WP-PA-002 — Project Bus Operationalisation

Status: ISSUED
Project: Epimonos Sandbox
Issued by: Sandbox PM
Coordinated by: PA
Implementer: Codex (IMPLEMENTER)
Independent reviewer: Claude Code (REVIEWER)
Predecessor: WP-PA-001, accepted at commit a2229bc26902e79d63a368e8ab002ebefd4f0863

Objective

Bring the accepted Project Bus MVP into controlled operational use for the Sandbox project without yet declaring it the primary project interface.

Scope

a repeatable, idempotent Sandbox project bootstrap;
explicit actor/role provisioning without credentials in Git;
a hardened single-node Compose deployment profile;
health, authenticated smoke, backup and restore verification;
client connection guidance and durable cursor ownership;
an activation, rollback and incident runbook;
evidence for an independent implementation and security review.

The Project Bus remains a separate generic component and repository. This work package does not change the Generic Sandbox API, Sandbox Manager Core, Incus provider, Open WebUI integration, private Epimonos implementation, or the canonical Sandbox documentation baseline.

Acceptance criteria

A fresh instance can be deployed from the repository with no secret values committed.
The Sandbox project and its formal actors can be provisioned repeatedly without duplicate state or conflicting idempotency keys.
Each configured actor is authenticated by transport-derived identity and can read the project using its own credential.
The operational smoke test checks health, MCP initialization, project membership, event synchronization, and role-filtered pending actions.
A live SQLite backup can be made, integrity checked, restored into an isolated instance, and compared with the source event cursor.
The runbook defines activation, rollback, token revocation/rotation, cursor recovery, backup, restore and incident handling.
SG, PTO and existing project threads remain the formal channels until Claude has independently approved the exact implementation commit and the PM has closed the activation gate with ACCEPT.
No internet-facing deployment, purchase, or new long-lived infrastructure is created without the existing PM-to-PO consultation rule.
The implementation and its evidence receive an independent Claude Code review; the implementer does not self-review or close the gate.

Required evidence

exact implementation commit SHA and clean worktree;
source and packaged-install test results under Python 3.12;
container build and non-root runtime proof;
fresh bootstrap plus idempotent replay transcript;
per-actor authenticated smoke transcript;
backup/restore/integrity transcript;
secret scan and repository diff;
independent review report with APPROVE, CHANGES_REQUESTED, or REJECT.

Activation gate

The PM may declare the Project Bus the primary Sandbox project interface only after all acceptance criteria pass and an independent review has returned APPROVE. Until then, bus records are shadow records and SG/PTO/project threads remain authoritative.

3.1 KiB Raw Blame History