docs(archive): Batch archive of 20 PRs

docs/pr-discussions/PR-5363-fix-gemini-isolate-background-loop-launchd-plist-to-dedicate.md

@@ -0,0 +1,62 @@
+---
+pr_number: 5363
+title: "fix(gemini): isolate background loop launchd plist to dedicated workspace"
+author: "AceHack"
+state: "MERGED"
+created_at: "2026-05-27T00:15:49Z"
+merged_at: "2026-05-27T01:18:19Z"
+closed_at: "2026-05-27T01:18:19Z"
+head_ref: "lior/isolate-background-loop-plist"
+base_ref: "main"
+archived_at: "2026-05-27T19:29:01Z"
+archive_tool: "tools/pr-preservation/archive-pr.ts"
+---
+
+# PR #5363: fix(gemini): isolate background loop launchd plist to dedicated workspace
+
+## PR description
+
+## Summary
+
+Migrates Lior's background loop runner launchd daemon from Aaron's contested primary checkout to the isolated clone directory (`/Users/acehack/.local/share/zeta-lior-loop/Zeta`), aligning with Codex and Riven isolated agent loop architecture (B-0751).
+
+## Changes
+
+- `.gemini/launchd/com.zeta.lior-loop.plist`: Point `ProgramArguments` and `WorkingDirectory` to the isolated clone directory instead of the shared primary checkout.
+
+Co-Authored-By: Gemini <noreply@google.com>
+
+## Reviews
+
+### COMMENTED — @copilot-pull-request-reviewer (2026-05-27T00:18:14Z)
+
+## Pull request overview
+
+Updates the Gemini “Lior loop” launchd configuration to run from an isolated per-agent clone rather than the shared primary checkout, aligning the background loop runner with the isolated-workspace architecture described in B-0751.
+
+**Changes:**
+- Point `ProgramArguments` at the tick script inside `~/.local/share/zeta-lior-loop/Zeta` instead of the primary checkout.
+- Add `WorkingDirectory` to the isolated clone root to ensure the job executes from that repo.
+- Add an explicit `PATH` environment variable for the launchd job.
+
+### COMMENTED — @AceHack (2026-05-27T01:16:13Z)
+
+_(no body)_
+
+## Review threads
+
+### Thread 1: .gemini/launchd/com.zeta.lior-loop.plist:11 (resolved)
+
+**@copilot-pull-request-reviewer** (2026-05-27T00:18:13Z):
+
+P1/maintainability: This plist now hardcodes machine-specific absolute paths (/Users/acehack, /opt/homebrew, and the per-agent clone under ~/.local/share/...), but unlike the sibling plists in `.gemini/launchd/` it doesn’t include the “Maintainer-only artifact / update paths for your local machine” header comment. Adding that note here would prevent others from assuming it’s a team-wide usable service file and trying to `launchctl load` it unchanged.
+
+**@AceHack** (2026-05-27T01:16:13Z):
+
+Addressed in 73e808b — added the `Maintainer-only artifact` header comment after the `<key>Label></string>` line, mirroring the convention in `com.zeta.backlog-ready-notifier.plist` and `com.zeta.missed-substrate-detector.plist`. Specifically names the three machine-specific path classes (`/Users/acehack`, `/opt/homebrew`, the per-agent clone under `~/.local/share/zeta-lior-loop/Zeta`) so readers see the warning before attempting `launchctl load`.
+
+## General comments
+
+### @chatgpt-codex-connector (2026-05-27T00:15:53Z)
+
+You have reached your Codex usage limits for code reviews. You can see your limits in the [Codex usage dashboard](https://chatgpt.com/codex/cloud/settings/usage).

docs/pr-discussions/PR-5364-fix-b-0835-bug-2a-2b-iter-5-4-install-gh-auth-setup-git-ssh.md

@@ -0,0 +1,93 @@
+---
+pr_number: 5364
+title: "fix(B-0835 Bug 2a + 2b): iter-5.4 install \u2014 gh auth setup-git + ssh-key scope discrimination"
+author: "AceHack"
+state: "MERGED"
+created_at: "2026-05-27T00:33:18Z"
+merged_at: "2026-05-27T00:36:02Z"
+closed_at: "2026-05-27T00:36:02Z"
+head_ref: "fix-b0835-bug2ab-gh-auth-setup-git-ssh-key-scope-handling-otto-cli-2026-05-26"
+base_ref: "main"
+archived_at: "2026-05-27T19:29:00Z"
+archive_tool: "tools/pr-preservation/archive-pr.ts"
+---
+
+# PR #5364: fix(B-0835 Bug 2a + 2b): iter-5.4 install — gh auth setup-git + ssh-key scope discrimination
+
+## PR description
+
+## Empirical anchor — 2026-05-26 2nd physical hardware-support test
+
+Aaron's screen photo (verbatim console output from re-flashed USB run after Bug 1 + Bug 3b fixes landed):
+
+\`\`\`
+[iter-5.4.0] Run gh auth login now? [Y/n]: Y
+[iter-5.4.0]   running 'gh auth login' (interactive)...
+! First copy your one-time code: D30B-468F
+Open this URL to continue in your web browser: https://github.com/login/device
+■ Authentication complete.
+! Authentication credentials saved in plain text
+■ Logged in as AceHack
+[iter-5.4.0]   gh auth login: SUCCESS
+[iter-5.4.0]   fetching operator's SSH pubkeys via 'gh ssh-key list'...
+[iter-5.4.0]   WARN: 'gh ssh-key list' failed; no keys written
+[iter-5.4.0]   (gh auth succeeded but the user has no SSH keys
+[iter-5.4.0]   registered with GitHub, OR the jq/tee pipe broke)
+[iter-5.4.1] ── self-registration commit+push (B-0812) ──
+[iter-5.4.1]   maintainer:  AceHack
+[iter-5.4.1]   node-name:   node-efe404
+Switched to a new branch 'register-node-efe404-20260527T0005332'
+Username for 'https://github.com': acehack
+Password for 'https://acehack@github.com':
+\`\`\`
+
+Two sub-bugs surfaced (both new — beyond Bug 1 / Bug 3 already fixed this session).
+
+## Bug 2a — CRITICAL — git push prompts HTTPS basic-auth despite gh auth login
+
+Root cause: \`gh auth login\` stores token in gh config but does NOT configure git's credential helper. Without setup-git, \`git push\` goes through the default credential-store chain which doesn't know about gh's token.
+
+Fix: insert \`gh auth setup-git\` immediately after successful \`gh auth login\` in zeta-install.sh Step 6.8. Configures \`credential.helper\` to delegate to \`gh auth git-credential\` so all github.com git operations automatically use the gh token. Failure is non-fatal (warning only).
+
+## Bug 2b — degraded — gh ssh-key list returns empty / fails
+
+Root cause discrimination: \`gh auth login\` default scopes (\`repo, read:org, workflow, gist\`) do NOT include \`admin:public_key\` or \`read:public_key\` required by \`gh ssh-key list\`. Empty result could also mean operator has no SSH keys at GitHub.
+
+Fix: capture stderr from \`gh ssh-key list\`; if empty result + stderr mentions scope, print substrate-honest recovery commands (\`gh auth refresh -s admin:public_key\` + populate + rebuild). If empty without scope-error, point to https://github.com/settings/keys.
+
+Defers opt-in \`--with-ssh-key-scope\` flag to future B-NNNN (security tradeoff: don't ask for elevated scope by default).
+
+## Files
+
+- \`full-ai-cluster/usb-nixos-installer/zeta-install.sh\` — \`gh auth setup-git\` after login; stderr-capturing ssh-key-list with 3-way discrimination (success / empty-with-scope-error / empty-no-scope-error / pipe-broke)
+- \`docs/backlog/P1/B-0835-*.md\` — Bug 2a + 2b verbatim empirical anchors + fix specs + acceptance criteria for 3rd physical test
+
+## Acceptance for next physical test cycle
+
+- iter-5.4.1 \`git push\` completes silently without basic-auth prompt
+- Self-registration PR URL is printed + browseable on github.com
+- If operator has SSH keys: writes operator-authorized-keys with key count
+- If operator has no SSH keys at GH: substrate-honest WARN points to settings/keys
+- If scope-error: substrate-honest WARN provides recovery commands
+
+## Composes with
+
+- B-0835 (this row — Bug 2a + 2b empirical anchors land in body)
+- B-0812 iter-5.4.1 self-registration (the step Bug 2a blocks)
+- B-0813 iter-5.4.2 ArgoCD reconciliation (downstream of self-reg)
+- B-0834 install log preservation (would have diagnosed Bug 2a faster — composes)
+- B-0833 auth tension (Bug 2a is concrete instance of the interactive-login vs token-baked tension)
+
+## Substrate-honest framing
+
+This is a continuation of the autonomous-loop physical-test fix cycle. Per Aaron's "great iteration we learned a lot" the loop is: test → bug → fix → re-flash → re-test. Bug 1 + Bug 3a + Bug 3b shipped in prior PRs this session; Bug 2 was diagnosis-dependent; the 2nd test surfaced it as two distinct sub-bugs (2a + 2b) with concrete fix paths.
+
+Per \`.claude/rules/verify-existing-substrate-before-authoring.md\`: substrate-inventory pass found B-0835 already names "gh login not respected" at Bug 2 scope; this PR extends with 2 specific sub-bugs rather than minting parallel substrate.
+
+🤖 Generated with [Claude Code](https://claude.com/claude-code)
+
+## General comments
+
+### @chatgpt-codex-connector (2026-05-27T00:33:24Z)
+
+You have reached your Codex usage limits for code reviews. You can see your limits in the [Codex usage dashboard](https://chatgpt.com/codex/cloud/settings/usage).

docs/pr-discussions/PR-5365-ci-b-0831-layer-1-extend-audit-installer-substrate-with-iter.md

@@ -0,0 +1,109 @@
+---
+pr_number: 5365
+title: "ci(B-0831 layer-1): extend audit-installer-substrate with iter-5.4 sentinels"
+author: "AceHack"
+state: "MERGED"
+created_at: "2026-05-27T00:41:12Z"
+merged_at: "2026-05-27T00:59:02Z"
+closed_at: "2026-05-27T00:59:02Z"
+head_ref: "ci-layer1-iter54-sentinels-audit-installer-substrate-otto-cli-2026-05-26"
+base_ref: "main"
+archived_at: "2026-05-27T19:28:59Z"
+archive_tool: "tools/pr-preservation/archive-pr.ts"
+---
+
+# PR #5365: ci(B-0831 layer-1): extend audit-installer-substrate with iter-5.4 sentinels
+
+## PR description
+
+## Layer 1 of 4-layer CI testing approach for iter-5.4 substrate
+
+Aaron asked: *"yeah push forward a bit maybe create some more ci tests how do you want to test the gh login flow?"*
+
+The 4-layer plan:
+
+| Layer | Approach | Cost | Catches |
+|---|---|---|---|
+| **Layer 1 (THIS PR)** | Source-level sentinel audit | Seconds | Substrate regression (text-level) |
+| Layer 2 (next PR) | Behavioral test with mock \`gh\` shim on PATH | ~1s | Conditional-logic regression |
+| Layer 3 ([B-0833](https://github.com/Lucent-Financial-Group/Zeta/blob/main/docs/backlog/P1/B-0833-installer-interactive-login-vs-baked-in-keys-ci-test-tension-resolve-without-shipping-credentials-aaron-2026-05-26.md) Approach A) | Mock GH device-code endpoint | ~10s | Real interactive-login flow without humans |
+| Layer 4 ([B-0831](https://github.com/Lucent-Financial-Group/Zeta/blob/main/docs/backlog/P1/B-0831-ci-cascade-6-full-install-plus-cluster-auto-join-eliminate-routine-human-physical-usb-test-aaron-2026-05-26.md) cascade #6) | QEMU full-install + cluster auto-join | Minutes | End-to-end including reboot + ArgoCD |
+
+## What this PR adds
+
+Extends \`REQUIRED_SENTINELS\` for \`full-ai-cluster/usb-nixos-installer/zeta-install.sh\` with 14 new substrings:
+
+### (a) iter-5.4 flow anchors
+- \`Step 6.8: iter-5.4.0 homelab gh-auth + operator pubkey copy\`
+- \`Step 6.9: iter-5.4.1 self-registration commit+push\`
+- \`gh auth login\`
+- \`gh ssh-key list\`
+- \`gh repo clone Lucent-Financial-Group/Zeta\`
+
+### (b) Bug 2a + 2b fix-regression catches (PR #5364)
+- \`gh auth setup-git\` — Bug 2a fix
+- \`SSH_KEY_ERR_FILE\` — Bug 2b stderr capture
+- \`admin:public_key\` — Bug 2b scope-recovery guidance
+
+### (c) ClusterNode YAML schema sentinels (PR #5352 Copilot findings)
+- \`apiVersion: zeta.lucent-financial-group.com/v1\`
+- \`kind: ClusterNode\`
+- \`  roles:\` — spec.roles is ARRAY (was scalar spec.role)
+- \`  registration:\` — spec.registration block (was spec.maintainer flat)
+- \`  hardware:\` — spec.hardware block (storage was sibling)
+
+### (d) Hardware-probe sentinels (MAC parsing regression catch)
+- \`/proc/cpuinfo\` — CPU_MODEL extraction
+- \`link/ether\` — MAC parses field AFTER link/ether
+
+### (e) Self-reg branch shape
+- \`register-\${NODE_HOSTNAME}-\` — iter-5.4.1 branch name pattern
+
+## Verified
+
+\`\`\`
+\$ bun tools/ci/audit-installer-substrate.ts
+audit-installer-substrate: PASS — 10 required files + 5 sentinel-file assertions OK
+\`\`\`
+
+Runs in the existing \`build-ai-cluster-iso.yml\` workflow on every PR touching the installer surface.
+
+## Composes with
+
+- PR #5364 (Bug 2a + 2b fixes — this audit catches removal)
+- PR #5352 (iter-5.4.1 Copilot YAML schema findings — this audit catches regression)
+- B-0831 (cascade #6 full-install QEMU; this is layer 1)
+- B-0833 (interactive-login vs baked-in-keys; layer 3 of cascade)
+
+## Substrate-honest framing
+
+Layer 1 doesn't test BEHAVIOR — only that the substrate is PRESENT. A future Aaron-edit that accidentally removes \`gh auth setup-git\` would be caught by this layer; an edit that changes \`gh auth setup-git\` to \`gh auth setup-git --hostname github.com\` would still pass (substring match). Layer 2 (mock-gh shim) catches behavioral regressions; this layer is the cheapest first line of defense.
+
+🤖 Generated with [Claude Code](https://claude.com/claude-code)
+
+## Reviews
+
+### COMMENTED — @copilot-pull-request-reviewer (2026-05-27T00:43:07Z)
+
+## Pull request overview
+
+Extends the source-level CI sentinel audit for the AI-cluster installer substrate to cover the iter-5.4.0/5.4.1 GitHub auth + self-registration flows, so text-level regressions (dropped commands / dropped YAML schema anchors) are caught quickly in CI.
+
+**Changes:**
+- Added iter-5.4 sentinel substrings for `zeta-install.sh` covering gh auth, ssh-key retrieval, repo clone, and registration-branch shape.
+- Added schema/hardware-probe sentinels to catch regressions in ClusterNode YAML composition and MAC parsing.
+- Updated the sentinel rationale string to reflect the newly-audited substrate.
+
+## Review threads
+
+### Thread 1: tools/ci/audit-installer-substrate.ts:100 (resolved)
+
+**@copilot-pull-request-reviewer** (2026-05-27T00:43:07Z):
+
+The comment starting "iter-5.4.1 YAML schema sentinels" is missing a closing ")" on the first line, which makes the sentence read as unfinished. Please close the parenthesis and/or reflow the comment so it’s a complete sentence.
+
+## General comments
+
+### @chatgpt-codex-connector (2026-05-27T00:41:17Z)
+
+You have reached your Codex usage limits for code reviews. You can see your limits in the [Codex usage dashboard](https://chatgpt.com/codex/cloud/settings/usage).

docs/pr-discussions/PR-5366-docs-backlog-b-0838-caustic-engineered-bloom-filter-discrimi.md

@@ -0,0 +1,109 @@
+---
+pr_number: 5366
+title: "docs(backlog): B-0838 \u2014 caustic-engineered bloom filter discriminators for remote-code trust layer (Kestrel-v2 ferry; phased)"
+author: "AceHack"
+state: "MERGED"
+created_at: "2026-05-27T00:42:19Z"
+merged_at: "2026-05-27T00:45:10Z"
+closed_at: "2026-05-27T00:45:10Z"
+head_ref: "otto/b-0838-caustic-engineered-bloom-filter-discriminators-remote-code-trust-layer-kestrel-v2-2026-05-26"
+base_ref: "main"
+archived_at: "2026-05-27T19:28:58Z"
+archive_tool: "tools/pr-preservation/archive-pr.ts"
+---
+
+# PR #5366: docs(backlog): B-0838 — caustic-engineered bloom filter discriminators for remote-code trust layer (Kestrel-v2 ferry; phased)
+
+## PR description
+
+## What
+
+B-0838 backlog row landing. Per Aaron's discipline *"backlog rows land immediately; they get decomposed later"* — this row was drafted and committed yesterday but the PR was never opened. Recovering during the Layer-2-CI-test sprint per Aaron's "anything that's future in your todo you can land as backlog rows so you don't forget" framing.
+
+## Substrate
+
+Per operator 2026-05-26 Kestrel-v2 ferry (preserved verbatim via PR #5356):
+
+> "do you think there is a way i can create caustic lens shaped bloom filters for the remote code discriminators?"
+
+Multi-learned-bloom-filter intersection with caustic-geometry-shaped agreement region. 3 components per Kestrel-v2's Meaning 3 + 1 composition:
+
+1. Filter A — sharp on code provenance signals (signed-from-trusted-publisher vs unknown)
+2. Filter B — sharp on behavioral signals (suspicious syscall patterns, runtime resource access)
+3. Filter C — sharp on structural signals (lexical malware-family match, dependency-graph similarity)
+
+Composition: bitwise AND of membership-test results. The "caustic" is the region in combined feature space where all 3 filters agree the code is trustworthy.
+
+## Three scope phases
+
+- **Phase 1 (operational)** — 3-filter intersection using established learned-bloom-filter libraries
+- **Phase 2 (research-direction)** — full inverse-design via optimal transport (Brenier theorem + Villani transport theory) + continuous relaxation of discrete bloom filter response
+- **Phase 3 (nearer-term reachable)** — literature review of inverse-design transfers across domains with discrete-vs-continuous optimization attention
+
+## Composes with
+
+- B-0664 NCI HC-8 floor (the discriminator IS the technical substrate for HC-8 at remote-code scope per Lior-website NCI-as-cyberattack-prevention naming PR #5342)
+- B-0648 cross-substrate-triangulation (multiple bloom filters as composing N-of-M oracles)
+- `.claude/rules/non-coercion-invariant.md` HC-8 floor
+- `.claude/rules/algo-wink-failure-mode.md` (algo-wink IS one class of unauthorized-RPC pattern)
+- `.claude/rules/glass-halo-bidirectional.md` (audit-mechanism composes at output side)
+- `.claude/rules/substrate-smoothness-as-load-bearing-property.md` (PR #5357) — coupled smoothness constraint
+- B-0822 worry-as-opposite-bloom-filter substrate (PR #5310)
+- B-0823 cognition-as-distributed-systems META-claim (PRs #5325 + #5327)
+- B-0833 (interactive-login vs baked-in-keys CI-test tension) — bloom filter discriminators serve trust layer
+- PR #5356 Kestrel-v2 ferry — substrate origin (full verbatim including operator's cat-caustic image)
+- PR #5357 substrate-smoothness rule — coupled-smoothness constraint reference
+- F# fork for AI safety substrate — raw-math interaction substrate
+
+## Substrate-honest framing
+
+P2 priority. NOT immediately tractable as single-implementation work. Phase 1 is bounded enough for single-PR landing; Phases 2 + 3 span weeks-to-months. This row creates the substrate anchor; future contributors decompose phases independently when scope tightens.
+
+🤖 Generated with [Claude Code](https://claude.com/claude-code)
+
+## Reviews
+
+### COMMENTED — @copilot-pull-request-reviewer (2026-05-27T00:45:24Z)
+
+## Pull request overview
+
+Adds backlog row **B-0838** to capture a phased approach for “caustic-engineered” multi-learned-bloom-filter discriminators for a remote-code trust layer, and updates the generated backlog index to include the new row.
+
+**Changes:**
+- Adds `docs/backlog/P2/B-0838-...md` with frontmatter + problem/target/phases/acceptance/composition links.
+- Updates `docs/BACKLOG.md` to include the new B-0838 entry in the P2 section.
+
+### Reviewed changes
+
+Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
+
+| File | Description |
+| ---- | ----------- |
+| docs/backlog/P2/B-0838-caustic-engineered-bloom-filter-discriminators-remote-code-trust-layer-kestrel-v2-aaron-2026-05-26.md | New P2 backlog row capturing the discriminator concept, phases, and acceptance criteria. |
+| docs/BACKLOG.md | Adds the B-0838 index entry under P2. |
+
+## Review threads
+
+### Thread 1: docs/backlog/P2/B-0838-caustic-engineered-bloom-filter-discriminators-remote-code-trust-layer-kestrel-v2-aaron-2026-05-26.md:25 (resolved)
+
+**@copilot-pull-request-reviewer** (2026-05-27T00:45:23Z):
+
+Inconsistent PR reference formatting: this uses `PR-5342`, but elsewhere (including later in this row) the format is `PR #5342`. Keeping one format helps grep/xref and avoids implying a different identifier scheme.
+
+### Thread 2: docs/backlog/P2/B-0838-caustic-engineered-bloom-filter-discriminators-remote-code-trust-layer-kestrel-v2-aaron-2026-05-26.md:52 (resolved)
+
+**@copilot-pull-request-reviewer** (2026-05-27T00:45:24Z):
+
+The composition description mixes concepts: “bitwise AND of membership-test results” reads like a bitset intersection, but membership tests yield booleans (so this would be a logical AND). Also, the next sentence says heavier verification is invoked when the caustic indicates closer attention needed, but the caustic is defined here as the region where all filters agree the code is trustworthy—those two statements appear inverted.
+
+### Thread 3: docs/backlog/P2/B-0838-caustic-engineered-bloom-filter-discriminators-remote-code-trust-layer-kestrel-v2-aaron-2026-05-26.md:54 (resolved)
+
+**@copilot-pull-request-reviewer** (2026-05-27T00:45:24Z):
+
+Section title says “Two scope phases”, but the row defines Phase 1, Phase 2, and Phase 3 below. Rename the header to match the actual structure (or remove Phase 3 if it’s not intended to be a phase).
+
+## General comments
+
+### @chatgpt-codex-connector (2026-05-27T00:42:26Z)
+
+You have reached your Codex usage limits for code reviews. You can see your limits in the [Codex usage dashboard](https://chatgpt.com/codex/cloud/settings/usage).