48 lines
2.5 KiB
Markdown
48 lines
2.5 KiB
Markdown
# TASK: FINAL crush turn — harness runtime container + tool-widening (Redmine 521 + bootstrap)
|
|
|
|
## Context
|
|
Charles 2026-08-29: "alpha asap, then kill the screen/crush stack; bootstrap
|
|
the harness (docker container) FIRST." This is the LAST crush turn on the
|
|
harness repo. After it: the loop runs containerized AND its turns can do
|
|
build work — the self-hosted stack builds everything to beta/prod itself.
|
|
|
|
## Part A — runtime container (bootstrap)
|
|
1. `deploy/Dockerfile.runtime` — FROM alpine (digest-pinned), copies the
|
|
static release binary, dumb-init or tini entrypoint (or Go signal
|
|
handling — SIGINT graceful stop already exists).
|
|
2. `deploy/compose.yaml` — service `mopac-loop`: image built from
|
|
Dockerfile.runtime, `restart: unless-stopped`, env-file (0600) for
|
|
HARNESS_REDMINE_KEY / HARNESS_LITELLM_KEY, bind mounts: repo reports/
|
|
+ state/ (persistent), harness.toml read-only. Healthcheck: loop
|
|
exposes nothing by default — add `--healthz-port` flag or reuse events
|
|
healthz; simplest: a `loop --status-file` heartbeat the healthcheck
|
|
reads (age < 3x poll interval).
|
|
3. Verify LIVE: compose up, confirm scan + at least one autonomous turn
|
|
(the alpha queue has open tasks), `docker inspect` restart policy,
|
|
then leave the container RUNNING (it replaces the dev.sh screen).
|
|
4. Kill switch documented: `docker compose -f deploy/compose.yaml down`.
|
|
|
|
## Part B — tool-widening (ticket 521: loop turns do build work)
|
|
1. File tools behind the existing gate discipline (deny-first, scoped to
|
|
work_root, logged): read (offset/limit), exact-match edit, write (new
|
|
files), ls/glob/grep. Same denial-count + feedback semantics as the
|
|
bash tool.
|
|
2. Bash gate: verify `./dev.sh {build,vet,test}` and `git commit/push`
|
|
pass the allow-list from work_root; extend the allow-list minimally if
|
|
not (no broadening beyond dev.sh + git).
|
|
3. Per-turn wall-clock timeout (config `[loop] turn_timeout_secs`,
|
|
default 1800) — expired turn = partial REPORT + release.
|
|
4. Tests: file-tool gate denials, edit exact-match semantics, timeout
|
|
expiry, and an end-to-end loop turn against the fake Redmine that
|
|
edits a file + runs a no-op command + REPORTs.
|
|
|
|
## Discipline
|
|
TDD red/green, docker dev builder only, atomic conventional commits,
|
|
push origin main, NEVER broad pkill (docker stop by name is fine).
|
|
|
|
## Deliverable
|
|
`REPORT-20260829-1500-bootstrap.md` in `~/.coordinate/inbox-pmo/`:
|
|
container instructions (up/down/logs), healthcheck design, tool surface
|
|
added, test results, and confirmation the container processed a real
|
|
alpha task autonomously.
|