docs(milestone): complete v1.3 (InboxOS Codebase-Drift Sweep — 9 candidates EXECUTED, 3 DEFERRED, 0 REJECTED)

The v1.3 inboxos milestone closes on the 9/12 disposition:
9 ACCEPT candidates (REQ-INB-28, 29, 30, 31, 32, 33, 34,
36, 37) EXECUTED in v1.3 across 8 PRs / 8 commits; 3
DEFER candidates (REQ-INB-35, 38, 39) filed for v1.4+;
0 REJECT candidates.

This commit updates REQUIREMENTS.md (the 9 ACCEPT
candidates are now marked [CANDIDATE — EXECUTED in v1.3,
commit <sha>]) and ROADMAP.md (the v1.3 EXECUTE block
records the 8 commits, the 4-layer PASS verify, the
PASS-with-NITS review, and the PASS audit).

v1.1 backlog closures recorded in v1.3: P1-1 closed by
REQ-INB-36, P1-2 closed by REQ-INB-37. P2-1 + P2-2
deferred to v1.4+ (REQ-INB-38, REQ-INB-39).

Tag: v1.3.0. Ship pattern identical to v1.1 / v1.2:
FF-merge phase/01-v1.3-execute → milestone/v1.3-initial →
main, push tag, push milestone branch, create Gitea
release. The cto-inboxos closure (T1.1, REQ-INB-28 +
REQ-INB-37) is the same P0 class as the v1.1 P0 sweep
(commits 7c20d5d, d530921); the ci-pr test wiring (T1.2,
REQ-INB-34) is the v1.3 highest-impact candidate.

---ci---
project: inboxos
phase: 0
milestone: v1.3
status: complete
requirements:
  covered: [REQ-INB-28, REQ-INB-29, REQ-INB-30, REQ-INB-31, REQ-INB-32, REQ-INB-33, REQ-INB-34, REQ-INB-36, REQ-INB-37]
  partial: []
  deferred: [REQ-INB-35, REQ-INB-38, REQ-INB-39]
  rejected: [REQ-INB-26]   # carry-forward from v1.2
backlog_closures:
  v1_1_P1_1: REQ-INB-36
  v1_1_P1_2: REQ-INB-37
  v1_1_P2_1: REQ-INB-38 (deferred to v1.4+)
  v1_1_P2_2: REQ-INB-39 (deferred to v1.4+)
version: v1.3.0
branch: milestone/v1.3-initial
commits: 17
execution_pass_commits: 8
verification: PASS (4 layers, 9 must-haves, 30/30 runnable tests, high confidence)
review: PASS-with-NITS (0 P0, 2 P1, 3 P2)
audit: PASS (17/17 ---ci--- blocks, file/commit discipline clean)
---/ci---

.ciagent/inboxos/REQUIREMENTS.md

@@ -178,15 +178,22 @@ All extraction prompts shall be version-controlled in `.opencode/commands/` and
 > **[CANDIDATE]** until the CPO authors a matching entry in
 > `docs/requirements.md` (CPO-owned, per board mandate `b49cfb7`).
 >
-> **Disposition:** 9 ACCEPT, 3 DEFER, 0 REJECT. The DEFER set
-> (REQ-INB-35, REQ-INB-38, REQ-INB-39) is filed for v1.4+
-> follow-up. The v1.2 carry-forward REQ-INB-26 (INB-183,
-> paperclip monorepo) is `[REJECTED — out of domain]` and
-> remains so in v1.3; the v1.2 polite-rejection comment
-> (`tea comment 8`, 2026-06-08) is the final disposition.
+> **Disposition:** 9 ACCEPT (REQ-INB-28, 29, 30, 31, 32, 33, 34,
+> 36, 37) **EXECUTED in v1.3** (commits `349b59a`, `d20b789`,
+> `8ece4c3`, `2137f97`, `eb1b49e`, `3746f03`, `b54df85`,
+> `fc2ae83`); 3 DEFER (REQ-INB-35, REQ-INB-38, REQ-INB-39)
+> filed for v1.4+; 0 REJECT. The v1.2 carry-forward
+> REQ-INB-26 (INB-183, paperclip monorepo) is
+> `[REJECTED — out of domain]` and remains so in v1.3;
+> the v1.2 polite-rejection comment (`tea comment 8`,
+> 2026-06-08) is the final disposition.
+>
+> **v1.1 backlog closures recorded in v1.3:** P1-1 closed
+> by REQ-INB-36; P1-2 closed by REQ-INB-37. P2-1 + P2-2
+> deferred to v1.4+ (REQ-INB-38, REQ-INB-39).
 
 ### REQ-INB-28 — `docs/gitea-actions.md:95` `cto-inboxos` → `jc-capital`
-**Status:** [CANDIDATE]
+**Status:** [CANDIDATE — EXECUTED in v1.3, commit `349b59a`]
 **Source:** Mechanical scan, T1-1; missed by the v1.1 P0 sweep (file last touched at Phase 4 / INB-33, before the org migration)
 **Parent:** REQ-INB-6, REQ-INB-10
 **Confidence:** 0.90
@@ -196,7 +203,7 @@ All extraction prompts shall be version-controlled in `.opencode/commands/` and
 **Acceptance criterion:** `docs/gitea-actions.md:95` (the verify-runner `curl` example) replaces the hardcoded `cto-inboxos/inboxos` with `jc-capital/inboxos` (and `${GITEA_OWNER:-jc-capital}/inboxos` for runtime correctness). The same fix shape as the v1.1 auto-applied P0 sweep (commits `7c20d5d`, `d530921`).
 
 ### REQ-INB-29 — Runbook footer "Next review" pointer update
-**Status:** [CANDIDATE]
+**Status:** [CANDIDATE — EXECUTED in v1.3, commit `8ece4c3`]
 **Source:** Mechanical scan, T1-2
 **Parent:** REQ-INB-6
 **Confidence:** 0.95
@@ -206,7 +213,7 @@ All extraction prompts shall be version-controlled in `.opencode/commands/` and
 **Acceptance criterion:** `docs/operations-runbook.md:823` (footer) updates "Next review: after the v1.1 ship (2026-06-08, milestone `milestone/v1.1-initial`)" to point at v1.3 (the active ideation milestone on `milestone/v1.3-initial`).
 
 ### REQ-INB-30 — Runbook §4.5 forward-pointer update (alerting)
-**Status:** [CANDIDATE]
+**Status:** [CANDIDATE — EXECUTED in v1.3, commit `2137f97`]
 **Source:** Mechanical scan, T1-3
 **Parent:** REQ-INB-6, REQ-INB-23
 **Confidence:** 0.80
@@ -216,7 +223,7 @@ All extraction prompts shall be version-controlled in `.opencode/commands/` and
 **Acceptance criterion:** `docs/operations-runbook.md:285-289` (the §4.5 "Forward-pointer") updates the "alert layer is the next v1.2 deliverable" claim to "alerting remains out of scope; v1.2 closed on a 0/1 disposition with no alerting deliverable; the next v1.x candidate cycle may re-evaluate per the v1.3 review's post-hoc backlog."
 
 ### REQ-INB-31 — `papra-write-policy.md:192` test count correction
-**Status:** [CANDIDATE]
+**Status:** [CANDIDATE — EXECUTED in v1.3, commit `eb1b49e`]
 **Source:** Mechanical scan, T1-4
 **Parent:** REQ-INB-9, REQ-INB-20
 **Confidence:** 0.90
@@ -226,7 +233,7 @@ All extraction prompts shall be version-controlled in `.opencode/commands/` and
 **Acceptance criterion:** `docs/papra-write-policy.md:192` updates the "covers 13 cases" claim to "covers 15 cases" (the v1.1 EXECUTE stage added 2 tests: `test_papra_dry_run_override_wins` and `test_emit_papra_write_gate_event_logs_three_fields`).
 
 ### REQ-INB-32 — `extraction-contract.md` line-ref refresh
-**Status:** [CANDIDATE]
+**Status:** [CANDIDATE — EXECUTED in v1.3, commit `3746f03`]
 **Source:** Mechanical scan, T1-5
 **Parent:** REQ-INB-4, REQ-INB-14
 **Confidence:** 0.85
@@ -236,7 +243,7 @@ All extraction prompts shall be version-controlled in `.opencode/commands/` and
 **Acceptance criterion:** `docs/extraction-contract.md` line refs (`pipelines/common.py:414-479`, `:605-624`, `:378-407`, and the opencode backend cite) update to the post-v1.0/v1.1 line-shuffled positions: `LLMConfig.from_env()` at `pipelines/common.py:536`, `ollama_run_command` at `pipelines/common.py:609`, `_ollama_call_one_model` at `pipelines/common.py:636`, the opencode backend at `pipelines/common.py:440`. The 4-line doc edit preserves the contract semantics (model pin, prompt path, JSON parse).
 
 ### REQ-INB-33 — `.env.example` 7-entry addition
-**Status:** [CANDIDATE]
+**Status:** [CANDIDATE — EXECUTED in v1.3, commit `b54df85`]
 **Source:** Mechanical scan, T1-6
 **Parent:** REQ-INB-6, REQ-INB-9, REQ-INB-11
 **Confidence:** 0.80
@@ -246,7 +253,7 @@ All extraction prompts shall be version-controlled in `.opencode/commands/` and
 **Acceptance criterion:** `.env.example` gains 7 commented-out entries (with the workflow-baked defaults) for: `OLLAMA_API_KEY=""`, `INBOXOS_LLM_BACKEND=ollama`, `PAPRA_DRY_RUN=true`, `PAPRA_BODY_WRITE_MODULES=crm,finance,legal`, `PAPRA_METADATA_ONLY_MODULES=intel,promotions`, `MBOX_BUCKET=`, `OPENCODE_NPM_VERSION=latest`. The new entries are grouped in a "Workflow tunables" section that the existing `IMAP_*` / `NOCODB_*` / `SEAWEEDFS_*` / `PAPRA_*` / `GITEA_*` blocks precede.
 
 ### REQ-INB-34 — Wire 6 v1.1 offline tests into `ci-pr.yml` merge gate
-**Status:** [CANDIDATE]
+**Status:** [CANDIDATE — EXECUTED in v1.3, commit `d20b789`]
 **Source:** Mechanical scan, T1-7; absorbs v1.3 PIT-V1.3-3
 **Parent:** REQ-INB-8
 **Confidence:** 0.90
@@ -266,7 +273,7 @@ All extraction prompts shall be version-controlled in `.opencode/commands/` and
 **Rationale:** The `opencode.json` file is tracked (5 commits) and the .gitignore pattern is intentional defense-in-depth (allows local override while still keeping a committed default). The footgun is real but minor; the fix (removing the .gitignore line) opens a separate question about whether the file should be tracked at all. Defer to v1.4 as a lead-developer judgment call.
 
 ### REQ-INB-36 — Runbook §6 ordering: `6.1 → 6.2 → 6.3 → 6.4`
-**Status:** [CANDIDATE]
+**Status:** [CANDIDATE — EXECUTED in v1.3, commit `fc2ae83`]
 **Source:** v1.1 backlog P1-1, T2-1
 **Parent:** REQ-INB-6
 **Confidence:** 0.95
@@ -276,7 +283,7 @@ All extraction prompts shall be version-controlled in `.opencode/commands/` and
 **Acceptance criterion:** `docs/operations-runbook.md` §6 renumbers from `6.1 → 6.4 → 6.2 → 6.3` to `6.1 → 6.2 → 6.3 → 6.4`. The v1.1 insertion of §6.4 (`Secret rotation`, REQ-INB-21) between §6.1 (`Secret inventory`) and §6.2 (`Why we never commit secrets`) is moved to its proper position (after §6.3). The renumber is a 4-section edit plus the §6 / §10 cross-references at the runbook footer.
 
 ### REQ-INB-37 — `scripts/setup_gitea_secrets.sh` `cto-inboxos` → `jc-capital`
-**Status:** [CANDIDATE]
+**Status:** [CANDIDATE — EXECUTED in v1.3, commit `349b59a`]
 **Source:** v1.1 backlog P1-2, T2-2
 **Parent:** REQ-INB-10
 **Confidence:** 0.90

.ciagent/inboxos/ROADMAP.md

@@ -136,3 +136,41 @@
   acceptance criteria, file:line evidence, and dispositions).
 - **Final candidates for PLAN/EXECUTE:** 9
   (REQ-INB-28, 29, 30, 31, 32, 33, 34, 36, 37).
+
+## v1.3 EXECUTE (Phase 01) **[executed 2026-06-08]**
+
+- **Goal**: land the 9 ACCEPT candidates as 8 PRs / 8 commits
+  on `phase/01-v1.3-execute`, FF-merge to `milestone/v1.3-initial`.
+- **Status**: executed 2026-06-08. The v1.3 acceptance gate
+  (9/12 disposition) is met. The verify report (4 layers PASS)
+  records 9/9 must-haves closed, 30/30 runnable offline
+  tests pass, 0 P0/P1/P2 issues, 0 blockers. The review
+  report (multi-persona, 5 active personas) is PASS-with-NITS.
+  The audit report (reconstruction + file + commit + CPO +
+  cross-project) is PASS.
+- **Issues**: REQ-INB-28 (P0, gitea-actions.md:95 cto-inboxos
+  drift, missed by v1.1 P0 sweep); REQ-INB-34 (P0, 6 v1.1
+  offline tests not in ci-pr merge gate); REQ-INB-37 (P1,
+  setup_gitea_secrets.sh cto-inboxos, v1.1 P1-2 carryover,
+  closed in same PR as REQ-INB-28); REQ-INB-29/30/31/32/33
+  (P2, doc-hygiene + env-file); REQ-INB-36 (P1, runbook §6
+  ordering, v1.1 P1-1 closure).
+- **Commits**: 8 EXECUTE commits (T1.1, T1.2, T2.1, T2.2,
+  T2.3, T2.4, T2.5, T3.1) on `phase/01-v1.3-execute`.
+  Net source-tree delta: 7 unique files (docs/gitea-actions.md,
+  scripts/setup_gitea_secrets.sh, .gitea/workflows/ci-pr.yml,
+  docs/operations-runbook.md, docs/extraction-contract.md,
+  docs/papra-write-policy.md, .env.example). Net diff:
+  ≈ 95-100 lines added.
+- **Artifacts**: `.ciagent/inboxos/verify/v1.3-PHASE1-REPORT.md`
+  (178 lines, 4-layer PASS), review commit on
+  `milestone/v1.3-initial`, audit commit on
+  `milestone/v1.3-initial`.
+- **Backlog closures**: 2/4 v1.1 backlog items closed in
+  v1.3 (P1-1 by REQ-INB-36, P1-2 by REQ-INB-37). P2-1 +
+  P2-2 deferred to v1.4+ (REQ-INB-38, REQ-INB-39 filed
+  in `v1.3-candidates.md §9`).
+- **Final state**: 9 ACCEPT (REQ-INB-28, 29, 30, 31, 32,
+  33, 34, 36, 37) closed in v1.3. 3 DEFER (REQ-INB-35,
+  38, 39) filed for v1.4+. 0 REJECT.
+- **Tag:** v1.3.0.