Phase Track O / O2 — Stage 3 kit upgrade ceremony freeze (Thinking)

Status: Reviewed → pass (O2-r3). O2 Thinking is spec-only and now frozen; no ceremony code, no signup UI, no live consumer ok init, and no Tier-3 merge land in this phase. Closes the §O0.3.3 deferral: defines the kit ceremony for muse-only → muse+git-mirror. The Track O / O3 Auto build ({step}b) is cleared to implement ok upgrade-regime as scoped in §O2.7. Do not re-derive this contract during the Auto build. Products unlock Stage 3 one-click only after §O2.6.

phase: TRACK-O-O2
outputs:
- id: track-o-o2-stage3-upgrade-ceremony
  path: docs/archive/phases/PHASE-TRACK-O-O2-STAGE3-UPGRADE-CEREMONY.md
  frozen: true
frozen_inputs:
- id: track-o-o0-funnel
  path: docs/archive/phases/PHASE-TRACK-O-O0-NORMIE-CUSTODY-FUNNEL.md
- id: track-o-o1-product-contract
  path: docs/TRACK-O-NORMIE-CUSTODY-PRODUCT-CONTRACT.md
- id: k7-dogfood-guardrail
  path: docs/archive/phases/PHASE-K7-MUSE-GIT-MIRROR-DOGFOOD.md
- id: k7-operator-runbook
  path: docs/K7-DOGFOOD-OPERATOR-RUNBOOK.md
- id: k4-vendoring-cli
  path: docs/archive/phases/PHASE-K4-VENDORING-CLI-CONTRACT.md
- id: kit-spec-regimes
  path: docs/OVERSEER-KIT-SPEC.md#4
- id: kit-spec-cli
  path: docs/OVERSEER-KIT-SPEC.md#5
- id: freeze-ceremony
  path: docs/OVERSEER-KIT-SPEC.md#6
- id: kit-boundary
  path: AGENTS.md
- id: test-tiers
  path: policy/test-tiers.yaml
- id: decision-tiers
  path: policy/tiers.yaml
- id: roadmap-track-o-rows
  path: docs/ROADMAP.md
review_stamp:
  reviewed_at: '2026-07-13T23:02:47Z'
  verdict: pass
  reviewer_mode: agent
  reviewer_model: thinking-high
  reviewer_provider: local
  kit_version: 0.1.0
  artifact_digest: sha256:ac970077edfe6ce01f98e25d06b8d49af0d13841149079981638b11171a661c0

Downstream edge: Track O / O3 (Auto) treats this document as ground truth without re-deriving it (SPEC §6). Product Stage 3 one-click in Scooling/Knowtation (or other entry products) may wrap the ceremony only after §O2.6 unlock criteria are met. This freeze does not authorize signup UI, live consumer installs, or Tier-3 merges.

Review record (§6.2): every freeze-review finding MUST cite file+line per SPEC §6; uncited findings are invalid and are discarded. Fixes during the loop are Tier 1 (feature branch); merge to main is Tier 3 and is never part of this loop.

§O2.0 — Simple summary

Someone who started with Muse-only custody can later add GitHub backup. That change is not a one-line config tweak: the tree must gain the full mirror setup (Git fields + bridge files) and must publish through the safe bridge (isolated mirror → muse-mirror PR), never by pushing main. This freeze defines that upgrade ceremony so products can later offer a one-click wrapper without inventing shortcuts.

Technical summary: freeze the ordered, fail-closed kit ceremony for the allowed transition muse-only → muse+git-mirror (O0 §O0.3.1 / §O0.3.3). The ceremony composes existing K4/K6/K7 surfaces: complete config write (no silent vcs.regime-only edit), footprint re-seed via ok sync / ok init --migrate with explicit --force rules, bridge dry-run gates (SD-14), and Tier-3 stop before merge to main. O3 Auto implements against this contract; products unlock Stage 3 UX only after O3 build-verification pass.

Recommendation: stamp this freeze → queue Track O / O3 Auto for the kit ceremony surface

• seven-tier harness; keep product one-click and live consumer init out of O2/O3 kit Auto green.

§O2.1 — Scope

In scope (freeze only — this phase writes no production ceremony code):

• Ceremony identity vs O0 deferral, K7 dogfood, and operator runbooks (§O2.2).
• Ordered ceremony steps C0–C8 for muse-only → muse+git-mirror (§O2.3).
• Config write + footprint re-seed + --migrate / --force interaction (§O2.4).
• Bridge dry-run gates and live-bridge boundaries (§O2.5).
• Product UX unlock criteria (§O2.6).
• O3 Auto deliverables (§O2.7).
• Explicit non-goals / rejection table (§O2.8).
• Seven-tier matrix O3 must satisfy (§O2.9).
• Hard stops + tier linkage (§O2.10).
• Thinking DoD + close-out (§O2.11).

Out of scope (explicit — prevent creep):

• Any Auto implementation of the ceremony in this Thinking session.
• Signup UI, OAuth, account APIs, or marketplace plugins in overseer-kit.
• Live consumer ok init on Scooling, Knowtation, or any named production tree.
• Adapter rewrite or a fourth VCS regime.
• git-only → muse+git-mirror ceremony (allowed transition in O0, but not Stage 3; needs its own later freeze if productized).
• Auto-merge of muse-mirror → main, git push canonical main, or muse bridge git-export --git-dir ..
• Making MuseHub, Scooling, Knowtation, Cursor, or Track Q mandatory for baseline kit use.
• Tier-3 merge, staging push, or live capability flips authorized by this freeze.
• Storing GitHub tokens, vault bytes, or Knowtation credentials inside the kit.

§O2.2 — Identity (frozen)

Frozen one-liner: O2 freezes how a muse-only personal space becomes muse+git-mirror without silent config drift; it does not ship the button and does not merge to main.

§O2.3 — Ceremony steps (frozen order)

Work on a feature branch / personal working tree. Steps marked Tier-3 never run inside product one-click without separate operator authorization.

Invariant: never muse bridge git-export --git-dir . (or any path equal to the development checkout). Never git push <remote> <main_branch>.

§O2.4 — Config + migrate / force interaction (frozen)

§O2.4.1 — Silent edit (forbidden)

§O2.4.2 — Required post-upgrade VCS shape (minimum)

Names/booleans only (no secrets):

vcs:
  regime: muse+git-mirror
  canonical: muse
  git:
    remote: origin          # or existing remote name preserved from pre-upgrade when present
    main_branch: main       # preserve existing main_branch name when present
    mirror_branch: muse-mirror
    feature_branch_pattern: "feat/{slug}"  # preserve when present
  muse:
    staging_remote: staging # required name; operational push may defer (K7 precedent)
    main_branch: main       # preserve existing muse main_branch when present
    working_dir: null       # preserve existing working_dir when set

Living-doc paths: preserve pre-upgrade docs.* values. Do not replace a working muse-only doc layout with greenfield default_config_dict("muse+git-mirror") filenames (those defaults point at different templates than many muse-only trees).

§O2.4.3 — Footprint re-seed composition

§O2.4.4 — --force rules (frozen)

§O2.5 — Bridge dry-run gates (frozen)

C5 must prove the following without live export. Gates compose K7 §K7.3.3 invariants.

Live C7 may proceed only after G1–G8 pass and C6 consent. C7 failure must not leave config rolled back automatically in O3 unless the Auto freeze-review of implementation adds an explicit transaction story — default frozen rule: config+footprint from C2–C4 may remain (tree is valid muse+git-mirror); live bridge can be retried. Do not half-revert to muse-only without a separate documented downgrade freeze (out of scope).

§O2.6 — Product UX unlock criteria (frozen)

Products (Scooling, Knowtation, others) may ship Stage 3 one-click / wizard wrap only when all of the following are true:

1. This O2 artifact is freeze-reviewed → pass with non-empty review_stamp.
2. Track O / O3 Auto is build-verified → pass against this freeze (seven tiers green).
3. The product wraps only ok upgrade-regime (flags per §O2.7) — it does not invent a parallel path that edits vcs.regime alone or skips G1–G8.
4. Product one-click includes C6 explicit consent before any live bridge (C7).
5. Product one-click never auto-performs C8 (merge to main).
6. Product still obeys O0 rejection table (no MuseHub-only baseline; no push-to-main shortcut).

Until (1)–(2) hold, products may only describe Stage 3 as coming soon / operator-assisted (O0 §O0.3.3 / O1 contract).

Operator today (unchanged): may follow K6/K7-style runbooks with explicit consent on a feature branch — that is operator dogfood, not product unlock.

§O2.7 — O3 Auto deliverables (frozen)

After this freeze is stamped pass, Track O / O3 may ship only:

1. Kit ceremony orchestrator (required): thin CLI subcommand ok upgrade-regime with frozen flags:
   • --from muse-only --to muse+git-mirror (only supported pair in O3; other pairs refuse)
   • --dry-run (default for product wrappers until explicit live) runs C0–C5 + G1–G8 report; no live export
   • --apply performs C2–C4 writes (and C5 gates); still no C7 unless --live-bridge is also set
   • --live-bridge requires prior/apply success + C6 consent channel (-y / --yes only after gates pass; refuse --yes alone without gate success)
   • --force only for §O2.4.4 shared-asset bridge conflicts (never implies --include-preserved) Orchestrator composes existing init/sync/status + K7 script invariants — not an adapter rewrite and not a fourth regime. A docs-only composition checklist without this subcommand is insufficient for O3 (silent partial upgrade risk).
2. Docs: kit-side ceremony runbook at docs/TRACK-O-STAGE3-UPGRADE-OPERATOR-RUNBOOK.md + update docs/TRACK-O-NORMIE-CUSTODY-PRODUCT-CONTRACT.md Stage 3 section to replace "deferred to Thinking O2" / "deferred to O2" shipping language with a pointer to this freeze + ok upgrade-regime, and retarget the Track O docs harness keywords in the same Auto change (keep one-click blocked until §O2.6; no redesign of Stages 1/2/4). Do not retarget the product contract in O2 Thinking alone — O1 §O0.8 harness still requires deferred markers until O3 updates validators + contract together.
3. Fixtures for muse-only → post-ceremony muse+git-mirror and incomplete-upgrade repair (tmp trees only; no live consumer).
4. Seven-tier tests per §O2.9.
5. ROADMAP + HANDOVER sync; O3 marked DONE only after /build-verification-review → pass.

O3 must not ship: signup UI, account APIs, live Scooling/Knowtation ok init, auto-merge to main, or git-only → muse+git-mirror productization.

§O2.8 — Rejection table (frozen)

§O2.9 — Seven-tier test matrix (O3 Auto must satisfy)

Skipping a tier is forbidden. Tests use tmp fixtures / injected runners only — no live Muse export against real consumer working trees in Auto-green.

§O2.10 — Hard stops + tier linkage (frozen)

This freeze does not itself authorize Tier-3 actions. Consuming it for merge/staging/live still requires separate operator authorization (SPEC §6.4).

§O2.11 — Definition of Done (Thinking) + close-out

O2 Thinking DoD:

• [x] This document reviewed → pass via /freeze-review-loop + ok review --freeze
• [x] frozen: true + non-empty review_stamp filled by the CLI
• [x] ROADMAP Track O / O2 → DONE (Thinking); Track O / O3 Auto row queued against this contract
• [x] Handover NEXT flips to O3 with valid Model: Auto + paste-ready fence (KH1 H7/H8)
• [x] No ceremony implementation code landed in the Thinking phase
• [x] No Tier-3 merge performed as part of freeze

Close-out sequence (execute only when O2 freeze marked DONE):

1. Freeze-review pass recorded; stamp written by ok review --freeze.
2. ROADMAP: Track O / O2 → DONE; add Track O / O3 (Auto, TODO) ceremony build.
3. Exploration backlog Track O row: note O2 freeze DONE; O3 Auto queued.
4. Handover NEXT → Track O / O3 Auto with paste-ready prompt.
5. Governance sync: docs/ROADMAP.md + docs/OVERSEER-HANDOVER.md updated together (SD-17).

Cross-references

• docs/archive/phases/PHASE-TRACK-O-O0-NORMIE-CUSTODY-FUNNEL.md — §O0.3.3 deferral closed by this freeze
• docs/TRACK-O-NORMIE-CUSTODY-PRODUCT-CONTRACT.md — Stage 3 remains blocked until §O2.6
• docs/archive/phases/PHASE-K7-MUSE-GIT-MIRROR-DOGFOOD.md — footprint membership + S1–S13 + K7.3.4
• docs/K7-DOGFOOD-OPERATOR-RUNBOOK.md — operator dogfood (not product unlock)
• docs/archive/phases/PHASE-K4-VENDORING-CLI-CONTRACT.md — init/sync/--force refuse semantics
• docs/OVERSEER-KIT-SPEC.md §4–§6
• AGENTS.md — SD-14
• docs/ROADMAP.md — Track O rows
• policy/test-tiers.yaml / policy/tiers.yaml