capability: onboard a cockpit project without a checkout

Kind: capability

Epic: #371

Part

Assisted onboarding in the cockpit starts from the existing discovery initialization step.
The person confirms the project. The cockpit stores metadata for that project.
The metadata names the source adapter and, when configured, the execution layer and its PM and DEV coordinators.
It does not store the squad. No checkout is required after confirmation.

Depends on

The execution-control capability.

Acceptance boundary

Change class: standard.

A person can add a project in the cockpit and later see whether an execution layer is configured, without a checkout.

Excludes

A second source adapter. Seat directories. Requiring a mounted repository to supervise the project.

Part of #371

Replaces #377

phase: 0
role: product-manager
status: skipped
seat: pm.manager
reason: Parent goal #371 already framed this part.
body:
Phase 0 skipped. Parent goal #371 already framed this part. Recorded by orch.arch so phase 2 can start on this admitted capability.

phase: 1
role: analyst
status: skipped
seat: pm.analyst
reason: Acceptance is the capability body on #417.
body:
Phase 1 skipped. The acceptance is the capability body on #417. Recorded by orch.arch so phase 2 can start.

phase: 2
role: architect
status: pass
seat: orch.arch
reason:
body:
Phase 2 — architect · #417 project metadata

Store

The cockpit keeps one metadata record per project. It names the source adapter and the repository. The execution layer is OpenRig or none. When it is OpenRig, the record may name the PM coordinator and the DEV coordinator. It does not store a squad, a seat directory, or any other seat.

Nothing is written before the person confirms the discovery preview. Cancelling writes nothing. After confirmation, the cockpit can show that project's goals and whether an execution layer is configured, with no checkout.

Boundary

GitHub is the only source adapter that works. Another named adapter shows unsupported for that project only. This record is what execution control reads. Until it names OpenRig, execution control stays off. The goal view still shows no squad list.

Profile

Standard. Builder dev.build.

phase: 3
role: implementation-planner
status: pass
seat: orch.arch
reason:
body:
Phase 3 — implementation plan · #417 only

Branch

feat/371-project-metadata from origin/development, in .worktrees/feat/371-project-metadata. Do not commit on the primary checkout.

Files

Add a project-metadata store used by the cockpit. Fields: source adapter, repository, execution layer (openrig or none), and optional PM and DEV coordinator names only when the layer is OpenRig.
Wire execution control to that store. No OpenRig means start, promote, and dispatch stay refused.
Cockpit add-project flow: preview first, write only after confirm, write nothing on cancel.
Tests for confirm, cancel, note-versus-execution, and no squad field.

Proof

pnpm exec vitest run on the new project-metadata and execution-control tests.

Out of scope

#377 stays the note. Do not open a second capability. Do not add a second working source adapter. Do not file a live gate.

phase: 4
role: developer
status: pass
seat: dev.build
reason:
body:
Phase 4 on #417. Built to phase 2 (issuecomment-6113286843) and phase 3 (issuecomment-6113287388). Branch feat/371-project-metadata at 392af8f from origin/development 2975016. Local; not pushed.
Changes:

New lib/cockpit-projects.mjs:
- projectRecord validates the one record: { version, sourceAdapter, repository, executionLayer: 'openrig'|null, coordinators?: { pm, dev } }. Any other field (squad, seats, rig, ...) is refused, not dropped. Coordinators are allowed only with OpenRig and only pm/dev, each one session address. Pi or any other layer is refused. The repository must be GitHub owner/name, with no . or ..
- previewProject reads the repository through its source adapter (client.repo and client.issues only), writes nothing, and returns the record and its digest. Another adapter is previewed as unsupported without being read.
- createProjectStore keeps projects.json in COCKPIT_DATA_DIR. confirm writes only when the digest matches the record. Reads fail closed: a hand edit, a record filed under another key or an unreadable file turns nothing on, and an unreadable file is never overwritten.
- workspaceRepositories adds stored GitHub projects to the configured workspaces.
scripts/cockpit-server.mjs:
- GET /projects, POST /projects/preview and POST /projects/confirm. These need write actions and CSRF, and in remote mode write permission on the repository. Cancel is a link and writes nothing.
- projectMetadata(repo) now reads the store, so execution control follows the record.
- Stored projects are selectable and authorized workspaces.
- The board shows the execution layer.
lib/cockpit-ui.mjs: renderProjects, renderProjectPreview and renderProjectExecutionLayer.
docs/cockpit-concepts-and-rules.md: a Projects section, and the execution control rule updated.
Proof:
New lib/tests/cockpit-projects.test.mjs (13) covers:
- the record fields;
- no squad or other seat;
- OpenRig as the only layer;
- the form mapping;
- preview reads only;
- cancel writes nothing;
- confirm writes exactly the preview;
- a wrong or tampered confirmation writes nothing;
- an unsupported adapter shows as unsupported for that project only;
- no OpenRig means start is refused while a note writes;
- OpenRig turns execution on;
- hand-edited records are not used;
- goals and the layer show with no checkout and no squad.
A live server probe on an isolated PATH, with a temp data dir and no GitHub calls: /projects 200, a bad digest 400 with no file, no CSRF 403 with no file, and confirm 302 to the project's goals, storing exactly the record.
Full suite 1545 passed, 1 skipped; reachability READY; prettier clean; cockpit smoke and validate-docs clean.
Judgment calls:
The cockpit's discovery reads the repository through the source adapter, because there is no checkout. The existing init discovery reads a local checkout.
Adding a project needs repo write permission in remote mode.
capability: onboard a cockpit project without a checkout #377 not touched, no second capability, no second working adapter, no live gate filed. Executor claude-cli (Claude Code, claude-opus-5-5).

phase: 5
role: tester
status: pass
seat: dev.qa
reason:
body:
Phase5 PASS — #417 project metadata, standard. Independently executed dev.qa; launcher/executor codex, local CLI transport, no delegation.
Exact commit392af8f322b40cba1b398ba2f0bb268e71c1026b in .worktrees/feat/371-project-metadata, clean before/after. Linux x64, Nodev22.23.3, Vitest2.1.9.
Read phase2/3/4; phase4 verified #417 (comment) at revision7861c0a05c736b5a3902560373403f65f3927f29c2714d7a3daa03752ce0e696.

Exact commands:
../../../node_modules/.bin/vitest run --root . lib/tests/cockpit-projects.test.mjs —13passed.
../../../node_modules/.bin/vitest run --root . —154files passed,1545tests passed,1skipped,0failed.
node scripts/validate-docs.mjs —119files,noerrors.
node scripts/verify-agent-workflow.mjs —pass.
node scripts/verify-hooks.mjs —pass.
node scripts/validate-role-catalog.mjs —READY.
node scripts/audit-reachability.mjs —READY.
../../../node_modules/.bin/prettier --check docs/cockpit-concepts-and-rules.md lib/tests/cockpit-projects.test.mjs lib/cockpit-projects.mjs lib/cockpit-ui.mjs scripts/cockpit-server.mjs —pass.
git status --short and git rev-parse HEAD —clean,SHAabove.

Independent node --input-type=module API probes with fake source client and disposable repository-scoped data:
Preview calls repo/issues only, writes no file; wrong digest writes no file; confirm stores exactly preview.record. Five bad records (squad,seats,Pi layer,path traversal,coordinators without layer) refused. Unsupported GitLab preview makes no source calls and leaves supported project intact. Corrupt JSON store get returns null; confirmation refuses without overwriting bytes.
Store-backed null/OpenRig records govern both start-next-phase and gate-transition guards as expected; notes write once for each with fake client. Passing execution guard tested without executing action.
Independent HTTP probe: spawned checkout scripts/cockpit-server.mjs on ephemeral loopback port with sanitized environment, PATH containing node only, temporary COCKPIT_DATA_DIR, COCKPIT_WRITE_ACTIONS=true and explicit synthetic fake token. No real credential read, printed or stored. Synthetic local CSRF token. GET /projects200; POST /projects/confirm bad digest400/no file; missingCSRF403/no file; valid302/exact stored record; subsequent project list shows project and OpenRig. Redirects manual, no preview, goal, issue or actions request; server terminated and fixtures removed.

Architect explicitly accepts source-adapter discovery without checkout and existing credential boundary for remote add. Remote OAuth permission branch is not independently exercised by the synthetic local HTTP probe. No candidate source inspection/modification, live gate, real GitHub mutation or dispatch. Scope metadata/confirm and execution-control binding; no second working adapter or squad directory. Hand phase6 to rev.review.

phase: 6
role: reviewer
status: pass
seat: rev.review
reason:
body:
Phase 6 — independent review · APPROVED · 392af8f322b40cba1b398ba2f0bb268e71c1026b

Verdict

APPROVED for the project-metadata slice at 392af8f322b40cba1b398ba2f0bb268e71c1026b on feat/371-project-metadata. The candidate was not edited.

Reviewed 2975016..392af8f (5 files). Worktree was clean. Re-ran lib/__tests__/cockpit-projects.test.mjs: 13 passed.

What holds

A record is source adapter, owner/name, and execution layer openrig or none. Coordinators are only pm and dev, and only with OpenRig. A squad, another seat, pi, or . / .. in the repository is refused rather than stored.
Preview reads the repository and writes no file. An unsupported adapter is not read. Cancel is a link back to /projects.
Confirm writes only when the digest matches the record. A corrupt projects.json is not overwritten, and a stored record that no longer validates is not used.
The names, the digest, and the record JSON are escaped in the preview. Preview and confirm require write actions and CSRF.
projectMetadata now reads this store. Until the record names openrig, start and promote stay refused. Notes still write.

Residuals (not a return)

The remote write-permission branch was not probed. The architect confirmed that is not a return.
The digest is of the record itself. Preview writes nothing; confirm still checks that the submitted record matches that digest.
No real credential was used, and no seat was dispatched.

Executed by: pi · Launcher: pi · Executor: pi · Transport: intercom-session · Delegation boundary: separate-local-session · Model: grok-4.7 · Seat: rev.review

phase: 7
role: technical-writer
status: pass
seat: orch.arch
reason:
body:
Phase 7 — technical writer · already in the approved commit

Review approved 392af8f322b40cba1b398ba2f0bb268e71c1026b. docs/cockpit-concepts-and-rules.md already says a project record names the source adapter, the repository, and OpenRig or none. With OpenRig it may name the PM coordinator and the DEV coordinator. It stores no squad. Adding a project is preview first and writes nothing until Confirm. Cancel writes nothing.

No further edit. No screenshot. The remote-permission path was not probed.

phase: 8
role: pr-readiness
status: pass
seat: orch.arch
reason:
body:
Phase 8. PR #418 is open against development at 392af8f. Manifest READY. Merge owner is the person. The remote-permission path was not probed.

feat: add a cockpit project with stored metadata and no checkout (#417)…

Delivered and merged via PR #418 (commit 85f2af5).

Integrated into development by PR #418: #418

Merge commit: 85f2af59cc467711e0506f60013dae1c4b19316f
Release/promotion to main is tracked separately.

Navigation Menu

Repository navigation

capability: onboard a cockpit project without a checkout #417

Part

Depends on

Acceptance boundary

Excludes

Store

Boundary

Profile

Branch

Files

Proof

Out of scope

Verdict

What holds

Residuals (not a return)

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

capability: onboard a cockpit project without a checkout #417

Description

Part

Depends on

Acceptance boundary

Excludes

Activity

smota commented on Oct 11, 2026

smota commented on Oct 11, 2026

smota commented on Oct 11, 2026

Store

Boundary

Profile

smota commented on Oct 11, 2026

Branch

Files

Proof

Out of scope

smota commented on Oct 11, 2026

smota commented on Oct 11, 2026

smota commented on Oct 11, 2026

Verdict

What holds

Residuals (not a return)

smota commented on Oct 11, 2026

smota commented on Oct 11, 2026

smota commented on Oct 11, 2026

github-actions commented on Oct 11, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions