# REPORT — 2026-08-29 15:00 — Bootstrap: runtime container + tool-widening (Redmine 521 + 523)

- turn: FINAL crush turn on the harness repo (q15), Charles directive
  "alpha asap, then kill the screen/crush stack; bootstrap the container FIRST"
- commits pushed to `ukrrs/MOPAC` main: `064aed0` (brief 495 landing),
  `e1b519d` (file tools), `e905515` (loop wiring + bound + heartbeat),
  `02013d3` (runtime container), `19d61a0` (docs)
- the `mopac-loop` compose service is RUNNING and healthy as of writing;
  it processed alpha task 523 autonomously end-to-end (proof below)

## 1. Runtime container (Part A)

Files: `deploy/Dockerfile.runtime`, `deploy/compose.yaml` (runbook appended
to `deploy/runbook.md`, README section added).

- Image: digest-pinned `alpine@sha256:143583...` (alpine 3.22) + the
  STATIC release binary (`make release`, CGO off, built in the
  digest-pinned golang builder — never on the host) + `bash` (the bash
  tool / dev.sh), `git` (turn commits), `docker-cli` (dev.sh builder
  client). No ENTRYPOINT: SIGINT graceful stop is Go's; zombie reaping is
  docker's built-in init (`init: true` in compose — docker's tini, zero
  extra packages, image stays digest-pure).
- Same-path bind trick: the repo is mounted at its HOST path
  (`HARNESS_REPO`, default `/home/reachableceo/projects/meta/MOPAC/harness`)
  so a turn's `./dev.sh build` inside the container bind-mounts a path the
  HOST docker daemon understands — builders remain digest-pinned
  siblings; nothing toolchain-shaped touches the host. `harness.toml`
  overlays read-only (turns can edit the repo, not their own gate).
- Secrets: `~/.coordinate/secrets/mopac-loop/` (0700): `loop.env` (0600,
  HARNESS_REDMINE_KEY + HARNESS_LITELLM_KEY), container `.gitconfig` +
  `git-credentials` (0600, gitea token via credential store — turn pushes
  authenticate; commits attributed to the vertical).
- Placement knobs: `HARNESS_REPO`, `HARNESS_SECRETS`, `HARNESS_UID/GID`
  (1001 on this host — the first boot caught the 1000 default and was
  fixed by parameterizing).

### Healthcheck design (no port)

`harness loop --status-file state/loop/status.json` maintains a heartbeat
JSON — beats on EVERY scan plus a safety ticker at min(poll/3, 30s), so a
long turn (up to the 1800s bound) never stales it past the threshold. The
compose healthcheck is pure mtime age: unhealthy when older than 360s
(= 3x the default 120s poll; keep in sync if the poll changes). Content:
`{vertical, pid, started_at, running, scans, dispatched, reports,
last_scan_at, last_scan_error, last_beat}` — `running:false` on clean
stop, `last_scan_error` set while Redmine is down but the daemon lives
(that is deliberately NOT unhealthy: scan errors retry next tick).

### Container instructions

```sh
cd ~/projects/meta/MOPAC/harness
make release                                           # static binary
docker compose -f deploy/compose.yaml up -d --build    # up
docker compose -f deploy/compose.yaml logs -f mopac-loop
docker inspect mopac-loop --format '{{.State.Health.Status}}'
docker compose -f deploy/compose.yaml down             # KILL SWITCH
```

Verified live: `state=running restart=unless-stopped health=healthy`.

## 2. Tool-widening (Part B, Redmine 521)

- File tools (`internal/tools/files.go`): `read` (numbered lines,
  offset/limit, binary refusal, byte cap), `edit` (exact-match; unique
  unless `replace_all`; never writes on failure), `write` (NEW files only
  — no clobbering), `ls`, `glob` (`**` support, mtime-sorted, capped),
  `grep` (RE2, mtime-sorted file list, capped). Deny-first like the bash
  gate: anything outside `work_root` — absolute, `..`, or symlink escapes
  (canonicalized via deepest existing ancestor) — returns `ErrDenied`,
  counted and fed back to the model with the same semantics as bash
  denials. Writes are temp+rename atomic. Every call leaves one audit
  line on stdout (tool name + outcome only, never arguments).
- Bash gate: allow-list extended MINIMALLY to the build surface —
  `./dev.sh *`, `make check`, `make release`, `git add *`, `git commit *`,
  `git push *` (both `harness.toml.example` and live `harness.toml`).
  Enforced by `TestShippedAllowListCoversDevAndGit`, which parses
  `harness.toml.example` itself so the preset cannot drift from the
  acceptance (dev.sh build/vet/test/check + git commit/push pass;
  sudo/curl/docker run/python3/go run still default-deny).
- Turn budget: `[loop] turn_timeout_secs` (default 1800, 0 = off). An
  expired turn keeps partial content, writes a partial REPORT with
  stop_reason `turn_timeout`, and releases the task (the pre-turn dedup
  marker prevents hot-looping; PMO re-releases by updating the issue).

## 3. Test results (`./dev.sh check` — build + vet + test, docker builder)

All green: brief, config, events, intake, llm, loop, models, quota,
serve, tools, writeback. New coverage:
- file-tool gate denials (absolute/`..`/symlink escapes → ErrDenied;
  missing file = plain error, not denial), edit exact-match semantics
  (not-found no-write, ambiguity count, replace_all, old==new refusal),
  write new-files-only, read offset/limit + truncation, ls/glob/grep
  scoping + include filter + invalid regexp
- timeout expiry: partial REPORT written with `turn_timeout`, err chain
  carries ErrTurnTimeout, zero disables the bound
- allow-list acceptance vs the shipped preset (see above)
- heartbeat: file appears + fields, `running:false` after clean stop,
  mtime keeps refreshing while scans cycle (poll=1s), scan errors
  recorded without flipping running
- END-TO-END fake-Redmine loop turn: reads a file, EDITS it (verified on
  disk), runs an allow-listed no-op bash command, REPORTs — note lands on
  the issue, status transitions per the map, tool audit lines present;
  a denied write outside the root still completes the turn with the note

## 4. Live autonomous proof (the alpha queue)

Old dev.sh loop container drained its queue (519 writebacks recovered,
523 turn completed 12:19Z), then was stopped BY NAME and replaced:
`docker stop mopac-loop` → `docker compose up -d`. The new container's
scan 2 dispatched re-queued task **523** (the exit-gate ticket itself) at
12:22Z and completed it autonomously at 12:31Z on glm-4.7-flash:

- tools used live: bash (2 ok), glob (2 ok), read (2 ok) — the new file
  palette in production
- gate denials live: `docker ps -a` and `screen -ls` refused with
  model-facing feedback (default deny held)
- REPORT `reports/REPORT-demo-523-20260829-123112.md` (rounds=8,
  tool_calls=8, denied=2, stop=round_limit), Redmine note posted,
  status New → Resolved
- heartbeat counted it: `{"scans":2,"dispatched":1,"reports":1}`,
  health=healthy throughout

## 5. Notes / handoff

- The killed 495 turn's completed-but-uncommitted work (brief surface,
  discourse client vendored) was landed first as its own commit so 521
  started from a green tree; LIVE discourse delivery on 495 remains open
  (queue task 519's follow-up belongs to the loop now — it has the tools).
- 523's flash turn hit the 8-round bound while exploring (stop=
  round_limit, 23.8k tokens). If turns routinely saturate rounds on
  study-class tasks, consider `[loop] max_rounds` 8 → 12 for the alpha
  queue; not changed unilaterally.
- `harness.toml` (live) updated with `turn_timeout_secs = 1800`,
  `[tools.files] enabled = true`, extended allow-list — file is
  gitignored, mirrored into `harness.toml.example` (committed).
- Kill switch documented in compose header, README, runbook:
  `docker compose -f deploy/compose.yaml down`. No broad pkill was used
  at any point (`docker stop mopac-loop` by name only).
- The crush/screen stack can now be retired per the exit gate: the loop
  is containerized, restart-policied, healthchecked, and its turns can
  do build work through the same digest-pinned docker builder discipline.