docs(agnote): reconcile register + gaps + SITREP with June fork-sync campaign

pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md

@@ -1050,3 +1050,8 @@ The pipeline reports success because its validation scope is too narrow. Neither
 - `2026-06-11T15:14:21Z` CLAIM `4090-CLAUDE (opus 4.8)` scope: **Review-infrastructure + post-merge verification lane.** (1) **Auto-review fix** — root cause was NOT the action version: `claude-code-action` (incl. v1.0.143, the bump in #1763) transitively pulls `oven-sh/setup-bun`, which was **absent from the repo Actions allowlist** → `claude-code-review.yml` startup_failed for ~7 days (4s fails). Real fix = added `oven-sh/setup-bun@*` to the allowlist (operator-authorized; `sha_pinning_required` preserved) + **#1787** (widen path filter to config/yaml/`.claude/agents|skills` + least-privilege perms, MERGED). Verified: post-allowlist the action runs (4s→41s); #1787/#1789 show only the benign "workflow file ≠ default branch" self-validation 401 (expected when a PR edits the review workflow). (2) **code-review + verifier agents** — `.claude/agents/code-review.md` (correctness/bug/security, reuses the `pmoves-pair-review` 4-class taxonomy) + `.claude/agents/verifier.md` (evidence-before-assertions) — #1785. (3) **Post-merge verification** ✅ 5/5 CRITICAL gitlinks consistent (#1773 Agent-Zero, #1775 Wealth, #1776 ClawZ+Creator, #1761 supabase, #1769 batch-6). (4) **Pair-review #1758** posted APPROVE-WITH-NITS. (5) **Auto-monitor** triage-only workflow #1789 (Codex caught + I fixed `allowed_bots` default-deny + inline-only gate). fork-sync: dry-run audit run; live sync deferred to Z890 (App-op owner; stale set includes Archon/Creator = claimed lanes). **Explicitly NOT claiming**: Archon fork-sync (Z890) + Tokenism #1756 (CODEX). Three-body: delivery=4090-CLAUDE, control=DARKXSIDE, memory=[[reference_auto_review_workflow]] + this trail. CHIT trail unsigned-local. agent_signature: `ACK::4090-CLAUDE::REVIEW-INFRA-AND-POSTMERGE-2026-06-11`.
 
 <!-- GRAPHITI_MARK: 4090-CLAUDE::REVIEW-INFRA-AND-POSTMERGE::2026-06-11 -->
+## Z890 Fleet Fork-Sync + Branch-Protection + Supabase + Archon CI Campaign (2026-06-09 → 06-11)
+
+- `2026-06-11T00:00:00Z` RELEASE `Z890-CLAUDE (opus 4.8 1M)` scope: **Main-infra integrator pass clearing the entire fork-sync backlog + closing two fleet-governance gaps.** Z890 lane = Control Body / canonical submodule-sync (`[[project_z890_main_infra_spark_drafts]]`, `[[project_fleet_fork_sync_state]]`); 4090-CLAUDE pair-reviewing. **(1) Supabase CRITICAL sync** (handoff `research/SUPABASE_SYNC_HANDOFF_2026-06-09.md`): blobless cone-sparse clone (45 MB vs 2 GB); two-hop merge — fork PR **#11** `master←upstream@master` (2233 commits; 2 CI-workflow conflicts where upstream had *converged toward* our F-04 explicit-secret hardening) + **#12** `hardened←master` (clean, all `pmoves_*` dirs byte-identical) → gitlink `a08627a4→61116aee` (**#1761**); TAC refreshed **#1768** (corrected stale pins Postgres 17.6.1→15.8.1.085 / PostgREST v14.3→v14.12 / Realtime v2.72.0→v2.102.3 + 11-image table; documented upstream publishable/secret key model; **Kong/CLI §3 gate PASSED** — kong.yml taken upstream wholesale, no PMOVES overlay = matched pair); no supabase Trivy gate exists (not in GHCR matrix; Python overlay on upstream stack) (`[[project_supabase_multinode_juicefs_vision]]`). **(2) Branch-protection automation** — operator surfaced that "hardened" branches had NO protection; fleet audit = **8/11 ungated** (49-fork dry-run: only 3 truly protected). Built `_app-token.yml` `permission-administration` knob + `branch-protection-sync.yml` (derives 49 forks from `.gitmodules`, self-maintaining, token-scope==apply-set) **#1760**; App `Administration:RW` **validated live** (dry-run mint succeeded). Fixed 3 bugs found verifying the dry-run (exit-code state detection; preserve-existing-checks so the 3 good forks aren't wiped; jq-not-heredoc) **#1767**; applied `only_unprotected` → **31 naked forks protected**, 18 skipped, 0 failed. **space-agent** investigated (sub-agent + full-history secret scan = clean, MIT fork) → flipped public + protected (`[[project_fork_branch_protection_gap]]`). **(3) App-driven fork-sync** — dispatched `fork-sync.yml` → auto-synced eligible tier, skip-labeled high-ahead/CRITICAL; merged **11 fork sync PRs** + gitlinks **#1769** (6: a0-plugins/Headscale/A2UI/BotZ-gateway/E2B-DR/E2B-DR-Desktop) + **#1770** (llama/Pinokio). High-ahead manual CRITICAL-merges (hardening preserved): **Agent-Zero** 116c (#11→#1773), **hyperdimensions** 7c (#20→#1774), **Wealth** 792c (#43→#1775). CRITICAL-huge: **Creator** 1225c (#8) + **ClawZ** 8354c (#3) → **#1776**. Lesson: conflict surfaces stayed tiny regardless of behind-count (8354!); PMOVES forks had ZERO unique deps (only stale versions) → take-upstream for package.json/lockfiles; hardening in additive files → keep-both. **(4) Archon CI health** — both red surfaces fixed by *aligning to upstream*: `test` lint (33 `no-unnecessary-type-assertion`) was a **lockfile drift** (PMOVES `typescript-eslint@8.60.1` > upstream `8.57.0`) → pinned bun.lock to 8.57.0, single-file, zero sync-churn (**#19→#1777**); E2E Smoke was a **missing-secret 401** (no `OPENAI_API_KEY`; PMOVES avoids managed OpenAI) → gate codex/mixed tiers on key-presence → all 4 E2E jobs green (**#20→#1784**). Both: fork red + **upstream also red** = inherited drift, not a PMOVES regression. **Doc-staleness finding (this reconcile):** README Known-Gaps were weeks-stale — OBSERVABILITY_MAP.md now on main (P2 resolved), A2A in compose (P0 exposure done, runtime-verify remains), NATS-auth down to 23 refs + NON-URGENT (#1690). Three-body: delivery=Z890-CLAUDE + App automation, control=DARKXSIDE (AskUserQuestion gates: merge-path / space-agent-flip / full-App-automation / Z890-next-scope) + 4090-CLAUDE pair-review, memory=this trail + ([[project_fleet_fork_sync_state]], [[project_fork_branch_protection_gap]], [[project_supabase_multinode_juicefs_vision]]). risks: low-managed — all hardening preserved + verified per-merge; branch-protection non-deadlocking (require-PR 0-approvals); admin-merges carried no-regression evidence (Archon #18 lint proven identical-to-base). CHIT trail **unsigned-local** (`CHIT_PASSPHRASE` voice-activated per `[[feedback_chit_prod_voice_activated]]`). agent_signature: `ACK::Z890-CLAUDE::FLEET-FORK-SYNC-BRANCH-PROTECTION-SUPABASE-ARCHON-2026-06-11`.
+
+<!-- GRAPHITI_MARK: Z890-CLAUDE::FLEET-FORK-SYNC-BRANCH-PROTECTION-SUPABASE-ARCHON::2026-06-11 -->

pmoves/docs/AGENTS/AGNOTE4482_SITREP.md

@@ -4,7 +4,7 @@ GRAPHITI_MARK: `PHI-4482-SITREP::QUICK-ORIENTATION`
 
 > **For:** Any agent dropping into a PMOVES session cold (fresh start, VS Code restart, new node, Husk walk-in).
 > **Rule:** Read this FIRST. It's pointers, not content. Follow the links.
-> **Last refreshed:** 2026-05-27
+> **Last refreshed:** 2026-06-11
 
 ---
 
@@ -43,7 +43,7 @@ Example: `feat/w3-discord-classrooms`, `fix/1287-runner-loop`
 | What gaps are still open? | [`README.md`](./README.md) → Known Gaps (P0-P2) |
 | What's the current sprint? | `pmoves/docs/NEXT_STEPS.md` |
 
-## Convergence Wave Index (Apr–May 2026)
+## Convergence Wave Index (Apr–Jun 2026)
 
 Waves since last SITREP refresh (2026-04-01). Each links to its AGNOTE4482.md section.
 
@@ -70,6 +70,8 @@ Waves since last SITREP refresh (2026-04-01). Each links to its AGNOTE4482.md se
 | Cole Medin Research | 2026-05-16 | `research/COLE_MEDIN_VIDEO_ANALYSIS.md` | 13 recent videos + 1827-item playlist scan, 5 P0/P1 integration recommendations for Nemo Claw, Archon, DGX Spark |
 | Hardened Reconcile + Auto Mode | 2026-05-31 | §Hardened-Branch Reconciliation + Auto Mode Fleet Config | 38-submodule hardened audit, 5 security gaps closed (incl DoX CVSS 10.0 RCE), 15/17 reconciled, `AUTOMODE_FLEET_CONFIG.md` (**all nodes must apply locally**) |
 | HERMES Agent Integration | 2026-06-04 | `pmoves/docs/AGENTS/HERMES_AGENT_INTEGRATION.md` | Full NousResearch Hermes Agent integration: room manifest, TAC tree, 6 node profiles (Z890, 5090, 4090, Spark, B850/RDNA4, KVM), agent registry/signature updates, operator skill, Three-Body agent definition. Local model mesh with Spark 70B primary. |
+| Z890 Main-Infra Pass | 2026-06-04 | `AGNOTE4482PHI.t1.md` §Z890 Main-Infra Pass | SPARK-drafted PR cluster merged, CI-wide sha-pin outage fixed (#1698), `chit_manifest_merge.py` tooling (#1706/7), gateway port 8111 alignment → VPS deploy green |
+| Z890 Fleet Fork-Sync + Governance | 2026-06-09→11 | `AGNOTE4482PHI.t1.md` §Fleet Fork-Sync Campaign | **All fork-sync drift cleared** (auto-tier + high-ahead Agent-Zero/hyperdimensions/Wealth + CRITICAL-huge ClawZ 8354c/Creator); **branch-protection automation** (31 forks protected, App Administration:RW validated, `branch-protection-sync.yml`); **supabase CRITICAL sync** (#1761 + TAC #1768, Kong gate passed); **Archon CI green** (lint #19 + E2E #20); space-agent public+protected |
 
 > ~~**⚠️ AGNOTE4482.md section gaps:** Supply Chain, SPARK Prep, and CHIT Hardening were backfilled 2026-05-17.~~ All SITREP wave index entries now have corresponding §-sections.
 

pmoves/docs/AGENTS/README.md

@@ -201,11 +201,13 @@ Strategic and theoretical foundations (preserve as-is, no regular updates needed
 | Priority | Gap | Owner |
 |----------|-----|-------|
 | ~~P0~~ | ~~BoTZ JWT HAS_JOSE fail-open~~ | **RESOLVED** — BoTZ PR #79 merged. `gateway.py` and `auth.py` both return HTTPException 500 (fail-closed) when HAS_JOSE or JWT_SECRET is missing. Verified 2026-04-01. |
-| P0 | ~100+ unauthenticated NATS references in `pmoves/` (grep: `nats://(nats\|localhost):4222` excluding `@`; count varies by submodule state) | Batch migration not yet started — refs span services, integrations, docs |
-| P0 | A2A server (`/.well-known/agent.json`) — code exists at `services/agent-zero/python/features/a2a/server.py` but compose exposure unconfirmed | Runtime verification needed |
+| ~~P0~~ | ~~~100+ unauthenticated NATS references in `pmoves/`~~ | **CLOSED NON-URGENT (#1690, 2026-06-04)** — deployment already authed via `env.shared`; DoX migrated. Down to ~23 stale `:4222` refs in `pmoves/`; do not sweep the drifted copies (`[[project_nats_auth_lane_b_non_urgent]]`). |
+| P0 | A2A server (`/.well-known/agent.json`) — code at `services/agent-zero/python/features/a2a/server.py`; **now wired into compose** (`docker-compose.agents.yml`) | **Runtime-verify only** — confirm the endpoint serves; exposure gap closed. |
 | ~~P1~~ | ~~BoTZ Gateway integration speculative~~ | **ARCHIVED (2026-04-19)** — BoTZ era doc moved to `archive/founding-strategy/`. Discord now via ClaWZ. |
 | ~~P2~~ | ~~BPM encoder spec exists but `bpm_encoder.py` not implemented~~ | **RESOLVED** — `pmoves/tools/bpm_encoder.py` implemented (574 lines), delivered in PR #1168 (Shift Crew tools, 2026-04-01). |
-| P2 | Observability Map (`OBSERVABILITY_MAP.md`) referenced but doesn't exist | Create from Production Audit Lane C |
+| ~~P2~~ | ~~Observability Map (`OBSERVABILITY_MAP.md`) referenced but doesn't exist~~ | **RESOLVED** — `pmoves/docs/services/monitoring/OBSERVABILITY_MAP.md` now on `main`. |
+
+> **Fleet-governance state (2026-06-11, Z890 campaign):** all fork-sync drift cleared (auto-tier + high-ahead + CRITICAL-huge synced, gitlinks promoted); branch protection applied to 31 naked hardened forks (`branch-protection-sync.yml`, App `Administration:RW` validated); supabase CRITICAL sync landed; Archon CI green (`test` lint + E2E). See claim register § *Fleet Fork-Sync + Branch-Protection + Supabase + Archon CI Campaign (2026-06-09 → 06-11)*.
 
 ---