Codex Lead Engineer
71 lines
3.1 KiB
Markdown
71 lines
3.1 KiB
Markdown
# WP-PA-002 — Project Bus Operationalisation
|
|
|
|
Status: `ISSUED`
|
|
Project: Epimonos Sandbox
|
|
Issued by: Sandbox PM
|
|
Coordinated by: PA
|
|
Implementer: Codex (`IMPLEMENTER`)
|
|
Independent reviewer: Claude Code (`REVIEWER`)
|
|
Predecessor: WP-PA-001, accepted at commit
|
|
`a2229bc26902e79d63a368e8ab002ebefd4f0863`
|
|
|
|
## Objective
|
|
|
|
Bring the accepted Project Bus MVP into controlled operational use for the
|
|
Sandbox project without yet declaring it the primary project interface.
|
|
|
|
## Scope
|
|
|
|
- a repeatable, idempotent Sandbox project bootstrap;
|
|
- explicit actor/role provisioning without credentials in Git;
|
|
- a hardened single-node Compose deployment profile;
|
|
- health, authenticated smoke, backup and restore verification;
|
|
- client connection guidance and durable cursor ownership;
|
|
- an activation, rollback and incident runbook;
|
|
- evidence for an independent implementation and security review.
|
|
|
|
The Project Bus remains a separate generic component and repository. This work
|
|
package does not change the Generic Sandbox API, Sandbox Manager Core, Incus
|
|
provider, Open WebUI integration, private Epimonos implementation, or the
|
|
canonical Sandbox documentation baseline.
|
|
|
|
## Acceptance criteria
|
|
|
|
1. A fresh instance can be deployed from the repository with no secret values
|
|
committed.
|
|
2. The Sandbox project and its formal actors can be provisioned repeatedly
|
|
without duplicate state or conflicting idempotency keys.
|
|
3. Each configured actor is authenticated by transport-derived identity and
|
|
can read the project using its own credential.
|
|
4. The operational smoke test checks health, MCP initialization, project
|
|
membership, event synchronization, and role-filtered pending actions.
|
|
5. A live SQLite backup can be made, integrity checked, restored into an
|
|
isolated instance, and compared with the source event cursor.
|
|
6. The runbook defines activation, rollback, token revocation/rotation,
|
|
cursor recovery, backup, restore and incident handling.
|
|
7. SG, PTO and existing project threads remain the formal channels until
|
|
Claude has independently approved the exact implementation commit and the
|
|
PM has closed the activation gate with `ACCEPT`.
|
|
8. No internet-facing deployment, purchase, or new long-lived infrastructure
|
|
is created without the existing PM-to-PO consultation rule.
|
|
9. The implementation and its evidence receive an independent Claude Code
|
|
review; the implementer does not self-review or close the gate.
|
|
|
|
## Required evidence
|
|
|
|
- exact implementation commit SHA and clean worktree;
|
|
- source and packaged-install test results under Python 3.12;
|
|
- container build and non-root runtime proof;
|
|
- fresh bootstrap plus idempotent replay transcript;
|
|
- per-actor authenticated smoke transcript;
|
|
- backup/restore/integrity transcript;
|
|
- secret scan and repository diff;
|
|
- independent review report with `APPROVE`, `CHANGES_REQUESTED`, or `REJECT`.
|
|
|
|
## Activation gate
|
|
|
|
The PM may declare the Project Bus the primary Sandbox project interface only
|
|
after all acceptance criteria pass and an independent review has returned
|
|
`APPROVE`. Until then, bus records are shadow records and SG/PTO/project
|
|
threads remain authoritative.
|