Written 2026-08-15. Six lanes. Each has a brief in this directory. Start a session by pointing it at its brief; the brief is written to be self-sufficient.
2026-08-16 — a second set exists: `agents/SITES.md`, lanes G–N, covering the domain
index.htmls. It touches no A–F file. Two things in it bind every lane here too: half the domains live in `/home/travis/Projects/`, not this tree, and four names exist in both with only one copy live. SeeSITES.md§0.1 for the byte-count check that settles which.
`docs/` is the stackdocs aggregation site and anything put there is swept into the atlas build. That is why these live in
agents/at the root instead.
All your sessions share `/home/travis/ProjectAmp2`. There are no worktrees. Two agents editing the same file is not merge conflict — it is one silently overwriting the other, and it has cost real work before.
So the lanes are partitioned by file ownership, and the ownership is the contract. Every brief opens with what it owns and what it must not touch. If a lane needs a file another lane owns, it says so and stops rather than reaching across.
Do not run all six at once. Three or four is the realistic ceiling on one tree.
| Lane | Owns | Ready? |
|---|---|---|
| A — Shell wiring | RRABBIT/m2/, RRABBIT/test/ | ⚠️ only if no other session is in `m2/` |
| B — studbook | studbook/ | ❌ blocked on two [TRAVIS] rulings |
| C — Infrastructure | no repo files; cloud accounts | ❌ needs you present — spend and credentials |
| D — Worker / auth / control plane | worker/, incl. `worker/migrations/` | ⚠️ schema + RLS + token tests unblocked 2026-08-21; cloud integration still on C |
| E — Site | computedriven.com/ (nav moved to lane N, 2026-08-16) | ✅ now |
| F — Docs reconciliation | root *.md | ✅ now |
| O — Cloud site | cloud.computedriven.com/ (new, 2026-08-21) | ✅ now — static; its claims read from status.json |
Start today: D, E, F and O. D's local half needs no cloud account at all — a local Postgres and a locally generated keypair carry the schema, the tenant-isolation battery and token verification.
2026-08-21 — lanes D and O both touch the Cloud v1 round and must not be run in one session. D owns the Worker and the schema; O owns the marketing/status surface. The seam between them is
cloud.computedriven.com/status.json, which O owns and D only reads. If a capability's rung changes, D reports it and O edits the file — never both.
A is the highest-value build work and the only question is whether the tracks/reel session is still live. Check git log --oneline -3 in RRABBIT/ — if the newest commit is a4ea112 ("Somewhere to put a track…"), that was this session and the lane is free.
None of these is a task. Each is a decision only you make.
studbook §10.5 — does the identity ladder admit a `track-` prefix? A track records a *live OS
world*, not a sealed sem- world. The code already uses track- and marks it provisional; if the answer is no, that constant changes and every id changes with it. Blocks B, and makes anything published before it disposable.
The index question (CONFIDENTIALITY.md §4) — the operator-visible graph: accept it,
minimise it, or encrypt it. Recommendation is minimise (ids, sizes, edges; no names, no paths). Blocks B's schema.
The threat model (CONFIDENTIALITY.md §1) — which of T1–T7 are in scope. Everything in
class B (private data) is downstream. Blocks B's crypto, not its index.
Spend approval for Hetzner, Fly, PlanetScale, Cloudflare R2. Blocks C.
Amended 2026-08-21: it no longer blocks all of D. D's local half — schema, RLS, tenant batteries, JWT verification against a generated keypair — runs with no account. Only the integration half waits on spend.
The enterprise tier price. ~$438/month carries 65% on 10 TB; the product is dedicated
infrastructure, not gigabytes. Blocks E's pricing copy. Corrected 2026-08-16 — this said ~$236, which carries 35%. $153.45 ÷ $236 = 65.02%, i.e. COGS÷price, the inverse of margin.
`STACK_COMPLETION.md` §0/§6 re-rating — the ruling changed an input those ratings read as
strength. Blocks nothing; it is just wrong until you do it.
Every brief repeats the ones it needs, but the whole set:
Cloudflare for everything; Fly for Keycloak alone. Workers are V8 isolates and cannot run
Java — the mirror of Firecracker being unable to boot FreeBSD.
Hetzner for the VM. T&R and Pigsty both need a real machine.
PlanetScale PS-5 HA ($15/mo) for Keycloak's database. Not Fly Managed Postgres ($38).
R2 for bulk objects — zero egress is what makes the restore claim true.
Compute moves into the OS. The ten Fly apps are being wound down, but **nothing is torn down
before its OS-side replacement is live_local.**
T&R backs up the user's machine, 10 GB–10 TB. Not just the shell's graph.
Confidentiality is four questions. Published needs none (v0); enterprise is isolation;
private-single-user is client-side keys; shared-private is deferred.
Convergent encryption is refused by name — it restores the confirmation-of-a-file attack.
Added 2026-08-21 — the Cloud v1 rulings (R7–R16, `REVISION_REGISTER.md`):
No server-hosted BEAM in Cloud v1. The control plane is Workers, reaching Pigsty over
Hyperdrive → Workers VPC → Cloudflare Tunnel. Super stays Elixir/OTP on the user's machine.
The R2 credential minter survives and is now the API surface. Bulk bytes go client ↔ R2
directly; a Worker in the byte path is a design error, not an optimisation.
PlanetScale is Keycloak's database and nothing else — for failure isolation, not for price.
Keycloak `sub` is not an identity. It is a binding to one, in principal_identities.
Three world sizes, three names: WORLD (the machine, 10 GB–10 TB) · WORLD VERSION (a manifest
root in R2) · WRL GRAPH (the small semantic layer inside it). Never one current_head.
World sync + restore ships before hosted compute. M2, not M5.
Driver/Fleet/Factory do not include a VM. Hosted capacity is a separate metered SKU.
RLS raises on missing tenant context. An empty result set is not a refusal.
CLAUDE.md (repo instructions, corrected 2026-08-15) → REVISION_REGISTER.md (what is still stale) → then the lane's brief.
Do not trust an undated planning doc. This tree had CLAUDE.md teaching an architecture abandoned sixteen days earlier, and a rung table that was wrong one day after it was measured.
From DOCTRINE.md, which is entrenched and which Travis alone ratifies:
A check outranks an opinion. If a command settles it, run the command.
Do not fabricate counts, statuses or provenance. ? is an acceptable answer.
Name the gap. Say what is not built, in the same breath as what is.
Measure before you claim, and say how.
Retract out loud, by name, in the same place the claim was made.
Some decisions are Travis's. Flag and stop.
Commit so work survives; verify so it is worth surviving.
Every report ends with a DOCTRINE: section saying which of advanced / contradicted / proposed / none applies. `none` is common and correct — do not manufacture a finding.