# TASK: FINAL crush turn — harness runtime container + tool-widening (Redmine 521 + bootstrap)

## Context
Charles 2026-08-29: "alpha asap, then kill the screen/crush stack; bootstrap
the harness (docker container) FIRST." This is the LAST crush turn on the
harness repo. After it: the loop runs containerized AND its turns can do
build work — the self-hosted stack builds everything to beta/prod itself.

## Part A — runtime container (bootstrap)
1. `deploy/Dockerfile.runtime` — FROM alpine (digest-pinned), copies the
   static release binary, dumb-init or tini entrypoint (or Go signal
   handling — SIGINT graceful stop already exists).
2. `deploy/compose.yaml` — service `mopac-loop`: image built from
   Dockerfile.runtime, `restart: unless-stopped`, env-file (0600) for
   HARNESS_REDMINE_KEY / HARNESS_LITELLM_KEY, bind mounts: repo reports/
   + state/ (persistent), harness.toml read-only. Healthcheck: loop
   exposes nothing by default — add `--healthz-port` flag or reuse events
   healthz; simplest: a `loop --status-file` heartbeat the healthcheck
   reads (age < 3x poll interval).
3. Verify LIVE: compose up, confirm scan + at least one autonomous turn
   (the alpha queue has open tasks), `docker inspect` restart policy,
   then leave the container RUNNING (it replaces the dev.sh screen).
4. Kill switch documented: `docker compose -f deploy/compose.yaml down`.

## Part B — tool-widening (ticket 521: loop turns do build work)
1. File tools behind the existing gate discipline (deny-first, scoped to
   work_root, logged): read (offset/limit), exact-match edit, write (new
   files), ls/glob/grep. Same denial-count + feedback semantics as the
   bash tool.
2. Bash gate: verify `./dev.sh {build,vet,test}` and `git commit/push`
   pass the allow-list from work_root; extend the allow-list minimally if
   not (no broadening beyond dev.sh + git).
3. Per-turn wall-clock timeout (config `[loop] turn_timeout_secs`,
   default 1800) — expired turn = partial REPORT + release.
4. Tests: file-tool gate denials, edit exact-match semantics, timeout
   expiry, and an end-to-end loop turn against the fake Redmine that
   edits a file + runs a no-op command + REPORTs.

## Discipline
TDD red/green, docker dev builder only, atomic conventional commits,
push origin main, NEVER broad pkill (docker stop by name is fine).

## Deliverable
`REPORT-20260829-1500-bootstrap.md` in `~/.coordinate/inbox-pmo/`:
container instructions (up/down/logs), healthcheck design, tool surface
added, test results, and confirmation the container processed a real
alpha task autonomously.