Overseer Kit — Roadmap

Phase Model Key

Build queue

| Phase | Model | Status | Deliverable | | --- | --- | --- | --- | | K1 Bootstrap | Thinking → Auto | DONE | Repo skeleton, promoted spec, dogfood governance docs | | K2 Config + adapters | Thinking → Auto | DONE | .overseer/config.yaml schema + VCS adapter interface + three fail-closed backends | | K3 Extract shared assets | Auto | DONE | Templates + policy + cursor fragments; adapters/templating.py | | K4a Freeze CLI contract | Thinking | DONE | Frozen init\|sync\|status arg contract + version.lock shape + footprint_digest algorithm + K4b seven-tier matrix (docs/archive/phases/PHASE-K4-VENDORING-CLI-CONTRACT.md) | | K4b Vendoring CLI build | Auto | DONE | overseer init\|sync\|status + version.lock + footprint_digest + drift check; POSIX shim → cli/ Python runtime; 108 tests green (§K4.10 seven tiers) | | K5a Freeze reviewer contract | Thinking | DONE | Frozen overseer review --freeze arg contract + exit codes 7/8 + extended freeze_contract.reviewer.{mode,model,provider,fallback} schema (legacy string normalization; local\|api; fallback: human fail-closed; reviewer_models labels) + findings/verdicts/stamp/escalation + Automation degrade path + K5b seven-tier matrix (docs/archive/phases/PHASE-K5-FREEZE-REVIEWER-CONTRACT.md). Independent freeze review round 3 → pass (F1–F9 + N1–N3 resolved). Cleared for K5b. | | K5b Freeze reviewer build | Auto | DONE | overseer review --freeze + nested freeze_contract.reviewer parse (legacy string normalization) + reviewer_models in policy/model-labels.yaml + tools/freeze_reviewer/ engine (injectable local|api; fallback: human fail-closed) + §K5.9 report + stamp write + Automation templates + seven-tier tests. Cleared by K5b-r2 pass + PR #6 on main (not by premature PR #5 merge alone). | | K5b-r Merge gate review | Thinking | DONE | Round 1 blocked (F1–F6 on PR #5). F1–F5 fixed (PR #6). K5b-r2 → pass (review). K5b cleared. | | 9A-5 Governance Hygiene Agent | Auto | DONE | overseer governance-sync [--dry-run] against kit VCS adapter — tools/governance_hygiene/ + seven-tier tests (181 green) | | K6a Freeze pilot install matrix | Thinking | DONE | Frozen install order + per-repo config matrix + init --migrate preserve contract + parity gate (P1–P7 + per-repo extras) + Muse working_dir / VF . docs-root seams + K6b seven-tier matrix (docs/archive/phases/PHASE-K6-PILOT-INSTALL-MATRIX.md). Rounds 1–5 blocked → fixes through 5-fix; Round 6 findings (R6-M1) → 6-fix; K6a-r7 → pass (R6-M1 + R5/R4 spot-check + full §K6.0–§K6.10 regress). Cleared for K6b. | | K6b Pilot install build | Auto | DONE | Additive init --migrate + --include-preserved; vcs.muse.working_dir + root_relative_docs: "." seams; origin: preserved\|kit lock + kit-only digest; tests/fixtures/pilot/*; docs/GIT-ONLY-QUICKSTART.md + docs/MIGRATE-EXISTING-REPO.md; seven-tier tests (224 green). Live consumer inits remain operator-gated; no gate flips; no K7 muse dogfood. | | K7a Freeze muse+git-mirror dogfood | Thinking | DONE | Frozen dogfood steps + regime-conditional footprint + parity K7.P1–P10 + §K7.5 guardrail + §K7.8 matrix (docs/archive/phases/PHASE-K7-MUSE-GIT-MIRROR-DOGFOOD.md). K7a-r1 → findings → 1-fix → K7a-r2 → pass (M1/M2/N1–N3 confirmed RESOLVED; full §K7.0–§K7.10 regress clean). Cleared for K7b. No Build; no live muse bridge export on the dev tree. | | K7b Dogfood muse+git-mirror build | Auto | DONE | Footprint assets (MUSE-BRIDGE-WORKFLOW.template.md, muse-bridge-deploy.sh S1–S13), regime-conditional resolve_footprint, executable script write, config-overseer-kit-dogfood.yaml fixture, docs/K7-DOGFOOD-OPERATOR-RUNBOOK.md, seven-tier tests (254 green). No live git-export on dev tree. | | K7 operator live dogfood | Operator | DONE | D2–D5 flip to muse+git-mirror; first safe bridge via .muse/mirror/ (209cd3f); PR #10 merged (Tier-3); adapter rev-parse --abbrev-ref HEAD fix; deploy template re-synced; 255 tests green. | | K8a Freeze multi-lane docs | Thinking | DONE | Frozen docs.lanes + docs.default_lane schema + governance-sync --lane / --all-lanes contract (docs/archive/phases/PHASE-K8-MULTI-LANE-DOCS-CONTRACT.md). | | K8b Multi-lane docs build | Auto | DONE | docs.lanes + default_lane in config; governance-sync --lane / --all-lanes; all-lane footprint; fixture config-two-lane.yaml; 266 tests green. | | K9a Freeze L1+L2 modules | Thinking | DONE | Contract in docs/archive/phases/PHASE-K9A-L1-L2-MODULE-FREEZE.md. Rounds 1–8 → findings + fixes; K9a-r9 → pass (all prior findings confirmed RESOLVED; full §K9.0–§K9.19 regress clean). Cleared for K9b (L1) and K10 (L2). | | K9b Checkpoint plugin build | Auto | DONE | L1 verify-step orchestrator + config parse + fixture pack + seven-tier tests (302 green) | | KH1 Handover relay standard | Thinking | DONE | KH1-r2 → pass. Contract + dogfood handover aligned; §KH1.6 close-out complete (🆗 branding lock + Track P seed). | | KH1b Substrate + gate reminders | Auto | DONE | §1 substrate health: tools/substrate_health/ fail-closed on hollow .muse/. §2 gate reminders: tools/governance_gates/ + governance_gates config + overseer status pending-gates + governance-sync footer + handover template checklist (§KH1.9). 399 tests green. | | KH2a Muse-sync hard gate | Thinking | DONE | Fail-closed Muse-sync gate freeze — docs/archive/phases/PHASE-KH2-MUSE-SYNC-HARD-GATE.md reviewed → pass (KH2-r2). Closes the gap this exact repo hit live: Git committing ahead of Muse with nothing catching it (KH1b's substrate health only checks .muse/ file presence, never content freshness). Freezes StatusResult.muse_dirty/git_dirty field additions, the tools/muse_sync/ probe (MuseSyncReport / check_muse_sync), the precise frozen trigger (muse_dirty and not git_dirty — Git clean, Muse stale; mid-edit "both dirty" is a frozen non-trigger, never blocked), the three wiring points (status --exit-code, review --freeze, governance-sync, all reusing exit code 2 — no renumbering of the frozen 2 > 6 > 3 > 0 precedence), and the seven-tier matrix. Documented boundary: does not catch drift re-masked by a later uncommitted edit (deferred, separate scope). Cleared for KH2b. | | KH2b Muse-sync hard gate build | Auto | DONE | Built mechanically against the frozen docs/archive/phases/PHASE-KH2-MUSE-SYNC-HARD-GATE.md: StatusResult.muse_dirty/git_dirty (all three adapters); tools/muse_sync/ (MuseSyncReport, check_muse_sync); wired into cli/commands/status.py (_exit_code_from_conditions extended, additive muse_sync JSON key), cli/commands/review.py (refuses before any review provider runs), tools/governance_hygiene/reads.py (perform_verified_reads returns ReadFailure("muse-sync", ...), mapped to exit 2 by the existing run_governance_sync); seven-tier tests (456 total green, +27 §KH2.8). Repo's own live drift (Git ahead of Muse by 2 commits) caught up via muse commit as Tier-1 hygiene in the same session. | | KH3a Footprint self-integrity hard gate | Thinking | DONE | Fail-closed footprint self-integrity gate freeze — docs/archive/phases/PHASE-KH3-FOOTPRINT-INTEGRITY-HARD-GATE.md reviewed → pass (KH3-r2). Direct response to this exact repo's own live incident: 13 kit-owned files (.cursor/rules/*, .cursor/skills/*/SKILL.md, .overseer/policy/*.yaml, .overseer/STANDING-DECISIONS.reference.md) were declared in version.lock since K4b but never actually rendered, and nothing automated ever objected because the existing footprint check is an opt-in --check-footprint flag not wired into review --freeze/governance-sync. Freezes tools/footprint_integrity/ (FootprintIntegrityReport / check_footprint_integrity), the narrow frozen trigger (declared in version.lock with non-preserved origin, absent from disk — deliberately existence-only, never content-hash, to avoid false-closing on the same benign drift class §KH2/this session already hit for scripts/muse-bridge-deploy.sh), the three wiring points (status --exit-code, review --freeze, governance-sync, all reusing exit code 2), and the seven-tier matrix. R1-M1 (fixed in KH3-r2): narrowed scope from "any digest mismatch" to "declared-but-absent only," specifically to avoid consumer-repo blast radius. Cleared for KH3b. | | KH3b Footprint self-integrity hard gate build | Auto | DONE | Built mechanically against the frozen docs/archive/phases/PHASE-KH3-FOOTPRINT-INTEGRITY-HARD-GATE.md: new tools/footprint_integrity/ (FootprintIntegrityReport, check_footprint_integrity); wired into cli/commands/status.py (_exit_code_from_conditions extended with footprint_self_integrity_ok, additive footprint_self_integrity JSON key, always-on — no flag needed), cli/commands/review.py (refuses before any review provider runs), tools/governance_hygiene/reads.py (perform_verified_reads returns ReadFailure("footprint-self-integrity", ...), mapped to exit 2); seven-tier tests (486 total green, +30 §KH3.8). Build-time refinement from the frozen spec (documented transparently, not a redesign): the gate checks existence against what version.lock already declares rather than re-resolving the current kit templates via resolve_footprint — strictly narrower and more precise to the actual incident (a live template not yet synced is drift, already covered elsewhere, not "declared but missing"), and avoids false-closing on lightweight test fixtures with synthetic/empty locks. This session's own remaining footprint_self_integrity: ok confirmed on the live repo. | | Track P / P0 | Thinking | DONE | Agent identity & signed provenance freeze — docs/archive/phases/PHASE-TRACK-P-P0-AGENT-PROVENANCE.md reviewed → pass (P0-r2), stamp digest sha256:7db8681…. Optional provenance envelope (agent_id/model_id/Ed25519 sig) on ledger entries; canonical hash excludes provenance.sig (v1 chain unbroken); soft under git-only, hard under Muse. Shared schema with Muse social domain. Social stays consumer-only. | | Track P / P1 | Auto | DONE | Build verified → pass (P1-BV-r2). Optional provenance envelope + Ed25519 verify + require_agent_signature + exit codes 25/26; canonical hash excludes provenance.sig (v1 chain unbroken). Build-verification round 1 raised BV1 (§P0.6 parity: verify did not emit 2 on hash-consistent malformed provenance) → fixed in tools/honesty/ledger.py verify_chain + CLI message + regression test; round 2 pass. 429 tests green (+30 §P0.8). Muse adapter plain-text SHA fix: _muse_rev_parse_sha reads bare stdout (0.2.x returns plain SHA on success); governance-sync --dry-run exits 0. First muse canonical commit sha256:4671b7f…; GitHub bridge PR #15 (muse-mirror → main). | | Track P / P-route | Thinking | DONE | Declarative model-routing policy freeze — docs/archive/phases/PHASE-TRACK-P-P-ROUTE-MODEL-ROUTING.md reviewed → pass (P-route-r2), stamp digest sha256:ab6b6a9…. Freezes the policy/model-routing.yaml schema ({position, phase_tier, gate} → model_tier + fallback; first-match-wins + mandatory defaults terminal; fallback[0] == model_tier, terminating in human), the additive model_tiers extension to policy/model-labels.yaml (abstract capability tiers, no vendor slugs), an optional default-inert model_routing: config block, a read-only overseer route surface + exit codes 30/31, the rule-holder-not-executor boundary table, and the seven-tier matrix. Runtime (Cursor / OpenRouter / Scooling 9A) is the executor; no model calls in the kit. Cleared for the P-route Auto build. | | Track P / P-route build | Auto | DONE | Build verified → pass (P-route-BV-r1). Vendored policy/model-routing.yaml (v1, first-match-wins + mandatory defaults; fallback[0] == model_tier terminating in human); extended policy/model-labels.yaml with model_tiers; optional default-inert model_routing: config; read-only overseer route (resolve / --validate / explain — no dispatch, no network, no key); exit codes 30/31; overseer status routing-validity line when enabled: true. 529 tests green (+43 §PR.8). Kit = rule-holder, runtime = executor. | | Track P / P-cost | Thinking | DONE | Cost-awareness surface (not a dollar pricer) freeze — docs/archive/phases/PHASE-TRACK-P-P-COST-AWARENESS.md reviewed → pass (P-cost-r2), stamp digest sha256:9f26678…. Freezes an optional, ordinal, currency-free cost_class (free < low < moderate < high) on each model_tiers[] entry; a deterministic paid_step_before_spend derivation (free + reserved human unpaid; absent band conservatively paid); additive cost_class + paid_step_before_spend annotation on the read-only overseer route output; an optional default-inert cost_awareness: config block; a read-only active-slice spend-awareness surface on overseer status + the governance-sync footer (reusing the §KH1.9 active-slice scan; reminder-only, never blocks); exit code 32 (malformed cost metadata, confined to overseer route); the boundary table (kit declares bands, runtime converts to dollars/budgets/spend); the seven-tier matrix. No dollar amount, currency, budget, spend cap, network call, or model call in the kit — price-agnostic by design. Cleared for the P-cost Auto build. | | Track P / P-cost build | Auto | DONE | Build verified → pass (P-cost-BV-r1). Built mechanically against frozen docs/archive/phases/PHASE-TRACK-P-P-COST-AWARENESS.md: optional cost_class on model_tiers (closed vocabulary free\|low\|moderate\|high; recognized key); paid_step_before_spend derivation; additive cost_class + paid_step_before_spend on overseer route; optional cost_awareness: config (enabled default false, surfaces default [status, governance-sync]); active-slice spend-awareness surface on overseer status (+ --json) and governance-sync footer + handover template reminder; exit 32 (malformed cost metadata, confined to overseer route); 569 tests green (+40 §PC.9). Kit = cost-awareness rule-holder, runtime = spender. | | Track P / P-evidence | Thinking | DONE | Verification evidence capture freeze — docs/archive/phases/PHASE-TRACK-P-P-EVIDENCE.md reviewed → pass (P-evidence-r3), stamp digest sha256:c1b9fb3…. Freezes ledger kind verification_evidence (additive to K9a enum); closed artifact types test_output|deploy_health|screenshot (hashes + opaque refs; no blobs in ledger); honesty.require_verification_evidence: off\|warn\|require (default off; HONESTY_KEYS membership); honesty-status Mode A/B mutual exclusion (--verification-evidence / --frozen-spec); exit 33 + error token missing_verification_evidence; normative build-verification V8 + Evidence table delta; boundary table (kit records/gates claims, never deploys). Closes build-verification V8 durability gap. Cleared for the P-evidence Auto build. Spec-only — no code landed. | | Track P / P-evidence build | Auto | DONE | Built against frozen docs/archive/phases/PHASE-TRACK-P-P-EVIDENCE.md → /build-verification-review pass (P-evidence-BV-r1). Shipped: ledger kind verification_evidence + validate_verification_artifacts; honesty.require_verification_evidence; honesty-status Mode B (--verification-evidence / --frozen-spec); exit 33 + missing_verification_evidence; twin build-verification V8 + Evidence table skill delta. 612 tests green (+43 §PE.10). Kit records/gates claims; never deploys. | | Track Q / Q0 Freeze Overseer App | Thinking | DONE | Overseer App freeze — docs/archive/phases/PHASE-TRACK-Q-Q0-OVERSEER-APP.md reviewed → pass (Q0-r2), stamp digest sha256:3c3f6229…. Freezes overseer app: local-only web UI over the existing Python engine (zero rewrite); closed api/* read/act surface (status, ROADMAP/HANDOVER, review --freeze, governance-sync, ledger, honesty-status); bind default 127.0.0.1 (+ localhost/::1); Bearer + CSRF-header auth; stdlib HTTP server (FastAPI not required); fail-closed CLI parity; seven-tier §Q0.12 matrix. Boundary: frontend/distribution of governance, never runtime. Spec-only — no code landed. Cleared for Q1 Auto build. | | Track Q / Q1 Local web UI build | Auto | DONE | Build verified → pass (Q1-BV-r1). Built against frozen docs/archive/phases/PHASE-TRACK-Q-Q0-OVERSEER-APP.md: overseer app stdlib loopback server (tools/app/) + static UI; cli/commands/app.py; closed api/* handlers calling existing engine; Bearer + CSRF auth; inert-first writes; seven-tier §Q0.12. 654 tests green (+42 §Q0.12). | | Track Q / Q2a Freeze OK CLI entrypoint | Thinking | DONE | Canonical CLI rename freeze — docs/archive/phases/PHASE-TRACK-Q-Q2A-OK-CLI-ENTRYPOINT.md reviewed → pass (Q2a-r2). Freezes ok as the standard POSIX entrypoint (cli/ok → python -m cli.main); argparse prog ok; operator-facing docs/templates prefer ok status, ok app, etc. cli/overseer remains a compatibility shim (same runtime; one-line stderr deprecation per process). Amends K4/SPEC §5 entrypoint naming without changing subcommands, exit codes, or .overseer/ config paths. Engine shims are not footprint members (corrects earlier Q2b “footprint + version.lock entry” wording). Seven-tier §Q2A.10 matrix. Spec-only — no code landed. Cleared for Q2b. | | Track Q / Q2b OK CLI entrypoint build | Auto | DONE | Build verified → pass (Q2b-BV-r1). Shipped frozen Q2a: cli/ok canonical shim + cli/overseer one-line stderr deprecation; prog="ok"; operator docs/templates/twin skills/CI → ok; SPEC §5 + K4.1 naming amendment; remediation strings → ok; engine shims not footprint members. 668 tests green (+14 §Q2A.10). Cleared for Q3 (ok app launcher). | | Track Q / Q3 Tauri desktop packaging | Auto | DONE | Build verified → pass (Q3-BV-r1). Tauri shell (desktop/) spawns canonical ok app, loads loopback Q1 UI in WebviewUrl::External; tools/desktop/ launcher contract + scripts/bundle-desktop-kit.sh; in-memory auth bootstrap script; macOS/Windows/Linux from one codebase; no engine/API changes. 696 tests green (+28 §Q3). | | Track Q / Q4a Freeze Path B UI redesign | Thinking | DONE | Path B UI redesign freeze — docs/archive/phases/PHASE-TRACK-Q-Q4A-UI-REDESIGN.md reviewed → pass (Q4a-r2), stamp digest sha256:ea118134…. Freezes developer/operator ok app presentation: Overview + Structure IA; L0→L3 / kit-vs-sister-door copy; four offline SVG structure diagrams (lanes / regimes / layers / kit→consumer); suite CTAs (GitHub, MuseHub, Knowtation, Consumer pattern, Scooling, VF); closed Q0 api/* + bind/auth non-reopen; no LICENSE flip; seven-tier §Q4A.15. Spec-only — no UI code landed. Cleared for Q4b Auto. | | Track Q / Q4b Path B UI redesign build | Auto | DONE | Build verified → pass (Q4b-BV-r1). Built against frozen docs/archive/phases/PHASE-TRACK-Q-Q4A-UI-REDESIGN.md: Overview + Structure IA; four offline SVGs (assets/diagrams/{lanes,regimes,layers,kit-consumer}.svg); suite CTAs §Q4A.7; status humanization; honesty strip + Apache-2.0 footer; closed Q0 api/*/bind/auth unchanged; no LICENSE/desktop/ edits. Seven-tier §Q4A.15 (17 green); full suite 905. | | K6-Scooling consumer runbook | Auto | DONE | docs/consumers/scooling/OVERSEER-SETUP.md — install, SC-P1/SC-P2 parity pointers, kit-vs-runtime boundary, day-to-day; cross-linked from K6 operator runbook + consumer-adapter pattern. No live Scooling init (operator-gated). | | Track O / O0 Normie custody funnel | Thinking | DONE | Normie custody funnel freeze — docs/archive/phases/PHASE-TRACK-O-O0-NORMIE-CUSTODY-FUNNEL.md reviewed → pass (O0-r3), stamp sha256:642076c9…. Freezes Track O vs K6/Q identity; Stages 1–4 (Muse-first start, work, optional GitHub backup, optional Knowtation bind); §O0.3.3 Stage 3 kit upgrade ceremony deferred to O2; custody identity; kit vs Scooling/Knowtation/MuseHub boundary; rejection table; O1 product-contracts-only deliverables; seven-tier §O0.8. Spec-only — no code landed. Cleared for O1. | | Track O / O1 Normie custody product contracts | Auto | DONE | Build verified → pass (O1-BV-r1). Product contract pack: docs/TRACK-O-NORMIE-CUSTODY-PRODUCT-CONTRACT.md (Stages 1–4, §O0.3.3 deferred Stage 3, boundary + rejection); Scooling Track O cross-link; Knowtation stub docs/consumers/knowtation/OVERSEER-SETUP.md; tools/track_o/ validator + seven-tier §O0.8 harness. 728 tests green (+32). No signup UI, no Stage 3 ceremony, no live consumer init. Cleared for O2 Thinking. | | Track O / O2 Stage 3 kit upgrade ceremony | Thinking | DONE | Ceremony freeze reviewed → pass (O2-r3), stamp sha256:ac970077…. Freezes muse-only → muse+git-mirror steps C0–C8; config/footprint re-seed + --migrate/--force rules; bridge gates G1–G8; product unlock §O2.6; O3 deliverable ok upgrade-regime; seven-tier §O2.9. Spec-only — no ceremony code landed. Cleared for O3. | | Track O / O3 Stage 3 upgrade-regime build | Auto | DONE | Build verified → pass (O3-BV-r2). Shipped ok upgrade-regime (§O2.7 flags; C0–C5/G1–G8; C8 hard-stop); runbook docs/TRACK-O-STAGE3-UPGRADE-OPERATOR-RUNBOOK.md; product-contract + tools/track_o/ harness retarget together; SPEC §5 row. Seven-tier §O2.9 (+33). Full suite 761 green. No signup UI; no live consumer init; no C8 merge. Track O kit chain complete; §O2.6 product one-click unlocked for consumers wrapping only this CLI. | | Track P / P-deploy deployment gate | Thinking | DONE | Deployment gate freeze — docs/archive/phases/PHASE-TRACK-P-P-DEPLOY.md reviewed → pass (P-deploy-r3), stamp digest sha256:a9fe1cd9…. Live-deploy sibling of build-verification: reuses P-evidence verification_evidence + deploy_health (no new ledger kind); honesty.require_deploy_health: off\|warn\|require (default off; HONESTY_KEYS + HonestyConfig); honesty-status Mode C (--deploy-health / shared --frozen-spec; §PD.5.0 resolution); exit 34 + missing_deploy_health; twin /deploy-verification-review skill (D1–D8); rejection table; seven-tier §PD.9. Kit records/gates only — never deploys / never HTTP-probes. Spec-only — no code landed. Cleared for the P-deploy Auto build. | | Track P / P-deploy build | Auto | DONE | Built against frozen docs/archive/phases/PHASE-TRACK-P-P-DEPLOY.md → /build-verification-review pass (P-deploy-BV-r1). Shipped: honesty.require_deploy_health (HONESTY_KEYS + HonestyConfig); find_matching_deploy_health; honesty-status Mode C (--deploy-health, §PD.5.0); exit 34 + missing_deploy_health; twin /deploy-verification-review (D1–D8). 798 tests green (+37 §PD.9). Kit records/gates; never deploys/probes. | | Hosted governance dashboard freeze | Thinking | DONE | Hosted read-only dashboard freeze — docs/archive/phases/PHASE-HOSTED-GOVERNANCE-DASHBOARD.md reviewed → pass (HGD-r3), stamp digest sha256:af8419e1…. Freezes org/repo ROADMAP+HANDOVER+gates glance via GitHub/MuseHub read APIs; Track Q contrast; closed GET-only api/*; Bearer viewer auth; document-derived vs advisory gates; rejection + capability tiers; Auto deliverables under tools/hosted_dashboard/ + ok hosted-dashboard; seven-tier §HGD.12. Spec-only — no code landed. Cleared for Hosted governance dashboard Auto. | | Hosted governance dashboard build | Auto | DONE | Build verified → pass (HGD-BV-r1). Built against frozen docs/archive/phases/PHASE-HOSTED-GOVERNANCE-DASHBOARD.md: tools/hosted_dashboard/ (github_contents/meta + optional checks/musehub_read); closed GET-only api/*; Bearer viewer auth; document-derived + advisory gates; ok hosted-dashboard (port 8766); static UI + honesty banner; runbook docs/HOSTED-GOVERNANCE-DASHBOARD-OPERATOR-RUNBOOK.md; SPEC §5 row; seven-tier §HGD.12 (50 green). Track Q untouched. No remote write / product store / CD. | | Q3-release — desktop installers freeze | Thinking | DONE | Signed desktop installers freeze — docs/archive/phases/PHASE-Q3-RELEASE-DESKTOP-INSTALLERS.md reviewed → pass (QR-r3), stamp digest sha256:91d39951…. Freezes CI publish of signed Tauri .dmg / .msi / .AppImage (Path C download path); runner matrix + publish allowlist; Apple/Windows/Linux signing + secret-name boundary; release manifest + GitHub Releases destination; rejection table; Auto deliverables under .github/workflows/ + tools/desktop_release/; seven-tier §QR.13. Honesty: Auto v1 still needs host Python 3.11+ (no embedded interpreter). Spec-only — no workflow/secrets landed. Cleared for Q3-release Auto. | | Q3-release — desktop installers build | Auto | DONE | Build verified → pass (Q3R-BV-r1). Built against frozen docs/archive/phases/PHASE-Q3-RELEASE-DESKTOP-INSTALLERS.md: .github/workflows/desktop-release.yml + optional smoke; templates/ci/desktop-release-github-actions.yml; tools/desktop_release/ (version-align, manifest, refuse, allowlist, checksums, finalize); desktop/keys/ public-only; runbook §Signed installers + Python 3.11+ honesty; SPEC §5 additive note; seven-tier §QR.13 (39 green). Full suite 887 green. Track Q engine/API untouched. Live notarization/Release upload not required for DONE (operator Tier-3 secrets). | | Landing + access clarity freeze | Thinking | DONE | Public landing + console access UX freeze — docs/archive/phases/PHASE-LANDING-ACCESS-CLARITY.md reviewed → pass (LAC-r2), stamp digest sha256:c0ac8162…. Freezes pre-public IA (strip DONE residue; structure SVGs on main page); Download CTA → signed Mac v0.1.0 .dmg; Paths 1–3 access playbook; Path B chrome (collapse bootstrap, bound repo via health repo_root additive, Status auto-refresh once); overseerkit.com apex = static only; pre-public DNS gate; seven-tier §LAC.12. Spec-only — no UI/landing rewrite. Cleared for Landing + access clarity Auto. | | Landing + access clarity build | Auto | DONE | Build verified → pass (LAC-BV-r1). Built against frozen docs/archive/phases/PHASE-LANDING-ACCESS-CLARITY.md: docs/landing/ IA §LAC.3 + offline SVGs + Download CTA → signed Mac v0.1.0 .dmg; Paths 1–3 playbook on README/landing/Path B Overview; HOSTING §LAC.8; Path B chrome (collapse bootstrap, health repo_root, tab explainers, Status auto-refresh once); narrow api/health additive only; validator + seven-tier §LAC.12; full suite 931 green. No CSRF mint; no unsigned-as-primary; DNS remains Tier 3. | | K12 LICENSE → MIT | Thinking → Auto | DONE | Freeze pass (MIT-r1) + BV pass (MIT-BV-r1). Operator SPDX flip Apache-2.0 → MIT. Amended K12 §K12.4/§K12.7; root LICENSE + pyproject.toml + landing/console SPDX; validator fail-closed MIT; seven-tier + full suite 936 green (1 env-deselected: port 8765 occupied). Spec: docs/archive/phases/PHASE-K12-LICENSE-MIT-AMENDMENT.md. | | Landing clarity pass | Auto | DONE | Build verified → pass (LC-BV-r1). Visitor IA on docs/landing/ amends LAC §LAC.3.1 section ids (hero → kit-basics → problem → how-it-works → structure → console-access → musehub → next-steps → scenarios). Download CTA keeps frozen Mac v0.1.0 .dmg + Apple Silicon label; Paths 1–3; four structure SVGs; MIT footer; no CSRF mint. Close-out polish: Path 1 “Download link” honesty + Download foot-link weight; stress fixture includes docs.html. Seven-tier landing+LAC 53 green. Merged via PR #39 → main (f5cde68). DNS cutover still Tier 3 (§LAC.9). | | Check OK (ad-hoc honesty) | Auto | DONE | BV pass (CIO-BV-r1 + CIO-r2). Merged PR #35 → main (b8b51c1, 2026-07-18). Skill /check-ok vendors to .cursor/skills/ and .claude/skills/; ok check-ok (+ synonym check-if-ok); paste docs/CHECK-OK.md for Copilot/any chat; same K5 engine; no new lanes. | | K13a Freeze multi-repo workspace lanes | Thinking | DONE | Reviewed → pass (K13a-r3), stamp sha256:df3d2754…. Freezes constellation / workspace model (Option B primary manifest at product_order .overseer/workspace.yaml), PRIMARY/RELAY/PRODUCT RELAY/ARCHIVED/LANE TIP markers, §MR.6.5 board filename identity ({REPO_SLUG}-OVERSEER-HANDOVER.md), ok workspace status|check-next|doctor, exit 35, SD-17 sibling gate, S1–S12 + seven-tier §MR.10. Spec: docs/archive/phases/MULTI-REPO-WORKSPACE-LANES-FREEZE.md. Spec-only — no CLI. Cleared for K13b. | | K13b Multi-repo workspace lanes build | Auto | DONE | Build verified → pass (K13b-BV-r1). Built against frozen docs/archive/phases/MULTI-REPO-WORKSPACE-LANES-FREEZE.md (incl. §MR.6.5): tools/workspace/ + ok workspace status|check-next|doctor, exit 35 (2 > 6 > 35 > 3 > 0), additive workspace: + manifest loader, PRIMARY/RELAY/PRODUCT RELAY/ARCHIVED/LANE TIP + tip_hash, prefixed init defaults, handover template + workspace-authority rule/skills, governance-sync workspace_relay footer, fixtures S1–S12, seven-tier §MR.10 green. No live consumer renames. | | K13-DOGFOOD | Operator + Auto | DONE | Live constellation scooling-stack on feature branches feat/k13-dogfood-workspace: Scooling boards → SCOOLING-* + .overseer/workspace.yaml (product_order); Knowtation → KNOWTATION-* + workspace: + ownership PRIMARY + PRODUCT RELAY tip_hash; ok workspace check-next → 0; doctor clean of board_name_violation. Merge remains Tier 3. MuseHub / Brain still optional. | | K13-MUSEHUB | Operator + Auto | DONE | Optional enrichment member live: MUSEHUB_ROOT=~/MUSE_HUB/musehub; boards MUSEHUB-OVERSEER-HANDOVER.md / MUSEHUB-ROADMAP.md + titles; workspace: → scooling-stack / product_order_root scooling; Scooling workspace.yaml musehub root → musehub checkout (required: false); ok workspace check-next → 0; doctor clean of board_name_violation; muse-only (no git/gh). MuseHub branch feat/k13-musehub-enrichment (ae779f3e…); Scooling feat/k13-dogfood-workspace (1ba29c19…). Constellation spelling corrected scoaling→scooling. Merge Tier 3. Does not claim product PRIMARY. | | K13-BRAIN | Operator + Auto | DONE | Optional edge member live: BRAIN_ROOT=~/theBRAIN/the-brain; boards THE-BRAIN-OVERSEER-HANDOVER.md / THE-BRAIN-ROADMAP.md + titles; workspace: → scooling-stack; Scooling workspace.yaml brain root + regime: git-only (required: false); ok workspace check-next → 0; doctor clean of board_name_violation. Brain branch feat/k13-brain-edge-member (bc0c0e6); Scooling 95519638…. Merge Tier 3. K13 dogfood order (§MR.12.3) complete. Does not claim product PRIMARY. | | K13 → main | Operator | DONE | PR #40 → main @ 6efef50 (2026-07-27). Consumers: ok sync from live kit checkout. | | GFG-a Governance freshness gate freeze | Thinking | DONE | Reviewed → pass (GFG-r3), stamp sha256:fe8a3a15…. Froze docs/archive/phases/PHASE-GFG-GOVERNANCE-FRESHNESS-GATE.md: session-end Automation template for ok governance-sync --dry-run (9A-5 §1 secondary trigger) + fail-closed ok status --exit-code / enabled land-check on D1/D2 drift or stale/missing last_governance_sync; marker enrich + dry-run carve-out; explicit non-goals (no post-merge hook, no silent main writes, no consumer hand-edit fix). Spec-only. Cleared for GFG-b. | | GFG-b Governance freshness gate build | Auto | DONE | Build verified → pass (GFG-BV-r1). Built exactly to frozen docs/archive/phases/PHASE-GFG-GOVERNANCE-FRESHNESS-GATE.md: cursor/automations/governance-sync-session-end.json; tools/governance_freshness/ (D1/D2 + marker; skip R4/gh); enriched last_governance_sync stamp on fully_aligned / dry-run D1–D2 aligned / _apply_plan; ok status --exit-code exit 2 + JSON governance_freshness; land-check when close_ritual.enabled; .gitignore/.museignore; cursor README Tier-2 enable; skill dry-run carve-out. Seven-tier §GFG.9 green; mid-apply no-marker assertion retained. | | GFG → main | Operator | DONE | Muse main merge sha256:1e9ce2ae… + GitHub PR #41 muse-mirror → main @ ccf44b4 (2026-07-28). Consumers: ok sync then one-time ok governance-sync --dry-run (§GFG.8.1). | | GFG-D2-FIX-a Muse ID-space D2 freeze | Thinking | DONE | Reviewed → pass (D2F-r2), stamp sha256:3148c577…. Froze docs/archive/phases/PHASE-GFG-D2-MUSE-ID-SPACE.md: under muse+git-mirror, D2 compares last_export.muse_commit_id to Muse tip (not git_sha); realign ancestry keeps git_sha; verify uses Muse IDs; no freshness default-off; no default git-import dogfood. Spec-only. Cleared for GFG-D2-FIX-b. | | GFG-D2-FIX-b Muse ID-space D2 build | Auto | DONE | Build verified → pass (D2F-BV-r1). Built exactly to frozen §D2F.8: read_bridge_muse_commit_id; read_canonical_anchor returns Muse ID; plan_realign ancestry uses git_sha; seven-tier §D2F.9 green. | | GFG-D2-FIX → main | Operator | DONE | Muse main @ sha256:835bdd28… (D2 fix 4aebfa75… + close-out) + GitHub PR #43 muse-mirror → main @ 972507c (2026-07-28). Consumers: ok sync then ok governance-sync --dry-run → ok status --exit-code → 0. | | KIT-PRESERVE-SHARED-ASSETS (0.7b) | Auto | DONE | Freeze pass (PSA-r1) + BV pass (PSA-BV-r1). ok init --preserve-shared-assets: differing non-living footprint stays on disk + origin:preserved even under --force; promote only via --force --include-preserved. Seven-tier §PSA.8 28 green. Spec: docs/archive/phases/PHASE-PRESERVE-SHARED-ASSETS.md. | | KIT-PRESERVE → main | Operator + Auto | DONE | SD-21 land 2026-07-30: Muse FF feat/preserve-shared-assets → main (sha256:746fa8e3…) → muse-bridge → GitHub PR #47 muse-mirror → main @ 302549e. No live consumer re-init. | | GS-PASTE-a Freeze paste-ready / NEXT regen | Thinking | DONE | Reviewed → pass (GSP-r3), stamp sha256:123c2e68…. Froze docs/archive/phases/PHASE-GS-PASTE-READY-REGEN.md: regenerate next-session + paste-ready-prompt via ok governance-sync only; fail-closed ambiguous NEXT; git-only/no-Muse; §GSP.10 seven-tier matrix. Spec-only. Cleared for GS-PASTE-b. | | GS-PASTE-b Paste-ready / NEXT regen build | Auto | DONE | Build verified → pass (GSP-BV-r1). Built against frozen docs/archive/phases/PHASE-GS-PASTE-READY-REGEN.md: tools/governance_hygiene/next_regen.py + patch/engine/anchors wiring; fail-closed ambiguous NEXT + glance; git-only/no-Muse; seven-tier §GSP.10 19 green. Branch feat/gs-paste-ready-regen. | | GS-PASTE → main | Operator + Auto | DONE | SD-21 land 2026-07-30: Muse FF feat/gs-paste-ready-regen → main (sha256:e7831636…) → muse-bridge → GitHub PR #49 muse-mirror → main @ 5a85ef2. No live consumer re-init. | | PMHF-a Post-merge handover freshness freeze | Thinking | DONE | Reviewed → pass (PMHF-r4), stamp sha256:7d02bb23…. Froze docs/archive/phases/PHASE-PMHF-POST-MERGE-HANDOVER-FRESHNESS.md: land-a/land-b paste protocol, fail-closed land_closeout (status / land-check / ok land-closeout), optional CI comment/docs-PR (never silent main writes; never Cursor-only primary). Compose GFG + GS-PASTE; no freeze/BV redesign. Spec-only. Cleared for PMHF-b. | | PMHF-b Post-merge handover freshness build | Auto | DONE | Build verified → pass (PMHF-BV-r1). Built exactly to frozen docs/archive/phases/PHASE-PMHF-POST-MERGE-HANDOVER-FRESHNESS.md: tools/land_closeout/ (LandCloseoutReport + check_land_closeout, §PMHF.5 resolution order); ok land-closeout (exit 0/2, probe default on for git regimes / off muse-only); ok status --exit-code folds land_closeout.ok into exit 2 (land_a_in_progress stays ok); land-check refuses non-complete closeout (§PMHF.6.5 tokens); next_regen land-phase= marker + land-b emission (frozen §PMHF.3.2 paste; dry-run shows body); templates/ci/governance-closeout-github-actions.yml (comment-only, GITHUB_TOKEN, never pushes/applies on main); handover template rule 8 + governance-sync skill + tier-authority touchpoints; SPEC §5 additive rows. Seven-tier §PMHF.10 46 green. No freeze/BV redesign; no Cursor-only primary; no silent main writes. | | PMHF → main | Operator + Auto | DONE | SD-21 land 2026-07-31: Muse FF feat/post-merge-handover-freshness → main (sha256:72efabb7…) → muse-bridge → GitHub PR #52 muse-mirror → main @ edbc3eb (operator-approved merge). land-b post-merge sync completed same day per §PMHF.3.2 (docs synced manually — see GSW-FIX); ok land-closeout → 0. Dogfooded the new protocol live: closeout gate correctly held post_merge_incomplete (exit 2) until this sync. No live consumer re-init. | | GSW-FIX-a Governance-sync write-path freeze | Thinking | DONE | Reviewed → pass (GSW-r3), stamp sha256:63cfd176…. Froze docs/archive/phases/PHASE-GSW-FIX-GOVERNANCE-SYNC-WRITE-PATH.md: apply order capture → realign (original branch) → ensure feature branch (dual-HEAD on muse+git-mirror) → write docs → commit → marker → push; rollback restores docs + marker + original branch; Muse commit_feature already-on-branch short-circuit + dirty-carry (--autoshelf/--merge); seven-tier matrix requires dirty-tree --write on all three regimes. Spec-only. Cleared for GSW-FIX-b. | | GSW-FIX-b Governance-sync write-path build | Auto | DONE | Build verified → pass (GSW-BV-r1). Built exactly to frozen docs/archive/phases/PHASE-GSW-FIX-GOVERNANCE-SYNC-WRITE-PATH.md: _apply_plan order capture → realign (original branch) → dual-HEAD feature-branch ensure → write docs → commit → marker (D1+D2 after commit) → push; rollback restores docs + marker + original branch (best-effort dual restore, no --force); commit_feature already-on-branch short-circuit (all three adapters) + Muse dirty-carry (--autoshelf). Seven-tier §GSW.10 29 green incl. dirty-tree --write on all three regimes. Branch feat/gsw-fix-governance-sync-write-path. | | GSW-FIX → main | Operator + Auto | DONE | SD-21 land 2026-07-31: Muse FF feat/gsw-fix-governance-sync-write-path → main (sha256:fd2a66b5…) → muse-bridge → GitHub PR #53 muse-mirror → main @ 98615a8. Land includes the land-closeout land_queue_conflict hyphen-fragment fix found dogfooding land-a (compound-token match; other-slice DONE rows no longer false-conflict). land-b post-merge sync same day via ok governance-sync --write — first live use of the GSW-FIX write path; live dogfood caught + fixed a second staging defect (Muse adapters ran bare muse add; Muse 0.2.x only has muse code add — both adapters + test-harness fidelity fixed on the sync branch); ok land-closeout → 0. Staging fix + land-b docs landed same day: Muse FF feat/governance-sync-2026-07-31 → main (sha256:f7e85006…) → muse-bridge → GitHub PR #54 muse-mirror → main @ e895a35 (operator-authorized ok pr-land). Closeout land (queue PLS + pr_matches_row compound-slice-ID fix): Muse FF → main (sha256:73f19df1… then compound-ID tighten) → muse-bridge → GitHub PR #55 muse-mirror → main @ 4650171 (operator-authorized ok pr-land). No live consumer re-init. | | PLS-a Post-land main sync freeze | Thinking | DONE | Reviewed → pass (PLS-r4), stamp sha256:7a31fb2b…. Froze docs/archive/phases/PHASE-PLS-POST-LAND-MAIN-SYNC.md: nested close_ritual.post_land_sync (enabled default false, strategy: ff_only, require_clean_worktree: true); additive ok pr-land post-step after MERGED — fetch vcs.git.remote, dirty → skipped_dirty warn (never clobber), clean → checkout vcs.git.main_branch + git pull --ff-only; exit 36 (EXIT_POST_LAND_SYNC) on hard sync fail (not K4 integrity 6); always-present PrLandResult.post_land_sync; verify_landed unchanged; consumer opt-in; seven-tier §PLS.10. Spec-only. Cleared for PLS-b. | | PLS-b Post-land main sync build | Auto | DONE | Build verified → pass (PLS-BV-r1, 0 findings). Built exactly to frozen docs/archive/phases/PHASE-PLS-POST-LAND-MAIN-SYNC.md: PostLandSyncConfig + fail-closed _parse_post_land_sync (adapters/config.py, unknown keys / strategy≠ff_only / require_clean_worktree≠true / non-bool → ConfigError); new tools/close_ritual/post_land_sync.py (§PLS.4.2 fetch → porcelain → dirty skipped_dirty warn never-clobber → clean checkout main + git pull --ff-only → frozen editor-buffer note); wired into run_pr_land/cli/commands/pr_land.py with config + repo_root; always-present PrLandResult.post_land_sync (closed set disabled\|regime_skipped\|skipped_dirty\|synced\|failed\|not_applicable); exit 36 = EXIT_POST_LAND_SYNC only on hard sync fail after real merge (never 6); muse-only inert regime_skipped zero git argv; verify_landed/land_check.py untouched; default off consumer opt-in. Seven-tier §PLS.10 46 green (63 with adjacent close-ritual/config suites). Doc touchpoints: SPEC §5 ok pr-land row, PHASE-PR-LAND-AFTER-CHECKS exit-36 + pointer, VF OVERSEER-SETUP post_land_sync knobs. BV reviewer note: thinking-high Claude tiers API-limited at review time; independent verifier ran on grok-4.5-high with the same checklist + evidence table. | | PLS → main | Operator + Auto | DONE (PR #58, 433c5a3) | Land PLS (SD-21 land hygiene; merge authority Tier 3): Muse merge feat/pls-a → main → muse-bridge-deploy → green muse-mirror PR → GitHub main; then land-b post-merge sync (ok governance-sync) + ok land-closeout → 0 before claiming land complete. | | GSB-a Governance-sync dated-branch collision freeze | Thinking | DONE | Reviewed → pass (GSB-r3), stamp sha256:30cfb999…. Froze docs/archive/phases/PHASE-GSB-GOVERNANCE-SYNC-BRANCH-COLLISION.md: when feat/governance-sync-<date> already exists on either history (same-day second closeout), --write reconciles before dual-HEAD ensure — ancestor/equal → FF tip without checkout-as-FF (git branch -f / update-ref / muse update-ref / muse branch -C); else deterministic -N uniquify + frozen PatchPlan replace + rebuilt pr_url; T_target via base-ref rules (O_H == B → configured main); Muse-first must never dirty the Git tree; compose with GSW order (no rollback / commit_feature redesign); --force checkout forbidden; seven-tier §GSB.8 incl. same-day-collision --write on all three regimes. Live defect: PLS land-b 2026-07-31 engine exit 2. Spec-only. Cleared for GSB-b. | | GSB-b Governance-sync dated-branch collision build | Auto | DONE | Build verified → pass (GSB-BV-r1, 0 findings). Built exactly to frozen docs/archive/phases/PHASE-GSB-GOVERNANCE-SYNC-BRANCH-COLLISION.md: C0 reconcile-before-ensure in tools/governance_hygiene/engine.py — when feat/governance-sync-<date> exists on either history, classify per-history vs §GSB.3.2.1 T_target (O_H == B → configured main); ancestor/equal → tip FF via allowed forms only (git branch -f / git update-ref / muse update-ref, never checkout-as-FF); either side diverged → deterministic lowest-free -N uniquify (N≥2) with frozen PatchPlan dataclasses.replace + rebuilt pr_url so commit/push/PR observe the reconciled name; Muse never dirties the Git tree (§GSB.3.4 — muse status --json total_changes staleness, fail-closed reset --hard ordering, no --force anywhere); then unchanged C1 dual-HEAD ensure — no rollback / commit_feature / GSW order redesign, exit codes unchanged. tests/support.py BranchStateRunner models per-branch tips/ancestry + shared-worktree content and reproduces the live PLS land-b checkout refusal without the fix (counterfactual exit 2). Seven-tier §GSB.8 25 green incl. mandatory same-day-collision --write on git-only, muse-only, muse+git-mirror; full suite 1213 green (15 pre-existing env failures unchanged, zero governance paths). BV note: thinking-high Claude tiers API-limited at review time; independent verifier ran on grok-4.5-high with the full checklist + evidence table. Branch feat/gsb-branch-collision. | | Public OSS docs housekeeping (A+B) | Operator + Auto | DONE (PR #60, bdee603) | Product-facing docs cut before public flip: archive shipped PHASE-* + multi-repo freeze → docs/archive/phases/; thinking/personal/pilot archaeology → docs/archive/{thinking,personal,operators}/; consumer runbooks → docs/archive/consumers/ with thin public stubs retained; public docs/README.md; Path B suite doors slimmed (no sister-product setup CTAs); path refs + Track O / Q4b / checklist / landing tests green. Landed Muse→mirror→GitHub main via SD-14 PR #60 @ bdee603. No flip to public yet. | | GSB → main | Operator + Auto | DONE (PR #59, de9013f) | SD-21 land: Muse merge feat/gsb-branch-collision → main → muse-bridge → GitHub PR #59 muse-mirror → main @ de9013f. land-b closeout follows with Public OSS docs A+B land (PR #60) + ok governance-sync --write (live C0 reconcile dogfood) + ok status / ok land-closeout → 0. | | Contributor guide and repository visibility flip | Operator + Auto | DONE (PR #63 @ 0e80a42; land-b #65 @ 8a37818) | Authored CONTRIBUTING.md; promoted migrate guide to docs/MIGRATE-EXISTING-REPO.md; removed non-public laundry (docs/archive/{personal,operators,consumers}/); secrets/history pass clean on working tree; maintainer docs/PUBLIC-VISIBILITY-CHECKLIST.md. SD-21 land: Muse FF feat/contributor → main (sha256:9c9e489…) → muse-bridge → GitHub PR #63; land-b docs PR #65. GitHub visibility flip still Tier 3 / operator when checklist green. | | Public repository visibility flip | Operator + Auto | DONE | Operator confirmed GitHub aaronrene/overseer-kit is public (visibility: public, private: false, 2026-08-12). Checklist product/laundry/secrets working-tree boxes were already green; Settings flip already applied — docs sync only. No agent/CI automation of the flip. | | ONS-a Operator NEXT surfacing freeze | Thinking | DONE | Reviewed → pass (ONS-r2), stamp sha256:242e318f…. Froze docs/archive/phases/PHASE-ONS-OPERATOR-NEXT-SURFACING.md: portable ok next / ok governance-sync --print-next (read-only extract, exit 37); skill + alwaysApply rule (Cursor + Claude Code); Copilot docs/PRINT-NEXT.md; host niceties best-effort and not a DONE gate; no tab-reload claim; no per-branch handover names. Spec-only. Cleared for ONS-b. | | ONS-b Operator NEXT surfacing build | Auto | DONE | Built exactly to frozen docs/archive/phases/PHASE-ONS-OPERATOR-NEXT-SURFACING.md: tools/print_next/ + cli/commands/next.py + ok next / ok governance-sync --print-next; skill + alwaysApply rule; docs/PRINT-NEXT.md + AGENTS + consumer stubs; SPEC §5 row; optional cursor/hooks/ (fail-open, not footprint). Seven-tier §ONS.12 24 green. BV pass (ONS-BV-r1). Tab sync is not a DONE gate. | | ONS → main | Operator + Auto | DONE | SD-21 land: Muse FF feat/ons-operator-next-surfacing → main (sha256:3e21a881…) → muse-bridge → GitHub PR #68 muse-mirror → main @ 588da95. land-b post-merge sync same day. | | LT-a Loop tightening freeze | Thinking | DONE | Reviewed → pass (LT-r2), stamp sha256:6a5aafb5…. Froze docs/archive/phases/PHASE-LT-LOOP-TIGHTENING.md: footprint coverage gate; session_bookends default off + Cursor start/end/stop hooks when on; kit-dogfood honesty warn + active-slice Mode B; ok handover-compact. Spec-only. Cleared for LT-b. | | LT-b Loop tightening build | Auto | DONE | Built exactly against frozen docs/archive/phases/PHASE-LT-LOOP-TIGHTENING.md: tools/footprint_coverage/ + status/review/governance wiring; session_bookends default off + dogfood hooks; kit honesty warn + active-slice Mode B; ok handover-compact; optional-feature tips on ok status; workspace-root docs; seven-tier §LT.10 34 green; dogfood ok sync --force + compact; BV pass (LT-b-BV-r1, hook fail-open fix). No consumer honesty/hooks defaults; no tab-reload claim. | | LT → main | Operator | DONE | PR #72 @ ff737cc (2026-09-02). | | consumer-lt-rollout | Operator | DONE | Synced LT into Knowtation, Scooling, VideoFactory, the-brain, bornfree-hub, ourware, scooling-lab (+ sc-brain). Primary Cursor repos opted into session_bookends (+ honesty warn on Knowtation/Scooling). footprint_coverage: ok. Deferred: MuseHub config, secondary-repo bookends, VF conflicted policy --force. | | ISR-a Independent second reviewer freeze | Thinking | DONE | Reviewed → pass (ISR-r4), stamp sha256:e6284150…. Froze docs/archive/phases/PHASE-ISR-INDEPENDENT-SECOND-REVIEWER.md: ledger kind independent_second_review; Mode D on ok honesty-status; require_independent_second_reviewer default off; exit 38; active-slice status/governance surface; portable CLI+docs primary. Governance, not runtime — kit records/gates only; no model dispatch. Spec-only. Cleared for ISR-b. | | ISR-b Independent second reviewer build | Auto | DONE | Build verified → pass (ISR-b-BV-r1). Built exactly against frozen docs/archive/phases/PHASE-ISR-INDEPENDENT-SECOND-REVIEWER.md: ledger kind independent_second_review; Mode D + exit 38; require_independent_second_reviewer (default off; kit dogfood warn); active-slice status/governance-sync surface; paste doc + twin skill; BV V9 + rule; SPEC/AGENTS/consumer pointers; seven-tier test_isr_ 48 green. Second-chat ISR pass (actor_session_id c72e9414… ≠ producer 62762b24…). No model dispatch; no consumer require; no new CLI verb. | | ISR → main | Operator + Auto | DONE (PR #74 @ 84db8c8) | MuseHub solidify first (staging.musehub.ai/aaronrene/overseer-kit), then Muse FF → muse-bridge → squash merge. ISR-a + ISR-b on main. land-b closeout same day. | | K10 Honesty module | Auto | DONE | L2 honesty-status + ledger {append,verify,show} + role gates + fixture pack + seven-tier tests (340 green); SPEC §5 updated | | K11 API/CI freeze provider | Auto | DONE | Headless provider: api HTTP client (/health, /review) + OVERSEER_REVIEW_API_KEY/OVERSEER_REVIEW_API_URL + GitHub Actions example + templates/ci/ vendored workflow; seven-tier K11 tests (361 green) | | K12 / Track N | Thinking → Auto | DONE | Public landing, scenario gallery, GitHub→MuseHub funnel, MIT LICENSE (amended from Apache-2.0), SECURITY.md; tools/landing/ validator; seven-tier K12 tests (380 total green) |

Vision baton: docs/archive/thinking/OVERSEER-KIT-LAYERED-HONESTY-VISION.md (expanded)
K9a contract: docs/archive/phases/PHASE-K9A-L1-L2-MODULE-FREEZE.md
Consumer pattern: docs/CONSUMER-ADAPTER-PATTERN.md
Handover UX debt: LT compact landed; ISR-b Auto + second-chat BV pass (ISR-b-BV-r1); remaining backlog ideas below

Exploration backlog (ideas — NOT queued; each needs its own Thinking freeze before it becomes a phase)

These are captured so they are not lost. None are committed scope. Each must pass a P0-style Thinking freeze (and clear the "governance, not runtime" boundary) before entering the build queue.

Dogfood integrity gate (mandatory — not optional)

When vcs.regime is muse+git-mirror or muse-only, overseer status --exit-code must report substrate.ok: true before any phase on this repo is marked DONE. Hollow .muse/ (config flip without K7 D2 muse init) is the exact Muse↔Git inversion failure mode this kit exists to catch. Remediation: muse init --force . (Tier 1).

Regime capability tiers (git-only baseline → MuseHub-enhanced)

The kit is fully usable on GitHub alone; MuseHub is an optional substrate that unlocks deeper capability. Same commands, same governance — more power when the canonical history is Muse.

Frozen guardrail (K7 design principle): No core governance feature may ever be MuseHub-only. Every baseline capability (init/sync/status, drift, footprint digest, templates, policy, freeze review, governance-sync) must remain fully functional on git-only. MuseHub may deepen a capability (realign, mirror, provenance/version enrichment) but never gate the baseline. This keeps the GitHub-only promise credible and makes the MuseHub value proposition about superior depth, not withheld function. The VCS adapter interface (spec §4) enforces this seam: git-only implements realign/mirror as reporting no-ops; muse+git-mirror implements them for real; the CLI calls the same method names in both regimes.

Reference repos (consumers, not owners)

Definition of Done (every phase)

• Deliverables match docs/OVERSEER-KIT-SPEC.md
• Required seven-tier tests green locally
• No secrets committed
• Both docs/ROADMAP.md and docs/OVERSEER-HANDOVER.md updated together

Cross-references

• docs/OVERSEER-KIT-SPEC.md — frozen architecture
• docs/archive/phases/PHASE-K4-VENDORING-CLI-CONTRACT.md — frozen K4 CLI contract (K4a); K4b builds against it
• docs/archive/phases/PHASE-K5-FREEZE-REVIEWER-CONTRACT.md — frozen K5 reviewer contract (K5a); K5b builds against it
• docs/archive/phases/PHASE-K6-PILOT-INSTALL-MATRIX.md — frozen K6 pilot install matrix (K6a); K6b builds against it
• docs/archive/phases/PHASE-K7-MUSE-GIT-MIRROR-DOGFOOD.md — frozen K7 dogfood design (K7a); K7b builds against it
• docs/archive/phases/PHASE-K8-MULTI-LANE-DOCS-CONTRACT.md — frozen K8 multi-lane docs (K8a); K8b builds against it
• docs/archive/phases/PHASE-K9A-L1-L2-MODULE-FREEZE.md — K9a L1+L2 module freeze (K9a-r9 → pass); K9b/K10 build against it
• docs/archive/phases/PHASE-K12-TRACK-N-LANDING-CONTRACT.md — K12 Track N landing freeze (K12 build against it)
• docs/archive/phases/PHASE-LANDING-ACCESS-CLARITY.md — Public landing + console access UX freeze (reviewed → pass, LAC-r2); Landing + access clarity Auto builds against it
• docs/landing/HOSTING.md — custom domain / static hosting honesty (overseerkit.com)
• docs/archive/phases/PHASE-KH1-HANDOVER-RELAY-STANDARD.md — KH1 handover relay standard (Thinking freeze; D4 shape checklist)
• docs/archive/phases/PHASE-TRACK-P-P0-AGENT-PROVENANCE.md — Track P / P0 agent-provenance freeze (reviewed → pass); P1 built against it
• docs/archive/phases/PHASE-TRACK-P-P-ROUTE-MODEL-ROUTING.md — Track P / P-route model-routing policy freeze (reviewed → pass, P-route-r2); the P-route Auto build builds against it
• docs/archive/phases/PHASE-TRACK-P-P-COST-AWARENESS.md — Track P / P-cost cost-awareness surface freeze (reviewed → pass, P-cost-r2, stamp sha256:9f26678…); the P-cost Auto build builds against it
• docs/archive/phases/PHASE-TRACK-P-P-EVIDENCE.md — Track P / P-evidence verification-evidence capture freeze (reviewed → pass, P-evidence-r3, stamp sha256:c1b9fb3…); the P-evidence Auto build builds against it
• docs/archive/phases/PHASE-TRACK-P-P-DEPLOY.md — Track P / P-deploy deployment-gate freeze (reviewed → pass, P-deploy-r3, stamp sha256:a9fe1cd9…); the P-deploy Auto build builds against it
• docs/archive/phases/PHASE-HOSTED-GOVERNANCE-DASHBOARD.md — Hosted governance dashboard freeze (reviewed → pass, HGD-r3, stamp sha256:af8419e1…) + Auto build DONE (BV pass, HGD-BV-r1)
• docs/archive/phases/PHASE-Q3-RELEASE-DESKTOP-INSTALLERS.md — Q3-release desktop installers freeze (reviewed → pass, QR-r3, stamp sha256:91d39951…); Auto build builds against it
• docs/HOSTED-GOVERNANCE-DASHBOARD-OPERATOR-RUNBOOK.md — Hosted dashboard operator runbook (read-only credentials, TLS, CORS, K7)
• docs/archive/phases/PHASE-TRACK-Q-Q0-OVERSEER-APP.md — Track Q / Q0 Overseer App freeze (reviewed → pass, Q0-r2, stamp sha256:3c3f6229…); Q1 built against it
• docs/archive/phases/PHASE-TRACK-Q-Q2A-OK-CLI-ENTRYPOINT.md — Track Q / Q2a OK CLI entrypoint freeze (reviewed → pass, Q2a-r2); Q2b builds against it
• docs/archive/phases/PHASE-TRACK-Q-Q4A-UI-REDESIGN.md — Track Q / Q4a Path B UI redesign freeze (reviewed → pass, Q4a-r2); Q4b built against it (BV pass, Q4b-BV-r1)
• docs/archive/phases/PHASE-TRACK-O-O0-NORMIE-CUSTODY-FUNNEL.md — Track O / O0 Normie custody funnel freeze (reviewed → pass, O0-r3, stamp sha256:642076c9…); O1 built product contracts against it
• docs/archive/phases/PHASE-TRACK-O-O2-STAGE3-UPGRADE-CEREMONY.md — Track O / O2 Stage 3 kit upgrade ceremony freeze (reviewed → pass, O2-r3, stamp sha256:ac970077…); O3 builds ok upgrade-regime against it
• docs/TRACK-O-NORMIE-CUSTODY-PRODUCT-CONTRACT.md — Track O / O1 normative product contract (Stages 1–4 + boundary/rejection; Stage 3 points at O2 + ok upgrade-regime; one-click until §O2.6)
• docs/TRACK-O-STAGE3-UPGRADE-OPERATOR-RUNBOOK.md — Track O / O3 operator runbook for ok upgrade-regime
• docs/consumers/scooling/OVERSEER-SETUP.md — Scooling public boundary stub (detailed pilot in archive; Track O)
• docs/consumers/knowtation/OVERSEER-SETUP.md — Knowtation Stage 4 public stub (no live init; detailed pilot in archive)
• docs/README.md — Public docs index
• docs/archive/README.md — Maintainer archive map
• docs/archive/phases/PHASE-KH2-MUSE-SYNC-HARD-GATE.md — KH2 Muse-sync hard gate freeze (reviewed → pass, KH2-r2) + Auto build, both DONE
• docs/archive/phases/PHASE-KH3-FOOTPRINT-INTEGRITY-HARD-GATE.md — KH3 footprint self-integrity hard gate freeze (reviewed → pass, KH3-r2) + Auto build, both DONE
• docs/CONSUMER-ADAPTER-PATTERN.md — consumer plug-in pattern
• docs/consumers/ — per-consumer reference adapters (not kit architecture)
• templates/ + policy/ + cursor/ — vendored footprint (K3)
• docs/archive/phases/PHASE-9A-5-GOVERNANCE-HYGIENE-AGENT-OUTLINE.md — first agent tool
• docs/archive/phases/MULTI-REPO-WORKSPACE-LANES-FREEZE.md — K13a multi-repo workspace / constellation lanes freeze (reviewed → pass, K13a-r3, stamp sha256:df3d2754…, incl. §MR.6.5 board filenames); K13b builds against it
• docs/archive/phases/PHASE-GFG-GOVERNANCE-FRESHNESS-GATE.md — GFG governance freshness gate freeze (reviewed → pass, GFG-r3, stamp sha256:fe8a3a15…); GFG-b builds against it
• docs/archive/phases/PHASE-PLS-POST-LAND-MAIN-SYNC.md — PLS post-land main sync freeze (reviewed → pass, PLS-r4, stamp sha256:7a31fb2b…); PLS-b builds against it
• docs/archive/phases/PHASE-ONS-OPERATOR-NEXT-SURFACING.md — ONS operator NEXT surfacing freeze (reviewed → pass, ONS-r2, stamp sha256:242e318f…); ONS-b builds against it
• docs/archive/phases/PHASE-LT-LOOP-TIGHTENING.md — LT loop tightening freeze (reviewed → pass, LT-r2, stamp sha256:6a5aafb5…); LT-b builds against it
• docs/archive/phases/PHASE-ISR-INDEPENDENT-SECOND-REVIEWER.md — Independent second reviewer freeze (reviewed → pass, ISR-r4, stamp sha256:e6284150…); ISR-b builds against it
• docs/archive/phases/PHASE-GSB-GOVERNANCE-SYNC-BRANCH-COLLISION.md — GSB dated-branch collision freeze (reviewed → pass, GSB-r3, stamp sha256:30cfb999…); GSB-b builds against it
• Scooling docs/archive/phases/PHASE-9A-MULTI-AGENT-OVERSEER-ROUTER-OUTLINE.md — runtime org-chart reference

Next step at a glance

No unambiguous NEXT row — operator authorship required.