Epic: v1.7.0 single-tenant always-on Code Mower Operator

[jeffhuber]

Goal

Ship a single-tenant, continuously running Code Mower Operator that can be shared by a small team and continue supervised work while developer laptops are offline. Codex and Claude are initial qualified supervisors; Devin is an explicit full-peer target under the same evidence-based qualification contract.

Depends on completing the operational-clarity and minimum-telemetry boundary in #1066. Contract drafting may begin earlier, but active Operator mutation and release qualification must consume the released v1.6 contracts.

Dependency map

Contract first

• v1.7.0 contract: freeze Operator authority, state, recovery, and privacy #1085 — authority, state machine, storage, budgets, recovery, provider capability, and privacy contract

Foundation after the contract; parallel where file ownership permits

• v1.7.0 runtime: package the Linux container and doctor --container #1086 — reproducible non-root Linux container, Compose pilot, Linux runner parity, and doctor --container
• v1.7.0 persistence: durable store, singleton lease, and restart recovery #1087 — durable store, singleton lease, fencing, idempotency, migration, and restart recovery
• v1.7.0 identity: GitHub App service credentials and event reconciliation #1088 — GitHub App service identity plus polling/webhook reconciliation
• v1.7.0 visibility: private remote Board and Operator lifecycle projection #1089 — private remote Board and Operator lifecycle projection

Runtime; serial promotion from observation to mutation

• v1.7.0 shadow: run the persistent Operator in observe-only mode #1090 — operator run --once and continuously running observe-only service, followed by one-week shadow soak
• v1.7.0 active: bounded supervised dispatch, review, and escalation #1091 — bounded supervised dispatch, exact-head review/fix rounds, Slack owner escalation, and manual-merge pilot

Provider qualification; parallel after runtime contracts stabilize

• v1.7.0 providers: qualify Codex and Claude service-mode supervisors #1092 — interchangeable Codex and Claude service-mode supervisors
• v1.7.0 Devin: package deterministic CLI and hosted transports #1093 — packaged deterministic Devin CLI/hosted transport
• v1.7.0 Devin: qualify full-peer orchestration, building, and review #1094 — evidence-based Devin promotion to peer orchestrator, builder, and reviewer

Serial release

• v1.7.0 release: qualify the supervised single-tenant Operator #1095 — closed-laptop pilot, failure injection, docs, immutable qualification, publication, and rollback

Product boundary

• Single tenant and repository allowlist; not a multi-tenant hosted control plane.
• Private Board access through an authenticated ingress; Board remains loopback/private by default.
• GitHub App/service credentials replace shared personal PATs in the standard deployment.
• Metadata-only telemetry; no source, diffs, prompts, transcripts, issue bodies, private messages, raw output, credentials, or personal paths.
• Supervised operation with human merge approval by default.
• Provider capability and authority are versioned policy backed by evidence, not permanent provider-name exclusions.

Explicit deferrals

• OpenAI Agents API may be evaluated later as an alternate Codex transport behind the provider adapter; it is not an architectural dependency.
• Git AI may later enrich provenance and productivity events; it is not required for reliable operation.
• Factory and other providers wait for the provider kit and qualification harness proven here.
• Quota-aware routing waits for reliable cross-provider usage and settlement data.

Delivery rules

• One issue and one writer per PR.
• Contract-first issues merge before dependent runtime work.
• Parallel PRs must have explicit file/schema ownership and rebase before exact-head review.
• Every behavior change includes focused tests and canonical documentation.
• Every changed head receives an independent eligible review; resolve all P0/P1/P2 findings.
• Active mutation, provider promotion, and release are serial decisions.
• Live credentials, infrastructure, and mutation canaries remain owner-controlled.

[jeffhuber]

Orchestration update — contract track started

#1085 was dispatched to Claude through Code Mower run 35569511308. Its work order is restricted to versioned authority/state/recovery/privacy schemas, canonical fixtures, tests, threat/authority notes, and canonical documentation. It must not implement an Operator loop, active mutation, container runtime, GitHub App mutations, remote Board ingress, or cloud schema changes.

This PR is intentionally isolated from the three active v1.6 writers. The foundation issues #1086–#1089 remain undispatched until #1085 stabilizes its contract and their exact file/schema ownership can be assigned. Observe-only runtime, mutation, provider promotion, and release work remain gated in the epic's stated order.