background session never ends; leave it held. - Remote control's `bridge-*` checkouts are session checkouts too, and the release covers them if `SessionEnd` fires in a bridge-spawned session. - [Remote control's live check](/quest/m0/worktree-routes.md) confirms - whether it does. Release only prunes the declared scratch: it keeps every - other file and Git's worktree lock (`release` and `prune` in - `src/cli/worktree.ts`; only `remove` unlocks). The bridge still decides at - session end, as that quest describes: it removes a clean checkout through - `WorktreeRemove` and keeps one with changes. Verify that order in the same - live check. + Whether it does is unverified: the maintainer dropped remote control's + live check on 2026-11-04 (/quest-unblock). Release only prunes the + declared scratch: it keeps every other file and Git's worktree lock + (`release` and `prune` in `src/cli/worktree.ts`; only `remove` unlocks). + The bridge still decides at session end: it removes a clean checkout + through `WorktreeRemove` and keeps one with changes. - Claude Code bounds `SessionEnd` hooks by a short budget (`CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS`) and does not wait past it. Measure a release with scratch to delete, and set the entry's timeout to diff --git a/quest/m0/user-dev-shell/repo-config.md b/quest/m0/user-dev-shell/repo-config.md index e1e479b6..7a82a04c 100644 --- a/quest/m0/user-dev-shell/repo-config.md +++ b/quest/m0/user-dev-shell/repo-config.md @@ -29,7 +29,10 @@ Decided 2026-11-03 (maintainer, /quest-unblock); see the hooks: a new Claude Code session and a new Codex session both resolve the dev shell's tools (`which just`, `quest --version` where pinned) with no `nix develop` and no manual `direnv allow`. - -## Waiting - -- Maintainer: pull kixelated/dotfiles and run `bin/install-dev-shell.py` (or the full `install`, with `codex` on `PATH`) on `nixos` (`kixtop` has neither direnv nor Nix, so the hook has nothing to load there; it got only the effort defaults on 2026-11-03); it changes the live agent config on each host, which an agent here doesn't touch unasked. The repositories' hooks must not go before the user-level ones arrive. [kixelated/dotfiles#33](https://github.com/kixelated/dotfiles/pull/33) is merged. On 2026-11-03, `desktop` and `nixos2` had the hook in `~/.claude-personal/settings.json`, but `nixos` and `kixtop` didn't. Check on each host with direnv and Nix (`desktop`, `nixos2`, `nixos`) that `~/.claude-personal/settings.json` has the dev-shell `SessionStart` hook and that a fresh worktree's session resolves `just`; on `kixtop` the hook is an expected no-op +- User-level hooks are on every host with direnv and Nix (2026-11-04, + /quest-unblock): `desktop`, `nixos2` and `nixos` have the dev-shell + `SessionStart` hook in `~/.claude-personal/settings.json`. On `nixos` the + maintainer chose to discard the checkout's local edits; they are kept as + branch `backup/nixos-local-2026-11-04` and + `.git/nixos-local-edits-2026-11-04.patch` there. `kixtop` has neither + direnv nor Nix, so the hook is a no-op there. diff --git a/quest/m0/worktree-routes.md b/quest/m0/worktree-routes.md deleted file mode 100644 index 4787196f..00000000 --- a/quest/m0/worktree-routes.md +++ /dev/null @@ -1,36 +0,0 @@ -# [XS] Live-check remote control's worktrees - -## Goal - -`claude remote-control --spawn worktree` works with `quest worktree hook`, or -the README's "Claude Code checkouts" section says what doesn't: a session -spawned from claude.ai or the Claude app gets a hook-created checkout, and -ending the session removes it when it has no changes and keeps it otherwise. - -## Plan - -[moq-dev/quest#425](https://github.com/moq-dev/quest/pull/425) live-checked -the other routes with Claude Code 2.1.316 and documented them. Remote control -needs a session spawned from claude.ai or the Claude app, which a headless -agent can't do, so its README description comes from Claude Code's own code: - -- The bridge creates a spawned session's worktree through `WorktreeCreate`, - named `bridge-`, and no `SubagentStart` or `SubagentStop` fires - for it, so it is never released. -- When the session ends, or `claude remote-control` shuts down, it compares - the checkout with the commit it started at. A checkout without changes is - removed through `WorktreeRemove`, and one with changes is kept. -- The bridge never runs `git worktree unlock` on a hook-created checkout, - since it records no Git root for one, so quest's lock stays in place. - -Check it from a scratch repository with the worktree hooks configured (the -opt-in user-level setup the README's "Claude Code checkouts" section -describes), with -`QUEST_WORKTREE_HOME` isolated: start `claude remote-control --spawn worktree`, -spawn a session from claude.ai, end it once without changes and once with an -untracked file, and watch `quest worktree status`. Fix the README if it -differs. - -## Waiting - -- Maintainer: spawn a remote-control session from claude.ai or the Claude app against a scratch repository, as the Plan says; done once the README matches what happened. diff --git a/quest/m1/decisions-needed.md b/quest/m1/decisions-needed.md index 35e285ab..dc8bf1d0 100644 --- a/quest/m1/decisions-needed.md +++ b/quest/m1/decisions-needed.md @@ -19,8 +19,8 @@ m1. ## Waiting - moq, moq.pro, rind, rust2, quest: no open draft carries - `## Decisions needed` (on 2026-11-02, 11 in moq, 16 in moq.pro, 1 each in - rind and rust2). Check with + `## Decisions needed` (on 2026-11-04, 4 in moq, 5 in moq.pro, 2 in rind, + 3 in rust2, none in quest). Check with `gh pr list -R moq-dev/ --state open --draft --json number,body` and search the bodies for the heading. To advance it, rewrite each to `## Waiting`. diff --git a/quest/m1/user-state.md b/quest/m1/user-state.md index 8ff854aa..cc33b750 100644 --- a/quest/m1/user-state.md +++ b/quest/m1/user-state.md @@ -104,8 +104,8 @@ Implementation guidance: call, so runner messages and approvals still interleave there. - Cross-user reads, such as an operator overview, fan out to the hubs or are dropped; none may move a user's state back into D1. -- Update `quest/m0/kix/deploy.md` and `cloudflare/README.md` for the - start-fresh deploy, and keep the dev and test fixtures working. +- Update `cloudflare/README.md`'s Deployment section for the start-fresh + deploy, and keep the dev and test fixtures working. ## Related diff --git a/quest/m2/chatgpt-waitlist.md b/quest/m2/chatgpt-waitlist.md index 94efe66f..118e1694 100644 --- a/quest/m2/chatgpt-waitlist.md +++ b/quest/m2/chatgpt-waitlist.md @@ -16,9 +16,9 @@ Deprioritized on 2026-10-05 behind the other m1 entries while hosted approval remains outstanding. Keep the quest ready so future triage checks for a reply; ChatGPT login and hosted runs still require its completion. +The maintainer has applied (confirmed 2026-11-04, /quest-unblock). + ## Waiting -- Maintainer: apply through OpenAI's interest form or waitlist, if not done; - the application is made for the operator's account. - OpenAI: approve the Kix app for hosted Sign in with ChatGPT. Check for a reply. diff --git a/quest/m2/legacy-labels.md b/quest/m2/legacy-labels.md index cdd8b876..c08848a7 100644 --- a/quest/m2/legacy-labels.md +++ b/quest/m2/legacy-labels.md @@ -17,7 +17,8 @@ Decided 2026-10-31 (user, /quest-plan of the follow-ups from moq.pro's and rust2 ## Waiting -- moq.pro, rind, rust2: each pins a quest release that includes - [moq-dev/quest#326](https://github.com/moq-dev/quest/pull/326); quest and - moq already do (2026-11-02). Check each repository's quest pin +- rind, rust2: each pins a quest release that includes + [moq-dev/quest#326](https://github.com/moq-dev/quest/pull/326); quest, + moq and moq.pro already do (2026-11-04; rind pins 782132e and rust2 + dc8008b, both older). Check each repository's quest pin (`flake.nix` or `mise.toml`).