docs: unattended-operation wave close-out (PRs #136–#139)

docs/audits/README.md

@@ -27,7 +27,7 @@ This directory holds DevStrap's chronological design & implementation audits. **
 
 Currently-actionable findings, pass-scoped. Earlier passes (1–3) are largely implemented or superseded (see `spec/18_WORK_LOG.md` for the shipped history); the open backlog is concentrated in passes 4, 5, and 6.
 
-> **2026-07-01 — Pass 6 landed.** The sixth pass ([`AUDIT_RECOMMENDATIONS_2026-07-01_PASS6.md`](AUDIT_RECOMMENDATIONS_2026-07-01_PASS6.md)) audited trunk `8c739b8` (PR #25) via a verification-driven nine-dimension workflow: 43 findings (P1=5, P2=25, P3=13), each adversarially verified against the code and checked for novelty against this backlog. Headlines: `P6-SEC-01`/`P6-SYNC-01` (the envelope layer still trusts the hub — unverified grant ingestion + whole-batch abort on one bad event), `P6-HUB-01`/`P6-DATA-01` (the now-live hub GC deletes live draft blobs), and `P6-GIT-01` (a universal 2-minute git timeout silently breaks eager materialization of large repos). This pass also **reconciled the ledger** below per convention #3: `P4-SEC-02` moved to *Recently shipped*, `P4-SEC-05` corrected to *partial* (its own finding is `P6-DOC-02`). **2026-07-02 update:** the hub-trust workstream (`P6-SYNC-01`, `P6-SEC-01`, `P6-SEC-02`; PRs #30–#34), `P6-DATA-01` (PR #35), `P6-HUB-01` (PR #36), and `P6-GIT-01` are shipped and moved to *Recently shipped* — **all five Pass 6 P1s are closed** (the AD-2 hardening-freeze P1 wave is complete). **2026-07-03 update:** `P6-DATA-02` is shipped; the open backlog is now the remaining P2/P3 set below. **2026-07-04 — snapshot-exchange wave (PRs #65–#76):** the event log is now BOUNDED — `P4-SYNC-02`/`P4-HUB-11` (compaction + full-state snapshot exchange, both P1s open since Pass 4), `P4-HUB-12`, `P4-SYNC-06` (narrowed), and Pass-6's `P6-HUB-04` shipped, alongside a parallel quick-win sub-wave closing seven Pass-6 P2/P3s (`P6-GIT-02`, `P6-GIT-03`, `P6-CLI-01`, `P6-XP-01`, `P6-QUAL-04`, `P6-QUAL-05`, `P6-DOC-04`; PRs #66–#72). Pass-6 drops 19→11 open. Every code PR carried dual review (coordinator line-by-line + Codex gpt-5.5, several with an additional opus pass); review findings fixed pre-merge include a fail-open hollow-manifest parse (P1), a CAS self-race, a byte-for-byte read-back gate before compaction deletes, a gc stale-list race, and an owner-aware sweep-lock release. **2026-07-03 (evening) — sync-convergence wave (PRs #59–#63):** `P5-SYNC-01` (the last AD-2 hardening-freeze critical — the freeze is COMPLETE), `P6-SYNC-02`, `P6-DATA-03/05/06`, `P6-XP-04`, and `P6-QUAL-01/02` shipped and moved to *Recently shipped*; Pass-6 drops 26→19 open. **2026-07-03 update:** `P6-GIT-02` shipped; Pass-6 drops 19→18 open. A separate 2026-07-03 **pairing wave** (`init --join --workspace-id` adoption, the founder-pinning ceremony, doctor mismatch detection, and the two-device runbook; PRs #48–#50 + the docs PR) closed the cross-device workspace-ID pairing remainder of `P4-SEC-07` and the joiner half of `P4-SEC-04` — both are Pass-4 findings tracked in the Pass 4 table, so the **Pass-6 count is unchanged** (they narrow, not close, and never counted toward the 43). **2026-07-04 update:** `P6-HUB-03` shipped (`fix/p6-hub-03`); Pass-6 drops 6→5 open. `P6-CLI-03` shipped (`fix/p6-cli-03`); 5→4 open. `P6-CLI-04` shipped (`fix/p6-cli-04`); 4→3 open. `P6-DOC-01` test-hardening residual shipped (`fix/p6-doc-01-test`); 3→2 open. `P6-XP-06` shipped (`fix/p6-xp-06`); 2→1 open. `P6-GIT-06` shipped (`fix/p6-git-06`); 1→0 open — **Pass 6 is fully closed (43/43).** **2026-07-05 — next wave chosen:** multi-device completeness — synced env-bundle exchange (`ENV-SYNC-01`) + synced device-trust propagation (`TRUST-01`); direction and backlog rows live in `spec/14_MVP_ROADMAP_AND_BACKLOG.md`.
+> **2026-07-01 — Pass 6 landed.** The sixth pass ([`AUDIT_RECOMMENDATIONS_2026-07-01_PASS6.md`](AUDIT_RECOMMENDATIONS_2026-07-01_PASS6.md)) audited trunk `8c739b8` (PR #25) via a verification-driven nine-dimension workflow: 43 findings (P1=5, P2=25, P3=13), each adversarially verified against the code and checked for novelty against this backlog. Headlines: `P6-SEC-01`/`P6-SYNC-01` (the envelope layer still trusts the hub — unverified grant ingestion + whole-batch abort on one bad event), `P6-HUB-01`/`P6-DATA-01` (the now-live hub GC deletes live draft blobs), and `P6-GIT-01` (a universal 2-minute git timeout silently breaks eager materialization of large repos). This pass also **reconciled the ledger** below per convention #3: `P4-SEC-02` moved to *Recently shipped*, `P4-SEC-05` corrected to *partial* (its own finding is `P6-DOC-02`). **2026-07-02 update:** the hub-trust workstream (`P6-SYNC-01`, `P6-SEC-01`, `P6-SEC-02`; PRs #30–#34), `P6-DATA-01` (PR #35), `P6-HUB-01` (PR #36), and `P6-GIT-01` are shipped and moved to *Recently shipped* — **all five Pass 6 P1s are closed** (the AD-2 hardening-freeze P1 wave is complete). **2026-07-03 update:** `P6-DATA-02` is shipped; the open backlog is now the remaining P2/P3 set below. **2026-07-04 — snapshot-exchange wave (PRs #65–#76):** the event log is now BOUNDED — `P4-SYNC-02`/`P4-HUB-11` (compaction + full-state snapshot exchange, both P1s open since Pass 4), `P4-HUB-12`, `P4-SYNC-06` (narrowed), and Pass-6's `P6-HUB-04` shipped, alongside a parallel quick-win sub-wave closing seven Pass-6 P2/P3s (`P6-GIT-02`, `P6-GIT-03`, `P6-CLI-01`, `P6-XP-01`, `P6-QUAL-04`, `P6-QUAL-05`, `P6-DOC-04`; PRs #66–#72). Pass-6 drops 19→11 open. Every code PR carried dual review (coordinator line-by-line + Codex gpt-5.5, several with an additional opus pass); review findings fixed pre-merge include a fail-open hollow-manifest parse (P1), a CAS self-race, a byte-for-byte read-back gate before compaction deletes, a gc stale-list race, and an owner-aware sweep-lock release. **2026-07-03 (evening) — sync-convergence wave (PRs #59–#63):** `P5-SYNC-01` (the last AD-2 hardening-freeze critical — the freeze is COMPLETE), `P6-SYNC-02`, `P6-DATA-03/05/06`, `P6-XP-04`, and `P6-QUAL-01/02` shipped and moved to *Recently shipped*; Pass-6 drops 26→19 open. **2026-07-03 update:** `P6-GIT-02` shipped; Pass-6 drops 19→18 open. A separate 2026-07-03 **pairing wave** (`init --join --workspace-id` adoption, the founder-pinning ceremony, doctor mismatch detection, and the two-device runbook; PRs #48–#50 + the docs PR) closed the cross-device workspace-ID pairing remainder of `P4-SEC-07` and the joiner half of `P4-SEC-04` — both are Pass-4 findings tracked in the Pass 4 table, so the **Pass-6 count is unchanged** (they narrow, not close, and never counted toward the 43). **2026-07-04 update:** `P6-HUB-03` shipped (`fix/p6-hub-03`); Pass-6 drops 6→5 open. `P6-CLI-03` shipped (`fix/p6-cli-03`); 5→4 open. `P6-CLI-04` shipped (`fix/p6-cli-04`); 4→3 open. `P6-DOC-01` test-hardening residual shipped (`fix/p6-doc-01-test`); 3→2 open. `P6-XP-06` shipped (`fix/p6-xp-06`); 2→1 open. `P6-GIT-06` shipped (`fix/p6-git-06`); 1→0 open — **Pass 6 is fully closed (43/43).** **2026-07-05 — next wave chosen:** multi-device completeness — synced env-bundle exchange (`ENV-SYNC-01`) + synced device-trust propagation (`TRUST-01`); direction and backlog rows live in `spec/14_MVP_ROADMAP_AND_BACKLOG.md`. **2026-07-06 — unattended-operation wave COMPLETE (PRs #136–#139):** issues #133/#134 closed, `P4-GIT-04` and `P4-PROD-04` shipped and moved to *Recently shipped*; see the spec/14 DIRECTION bullet.
 
 <!-- MD028 separator between adjacent dated blockquotes -->
 

spec/14_MVP_ROADMAP_AND_BACKLOG.md

@@ -559,3 +559,4 @@ These are validated forward-direction decisions from the sixth-pass viability re
 - **AD-1 — zero-infrastructure Hub backend for first-run adoption: COMPLETE 2026-07-05.** Both carriers are live behind the pluggable `Hub` interface. The private-git-repo carrier: `hub: git+ssh://…` (also `git+https://`, `git+file://`, scp-like, `?branch=`) syncs through any private git repo the user can already push to — `GitCarrierHub` composes the proven `R2Hub` semantics over a filesystem `S3Client` in a local clone, with a fetch/commit/push write loop (push-ref CAS replaces conditional PUT; non-fast-forward retries re-apply idempotent, path-disjoint mutations) and a `--force-with-lease` orphan-squash on `hub compact` to bound carrier history. The local-folder / cloud-drive-folder carrier: `hub: folder:<abs-path>` roots the same `fsObjectStore` directly in a shared directory (a cloud-drive folder or network mount is the replication transport, so there is no push loop — each op is lock → delegate → unlock), with the cross-process lock and observation floor kept in the LOCAL home cache (never replicated) and only ciphertext objects in the shared folder; `FolderHub` reuses the extracted `fsLock` cross-process lock helper. See `03_SYSTEM_ARCHITECTURE.md` (Hub backends) for the full design. Backlog rows: `[x] zero-infrastructure Hub backend — private-git-repo carrier (AD-1, 2026-07-04)`, `[x] live dogfood against a real private GitHub repo (spec/19 §F.2, 2026-07-04)`, `[x] git carrier as the documented quickstart default — r2:// demoted to scale/power (README/init hints/spec-13/spec-19, 2026-07-04)`; `[x] devstrap hub init <git-url> bootstrap convenience (2026-07-04)`; `[x] local-folder / cloud-drive-folder carrier (AD-1 complete, 2026-07-05)`.
 - **DIRECTION — distribution + OSS onboarding workstream (AD-8).** Adoption is bottlenecked on distribution and contributor friction, not features. Planned goals: cut `v0.1.0` through the existing GoReleaser pipeline (**v0.1.0 SHIPPED 2026-07-05** — tap/cask + `curl|sh` installer + completions live; the pipeline's same-commit rc → stable promotion was hardened live via the `GORELEASER_CURRENT_TAG` pin, PR #108); make the spec-drift/work-log gate **advisory on fork PRs** (**SHIPPED 2026-07-05** — `cmd/spec-drift --advisory` downgrades findings to `::warning::` annotations and exits 0; the CI workflow flips it on only when `github.event.pull_request.head.repo.full_name != github.repository`, so same-repo PRs and pushes stay blocking; `CONTRIBUTING.md` documents the fast path — the maintainer completes the bookkeeping at merge); extract a user-facing `docs/` tier (install / quickstart / self-hosting) distinct from the `spec/` design corpus (**SHIPPED 2026-07-05** — `docs/install.md`, `docs/quickstart.md`, `docs/self-hosting.md`); write a short human `ARCHITECTURE.md` (**SHIPPED 2026-07-05** — repo-root explanation tier with per-section depth pointers into `spec/`; the README's Install/Quickstart/Architecture sections now link the new tier and a Documentation pointer block); enable GitHub Discussions + good-first-issue labels (**SHIPPED 2026-07-05** — Discussions enabled, issue-template contact link, three curated starter issues #111–#113 labeled from the open backlog: `P5-CLI-03`, `P5-CLI-01` render rollout, `P4-QUAL-07` contextcheck); reframe `AGENTS.md` as the maintainer's agent workflow rather than a contributor obligation (**SHIPPED 2026-07-05** — scope banner at the top of `AGENTS.md`); and plan for bus-factor by recruiting a second write-access maintainer.
 - **DIRECTION — multi-device completeness wave (2026-07-05).** With Pass 6 closed (43/43), the AD-2 freeze complete, and AD-1/AD-8 shipped, the next wave closes the two remaining genuinely-unbuilt gaps in the Phase-2 multi-device story (both still "Not implemented yet" in `00_START_HERE.md`): [x] `ENV-SYNC-01` (SHIPPED 2026-07-05) — synced encrypted env-bundle exchange: a new `env.profile.updated` event carries the captured profile's `age_blob:<sha256>` ref + binding metadata over the existing blob plane (capture already encrypts to every approved device's age recipient via `envRecipients`), with LWW apply by source-event coordinate, `mustVerifyEvent` inclusion, revoke-rewrap promotion to hub-carried semantics, and a snapshot-plane env pointer so profiles survive compaction; `env hydrate`/`materialize` on the receiving device then work unchanged. [x] `TRUST-01` (SHIPPED 2026-07-05) — synced device-trust propagation: `device.revoked`/`device.lost` events (signed, `mustVerifyEvent`) so one device's revoke reaches the whole fleet; sticky/monotonic apply (only `pending`/`approved` transition; a local fingerprint ceremony is the only resurrection path); `device.approved` deliberately NOT propagated — approval stays the local P4-SEC-04 ceremony; receiving devices flag `secret_bindings.needs_rotation`.
+- **DIRECTION — unattended-operation wave (2026-07-06): COMPLETE.** Four PRs (#136–#139), all dual-reviewed, made DevStrap safe to run always-on with nobody watching: [x] issue #133 — a stale/early `draft.snapshot.created` quarantines as a replayable `draft_pending_project` conflict instead of aborting the whole pull batch (malformed draft/env payloads quarantine-as-consumed on both planes); [x] issue #134 — a failed revoke-path WCK rotation persists an owed-rotation marker that every `sync` cycle retries (Rotate-only resolution; early failures warn-and-continue so the `device.revoked` event still propagates); [x] `P4-GIT-04` — `worktree cleanup --merged` reaps squash/rebase-merged worktrees via the `git merge-tree --write-tree` current-tree probe (revert-safe; tip-SHA reap breadcrumb); [x] `P4-PROD-04` — `devstrap service install|uninstall|status` wraps `run-loop` in a launchd LaunchAgent / systemd user service, live-dogfooded on real launchd pre-merge. Remaining backlog after this wave: the three community starter issues (#111–#113), the Pass-4 residuals (`P4-SEC-05` notarization — blocked on Apple enrollment; `P4-SEC-08`, `P4-SYNC-03/05/07/08`, `P4-HUB-14` metrics half, `P4-HUB-15/16`, `P4-GIT-07`, `P4-QUAL-04` Windows half, `P4-QUAL-07`), and the gated capability planes (daemon, HTTP/SSE relay, StrapFS). A Pass-7 audit is the natural next checkpoint now that four waves have landed since Pass 6's trunk snapshot.

spec/18_WORK_LOG.md

@@ -31,6 +31,19 @@ Follow-ups:
 
 Entries are newest-first: each code-modifying cycle prepends ONE dated entry at the top.
 
+## 2026-07-06 — docs: unattended-operation wave close-out (PRs #136–#139)
+
+Changed:
+- `spec/14_MVP_ROADMAP_AND_BACKLOG.md`: new `DIRECTION — unattended-operation wave (2026-07-06): COMPLETE` bullet recording the four shipped items (issue #133 draft-pending quarantine, issue #134 self-healing WCK rotation, `P4-GIT-04` squash-merge worktree GC, `P4-PROD-04` `devstrap service`), the remaining backlog after the wave, and the Pass-7 audit as the natural next checkpoint.
+- `docs/audits/README.md`: the intro blockquote's wave trail extended with the 2026-07-06 completion note (both ledger row moves happened in their own PRs; header counts unchanged).
+
+Validated:
+- Docs-only; ledger open-count invariant unaffected (no rows moved in this PR).
+
+Follow-ups:
+- None (wave complete).
+
+
 ## 2026-07-06 — feat(service): devstrap service install|uninstall|status (P4-PROD-04)
 
 Changed: