R1 deploy leg (REQ-v1-003 machinery set c18619; hep APPROVE c18623; vehicle call c18634). The merge IS the approval.
Reviewed from seat (head 67b806fc): additive only - .gitea/workflows/release.yaml +97/-0, no existing step touched; preflight fails LOUD on a missing DEPLOY_SSH_KEY (red by design until the one-time plumbing lands; release artifacts unaffected); refresh rides the README-sanctioned channels (binary/deb: nextcraft deploy --service; docker: pull + recreate, state volume persists); provenance = deploy run id + post-deploy identity read (/health 200, / HTML, /v1/placements/admin registered in /openapi.json); footer stays retired (c18624).
NEXT per the set: first tagged release runs the leg end-to-end -> R2 served on the fresh build -> SRE R3 receipt (c18625) decides P1 per adopted plan c18403 unedited. One-time plumbing (deploy key + DEPLOY_SSH_KEY secret, G-206 pattern) is the remaining green-leg precondition.
---ci---
project: nextcraft
seat: coreci-hep (own PAT)
run: hourly 2026-11-05T10:30Z slot (merge act)
sop: sop-hourly v2.0
The v0.11 phase-list header still read "active" and phase 0's Status cell
still read "active" after the milestone shipped, so the repo's own record
contradicted itself: the Overview read COMPLETE, phases 1-6 read complete,
and the table two lines below them read active. The ship commit 5bc899eef3
flipped the Overview entry and the P6 verdict row and left the phase table
behind — a reader of the phase table alone sees a live v0.11 on a line
whose next milestone is not scoped yet.
Evidence (read at source, 2026-10-27):
- .ciagent/ROADMAP.md Overview: "Milestone v0.11 — COMPLETE (shipped as
v0.10.6, 2026-10-22)".
- .ciagent/REQUIREMENTS.md header: "v0.11 Requirements (Complete — Placement
Tracking and Audit, Feature; shipped as v0.10.6)".
- Tags v0.10.0 (8684d9d60c) .. v0.10.6 (85ddf5ea22) exist; release v0.10.6
published 2026-10-22T04:41:47Z.
- main tip f4a35afbc9 — "chore(P06): clear checkpoint — milestone v0.11
complete".
Changed: 2 lines, 3 cells, status markers only.
- "### v0.11 (active)" -> "### v0.11 (complete — shipped as v0.10.6,
2026-10-22)"; the sibling headers read "### v0.8 (complete)" and
"## Phase List (v0.10 — complete)".
- Phase 0 Status "active" -> "complete (v0.10.0)" — P0 -> v0.10.0 on the
milestone's own tag line; the v0.10 table's phase 0 reads
"complete (v0.9.0)".
- Phase 0 success-criteria cell gets the same "complete (shipped as
v0.10.0)" marker the v0.10 table's phase 0 carries.
Blast radius: documentation only, one file (.ciagent/ROADMAP.md). No code,
no dependency, no config, no shipped artifact, no requirement or phase
touched. The milestone's scope is not rewritten — the cells now say what
the tag, the release and git history already say.
Never silently rewritten: every flip rides this auditable commit and the
merge request that carries it.
Milestone v0.11 (Placement Tracking and Audit) complete — shipped as
v0.10.6 (the v0.10.x final = the milestone release). All phases
verified + audited (P6 review SHIP, 0 P0s; D-112 audit PASS); merged
to main via PR #6; v0.10.5 (the deferred per-phase tag) + v0.10.6
(release lane on the tags). The next milestone opens at SPECIFY per
the D-062 rails.
Overview entry flipped to COMPLETE (shipped as v0.10.6, 2026-10-22);
the P6 row recorded with the final-review verdict (SHIP, 0 P0s, the two
P1 doc-level findings dispositioned) + the audit PASS + the ship facts.
Never silently rewritten: every flip rides this auditable commit.
Wave 6-1 multi-persona review (lead-developer): D-100 one-transaction
discipline VERIFIED (transition_application = the sole post-creation
status writer, R-78 — marketplace store carries no status write; one
Session, one commit covering both tables + the application row); R-80
re-hire coherence VERIFIED (rehire = fresh PlacementRow + placement.rehired,
never a fabricated application transition; partial-unique guard, the
IntegrityError surfaces); G-319 pin split VERIFIED (own-postings list
counts-only, test_postings_read.py negative PII assertion unchanged);
D-110 wire pins VERIFIED (placement.ts mirrors placements/base.py
field-for-field + status-union, pinned in pins.test.ts); D-092 census
VERIFIED (the overview mock block replaced by real placements; talent
mocks retained + honestly labeled; no fake-converted surface). Zero P0s.
Security-auditor pass: no credentials/identity PII on any log or asset
path (learner_id an opaque handle everywhere, R-79); gate orders pinned
per principal class (employer session->claim->entitlement; admin token;
learner allowlist->verified-18+->data); the ledger no-delete path intact
(R-70); tamper/fork/concurrency arms green; export determinism + the
G-321 methodology honesty re-verified; no secret echoed by any
exception path. Clean.
P1 findings, dispositioned with recorded follow-ups (never loop back
to EXECUTE): (1) PLAN Must-Haves names tests/placements/test_e2e_audit.py
but the D-111 E2E proof lives as tests/placements/test_export.py::
test_e2e_audit_proof — doc-path drift, substance verified green; (2) the
D-112 addition census omits employers/store.py L64-70 (the two-line
_AUDIT_EVENT_KINDS "application" vocabulary addition, P2 REQ-11-002
audit lane — in-scope, the census text incomplete).
Wave 6-2 audit (D-112 reconstruction): 27 branch commits vs the
.census — 18 added + 23 changed files, all placement-surface-scoped
(+ the .ciagent process set, README/deploy doc rows); feat commits
scoped to the placement surface; the two same-cycle CI red triages +
the disclosed probe.txt pair on main accounted. PASS.
---ci---
phase: 6
milestone: v0.11
status: ship_pending
---/ci---
REQ-11-005 complete: the mine point-read (G-322) + the learner status
read (D-104) + withdraw on the unchanged D-043 stack; the job-detail
status panel; A-304 badge honesty. CI #168 green both lanes after two
same-cycle red triages. REQ-11-005 row flipped complete (v0.10.5) in the
companion commit (its default title: Update REQUIREMENTS.md — contents
API message field, disclosed).
---ci---
phase: 5
milestone: v0.11
status: complete
requirements:
covered: [REQ-11-005]
partial: []
---/ci---
Plan: .ciagent/PLAN.md Phase 5 (waves 5-1/5-2); manager verdict nextcraft#1 (hep, 2026-10-19T19:29Z). P5 vertical slice per the binding wave order: store reads -> routes -> web wiring -> tests in the same wave.
Phase 1 complete: the 9th D-027 store (PlacementRow partial-unique
active guard + PlacementEventRow global sha256 hash chain with the
UNIQUE(prev_hash) fork backstop), the D-099 matrix + event
vocabulary, the ONE transactional transition_application (D-100,
flush-then-hash-then-commit), main.py/deps wiring, the 22-test
adversarial suite (tamper/fork/concurrency/no-delete-path), the
security review fixes (tz conversion, actor vocabulary, conftest
topology), verify four-layers PASS. Ships as v0.10.1.
---ci---
phase: 1
milestone: v0.11
status: complete
requirements:
covered: [REQ-11-001]
partial: []
---/ci---
The v0.10 milestone marked complete in the milestone
docs: REQUIREMENTS.md header → Complete — shipped as v0.9.6 (the
v0.9.x final patch = the milestone release per the tag-line model),
intro rewritten with the shipped-on-v0.9.x wording + all-5-complete
summary mirroring the v0.9 section; ROADMAP.md overview line →
COMPLETE (shipped as v0.9.6, 2026-10-01) and the v0.10 phase-list
phase 6 row → complete (v0.9.6, release 954) with the final
review/audit verdicts. The config.json milestone block stays v0.10;
the next milestone SPECIFY re-establishes it.
---ci---
phase: 6
milestone: v0.10
status: complete
requirements:
covered: [REQ-10-001, REQ-10-002, REQ-10-003, REQ-10-004, REQ-10-005]
partial: []
---/ci---
The v0.10 milestone: employers become principals of the marketplace
(REQ-F-019 activated as REQ-10-001..005 per D-085). Employer auth
with scrypt password hashing, hashed session tokens, and login/
register throttles (G-311/G-312/G-315); employer identity as claim/
verify over the v0.6 marketplace entities with advisory evidence
adjudication and admin approval (D-089/D-089/G-316/G-317); the
dashboard converted to real data with honest empty/pending/
processing states (no mock charts); self-serve postings through
the shared D-091 entitlement gate byte-identical with the admin
path (G-318/G-319); self-serve checkout over the v0.9 catalog
through the REAL webhook path with the own-session mock-complete
closing the G-301 class (G-302/G-303/G-304 carried forward); and
the admin network overview — accounts, claim queue, and audit in
one panel (D-094). Final review verdict SHIP: 2 P0s found and
fixed (the /me claim-state leak, the dead billing confirm button),
3 P1s dispositioned; audit PASS — reconstruction clean, discipline
green. Tags v0.9.0..v0.9.6 on the v0.9.x line; the tag lane builds
every release's full asset matrix per D-064.
---ci---
phase: 6
milestone: v0.10
status: complete
requirements:
covered: [REQ-10-001, REQ-10-002, REQ-10-003, REQ-10-004, REQ-10-005]
partial: []
---/ci---
coreci-hep
coreci-nextcraft-po
jonathan
CIAgent