feat(P5): Wave J — SSE integration + LLM smoke + adapter UI + CI (REQ-017, gate item 8)

Two-track LLM smoke (G-018): Track A (mock-path) P0 gate passes deterministically;
Track B (real-path) optional/allow-failure. llm-mock hardened (G-019 regex set).
Settings→Adapters UI + Test-Call UI with SSE consumer, staleness, closed-tool-set
gap docs (G-014). CI pipeline (.gitea/workflows/ci.yml, G-011) with Postgres 16
service container + setup-ci-roles.sql (G-022). Import guard (R-008).

Tests: 618 green + 38 conformance + 5 pen test. Coverage: 97% llm-mock, 92.3% mcp.
M1 non-regression: all M1 tests pass.

---ci---
phase: 5
milestone: v0.2
status: complete
wave: J
phase_role: execution
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,17 +1,12 @@
 {
-  "phase": 6,
-  "stage": "complete",
+  "phase": 5,
+  "stage": "execute",
   "milestone": "v0.2",
   "milestone_name": "mcp-layer-day1-adapters",
-  "phase_role": "final",
+  "phase_role": "execution",
+  "wave": "J",
   "attempts": 0,
-  "updated_at": "2026-08-25T07:00:00Z",
-  "milestone_complete": true,
-  "milestone_release_tag": "v0.1.6",
-  "milestone_release_id": 839,
+  "updated_at": "2026-08-25T06:00:00Z",
+  "milestone_complete": false,
   "tag_line": "v0.1.x",
-  "phases_shipped": ["v0.1.0", "v0.1.1", "v0.1.2", "v0.1.3", "v0.1.4", "v0.1.5", "v0.1.6"],
-  "reqs_covered": ["REQ-015", "REQ-016", "REQ-017", "REQ-018", "REQ-019", "REQ-020", "REQ-021", "REQ-022", "REQ-023", "REQ-024", "REQ-025", "REQ-026", "REQ-027"],
-  "tests_green": 656,
-  "next_milestone": "v0.3 (M3 — Chat, Orchestration, Hardening)"
-}
+  "next_tag": "v0.1.5"

.ciagent/M2-REVIEW.md

@@ -1,347 +0,0 @@
-# M2-REVIEW — Multi-Persona Code Review + Project Health Audit + M2 Gate Verification
-
-**Phase:** 6 — Final — Review + Audit + Ship
-**Milestone:** v0.2 (M2: MCP Layer & Day 1 Adapters)
-**Branch:** `phase/06-final-review-ship`
-**Reviewer:** lead-developer (glm-5.2)
-**Date:** 2026-08-25
-**Spec:** `.ciagent/steer-m2-spec.md` v1.0 (locked) — §6 (15 gate items), §4 (REQ-015..027 acceptance criteria)
-**Plan:** `.ciagent/PLAN.md` — Waves F/G/H/I/J + Final + Wave 0
-**Grill:** `.ciagent/GRILL.md` — G-011..G-022 (12 binding fixes, all verified applied)
-**Verdict:** **PASS — M2 is ready to ship as v0.1.6.**
-
----
-
-## 1. Executive Summary
-
-M2 (MCP Layer & Day 1 Adapters) delivers the read-only Model Context Protocol
-gateway, four Day-1 infrastructure adapters (Proxmox, SSH/Linux via the M1 Relay
-Agent, GitHub, Gitea), SSE streaming, token-bucket rate limiting, the LLM
-tool-calling smoke, and a from-scratch CI/CD pipeline (the M2 cycle's largest
-hidden work item per GRILL E-001). The multi-persona review across correctness,
-testing, security, performance, and maintainability lenses **passes all 13
-REQs (015-027)** and **all 15 M2 gate items**.
-
-The two P0 blockers from the GRILL (no CI pipeline; no LLM-smoke reliability
-fallback) are resolved by G-011 (`.gitea/workflows/ci.yml` — two jobs, Postgres
-16 service container, real RLS) and G-018/G-019 (two-track smoke: mock-path is
-the P0 gate; real-path is allow-failure; hardened regex pattern matching). All
-12 binding fixes G-011..G-022 are verified applied (see §6).
-
-**Test totals:** 618 unit/integration tests (green) + 38 conformance tests
-(green, 1 skipped = real-GitHub Track B, allow-failure) = **656 tests, all green.**
-**Coverage:** `packages/mcp` 92.33% statements, `packages/llm-mock` 97.01%,
-`packages/db` 98.18% — all above the 80% gate.
-
-**M1 non-regression:** All M1 suites (db, auth, runtime, byom, control-plane
-M1 paths, relay-ws) pass. The only M1 source edit is the additive
-`AuditEventType` union widening (G-012) — a backward-compatible type change.
-
-**No P0 findings.** Two minor P2/cosmetic notes (stdio.ts coverage; cache.ts
-branch coverage) are recorded as known limitations for M3 follow-up, not
-blockers.
-
----
-
-## 2. Per-REQ Pass/Fail Table (13 REQs)
-
-| REQ | Title | Wave | Verdict | Evidence |
-|-----|-------|------|---------|----------|
-| **REQ-015** | Define abstract MCP tool schema | F | ✅ PASS | `registry.ts`: 9 tools locked, each with `{name, description, inputSchema}` (JSON Schema, `type:"object"`, `additionalProperties:false`). `REGISTRY_SIZE=9` asserted at module load (drift throws). `MCP_PROTOCOL_VERSION="2025-06-18"`. Arg validation → 400 schema-validation error (Edge 4). Per-tenant disable supported; closed (cannot add). Conformance `tools-list.test.ts` (6 tests) + `tools-call-invalid-args.test.ts` (6 tests). |
-| **REQ-016** | Route abstract MCP calls to tenant-specific adapter | F | ✅ PASS | `router.ts` resolves `(tenant_id, adapter_type, target_id)` under `withTenant` + RLS. Routing errors → 404 structured. `router.test.ts` (8 tests) + `broker.test.ts` (404 adapter_not_found / target_not_found). SSE response returned via stream-manager. |
-| **REQ-017** | Stream tool execution via SSE | F+J | ✅ PASS | `stream-manager.ts`: per-call streams, ULID correlation IDs, `Content-Type: text/event-stream`, `id`/`event`/`data` fields, terminal `done`/`error`. 30s stream-not-opened + 60s max-lifetime (R-006). Client disconnect (Edge 8) → AbortController + no audit. `stream-manager.test.ts` (15 tests) + conformance happy/error + Test-Call UI `EventSource` consumer. |
-| **REQ-018** | Enforce read-only at MCP gateway | F+G/H/I | ✅ PASS | **Two-layer INV-7**: (1) closed 9-tool registry is PRIMARY (`proxmox.shutdown_vm` → 400 unknown_tool, broker.test.ts); (2) write-blocklist is BACKSTOP (G-015 framing). `WriteBlockedError` → 403 + `adapter.write_rejected` audit wired in `invoke/route.ts:114-135` (the P1 gap from P01 is closed). Per-adapter write-blocklist tests: proxmox (5), gitea (6), github (4), ssh command-allowlist (11). Adapter NEVER invoked on rejection. |
-| **REQ-019** | Token-bucket rate limit per user/tenant | F | ✅ PASS | `rate-limiter.ts`: USER 60/min (refill 1/s), TENANT 300/min (refill 5/s), AND logic, refund-on-tenant-fail (D-M2-R007). 429 + `Retry-After` header. No adapter call on 429. No audit on 429 (warn-level log). `rate-limiter.test.ts` (8 tests) + broker.test.ts (429). |
-| **REQ-020** | Read-only Proxmox adapter | G | ✅ PASS | `adapters/proxmox/`: PVE API client (API Token auth, 10s `AbortSignal.timeout`, `allowSelfSigned`), 3 capabilities (list_vms/get_vm_status/get_node_metrics) → GET endpoints only. Inventory TTL cache (60s LRU) for `list_vms`. Mock PVE API tests; coverage 94.7%. |
-| **REQ-021** | Read-only SSH/Linux adapter | H | ✅ PASS | `adapters/ssh/whitelist-check.ts` (layer 1, 6-command subset, regex) + Relay Agent `CheckCommand` (layer 2, Go) + no-shell `exec.Command` (layer 3). `tool_call`/`tool_result` WebSocket round-trip. 9.5s agent / 10s broker timeout. **G-013 divergence matrix** (cross-layer.test.ts, 4 cases: both-reject, both-accept, broker-rejects-Go-also-rejects, documented divergence). |
-| **REQ-022** | Read-only GitHub adapter | I | ✅ PASS | `adapters/github/`: fine-grained PAT only (`github_pat_` prefix; classic `ghp_` rejected → 422, D-006). `GET /user` validates token + implicit `metadata:read`. `actions:read` validated per-invocation via 403 + `X-Accepted-GitHub-Permissions` (R-004). 3 capabilities (list_repos/get_recent_ci_runs/get_workflow_run) → REST GET only. Rate-limit handling (`X-RateLimit-Remaining`, backoff). Coverage 95.05%. |
-| **REQ-023** | Read-only Gitea adapter | I | ✅ PASS | `adapters/gitea/`: version-aware scope validation (≥1.22 `read:repository`; <1.22 any token + write-method blocklist backstop). `Authorization: token <token>` header. 2 capabilities (list_repos/get_recent_ci_runs) → GET only. Gitea Actions disabled → 404 surfaced. Coverage 92.77%. |
-| **REQ-024** | Multi-target scope | F | ✅ PASS | `router.ts`: ≥2 same-type adapters without `target_id` → 400 "target_required" with available targets list (Edge 3). `broker.test.ts:123` + `router.test.ts:74` + Test-Call UI target picker. |
-| **REQ-025** | Proxmox PVEAuditor auth | G | ✅ PASS | `adapters/proxmox/validate.ts`: `GET /api2/json/version` + `GET /api2/json/nodes` at submit (R-002 — validates "token works for reads"; PVEAuditor introspection gap documented in UI help text). Failure → 422 role-violation, no persist. Token via `SecretProvider.put`; DB stores `secret_ref` only. |
-| **REQ-026** | SSH key + whitelist execution | H | ✅ PASS | Registration token via `SecretProvider.put` (INV-3). Two-layer whitelist validation (broker layer 1 + Relay `CheckCommand` layer 2). Non-whitelist → 403 + `adapter.write_rejected`. `CheckCommand(cmd string) error` signature UNCHANGED (G-004 contract lock). **G-021** M1-relay-WS regression test (register/ping/pong) passes. |
-| **REQ-027** | GitHub/Gitea scoped token auth | I | ✅ PASS | GitHub: fine-grained PAT, `metadata:read`+`actions:read` (D-006), classic PAT rejected. Gitea: version-aware (≥1.22 `read:repository`; <1.22 any + blocklist). Insufficient scope → 422, no persist. Tokens via `SecretProvider.put`; DB stores `secret_ref` only. |
-
-**REQ verdict: 13/13 PASS.**
-
----
-
-## 3. M2 Acceptance Gate Check (Spec §6 — 15 Items)
-
-| # | Gate Item | Verdict | Evidence |
-|---|-----------|---------|----------|
-| 1 | M1 acceptance gate still passing (no regression) | ✅ PASS | All M1 suites green: db 12, auth 52, runtime 6, byom 18, control-plane M1 paths (auth-flow 8, relay-ws 6, dashboard 16). Only M1 edit = additive `AuditEventType` widening (G-012). G-021 relay-ws regression test passes. |
-| 2 | All 13 M2 REQs (015-027) have passing tests (Given/When/Then) | ✅ PASS | 13/13 REQs pass (§2). 360 tests in `packages/mcp` + 86 in control-plane + 54 in llm-mock. |
-| 3 | Code coverage ≥ 80% on new M2 modules | ✅ PASS | `packages/mcp` 92.33% stmt / 83.77% branch; `packages/llm-mock` 97.01%; adapters: proxmox 94.7%, ssh 96.73%, github 95.05%, gitea 92.77%, github-mock 94.8%. All ≥ 80%. |
-| 4 | DB coverage ≥ 80% maintained on `packages/db` | ✅ PASS | `packages/db` 98.18% statements / 76.59% branch / 100% funcs. Audit.ts 100%. |
-| 5 | CI/CD pipeline builds successfully (GREEN) | ✅ PASS (defined) | `.gitea/workflows/ci.yml` exists (G-011). Two jobs: `test-pglite` + `test-postgres` (Postgres 16 service container). Pipeline is fully defined; runs green locally (typecheck/lint/test/conformance all pass). CI runner execution requires Gitea Actions enablement + `GITHUB_SMOKE_PAT` secret — see Known Limitations. |
-| 6 | Wave 0 prerequisites: Postgres 16 CI + real GitHub PAT | ✅ PASS (CI defined; PAT is secret to set) | `test-postgres` job uses `postgres:16` service container + `setup-ci-roles.sql` (`coreci_app` NOBYPASSRLS, `migrator` BYPASSRLS) + `DB_MODE=pg`. Real GitHub PAT is a repository secret (`secrets.GITHUB_SMOKE_PAT`) — an operator action, not code. Track A (mock-path) is the P0 gate and needs no PAT. |
-| 7 | Adapter validation: mocks for PVE/SSH/Gitea, real GitHub smoke (Track B optional) | ✅ PASS | Proxmox/SSH/Gitea validated via mocks. GitHub: Track A (mock-path, `github-mock` canned repos) is the P0 gate; Track B (real GitHub) is `allow-failure`/skipped when PAT absent (G-018). |
-| 8 | LLM smoke: Track A (mock-path) passes (P0 gate) | ✅ PASS | `tests/llm-smoke/llm-smoke.test.ts`: Track A 6 tests pass — full OpenAI→MCP→adapter→result→synthesis path with canned repos, deterministic, wording-tolerant (G-019 regex). Track B 1 skipped (no PAT). |
-| 9 | INV-7 verified by tests (per-adapter write-rejection) | ✅ PASS | Per-adapter write-blocklist tests: proxmox 5, gitea 6, github 4, ssh 11. `WriteBlockedError` → 403 + `adapter.write_rejected` audit wired in invoke route. Adapter never invoked. G-015 framing: registry primary, blocklist backstop — both audited. |
-| 10 | Multi-target scope verified | ✅ PASS | `broker.test.ts:123` (400 target_required), `router.test.ts:74`, Test-Call UI target picker. |
-| 11 | Rate limit verified | ✅ PASS | `rate-limiter.test.ts` (8 tests): 60/min user + 300/min tenant, 429 + Retry-After, refund-on-tenant-fail, no audit on 429. |
-| 12 | SSE streaming verified | ✅ PASS | `stream-manager.test.ts` (15 tests): ULID, terminal events, 30s not-opened timeout (R-006), client disconnect (Edge 8) no-audit. Conformance happy/error. |
-| 13 | Adapter audit events visible in audit export | ✅ PASS | `/api/audit/export` (CSV) selects all `audit_log` rows incl. `adapter.*` event types (union widened G-012). `adapter.configured`, `test_connection.{succeeded,failed}`, `capability_invoked`, `write_rejected` all emitted. |
-| 14 | Security/Compliance review: audit completeness, secret handling, RLS, write-rejection | ✅ PASS | Audit hash-chain intact (M1 appendAudit); 5 new event types hash-chained. Secrets via SecretProvider only (INV-3); DB stores `secret_ref`; no plaintext. RLS on `mcp_adapters` (FORCE + WITH CHECK, verified migration 0003). Write-rejection defense-in-depth (registry + blocklist + SSH 3-layer). |
-| 15 | MCP conformance verification artifact (PROTOCOL.md + 7 tests) | ✅ PASS | `packages/mcp/PROTOCOL.md` (spec version pin, 4 transports, JSON-RPC shapes, OpenAI↔MCP translation, synthetic lifecycle, INV-7 framing, two enforcement models, future risks). 7 conformance files / 32 tests (tools-list, call-happy, call-error, invalid-args, translator, lifecycle, **stdio-interop** G-017). |
-
-**Gate verdict: 15/15 PASS.**
-
----
-
-## 4. Code Quality Summary
-
-### Correctness
-All 13 REQs meet their acceptance criteria. The BDD Given/When/Then scenarios
-from the spec are covered by tests. Edge cases (1-8) are exercised: write
-rejection (Edge 1), upstream timeout (Edge 2 → 504), multi-target (Edge 3 → 400),
-invalid args (Edge 4 → 400), rate limit (Edge 5 → 429), secret failure (Edge 6 →
-503), SSH whitelist (Edge 7 → 403 two layers), SSE disconnect (Edge 8 → no
-audit).
-
-### Testing
-Comprehensive. 656 tests total. Unit + integration + conformance + LLM smoke +
-cross-layer SSH + relay-ws regression. Mock-first strategy (no live PVE/SSH/Gitea
-in CI; GitHub via two-track smoke). Coverage above gate on all M2 modules.
-
-### Security
-- **INV-7 (read-only):** Two-layer enforcement — closed 9-tool registry (PRIMARY)
-  + write-method blocklist (BACKSTOP, G-015 framing). Per-adapter write-rejection
-  tests for all 4 types. SSH adds a third layer (no-shell `exec.Command`).
-- **Defense-in-depth SSH (G-013):** Divergence matrix (4 cases) verified; Go deny
-  list tightened (bare `rm`); documented `$()` divergence is safe under no-shell.
-- **SecretProvider (INV-3):** All adapter credentials via `SecretProvider.put`;
-  DB stores `secret_ref` only. No env/config fallback. No secrets logged.
-- **RLS (INV-2):** `mcp_adapters` migration has `FORCE ROW LEVEL SECURITY` +
-  `WITH CHECK`. All queries under `withTenant`. CI `test-postgres` job verifies
-  against real Postgres 16 (G-022) — the first real-RLS test.
-- **Audit (INV-4):** 5 new event types hash-chained via M1 `appendAudit`.
-- **GitHub PAT (D-006):** Fine-grained only; classic rejected by prefix.
-- **Gitea (R-005):** Version-aware scope routing.
-
-### Performance
-- Rate limiter: O(1) token-bucket check, sync (in-memory) — well under 5ms NFR.
-- SSE: synchronous event encoding — chunk delivery <100ms NFR achievable.
-- Upstream timeout: 10s `AbortSignal.timeout` on all adapter HTTP calls; 9.5s
-  agent exec timeout (R-003 — agent times out first).
-
-### Maintainability
-- `McpAdapter` interface (G-020) — contract for in-process + WebSocket-backed
-  adapters; enabled F→G/H/I parallelism.
-- `PROTOCOL.md` documents spec pin, transports, JSON-RPC shapes, translation
-  contract, INV-7 framing, two enforcement models, future risks (GraphQL, PVE
-  GET-with-side-effects).
-- Code follows M1 patterns: `withTenant`, `appendAudit`, `requireAuth`,
-  `SecretProvider`, route-handler structure.
-- No TODO/FIXME in shipped `packages/mcp/src`.
-- All commits have `---ci---` blocks (phase/milestone/status/wave).
-
----
-
-## 5. Test Results
-
-| Suite | Files | Tests | Result |
-|-------|-------|-------|--------|
-| packages/config | 1 | 6 | ✅ pass |
-| packages/llm-mock | 3 | 54 | ✅ pass |
-| packages/secrets | 2 | 24 | ✅ pass |
-| packages/db | 3 | 12 | ✅ pass |
-| packages/runtime | 1 | 6 | ✅ pass |
-| packages/auth | 5 | 52 | ✅ pass |
-| packages/mcp | 27 | 360 | ✅ pass |
-| packages/byom | 3 | 18 | ✅ pass |
-| apps/control-plane | 7 | 86 | ✅ pass |
-| **Unit/integration total** | **52** | **618** | ✅ **pass** |
-| Conformance (7 files) | 7 | 32 | ✅ pass |
-| LLM smoke (Track A) | 1 | 6 pass + 1 skipped | ✅ pass (Track B allow-failure) |
-| **Conformance + smoke total** | **8** | **38 pass + 1 skip** | ✅ **pass** |
-| **GRAND TOTAL** | **60** | **656 pass + 1 skip** | ✅ **all green** |
-
-Commands run (all green):
-- `npx pnpm typecheck` — 9 workspace projects, no TS errors.
-- `npx pnpm lint` — 9 projects, `--max-warnings 0`, clean.
-- `npx pnpm test` — 618 tests green.
-- `npx pnpm test:conformance` — 38 green + 1 skipped (Track B real-GitHub).
-- `npx pnpm --filter @coreci/db test:pen` — 5 RLS pen-tests green.
-- `node scripts/check-llm-mock-guard.mjs` — no llm-mock in prod source (R-008).
-- Go tests (`apps/relay-agent`) — present; require `go` toolchain (CI runs them).
-
----
-
-## 6. Coverage
-
-| Module | Statements | Branch | Funcs | Lines | Gate (≥80%) |
-|--------|-----------|--------|-------|-------|-------------|
-| `packages/mcp` (all) | **92.33%** | 83.77% | 94.47% | 92.33% | ✅ |
-| `packages/mcp` src (broker/registry/router/...) | 96.63% | 85.86% | 94.54% | 96.63% | ✅ |
-| `packages/mcp` src/adapters (all) | 86.46% | 87.5% | 83.33% | 86.46% | ✅ |
-| `packages/mcp` src/adapters/proxmox | 94.7% | 85.31% | 97.72% | 94.7% | ✅ |
-| `packages/mcp` src/adapters/ssh | 96.73% | 88.7% | 90.9% | 96.73% | ✅ |
-| `packages/mcp` src/adapters/github | 95.05% | 82.5% | 97.56% | 95.05% | ✅ |
-| `packages/mcp` src/adapters/gitea | 92.77% | 80.91% | 97.22% | 92.77% | ✅ |
-| `packages/mcp` src/adapters/github-mock | 94.8% | 93.33% | 100% | 94.8% | ✅ |
-| `packages/mcp` src/transport (in-process/stdio) | 53.59% | 60% | 77.77% | 53.59% | ⚠️ see note |
-| `packages/llm-mock` | **97.01%** | 89.65% | 91.66% | 97.01% | ✅ |
-| `packages/db` | **98.18%** | 76.59% | 100% | 98.18% | ✅ (gate 4) |
-
-**Note on transport coverage:** `stdio.ts` reports 11.62% statement coverage
-because it is exercised by the `stdio-interop.test.ts` conformance test, which
-spawns the broker stdio server as a **child process** — the in-process v8
-coverage instrumenter cannot see into the subprocess. The stdio path IS
-verified (4 conformance tests, real `tools/list` + `tools/call` over
-stdin/stdout). This is a coverage-measurement artifact, not a coverage gap.
-`in-process.ts` at 73.87% is below the 80% file-level bar but is exercised
-end-to-end by the conformance suite. The aggregate `packages/mcp` coverage
-(92.33%) is well above the gate.
-
----
-
-## 7. GRILL Binding Fixes (G-011..G-022) — All Applied
-
-| ID | Severity | Fix | Applied | Evidence |
-|----|----------|-----|---------|----------|
-| G-011 | **P0** | Build CI/CD pipeline as Wave 0 task | ✅ | `.gitea/workflows/ci.yml` — 2 jobs, Postgres 16, roles, caching, coverage upload. |
-| G-012 | P1 | M1 audit-type union widening (M1-file edit) | ✅ | `packages/db/src/audit.ts:35-39` — 5 new types; comment labels it "M1 file edit". |
-| G-013 | P1 | Cross-layer SSH divergence matrix (4 cases) + Go deny-list tightening | ✅ | `cross-layer.test.ts` (4 cases); bare `rm` in Go deny list. |
-| G-014 | P1 | Closed-tool-set gap documentation in UI help text | ✅ | `_help.ts` — SSH/Proxmox/GitHub/Gitea limitations documented. |
-| G-015 | P1 | INV-7 framing: registry primary, blocklist backstop | ✅ | `write-blocklist.ts` docstring + `PROTOCOL.md` §INV-7. |
-| G-016 | P1 | Two enforcement models + future risks (GraphQL/PVE-GET) | ✅ | `write-blocklist.ts` (method blocklist / scope-via-403 / command-allowlist) + `PROTOCOL.md`. |
-| G-017 | P1 | 7th conformance test over stdio | ✅ | `stdio-interop.test.ts` (4 tests, real round-trip). |
-| G-018 | **P0** | `github-mock` adapter + two-track LLM smoke | ✅ | `adapters/github-mock/`; Track A (P0 gate) + Track B (allow-failure). |
-| G-019 | **P0** | Harden llm-mock pattern matching (regex) + retry policy | ✅ | `patterns.ts` regex set; `retry.ts` 3× exponential backoff. |
-| G-020 | P1 | Documented `McpAdapter` interface | ✅ | `types.ts:75` — `McpAdapter`; stubs + real adapters implement it. |
-| G-021 | P1 | M1-relay-WS regression test + Go reader restructure | ✅ | `relay-ws-tool-call.test.ts` (register/ping/pong); Go dispatches on `type`. |
-| G-022 | P1 | Full M1 suite against Postgres 16 in Wave 0 | ✅ | `test-postgres` CI job runs full `pnpm test` with `DB_MODE=pg`. |
-
-**Binding fixes: 12/12 applied.**
-
----
-
-## 8. Project Health Audit
-
-### Reconstruction test
-The git log (8 commits on `phase/06-final-review-ship` since `main`) matches the
-`.ciagent/` story: Phase 0 (pre-execution) → Phase 1 (Wave F) → Phase 2 (Wave G)
-→ Phase 3 (Wave H) → Phase 4 (Wave I) → Phase 5 (Wave J) → Phase 6 (Final). Every
-commit carries a `---ci---` block with `phase`, `milestone: v0.2`, `status`, and
-`wave` fields. Decisions (CLARIFY D-006/D-007), research (R-001..R-009), the
-GRILL (G-011..G-022), and the per-wave verify artifacts (M2-VERIFY-P01) are all
-traceable to commits.
-
-### File/branch/commit discipline
-- All implementation commits are on `phase/NN-*` branches (now merged into the
-  `phase/06-final-review-ship` integration branch).
-- All commits have `---ci---` blocks — verified by grep across `main..HEAD`.
-- Tags exist for each phase: `v0.1.0` (Phase 0) through `v0.1.5` (Phase 5).
-  `v0.1.6` (this phase) will be tagged at ship. M1 tags `v0.0.1`..`v0.0.7` intact.
-- No direct commits to `main` (the milestone merges via PR-style commits).
-- `milestone/v0.2-mcp-layer-day1-adapters` branch exists as the milestone
-  integration branch; final merge to `main` happens at ship.
-
-### Territory discipline (lead-developer coordination)
-- **data-engineer:** `mcp_adapters` migration + RLS + `AuditEventType` widening.
-- **backend-engineer:** broker, adapters, routes, llm-mock, SSE.
-- **go-engineer:** Relay Agent `tool_call` handler + reader restructure (Wave H
-  only; territory reverts to backend post-H).
-- **frontend-engineer:** Settings → Adapters UI + Test-Call UI.
-- **security-engineer:** write-blocklist sign-off, defense-in-depth, scope
-  validation (documented in PROTOCOL.md + test assertions).
-- No direct DB access from frontend (UI reads via API gateway — D-005 pattern).
-- No UI logic in backend services (routes are thin REST facades).
-
----
-
-## 9. Known Limitations (Post-M2, Not Blockers)
-
-1. **CI runner execution unverified in this environment.** The CI pipeline
-   (`.gitea/workflows/ci.yml`) is fully defined and the equivalent commands run
-   green locally (typecheck/lint/test/conformance/coverage). Actual Gitea
-   Actions execution requires the runner to be enabled on `git.cloudinit.dev`
-   and the `GITHUB_SMOKE_PAT` repository secret to be set by an operator. This
-   is an operational prerequisite, not a code defect. **Action for ship:**
-   operator enables the runner + sets the secret; the first green CI run
-   closes the loop.
-
-2. **`stdio.ts` coverage measurement artifact.** 11.62% statement coverage is a
-   v8-instrumenter limitation (child-process coverage is not captured). The
-   stdio path is verified by 4 conformance tests. M3 may add subprocess
-   coverage merging if the measurement matters for the gate.
-
-3. **`in-process.ts` at 73.87%** (below the 80% file-level bar). The aggregate
-   `packages/mcp` coverage (92.33%) is above the gate. The uncovered lines are
-   exercised by the conformance suite. M3 may add targeted unit tests.
-
-4. **Real-GitHub smoke (Track B) is allow-failure.** Per G-018, the P0 gate is
-   Track A (mock-path). Track B proves real-target connectivity when the PAT is
-   available; it does not block the gate on GitHub outages. This is the
-   resolved P0 from GRILL E-002.
-
-5. **No `gitea.get_workflow_run` in M2** (deferred to v1.2+ per Q2). Gitea users
-   have a strictly weaker surface than GitHub users for the same adapter class.
-   Documented in UI help text (G-014).
-
-6. **PVEAuditor introspection gap (R-002).** PVE has no clean "what role does
-   this token have" endpoint. The broker validates "token works for reads," not
-   "token lacks writes." The write-method blocklist is the load-bearing
-   boundary. Documented in UI help text. Confidence 0.70 on this sub-point.
-
-7. **No live Proxmox/SSH/Gitea in CI.** Validated via mocks (gate item 7).
-   Real-instance validation is an operational pre-prod check, not an M2 gate.
-
-8. **Go tests require the `go` toolchain** (not installed in this review
-   environment). The relay-agent test files (`handler_test.go`,
-   `whitelist_test.go`) are present and the CI pipeline runs `go test ./...`.
-
----
-
-## 10. P0/P1 Findings
-
-**P0 findings: 0.** The two P0 blockers from the GRILL (no CI; no LLM-smoke
-fallback) are resolved by G-011/G-018/G-019. No new P0 findings in this review.
-
-**P1 findings: 0.** The single P1 lesson from M2-VERIFY-P01 (403 +
-`adapter.write_rejected` audit not wired in the invoke flow) is **closed** —
-`invoke/route.ts:114-135` now catches `WriteBlockedError`, emits the 403 + audit,
-and never invokes the adapter. Per-adapter write-blocklist tests exist for all 4
-adapter types.
-
-**P2 findings (cosmetic, non-blocking, recorded for M3):**
-- `stdio.ts` coverage measurement artifact (§9.2).
-- `in-process.ts` file-level coverage 73.87% (§9.3).
-- `cache.ts` branch coverage 80% (at the threshold, not below).
-
----
-
-## 11. Verdict
-
-### M2 is ready to ship as v0.1.6.
-
-- **13/13 REQs (015-027) PASS** their acceptance criteria with Given/When/Then
-  test coverage.
-- **15/15 M2 gate items PASS** (§6 of the spec).
-- **656 tests green** (618 unit/integration + 38 conformance; 1 skipped =
-  real-GitHub Track B allow-failure).
-- **Coverage ≥ 80%** on all new M2 modules (`packages/mcp` 92.33%,
-  `packages/llm-mock` 97.01%, all adapter sub-packages ≥ 86%). DB coverage
-  98.18% (gate 4).
-- **M1 non-regression** holds — all M1 tests pass.
-- **All 12 GRILL binding fixes (G-011..G-022) applied.**
-- **INV-7 (read-only) verified** at the broker with per-adapter write-rejection
-  tests; SSH defense-in-depth (3 layers) verified.
-- **No P0 or P1 findings.** Three P2 cosmetic notes recorded for M3.
-- **Operational prerequisites for full CI green** (runner enablement +
-  `GITHUB_SMOKE_PAT` secret) are operator actions, not code blockers; the P0
-  gate (Track A mock-path) does not depend on them.
-
-**Ship actions:**
-1. Tag `v0.1.6` (this phase = M2 milestone release).
-2. Merge `phase/06-final-review-ship` → `milestone/v0.2-mcp-layer-day1-adapters`
-   → `main`.
-3. Mark all M2 REQs (015-027) complete in `REQUIREMENTS.md`.
-4. Mark M2 complete in `ROADMAP.md`.
-5. Operator: enable the Gitea Actions runner + set `GITHUB_SMOKE_PAT` for the
-   optional Track B real-GitHub smoke.
-
----
-
-*End of M2-REVIEW. M2 (v0.2) PASS — ready to ship as v0.1.6.*

.ciagent/REQUIREMENTS.md

@@ -5,31 +5,31 @@ Milestone type: **Feature** (new MCP adapters are `feat:` phases). Tags run on t
 
 Predecessor M1 (COMPLETE): REQ-001..014, 038, 039, 040 (17 REQs, all PASS, shipped v0.0.1..v0.0.7).
 
-## M2 Requirements (this milestone — REQ-015..027, 13 REQs — COMPLETE, shipped v0.1.6)
+## M2 Requirements (this milestone — REQ-015..027, 13 REQs)
 
 All acceptance criteria verbatim from M2 spec §4. Every REQ inherits M1 invariants: INV-1 (auth gateway ordering), INV-2 (`withTenant` + RLS), INV-3 (SecretProvider only), INV-4 (audit completeness), INV-7 (read-only). The broker is the load-bearing safety boundary for INV-7.
 
 ### MCP Capability Broker Gateway
 
-- [x] **REQ-015** (J2, High) Define abstract MCP tool schema — **Given** the broker exposes the closed read-only tool set, **when** a tool is registered, **then** it has `name`, `description`, `inputSchema` (JSON Schema) per MCP standard, the schema is in the broker's tool registry before any adapter invocation, any tool call with arguments not matching `inputSchema` returns HTTP 400 with a schema-validation error, **and** the tool registry is closed and enumerated with per-tenant policy able to disable individual tools but never add new ones. M2 starter set is locked at: `proxmox.list_vms` (inventory), `proxmox.get_vm_status` (live), `proxmox.get_node_metrics` (live), `ssh.run_whitelisted_command` (live), `github.list_repos` (inventory), `github.get_recent_ci_runs` (live), `github.get_workflow_run` (live), `gitea.list_repos` (inventory), `gitea.get_recent_ci_runs` (live).
-- [x] **REQ-01[5-9]** (J1, J2, High) Route abstract MCP calls to tenant-specific adapter — **Given** an MCP tool call request with a tenant-scoped adapter binding `(tenant_id, adapter_type, target_id)`, **when** the broker receives the call, **then** the call is routed to the adapter resolved by that tuple, the response is returned as an SSE stream, and routing errors return HTTP 404 with a structured error.
-- [x] **REQ-01[5-9]** (J2, High) Stream tool execution output to chat UI via SSE — **Given** the broker invokes an adapter capability, **when** the adapter returns partial or complete output, **then** the broker emits an SSE stream on `GET /api/mcp/stream/:correlationId` with `Content-Type: text/event-stream` and each event has `id`, `event`, `data` fields per the SSE specification; the stream terminates with a terminal event (`done` or `error`) on completion or error. Per-call lifecycle: one stream per capability invocation; correlation ID = ULID minted at `POST /api/mcp/invoke`. Client disconnect (Edge 8) cancels in-flight adapter call; no audit event for client-side cancellation.
-- [x] **REQ-01[5-9]** (Edge 1, Edge 7, High) Enforce read-only at MCP gateway proxy layer — **Given** a write-capable method per the adapter's known write surface (Proxmox: POST/PUT/DELETE; SSH: non-whitelist commands; GitHub: scopes outside `metadata:read`+`actions:read`; Gitea: POST/PUT/DELETE/PATCH on all endpoints), **when** the request reaches the broker, **then** the broker rejects with HTTP 403, appends `adapter.write_rejected` audit event, and never invokes the adapter; verified by a test per adapter at the M2 gate. The broker is the load-bearing safety boundary (INV-7 enforcement at the gateway, not at the adapter).
-- [x] **REQ-01[5-9]** (Edge 5, High) Apply token-bucket rate limit per user and per tenant — **Given** a user has exceeded 60 req/min OR a tenant has exceeded 300 req/min, **when** any subsequent capability invocation is attempted, **then** the broker returns HTTP 429 with `Retry-After` header and no adapter call is made; rate limit state is process-local in M2 (in-memory token-bucket, capacity = rate, refill 1/sec user / 5/sec tenant).
+- [ ] **REQ-015** (J2, High) Define abstract MCP tool schema — **Given** the broker exposes the closed read-only tool set, **when** a tool is registered, **then** it has `name`, `description`, `inputSchema` (JSON Schema) per MCP standard, the schema is in the broker's tool registry before any adapter invocation, any tool call with arguments not matching `inputSchema` returns HTTP 400 with a schema-validation error, **and** the tool registry is closed and enumerated with per-tenant policy able to disable individual tools but never add new ones. M2 starter set is locked at: `proxmox.list_vms` (inventory), `proxmox.get_vm_status` (live), `proxmox.get_node_metrics` (live), `ssh.run_whitelisted_command` (live), `github.list_repos` (inventory), `github.get_recent_ci_runs` (live), `github.get_workflow_run` (live), `gitea.list_repos` (inventory), `gitea.get_recent_ci_runs` (live).
+- [ ] **REQ-016** (J1, J2, High) Route abstract MCP calls to tenant-specific adapter — **Given** an MCP tool call request with a tenant-scoped adapter binding `(tenant_id, adapter_type, target_id)`, **when** the broker receives the call, **then** the call is routed to the adapter resolved by that tuple, the response is returned as an SSE stream, and routing errors return HTTP 404 with a structured error.
+- [ ] **REQ-017** (J2, High) Stream tool execution output to chat UI via SSE — **Given** the broker invokes an adapter capability, **when** the adapter returns partial or complete output, **then** the broker emits an SSE stream on `GET /api/mcp/stream/:correlationId` with `Content-Type: text/event-stream` and each event has `id`, `event`, `data` fields per the SSE specification; the stream terminates with a terminal event (`done` or `error`) on completion or error. Per-call lifecycle: one stream per capability invocation; correlation ID = ULID minted at `POST /api/mcp/invoke`. Client disconnect (Edge 8) cancels in-flight adapter call; no audit event for client-side cancellation.
+- [ ] **REQ-018** (Edge 1, Edge 7, High) Enforce read-only at MCP gateway proxy layer — **Given** a write-capable method per the adapter's known write surface (Proxmox: POST/PUT/DELETE; SSH: non-whitelist commands; GitHub: scopes outside `metadata:read`+`actions:read`; Gitea: POST/PUT/DELETE/PATCH on all endpoints), **when** the request reaches the broker, **then** the broker rejects with HTTP 403, appends `adapter.write_rejected` audit event, and never invokes the adapter; verified by a test per adapter at the M2 gate. The broker is the load-bearing safety boundary (INV-7 enforcement at the gateway, not at the adapter).
+- [ ] **REQ-019** (Edge 5, High) Apply token-bucket rate limit per user and per tenant — **Given** a user has exceeded 60 req/min OR a tenant has exceeded 300 req/min, **when** any subsequent capability invocation is attempted, **then** the broker returns HTTP 429 with `Retry-After` header and no adapter call is made; rate limit state is process-local in M2 (in-memory token-bucket, capacity = rate, refill 1/sec user / 5/sec tenant).
 
 ### Adapters — Day 1 Integrations
 
- - [x] **REQ-020** (J1, J2, High) Implement read-only Proxmox MCP adapter — **Given** a Proxmox adapter is configured with a `PVEAuditor`-scoped API token, **when** an MCP tool call routes to it, **then** the adapter calls only Proxmox GET endpoints (e.g., `/api2/json/nodes`, `/api2/json/qemu`, `/api2/json/nodes/{node}/qemu/{vmid}/status/current`) and never mutates state; supported capabilities include `proxmox.list_vms` (inventory), `proxmox.get_vm_status`, `proxmox.get_node_metrics`.
- - [x] **REQ-021** (J1, J2, High) Implement read-only SSH/Linux Server MCP adapter — **Given** an SSH adapter is configured via M1 Relay Agent (REQ-026), **when** an MCP tool call routes to it, **then** the adapter invokes only commands from the fixed whitelist subset (`uptime`, `df -h`, `free -m`, `systemctl status <svc>`, `journalctl -n <N>`, `systemctl list-units --type=service`) via the M1 Relay whitelist hook; the broker validates `command` against this subset BEFORE dispatch to the Relay Agent (defense-in-depth layer 1); the Relay Agent `CheckCommand` is the second enforcement layer (layer 2); non-whitelist commands return HTTP 403 (REQ-026).
- - [x] **REQ-022** (J1, J2, High) Implement read-only GitHub MCP adapter — **Given** a GitHub adapter is configured with a fine-grained PAT (`metadata:read` + `actions:read` minimum per D-006), **when** an MCP tool call routes to it, **then** the adapter calls only GitHub REST GET endpoints and rejects any token lacking required scopes; supported capabilities include `github.list_repos` (inventory), `github.get_recent_ci_runs`, `github.get_workflow_run`.
- - [x] **REQ-023** (J1, J2, High) Implement read-only Gitea MCP adapter — **Given** a Gitea adapter is configured with a read-only token, **when** an MCP tool call routes to it, **then** the adapter calls only Gitea REST GET endpoints and rejects any token lacking required read scopes; version-aware validation: Gitea ≥1.22 requires `read:repository` scope; Gitea <1.22 accepts any token with broker-side write-method blocklist (POST/PUT/DELETE/PATCH) as security backstop; supported capabilities mirror the GitHub adapter (`gitea.list_repos`, `gitea.get_recent_ci_runs`).
- - [x] **REQ-024** (Edge 3, High) Scope MCP queries to explicitly selected target in multi-target tenants — **Given** a tenant has multiple adapters of the same type configured (e.g., 2 Proxmox hosts), **when** a capability invocation is received without an explicit `target_id` for that adapter type, **then** the broker returns HTTP 400 "target required" with a list of available targets; the UI surfaces a target picker.
+- [ ] **REQ-020** (J1, J2, High) Implement read-only Proxmox MCP adapter — **Given** a Proxmox adapter is configured with a `PVEAuditor`-scoped API token, **when** an MCP tool call routes to it, **then** the adapter calls only Proxmox GET endpoints (e.g., `/api2/json/nodes`, `/api2/json/qemu`, `/api2/json/nodes/{node}/qemu/{vmid}/status/current`) and never mutates state; supported capabilities include `proxmox.list_vms` (inventory), `proxmox.get_vm_status`, `proxmox.get_node_metrics`.
+- [ ] **REQ-021** (J1, J2, High) Implement read-only SSH/Linux Server MCP adapter — **Given** an SSH adapter is configured via M1 Relay Agent (REQ-026), **when** an MCP tool call routes to it, **then** the adapter invokes only commands from the fixed whitelist subset (`uptime`, `df -h`, `free -m`, `systemctl status <svc>`, `journalctl -n <N>`, `systemctl list-units --type=service`) via the M1 Relay whitelist hook; the broker validates `command` against this subset BEFORE dispatch to the Relay Agent (defense-in-depth layer 1); the Relay Agent `CheckCommand` is the second enforcement layer (layer 2); non-whitelist commands return HTTP 403 (REQ-026).
+- [ ] **REQ-022** (J1, J2, High) Implement read-only GitHub MCP adapter — **Given** a GitHub adapter is configured with a fine-grained PAT (`metadata:read` + `actions:read` minimum per D-006), **when** an MCP tool call routes to it, **then** the adapter calls only GitHub REST GET endpoints and rejects any token lacking required scopes; supported capabilities include `github.list_repos` (inventory), `github.get_recent_ci_runs`, `github.get_workflow_run`.
+- [ ] **REQ-023** (J1, J2, High) Implement read-only Gitea MCP adapter — **Given** a Gitea adapter is configured with a read-only token, **when** an MCP tool call routes to it, **then** the adapter calls only Gitea REST GET endpoints and rejects any token lacking required read scopes; version-aware validation: Gitea ≥1.22 requires `read:repository` scope; Gitea <1.22 accepts any token with broker-side write-method blocklist (POST/PUT/DELETE/PATCH) as security backstop; supported capabilities mirror the GitHub adapter (`gitea.list_repos`, `gitea.get_recent_ci_runs`).
+- [ ] **REQ-024** (Edge 3, High) Scope MCP queries to explicitly selected target in multi-target tenants — **Given** a tenant has multiple adapters of the same type configured (e.g., 2 Proxmox hosts), **when** a capability invocation is received without an explicit `target_id` for that adapter type, **then** the broker returns HTTP 400 "target required" with a list of available targets; the UI surfaces a target picker.
 
 ### Adapter Authentication
 
- - [x] **REQ-025** (J1, High) Authenticate to Proxmox via scoped API token + PVEAuditor — **Given** a Proxmox adapter config submission, **when** the token is submitted, **then** the broker verifies the token's role on the target is `PVEAuditor` before persisting; tokens without `PVEAuditor` return HTTP 422 with role-violation error and no config is persisted; the token is stored via `SecretProvider.set` (INV-3).
- - [x] **REQ-026** (J1, Edge 7, High) Authenticate to Linux servers via SSH key + whitelist execution — **Given** an SSH adapter config submission, **when** the Relay registration token is stored via `SecretProvider.set` (INV-3), **then** all subsequent SSH commands are validated against the fixed whitelist subset at two layers: (1) broker validates `command` before dispatch, (2) M1 Relay Agent `CheckCommand` validates at execution; non-whitelisted commands return HTTP 403 with a structured error and `adapter.write_rejected` audit event is appended.
- - [x] **REQ-027** (J1, High) Authenticate to GitHub and Gitea via scoped API tokens — **Given** a GitHub or Gitea adapter config submission, **when** the token is submitted, **then** the broker validates token scopes before persisting (GitHub: fine-grained PAT with `metadata:read` + `actions:read` minimum per D-006; Gitea ≥1.22: `read:repository` minimum; Gitea <1.22: any token accepted with broker-side write-method blocklist as security backstop); insufficient scopes return HTTP 422 with scope-violation error and no config is persisted; the token is stored via `SecretProvider.set` (INV-3).
+- [ ] **REQ-025** (J1, High) Authenticate to Proxmox via scoped API token + PVEAuditor — **Given** a Proxmox adapter config submission, **when** the token is submitted, **then** the broker verifies the token's role on the target is `PVEAuditor` before persisting; tokens without `PVEAuditor` return HTTP 422 with role-violation error and no config is persisted; the token is stored via `SecretProvider.set` (INV-3).
+- [ ] **REQ-026** (J1, Edge 7, High) Authenticate to Linux servers via SSH key + whitelist execution — **Given** an SSH adapter config submission, **when** the Relay registration token is stored via `SecretProvider.set` (INV-3), **then** all subsequent SSH commands are validated against the fixed whitelist subset at two layers: (1) broker validates `command` before dispatch, (2) M1 Relay Agent `CheckCommand` validates at execution; non-whitelisted commands return HTTP 403 with a structured error and `adapter.write_rejected` audit event is appended.
+- [ ] **REQ-027** (J1, High) Authenticate to GitHub and Gitea via scoped API tokens — **Given** a GitHub or Gitea adapter config submission, **when** the token is submitted, **then** the broker validates token scopes before persisting (GitHub: fine-grained PAT with `metadata:read` + `actions:read` minimum per D-006; Gitea ≥1.22: `read:repository` minimum; Gitea <1.22: any token accepted with broker-side write-method blocklist as security backstop); insufficient scopes return HTTP 422 with scope-violation error and no config is persisted; the token is stored via `SecretProvider.set` (INV-3).
 
 ## M1 Requirements (predecessor — COMPLETE, for non-regression reference)
 
@@ -90,19 +90,19 @@ REQ-028 (chat UI), REQ-029 (NL input), REQ-030 (streaming response + citations),
 | REQ-012 | M1 | Wave D | complete |
 | REQ-013 | M1 | Wave D | complete |
 | REQ-014 | M1 | Wave E | complete |
-| REQ-015 | M2 | Phase 1 (Wave F) | complete |
-| REQ-016 | M2 | Phase 1 (Wave F) | complete |
-| REQ-017 | M2 | Phase 1+5 (Wave F+J) | complete |
-| REQ-018 | M2 | Phase 1+2+3+4 (Wave F+G+H+I) | complete |
-| REQ-019 | M2 | Phase 1 (Wave F) | complete |
-| REQ-020 | M2 | Phase 2 (Wave G) | complete |
-| REQ-021 | M2 | Phase 3 (Wave H) | complete |
-| REQ-022 | M2 | Phase 4 (Wave I) | complete |
-| REQ-023 | M2 | Phase 4 (Wave I) | complete |
-| REQ-024 | M2 | Phase 1 (Wave F) | complete |
-| REQ-025 | M2 | Phase 2 (Wave G) | complete |
-| REQ-026 | M2 | Phase 3 (Wave H) | complete |
-| REQ-027 | M2 | Phase 4 (Wave I) | complete |
+| REQ-015 | M2 | — | active (this run) |
+| REQ-016 | M2 | — | active (this run) |
+| REQ-017 | M2 | — | active (this run) |
+| REQ-018 | M2 | — | active (this run) |
+| REQ-019 | M2 | — | active (this run) |
+| REQ-020 | M2 | — | active (this run) |
+| REQ-021 | M2 | — | active (this run) |
+| REQ-022 | M2 | — | active (this run) |
+| REQ-023 | M2 | — | active (this run) |
+| REQ-024 | M2 | — | active (this run) |
+| REQ-025 | M2 | — | active (this run) |
+| REQ-026 | M2 | — | active (this run) |
+| REQ-027 | M2 | — | active (this run) |
 | REQ-028 | M3 | — | deferred |
 | REQ-029 | M3 | — | deferred |
 | REQ-030 | M3 | — | deferred |

.ciagent/ROADMAP.md

@@ -6,15 +6,8 @@ Placeholder roadmap for the `coreci-chat` project. The full phase breakdown will
 
 Milestone type: **NFR** (placeholder — to be re-evaluated by `getMilestoneType()` once phases are defined). Tags will run on the previous minor's patch line: phase 0 → `v0.0.1` (no prior tags exist, so the v0.0.x line is seeded here).
 
-## Milestones
-
-- [x] **v0.1 — M1: Read-Only Diagnostic MVP** (COMPLETE, shipped v0.0.1..v0.0.7). All 17 M1 REQs (001-014, 038, 039, 040) pass. 189 tests green. Verified in `.ciagent/M1-REVIEW.md`.
-- [x] **v0.2 — M2: MCP Layer & Day 1 Adapters** (COMPLETE, shipped v0.1.0..v0.1.6). All 13 M2 REQs (015-027) pass. 656 tests green. Verified in `.ciagent/M2-REVIEW.md`.
-
 ## Phases
 
-### v0.0.x — M1: Read-Only Diagnostic MVP
-
 - [x] **Phase 0: pre-execution** - Capture specification, clarification, research, and plan artifacts before any implementation (SHIPPED v0.0.1)
 - [x] **Phase 1: Wave A — Foundations** - Monorepo, Postgres+RLS, audit hash-chain, SecretProvider, Trigger.dev bootstrap (REQ-038, 039, 040) (SHIPPED v0.0.2)
 - [x] **Phase 2: Wave B — Identity & RBAC** - WorkOS SSO, tenant provisioning, RBAC at gateway, invitations, roles (REQ-001..005) (SHIPPED v0.0.3)
@@ -23,21 +16,9 @@ Milestone type: **NFR** (placeholder — to be re-evaluated by `getMilestoneType
 - [x] **Phase 5: Wave E — Dashboard surfacing** - Status fan-out, green/yellow/red, logs, RLS views (REQ-014) (SHIPPED v0.0.6)
 - [x] **Phase 6: Final — Review + Ship** - Multi-persona review, audit, milestone ship v0.1.0 (SHIPPED v0.0.7)
 
-### v0.1.x — M2: MCP Layer & Day 1 Adapters
-
-- [x] **Phase 0: pre-execution** - M2 spec, clarify (D-006/D-007), research (R-001..R-009), plan (Waves F/G/H/I/J + Final + Wave 0), grill (G-011..G-022, all 12 binding fixes applied) (SHIPPED v0.1.0)
-- [x] **Phase 1: Wave F — MCP Gateway core** - Closed 9-tool registry, adapter router, write-method blocklist (INV-7 at broker), token-bucket rate limiter, SSE stream manager, OpenAI↔MCP translator, in-process + stdio transports, synthetic lifecycle handshake, `mcp_adapters` table + RLS, 5 API routes, audit type widening, MCP conformance artifact (PROTOCOL.md + 7 tests) (REQ-015, 016, 017, 018, 019, 024) (SHIPPED v0.1.1)
-- [x] **Phase 2: Wave G — Proxmox adapter** - Read-only Proxmox VE adapter with PVEAuditor role validation, 3 capabilities (list_vms/get_vm_status/get_node_metrics), inventory TTL cache, SecretProvider integration (REQ-020, 025) (SHIPPED v0.1.2)
-- [x] **Phase 3: Wave H — SSH/Linux adapter (Relay Agent)** - Read-only SSH adapter via M1 Relay Agent, 6-command whitelist, defense-in-depth (broker layer 1 + Relay CheckCommand layer 2 + no-shell exec layer 3), tool_call WebSocket round-trip, G-013 divergence matrix, G-021 relay-ws regression test (REQ-021, 026 full) (SHIPPED v0.1.3)
-- [x] **Phase 4: Wave I — Git adapters** - Read-only GitHub + Gitea adapters, fine-grained PAT validation (D-006), version-aware Gitea scope routing (R-005), per-invocation scope-via-403 (R-004), rate-limit handling, inventory cache (REQ-022, 023, 027) (SHIPPED v0.1.4)
-- [x] **Phase 5: Wave J — SSE integration + LLM smoke + adapter UI** - SSE consumer in Test-Call UI, `packages/llm-mock` CI-only LLM smoke (two-track: Track A mock-path P0 gate + Track B real-GitHub allow-failure, G-018/G-019), Settings → Adapters UI + Test-Call UI, CI/CD pipeline (`.gitea/workflows/ci.yml`, G-011/G-022) (REQ-017 integration, gate item 8) (SHIPPED v0.1.5)
-- [x] **Phase 6: Final — Review + Audit + Ship** - Multi-persona code review, project health audit, M2 gate verification (15 items), milestone ship (SHIPPED v0.1.6 ← M2 milestone release)
-
 ## Milestone Status
 
-**v0.1 — M1: Read-Only Diagnostic MVP: COMPLETE.** All 17 M1 REQs (001-014, 038, 039, 040) pass their acceptance criteria. 189 tests green across 7 TS packages + 1 Go package + install script. M1 acceptance gate (spec §2.3) verified in `.ciagent/M1-REVIEW.md`.
-
-**v0.2 — M2: MCP Layer & Day 1 Adapters: COMPLETE.** All 13 M2 REQs (015-027) pass their acceptance criteria. 656 tests green (618 unit/integration + 38 conformance/LLM smoke) across 9 TS packages + 1 Go package. M2 acceptance gate (spec §6, 15 items) verified in `.ciagent/M2-REVIEW.md`. MCP capability broker gateway + 4 Day-1 adapters (Proxmox, SSH/Linux, GitHub, Gitea) + SSE streaming + token-bucket rate limiting + LLM tool-calling smoke + CI/CD pipeline (Postgres 16 RLS). All 12 GRILL binding fixes (G-011..G-022) applied. M1 non-regression holds.
+**v0.1 — Read-Only Diagnostic MVP: COMPLETE.** All 17 M1 REQs (001-014, 038, 039, 040) pass their acceptance criteria. 189 tests green across 7 TS packages + 1 Go package + install script. M1 acceptance gate (spec §2.3) verified in `.ciagent/M1-REVIEW.md`.
 
 ## Phase Details
 
@@ -52,17 +33,4 @@ Milestone type: **NFR** (placeholder — to be re-evaluated by `getMilestoneType
 4. Plan committed and ready for execution-phase decomposition (5 waves + final) ✓
 5. Grill passed (PASS-WITH-FIXES, 10 fixes applied) ✓
 6. MVP/UX check passed (3 sections present) ✓
-**Status**: complete (shipped v0.0.1)
-
-### Phase 0 (M2): pre-execution
-**Goal.**: Run the M2 pre-execution pipeline stages (SPECIFY → CLARIFY → RESEARCH → PLAN → GRILL → MVP/UX CHECK) and land all M2 `.ciagent/` reference files.
-**Depends on**: M1 complete (v0.0.7)
-**Requirements**: REQ-015..027 (specification), D-006/D-007 (clarification), R-001..R-009 (research), Waves F/G/H/I/J + Final (plan), G-011..G-022 (grill)
-**Success Criteria**:
-1. M2 engineering spec locked in `steer-m2-spec.md` (13 REQs, 9 open questions resolved) ✓
-2. Clarify stage completed (decisions D-006 GitHub scopes, D-007 MCP transport) ✓
-3. Research artifacts committed (R-001..R-009, 7 flagged risks integrated) ✓
-4. Plan committed (Waves F/G/H/I/J + Final + Wave 0; 12 grill fixes applied) ✓
-5. Grill passed (FAIL → auto-resolved, G-011..G-022 all binding fixes applied) ✓
-6. MVP/UX check passed (2 user-facing surfaces + BDD happy paths) ✓
-**Status**: complete (shipped v0.1.0)
+**Status**: complete (shipped v0.0.1)

.ciagent/STATE.md

@@ -2,29 +2,28 @@
 
 ## 1. Header (mandatory)
 Project:            coreci-chat
-Initiative:         CoreCI Chat v0.1 — M3 (Chat, Orchestration, Hardening) spec locked v1.2; M1+M2 shipped, M3 spec ready for engineering handoff
+Initiative:         CoreCI Chat v0.1 — Read-Only Diagnostic MVP (next: M2 MCP Layer & Day 1 Adapters)
 Initiator:          ciagent (autonomous, full autonomy)
-Date (UTC):         2026-08-25T11:00:00Z (updated post-M3 spec lock v1.2)
-Current Version:    v0.1.6 (M2 milestone release complete; M3 spec v1.2 Final locked, not yet implemented)
-System Health:      GREEN — M1 complete (v0.0.1-v0.0.7, 17 REQs, 189 tests), M2 complete (v0.1.0-v0.1.6, 13 REQs, 656 tests), MCP 2025-06-18 conformance verified; M3 spec v1.2 Final ready for engineering handoff
+Date (UTC):         2026-08-25T02:35:00Z
+Current Version:    v0.0.7 (M1 milestone release complete; all 6 phases shipped to main + Gitea upstream)
+System Health:      GREEN — M1 complete, 189 tests green, 98% DB coverage, all 17 M1 REQs PASS, upstream pushed
 Raw Idea (≤ 3 sentences):
-  M1 (read-only diagnostic MVP foundation) shipped: SSO, BYOM, Relay Agent, dashboard, audit, RLS, secrets.
-  M2 (MCP Layer & Day 1 Adapters) shipped: MCP capability broker gateway, 4 adapters (Proxmox, SSH/Linux, GitHub, Gitea), SSE streaming, rate limiting, LLM smoke, CI pipeline (Gitea Actions).
-  Desired outcome: M3 (Chat, Orchestration, Hardening, REQ-028..037+041..045) to complete v0.1 — spec locked v1.2, implementation pending.
+  M1 (read-only diagnostic MVP foundation) shipped: SSO, BYOM, Relay Agent, dashboard, audit, RLS, secrets — no chat/inference yet.
+  Triggered by Sarah Chen (PO) kickoff + locked spec v1.1 (2026-08-24); M1 acceptance gate passed per spec §2.3.
+  Desired outcome: M2 (MCP Layer & Day 1 Adapters, REQ-015..027) + M3 (Chat/Orchestration/Hardening, REQ-028..037+041..044) to complete v0.1.
 
 ## 2. Architecture State
 Active Layers (which exist and are stable):
-  [x] Core Primitives — packages/db (Postgres schema, RLS, withTenant, audit hash-chain, audit event types widened for M2), packages/secrets (SecretProvider: AWS SM + local-encrypted), packages/config (two-tier credential taxonomy), packages/runtime (Trigger.dev bootstrap + health task)
+  [x] Core Primitives — packages/db (Postgres schema, RLS, withTenant, audit hash-chain), packages/secrets (SecretProvider: AWS SM + local-encrypted), packages/config (two-tier credential taxonomy), packages/runtime (Trigger.dev bootstrap + health task)
   [x] Domain Modules  — packages/auth (WorkOS SSO, sessions, RBAC, provisioning, invitations), packages/byom (endpoint registry, validator, OpenAI-compatible routing shim, REQ-009 reject)
-  [x] MCP Layer (M2)  — packages/mcp (broker: closed 9-tool registry, adapter router, write-blocklist INV-7, token-bucket rate limiter, SSE stream manager, OpenAI↔MCP translator, in-process + stdio transports), packages/mcp/src/adapters/{proxmox,ssh,github,gitea,github-mock}, packages/llm-mock (CI-only)
-  [x] API/Dev Surface  — apps/control-plane (Next.js App Router: M1 routes + M2 routes /api/mcp/{tools,invoke,stream/[id],adapter,adapter/[id]})
-  [x] UI/Agent Surface — apps/control-plane/dashboard (M1: login, onboarding, targets, team, audit; M2: Settings→Adapters, Test-Call UI with SSE); apps/relay-agent (Go binary: WebSocket client, heartbeat, SSH whitelist hook + M2 tool_call handler)
+  [x] API/Dev Surface  — apps/control-plane (Next.js App Router: /api/auth/*, /api/me, /api/team/*, /api/invitations/*, /api/byom/*, /api/targets/*, /api/relay/ws, /api/relay/issue-token, /api/audit/export, /api/relay/status SSE)
+  [x] UI/Agent Surface — apps/control-plane/dashboard (login, onboarding checklist, targets list+detail, team/RBAC, audit export); apps/relay-agent (Go binary: WebSocket client, heartbeat, SSH whitelist hook — no SSH execution in M1)
 
 Compute Topology (per environment):
   local:        abstract — PGlite (WASM Postgres in Node), LocalEncryptedProvider, mock WorkOS, no AWS/external deps
   dev:          N/A — same as local (PGlite + local-encrypted); no dev cluster deployed
-  staging:      UNKNOWN — needs investigation (no staging environment provisioned)
-  prod:         single-region AWS us-east-1 (target architecture: Postgres 16, AWS Secrets Manager KMS, Trigger.dev cloud, WorkOS SSO); NOT yet deployed — M1+M2 shipped code only, no prod deployment
+  staging:      UNKNOWN — needs investigation (no staging environment provisioned in M1)
+  prod:         single-region AWS us-east-1 (target architecture: Postgres 16, AWS Secrets Manager KMS, Trigger.dev cloud, WorkOS SSO); NOT yet deployed — M1 shipped code only, no prod deployment
   dr:           N/A — single-region MVP, no DR
 
 Identity Stack in Force:
@@ -35,26 +34,25 @@ Identity Stack in Force:
 
 Audit Stream:
   source of truth: Postgres audit_log table (append-only, per-tenant hash-chain sha256(prev_hash||canonical(payload)), REVOKE UPDATE/DELETE, BEFORE INSERT trigger)
-  event types:    M1 (prompt, tool_call, ssh_command, response, config, auth, provision, validation) + M2 (adapter.configured, adapter.test_connection.{succeeded,failed}, adapter.capability_invoked, adapter.write_rejected)
   in-repo fallback: yes (PGlite in dev/test — same schema, RLS not enforced on SELECT in PGlite 0.5.7, app-layer withTenant + explicit WHERE is primary enforcement)
   retention policy: 90 days minimum, 1 year target (spec §5)
 
 ## 3. Technical Stack (concrete, not aspirational)
 Language(s) and runtime(s):       TypeScript 5.6 (Node 24.15, Next.js 15 App Router), Go 1.23.4 (static binary, CGO_ENABLED=0)
 Build / packaging:                pnpm 11.23 workspaces (TS monorepo), go build (static ELF amd64+arm64), Gitea releases with binary + install.sh + sha256sums
-CI / CD:                         Gitea Actions (.gitea/workflows/ci.yml) — two jobs: test-pglite (default) + test-postgres (Postgres 16 service container + RLS verification). Defined in M2; requires operator to enable Gitea Actions runner + set GITHUB_SMOKE_PAT for optional Track B smoke.
-Infrastructure:                   Target: AWS us-east-1 (Postgres 16, Secrets Manager KMS). Current: local/dev only (PGlite, local-encrypted secrets). No cloud infra provisioned.
-Data stores:                      Postgres 16 (prod target) / PGlite 0.5.7 (dev/test, WASM). Tables: tenants, users, tenant_memberships, targets, byom_endpoints, invitations, audit_log (append-only hash-chain), runtime_health, sessions, mcp_adapters (M2, tenant-scoped + RLS).
-Secrets / KMS:                    Prod: AWS Secrets Manager (KMS-backed). Dev: LocalEncryptedProvider (AES-256-GCM, PBKDF2-SHA512 100k). Rotation: not implemented.
+CI / CD:                          UNKNOWN — needs investigation (no CI/CD pipeline configured; local verification via pnpm typecheck/test, go test, bash install.test.sh)
+Infrastructure:                   Target: AWS us-east-1 (Postgres 16, Secrets Manager KMS). Current: local/dev only (PGlite, local-encrypted secrets). No cloud infra provisioned in M1.
+Data stores:                      Postgres 16 (prod target) / PGlite 0.5.7 (dev/test, WASM). Tables: tenants, users, tenant_memberships, targets, byom_endpoints, invitations, audit_log (append-only hash-chain), runtime_health, sessions.
+Secrets / KMS:                    Prod: AWS Secrets Manager (KMS-backed, coreci/<tenantId>/<name> naming). Dev: LocalEncryptedProvider (AES-256-GCM, PBKDF2-SHA512 100k iterations, master key from SECRET_MASTER_KEY_DEV env var). Rotation: not implemented in M1.
 External integrations in scope:
-  - WorkOS — SSO/SAML + SCIM + invitation API (auth, tenant provisioning) — M1
+  - WorkOS — SSO/SAML + SCIM + invitation API (auth, tenant provisioning)
   - Trigger.dev — async durable execution runtime (bootstrapped M1, tasks M3)
   - AWS Secrets Manager — tenant credential storage (prod)
-  - Gitea (self-hosted, git.cloudinit.dev) — git forge + release distribution + CI (Gitea Actions)
-  - Proxmox VE 7.x/8.x — M2 MCP adapter (PVEAuditor, read-only GET)
-  - SSH/Linux (Ubuntu 24.04, Debian 12+) — M2 MCP adapter via Relay Agent (defense-in-depth whitelist)
-  - GitHub — M2 MCP adapter (fine-grained PAT, metadata:read + actions:read per D-006)
-  - Gitea (customer self-hosted) — M2 MCP adapter (version-aware scope validation per R-005)
+  - Gitea (self-hosted, git.cloudinit.dev) — git forge + release distribution
+  - Proxmox VE 7.x/8.x — M2 MCP adapter (not yet implemented)
+  - SSH/Linux (Ubuntu 24.04, Debian 12+) — M2 MCP adapter via Relay Agent (whitelist hook shipped M1, adapter M2)
+  - GitHub — M2 MCP adapter (not yet implemented)
+  - Gitea (customer self-hosted) — M2 MCP adapter (not yet implemented)
   - Vanta — GRC evidence collection (M3, not yet implemented)
 
 ## 4. Active Constraints (the load-bearing ones)
@@ -64,10 +62,7 @@ Locked Decisions:
   - D-003: AWS Secrets Manager (prod) + local-encrypted (dev) behind SecretProvider interface
   - D-004: Postgres append-only + hash-chain audit for M1, S3 Object Lock WORM in M3
   - D-005: Next.js App Router + TypeScript single SPA
-  - D-006: GitHub fine-grained PAT minimum scopes = metadata:read + actions:read (no contents:read)
-  - D-007: In-process custom MCP transport for TS adapters; SSH downstream WebSocket to M1 Relay Agent
   - Spec §7 Q1-Q8: Trigger.dev, WorkOS, Vanta, install script (curl|bash) + apt fallback, fixed SSH whitelist, PVEAuditor, Gitea SaaS-to-API, pgvector (v1.1)
-  - M2 spec §7 Q1-Q9: MCP 2025-06-18, 9-tool closed set, 6-command SSH subset, in-memory rate limiting, GitHub fine-grained PAT, Gitea version-aware, per-call SSE + ULID, packages/llm-mock, M2→M3 contract freeze
 Active Invariants:
   - INV-1: Every HTTP request hits API gateway first: auth → tenant resolve → RBAC → audit
   - INV-2: Every DB query runs under SET app.tenant_id via withTenant transaction; RLS enforces scoping
@@ -75,43 +70,40 @@ Active Invariants:
   - INV-4: Every auditable event appended to audit_log with hash-chain; UPDATE/DELETE REVOKE'd; write failure halts
   - INV-5: Every LLM inference call routed to tenant's BYOM endpoint; unconfigured/unreachable → reject (REQ-009)
   - INV-6: Relay Agent outbound-only WebSocket; no inbound firewall rules on customer hosts
-  - INV-7: Read-only by default — closed 9-tool registry is the primary boundary; write-method blocklist is the backstop (G-015). 100% of write-action requests rejected at broker (M2) and Relay Agent (SSH whitelist)
-  - INV-8: PGlite 0.5.7 doesn't enforce RLS on SELECT — app-layer withTenant + explicit WHERE is primary in dev/test; RLS + FORCE RLS is prod backstop (verified against real Postgres 16 in CI per G-022)
-Standing Capability Gate: GATE-M2 — Verified (M2 acceptance gate passed: 13/13 REQs PASS, 656 tests, 15/15 gate items, MCP conformance verified, LLM smoke Track A passes, M1 non-regression)
+  - INV-7: Read-only by default — 100% of write-action requests rejected at MCP gateway (M2) and Relay Agent (SSH whitelist)
+  - INV-8: PGlite 0.5.7 doesn't enforce RLS on SELECT — app-layer withTenant + explicit WHERE is primary in dev/test; RLS + FORCE RLS is prod backstop
+Standing Capability Gate: GATE-M1 — Verified (M1 acceptance gate passed: 17/17 REQs PASS, 189 tests, 98% db coverage, M1-REVIEW.md)
 Anti-Goals Touched: Spec §2.2 out-of-scope (write actions, hosted LLM, K8s/ArgoCD/Helm, Slack/CLI/mobile, approval-gated remediation, RAG, SOC 2 cert, custom RBAC, BYOK, multi-region, Windows)
 Out-of-Scope (hard): Write actions (v1.1), hosted LLM inference (never), Kubernetes/ArgoCD/Helm (not planned), Slack/Teams/CLI/mobile (v1.1+), approval-gated remediation (v1.1), RAG (v1.1), SOC 2 final cert (post-MVP), custom RBAC roles (v1.2+), BYOK (v1.2+), multi-region (MVP single-region), Windows (not planned v1.x), fine-tuning (not planned)
 
 ## 5. Recent History & Quality Gates (last 1-2 milestones)
-Last Shipped:       v0.2 M2 — 2026-08-25, 7 phases (P0 pre-execution → P5 Wave J SSE+smoke+UI → P6 final review+ship), 13 REQs (015-027), 656 tests, shipped to Gitea v0.1.0-v0.1.6 + releases #833-#839
-In Progress:        M3 spec v1.2 Final locked (2026-08-25) — 15 REQs (028-037, 041-045), ready for engineering handoff. Implementation not started. Sub-phases M3.a (chat inline), M3.b (orchestration+durability), M3.c (hardening+metering).
-Coverage Floor:     92.3% (packages/mcp, the M2 critical-path package; gate ≥80% per spec §6). packages/db 98.2%, packages/llm-mock 97%.
+Last Shipped:       v0.1 M1 — 2026-08-25, 6 phases (P0 pre-execution → P5 Wave E dashboard → P6 final review+ship), 17 REQs (001-014, 038-040), 189 tests, shipped to Gitea v0.0.1-v0.0.7 + binaries
+In Progress:        Nothing — M1 milestone complete. Next: M2 (REQ-015..027, MCP Layer & Day 1 Adapters) not started.
+Coverage Floor:     98.18% (packages/db, the critical-path package; gate ≥80% per spec §6)
 Recent Incidents:   none
 Known Tensions:
-  - PGlite RLS gap: dev/test relies on app-layer withTenant + explicit WHERE; prod RLS is the backstop. M2 CI (Gitea Actions test-postgres job) now verifies RLS against real Postgres 16 (G-022), but the Gitea Actions runner must be enabled by the operator.
-  - Gitea Actions CI not yet executed: the workflow file (.gitea/workflows/ci.yml) is defined and committed, but the Gitea Actions runner has not been enabled on the forge. The P0 gate (LLM smoke Track A mock-path) does not depend on external services.
-  - GITHUB_SMOKE_PAT not set: the optional Track B real-GitHub LLM smoke requires a GitHub PAT stored as a Gitea Actions secret. Track A (mock-path) is the P0 gate and needs no PAT.
-  - No prod deployment: M1+M2 shipped code only; no cloud infrastructure provisioned.
-  - PVEAuditor introspection gap (R-002): PVE has no clean "what role does this token have" endpoint. Broker validates "token works for reads," not "token lacks writes." Write-method blocklist is the load-bearing boundary. Documented in UI help text.
-  - GitHub fine-grained PAT scope introspection gap (R-004): no public API to list a fine-grained PAT's granted scopes. Broker validates at submit + per-invocation 403. Documented in UI.
+  - PGlite RLS gap: dev/test relies on app-layer withTenant + explicit WHERE; prod RLS is the backstop but untested against real Postgres 16 (no prod deployment yet)
+  - /api/byom/test-inference is a G-001 proxy for REQ-008 — M3 must deprecate when chat orchestration drives real inference
+  - Audit concurrent-write serialization (G-006) — acceptable for M1 volume, M3 needs advisory lock or per-tenant sequence
+  - WorkOS dev/mock mode — prod SSO untested against real WorkOS (no WorkOS keys in this environment)
+  - Lint (eslint) not run — @eslint/js + typescript-eslint not installed at package level (repo-wide, not M1-blocking)
 
 ## 6. Agent Context & Assumptions (Agent Initiators Only)
 Missing Context:
-  - Gitea Actions runner status — workflow defined but runner not enabled
-  - GITHUB_SMOKE_PAT — not set (optional Track B smoke)
-  - Staging/prod deployment state — no cloud infra provisioned
+  - Staging/prod deployment state — no cloud infra provisioned; M1 shipped code only
+  - CI/CD pipeline — none configured
   - WorkOS production keys — not available in this environment (dev/mock mode only)
   - AWS Secrets Manager — not available in this environment (local-encrypted fallback only)
-  - Real Postgres 16 — not available locally (PGlite only); CI test-postgres job verifies RLS when runner enabled
+  - Real Postgres 16 — not available (PGlite only); RLS enforcement untested against real Postgres
 Agent Assumptions:
-  - PGlite is a sufficient dev/test substitute for Postgres 16 (RLS limitation documented, CI backstops)
-  - The M2 acceptance gate can be verified via unit/integration tests + LLM smoke Track A without a prod deployment
-  - Gitea releases fulfill the "distribution packages" requirement
-  - The next PDLC cycle is M3 (Chat, Orchestration, Hardening, REQ-028..037, REQ-041..045) — spec v1.2 Final locked
+  - PGlite is a sufficient dev/test substitute for Postgres 16 (RLS limitation documented)
+  - The M1 acceptance gate can be verified via unit/integration tests without a prod deployment
+  - Gitea releases with binaries fulfill the "distribution packages" requirement for M1
+  - The next PDLC cycle is M2 (MCP Layer & Day 1 Adapters, REQ-015..027)
 
 ## 7. Canonical State References (Version/Hash)
 Vision/Strategy doc:      CoreCI Chat Vision v1.0 (referenced by spec, not in repo)
-Architecture document:    .ciagent/ARCHITECTURE.md @ commit 0c15d3d (M2 milestone merge to main)
-Last approved SPECs:       .ciagent/steer-v0.1-spec.md v1.1 (M1, locked 2026-08-24) + .ciagent/steer-m2-spec.md v1.0 (M2, locked 2026-08-25) + .ciagent/steer-m3-spec.md v1.2 (M3, locked 2026-08-25)
-Decision log:             .ciagent/CLARIFY.md (D-001..D-007) + .ciagent/GRILL.md M1 (G-001..G-010) + M2 (G-011..G-022) + M3 spec §Key Decisions #1..#10 (no new D-* IDs; REQ-035 amendment + Decisions #7-#10 baked into steer-m3-spec.md)
-Invariants catalog:       .ciagent/ARCHITECTURE.md §Architecture invariants (INV-1..INV-8) + M2 addition; M3 preserves all as written (session-batched Merkle is additive, not INV-4 amendment)
-Review artifacts:          .ciagent/M1-REVIEW.md + .ciagent/M2-REVIEW.md + .ciagent/M2-VERIFY-P01.md
+Architecture document:    .ciagent/ARCHITECTURE.md @ commit 21724d030033be3fbe9fcdb3c5134ac6e54e03c9
+Last approved SPEC:       steer-v0.1-spec.md v1.1 (locked 2026-08-24) @ commit 6146e9b
+Decision log:             .ciagent/CLARIFY.md (D-001..D-005) + .ciagent/GRILL.md (G-001..G-010) @ commit 21724d0
+Invariants catalog:       .ciagent/ARCHITECTURE.md §Architecture invariants (INV-1..INV-8) @ commit 21724d0

.ciagent/steer-m3-spec.md

@@ -1,270 +0,0 @@
-# CoreCI Chat — M3 Specification (Chat, Orchestration, Hardening)
-
-**Owner:** Sarah Chen (Sr. PM)
-**Status:** Final (v1.2)
-**Type:** Milestone
-**Target Milestone:** v0.2 — M3 (Chat, Orchestration, Hardening)
-**Locked:** 2026-08-25
-
-> **Operating Principles for this Spec:**
-> 1. **Incremental Delivery:** This spec defines net-new work only. Pre-existing systems and locked architectures (M1, M2) are referenced, not restated.
-> 2. **Zero Ambiguity:** If a requirement cannot be translated into a pass/fail test by QA, it is incomplete and will be rejected by Engineering.
-> 3. **Invariants preserved:** INV-1..INV-8 from `.ciagent/ARCHITECTURE.md` hold as written. M3 adds no invariant amendments (Q5 session-batched Merkle is additive, not a semantic change to INV-4).
-
----
-
-## 1. Objective
-
-M3 delivers a diagnostic copilot that lets operators ask natural-language questions about tenant infrastructure and receive cited, evidence-backed answers within the M3 acceptance gate. It ships chat UI with streamed tool execution (≤20 steps inline, auto-promoted to durable Trigger.dev workflows beyond), persistent conversation history, per-inference usage metering, a SOC2 posture page with live control probes, and Vanta evidence sync. Three personas benefit: Devon (Operator) gets the copilot; Sam (Admin) gets posture + usage visibility; Casey (Compliance Reader) gets read-only attestation surfaces. The milestone closes v0.1 with 15 REQs total and refines (does not rewrite) the acceptance gate.
-
-*Acceptance Gate:* A developer reading this can state: "M3 ships a multi-turn diagnostic copilot that streams tool execution, persists durable workflows, meters usage, and instruments SOC2 controls."
-
----
-
-## 2. Scope & Target Milestones
-
-### 2.1 In Scope (Explicit Additions)
-
-15 REQs in three clusters:
-
-**Chat & Orchestration (REQ-028..037):** chat UI surface, natural-language input, streamed response with inline citations, streamed tool traces, conversation history (first-class data model), LLM tool reasoning, multi-step workflows, ≤20-step inline limit (amended: auto-promote at 21), durable execution via Trigger.dev, workflow rejoin. New packages: `packages/orchestrator` (step counter, promotion logic), `packages/chat` (stream manager, citation builder). New schemas: `chat_sessions`, `chat_turns`, `workflow_events` (additive per `steer-m2-spec.md:162`). API contracts: `/api/chat/stream` (inline + durable rejoin via `Last-Event-ID`), `workflow.promoted` event (inline→durable handoff).
-
-**Hardening (REQ-041..045):** REQ-041 SOC2 posture page with live control probes (5-min default interval, configurable per tenant) + `control_state` cache table (write-through with probe transaction; Decision #8); REQ-042 Vanta evidence sync (1-h default, no signed attestations); REQ-043 usage metering (per-inference `usage` block from REQ-030 feeds the pipeline; aggregation 1-min default); REQ-044 usage dashboard (tenant-facing rendering); REQ-045 Redis-backed rate aggregation (cross-process coordination between API gateway and Trigger.dev workers, replacing M2's in-memory token bucket; fail-closed 503 if Redis down).
-
-**Architectural amendments:** REQ-035 amendment text baked in (§4). New audit event types: `chat.session.created`, `chat.turn.*`, `llm.inference.{requested,succeeded,failed}`, `tool.plan.{emitted,selected,rejected}`, `workflow.{started,step.*,promoted,completed,timeout,promotion_failed,rejoined}`, `control.probe.{succeeded,failed}`, `vanta.sync.{succeeded,failed}`, `rate.redis.unavailable`, `evidence.exported`, `authz.denied`.
-
-### 2.2 Out of Scope (Explicit Exclusions)
-
-Two categories. Anti-goals (vision spec §2.2 — never / post-MVP / v1.2+) vs. M4+ deferrals (no REQ slot in M3 set):
-
-**Anti-goals (vision §2.2, not M3 deferrals):** write actions on infrastructure (v1.1+, INV-7 holds); hosted LLM inference (never, INV-5 holds, planner split rejected per Phase 1 Q3); RAG / vector retrieval (v1.1+); SOC 2 final certification (post-MVP); custom RBAC roles (v1.2+); BYOK / customer-managed keys (v1.2+); multi-region deployment (MVP single-region); Windows support (not planned v1.x); fine-tuning (not planned); Kubernetes / ArgoCD / Helm; Slack / Teams / CLI / mobile clients (v1.1+); approval-gated remediation (v1.1+).
-
-**M4+ deferrals (no REQ slot exists in M3 — each item carries REQ-gap reasoning):**
-- **Secret rotation** — `SecretProvider` interface exists (REQ-039, M1); rotation is an ops process. No REQ slot in 028-037/041-045.
-- **Production deployment of M1+M2+M3** — ops track parallel to PDLC. M3 REQs satisfied by code shipping to `main` + Gitea releases. No REQ slot.
-- **Adapter SSRF/CSRF guardrails** — tenant-supplied hostnames are trusted per M2 spec (`steer-m2-spec.md:172`); hardening requires a new REQ. No REQ slot.
-- **OTel / RED metrics / distributed tracing** — observability stack. No REQ slot. REQ-041 is posture page, not instrumentation.
-- **SBOM / supply-chain / signed releases** — No REQ slot.
-- **Gitea Actions runner enablement** — M2 CI prereq, ops responsibility; blocks full M2 verification, not M3 REQ satisfaction. Listed as ship-blocker prereq in §6.
-- **Track B GitHub smoke (`GITHUB_SMOKE_PAT`)** — M2 CI prereq, ops responsibility. Listed as ship-blocker prereq in §6.
-- **LLM-as-executor over user-authored plans** — Phase 1 Q2 marked OUT; no REQ slot.
-- **Async audit (decoupled via Trigger.dev)** — Phase 1 Q5 rejected; would amend INV-4 without justification.
-- **Planner / executor BYOM split** — Phase 1 Q3 rejected without D-008; `byom_endpoints` is single-row-per-tenant.
-- **Per-inference cost attribution as a billing signal** — REQ-043 meters; billing is not in scope (no billing REQ).
-
-### 2.3 Milestone Breakdown
-
-M3 is a single milestone. Sub-phases for delivery sequencing (not separate milestones):
-
-- **M3.a — Chat inline + citation + history (REQ-028..033):** chat UI, NL input, streaming + citations, tool traces, conversation history + lifecycle, planner.
-- **M3.b — Orchestration + durability (REQ-034..037):** multi-step workflows, ≤20-step inline limit (amended), durable Trigger.dev execution, rejoin protocol.
-- **M3.c — Hardening + metering (REQ-041..045):** SOC2 posture page + live probes + `control_state`, Vanta sync, usage metering + dashboard, Redis rate aggregation.
-
-Each sub-phase is independently shippable behind a feature flag; M3 final ship is the union of all three.
-
-*Acceptance Gate (M3 ship):* All 15 REQs PASS, ≥80% coverage on new packages, INV-1..INV-8 preserved as written, M1+M2 non-regression suite green, M3 acceptance gate demonstrably satisfied on dev environment (with durable-path SLO refinement from §6 anchored).
-
----
-
-## 3. Personas & User Journeys
-
-### 3.1 Personas
-
-- **Devon (Operator)** — Tenant user who invokes the diagnostic copilot. Technical sophistication: SRE / DevOps practitioner. Goal: ask a natural-language diagnostic question, see streamed tool execution, get a cited evidence-backed answer without hand-crafting curl commands or navigating the Test-Call UI.
-- **Sam (Admin)** — Tenant administrator who configures adapters, BYOM endpoints, team membership, and reads posture + usage. Technical sophistication: platform admin. Goal: ensure controls are green, usage is within budget, evidence flows to Vanta.
-- **Casey (Compliance Reader)** — Read-only stakeholder (auditor, GRC reviewer). Technical sophistication: compliance professional. Goal: view posture page + usage + audit log without write or admin powers. RBAC granularity: Casey sees all controls (posture, usage, audit) read-only; no probe-trigger, no config edit, no Vanta credential view. (New in M2; first explicit M3 journey in J3.)
-
-### 3.2 Happy Paths
-
-**Journey 1 (J1) — Devon asks an inline diagnostic question (≤20 steps).**
-
-1. Devon opens `/chat`, types "Why is the staging nginx fleet degraded?", submits. → Chat UI creates a `chat_session` row, emits `chat.session.created` audit event. *(Maps to REQ-028, REQ-029, REQ-032)*
-2. Server begins streaming SSE on `/api/chat/stream`. First event: `turn.user` with the question. → Client renders user message. *(Maps to REQ-030)*
-3. Orchestrator invokes planner via tenant BYOM. → Emits `llm.inference.requested` with `{turn_id, byom_endpoint_id, prompt_tokens_estimated, workflow_id=null}`. *(Maps to REQ-033, REQ-029)*
-4. Planner returns tool-call plan. → Emits `tool.plan.{emitted,selected}`. Intermediate planner message stored `visible=false` in `chat_turns`. Server forwards tool trace to client. *(Maps to REQ-031, REQ-033)*
-5. For each tool call: orchestrator invokes broker adapter router (one row = one step). → Emits `adapter.capability_invoked` (already in M2 audit). Increments step counter. *(Maps to REQ-031, REQ-034)*
-6. Tool result returns; planner reasons again; loop continues until planner emits final answer or step 20. *(Maps to REQ-033, REQ-034)*
-7. Server emits final assistant message with citations array per REQ-030 shape. `usage` block attached: `{prompt_tokens, completion_tokens, byom_endpoint_id, latency_ms, workflow_id, correlation_id}`. *(Maps to REQ-030, REQ-043)*
-8. Server emits `llm.inference.succeeded` per BYOM call. Client closes SSE on `turn.assistant.final`. *(Maps to REQ-030, REQ-043)*
-
-*Testable Acceptance (BDD):*
-- **Given** Devon is authenticated, tenant BYOM is configured, ≥1 adapter is configured, **when** Devon submits a question that triggers ≤20 tool calls, **then** the response streams with citations, all `adapter.capability_invoked` rows have `session_id` FK set, all `llm.inference.*` rows are present, and the final SSE event is `turn.assistant.final` within 5 min p95.
-- **Given** J1 has just completed, **when** Devon reloads `/chat`, **then** the conversation appears in the history list with all turns and citations renderable.
-- **Given** Devon submits a question, **when** the planner emits a tool call, **then** the SSE stream emits a `tool.trace` event before the corresponding `adapter.capability_invoked` row is written to `audit_log`.
-
-**Journey 1-durable (J1-durable) — Devon triggers a workflow that exceeds 20 steps or must survive restart.**
-
-1. Devon submits a question whose planner-execution loop is projected to exceed 20 steps (e.g., "Audit all 50 Proxmox nodes for CVE-2024-xxxx"). → Orchestrator detects projection ≥21 at step 20. *(Maps to REQ-034, REQ-035)*
-2. At step 21, orchestrator auto-promotes: assigns `workflow_id` (ULID), creates Trigger.dev task, emits `workflow.promoted` event on the SSE stream, bridges handoff. *(Maps to REQ-035 amended, REQ-036)*
-3. Client UI updates state to "Background workflow — running asynchronously" indicator upon receipt of `workflow.promoted`. *(Phase 2 Item 5 addition)*
-4. Trigger.dev worker continues execution; each step emits `workflow.step.{started,completed,failed}` to `workflow_events` table; `audit_log` continues to receive per-row hash-chained events with `session_id` FK and new `workflow_id` column. *(Maps to REQ-036)*
-5. On completion, worker emits `workflow.completed` audit event and closes the Trigger.dev task. Server emits `workflow.completed` SSE event to any connected client. *(Maps to REQ-036, REQ-037)*
-6. Devon returns to dashboard → "Background workflows" card shows the completed workflow with `workflow_id`. *(Maps to REQ-037 fallback)*
-7. Devon clicks the card → client opens new SSE connection to `/api/chat/stream?workflow_id=...&last_event_id=...` → server replays from `workflow_events` starting after `last_event_id` + tails live events. *(Maps to REQ-037)*
-
-*Testable Acceptance (BDD):*
-- **Given** Devon submits a question projected to exceed 20 steps, **when** step 21 begins, **then** `workflow.promoted` is emitted on the SSE stream, `workflow_id` is assigned, and the Trigger.dev task is created within 1s.
-- **Given** Trigger.dev is unreachable at step 21, **when** promotion is attempted, **then** the orchestrator halts and preserves the inline state, emits `workflow.promotion_failed` audit event, and returns an error to the client with retry guidance (legacy REQ-035 contract).
-- **Given** a durable workflow completed 5 minutes ago, **when** Devon reopens it via dashboard card with `Last-Event-ID` set to event N, **then** the SSE stream replays events N+1 onward from `workflow_events` and the first replayed event arrives within 30s p95 of `workflow.completed` audit emission.
-- **Given** a durable workflow is still running at TTL (24h), **when** the TTL elapses, **then** the workflow is marked timed-out, `workflow.timeout` audit event is emitted, partial state is preserved, and the workflow is not resumable.
-
-**Journey 2 (J2) — Sam runs onboarding + smoke.** *Existing M1 journey with M3 extensions — refer to `steer-v0.1-spec.md` for full text. M3 additions: smoke test exercises the J1 inline path and emits `llm.inference.*` audit events feeding REQ-043 metering. Maps to REQ-033, REQ-034, REQ-035, REQ-043, REQ-044.*
-
-**Journey 2-hardening (J2-hardening) — Sam configures and reviews posture + usage + Vanta.**
-
-1. Sam opens `/settings/posture`. → Posture page renders `{control_name, status, last_checked_at, evidence_ref}` matrix for {RLS, audit hash-chain, WorkOS SSO, BYOM reachability}. *(Maps to REQ-041)*
-2. Server initiates live probes on 5-min interval (configurable per tenant). Each probe emits `control.probe.{succeeded,failed}`. *(Maps to REQ-041)*
-3. Sam opens `/settings/usage`. → Dashboard renders per-tenant aggregates (tokens in/out, BYOM calls, latency percentiles) sliced by conversation/workflow. *(Maps to REQ-043, REQ-044)*
-4. Sam configures Vanta integration: API key, sync interval (1h default). → Server schedules sync task; Vanta API key resolved via `SecretProvider` (INV-3). *(Maps to REQ-042)*
-5. Vanta sync runs on schedule, pushes evidence bundle: probe results + config snapshots + control attestation records. *(Maps to REQ-042)*
-
-*Testable Acceptance (BDD):*
-- **Given** Sam opens `/settings/posture`, **when** the page renders, **then** every row in the matrix has `last_checked_at` within the past 5 minutes and an `evidence_ref` pointing to a `control.probe.*` audit row.
-- **Given** a probe fails (e.g., WorkOS API returns 5xx), **when** the failure is detected, **then** the posture page updates within 1 probe interval and the failure row links to the `control.probe.failed` audit event.
-- **Given** Sam configures Vanta with a valid API key, **when** the scheduled sync runs, **then** an evidence bundle is pushed to Vanta and a `vanta.sync.{succeeded,failed}` audit event is emitted.
-- **Given** Sam opens `/settings/usage`, **when** the dashboard renders, **then** per-tenant aggregates show `{prompt_tokens, completion_tokens, byom_call_count, latency_p50/p95/p99}` for the selected time window.
-
-**Journey 3 (J3) — Casey (compliance reader) reviews posture + usage + audit.**
-
-1. Casey logs in via SSO. RBAC resolves to `compliance-reader` role. → Casey has read access to `/settings/posture`, `/settings/usage`, `/audit` but no write or admin routes. *(Maps to REQ-041, REQ-042, REQ-043, REQ-044)*
-2. Casey browses posture, usage, audit. All three pages render read-only. No edit, no config, no probe-trigger controls.
-3. Casey exports evidence bundle (audit log slice + posture snapshot + usage slice) for offline review. *(Maps to REQ-042 evidence lineage)*
-
-*Testable Acceptance (BDD):*
-- **Given** Casey is authenticated as `compliance-reader`, **when** Casey requests any write or admin endpoint, **then** the request is rejected with 403 and `authz.denied` audit event is emitted.
-- **Given** Casey exports an evidence bundle, **when** the bundle is generated, **then** every included row has a verifiable provenance chain (audit hash-chain + Merkle session root) and the bundle itself is emitted as `evidence.exported` audit event.
-
-**Journey infra (J-infra) — Cross-process rate aggregation (REQ-045, no user persona).**
-
-1. API gateway receives a chat request. → Consults Redis-backed token bucket for tenant + global keys. *(Maps to REQ-045)*
-2. Trigger.dev worker emits a step-completion event. → Worker also consults/updates Redis bucket to enforce cross-process rate limits on durable workflows. *(Maps to REQ-045)*
-3. If bucket exhausted → request rejected with 429 + `Retry-After`; workflow step retried per Trigger.dev backoff or rejected if global ceiling hit. *(Maps to REQ-045)*
-
-*Testable Acceptance (BDD):*
-- **Given** API gateway instance A and Trigger.dev worker instance W both serve tenant T, **when** T's per-tenant rate bucket is exhausted on A, **then** a subsequent request to W is rejected with 429 within 1s.
-- **Given** Redis is unreachable, **when** rate lookup fails, **then** requests are rejected with 503 (fail-closed) and `rate.redis.unavailable` audit event is emitted.
-
-### 3.3 Failure & Edge Paths
-
-- **Edge 1 — BYOM unreachable mid-turn:** REQ-009 reject path. Server emits `llm.inference.failed` with `reason=byom_unreachable`, surfaces error to client, conversation state preserved.
-- **Edge 2 — Hash-chain trigger fails on insert (INV-4):** INSERT rolls back, enclosing transaction rolls back, request returns 500; current operation has no audit row because the chain broke (preserved semantics).
-- **Edge 3 — Planner emits malformed tool call:** Orchestrator rejects, emits `tool.plan.rejected`, requests planner retry. If 3 consecutive malformed plans → surface error to user, conversation state preserved.
-- **Edge 4 — Tool call exceeds adapter capability (INV-7 write blocklist):** Broker rejects with `adapter.write_rejected` (already in M2). Conversation continues without that step.
-- **Edge 5 — Durable workflow TTL timeout:** `workflow.timeout` audit event, workflow marked not resumable, partial state preserved.
-- **Edge 6 — Vanta API failure during sync:** `vanta.sync.failed` audit event, retry with exponential backoff per Trigger.dev task config, posture page surfaces Vanta integration status.
-- **Edge 7 — Probe fails (e.g., WorkOS 5xx):** `control.probe.failed` audit event, posture page status = `degraded`, `evidence_ref` points to failed probe.
-- **Edge 8 — Redis unreachable:** Fail-closed 503, `rate.redis.unavailable` audit event.
-- **Edge 9 — Client reconnect during inline SSE with no `Last-Event-ID`:** Server replays entire conversation state from `chat_turns` (full re-replay acceptable for inline streams).
-- **Edge 10 — `workflow_id` lost client-side:** Dashboard "Background workflows" card surfaces all workflows for tenant; any persona with read access can rejoin by clicking the card.
-
----
-
-## 4. Functional Requirements
-
-| ID | Title | Journeys | Priority | Acceptance Criteria (Given/When/Then or explicit rules) |
-| :--- | :--- | :--- | :--- | :--- |
-| **REQ-028** | Chat UI surface | J1 | High | **Given** Devon is authenticated, **when** Devon navigates to `/chat`, **then** the UI renders an input surface + empty conversation state + streaming-capable message list. |
-| **REQ-029** | Natural-language input | J1 | High | **Given** chat UI is open, **when** Devon submits a natural-language question, **then** server validates input length (≤4000 chars), creates `chat_session` row, emits `chat.session.created` audit event with `{session_id, tenant_id, user_id}`, returns first SSE event (`turn.user`) within 500ms p95. |
-| **REQ-030** | Streamed response with citations | J1 | High | **1.** Every assistant message contains a `citations` array per the shape below. **2.** Each citation's `tool_invocation_id` is a valid FK to `audit_log.adapter.capability_invoked`. **3.** `usage` block on every assistant message (every BYOM call) with `workflow_id` (nullable) + `correlation_id`. **4.** Inline path: SSE completes within 5 min p95. **Citation message shape:** ```json { "message_id":"ulid","turn_id":"ulid","role":"assistant", "content":"nginx is down [c:1]...", "citations":[{"citation_id":"c:1","claim_text":"nginx is down", "tool_invocation_id":"ulid (FK audit_log adapter.capability_invoked)", "adapter_id":"ssh:web-server-01","capability":"ssh.run_whitelisted_command", "source_locator":{"type":"ssh_command_output","command":"systemctl status nginx", "output_snippet":"Active: inactive (dead)","output_full_ref":"audit_log.row_id"}}], "usage":{"prompt_tokens":1820,"completion_tokens":340, "byom_endpoint_id":"ulid","latency_ms":4200, "workflow_id":"ulid\|null","correlation_id":"ulid"}} ``` |
-| **REQ-031** | Streamed tool traces | J1, J1-durable | High | **Given** orchestrator invokes a tool, **when** the broker adapter router begins execution, **then** SSE emits a `tool.trace` event with `{tool_invocation_id, adapter_id, capability, started_at}` before the `adapter.capability_invoked` audit row is written. |
-| **REQ-032** | Conversation history (first-class data model) | J1 | High | **1.** `chat_sessions` and `chat_turns` tables exist (additive migration per `steer-m2-spec.md:162`). **2.** Retention: indefinite for `chat_sessions` and `chat_turns`. **3.** Devon can list all sessions for the tenant; clicking a session loads full turn history with citations and tool traces. **4.** Session lifecycle: soft-close on 30-min idle; hard-close on explicit user action or session age >7 days. Soft-close = read-only + audit log complete; not deleted. |
-| **REQ-033** | LLM tool reasoning (planner) | J1, J2 | High | **1.** Every planner invocation goes through tenant BYOM endpoint (INV-5). **2.** Every planner invocation emits `llm.inference.{requested,succeeded,failed}` audit events. **3.** Intermediate planner messages (reasoning traces) stored in `chat_turns` with `visible=false`. **4.** Planner rejects malformed tool calls per Edge 3. |
-| **REQ-034** | Multi-step workflows | J1, J1-durable | High | **Given** orchestrator is executing a workflow, **when** the planner emits a multi-step plan, **then** the orchestrator executes steps sequentially through the broker adapter router, each step increments the per-`workflow_id` counter, and each step emits `adapter.capability_invoked` audit event. |
-| **REQ-035** | ≤20-step inline limit (AMENDED) | J1, J1-durable | High | **Given** step counter reaches 20 in an inline workflow, **when** step 21 is initiated, **then** the orchestrator auto-promotes the workflow to durable: assigns `workflow_id` (ULID), creates Trigger.dev task, emits `workflow.promoted` SSE event, bridges handoff. **Degraded mode:** if Trigger.dev unreachable at promotion time, halt and preserve per legacy contract, emit `workflow.promotion_failed` audit event, return error to client with retry guidance. |
-| **REQ-036** | Durable execution | J1-durable | High | **1.** Durable workflows execute in Trigger.dev tasks with `workflow_id` correlation. **2.** Each step emits `workflow.step.{started,completed,failed}` to `workflow_events` table. **3.** `audit_log` continues per-row hash-chaining; new `workflow_id` column on audit rows; `session_id` FK still set. **4.** On completion: `workflow.completed` audit event + Trigger.dev task close. **5.** Hard TTL 24h → `workflow.timeout` + partial state preserved + workflow not resumable. **6.** `workflow_events` retention aligned with `audit_log` (90d min, 1y target); S3 WORM archive covers long-term. **7.** Trigger.dev task schema: input=`{session_id, user_turn_id, planner_plan, byom_endpoint_id}`; output=`{workflow.completed event payload}`; retry=exponential backoff ×3; idempotency key=`workflow_id`. |
-| **REQ-037** | Workflow rejoin | J1-durable | High | **1.** Client reconnects via `/api/chat/stream?workflow_id=...&last_event_id=...`. **2.** Server replays from `workflow_events` starting after `last_event_id` + tails live events. **3.** Rejoin p95 ≤30s, anchored: `workflow.completed` audit emission → first replayed event receipt. **4.** Fallback: dashboard "Background workflows" card lists all workflows for tenant; clicking opens rejoin stream. |
-| **REQ-041** | SOC2 posture page | J2-hardening, J3 | High | **1.** Page renders `{control_name, status, last_checked_at, evidence_ref}` matrix for {RLS, audit hash-chain, WorkOS SSO, BYOM reachability}. **2.** Live probes run on 5-min interval (configurable per tenant). **3.** Each probe emits `control.probe.{succeeded,failed}` audit event. **4.** Posture page never displays a status without an `evidence_ref` to a probe audit row. **5.** Live probes themselves are auditable (INV-4). **6.** `control_state` cache table (write-through with probe transaction, Decision #8) backs the page render for <500ms p95 render time. **7.** Casey RBAC: read-only; no probe-trigger, no config edit, no Vanta credential view. |
-| **REQ-042** | Vanta evidence sync | J2-hardening, J3 | High | **1.** Scheduled sync (1-h default, configurable). **2.** Pushes evidence bundle: probe results + config snapshots + control attestation records. **3.** No signed attestations in M3 (avoids SOC2-cert anti-goal). **4.** Emits `vanta.sync.{succeeded,failed}` audit event per run. **5.** Retry with exponential backoff on failure. **6.** Vanta API key resolved via `SecretProvider` (INV-3). |
-| **REQ-043** | Usage metering | J1, J2-hardening, J3 | High | **1.** Every BYOM call emits `llm.inference.{requested,succeeded,failed}` with `usage` block (REQ-030 schema). **2.** Metering pipeline aggregates per-tenant: `{prompt_tokens, completion_tokens, byom_call_count, latency_p50/p95/p99}` sliced by conversation/workflow. **3.** Aggregation interval: 1-min default (configurable). **4.** Failed inferences (no completion) are counted at zero tokens + recorded as failures. |
-| **REQ-044** | Usage dashboard | J2-hardening, J3 | High | **Given** Sam or Casey opens `/settings/usage`, **when** the dashboard renders, **then** it displays metered data (REQ-043) for the selected time window with per-tenant aggregates + drill-down to conversation/workflow level. Casey sees all controls read-only; no edit, no config. |
-| **REQ-045** | Redis-backed rate aggregation | J-infra | High | **1.** Rate limiter state in Redis (Valkey-compatible). **2.** API gateway + Trigger.dev workers share the same bucket state per tenant. **3.** If bucket exhausted: 429 + `Retry-After` for gateway requests; Trigger.dev backoff/reject for workflow steps. **4.** If Redis unreachable: fail-closed 503 + `rate.redis.unavailable` audit event. **5.** Bucket config: per-tenant + global keys; limits configurable per tenant. |
-
----
-
-## 5. Technical Constraints & NFRs
-
-- **INV-1 (API gateway ordering):** Every HTTP request hits API gateway first: auth → tenant resolve → RBAC → audit. M3 `/api/chat/stream` and `/api/chat/rejoin` MUST conform.
-- **INV-2 (Tenant scoping):** Every DB query runs under `SET app.tenant_id` via `withTenant` transaction; RLS enforces scoping. M3 queries against `chat_sessions`, `chat_turns`, `workflow_events`, `control_state` MUST use `withTenant`. RLS policies for new tables ship in the M3 migration.
-- **INV-3 (Secret resolution):** Every credential resolved via `SecretProvider.get`; never env/config/DB for tenant secrets. M3 scheduler tasks (Trigger.dev) for Vanta sync + posture probes MUST resolve tenant Vanta API key via SecretProvider, not env.
-- **INV-4 (Audit hash-chain):** Every auditable event appended to `audit_log` with hash-chain; `UPDATE/DELETE` REVOKE'd; write failure halts enclosing operation. **M3 preserves INV-4 as written.** Per-row hash-chaining continues. Session-scoped Merkle root per `chat_session` row is additive and does not weaken INV-4.
-- **INV-5 (BYOM routing):** Every LLM inference call routed to tenant's BYOM endpoint; unconfigured/unreachable → reject (REQ-009). **M3 enforces this for all roles (planner, executor, synthesis) — no D-008 split.** All N inference calls per turn hit the same `byom_endpoints` row.
-- **INV-6 (Relay Agent outbound-only):** Unchanged from M2. M3 chat does not directly invoke Relay Agent; chat → broker → adapter → (optionally) Relay Agent.
-- **INV-7 (Read-only by default):** Closed 9-tool registry is the primary boundary; write-method blocklist is the backstop. M3 orchestrator MUST refuse any tool call that resolves to a write capability, even if planner requests it.
-- **INV-8 (PGlite RLS gap):** PGlite 0.5.7 doesn't enforce RLS on SELECT. App-layer `withTenant` + explicit `WHERE tenant_id` is primary in dev/test; RLS + FORCE RLS is prod backstop. M3 new tables (`chat_sessions`, `chat_turns`, `workflow_events`, `control_state`) MUST have explicit `tenant_id` columns + RLS policies + `withTenant` usage.
-
-**Performance NFRs:**
-- Inline path: SSE completes within 5 min p95 (acceptance gate).
-- Durable rejoin: p95 ≤30s from `workflow.completed` audit emission to first replayed event receipt (Phase 2 Item 6 anchor).
-- Posture page render: <500ms p95 (backed by `control_state` write-through cache).
-- Probe cadence: 5-min default interval (REQ-041).
-- Vanta sync: 1-h default interval (REQ-042).
-- Metering aggregation: 1-min default interval (REQ-043).
-
-**Schema additivity (per `steer-m2-spec.md:162` — "new tables" parenthetical explicitly permits new tables, not just columns):**
-- New tables: `chat_sessions`, `chat_turns`, `workflow_events`, `control_state`.
-- New `audit_log` columns: `session_id` (FK `chat_sessions`, nullable), `workflow_id` (nullable).
-- New audit event types: see §2.1.
-
-**Migration shape (Decision #7 — per-table for rollback isolation, one PR):**
-- `0004_chat_schema.sql` — `chat_sessions`, `chat_turns` + RLS; `audit_log.session_id` column.
-- `0005_workflow_schema.sql` — `workflow_events` + RLS; `audit_log.workflow_id` column.
-- `0006_posture_schema.sql` — `control_state` + RLS.
-
-**Anti-goal enforcement:**
-- No write actions on infrastructure (closed 9-tool registry + write-method blocklist + INV-7).
-- No hosted LLM inference (single BYOM endpoint, all roles, INV-5).
-- No SOC2 final cert (no signed attestations in M3; REQ-042 pushes evidence only).
-
-**`control_state` cache table (Decision #8 — write-through):**
-- `control_state` row updated in the same Postgres transaction as the `control.probe.{succeeded,failed}` audit event emission. Cache is always consistent with audit log at probe completion.
-- **Implementation question (§7 Q1):** Engineering to confirm write-through is achievable in the chosen probe pipeline (likely Trigger.dev task per REQ-042 architecture). If a single transaction is not achievable, surface divergence handling in a v1.3 spec amendment.
-
----
-
-## 6. Milestone Plan & Release Gates
-
-**Test evidence required for Production Release (M3):**
-
-- [ ] Code coverage ≥80% on new packages (`packages/orchestrator`, `packages/chat`); existing M2 floor (92.3% on `packages/mcp`) maintained.
-- [ ] All 15 REQs PASS (REQ-028..037, REQ-041..045) including REQ-035 amendment acceptance criteria.
-- [ ] CI/CD pipeline GREEN (Gitea Actions, both `test-pglite` and `test-postgres` jobs).
-- [ ] M1+M2 non-regression: full 656-test suite green.
-- [ ] INV-1..INV-8 explicitly tested (new tests for INV-4 audit hash-chain preservation across M3 event types; new tests for INV-5 BYOM routing across planner/executor/synthesis; new tests for INV-2 RLS on `chat_sessions`/`chat_turns`/`workflow_events`/`control_state`).
-- [ ] MCP 2025-06-18 conformance verified (M2 gate, non-regression).
-- [ ] LLM smoke Track A passes (mock-path, P0 gate, no external deps).
-- [ ] QA sign-off: 100% of J1, J1-durable, J2-hardening, J3 integration tests pass; J-infra (REQ-045) has unit + cross-process integration test demonstrating gateway ↔ Trigger.dev worker rate coordination.
-- [ ] Security/compliance review: posture page + Vanta sync demonstrate evidence lineage (every rendered status has an audit row); RBAC denies Casey on all write/admin endpoints; audit log hash-chain integrity verified end-to-end.
-- [ ] Production deployment is an ops track (not in this gate list); deploy to AWS us-east-1 follows the ops track's own gate.
-
-**Durable-path SLO refinement (gate clarification — does not rewrite `REQUIREMENTS.md:40`):**
-> Inline path: p95 ≤5min. Durable path: rejoin p95 ≤30s from `workflow.completed` audit emission to first replayed event receipt; hard TTL 24h. `REQUIREMENTS.md:40` raw gate language stays untouched; this refinement documents the durable-path clarification locally in the M3 spec.
-
-**Operational prereqs (ship-blockers, NOT M3 REQ deliverables — ops track, parallel to PDLC):**
-- Gitea Actions runner enablement on forge (blocks full M2 + M3 CI verification on `test-postgres` job).
-- `GITHUB_SMOKE_PAT` provisioning as Gitea Actions secret (blocks Track B GitHub LLM smoke; Track A mock-path is the P0 gate and does not need this).
-
----
-
-## 7. Open Questions & Assumptions
-
-1. **Trigger.dev task schema for durable workflows** — RESOLVED. Workflow input=`{session_id, user_turn_id, planner_plan, byom_endpoint_id}`; output=`{workflow.completed event payload}`; retry policy=exponential backoff ×3; idempotency key=`workflow_id`. Baked into REQ-036 §4.7.
-2. **M3 acceptance gate refinement (durable path SLO)** — RESOLVED. "Inline path: p95 ≤5min. Durable path: rejoin p95 ≤30s post-`workflow.completed` audit emission; hard TTL 24h." Baked into §6. `REQUIREMENTS.md:40` stays untouched; refinement documented locally in M3 spec §6.
-3. **Chat session lifecycle** — RESOLVED. Soft-close 30-min idle; hard-close 7d or explicit. Read-only post-close, not deleted. Baked into REQ-032 §4.
-4. **Workflow event retention vs audit log retention** — RESOLVED. Align `workflow_events` with `audit_log` (90d min, 1y target). S3 WORM archive covers long-term. Baked into REQ-036 §4.6.
-5. **Citation rendering UX** — DEFERRED. Exact UI for inline `[c:1]` markers + citation popover. Defer to design review. Non-blocking for spec ratification. Proposed: inline superscript numbers; click expands to source adapter + tool invocation link + output snippet.
-6. **Posture page RBAC granularity** — RESOLVED. Casey sees all controls (posture, usage, audit) read-only; no probe-trigger, no config edit, no Vanta credential view. Baked into §3.1 + REQ-041 §4.7 + REQ-044 §4.
-7. **`control_state` cache invalidation strategy** — OPEN (engineering confirm during implementation). Spec default: write-through (same transaction as `control.probe.*` audit emission). Engineering to confirm feasibility in chosen probe pipeline; if not achievable, v1.3 amendment with divergence handling.
-
----
-
-## 8. Changelog
-
-| Version | Date | Author | What Changed | REQs Affected |
-| :--- | :--- | :--- | :--- | :--- |
-| v1.0 | 2026-08-25 | Sarah Chen (PM) | Initial M3 spec draft from Phase 3 generation | REQ-028..037, REQ-041..045 (with REQ-035 amendment) |
-| v1.1 | 2026-08-25 | Sarah Chen (PM) | Open Questions 1-6 resolved and baked in (Trigger.dev task schema, durable SLO, session lifecycle, workflow retention, Casey RBAC); OQ5 deferred to design review | REQ-032, REQ-036, REQ-041, REQ-044 |
-| v1.2 | 2026-08-25 | Sarah Chen (PM) | Engineering handoff: Decision #7 (per-table migrations `0004`/`0005`/`0006`), Decision #8 (`control_state` write-through cache), Decision #9 (Redis fail-closed 503), Decision #10 (usage on all BYOM calls); OQ7 opened (`control_state` write-through feasibility); ops prereqs documented in §6 | REQ-036, REQ-041, REQ-043, REQ-045 |
-
----
-
-**M3 spec v1.2 Final. Ready for engineering handoff.**