docs(wish): record re-review #1 of #2817, refresh the fix disposition, retire the UI entries

.genie/INDEX.md

@@ -14,7 +14,7 @@
 
 
 - khal-app-kit-identity + genie-remote-ssh — **RELOCATED 2026-07-23** with the whole khal-native-desktop track to `khal-os/genie-desktop:.genie/` (branch `wish/khal-native-theme`; Felipe: desktop context lives in the desktop repo). Second and third of the Theme→Identity→SSH order, both WRS 60 simmering there
-- [genie-boards-ui](brainstorms/genie-boards-ui/DRAFT.md) — WRS 70; genie desktop boards module: ABSORB of the G4 kanban decided by Felipe; tab + split-toggle layout tentatively locked ("that looks good", confirm at crystallize); archive section + per-project .genie-commit checkboxes added to scope; roadmap shape (per-project board + groom-with-agent task) recommended, awaiting Felipe; depends on ui-bridge board-payload extension (protocol 1.1) + genie-ui-dash G5 (2026-07-21)
+- [genie-boards-ui](brainstorms/genie-boards-ui/DRAFT.md) — WRS 70; genie desktop boards module: ABSORB of the G4 kanban decided by Felipe; tab + split-toggle layout tentatively locked ("that looks good", confirm at crystallize); archive section + per-project .genie-commit checkboxes added to scope; roadmap shape (per-project board + groom-with-agent task) recommended, awaiting Felipe; depended on ui-bridge board-payload extension (protocol 1.1) + genie-ui-dash G5 (2026-07-21) — **both retired 2026-08-30** (#2834, Felipe: Orca integration is the only UI); this draft is superseded unless re-scoped onto Orca
 - [intent-to-wish-compiler](brainstorms/intent-to-wish-compiler/DRAFT.md) — **LIVE (re-verified 2026-07-21):** WRS 92; Demand→Patch/Standard/Program router + circuit-breaker (flex cuts autonomous, payout cuts human-only); invisible routing compiled from intent — program-scale, splits at pour time
 - [brainstorm-domain-map](brainstorms/brainstorm-domain-map/DRAFT.md) — **LIVE (re-verified 2026-07-21):** WRS 80; executable spec compiler (intent → requirement-ID → oracle-class → execution → proof-packet); deterministic gates, residual-risk review only; subjective-truth ownership still open (umbrella G8)
 ## Ready
@@ -32,7 +32,7 @@
 
 ## Poured
 
-- [genie-dual-mode-orca-plugin — DESIGN](brainstorms/genie-dual-mode-orca-plugin/DESIGN.md) → [WISH](wishes/genie-dual-mode-orca-plugin/WISH.md) — **IN_PROGRESS** (plan APPROVED/SHIP 2026-08-29 design digest `2499668e…`; A1–A7 merged to dev #2808–#2820; rolling promotion #2817 dev→main reviewed **FIX-FIRST** 2026-08-30 at `eccf0ae4a` by independent reviewer + supply-chain/architecture lenses: 6 HIGH — doctor/ui-bridge breach the Orca barrier, update aborted delivery on a failed Orca probe, adapter ignores `timeoutMs`, `run-use` read-back TypeError, unbundled-parity Orca entrypoint; 0 CRITICAL). Fixes merged #2821/#2823/#2825, open #2824/#2827/#2822/#2826, in flight adapter-readback + mode-guards; re-review required before human promotion. Also found and fixed outside wish scope: `version.yml` runs from main so the ninth version field never synced on dev (no dev tarball after v5.260829.4); `tar -xzf` without `-p` broke `genie update` under umask 077
+- [genie-dual-mode-orca-plugin — DESIGN](brainstorms/genie-dual-mode-orca-plugin/DESIGN.md) → [WISH](wishes/genie-dual-mode-orca-plugin/WISH.md) — **IN_PROGRESS** (plan APPROVED/SHIP 2026-08-29 design digest `2499668e…`; A1–A7 merged to dev #2808–#2820). Rolling promotion #2817 dev→main: review #0 at `eccf0ae4a` FIX-FIRST (6 HIGH, 0 CRITICAL) → fixes #2821/#2823/#2824/#2825/#2826/#2827/#2829/#2830/#2834 merged; re-review #1 at `f45d634b8` FIX-FIRST (all prior HIGHs closed, 3983 tests pass; one new HIGH H7 — SessionStart hook opened genie.db under Orca authority → #2835; M12/M15 → #2836). Main-side hotfixes awaiting human merge: #2822 (ninth version field), #2833 (dogfood harness accepts retired Codex route — why v5.260830.x never published). Re-review #2 pending after #2835/#2836; follow-ups M2/M3/M4/M9/M10 recorded in WISH.md. Also fixed outside wish scope: `tar -xzf` without `-p` broke `genie update` under umask 077 (#2821/#2824)
 - [delegate-bridge — DESIGN](brainstorms/delegate-bridge/DESIGN.md) → [WISH](wishes/delegate-bridge/WISH.md) — **APPROVED 2026-08-12** (design SHIP digest `a720e84c…` after 1 fix loop — the HIGH was prepare-cadence: turn-1-only, existence-refusal ≠ dirtiness; plan SHIP after 1 fix loop — the HIGH was the doctor module path, all loop-1 advisories applied in-document): W2+W3 of cross-agent-delegation — turn-per-launch bridge (`task delegate [--continue]`, spike-first, `requireRosterAgent` at consumption, adapter cards ×5 with hermes stateless, fail-open + single first-turn `-r1` orphan retry, timeline-recorded orphan doctor check) and `task fan` fan-out with ratification picker. 7 groups A (unblocked W1 handoffs) · S gate · B ∥ C · D ∥ E · F live smoke; cards `t_msp6a1ql…`–`t_msp6a25s…`, wish card `t_msp4fp6ce714c8be` task-blocked on remotty `headless-turn-open` (seeded in remotty's `.genie` 2026-08-11, board card there) **Amendment recorded 2026-08-13 (spawn-context-contract group reversals):** S–F turn transport re-bases to live herdr sessions; the block re-targets from `headless-turn-open` to the herdr 0.3 swap + `engine-turn-verbs` (remotty card `t_msqkkjt221792465`), recorded on the umbrella + group cards in the board snapshot.
 - [cross-agent-delegate — DESIGN](brainstorms/cross-agent-delegate/DESIGN.md) → [WISH](wishes/cross-agent-delegate/WISH.md) — **APPROVED 2026-08-11** (design SHIP digest `c15d6a9e…` after 2 fix loops; plan SHIP with all 7 findings applied in-document, incl. the A1/A2 gate split; re-opened orca-inspired 2026-08-10, umbrella G6): W1 declared-routing wish — `assigned_agent`+`assigned_reason` on the card (default = current agent), roster allowlist (claude/codex/pi/hermes/prime), `create --agent/--why` + `task assign --clear`, lane-path-only `board --json` (laneless stays byte-frozen), roadmap-sync lockstep; 4 groups A1 → A2 ∥ B ∥ C, 5 board cards. Follow-on `delegate-bridge` poured 2026-08-12 (entry above) with the 5 logged residuals resolved in its own SHIP'd design; unblocks remotty's `assigned_agent` rendering ask
 
@@ -55,9 +55,9 @@
 - [boards-first-class](brainstorms/boards-first-class/DESIGN.md) · [WISH](wishes/boards-first-class/WISH.md) — **SHIPPED 2026-07-21 — PR [#2611](https://github.com/automagik-dev/genie/pull/2611) merged to dev `fa163bd2` (16/16 CI); post-merge live QA open (card in Review lane)**: all 3 groups SHIP loop 0 (`8ab4d0e5`+`9386accc` ∥ `8368705c` ∥ `45ab48a8`); ultracode 4-lens verify found 1 HIGH (releaseTask done→ready resurrection race, empirically reproduced) → fixed `56e59632` (atomic CAS + 2-process regression); full-suite validation caught a plugin-mirror digest drift → fixed `22d36078`; full `bun test` 2067/0; live: roadmap seeded 13 cards, drift lint's first run caught 2 real INDEX drifts (fixed `1ca40d21`), doctor 13 ok / 0 drift. Plan review was SHIP (1 fix loop): genie lifecycle as kanban — board create/list + lifecycle lanes (Idea→Brainstorm→Wish→Work→Review→Done), `genie idea` capture, task_events timeline (new additive table; stage_log retained+backfilled), runtime identity + heartbeat liveness (▶/⏸/☠), enforced blocks (single carved checkout exception), meeseeks report events, jar↔INDEX drift lint via lifecycle-slug join. 3 groups: A engine → B timeline+runtime (Fable gate) ∥ C jar unification
 - [token-efficiency-rebaseline](brainstorms/token-efficiency-rebaseline/DESIGN.md) — WRS 100;
   ratified Fix → Spend → Workflows sequence; first wish is routing-delivery-fix (2026-07-11)
-- [genie-ui-bridge — DESIGN](brainstorms/genie-ui-bridge/DESIGN.md) → [WISH](wishes/genie-ui-bridge/WISH.md) — **SHIPPED 2026-07-21**: G1 `aadbae83` + G2 `2ff71abe` (ui-bridge command, protocol 1.0) execution-reviewed SHIP; PR [#2610](https://github.com/automagik-dev/genie/pull/2610) MERGED to dev `600c18fe` (CI 16/16) + post-merge scratch-client QA. Unblocked genie-ui-dash G4/G5 (merge preceded both reviews); Felipe ratified channel/home/timing via explicit picker
+- [genie-ui-bridge — DESIGN](brainstorms/genie-ui-bridge/DESIGN.md) → [WISH](wishes/genie-ui-bridge/WISH.md) — **RETIRED 2026-08-30** (#2834; Felipe: "theres no more genie ui, only 'ui' is orca integration" — `genie ui-bridge` is now a one-line refusal stub, the MCP transport modules and UI-BRIDGE.md are deleted). Prior record — **SHIPPED 2026-07-21**: G1 `aadbae83` + G2 `2ff71abe` (ui-bridge command, protocol 1.0) execution-reviewed SHIP; PR [#2610](https://github.com/automagik-dev/genie/pull/2610) MERGED to dev `600c18fe` (CI 16/16) + post-merge scratch-client QA. Unblocked genie-ui-dash G4/G5 (merge preceded both reviews); Felipe ratified channel/home/timing via explicit picker
 - [genie-ui — DESIGN](brainstorms/genie-ui/DESIGN.md) → [WISH](wishes/genie-ui/WISH.md) — **SUPERSEDED as the UI direction 2026-07-21**: shipped the fresh-substrate browser shell (merged PR #2609), but Felipe rejected that substrate after seeing it live; the UI direction moved to [genie-ui-dash](wishes/genie-ui-dash/WISH.md). Salvage value retained: the ~1,270-LoC chat backend (no PTY imports) remains conductor-wish substrate.
-- [genie-ui-dash — WISH](wishes/genie-ui-dash/WISH.md) — direct wish (no brainstorm; Felipe-ratified verbatim), plan SHIP + amendment re-review SHIP; **ALL FIVE GROUPS EXECUTED 2026-07-21** on private `khal-os/genie-desktop` branch `genie-dash` @ `9bf43fc`: base+build proof · agent-adapter contract (zero-behavior-change proven) · codex/hermes/rlmx adapters + picker · genie kanban as ui-bridge client · hire roster via roster_hire (single write path). IN_PROGRESS pending Felipe GUI QA + rlmx live spawn; polish-pass LOW backlog consolidated in the G5 disposition.
+- [genie-ui-dash — WISH](wishes/genie-ui-dash/WISH.md) — direct wish (no brainstorm; Felipe-ratified verbatim), plan SHIP + amendment re-review SHIP; **ALL FIVE GROUPS EXECUTED 2026-07-21** on private `khal-os/genie-desktop` branch `genie-dash` @ `9bf43fc`: base+build proof · agent-adapter contract (zero-behavior-change proven) · codex/hermes/rlmx adapters + picker · genie kanban as ui-bridge client · hire roster via roster_hire (single write path). **RETIRED 2026-08-30** with its ui-bridge client (Felipe: no more Genie UI; Orca integration is the only UI) — was IN_PROGRESS pending Felipe GUI QA + rlmx live spawn; polish-pass LOW backlog consolidated in the G5 disposition.
 - [WISH: stable-release-security-gate](wishes/stable-release-security-gate/WISH.md) · [brainstorm](brainstorms/stable-release-security-gate/DRAFT.md) — **DONE 2026-07-27 (6/6)** — closed by the first full-pipeline stable release v5.260727.5 (run 30240023804: production gate demonstrated live with dispatcher ≠ approver, 36 assets, immutable, latest/homolog/dev manifests advanced); was IN_PROGRESS 4/6 since 2026-07-25: the stable-channel unblock for inherited Ultra findings F16 (CRITICAL arbitrary-ref stable publish, all 4 dispatch entry points) / F17 (unbound run_id/version inputs) / F18 (unpinned actions, unfrozen installs, broad permissions) / F31 (non-transactional swap; verify-release.sh can't verify real releases). G1 repo-code hardening dispatched to engineer on `wish/stable-release-security-gate`; G2 GitHub Environment (`production` + prevent-self-review) / `v*` ruleset + exported evidence is **Felipe-owned**, depends-on G1
 - [hermes-homogeneous-integration](brainstorms/hermes-homogeneous-integration/DESIGN.md) · [WISH](wishes/hermes-homogeneous-integration/WISH.md) — **SHIPPED** (2026-07-13): PR [#2565](https://github.com/automagik-dev/genie/pull/2565) merged to dev `40512016`, released `v5.260713.2` (dev channel); all 6 groups SHIP-reviewed (G2 one fix loop), final gate SHIP; live isit dogfood PASS ([qa/](wishes/hermes-homogeneous-integration/qa/live-dogfood-20260713.md)) — 23 product skills first-class in Hermes, `mcp_servers.genie` + backups in the live profile, 4/4 doctor legs green. **2 dogfood defects filed as follow-up tasks:** D1 duplicate nested `external_dirs` key on merge into block `skills:` (PyYAML last-wins keeps it working); D2 `[auto-version]` skips the plugin.yaml YAML sync (shipped plugin reads 5.260712.2 vs genie 5.260713.2) — both fixed in PR [#2566](https://github.com/automagik-dev/genie/pull/2566) (merged to dev). Also open: khaw-bridge re-home to KHAW plugin; 2 codex-manifest failures pre-existing on main
 - [WISH: PR #2545 Ultra release-gate remediation](wishes/pr-2545-ultra-release-gate/WISH.md) — **DONE** (closed 2026-07-24): PR #2545 merged via `6f682e2b`; follow-up #2556 merged into `dev` at `a7c3c7ce` and promoted via #2557; successor #2562 merged as `137dede8` on 2026-07-12 with 15 checks passing on its exact head `bd8c6128`, and is now on `main`. Both HIGH follow-ups ship fixed (F42 `09b368a5`, F43 `8e147d87`), the seven-lane replay ran at `8e147d87` with its 12 findings dispositioned F44–F52, and the metrics-updater routine has been silent since 2026-07-14. Recorded as unmet rather than waived: **F02** — no independent `APPROVED` review exists on #2562. The F16–F18/F31 stable-promotion block cleared when [stable-release-security-gate](wishes/stable-release-security-gate/WISH.md) closed DONE 2026-07-27 (first full-pipeline stable v5.260727.5, run 30240023804); installed hook hashes remain untrusted.

.genie/wishes/genie-dual-mode-orca-plugin/WISH.md

@@ -383,14 +383,35 @@ done
   outside the wish scope during the same review: `version.yml` executes from `main` under `workflow_run`, so the
   ninth version field never synced on dev and no dev tarball shipped after v5.260829.4; `tar -xzf` without `-p` broke
   `genie update` under umask 077.
-- **Fix disposition (2026-08-30):** merged to `dev` — #2821 (admission tolerates umask-restricted payloads),
-  #2823 (committed Orca manifest version no longer gates dev releases), #2825 (H6 esbuild parity gate for
-  `orca-entrypoint.min.js`, wired into `check`/CI/`build-binary.sh`). Open — #2824 (`tar -xzpf` in both extractors),
-  #2827 (H3: ownership refresh runs after `publishCodexDeliveryFacts`, advisory), #2822 (`version.yml` ninth field →
-  `main`), #2826 (M7/M8 docs, Kimi `pm.md`→`quick.md`, orphan check); in flight — `fix/orca-adapter-readback`
-  (H4, H5, M1) and `fix/orca-mode-guards` (H1, H2, M6). Per-group acceptance boxes stay unticked until the clean
-  re-review; #2817 is not approved for human promotion before that re-review returns SHIP.
-
+- **Fix disposition (2026-08-30, refreshed after re-review #1):** merged to `dev` — #2821 (admission tolerates
+  umask-restricted payloads), #2823 (committed Orca manifest version no longer gates dev releases), #2824 (`tar -xzpf`
+  in both extractors), #2825 (H6 esbuild parity gate for `orca-entrypoint.min.js`), #2826 (M7/M8 docs, Kimi
+  `pm.md`→`quick.md`, orphan check), #2827 (H3 ownership refresh after `publishCodexDeliveryFacts`, advisory),
+  #2828 (ledger), #2829 (H4 `timeoutMs` bound, H5 `run:null` read-back, M1 flaky test, stream faults, doctor
+  resilience), #2830 (H1 doctor + M6 board/idea guards, dead `genie mcp` entry retired from `.mcp.json`),
+  #2834 (H2 resolved by retiring `genie ui-bridge` outright — see the decision below). Open to `dev` — #2835 (H7
+  SessionStart hook), #2836 (M12 gate wiring, M15 `.mcp.json.genie-backup-*` ignore). Open to `main` (human merge;
+  the release pipeline runs `version.yml`, `release-guard.sh` and the dogfood harness from `main`, so these cannot
+  take effect from dev) — #2822 (ninth version field), #2833 (harness accepts the retired Codex project route; why
+  `v5.260830.2/.3` built, signed and never published). Follow-ups recorded, not blocking promotion — M2 (real-runtime
+  smoke never executes; needs one transcript against a real Orca host), M3/M4 (read-back over-strictness:
+  uncapped `task-list`, optional `model`/`effort` compared strictly), M9 (Hermes model surface lost board/task
+  tools), M10 (dead launcher validator in `src/lib/codex-project-mcp.ts`).
+- **Re-review #1 of #2817 (dev→main) — FIX-FIRST (2026-08-30):** same reviewer profile, pinned snapshot
+  `f45d634b856a834bf0660e2b1cdbe1eda21edb04` (dev tip incl. #2834). All six previous HIGH gaps and both root causes
+  verified closed with evidence (doctor, ui-bridge, update probe, adapter deadline, `run:null` read-back, bundle
+  parity, `--verify-source` OK at 5.260830.5, `-xzpf`). Validation: `bun run check:fast` PASS; `bun run build` PASS;
+  `bun test src` 2772/0, `bun test scripts` 432 pass / 5 fail (all `reconcile-release-assets` timeouts, byte-identical
+  on `main`), `bun test tests plugins` 779 pass / 1 skip — aggregate 3983 pass. One NEW HIGH: **H7** the shipped
+  SessionStart hook (`plugins/genie/scripts/session-context.cjs`, registered by all three manifests) opened
+  `.genie/genie.db` without consulting `orchestration.mode`, creating `-wal`/`-shm` and injecting local task state
+  under Orca authority (A1 breach, same class as H1) — fixed in #2835 with a fail-closed in-hook authority read and a
+  fixture that fails on the previous bundle. New MEDIUM: M12 Kimi orphan check unwired (#2836), M13 this ledger stale
+  (this entry), M14 `ui-bridge` retirement is outside the wish scope and orphaned three INDEX entries (decision and
+  corrections below), M15 `genie init` backup untracked (#2836). Re-review #2 required after #2835/#2836 land.
+- **Decision (M14, recorded by the orchestrator):** Felipe's words to the fixing session on 2026-08-30 — *"theres no
+  more genie ui, only 'ui' is orca integration"*. `genie ui-bridge` and the MCP transport it kept alive are retired
+  (#2834); INDEX entries for `genie-ui-bridge`, `genie-ui-dash` and `genie-boards-ui` now record the retirement.
 - **Current canonical plan — SHIP:** independent reviewer `term_6c98a3c8-7ac8-4274-a8e9-ade35e2d82dd` reviewed
   reviewable DESIGN content SHA-256 `2499668e81fe3d3f3f7f15bac0246c3e0647a036e9441fa882dcf6a8ecb92bf9`
   at `2026-08-29T18:13:16Z`. The exact four-document set is approved and A1–A7 are authorized in the recorded DAG.