roadmap-status.md

Roadmap Status

Claim class: Current truth for roadmap horizon, milestone, and track status.

Owns: Which workstreams are complete, in progress, or pending, and their next gates.

Does not own: Daily-user command recommendations (daily-driver-current-status.md) or historical review reasoning in dated analysis files.

Last reviewed: 2026-09-17 (roadmaps/progress/intents review; test-leak into the repo run index fixed; ADR-0043 register reconciled with the owner G14 disposition; no horizon, priority, or gate changes)

Last updated: 2026-09-09 (Socratic roadmap/intent panel, 7 lenses, record reviews/roadmap-intent-socratic-2026-09-09.md; owner adopted all 10 ledger items. Corrections landed: G1/G3/G4/G5/G6 rows restated from Complete/Pending to their evidenced state; ADR-0031 criterion 1 restated as unexercised, not clean — scripts/prepare_h4_evidence.py now reports a reachability denominator and a verdict, and for the 2026-08-13→2026-09-11 window it returns unexercised with 0 observed / 0 reachable runs; across all recorded history only 4 of 415 runs ever reached an H4 surface at all, because .teaagent/runs/runs-index.jsonl holds just 6 distinct synthetic benchmark/smoke prompts and zero organic owner tasks, so 0 observed carries no information about false-positive rate; criterion 2 passes vacuously (0 workspace policies, 0 roles, 0 declarations); promotion_ready is a hardcoded literal in teaagent/governance/h4_decision_packet.py, not an evaluated metric; criterion 4 remains human sign-off. Promotion on 2026-09-12 is arithmetically unreachable — only extend (valid only with a dated dogfood session booked) or revert. Synthetic demo receipts are now stamped provenance='synthetic-demo' and excluded from candidates, so the "demo synthetic ≠ C1" rule is code-enforced rather than prose-only. EFX-001–003 remain In Progress with live-provider proof pending. The owner-operator remains the target persona; active operational validation is unevidenced in the run store. Per harness-first §4.2 raw suite counts are not quality claims; DR-006 gate citation is now enforced by scripts/check_dr006_gate_trailer.py, and non-goal surfaces are quarantined under ADR-0043)

Review 2026-09-12 (ADR-0031 expiry day): decision window closed 2026-09-11 with verdict unexercised (0 observed / 0 reachable, re-verified today); no dogfood session booked, zero new runs (latest run 2026-08-31) and zero new friction entries — promotion unreachable, decision is the owner's today (extend-with-booked-session or revert). Falsifier-1 now mechanical via check_dr006_gate_trailer.py: 8 post-DR-006 feat commits touching teaagent/, 1 cites a gate (87d1c61); retrospective only, the gate landed 2026-09-09. DR-006 falsifier window closes 2026-09-22. No horizon or milestone status moved by this review. Update 2026-09-12 (goals-review instruments): the 5-lens goals Socratic panel (record .teaagent/reviews/goals-socratic-2026-09-12/synthesis-record.md, gitignored) ruled the goal set directionally right but badly measured; owner approved the instrument items. Landed: scripts/prepare_g1_evidence.py (G1 denominator+verdict, unexercised today), G2 one-screen acceptance test, G6 untyped classification + --fail-on untyped ratchet (458 untyped), G5 corpus-cost section in the aging dashboard, and origin on run_started/runs-index (B-08; TEAAGENT_RUN_ORIGIN or run_started_extra, default unknown). Goal-text items (B-05/B-07/B-10), deletions (B-06/B-09), and B-11 remain owner-gated. Update 2026-09-13 (agentflow v8.2.0 survey delta + AGF-001 implementation + gated-items panel): re-surveyed agfnow/agentflow at fcb6878 (v8.2.0); AGF-001 teaagent skill audit landed under owner "implement governance gaps" direction; AGF-002 verified already present. A 5-lens Socratic panel re-verified every owner gate (record .teaagent/reviews/gated-items-2026-09-13/synthesis-record.md, gitignored): all gates hold; corrections landed — EFX exit-evidence narrowed to the falsifiable residual (one real provider mutation observed to behave as classified), workflow_engine importer sweep recorded complete (0 production callers), DR-006 falsifier retrospective prepared (10 post-DR-006 feats, 3 gate-cited, 0 violations post-mechanization; F2–F4 unexercised). ADR-0031 is actively decaying: criterion 1 is unreachable at zero organic traffic, so "no decision" produces the permanent-shadow anti-pattern the ADR forbids — highest-value owner ask is booking one M4 dogfood session. Ungated lane found: G6 untyped ratchet (458→0). No horizon, milestone, goal, or EFX status moved. Update 2026-09-13 (vendor direction survey): surveyed OpenAI (Agents API, managed cloud agents, 3.1 agent-workdays/human-day internally), Anthropic (Trustworthy Agents framework — harness as security boundary, Plan Mode oversight, prompt-injection defense-in-depth), and DeepMind (AI Control Roadmap — insider-threat framing, supervisor monitoring, coverage/recall/response-time metrics, 1M coding-agent trajectories analyzed). Conclusion: vendor convergence validates harness-first; the one substantive gap is live monitoring → VND-001 (Proposed), plus VND-002 threat-model docs addition (Proposed) and VND-003 autonomy metrics (On Hold — zero organic runs). Record .teaagent/reviews/vendor-directions-2026-09-13/survey-record.md (gitignored). No status moved. Update 2026-09-13 (G6 untyped ratchet zeroed): all 458 untyped test files classified via # test-type: markers (12-agent parallel pass; 455 behavior / 82 contract / 39 adversarial / 31 lifecycle totals); UNTYPED_BASELINE lowered 458→0 — the CI --fail-on untyped gate is now absolute. G6 stays Partial: 71 construction-only / 5 high-risk files remain (assertion-strengthening lane, not typing). No other status moved. Update 2026-09-13 (G6 P0 flags cleared): strengthened all 5 P0-tier flagged test files — test_audit.py (14 construction-only + 1 permanently-skipped placeholder → real RecursionError test), test_managed_runtime_audit.py, and 3 security acceptance flows (read-only gate, vote relay, approval manager). high_risk_files: 0; construction_only residual is now 66 files, all lower-tier. test_verify_valid_chain renamed test_verify_chain_detects_tampered_hashes — the old name claimed validity while the fixture used dummy hashes. Update 2026-09-13 (G6 construction-only residual cleared + stale contract fixed): 9-agent parallel pass strengthened all 66 remaining construction_only files — every assert verified against probed runtime behavior; several tests were asserting wrong behavior and were corrected (e.g. test_production_warnings_are_strings was vacuous on this platform; test_cli_with_special_characters_in_api_key asserted success where a NUL byte forces exit 1). Also fixed a pre-existing failure: test_m1_audit_stream_matches_frozen_contract was red on clean tree — the origin field (B-08, landed 338de3a8) was missing from the golden contract; updated. construction_only_files: 0, high_risk_files: 0, placeholder_files: 0. G6 → Met. Update 2026-09-13 (G6 zero-flag): 9-agent parallel pass fixed all 36 remaining flagged files — 33 no_assertions (call-and-pray tests now assert probed outcomes), 2 assert_true (one was dead code in an unreachable branch; one masked a real TypeError), 2 undocumented_skip (positional skip message → reason= keyword). Several tests were exercising nothing real and were corrected (e.g. test_n4_git_transaction_sink_records_file_writes never created a commit — no file changes meant 'nothing to commit'). Audit is fully clean: zero flags of any kind. Review 2026-09-14 (hygiene + overdue-decision flag): re-ran the §3.5 starts-now lane — prepare_h4_evidence.py still unexercised (0 observed / 0 reachable / 5732 total events); test_efx* 15/15 pass. Found and fixed a date-bomb: test_h4_shadow_demo.py + scripts/exercise_h4_shadow_demo.py hardcoded until='2026-09-11' (the ADR-0031 window close), so the demo's own events fell outside the window and synthetic_excluded read 0 — test went red on 2026-09-12. Both now use until=date.today() (791eb1bc). Friction-log evidence attached to the 3 open hypotheses (d7308906); closure itself is owner-only per scripts/validate_docs_consistency.py. ADR-0031 owner decision is now 2 days overdue (review date 2026-09-12); the permanent-shadow decay the gated-items panel flagged is active. No horizon or milestone status moved by this review. Update 2026-09-14 (VND-002 insider-threat docs): owner authorized the docs-only VND-002 item via the "implement tasks" direction; added the insider-threat/agent-misalignment class to docs/threat-model.md — a new threat-table row plus a dedicated section citing DeepMind's AI Control insider-threat framing and the ~1M-trajectory finding that most flagged events are misinterpretation/overeagerness, not adversarial intent. VND-002 → Complete. VND-001 (live supervisor) and VND-003 (autonomy metrics) remain owner-gated. No other status moved. Update 2026-09-14 (ADR-0031 extension + VND-001 authorization): owner decided ADR-0031 → extend with a booked co-maintainer dogfood session (not revert). The extension is conditioned on the session being scheduled — a new decision-window close is set when the session date lands, so the shadow does not decay open-ended; promotion_ready stays false and criterion-1 owner_verdict remains owner-only. Owner also authorized VND-001 (live supervisor / post-run trajectory reviewer) under the governance-gap DR-006 gate; implemented as teaagent/run_review.py + teaagent runs review <run_id> (post-run reviewer; in-run monitor remains future). No horizon/milestone status moved by this record. Update 2026-09-14 (dogfood session booked): owner scheduled the co-maintainer dogfood session for 2026-09-15 (scope: background lifecycle + operator cockpit per DR-006 T4; cloud/gateway/multi-tenant held). Recorded as docs/work-log/m4-dogfood-2026-09-15.md — the dated owner-override entry gate for Horizon B and the ADR-0031 extension condition. New ADR-0031 decision-window close = 2026-09-15; after the session, agents run B2/B3 (prepare_h4_evidence.py --until 2026-09-15, build_h4_decision_packet.py, BG-001/cockpit specs) against the real audit logs. No horizon/milestone status moved by this record. Update 2026-09-15 (ADR-0031 evidence: approval surface wired + first organic events): found and fixed a wiring gap — AgentRunner in chat_agent.py was built without workspace_root, so RunnerApprovalCoordinator.workspace_root stayed None and evaluate_approval_policy_shadow early-returned before recording h4_governance_shadow; the approval surface was unreachable on the main agent run path (only subagent launches, which pass self._root, ever emitted a receipt — the 4/415). Fix 8fd7a461 passes config.root. Two dogfood runs (TEAAGENT_RUN_ORIGIN=dogfood, fake provider) then produced the first organic h4_governance_shadow events: surface=approval allowed=true enforced=false (prompt mode + workspace_write_file), and surface=subagent_launch allowed=false enforced=false — a denial candidate (RBAC start_workflow denied yet the subagent ran in shadow mode) flagged for owner adjudication, not agent verdict. prepare_h4_evidence.py regenerated: verdict unexercised → needs_review, 2 observed / 9 reachable runs / 1 denial candidate; promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (ADR-0031 evidence broadened + residual gaps): continued dogfooding produced 3 more organic approval receipts (workspace_apply_patch, workspace_run_shell_mutate, workspace_edit_at_hash — all allowed=true, provenance=null). Packet regenerated --until 2026-09-15: 5 observed / 12 reachable runs / 1 denial candidate; coverage now approval 4 (0 denials) + subagent_launch 1 (1 denial). Two residual gaps recorded for owner adjudication, not fixed: (a) empty RBAC role store — .teaagent/roles/ + .teaagent/role-assignments/ are empty, so check_action_permission returns "no role with permission start_workflow" for every subagent launch; harmless in shadow mode (check_subagent_launch_rbac returns True regardless) but if rbac_governance_mode ever flips to enforce, all subagent launches break — needs a bootstrap/default-role decision. (b) ANP adapter dead surface — teaagent/anp_adapter.py:364 builds AgentRunner without workspace_root and ANPBidirectionalAdapter has no root attribute; wiring it needs a constructor param plumbed through callers (secondary surface, out of agent run scope). promotion_ready stays false; owner_verdict untouched. No horizon/milestone status moved by this record. Update 2026-09-15 (VND-001 reviewer fix + third residual gap): dogfooded teaagent runs review on the new runs and found a coverage bug — review_run only counted tool_call_started, but a call paused at the approval gate emits tool_call_pending_approval and never reaches tool_call_started, so blocked capability requests (the exact unapproved_capability/denied_attempt signals) were invisible (tool_calls=0, coverage=0.0). Fix ec7656e3 counts tool_call_pending_approval as a call (deduped by call_id); verified tool_calls 0→1, coverage 0.0→1.0. Third residual gap recorded for owner adjudication: subagent_launch allow path is unreachable by design — assignee always falls back to parent_run_id (a fresh id per run; operator_id/agent_id are not real ChatAgentConfig fields), and get_roles_for_assignee has no wildcard/default role, so start_workflow can never be granted to a stable identity. The RBAC check is therefore structurally deny-only until a stable operator identity exists. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (approval-shadow observation bias + allow-mode run): drove an allow-mode run — the destructive call completed the full lifecycle (tool_call_requested/started/completed, file written) but emitted no h4_governance_shadow. Fourth residual gap recorded for owner adjudication: the approval shadow only observes prompt-mode runs — evaluate_approval_policy_shadow is invoked inside handle_approval_request, which only runs when can_request_approval is true (PROMPT mode + destructive). In allow/workspace-write/read-only modes the shadow never fires, so H4 evidence is systematically biased toward prompt-mode runs and blind to the modes where enforcement matters most. Whether the shadow should observe every destructive call regardless of mode is a semantic boundary (observation scope + audit volume), so recorded not fixed. Packet regenerated: 5 observed / 13 reachable runs / 1 denial candidate. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (observability + lifecycle surfaces verified): exercised the H4 control-plane/audit surfaces on the dogfood runs — all healthy. agent resume completed the pending→resume→auto-approve→complete lifecycle (auto_approved_call_id recorded; consistent with the observation-bias finding, no tool_call_approved/shadow on the auto-approve path). audit verify reports VALID hash chain on all 7 dogfood runs (zero gaps/modifications/insertions). runs export (completeness ok:true, full trace), runs replay (dry-run, tools_used), cockpit (pending_count:6, quarantine_count:28, context health green), daily (flags pending approvals), and runs list all work. origin: dogfood correctly recorded in runs-index.jsonl (B-08) — owner can cleanly filter dogfood vs organic runs. memory_write_quarantined fired correctly (provenance gate quarantined the subagent's auto-curated memory write). No new gaps; these surfaces are healthy. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (approval lifecycle completed + provenance fix): resolved all 6 pending approvals via teaagent approval approve — the canonical tool_call_pending_approval→tool_call_approved lifecycle now exercised organically on 8 runs. Found and fixed a provenance gap (2f144102): the CLI approve path recorded tool_call_approved with only call_id/tool_name — no authority_type/approved_by — so CLI-approved calls were indistinguishable from JIT-prompt approvals in the audit trail. Now records authority_type='cli_approval', approved_by='operator' (consistent with jit_prompt/auto_mode/preapproved_payload_digest); verified on a dogfood run. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (deny-preset enforcement gap — most serious finding): exercised the deny path and found a documented safety control that is advisory-only at runtime. teaagent approval deny <tool> registers a deny grant and approval check/explain correctly report decision: deny ("Matching deny grants block the tool call"), but the runtime path never blocks: assert_allowed → check_preset → is_allowed, which collapses deny and prompt both to False, so a matched deny grant is indistinguishable from "no preset" and falls through to pending_approval (prompt mode) or executes (allow mode). Verified: a scoped deny preset on workspace_run_shell_mutate did NOT block the matching call in either mode. Root cause: check_preset returns a bare bool that can't distinguish deny from no-match; _resolve_decision already exposes decision distinctly but the runtime path doesn't use it. Not fixed — enforcement change on teaagent/approval/manager.py (high-risk path) that alters when calls block; needs a risk report + owner sign-off. Test preset revoked. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (budget + plan-gate + sandbox boundaries verified): exercised the remaining governance boundaries — all enforced correctly. Budget: max_tool_calls=1 → run_failed: tool-call budget exceeded after exactly 1 call; max_iterations=1 → run_failed: iteration budget exceeded; both with actionable messages. Plan gate: run --from-plan <plan> --require-plan blocked workspace_write_file with tool_call_blocked/authority_type: policy_blocked — "Intent drift: target outside the approved plan scope" (the write target wasn't in the plan's declared files). Intent-drift enforcement works. Git sandbox: git_sandbox_started fires per run; headless runs keep the teaagent-sandbox-<run_id> branch for review and restore the tree (deliberate, not a bug) — but branches accumulate with no auto-prune (27 now; manual via doctor/experiment only), a minor housekeeping note. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (undo/rollback data-loss hazard — second serious finding): exercised teaagent undo and found a destructive edge. undo --preview diffs sandbox_branch → original_branch, but original_branch (main) has moved forward since the run, so the preview shows all later commits, not just the run's writes — misleading. Worse, GitBranchSandbox.rollback() runs git reset --hard HEAD + git clean -fd before checkout, assuming HEAD is on the sandbox branch; but after a headless run keep() already restored main, so undo on a completed run would reset --hard + clean -fd on main itself — wiping uncommitted work — then branch -D the kept review branch. Verified by code read (teaagent/sandbox/_git_branch.py:254-280) + preview behavior; not executed (would destroy the working tree). Not fixed — teaagent/sandbox/ is a high-risk path and the fix (guard rollback to only run on the sandbox branch, or scope the reset) changes destructive behavior; needs a risk report + owner sign-off. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (attach-resume provider gap): exercised agent attach <run_id> --resume on a pending run — it failed run_failed: opencodezen-go requires OPENCODEZEN_API_KEY. attach has no --provider flag and resumes with the configured default provider, not the original run's provider, so attach --resume cannot resume any non-default-provider run (it errors on credentials). agent resume <provider> <run_id> works (takes provider positionally). Recorded as a gap — the attach-resume path should inherit the run's recorded provider. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (session/background durable-continuity verified): exercised the H4 durable run-state surfaces — all healthy. session list shows per-run heartbeat + git_sandbox state + status; background list shows background-task lifecycle (pid, log, exit_code, run_id). session resume <run_id> fake resumed a pending run, auto-approved the call, and attempted it (failed only on the probe's intentional bad hash — the resume path itself is correct). origin: dogfood attributed throughout. No new gaps. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (diagnostics verified; doctor-all false-negative noted): ran the harness's own diagnostics — doctor project 9/9 security checks green (.teaagent/ mode/ownership, secret mode/content), selftest all green (audit completeness, permission smoke "read-only blocks destructive write", tool lint 0 errors). doctor all reports ok: False but only because 11/14 providers lack API keys (expected — only fake is configured); the overall ok flag counts unconfigured optional providers as failure, a false-negative signal worth noting (an operator reading ok:False can't tell "no providers configured" from "something broken"). promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (watch verified; interactive-only boundary reached): teaagent watch works — polls and reports pending=N + run status each interval. agent interactive-review requires suspension-<run_id>.json, which is only written by suspend_to_background from the interactive REPL — not reachable headless, so that surface stays unexercised (it's the one path that genuinely needs a TTY/owner session). This completes the non-interactive surface coverage: every headless-reachable governance boundary, lifecycle path, observability tool, durable-continuity surface, and self-diagnostic has now been exercised. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (interactive-review exercised — full surface coverage): drove agent interactive-review by writing a suspension-<run_id>.json in the suspend_to_background format plus a tracked change — the review header, changed-file list, per-file diff, and the y/e/r/n/q action loop all work (probe artifacts cleaned up). This completes surface coverage: every governance boundary, lifecycle path, observability tool, durable-continuity surface, self-diagnostic, and the interactive review loop has now been exercised. Final tally: 3 bugs fixed (workspace_root wiring, reviewer blocked-call coverage, CLI approval provenance), 7 gaps + 1 denial candidate recorded for owner adjudication (2 safety-critical: deny presets advisory-only, undo resets main). promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (MCP server + skill audit verified): exercised the two remaining surfaces. teaagent mcp serve over stdio JSON-RPC — initialize returns teaagent with tools capability, tools/list returns 23 workspace tools, tools/call workspace_git_status executes and returns clean status (full external-agent consumption path works). teaagent skill audit (AGF-001) — 268 skills across roots, 49 name collisions, status: ok, issues: [], assessment: not_performed (semantic conflict assessment is documented as out-of-scope for the command). No new gaps. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (MCP HTTP transport + auth + trust + skill subcommands verified): exercised the remaining MCP and skill surfaces. mcp serve --http — initialize over HTTP returns server info; --auth-token enforced correctly (valid Bearer token accepted, wrong/missing token → unauthorized). mcp trust list/audit — empty policy (allowed_tools: [], servers: {}) and empty audit trail, both ok: true. skill explain — 20 loaded skills, ~44k est. tokens, 11 shadowed; skill search/marketplace-list — empty registries ([]). No new gaps. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (full CLI surface sweep — all command groups probed): swept every top-level command group for clean function or clean error. Working: status, daily, health, recall, yesterday, cost report, goal list, tool list/lint, artifact list, workspace tools/openapi, plugin list, replay list, experiment list, cloud list, permission explain, guidance, cockpit, recipes list, surfaces explain, gateway list, metrics, classify, memory list, audit list, model providers, consensus status, approval list/pending, code-ontology query, journal, preflight (clarification scoring + context pack), sync status. Clean-arg-required or expected-empty: env verify (no lockfile → compliant:false), sandbox check wasm (runtime not installed → actionable message), credentials rotate, control-plane serve, ci review, artifact read, code-ontology build, mcp trust allow/deny/revoke (mutation path, not exercised — writes policy). No crashes, no tracebacks on any reachable surface. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (mutation paths exercised; trust-key silent-discard footgun): exercised the write surfaces. mcp trust allow/deny/list/audit — with a consistent TEAAGENT_MCP_TRUST_KEY, allow+deny persist correctly; footgun: a wrong/missing key silently discards the policy — deny under a different key read the encrypted policy as empty (couldn't decrypt) and overwrote it, resetting allowed to [] with no error (a config mistake silently wipes trust grants). memory add/list/show/maintain/quarantine list — all work (maintain --dry-run reports 3 duplicates, 20 quarantined, 27 stale). audit verify <run_id> — hash chain VALID, timestamp ordering verified; audit export — 10 events exported. credentials rotate --dry-run — correct next-steps output. code-ontology build — 15,462 nodes / 98,905 edges. env provision — clean error (teaagent.toml not found). New gap recorded: trust-policy decryption failure should error, not silently reset. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (approval mutations exercised; strict preset is a no-op — bug): exercised the approval write surface. grant/revoke/deny/check/explain/audit/doctor/next/subagents list/why-denied all work — grant creates a session grant, check evaluates it (decision: allow), revoke removes it; deny correctly requires path_glob/command_prefix (rejects bare deny with an actionable message). Bug: approval preset strict is a no-op — it skips the deny grants because they lack path_glob/command_prefix, so grants_applied: [] and grants stays empty; the "deny all destructive tools" preset applies nothing (the preset's own deny entries violate the deny-scope requirement). preset dev-safe works (4 grants applied). All test grants revoked after probing. New gap recorded: strict preset self-inconsistent. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (run-lifecycle + multi-agent surfaces exercised): swept the remaining command groups. runs list/show/trace/export/replay/review/commit — all work on a real run; runs review correctly flagged the probe's df-edit-1 as unapproved_capability (high) — the reviewer working as intended. replay steps — full event-step list; audit show/tail/prune — hash-chained events, tail, prune (0 deleted). agent status <run_id> — full run state. sync export — message exported (sequence_number: 4); consensus request/history — clean "no active peers" / 0 proposals. cloud show/goal status/artifact read — clean not-found/empty. journal — writes daily file. No crashes. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (agent subcommand tree exercised): swept the full agent surface. agent card — AgentCard with 23 tools + capabilities; agent show <run_id> — hash-chained JSONL; agent plan — produces a plan artifact + ready: True (writes .teaagent/plans/<ts>-<task>.md); agent daily/preflight — readiness + clarification scoring; agent subagent-review list — empty (reviews: []); agent automation list/status/template repo-watch --dry-run — empty registry + full automation spec. All agent subcommands now exercised (run/attach/resume/interactive-review/status/runs/undo covered earlier). No crashes. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (automation lifecycle exercised — durable H4 surface): exercised the full agent automation write path. add creates an automation (enabled: true, next_run_at scheduled, provenance_digest set); list/show reflect it; pause/resume toggle enabled; tick reports health (automation_count/due_count/enabled_count); run spawns a background task (background_started, pid, log_path — the task exited cleanly, exit: 0); delete removes it. The durable-automation lifecycle works end-to-end. Test automation deleted after probing. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (final subcommand sweep — entire CLI surface exercised): swept the last untested subcommands. clarify/completion/model smoke/conformance/route/capabilities/sandbox route/graphqlite smoke/query/cloud submit/cancel/capabilities/env lock/recipes run --print-only/ci review --print-only/memory search/failures/decisions/team/skill candidate list/mcp trust inspect/experiment compare/select/cancel/replay fork/resume/sync import/consensus peers/config — all work or error cleanly. experiment cancel cleaned up all orphaned teaagent-sandbox-* branches (resolving the accumulation noted earlier — 0 remain). sandbox monitor needs Docker (clean error, not installed). model conformance fake reports ok:false (fake provider returns non-'ok' content — expected for the stub). No crashes. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (agent chat REPL exercised — last surface): drove agent chat over piped stdin — the REPL starts (TeaAgent TUI 0.1.0), accepts help (full command list), status, session list (returns saved sessions), and exit (clean quit). The interactive chat surface works headless-driven. This completes coverage: every CLI command, subcommand, and interactive surface has now been exercised. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (tui confirmed = chat REPL; coverage complete): ran teaagent tui under a pseudo-TTY — it is the same TeaAgent TUI 0.1.0 REPL as agent chat (same banner, prompt, help/exit), already exercised. This confirms complete coverage: every CLI command, subcommand, interactive surface, MCP transport (stdio + HTTP with auth), and write path has been exercised across the 2026-09-15 session. Final tally: 3 bugs fixed (workspace_root wiring, reviewer blocked-call coverage, CLI approval provenance), 9 gaps + 1 denial candidate recorded for owner adjudication (2 safety-critical: deny presets advisory-only, undo resets main; plus empty RBAC store, unreachable allow path, prompt-mode observation bias, ANP dead surface, attach-resume provider gap, trust-key silent-discard, strict preset no-op). promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (chat REPL internal commands exercised — deepest coverage): drove the agent chat REPL's internal command set over piped stdin — all work: complexity/estimate/route (task analysis), permission (mode switch reflected in prompt), session new/show/list/switch/clear (session lifecycle), provider/model/route-model/destructive/progress/stream/subagent/heartbeat (toggles + setters), doctor (graphqlite check). The interactive surface is fully functional headless-driven. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (chat ask — task run inside the REPL): drove ask <task> inside agent chat — runs a task in-REPL, prints the run summary (tools called, files changed, cost, budget remaining, audit log path, undo command). The fake provider returns a canned response without tool calls (expected for the stub). This is the deepest path — a full agent run nested inside the interactive REPL. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (remaining chat REPL commands — full REPL coverage): exercised the last chat commands — root (set workspace root), progress <run_id> (rich progress: phase, last tool, elapsed, iteration, budget), status <run_id> (full run state), chat on/off (session toggle), session clear/switch (session management). Every agent chat REPL command is now exercised. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (agent run flag surface exercised): swept the agent run flag set — all work: --dry-run (preflight JSON, no run), --clarify, --no-validate, --skip-plan-check, --no-benchmark, --no-progress, --no-summary, --human (readable summary), --json, --stream, --telemetry-console (emits telemetry), --code-analysis, --heartbeat, --max-subagent-depth, --validation-profile, --context-profile, --memory-limit, --no-auto-skills, --skill-index-only, --tenant-id, --route-model, --model. Every agent run flag is now exercised. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (remaining run flags; sandbox-branch leak + approve-call-id deprecation): swept the rest of agent run's flags — --from-plan, --parallel (spawns experiment branches), --approach, --subagent, --git-sandbox, --git-sandbox-auto-stash, --hitl-approval, --approve-scoped, --allow-destructive, --telemetry-otlp-endpoint, --telemetry-service-name, --checkpoint-store, --stream-raw, --json-stream, --skill, --require-plan all work. Two findings: (1) a headless agent run left HEAD on a teaagent-sandbox-* branch — the sandbox didn't restore main on completion (same family as the undo hazard; cleaned up manually). (2) --approve-call-id is deprecated and ignored — "removed for security (call ids are not stable)" — but still accepted; a stale flag silently does nothing. --parallel 2 spawned approach-1/approach-2 branches (cleaned via experiment cancel). promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (H4 evidence: dogfooding produced organic shadow events): ran prepare_h4_evidence.py --since 2026-08-13 --until 2026-09-15 against the real audit logs — the day's dogfooding generated organic h4_governance_shadow events: observed_events: 9 (8 approval + 1 subagent_launch), reachable_runs: 21, total_events: 7779, synthetic_excluded: 0, verdict needs_review (up from unexercised / 0 observed). This is the B2 organic evidence the M4 dogfood plan calls for — the surfaces now have real coverage data for owner adjudication. promotion_ready stays false (owner verdict still required per ADR-0031 exit criterion 1). No horizon/milestone status moved by this record. Update 2026-09-15 (H4 decision packet built — 4/5 criteria prepared): ran build_h4_decision_packet.py — the ADR-0031 shadow→enforce review packet is now assembled with real evidence: criterion 1 (zero-false-positive window) prepared (9 observed receipts, 1 denial candidate), criterion 2 (coverage completeness) prepared (0 gaps), criterion 3 (performance SLO) prepared (median 0.489ms < 50ms threshold over 25 policies), criterion 5 (rollback plan) prepared (dry-run succeeded). Only criterion 4 (human sign-off) is human_required — owner/security-governance sign-off cannot be agent-generated. promotion_ready: false correctly. The B2 evidence packet is complete; the decision is the owner's. No horizon/milestone status moved by this record. Update 2026-09-15 (BG-001 orphan path exercised — §3.3 gap confirmed live): dogfooded the background lifecycle per background-lifecycle-acceptance-spec-2026-07-11.md §5.2 — submitted a background run (--background), watched it complete cleanly (alive:false, exit_code:0, stopped_at set, run_id backfilled — the §3.1 identity chain works). Then submitted a second run and SIGKILLed its pid: background list showed alive:false, exit_code:0, stopped_at — no orphaned marker, and the §6 exit-code fallback (_refresh_process_state defaults a reaped/unkillable exit to 0) made the SIGKILLed process indistinguishable from a clean exit. Confirmed §3.3 orphan derivation is not implemented (background_run.py never emits orphaned); the spec's documented exit-code-fallback risk materialized live. BG-001 acceptance item 1 (§3.3 + §3.5 taxonomy) remains open — a feat: code change needing owner approval + DR-006 gate, not a dogfooding step. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (cockpit exercised — pending-approval count inconsistency): dogfooded teaagent cockpit per operator-cockpit-acceptance-spec-2026-07-11.md §3.1 — the snapshot answers Q2 (approval), Q3 (cost), Q4 (memory quarantine: 33), Q5 (stale_workspace), Q6 (skill); goal/model_route/review/spec are null, honest for an idle cockpit. Finding: the two pending-approval surfaces disagree — control.approval.pending_count scans limit=100 runs and reports 3, but pending_approvals.queue_depth uses default limit=20 and reports 0 (the 3 pending runs are older than the 20 most recent); --human reads queue_depth and shows pending approvals: 0. An operator reading the queue or --human sees zero pending while 3 real approvals wait — a same-fact inconsistency across cockpit surfaces (SURF-009 parity gap). promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (cross-surface parity check — approval pending/next also under-report): followed the cockpit finding across the dedicated approval surfaces — teaagent approval pending returns queue_depth: 0 / pending: [] and teaagent approval next returns "No pending approvals found", both using the same limit=20 window that misses the 3 real pending approvals (in runs older than the 20 most recent). So the primary surface for "what awaits my approval" (approval pending/next) is wrong, not just the cockpit — an operator checking pending approvals via the dedicated command sees zero while 3 wait. The limit=20 default in collect_pending_approval_views/build_pending_approvals_snapshot is the shared root cause across cockpit queue, approval pending, and approval next. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (dogfooding consolidated — adjudication-ready findings list): agent-side dogfooding is complete — every CLI command, subcommand, interactive surface, MCP transport (stdio + HTTP + auth), write path, background lifecycle, and cockpit surface exercised headless; the only unexercised surface is the owner-driven TUI session (m4-dogfood-2026-09-15.md). Consolidated the ~30 scattered findings into a single prioritized adjudication list docs/work-log/dogfood-findings-2026-09-15.md: 3 bugs fixed (workspace_root wiring, reviewer blocked-call coverage, CLI approval provenance), 5 safety-critical gaps (deny presets advisory-only, undo resets main, sandbox-branch leak, BG-001 orphan gap, pending-approval parity), 33 other gaps (incl. audit-integrity: git_sandbox_resolved/session_suspended events orphaned to stale pending-*.jsonl temp files), 1 denial candidate, plus the complete B2 H4 evidence (9 organic events, 4/5 packet criteria prepared). Remaining work is owner adjudication + the owner TUI session — no agent-side dogfooding surface remains. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (pending-approval lifecycle gap — no reject/cancel path): investigated the 3 pending approvals surfaced by the parity check — they are live run_paused runs (df-edit-1, df-deny-1, df-deny-2, my own dogfood probes) genuinely awaiting a decision. Finding: there is no operator path to reject or cancel a pending approval — approval offers only approve (which would execute the destructive probe call); runs and agent expose no reject/cancel/abort. An operator who wants to decline a pending destructive call has no surface — the only options are approve (run it) or leave it pending forever. A missing lifecycle transition (the deny/reject half of the approval decision). Recorded as a gap for owner adjudication — adding a reject path is a feat: change needing owner approval + DR-006. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (pending-approval durability asymmetry — no expiry on main path): followed the reject-path gap into the durability question — do run_paused pending approvals ever expire? Finding: the subagent approval queue auto-times-out (pending_request_timeout_seconds: 3600, auto_timeout_pending_requests: true), but the main tool_call_pending_approval/run_paused path has no expiry — pending_approval_for_run clears a pending entry only on tool_call_approved/tool_call_denied/run_completed/run_failed, so a paused run that never resumes stays pending forever. Combined with G15 (no reject path), a declined-but-unactionable approval lingers indefinitely — the two approval surfaces have inconsistent durability semantics (subagent: 1h TTL; main: none). Recorded as a gap for owner adjudication. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (G15 refined — deny mechanism exists, only the CLI surface is missing): traced tool_call_denied — it is emitted (teaagent/runner/_approval_manager.py:134) when approval_handler returns False (interactive decline), and pending_approval_for_run clears on it. So the deny lifecycle (emit + clear) is fully built; what's missing is only a CLI command to deny a queued/headless pending approval — approval exposes approve but no deny/reject for an already-paused run. This narrows G15 from "missing lifecycle transition" to "missing CLI surface for an existing mechanism" — a smaller, well-scoped feat: (a approval deny <call_id>/reject that records tool_call_denied for a paused run). Still owner-gated (approval path + DR-006). promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (pending-approval escape paths exhausted — airtight): tested the last theoretical escape for a stuck pending approval — agent undo on a paused run. undo --preview <paused_run_id> returns (no undo diff available) and undo --last reports no undo journal found — paused runs have no undo journal, so undo can't even target them. This closes the loop: a pending approval on a paused run can be approved (executes the call), or left pending forever — it cannot be rejected (G15), expired (G16), or undone. The approval-lifecycle gap cluster is airtight; the only resolution is the missing approval deny/reject CLI surface. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (TUI cockpit tabs unreachable — dead code): tried to exercise the TUI cockpit tab surface (WORKFLOWS/APPROVALS/COSTS/MEMORY/BACKGROUND) — finding: CockpitScreenRenderer, CockpitDataManager, and CockpitTab are defined in teaagent/tui/cockpit_screens.py/cockpit_data_sources.py and re-exported from teaagent.tui, but nothing instantiates them — no TUI command, keybinding, or render path reaches the tabbed screens. core.py refreshes build_control_cockpit data (_control_cockpit) but never renders the tabbed UI. So the TUI cockpit tab surface is dead code / unreachable — the spec's §3.1 "TUI tabs" half of the cockpit acceptance can't be exercised because the screens aren't wired in. Recorded as a gap for owner adjudication (wiring the tabs is a feat: needing owner approval + DR-006). promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (dead-code gate blind spot — TUI excluded): ran the repo's own check_dead_code.py (vulture) to corroborate G17 — vulture confirms the TUI cockpit is dead (CockpitDataManager, create_cockpit_renderer, render_screen, and all get_* methods flagged unused at 60% confidence). Second finding: check_dead_code.py runs vulture teaagent/ --exclude teaagent/tui/ — it excludes the TUI directory entirely, so the dead-code gate has a blind spot exactly where this dead code lives (the cockpit screens would never be flagged even if vulture ran in CI). Also: check_dead_code.py isn't in .pre-commit-config.yaml and vulture isn't installed by default — the gate is opt-in and currently a no-op. Recorded as a gap for owner adjudication. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (TUI cockpit renders correctly + approvals semantic conflation): rendered the dead TUI cockpit screens directly via CockpitDataManager + create_cockpit_renderer — all 5 tabs render correctly (WORKFLOWS/APPROVALS/COSTS/MEMORY/BACKGROUND), so the dead code is functional, just unwired (refines G17: works, unreachable). New finding: the APPROVALS tab shows "Pending Approvals (21 total)" but counts memory-quarantine entries (review_state in [pending, quarantined] from the memory catalog), not tool_call_pending_approval queue entries (3 real). Same label "Pending Approvals", different meaning — a semantic conflation across cockpit surfaces: the TUI tab would show 21 memory-quarantine rows while the real tool-call approval queue holds 3. An operator reading the TUI APPROVALS tab sees memory-review items labeled as approvals. Recorded as a gap for owner adjudication. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (TUI WORKFLOWS tab conflation — runs labeled active workflows): inspected the WORKFLOWS tab data — "Active Workflows (20 total)" lists run_ids with status='completed' (from RunStore.list_runs), so it shows runs (not workflows) and completed (not active). Same conflation pattern as G19 (APPROVALS shows memory-quarantine as approvals): the TUI cockpit tab labels don't match what they display — "Active Workflows" = all recent runs regardless of status, "Pending Approvals" = memory-quarantine entries. If the TUI cockpit were wired (G17), its tabs would systematically mislabel their contents. Recorded as a gap for owner adjudication. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (TUI cockpit tab audit — conflation scoped to WORKFLOWS/COSTS/APPROVALS): audited all 5 TUI cockpit tabs for the mislabeling pattern — COSTS shares the run→workflow conflation (workflow_id = run_id, same root cause as G20); MEMORY is accurate (shows the 20 non-quarantined registry entries, zero overlap with the 20 quarantined — quarantined=False correct); BACKGROUND is accurate (0 runs). So the conflation is systemic across WORKFLOWS/COSTS/APPROVALS (all label run/memory data as workflow/approval) but MEMORY/BACKGROUND are correct — refines G19/G20 scope: the cockpit's data-source layer conflates domain concepts in 3 of 5 tabs. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (control-plane exercised — third approval source, JIT in-memory): exercised teaagent control-plane serve — dashboard HTML, /api/health, /api/tenants, and SSE streams (/api/workflow/stream, /api/focus/stream, /api/jit/diff) all respond. Finding: /api/jit/diff pending comes from jit_server.get_pending_requests() — an in-memory JIT approval server, a third approval source distinct from the tool_call_pending_approval audit events. So there are now three approval surfaces with three different sources: cockpit queue_depth (audit, limit=20), approval pending/next (audit, limit=20), and control-plane JIT (in-memory, separate lifecycle) — none agreeing, and the JIT surface can't see the 3 audit-pending approvals at all (different store). Recorded as a gap for owner adjudication — the approval queue has no single source of truth. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (adjudication triage prepared): external-advisor review of the full roadmap confirmed the agent lane is exhausted — every remaining item is owner-gated (booked TUI session, G1–G5 adjudication, ADR-0031 verdict + D1 classification, G6–G38 gate assignment, EFX live proof). Advisor flagged two contradictions worth owner attention: the H4 packet reads "4/5 prepared" but G1/G2 make enforce-promotion unsafe, and "Daily Cockpit Parity" is marked Complete while G17–G20 show the TUI cockpit tabs are dead code that mislabels their data. Prepared the owner-adjudication triage table in docs/work-log/dogfood-findings-2026-09-15.md — proposed DR-006 provenance per gap (20 governance-gap, 1 legacy-competitive, 1 owner-override, D1 owner verdict) so adjudication is a sign-off, not an analysis session. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (agent PTY evidence only — B1 still pending): an agent-driven TUI session ran under a real pseudo-TTY (transcript .teaagent/tui-dogfood-2026-09-15-pty.txt; run 9d2f7db87eaf4089b1f739088027126a). Exercised help, permission, daily, session list, approvals pending, ask, exit — all functional — but with the fake provider: 0 tool calls, 0 files changed, 0 new shadow receipts. This is partial evidence, not B1: B1 requires real coding with owner-observed testimony. Two residual failures recorded in docs/work-log/m4-dogfood-2026-09-15.md: the TUI launch crash (fixed in 8babc313) and an open show last REPL exit (unhandled exception kills the REPL, code 1). prepare_h4_evidence.py --until 2026-09-15 unchanged: 9 observed / 21 reachable. Packet 4/5 prepared; criterion 4 human_required — the owner session and sign-off plus D1 classification remain owner-only. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (G1–G22 implemented, re-dogfooded; show last fixed): owner-adjudicated fixes landed in 1611e71b (G1–G10, G15–G18, G21, G22; G14 quarantined; G11–G13 untouched per owner). Re-dogfood: approval check returns deny in default AND allow mode (G1 live); preset strict applies 2 wildcard deny grants (G6 live); an auto-stash dogfood run lands git_sandbox_resolved in the real run .jsonl with HEAD on main (G22 live); 154 pending-*.jsonl temps are pre-fix orphans, none new. The open show last REPL exit is now fixed (_cmd_show catches FileNotFoundError, prints error: run '<id>' not found, stays in REPL) with regression test tests/tui/test_tui_show_unknown_run.py. H4 still 9 observed / 21 reachable — fake-provider re-dogfood proves fixes, not new coverage. ADR-0031 close 2026-09-29. promotion_ready stays false. No horizon/milestone status moved by this record. Update 2026-09-15 (G7/G8 enforce proof; TUI guard single-guarded): the G7/G8 allow path is now proven in both modes: TEAAGENT_H4_RBAC_MODE=enforce denies a role-less assignee (False, "no role with permission start_workflow") and allows the seeded default-operator via the operator role — the exact false-positive/true-positive pair criterion 1 needs, reproducible on demand. The TUI show last fix was promoted to a single handle_command guard covering dispatch + cockpit refresh (with logger.exception); _cmd_show narrows to (FileNotFoundError, OSError); the guard regression test now uses the sibling constructor form. Re-verified: H4 still 9 observed / 21 reachable, DR-006 trailer check passes on 1611e71b, verify_docs.sh green. The remaining lane is unchanged and owner-only: B1 owner session, ADR-0031 sign-off + D1 (close 2026-09-29), EFX live proof. promotion_ready stays false. No horizon/milestone status moved by this record. Erratum 2026-09-15 (probe artifact polluted H4 count, corrected): the G7/G8 enforce proof was first run with RunStore('.'), which wrote a 2-event probe-enforce-reject-check.jsonl into the repo runs dir and inflated prepare_h4_evidence.py to 11 observed / 22 reachable. Artifact deleted; evidence is back to 9 / 21 (needs_review). The enforce allow/deny pair was re-proven in a throwaway /tmp workspace — zero repo audit writes — and stands: enforce denies role-less assignee, allows seeded operator. Lesson: verification probes must use scratch workspaces, never the repo runs dir. Erratum 2026-09-15 (H4 count includes an orphan-sourced receipt — corrected reading): of the 9 observed receipts, 8 approval events live in real run .jsonl files, but the 1 subagent_launch receipt (the D1 denial candidate) lives only in pending-1061f13779524cb9b8763a9a2d130e7d.jsonl — a G22-class orphan temp whose parent run b15ffcfb… (which launched the 20b0978c… child subagent) completed without it. All 9 carry no provenance marker, and _is_synthetic_payload treats missing provenance as organic (teaagent/governance/h4_evidence.py:190-196), so the orphan counts as observed. Honest reading: 8 in-log receipts + 1 orphan-sourced D1 candidate, not "9 organic". The orphan is preserved (deleting it would destroy D1 evidence); criterion 1 must be read as 8 + 1-orphan, and the owner D1 verdict should note the receipt's provenance gap. synthetic_excluded: 0 is a filter output, not a cleanliness claim. (Parent id corrected 2026-09-15 per Socratic panel: receipt run_id is b15ffcfb…, not the child.) Correction 2026-09-15 (DR-006 "2026-09-22" is not an authority date): the "falsifier window closes 2026-09-22" phrasing in roadmap/backlog prose (this doc line 15, backlog-priority.md:20, reviews/roadmap-intent-socratic-2026-09-09.md:11) is roadmap-invented — DR-006 itself (strategy/dr-006-owner-decision-2026-06-22.md:63) defines the falsifiers as a 3-month standing tripwire with no close date, and the 09-22 arithmetic (3 months from 06-22) appears only in plans/horizon-a-close-evidence-loop-2026-09-12.md:38 as a calendar review trigger ("~2026-09-22"), not an expiry of enforcement. Falsifier-1 (mechanical Gate: check) remains in force past 09-22; what the horizon-A plan schedules for ~09-22 is a review of the falsifier evidence, not a lapse of authority. Prose corrected here; the two other mentions stay as historical record of the misreading. Correction 2026-09-15 ("no new friction entries" was imprecise): the friction log is not dormant — 5/5 owner entries (F2/F3/F6/F7/F8) are closed, and agent verification evidence was added 2026-09-14 on open hypotheses: approval --selector N closes call-id hunting (work-log/operator-friction-log.md:199), the run-id guard verified live with pinning tests (:217), and doctor config provenance verified live with pinning tests (:246). Precise state: no new owner-written entries since 2026-06-22; agent verification evidence added 2026-09-14; closure on the open hypotheses awaits owner validation. Prior "no new entries / dormancy" phrasing understated the agent verification work.

Review recorded 2026-09-16 (roadmap rethink; proposals only): Decision rationale and proposed plan preserves the evidence, corrected G34/G37 interpretations, G1–G22 owner dispositions, proposed triage for all G23–G38 findings, workflow acceptance criteria, and unchanged H4/EFX/quarantine gates. Recommendation: reconcile current status, prioritize bounded first-run/background and existing-contract repairs, then obtain owner-observed coding evidence; do not repeat broad command sweeps or reopen held expansion. The owner requested recording, not adoption: no implementation is scheduled, no owner verdict is supplied, and no horizon/milestone status changes here. Same-day docs reconciliation applied (execution plan header/§1 date, Horizon A/B status banners, held-spec index H4 expiry rows, findings owner-only list, backlog Proposed row, H1 exit-evidence caveat); a G23–G38 triage table (9 governance-gap, 6 owner-override, 1 legacy-competitive) was added to work-log/dogfood-findings-2026-09-15.md for one-batch adjudication. The H1 status/confidence columns and every G23–G38 gate assignment remain owner calls. Update 2026-09-16 (G23–G38 adjudicated "Yes for all" and implemented): owner accepted the agent-proposed triage as written; fixes landed the same day under the cited gates (9 governance-gap: G26/G27/G28/G29/G31/G32/G33/G35/G36; 6 owner-override: G23/G24/G25/G30/G37/G38; G34 held under ADR-0043). Each finding carries a # test-type: behavior regression that failed pre-change (tests/test_dogfood_*_g*.py), and an integrated scratch journey proved the first-run path: headless init --provider fake (no prompt, gitignore: added) → committed scaffold → offline preflight ready: true → agent run fake with Safe git sandbox auto-enabled, completed, git status --porcelain empty; runs list arrays contain only runs; bare audit verify errors up front; MCP survives an unknown tools/call (-32602). Risk record reviews/dogfood-g23-g38-2026-09-16-risk.md; decisions and residuals in work-log/dogfood-findings-2026-09-15.md §"Owner decisions (2026-09-16)". H4 evidence unchanged (fake-provider probes make no governed tool calls); promotion_ready stays false; D1 still deferred; B1 owner session still pending. No horizon/milestone status moved by this record — the H1 caveat stands until an owner-observed journey (R4) lands. Update 2026-09-17 (dogfood residuals closed; full suite verified): the last agent-completable residuals landed — automation promote/status resolve unique names (promote via a quarantine-aware selector over list_quarantined(); the active-store selector could never see quarantined specs), setup --no-gitignore opt-out, NUL-byte --api-key classified before any config write, and the dead unimported cli/_handlers/agent_automation.py (596 lines of pre-fix G36/G37 code) deleted. automation.py selectors extracted to _automation_selectors.py and the six commands' identical try/except → classified-error boilerplate dedup'd into a _classified_errors decorator — module back under the god-module gate at 759 lines. ultrawork start argv-forwarding deferred by design (deprecated command). Full suite re-verified sharded: 6295 passed / 0 failed / 23 skipped. promotion_ready stays false. No horizon/milestone status moved by this record. Review 2026-09-17 (roadmaps, progress, intents): gates re-measured at HEAD 005f6049 — DR-006 falsifier 1 check_dr006_gate_trailer.py --base 3ff0fa24 exit 0 (5 post-2026-09-09 feat commits touching teaagent/, 5 cite a gate); H4 packet --since 2026-08-13 --until 2026-09-17 unchanged at 9 observed / 22 reachable / 1 candidate / needs_review; G1 unexercised (0 organic / 1216 synthetic / 322 unknown of 1538 runs). Only 11 runs landed after the dogfood close (2026-09-15T20:36 → 2026-09-16T17:45), all test leakage, not use: tests/test_tui.py::test_tui_ask_clarify_with_concrete_task_builds_spec built TeaAgentTUI without root=, so its fake-provider ask appended a real run to the repo's own .teaagent/runs index once per full-suite invocation (origin unknown, provider empty, 0 tool calls — 1,057 index rows carry that fixture prompt since 2026-05-08). Fixed in 21381c74 by isolating the test root to a tmp dir (reproduced 1538→1539, post-fix 1539→1539; probe artifact removed per the 2026-09-15 erratum precedent). No H4/G1 number moves: those rows never reached an approval surface and the prompt is already on the synthetic-fixture list — but the index will stop drifting between reviews. Docs reconciled: the owner's 2026-09-15 G14 decision ("quarantine per ADR-0043") had reached backlog-priority.md but not the ADR-0043 register — row added (register now 8 rows: 5 legacy-competitive incl. ANP, 1 M4 carve-out, 2 harness-migration). Intent envelope .teaagent/delivery/roadmap-rethink-2026-09-07/ (gitignored) remains status: unsigned / closed: false with a stale evidence ledger (suite 6681 at 66411a1; H4 2 observed / 2 candidates vs 9/22 now) — closing it is owner acceptance, not agent-updatable. Upcoming owner dates: 2026-09-22 DR-006 calendar review trigger (falsifiers F1–F4: F1 mechanical and clean, F2–F4 unexercised); 2026-09-29 ADR-0031 close — readiness checklist 0/8 signed, D1 verdict + criterion 4 sign-off + B1 owner-observed session still open; 2026-12-09 ADR-0043 quarantine disposition. Agent lane is exhausted: every remaining item is an owner verdict or an owner session. No horizon or milestone status moved by this review. Review addendum 2026-09-17 (second pass; exit codes captured directly): DR-006 F1 --base 3ff0fa24 exit 0; H4 packet exit 0 at 9 / 22 / 1 needs_review; G1 exit 0 unexercised (0 / 1216 / 322 of 1538); verify_docs.sh exit 0 — all unchanged after 21381c74–89b60bd4. Three reconciliations: (1) ANP stays out of ADR-0043's context table (adr/0043:26-32) — that table is the 2026-09-09 panel's git log --diff-filter=A sweep (it also omits consensus/ and jit_approval_server.py), so the provenance lives only in the register row: teaagent/anp_adapter.py landed 2026-05-18 (ddcd61f5), before both direction decisions, and entered quarantine via owner disposition G14 on 2026-09-15. Owner flag, not agent-resolvable: ADR-0007 still reads "Accepted and Implemented — 2026-05-22" while ADR-0043 now brands its surface legacy-competitive; G14 authorized quarantine, not an ADR rewrite. Same standing pattern as ADR-0019/0020/0021 ("Accepted and Implemented (Beta)") whose consensus/control-plane surfaces sit in the same register — resolve all four together at the 2026-12-09 disposition. (2) ADR-0041 vs ADR-0043 on domain/workflow_engine.py is posture, not a live contradiction: ADR-0041 lists it among the five domain modules and reads Phase 2 as "thin rather than vanish" (adr/0041:86,232,285-287), ADR-0043 marks it "strongest deletion candidate" but defers deletion to 2026-12-09 — a deletion at that review must also amend ADR-0041's five-module scope and retire skills/builtin/workflow-orchestration/SKILL.md. (3) Suite-count discrepancy flagged, not edited: this file's 2026-09-17 update cites 6295 passed / 23 skipped while work-log/dogfood-findings-2026-09-15.md:282 cites 6752 passed for the same day; pytest --collect-only -q tests on this tree collects 6781, so 6295 cannot be a full-suite count of this tree and 6752 is consistent with it. Neither number is re-certified here — the local environment (pytest 9.0.3, no xdist) cannot reproduce CI's --random-order -n auto --dist worksteal run; certify on the next CI-matched run. No horizon or milestone status moved. Review addendum 2026-09-17 (third pass; G17 propagation): the owner's G17 deletion (1611e71b, 2026-09-15: tui/cockpit_screens.py, tui/cockpit_data_sources.py, three test files) had not reached the docs that promise the tabs — the M4 cockpit acceptance spec (§1 TUI bullet, §3.1 Q1–Q4 "tabs", §4, §6), the held-spec index row, and the SCL-P2-001/CPP-P2-001 rows here. Reconciled with a dated amendment and row caveats; statuses unchanged (owner-directed deletion of unreachable code narrows the surface, it does not un-complete the item). Verified live: teaagent cockpit in a scratch repo returns {control, pending_approvals, schema_version, stale_workspace} with control.memory.quarantine_count present; the TUI [Control Cockpit] panel prints Memory: N entries only — so spec §3.1 Q4 has no TUI surface (data in the CLI snapshot only) — recorded for the owner's §5 walk-through, which alone determines whether the surviving panels satisfy Q1–Q4 (a panel line is feat: under DR-006, not done here). This removes the basis of the advisor's 2026-09-15 "Daily Cockpit Parity vs G17–G20" flag — the mislabeled tabs are gone and parity rests on the shared CockpitState/build_control_cockpit builders that survive — without supplying the acceptance verdict. CPP-P2-001's own acceptance ("one panel summarizes route, memory, review, skill, spec, goal, approval, and cost", plans/community-pain-points-response-plan-2026-06-05.md:48) is the surviving [Control Cockpit] panel, so its Complete needs no owner re-adjudication; SCL-P2-001 carries the caveat. No horizon or milestone status moved. Update 2026-09-17 (advisor note internalized): the 2026-08-31 external-advisor hypothesis was cited from three committed docs by a path under .omx/artifacts/ that is excluded from git (.git/info/exclude) — evidence readable on one machine only. Internalized verbatim, with the prompt snapshot and an agent-prepared disposition table (extension taken bound to the booked session; revert not triggered; EFX live proof, ADR-0031 sign-off, DR-006 owner falsifier note, B1 owner session and the Horizon C fork all still open), at reviews/external-advisor-roadmap-hypothesis-2026-08-31.md; backlog-priority.md, this file's H4 row and plans/current-roadmap-execution-plan-2026-08-26.md §6.3 now cite it. No horizon or milestone status moved.

Prior update: 2026-08-31 (advisor: H4 extend only if dogfood scheduled for organic events else revert, 0 organic ≠ promotion, demo synthetic ≠ C1; EFX promote only on live proof; M4 dogfood is the only DR-006 lane that can generate organic events/friction/BG-001. Suite observation at bf07bc8: 6681 passed, 0 failed, 26 skipped via sharded pytest -n auto --dist worksteal, 6707 collected — recorded as a historical observation only, not a quality claim, per harness-first §4.2; see suite truncation analysis)

Canonical source of truth. All other status docs (docs/security/risk-register-and-threat-model-2026-06-02.md, docs/analysis/defeat-scenarios-and-cascade-effects-2026-06-02.md, docs/analysis/active-findings-status-ledger-2026-06-06.md) defer to this document for overall completion status. Per-item test evidence lives in the risk register §9.

Direction note, 2026-06-14. Roadmap rows describe owner-operator harness work unless explicitly labeled future or aspirational. External adoption, hosted deployment, enterprise/team operations, and broad daily-driver claims are not current goals.

Purpose

Provide a single source of truth for roadmap item status, ownership, confidence, and next gates. Every roadmap item should have exactly one owner surface and status.

Scheduling Rule

As of 2026-08-26, EFX-001 through EFX-003 are the only newly known, authorized, non-held code items. They entered through DR-006's governance-gap lane after deterministic local probes reproduced ambiguous mutating-tool dispatch, effectful-tool approval bypass, and reusable argument-blind one-time approval. Runtime guards now exist on the existing runner, registry, audit, and approval seams with focused tests and providerless acceptance (tests/acceptance/test_efx_durable_effect_flow.py); live GitHub/browser/provider proof is still required before Complete. They do not authorize an effect platform, exactly-once claim, distributed outbox, fencing service, actor supervisor, or second event/workflow framework.

H0-H6 remain status taxonomy, not sprint menus. Other new work starts only from cited owner friction, an independently proved governance gap, a dated owner override, qualifying M4 co-maintainer dogfood, or the existing dated decision queue. A trigger opens evaluation outside the proved governance-gap lane; it does not create implementation authority or prove completion.

Roadmap Horizons

Horizon	Name	Target Outcome	Owner	Status	Confidence	Next Gate	Exit Evidence
H0	Claim and risk hygiene	Public claims, risk register, docs gates, and tool warnings are owned	governance	Complete	High	H1	H0 exit evidence met; all M0 checks pass
H1	Daily operator loop	Setup, daily cockpit, plan, execute, approve, verify, recover, and remember are one coherent journey	governance	Complete	High	H2	Journey acceptance tests pass across CLI/TUI baseline; acceptance tier snapshot 628 passed at 85109e4 (2026-06-10); 2026-09-16 caveat: this closure is the June implementation milestone, not current end-to-end verification — dogfood findings G23/G24/G29/G30/G31/G38 (first-run and background paths, 2026-09-15) are unadjudicated; see reviews/roadmap-rethink-2026-09-16.md §3.1
H2	Multi-surface continuity	CLI, TUI, IDE, dashboard, background, cloud, and gateway share one run-state contract	TBD	On Hold — M2 foundation complete	Medium	Owner-validated continuity need	M2 acceptance complete; full surface parity (IDE/dashboard/cloud) is external/future under harness-first
H4	Durable owner/agent operations	Long-running owner-operator and co-maintainer-agent workflows have durable run-state continuity, control-plane views, policy, audit, and cost attribution. Run continuity does not imply exactly-once tool execution, external-effect settlement, business acceptance, or reversal; ADR-0042 remains binding	TBD	On Hold — shadow wiring exists; ADR-0031 evidence packet prepared 2026-08-27, refreshed 2026-08-31 and re-verified 2026-09-12 over the closed decision window 2026-08-13→2026-09-11 (0 observed / 0 reachable, verdict unexercised); extended window 2026-08-13→2026-09-15 after the booked 2026-09-15 M4 dogfood: 8 in-log approval receipts + 1 orphan-sourced D1 subagent_launch denial candidate across 22 reachable runs (21 at dogfood close + 1 hook-fixture run; no new organic receipts), verdict needs_review, packet 4/5 prepared (criterion 4 human sign-off human_required); promotion_ready=false is a hardcoded literal, not a metric; H4 demo scripts/exercise_h4_shadow_demo.py exercisable (2 synthetic candidates, must not launder into C1) and guarded (tests/test_h4_shadow_demo.py); 2026-09-12 expiry-day state: no dogfood session booked, zero new runs and zero new friction entries since review, so promotion is unreachable — owner decided 2026-09-14: extend with a booked co-maintainer dogfood session (new window close set on booking)	Low	Dogfood session booked 2026-09-15 (background+cockpit, docs/work-log/m4-dogfood-2026-09-15.md) — new ADR-0031 window close 2026-09-15 (decision deadline 2026-09-29 per risk report — G1–G5 condition); EFX live-proof closure remains pending owner authorization	Policy/RBAC shadow-wired (WDA-002/003); EFX-001–003 runtime guards landed on existing seams with live-provider proof pending; EFX live-proof procedure docs/plans/efx-live-proof-procedure-2026-08-31.md and H4 demo scripts/exercise_h4_shadow_demo.py/tests/test_h4_shadow_demo.py ready for owner auth; generic external-effect reconciliation remains held; ADR-0029 Option D executed; ADR-0031 evidence packet at .teaagent/reviews/adr-0031/ (2026-08-27, refreshed 2026-08-31, re-verified 2026-09-12); advisor hypothesis (2026-08-31) internalized with its dated disposition at reviews/external-advisor-roadmap-hypothesis-2026-08-31.md (the original .omx/artifacts/ run artifact is local-only, not in git); 2026-09-15 M4 dogfood: ADR-0031 packet 4/5 prepared (criteria 1/2/3/5 prepared, criterion 4 human sign-off human_required), 9 observed h4_governance_shadow events (8 approval + 1 subagent_launch denial candidate) across 21 reachable runs, verdict needs_review, promotion_ready=false; 2026-09-15 window closed — next action is owner sign-off on the 4/5 packet + D1 classification by 2026-09-29 (extension conditioned on G1–G5 per risk report)
H6	Owner packaging and local distribution	Desktop/client-server and local release channels have supply-chain, update, rollback, and support plans for owner-operated use	TBD	On Hold — local proof exists; daily CLI unwired	Low	Owner update friction + trust-boundary proof	Single-platform update proof is reproducible via scripts/prove_update_platform.py; update/* remains intentionally absent from the daily CLI; no desktop packaging/session-attach proof

North-Star Goals (G1-G6)

Owner-ratified harness goals from the Harness-First Direction §2. This table owns their current honest status; the identity document keeps the ratified wording. Adoption record: whole-project lens review.

Goal	Ratified outcome	Status	Evidence / gate
G1	Daily task without consulting docs	Unmeasured — no organic evidence	Friction log 5/5 owner entries closed, but no new owner-written entries since 2026-06-22 (2026-09-14 agent verification evidence added on open hypotheses); no doc-lookup metric exists; .teaagent/runs/runs-index.jsonl records 1528 runs as of 2026-09-16 with zero origin: owner runs (1206 synthetic, 322 unknown — of which 65 are origin: dogfood; 2026-09-09 audit's 415-run/6-prompt shape superseded). Absence of friction is dormancy evidence, not ergonomics evidence. scripts/prepare_g1_evidence.py (B-01, 2026-09-12) now reports the organic/synthetic denominator plus a verdict (unexercised today) so an empty log can no longer read as success
G2	Any run explained from one artifact	Pending — surface measured in CI (owner field validation still open)	teaagent agent show <run> plus run evidence summary (tests/acceptance/test_run_evidence_summary_flow.py); one-screen acceptance asserted by test_run_receipt_answers_three_questions_within_one_screen (B-02, 2026-09-12): why-allowed/what-changed/how-undo within DEFAULT_PAGINATION_LINES (50), passing in CI (verified 2026-09-16, 12/12 in file). Owner field validation (real-run readability) still open
G3	One event spine	Partial — rescoped by owner decision	M3 plan gate moved to a typed RunEvent spine interceptor cleanly; M4 approval/budget and M5 HookRegistry enforcement were assessed unsuitable for the spine/interceptor model and stay inline by owner-reviewed evidence (docs/work-log/m4-budget-stays-inline-2026-06-13.md, docs/work-log/m5-hooks-observability-only-2026-06-13.md). The spine's realized value is the observability read side, not wholesale relocation of mutating enforcement
G4	Extensible by hooks, not forks	Partial — observability wired; enforcement bridge held	HookRegistry exists and emits typed audit events (TOOL_HOOK_PRE_MUTATION, TOOL_HOOK_POST_MUTATION, etc.) surfaced by the M2 reader; tests/acceptance/test_hook_lifecycle_flow.py passes. Pre/post tool hooks mutate in-flight args/results in teaagent/tools.py; moving enforcement to spine consumers is unsuitable (same runtime-coupling finding as M4). Six session-lifecycle hooks are defined but not wired to production callers — see m5-hooks-observability-only-2026-06-13.md
G5	Docs corpus carries its weight	Partial — corpus cost signal live + constitution cap enforced	docs/generated/docs-aging-dashboard.md ## Corpus Cost (G5 Signal) reports total/live/archive counts and per-surface costs; scripts/report_docs_aging.py runs in CI. Current corpus: 667 Markdown files, 666 in docs-inventory.md (8 constitution, 369 working, 289 archive). Constitution-tier ≤ 12 enforced by check_docs_inventory (_CONSTITUTION_MAX_DOCS = 12, pinned by test_constitution_tier_cap_enforced_at_twelve); archive-tier discipline is manual, not automated
G6	Tests prove behavior, not construction	Complete — typing complete, ratchet absolute, zero flags	608 test files (as of 2026-09-15); all 458 backlog files classified 2026-09-13 (455 behavior / 82 contract / 39 adversarial / 31 lifecycle); UNTYPED_BASELINE = 0 — --fail-on untyped in CI now fails on any new untyped file (VND-001 test file typed 2026-09-15, re-verified 0 untyped). All 71 construction_only + all 36 no_assertions/assert_true/undocumented_skip files strengthened 2026-09-13 (every assert verified against probed runtime behavior). Audit fully clean: high_risk_files: 0, medium_risk_files: 0, construction_only_files: 0, placeholder_files: 0. Raw suite counts are not a quality claim per harness-first §4.2

Roadmap-Neutral Governance-Gap Intake - Effect Authority

These items do not reopen or renumber H0-H6. Promote is the scheduling disposition under DR-006; implementation status is In Progress while focused runtime and providerless acceptance evidence exists and live-provider proof is still required for Complete.

ID	Work Item	Implementation Status	Scheduling	Confidence	Required Exit Evidence
EFX-001	Refuse blind redispatch after an unmatched mutating-tool start; surface the attempt as unconfirmed/UNKNOWN	In Progress — runner sandwich + process-death test	Promote — P0 governance-gap	High	tests/test_efx001_interrupted_dispatch.py; providerless tests/acceptance/test_efx_durable_effect_flow.py; live GitHub/browser/provider proof still required for Complete
EFX-002	Inventory effectful tools and fail closed when local policy sees external mutation, regardless of misleading read-only/destructive hints	In Progress — local external_effect + fail-closed backends	Promote — P0 governance-gap	High	tests/test_efx002_effect_classification.py; providerless tests/acceptance/test_efx_durable_effect_flow.py; live GitHub/browser/provider proof still required for Complete
EFX-003	Bind one-time approval to run, tool, canonical payload/effect intent, then consume or expire it before dispatch	In Progress — digest-bound consume-once JIT	Promote — P0 governance-gap	High	tests/test_efx003_one_time_approval.py; providerless tests/acceptance/test_efx_durable_effect_flow.py; live GitHub/browser/provider proof still required for Complete
EFX-FUTURE	Provider-specific idempotency, settlement, and reconciliation beyond ADR-0042	Absent	On Hold	Low	Local gaps closed, dated owner promise, provider-enforced identity/status contract, effect-specific fault evidence, and Human Review

EFX exit-evidence clarification (2026-09-13 gated-items panel): the providerless evidence already proves the guards — EFX-001 crash-consistency is exercised by a real os._exit(73) mid-effect, EFX-002 classification is static + tested, EFX-003 digest-binding is consume-once tested. The residual that "live-provider proof" uniquely covers is narrow and falsifiable: one real provider mutation observed to behave as classified (e.g. a GitHub create_pr call passing through the approval/effect path against a real provider), which requires owner-authorized credentials and target. The gate holds; the wording is narrowed so it cannot sit unfalsifiably forever.

Evidence and adoption status: Durable-Effect Roadmap Socratic Review. Current execution sequence (non-authoritative): Current Roadmap Execution Plan.

Roadmap-Neutral Intake - Agentflow v8.2.0 Survey Delta

Survey-derived candidates from the agentflow b2935f5→fcb6878 (v8.2.0) delta review, 2026-09-13 (record: .teaagent/reviews/agentflow-structures-2026-09-12/delta-2026-09-13-v8.2.0.md, gitignored). These do not reopen or renumber H0-H6. Proposed means documented and not accepted as implementation-ready; none is scheduled without owner approval under DR-006. Mechanisms serving existing goals (suggested-default questions → G1; qualifying-path review rule → EFX-002 conformance) are noted in the delta record, not listed as rows.

ID	Work Item	Implementation Status	Scheduling	Confidence	Required Exit Evidence
AGF-001	Cross-host skill conflict audit: extend skill explain (or add skill audit --inventory) to enumerate foreign skill roots and Codex/Claude plugin caches read-only, plus a once-per-conflict semantic warning protocol (quote both clauses, name consequence, state which instruction wins)	Complete — teaagent skill audit inventories active + foreign roots (.agents/skills, plugin caches), marks loadable, reports collisions, embeds SKILL_CONFLICT_PROTOCOL (teaagent/skill_loader.py, tests/test_skill_audit_inventory.py)	Complete — implemented 2026-09-13 under owner "implement governance gaps" direction	Medium	Inventory acceptance test over fixture roots; conflict-warning text contract test; no execution of inspected skills
AGF-002	Inline incident citations on the two uncited guards (check_dr006_gate_trailer, check_action_register_link), matching the cite-originating-failure convention of peer guards	Complete — both guards carry Origin: paragraphs citing the 2026-09-09 review failure (landed 86fa25ea)	Complete — verified 2026-09-13	High	Guard comments cite originating failure; no behavior change
AGF-003	Run-store retention/prune policy for completed inactive records (agentflow completion-cleanup analog: opt-in, Trash-equivalent, age-gated)	Absent — no retention in run_store.py/run_logging.py	On Hold — premature at zero organic delivery traffic; re-propose when organic runs exist	Low	Retention policy spec + prune acceptance test over fixture run store
AGF-004	metadata.version (or equivalent) field in SKILL.md frontmatter as single per-skill version source	Absent — frontmatter is name/description only	On Hold — no consumer asks for per-skill versions; revisit if marketplace ships independently versioned skills	Low	Version field parsed + surfaced in skill explain

Roadmap-Neutral Intake - Vendor Direction Survey 2026-09-13

Survey of OpenAI / Anthropic / Google DeepMind agent-and-governance directions (record: .teaagent/reviews/vendor-directions-2026-09-13/survey-record.md, gitignored). Conclusion: all three vendors now treat the harness/environment layer as the security boundary — validating harness-first. Rows below are the only gaps the survey surfaced; none is scheduled without owner approval under DR-006.

ID	Work Item	Implementation Status	Scheduling	Confidence	Required Exit Evidence
VND-001	Live supervisor/monitor lane: trusted reviewer pass over the run trajectory (post-run first, in-run later) classifying events against a threat taxonomy; acceptance shaped on DeepMind's coverage/recall/time-to-response metrics	Implemented — teaagent/run_review.py post-run reviewer classifies each tool call against the insider-threat taxonomy via teaagent runs review <run_id>; in-run live monitor remains future	Complete — implemented 2026-09-14 under owner authorization + governance-gap DR-006 gate	Medium	Post-run reviewer pass over fixture audit log; taxonomy-classified findings; coverage metric reported (tests/test_run_review.py, 7 tests)
VND-002	Insider-threat/misalignment threat class in docs/threat-model.md — agents as potential insider threats (DeepMind AI Control framing), not only external attackers	Complete — insider-threat class added to docs/threat-model.md (new threat-table row + dedicated section)	Complete — implemented 2026-09-14 under owner "implement tasks" direction	High	Threat-model section added; no behavior change
VND-003	Agent-autonomy metrics (check-in rate, interruption rate, pause-vs-assume calibration — Anthropic's measuring-agent-autonomy shape)	Absent — same zero-organic blocker as G1	On Hold — no organic runs to measure; re-propose when M4 dogfood lands	Low	Metric definitions + instrumented run fields

Milestones

Milestone	Target	Outcome	Owner	Status	Confidence	Next Gate	Exit Criteria
M0	1-2 weeks	Risk register operational, release claims traceable, tool lint warnings budgeted	governance	Complete	High	M1 complete	All 3 checks pass: validate_docs_consistency.py, refresh_competitive_docs.py --check, teaagent tool lint --root .
M1	2-6 weeks	Daily cockpit parity, run evidence summary, guided recovery	TBD	Complete	High	M2 complete	CLI/TUI cockpit parity acceptance, run evidence summary acceptance, guided recovery acceptance
M2	4-10 weeks	Long-session context health, hash-bound plans, scope creep measurement	TBD	Complete	High	M3 complete	Long-session context guard acceptance, scope budget acceptance, plan revision acceptance
M3	8-14 weeks	Extension activation explain, MCP trust onboarding, subagent review/merge	TBD	Complete	High	M4 complete	Extension activation explain acceptance, MCP trust onboarding acceptance, subagent review/merge acceptance
M4	12-22 weeks	Background/cloud durability, gateway task intake, control-plane operator cockpit	TBD	On Hold except DR-006 dogfood carve-out	Low	Dated BG-001/cockpit dogfood evidence	Only background lifecycle + operator cockpit are eligible under co-maintainer dogfood; cloud/SaaS/multi-tenant GTM remains held. Eligibility is not need or completion
M5	Ongoing	Prompt/runtime/model/provider gating, repo-map benchmarking, release evidence bundles	TBD	Blocked — fixture corpus gated	Low	Funded non-advisory release profile + owner decision	Prompt/conversational regression suite and repo-map fixture corpus are in the release profile; model/provider regression evidence remains external
M6	After M1-M4	Desktop/client-server packaging for owner-operated trust, update, rollback, session attach	TBD	On Hold — no authorized owner demand	Low	Owner friction or dated override	Packaged launch smoke, signing/SBOM/update docs, and desktop session-attach acceptance remain future contracts

Track A - Roadmap Governance and Claim Hygiene

ID	Work Item	Owner	Status	Confidence	Next Gate	Risk
GOV-001	Create canonical roadmap status table	TBD	Complete	High	GOV-002	Medium
GOV-002	Add risk-register schema	docs / governance	Complete	High	release audit	High
GOV-003	Add claim-to-evidence matrix	docs / governance	Complete	High	release audit	High
GOV-004	Define verification profiles	docs / governance	Complete	High	release audit	High
GOV-005	Add warning-budget ownership	docs / governance	Complete	High	release audit	Medium
GOV-006	Create release-channel source of truth	docs / governance	Complete	High	release audit	Medium
GOV-007	Make competitive survey freshness a release checklist blocker	docs / governance	Complete	High	release audit	Medium
GOV-008	Add decision expiry dates to ADRs	docs / governance	Complete	High	ADR review	Medium
GOV-009	Add issue template for roadmap tasks	docs / governance	Complete	High	backlog refinement	Low
GOV-010	Tag backlog items by user journey	docs / governance	Complete	High	backlog refinement	Low
GOV-011	Create "do not claim" list	docs / governance	Complete	High	release audit	Medium
GOV-012	Add release residual-risk summary	docs / governance	Complete	High	release audit	High
GOV-013	Create curated documentation front door	docs	Complete	High	GOV-014	Low
GOV-014	Add doc-vs-HEAD guarded claim registry	docs / verification	Complete	High	release audit	High
GOV-015	Audit High/Critical module risks for upward links	docs / module owners	Complete	High	GOV-016	High

Track H3 - Ecosystem Trust And Dynamic Skills

The June 5 dynamic-skill research narrows the first H3 proof point: TeaAgent should not expand ecosystem breadth until generated skills, long results, and skill-output verification are testable against the RSS failure case. DSK-P0-001 through DSK-P0-007 (lifecycle state machine, write quarantine, offline RSS fixture, long-result envelope, output validators, explainability, and decision-visibility) form the first ecosystem-trust spine.

ID	Work Item	Owner	Status	Confidence	Next Gate	Risk
DSK-P0-001	Skill lifecycle state machine distinguishes loaded, activated, used, and verified.	skills / audit	Complete	High	lifecycle event tests	High
DSK-P0-002	Direct active-skill writes are blocked, quarantined, or labeled unmanaged.	workspace tools / skill writer	Complete	High	protected path acceptance	High
DSK-P0-003	Offline RSS fixture acceptance proves source-backed skill output.	tests / skills	Complete	High	fixture summary test	High
DSK-P0-004	Long-result envelope preserves preview, full artifact, hash, and cursor.	tools / audit	Complete	High	large result fixture test	High
DSK-P0-005	Output artifact validators for source-backed tasks.	tests / verifier	Complete	High	validator test suite	High
DSK-P0-006	Unmanaged skill explainability state labels candidate, shadowed, and blocked skills.	skill loader / CLI	Complete	High	explainability state test	High
DSK-P0-007	Invalid tool-decision failure is visible in skill flows, not silently successful.	chat agent / runner	Complete	High	invalid-decision test	High
DSK-P1-001	Behavioral skill eval compares with-skill and without-skill results.	skill eval	Complete	High	deterministic eval harness	Medium
DSK-P1-002	Skill invocation audit records activation cause and output artifact links.	audit / run store	Complete	High	run evidence integration	Medium
DSK-P1-003	Explicit skill activation UX is available through CLI/task config first.	CLI / runner	Complete	High	explicit activation acceptance	Medium

Current evidence package:

• Dynamic Skill Generation And Long Result Audit
• RSS Dynamic Skill Failure Case Study
• Agent Ecosystem Core Values
• Dynamic Skill Critical Questioning
• Dynamic Skill And Long Result Work Items
• Dynamic Skill Lifecycle And Result Flow

Cross-Horizon Track - Seven Control Loops

The June 5 competitor pass identifies seven control loops that should become TeaAgent's architecture and product governance model across H0-H5: spec-first direction, dynamic workflow breadth, loop/goal depth, model routing, synthesis review, precise memory, and human review gates. This track is cross-horizon because each loop touches multiple existing modules rather than a single roadmap horizon.

Complete below records the implementation state of the listed historical items. It does not authorize follow-on work. This survey-derived legacy-competitive track remains held unless a new item cites owner friction, an independently proved governance gap, or a dated owner override.

ID	Work Item	Owner	Status	Confidence	Next Gate	Risk
SCL-P0-001	Bind high-risk runs to a spec or plan receipt.	plan gate / runner	Complete	High	failing high-risk no-spec test	High
SCL-P0-002	Add repo-grounding checks before spec tasks execute.	plan gate / code map	Complete	High	stale-spec fixture test	High
SCL-P0-003	Link dynamic skill lifecycle and long-result work as the H3 proof path.	skills / docs	Complete	High	DSK-P0 link audit	High
SCL-P0-004	Define persisted goal records for loop state, evidence, and stop criteria.	runner / run store	Complete	High	goal record schema test	High
SCL-P0-005	Add model-route receipts to audit and run evidence.	model routing / audit	Complete	High	deterministic route fixture	Medium
SCL-P0-006	Define synthesis review artifacts for high-risk answers.	review / evidence	Complete	High	contradictory-source fixture	High
SCL-P0-007	Define human review gate packets for irreversible actions.	approval / TUI	Complete	High	destructive action packet test	High
SCL-P1-001	Add typed memory metadata: scope, source, confidence, TTL, supersession, owner.	memory	Complete	High	memory promotion tests	High
SCL-P1-002	Add memory quarantine and promotion flow.	memory / review	Complete	High	unreviewed memory injection test	High
SCL-P1-003	Add goal status and evidence inspection commands.	CLI / TUI	Complete	High	status command acceptance	Medium
SCL-P1-004	Add role-aware model routing tests.	model routing	Complete	High	route matrix tests	Medium
SCL-P1-005	Require synthesis review for source-backed high-risk research.	review / docs	Complete	High	review requirement validator	Medium
SCL-P1-006	Add gate packets to skill install and memory promotion.	skills / memory / approval	Complete	High	gate packet acceptance	High
SCL-P2-001	Build a TUI cockpit for spec, goal, route, review, memory, and approval state.	TUI	Complete — surface narrowed 2026-09-15: tabbed screens deleted per owner G17 (1611e71b); the status-view [Control Cockpit] panel (teaagent/tui/core.py:319-381) carries exactly these six sections	High	cockpit prototype	Medium
SCL-P2-002	Add release evidence bundle for all seven loops.	release / docs	Complete	High	release bundle check	Medium

Current evidence package:

• Seven Control Loops Competitor Survey
• Seven Control Loops Product Direction
• Seven Control Loops TeaAgent Integration Map
• Seven Control Loops Critical Questioning
• Seven Control Loops Work Items

Cross-Horizon Track - Community Pain Point Overlay

The June 5 community pass adds a user-pain overlay to the seven control loops. The work is deliberately receipt-oriented: make routing, memory, review, cost, skill/MCP, approval, goal, and proof-of-use behavior visible before widening autonomy.

Complete below records implementation that already landed; it is not evidence of current community demand. Follow-on community-survey work is held unless it passes the same DR-006 authority gate as any other hypothesis-derived item.

ID	Work Item	Owner	Status	Confidence	Next Gate	Risk
CPP-P0-001	Add route evidence panel to run summary.	model routing / run evidence	Complete	High	model route fixture	High
CPP-P0-002	Add goal checkpoint receipt.	runner / run store	Complete	High	long-goal checkpoint test	High
CPP-P0-003	Add memory write quarantine rule for agent-created project memory.	memory / approval	Complete	High	pending-memory test	High
CPP-P0-004	Add review artifact minimum schema.	review / subagents	Complete	High	missing-evidence review test	High
CPP-P0-005	Add approval authority receipt.	approval / audit	Complete	High	exact-scope authority test	High
CPP-P0-006	Add dynamic asset provenance summary.	skills / MCP / audit	Complete	High	dynamic asset evidence test	High
CPP-P0-007	Add proof-of-use requirement for skill-backed outputs.	skills / runner	Complete	High	skill-backed output test	High
CPP-P0-008	Add intent-drift pre-write check for high-risk runs.	plan gate / policy	Complete	High	out-of-scope write test	High
CPP-P1-001	Add review repeat suppression.	review / evidence	Complete	High	repeated finding state test	Medium
CPP-P1-002	Add phase budget thresholds.	budget / model routing	Complete	High	phase budget test	Medium
CPP-P1-003	Add context pressure score.	context bus / TUI	Complete	High	context score test	Medium
CPP-P1-004	Add untrusted-source memory tests.	tests / memory	Complete	High	memory poisoning fixture	High
CPP-P1-005	Add risk-adaptive spec exemption UX.	plan gate / CLI	Complete	High	low-risk exemption test	Medium
CPP-P2-001	Add control-plane cockpit.	TUI	Complete — CLI teaagent cockpit snapshot + TUI status panels; tabbed TUI screens deleted 2026-09-15 per owner G17 (1611e71b); see the 2026-09-17 amendment in specs/operator-cockpit-acceptance-spec-2026-07-11.md	High	cockpit acceptance test	Medium

Current evidence package:

• Community Agent Pain Points Survey
• Community Pain Points Response Plan

Status Definitions

• Proposed: Item is documented and not yet accepted as implementation-ready
• Complete: Item is fully implemented and verified
• In Progress: Item is actively being worked on
• Pending: Item is not yet started
• Blocked: Item is blocked by dependencies
• On Hold: Item is intentionally deferred

Confidence Definitions

• High: High confidence in approach and timeline
• Medium: Moderate confidence, some unknowns remain
• Low: Low confidence, significant unknowns or dependencies

Critical Path — Current Completion Evidence

Item	Status	Completion %	Evidence Type	Owner	Notes
SEC-01 Audit HMAC persistence	Fixed	100%	Code + passing tests	—	Key persisted at teaagent/audit.py:163; RISK-01 hardening: key-save OSError now logs warning (no silent pass); HMACKeySaveTests::test_chain_key_save_failure_logs_warning
SEC-17 ApprovalPolicy thread leak	Fixed	100%	Code + passing tests	—	ENG-01: __del__ shuts down executor; ApprovalPolicyThreadLeakTests
SEC-18 Zero cost rates (fake/ollama/vllm)	Fixed	100%	Code + passing tests	—	RISK-02: nominal non-zero rates; ProviderCostRateTests
SEC-19 JIT approval no timeout	Fixed	100%	Code + passing tests	—	OPS-01: 60s default timeout, auto-deny; JITApprovalTimeoutTests
SEC-02 MCP trust expiry	Fixed	100%	Code + passing test	—	teaagent/mcp_trust.py:286, teaagent/mcp_trust.py:343; test_server_trust_expiry()
SEC-04 Budget default	Fixed	100%	Code + passing tests	—	Default 500 cents; test_budget_zero_cents_rejects_any_spend()
SEC-06 JIT isolation	Fixed	100%	Code + passing tests	—	test_subagent_jit_approval_isolation_sec06()
SEC-07 Docker hardening	Fixed	100%	Code + passing tests	—	teaagent/subagents/_isolation.py:347-365; test_docker_isolation_*()
SEC-10 Shell allowlist	Fixed	100%	Code + passing tests	—	teaagent/workspace_tools/_shell.py:174; test_all_inspect_commands_classified_as_inspect()
DS-02 TUI controller routing	Fixed	100%	Code + passing tests	—	teaagent/tui/core.py:996; controller-based cost/undo/task
DS-05 TUI undo via journal	Fixed	100%	Code + passing tests	—	teaagent/tui/core.py:1057; test_tui_undo_uses_journal()
DS-09 Background UUID rejection	Fixed	100%	Code + passing test	—	test_agent_run_background_rejects_known_run_or_suspension_id()
DS-12 Empty-path approval	Fixed	100%	Code + passing tests	—	test_empty_path_globs_rejected_ds12()
DS-13 Budget zero semantics	Fixed	100%	Code + passing tests	—	None=unlimited, 0=no-spend
DS-01 TUI cost accumulation	Fixed	100%	Code + passing tests	—	TICKET-12; test_task003_cost_truth.py
DS-08 resume always errors	Fixed	100%	Code + passing tests	—	TICKET-16 Phase 2; test_repl_suspend_resume_roundtrip
DS-11 Initial task dropped	Fixed	100%	Code + passing tests	—	TASK-DD2-001; chat task forwarding tests
H0 Claim + risk hygiene	Complete	100%	Code + docs	governance	All H0 items done; risk register has Owner/Due; M0 checks pass
M0 Risk register operational	Complete	100%	Code + docs	governance	All 3 M0 checks verified passing

Merge gate: python3 scripts/validate_docs_consistency.py must pass before any PR that updates roadmap or risk register status.

Unverified ecosystem claims: See docs/security/risk-register-and-threat-model-2026-06-02.md Appendix C for a full list of aspirational claims that must not be marked as shipped without test evidence.

Notes

• This document should be updated when roadmap items change status
• Every roadmap item should have exactly one owner surface
• Status changes should be traceable via git history
• This document is referenced by release checklist and docs validators
• Documentation-current-truth work is tracked in docs/plans/documentation-optimization-master-plan-2026-06-04.md and docs/work-log/documentation-optimization-work-items-2026-06-04.md
• Phase 0 governance closure evidence is tracked in docs/work-log/phase-0-governance-closure-report-2026-06-04.md
• Full pytest collection is expected to run from the development environment declared in pyproject.toml; hypothesis already appears under project.optional-dependencies.dev, so the June 11 collection failure was an environment provisioning gap rather than a missing dependency declaration.