chore(tac): reconcile cast-gateway, p7, voice TAC trees

pmoves/configs/tac_trees/cast-gateway.tac.yaml

@@ -30,6 +30,8 @@ root:
       task: "Service health and container configuration"
       context: "Dockerfile + docker-compose.yml"
       agent_hint: 4090-claude
+      status: done
+      notes: "Verified 2026-03-21: healthz, compose, Dockerfile uid 65532, hardening anchor"
       children:
         - id: cg.health.endpoint
           task: "/healthz endpoint responds on port 8060"
@@ -40,6 +42,7 @@ root:
             expect: "Health endpoint registered in aiohttp routes"
           context: "PORT=8060 from env, default in service.py"
           agent_hint: 4090-claude
+          status: done
 
         - id: cg.health.compose
           task: "Compose service defined with correct profiles"
@@ -50,6 +53,7 @@ root:
             expect: "profiles: [cast, media], depends_on flute-gateway + nats (service_healthy)"
           context: "Networks: pmoves_app, pmoves_bus, pmoves_api, pmoves_external"
           agent_hint: 4090-claude
+          status: done
 
         - id: cg.health.dockerfile
           task: "Dockerfile uses non-root user"
@@ -60,6 +64,7 @@ root:
             expect: "python:3.12-slim, useradd -m -u 65532, USER nonroot"
           context: "Also installs catt[all] for Cast device control"
           agent_hint: 4090-claude
+          status: done
 
         - id: cg.health.hardening
           task: "Compose hardening anchor applied"
@@ -70,6 +75,7 @@ root:
             expect: "<<: *tier-agent-hardened-ro, user: 65532:65532"
           context: "Resource limits: 1 CPU, 512M memory"
           agent_hint: 4090-claude
+          status: done
 
     # =========================================================================
     # Phase 2: TTS Provider Chain
@@ -78,6 +84,8 @@ root:
       task: "TTS provider fallback chain"
       context: "pmoves/services/cast-tts-gateway/fallback.py + flute_client.py"
       agent_hint: 4090-claude
+      status: done
+      notes: "Verified: Flute primary, Ultimate fallback, Google last resort, FallbackManager with circuit breaker"
       children:
         - id: cg.tts.flute
           task: "Primary provider: Flute Gateway (prosodic TTS)"
@@ -88,6 +96,7 @@ root:
             expect: "http://flute-gateway:8055 via env"
           context: "FluteTTSProvider in flute_client.py, prosodic synthesis"
           agent_hint: 4090-claude
+          status: done
 
         - id: cg.tts.ultimate
           task: "Fallback provider: Ultimate TTS Studio"
@@ -98,6 +107,7 @@ root:
             expect: "http://ultimate-tts-studio:7861 via env"
           context: "UltimateTTSProvider in fallback.py"
           agent_hint: 4090-claude
+          status: done
 
         - id: cg.tts.google
           task: "Final fallback: Google TTS"
@@ -126,6 +136,8 @@ root:
       task: "Google Cast device discovery and management"
       context: "pmoves/services/cast-tts-gateway/device_manager.py + groups.py"
       agent_hint: 4090-claude
+      status: done
+      notes: "Verified: /cast/discover mDNS, CastGroupManager, ConcurrentCaster (max 4)"
       children:
         - id: cg.devices.discovery
           task: "POST /cast/discover — mDNS device scanning"
@@ -164,6 +176,8 @@ root:
       task: "Voice profile management"
       context: "pmoves/services/cast-tts-gateway/voices.py"
       agent_hint: 4090-claude
+      status: done
+      notes: "Verified: CRUD at /cast/voices, VoiceProfile dataclass, device/group/context binding"
       children:
         - id: cg.voices.crud
           task: "CRUD endpoints at /cast/voices"
@@ -212,6 +226,8 @@ root:
       task: "Scheduled announcements and priority queue"
       context: "pmoves/services/cast-tts-gateway/scheduler.py + queue.py + audio_queue.py"
       agent_hint: 4090-claude
+      status: done
+      notes: "Verified: RECURRING + ONE_SHOT, templates, CastPriorityQueue, AudioQueueManager"
       children:
         - id: cg.scheduler.recurring
           task: "POST /cast/schedule — cron-like recurring announcements"
@@ -270,6 +286,8 @@ root:
       task: "Prometheus metrics"
       context: "pmoves/services/cast-tts-gateway/service.py lines 72-123"
       agent_hint: 4090-claude
+      status: done
+      notes: "Verified: all 8 Prometheus counters + 1 histogram defined in service.py"
       children:
         - id: cg.metrics.requests
           task: "cast_tts_requests_total counter"
@@ -358,6 +376,8 @@ root:
       task: "Authentication, authorization, and audit"
       context: "pmoves/services/cast-tts-gateway/auth.py + security.py"
       agent_hint: 4090-claude
+      status: done
+      notes: "Verified: JWT middleware, RateLimiter, AuditLogEntry, container hardening"
       children:
         - id: cg.security.jwt
           task: "JWT auth middleware on all routes"
@@ -406,6 +426,8 @@ root:
       task: "NATS event publishing"
       context: "pmoves/services/cast-tts-gateway/service.py — _publish_event()"
       agent_hint: 4090-claude
+      status: done
+      notes: "Verified: cast.completed (3 sites), health_alert (1), failed (7 sites), discovered (1), auth NATS URL"
       children:
         - id: cg.nats.cast-completed
           task: "voice.cast.completed.v1 published on successful cast"
@@ -428,26 +450,26 @@ root:
           agent_hint: 4090-claude
 
         - id: cg.nats.missing-failed
-          task: "GAP: voice.cast.failed.v1 not yet published"
+          task: "voice.cast.failed.v1 published on failure"
           action:
             type: grep
             target: "pmoves/services/cast-tts-gateway/service.py"
             pattern: "voice.cast.failed.v1"
-            invert: true
-            expect: "NOT YET IMPLEMENTED — failure events not published to NATS"
-          context: "Should publish on TTS synthesis failure or cast failure"
+            expect: "IMPLEMENTED — 7 call sites publish failure events to NATS"
+          context: "Published on TTS synthesis failure or cast failure"
           agent_hint: 4090-claude
+          status: done
 
         - id: cg.nats.missing-discovered
-          task: "GAP: device.cast.discovered.v1 not yet published"
+          task: "device.cast.discovered.v1 published on discovery"
           action:
             type: grep
             target: "pmoves/services/cast-tts-gateway/service.py"
             pattern: "device.cast.discovered.v1"
-            invert: true
-            expect: "NOT YET IMPLEMENTED — device discovery not announced via NATS"
-          context: "Should publish when /cast/discover finds new devices"
+            expect: "IMPLEMENTED — 1 call site in _on_device_discovery"
+          context: "Published when /cast/discover finds new devices"
           agent_hint: 4090-claude
+          status: done
 
         - id: cg.nats.authenticated-url
           task: "NATS_URL uses authenticated format"

pmoves/configs/tac_trees/pinokio-p7.tac.yaml

@@ -53,7 +53,7 @@ root:
             expect: "Pinokio UI shows 'Agents' tab on 4090 laptop"
           agent_hint: 4090-claude
           status: done
-          notes: "P7 installed, Agents tab visible, pmoves-net configured"
+          notes: "Upgraded 2026-03-21 — user confirmed manual Pinokio desktop upgrade complete"
 
     # =========================================================================
     # Phase 2: Agent Interpreter — SKILL.md Discovery
@@ -139,6 +139,7 @@ root:
       task: "Cross-machine P7 agent routing via Tailscale"
       context: "Tailscale mesh connects 5090, Z890, 4090 laptop — P7 agents should discover remote apps"
       agent_hint: 4090-claude
+      notes: "BLOCKED: requires P7 upgrade on 4090 + 5090 (manual desktop app update) before agent routing tests"
       children:
         - id: p7.mesh.tailscale
           task: "All 3 dev machines on Tailscale mesh"
@@ -159,6 +160,7 @@ root:
           status: blocked
           blocked_reason: "TTS on 5090 Windows binds localhost:7861 — needs --server-name 0.0.0.0 or Caddy proxy route; Flute reports ultimate_tts: false"
           depends_on: [p7.upgrade.5090, p7.upgrade.4090, p7.interpreter.tts]
+          notes: "BLOCKED: depends on p7.upgrade.4090 + p7.upgrade.5090 (manual P7 desktop upgrade)"
 
         - id: p7.mesh.mobile
           task: "Mobile agent (Discord/Openclaw) reaches 5090 via mesh"
@@ -168,6 +170,7 @@ root:
           context: "Openclaw/Hermes Agent pattern from P7 announcement"
           agent_hint: 4090-claude
           status: pending
+          notes: "BLOCKED: depends on P7 upgrade + remote TTS routing working first"
 
     # =========================================================================
     # Phase 6: PMOVES Service SKILL.md Registration

pmoves/configs/tac_trees/voice-agents.tac.yaml

@@ -674,6 +674,7 @@ root:
       task: "P7 Agent Interpreter voice routing"
       context: "Pinokio 7 Agent Interpreter auto-discovers TTS apps via SKILL.md"
       agent_hint: 5090-claude
+      notes: "BLOCKED: requires P7 desktop app upgrade on 5090 + 4090 (manual action) and Agent Interpreter TTS discovery (5090 responsibility)"
       children:
         - id: va.p7.discovery
           task: "P7 discovers Ultimate-TTS-Studio as voice app"
@@ -702,6 +703,7 @@ root:
           agent_hint: 4090-claude
           status: pending
           depends_on: [va.p7.discovery, va.p7.speak-flow]
+          notes: "BLOCKED: depends on P7 upgrade on both machines + local speak-flow working"
 
         - id: va.p7.mobile-agent
           task: "Mobile agent (Discord/Openclaw) triggers TTS"