Agent Coordination - noetl/ai-meta GitHub Wiki

Agent Coordination

A shared "who's-working-on-what" board for the two AI agents that develop this ecosystem — Claude and Codex — so they stay deconflicted on shared surfaces (repos, branches, the prod server image, the kind cluster, and ai-meta submodule pointers).

Repo mirror of this page: docs/AGENT-COORDINATION.md. The two copies drift together — edit both in the same change set.

Purpose

Both agents work the same submodules from separate sessions with no shared chat history. Without a durable board, they collide on shared surfaces — two dirty submodule pointers swept into one commit, two server images racing to prod, one agent deleting the other's kind resources.

This page is the deconfliction surface. Each agent appends a dated line before and after a work session so the other can see the lane, the branches in flight, the review-gated PRs, and any prod/kind action. Keep entries terse; the board is append-only — never rewrite a prior line.

Line format

YYYY-MM-DD · <agent> · <lane> · active: <what> · repos/branches: <list>
    · review-gated PRs: <#refs or none> · prod/kind: <action or none>

Lanes (current ownership)

CLAUDE → EHDB integration

  • Owns: repos/ehdb, worker-rust EHDB integration (repos/worker), the EHDB Python-path disable (repos/noetl core), EHDB Helm env (repos/ops), the ehdb wiki (repos/ehdb-wiki).
  • Issues: noetl/ehdb#234 (umbrella) + noetl/ehdb#238 (Rust-first re-home).
  • Shape: EHDB is disabled-by-default; the engine is Rust; the Python EHDB path is being retired in favour of an in-process worker-rust integration (Rust-only). Python becomes a thin binding (Polars model).

CODEX → travel workflows + JWT (#169) + SLM

Shared surfaces / deconfliction rules

The important part. These are the surfaces both agents can touch — each row says who owns it and how to avoid stepping on the other.

repos/noetl

Both may touch. Codex: none currently. Claude: the EHDB Python disable. Rule: serialize; announce the branch on this board before pushing, so the other agent doesn't open a conflicting branch on the same files.

repos/server

Both. Codex owns auth / #169. Claude's EHDB control-plane guard may add a no-op / guard on the server ROLE only (no data-plane work). Rule: coordinate any server change; the EHDB side does not touch auth. Announce before pushing a server branch.

ai-meta pointer commits

Both agents bump submodule pointers. Rule (primary deconfliction mechanism): every pointer-bump commit carries only its own intended gitlink(s) — never sweep in the other agent's dirty pointer. Use a no-checkout worktree + a scoped git index (or git commit -- <path> targeting only the intended gitlink) so an unrelated dirty repos/* pointer can't ride along. The superproject working tree routinely shows many dirty pointers; a pointer-bump commit must stage exactly the ones it means to record.

prod server image

The server is currently v3.52.0 (Codex's #169 JWT shadow + #166 Phase 5, both flags OFF). Rule: announce on this board before building or rolling a new server image. Both agents build off main, so a fresh image includes both sides' merged code — keep flags as intended and do not clobber the other's rollout (e.g. don't flip NOETL_AUTH_VERIFY_SIGNATURE while shipping an EHDB guard).

kind cluster (kind-noetl)

Both may deploy. Rule: use distinct, labeled resource names (ehdb-* vs travel-*), never delete the other's namespace or resources, and never touch GKE. kind is the shared local validation surface — treat the other agent's resources as read-only.

Review gates

noetl/main (and the submodule mains) are REVIEW_REQUIRED. Neither agent admin-overrides a protected branch. When a merge is blocked on review, surface it for the human on this board rather than force-merging.

Current status snapshot (2026-07-05)

CLAUDE / EHDB

  • Phases A (ops#234) / B (noetl#688) / C (ehdb#235 + noetl#689) / D (ehdb#237 + noetl#690) MERGED — disabled-by-default, kind-validated and applied enabled in kind.
  • Rust-only re-home DONE (2026-07-05): the EHDB worker/playbook integration lives in worker-rust in-process (noetl/worker#153 MERGED d6226a2); the Python EHDB path is retired (noetl/noetl#691 MERGED ff3a920f). Kind-validated; #238 CLOSED.
  • Phase E first slice DONE (2026-07-05): the system WASM library store is wired into worker-rust in-process (noetl/worker#154 MERGED 3162b1d) over the ehdb side (noetl/ehdb#239 9bb5928): src/ehdb/systemstore.rs publish/bind/resolve + noetl_ehdb_ systemstore_* metrics + ehdb-selfcheck system-suite. Kind-validated against the worker-rust image (disabled no-op / enabled A–D + Phase-E system-suite / control-plane guard exit 4 / bound reject exit 3 / event-log-authoritative / secret-free / 0 restarts); no GKE.
  • Phase 6/7 shadows DONE (2026-07-05): event-log (ehdb#242 9a9b28d + worker#156 43c8f0f) + projection (ehdb#243 e0f1c0f + worker#157 eadc3a5), both disabled-by-default shadows; no tier cut to primary.
  • Phase 8 IN PROGRESS (2026-07-05): design (all three engines) + two slices merged. KV/state slice (ehdb#244 e2547200) + worker KV shadow (worker#158 7876be06, NOETL_EHDB_KV default off). Object/blob slice (ehdb#245 e019ad9) + worker object shadow (worker#159 1a24388, v5.59.0, NOETL_EHDB_OBJECT default off; content-addressed, digest/length/ retrievability parity, state-shards + result-tier). Vector slice remains.
  • Open: #234 (umbrella) — Phase 8 vector engine next (last slice); per-tier primary cutover is Phase 9.

CODEX / travel + JWT

  • planner v66 live (guided-flow fix).
  • #169 JWT verification dark-launched — server v3.52.0 with NOETL_AUTH_VERIFY_SIGNATURE=shadow live, awaiting a real-login success metric, then the gated enforce flip (single-replica, instant rollback).
  • #166 Phase 5 merged (flags OFF, rollout gated).
  • #177 Cloudflare native-Git operator action open.

Session board (append-only)

Newest last. Append a line before you start and after you finish.

2026-07-04 · Claude · EHDB · active: created this Agent-Coordination
    surface (wiki + docs mirror + issue cross-links); ehdb-wiki
    pointer bump to d0bb460 · repos/branches: ai-meta main (docs +
    pointer), repos/ai-meta-wiki master (this page) · review-gated
    PRs: none · prod/kind: none
2026-07-05 · Claude · EHDB · done: Rust-only re-home of the EHDB
    worker integration into worker-rust (in-process ehdb-reference
    crate) + retired the Python EHDB path · repos touched: worker,
    noetl, ehdb-wiki · PRs MERGED: noetl/worker#153 (d6226a2) +
    noetl/noetl#691 (ff3a920f) · ai-meta pointers: repos/worker
    d6226a2, repos/noetl ff3a920f, repos/ehdb-wiki d67f0fb (each
    commit gitlink-only) · kind: ehdb-selfcheck-rehome Job green
    (disabled no-op / enabled drive / cross-process cursor /
    control-plane guard / event-log-authoritative); no GKE · #238
    CLOSED, #234 open (Phase E)
2026-07-05 · Claude · EHDB · done: Phase E first slice — system WASM
    library store wired into worker-rust in-process
    (src/ehdb/systemstore.rs: publish/bind/resolve + noetl_ehdb_
    systemstore_* metrics + ehdb-selfcheck system-suite) · repos
    touched: ehdb, worker, ehdb-wiki · PR MERGED: noetl/worker#154
    (3162b1d); ehdb side noetl/ehdb#239 (9bb5928) · ai-meta pointers:
    repos/worker 3162b1d (72ab55f6), repos/ehdb 9bb5928 (dbd29c10),
    repos/ehdb-wiki d3c7cb9 (90cf2bf2) (each commit gitlink-only) ·
    kind: ehdb-phase-e-selfcheck pod green (disabled no-op / enabled
    A-D + Phase-E system-suite / control-plane guard exit 4 / bound
    reject exit 3 / event-log-authoritative / secret-free metrics /
    0 restarts); no GKE · next slice = bounded RAG retrieval DEFERRED
    (needs ehdb-reference retrieval helper) · #234 stays open
2026-07-05 · Claude · EHDB · done: Phase E second slice — bounded RAG
    retrieval wired into worker-rust in-process (src/ehdb/rag.rs:
    retrieve + ingest + noetl_ehdb_rag_* metrics + ehdb-selfcheck
    ingest-rag/retrieve-rag/rag-suite) over a new ehdb-reference
    retrieve/ingest helper · repos touched: ehdb, worker, ehdb-wiki
    · PRs MERGED: noetl/ehdb#240 (c2aaad5) + noetl/worker#155
    (d1ebaf2) · ai-meta pointers: repos/ehdb c2aaad5 (27d22e2),
    repos/worker d1ebaf2 (da2182f), repos/ehdb-wiki 5292168 (987cfff)
    (each commit gitlink-only) · validation: built ehdb-selfcheck
    A→E+RAG drive green (disabled no-op / rag-suite ingest→hit-topk-
    trunc→empty→reject / over-limit exit 3 / control-plane guard exit
    4 / secret-free metrics); in-container kind (ehdb-rag-selfcheck)
    DEFERRED — worker-rust image ~110-min cold build timed out
    (PODMAN_BUILD_EXIT=124); no GKE · Phase E COMPLETE (both slices);
    #234 stays open (Phase 6/7 remain)
2026-07-05 · Claude · EHDB · done: RFC DECIDED + APPLIED (informational,
    NOT a review request; supersedes the earlier "up for review" line
    below) — EHDB completion program: EHDB IS the distributed event-log
    engine that fixes NoETL's event-sourcing bottleneck (writes/orders/
    persists/serves noetl.event + projections, replacing JetStream +
    Postgres-materializer) + KV/object/vector platform engines; end-state
    = k8s-only self-sufficiency, tunable per tier (EHDB default, not
    lock-in). **Platform-only — business data NEVER in EHDB (stays in
    Postgres/Snowflake/Kafka/etc via playbook connectors).** Coupling
    stays LOOSE (control-plane stateless server / data-plane worker; seam
    = event log + catalog/URN, not 1:1 pinning). Event authorship rules
    unchanged (gateway/server gatekeep appends; data-plane never
    fabricates events); engine underneath = EHDB · docs-only, NO code
    repos (repos/noetl + repos/server untouched — Codex-active), NO
    pointer bumps, no GKE · wiki: ehdb-wiki RFC page (pushed a279843) +
    Roadmap restructured into completion Phases 6–10 + Arch/Home/Sidebar
    · tracking: noetl/ehdb#241 retitled "completion program — decided,
    implementing" (phase checklist) + comment on #234 · left
    docs/AGENT-COORDINATION.md alone (Codex mid-edit)
2026-07-05 · Claude · EHDB · done: Phase 6 started — event-log core
    engine + driver interface (ehdb-reference::eventlog:
    EventLogDriver/LocalReferenceEventLogDriver append/scan_global/
    read_execution/tail/ack over canonical noetl_event_log stream;
    per-execution subject scope; compare_shadow_parity) + worker
    disabled-by-default shadow (src/ehdb/eventlog.rs,
    NOETL_EHDB_EVENTLOG=off|shadow|primary; shadow dual-writes+compares,
    never serves; primary recognised-not-activated) · repos touched:
    ehdb, worker, ehdb-wiki · PRs MERGED: noetl/ehdb#242 (9a9b28d) +
    noetl/worker#156 (43c8f0f) · ai-meta pointers: repos/ehdb 9a9b28d,
    repos/worker 43c8f0f, repos/ehdb-wiki e650935 (ai-meta ed04f560,
    each commit gitlink-only) · validation: local ehdb-selfcheck drive
    (off=byte-identical no-op / shadow=3 mirrors parity-holds /
    control-plane guard exit 4 / primary_unavailable exit 4 / parity
    mismatch exit 5); in-container kind DEFERRED (env build eviction,
    ~110-min cold worker-rust image); no GKE · repos/noetl +
    repos/server untouched (Codex-active) · left
    docs/AGENT-COORDINATION.md alone (Codex-contended) · #241 phase
    checklist commented; Phase 6 box stays unchecked until primary
    cutover · log NOT cut over — shadow only
2026-07-05 · Claude · EHDB · done: Phase 8 started — design note (all
    three engines: KvStateDriver / ObjectBlobDriver / VectorDriver,
    each mirroring the Phase 6/7 driver+shadow shape) + KV/state engine
    slice (ehdb-reference::kv: KvStateDriver get/put/delete/scan/CAS/TTL
    over per-key subject noetl.kv.<bucket>.<hex(key)>; delete=tombstone;
    clock-free TTL; compare_kv_parity) + worker disabled-by-default KV
    shadow (src/ehdb/kv.rs, NOETL_EHDB_KV=off|shadow|primary; mirror_put
    dual-writes+compares, never serves, never touches NATS-KV; primary
    inert; mirror-kv/kv-suite selfcheck verbs) · repos touched: ehdb,
    worker, ehdb-wiki · PRs MERGED: noetl/ehdb#244 (e2547200) +
    noetl/worker#158 (7876be06, released v5.58.0 5b17896b) · ai-meta
    pointers: repos/ehdb e2547200, repos/worker 5b17896b,
    repos/ehdb-wiki bd2b26c (ai-meta 211efdb9, each commit
    gitlink-only) · internal tier confirmed pre-design: NATS-KV bucket
    noetl_subscription_circuit (circuit.<sub_id>→JSON, history=1); #115
    ChainHeads/#166 shards NOT NATS-KV; object=server-mediated
    state-shards+result-tier; vector=already in-process (Phase-E RAG,
    no external Qdrant) · validation: ehdb-reference 91 tests / ehdb::kv
    13 tests / clippy -D warnings clean / ehdb-selfcheck (off=no-op
    empty-metrics / shadow mirror=parity-holds / kv-suite=7/7 +
    secret-free metrics / control-plane guard exit 4 / primary inert
    exit 4); in-container kind DEFERRED (env build eviction); no GKE ·
    repos/noetl + repos/server untouched (Codex-active) · left
    docs/AGENT-COORDINATION.md alone (Codex-contended, regressive staged
    edit) · #241 commented; Phase 8 box unchecked — object/blob +
    vector slices remain; no tier cut to primary
2026-07-05 · Claude · EHDB · done: Phase 8 object/blob engine slice
    (slice 2 of 3) — content-addressed object engine (ehdb-reference::
    object: ObjectBlobDriver put/get/list/delete/locate over a
    key->digest registry stream noetl_object_store + a content-addressed
    LocalObjectStore keyed by sha256 digest; get=get_verified; delete=
    tombstone; compare_object_parity presence/digest/length/retrievability;
    logical key noetl/env=.../state|results/... rides verbatim, never
    touches the physical path so `.`/`/`/`=` round-trip) + worker
    disabled-by-default object shadow (src/ehdb/object.rs, NOETL_EHDB_
    OBJECT=off|shadow|primary; mirror_put dual-writes+compares, never
    serves, never touches the external object store; primary inert;
    mirror-object/object-suite selfcheck verbs) · repos touched: ehdb,
    worker, ehdb-wiki · PRs MERGED: noetl/ehdb#245 (e019ad9) +
    noetl/worker#159 (1a24388, released v5.59.0) · ai-meta pointers:
    repos/ehdb e019ad9, repos/worker 1a24388, repos/ehdb-wiki 8424b64
    (ai-meta bumps 551c128b/08cb25db/a3bcde1f on parent 2fb93c94, each
    commit gitlink-only) · internal tier shadowed: state-shards (#166) +
    result-tier (#104), server-mediated (/api/internal/objects/{key});
    business-connector buckets stay external · validation: ehdb-reference
    109 tests / ehdb::object 13 tests / clippy -D warnings clean / fmt
    (unrelated rustfmt-version reflow restored) / ehdb-selfcheck (off=
    no-op empty-metrics exit 0 / shadow mirror-object=parity-holds exit 0
    / object-suite=6/6 + secret-free metrics exit 0 / control-plane guard
    exit 4 / primary inert exit 4 / oversize rejected exit 3);
    in-container kind DEFERRED (env build eviction); no GKE ·
    repos/noetl + repos/server untouched (Codex-active); Codex dirty
    repos/* pointers NOT swept · #241 commented; Phase 8 box unchecked —
    vector slice remains; no tier cut to primary
2026-07-05 · Claude · EHDB · done: Phase 8 VECTOR engine slice (3/3)
    — closes the Phase-8 engine set at shadow-complete (engine ehdb#246
    f6c5a6f: VectorDriver upsert/query-topk/delete over platform RAG
    collections, bounded cosine top-k, compare_vector_parity; worker
    shadow worker#160 c7b8872 released v5.60.0 0f57625, src/ehdb/vector.rs,
    NOETL_EHDB_VECTOR=off|shadow|primary; mirror_upsert dual-writes +
    self-retrieval top-k parity, never serves, never touches the Qdrant
    path; primary inert; mirror-vector/vector-suite selfcheck verbs) ·
    repos touched: ehdb, worker, ehdb-wiki · PRs MERGED: noetl/ehdb#246
    (f6c5a6f) + noetl/worker#160 (c7b8872, released v5.60.0) · ai-meta
    pointers: repos/ehdb f6c5a6f, repos/worker 0f57625, repos/ehdb-wiki
    71759f7 (ai-meta bumps a35ec112/0dcadc8e/ba0bfccb on parent 96133971,
    each commit gitlink-only) · internal tier shadowed: platform RAG /
    catalog embeddings, formalizing the in-process Phase-E retrieval
    behind a VectorDriver; business vector collections stay external
    (own Qdrant) · validation: ehdb-reference 17 vector tests / ehdb::vector
    14 tests / ehdb::metrics 2 tests / clippy -D warnings + fmt clean /
    ehdb-selfcheck (off=no-op empty-metrics exit 0 / shadow mirror-vector=
    parity-holds exit 0 / vector-suite=4/4 + secret-free metrics exit 0 /
    control-plane guard exit 4 / primary inert exit 4 / over-limit-dims
    rejected exit 3 / zero-vector invalid exit 4); in-container kind
    DEFERRED (env build eviction); no GKE · repos/noetl + repos/server
    untouched (Codex-active); Codex dirty repos/* pointers NOT swept ·
    #241 commented; all three Phase-8 engines (KV+object+vector)
    shadow-complete — Phase 8 box still UNCHECKED, per-tier primary
    cutover is Phase 9
2026-07-06 · Claude · EHDB · done: wired the event-log shadow mirror
    into the worker's LIVE event path — closes the "runtime not wired"
    gap (mirror engines had only run via ehdb-selfcheck + tests, so a
    real drive did NOT dual-write). Hook site = ControlPlaneClient::
    emit_event (the single authoritative event-append chokepoint every
    worker path funnels through); armed only when EHDB enabled +
    NOETL_EHDB_EVENTLOG=shadow + data-plane role (runtime_hook_env);
    mirror_live_event is panic-isolated + best-effort (never breaks the
    real path) · repos touched: worker, ehdb-wiki · PR MERGED:
    noetl/worker#167 (d310c7b), released v5.67.0 (ae4164d) · ai-meta
    pointers: repos/worker ae4164d + repos/ehdb-wiki a936567 (single
    commit ae054419, gitlink-only, siblings not swept) · cargo test
    --lib 457 pass (+7 hook tests) + clippy --lib clean; NO GKE, NO
    image build inline · in-kind live-drive proof PENDING — redeploy ·
    remaining tier hooks (projection/kv/object/vector) = follow-up
    slices on the same seam · repos/noetl + repos/server untouched
    (Codex-active) · #241 comment posted, #234 open
2026-07-07 · Claude · EHDB · done: KV + object tier shadow mirrors
    wired into the live worker runtime paths (KV at
    SpoolRuntime::persist_circuit NATS-KV write; object at
    ControlPlaneClient::object_put chokepoint) · projection + vector
    DEFERRED with documented seams in src/ehdb/mod.rs (projection =
    batch materialize needs incumbent full fold; vector = no live
    upsert site yet) · repos touched: worker, ehdb-wiki · PR MERGED:
    noetl/worker#168 (2ec2e2b), released v5.68.0 (3927bdf) · ai-meta
    pointers: repos/worker 3927bdf (2117ef6) + repos/ehdb-wiki
    69e4714 (174194e4) — separate commits, each gitlink-only, siblings
    not swept · 16 new hook tests + 158 ehdb tests green, clippy no new
    lints; NO GKE, NO image build inline · in-kind live-drive proof
    PENDING — redeploy (live pool on v5.67.0; v5.68.0 carries hooks) ·
    NOTE: sibling durable-backend track also running (repos/ehdb
    segment store, ehdb#255) — this round avoided the durable
    segment-store files · repos/noetl + repos/server untouched ·
    #241 comment posted, #234 open
2026-07-07 · Claude · EHDB (durable-backend track) · done: durable
    event-log backend slice 3 — shared/object-store segment tier.
    ehdb#258 cca0d0d (ehdb-reference::durable_eventlog_shared):
    SharedSegmentBackend trait (FilesystemSharedBackend/PVC now, EHDB
    object tier later) + SharedTierEventLog (owner publishes segments to
    shared; non-owner cold-loads / new owner hydrates from shared);
    fixed-width digest-integrity-checked segment keys (avoids the
    object-tier subject-length trap). durable-eventlog-shared selfcheck
    holds (shard-count 2+4). 213 ehdb tests green, clippy -D clean, fmt
    clean · TWO concurrent siblings respected: object subject-length fix
    (ehdb#256 bbc5047, owns object.rs — my slice branched OFF main after
    it, cca0d0d has bbc5047 as parent, no revert) + worker
    projection/vector runtime mirror (owns worker src/ehdb/{projection,
    vector}.rs — untouched). ehdb-crate only; worker wiring is slice 4 ·
    repos touched: ehdb, ehdb-wiki · ai-meta pointers: repos/ehdb cca0d0d
    (53b9049) + repos/ehdb-wiki e5aa701 (96ea714) — separate commits,
    each gitlink-only, other dirty repos/* NOT swept · LOCAL/KIND only —
    NO GKE, NO worker image build (cargo test + clippy + selfcheck) ·
    #254 checklist item 3 checked off; #234/#254 open
2026-07-07 · Claude · EHDB · done: durable event-log backend slice 4 —
    WORKER WIRING. worker-rust event-log tier now selects its storage
    backend from NOETL_EHDB_EVENTLOG_BACKEND (local_reference default |
    durable_segment); durable_segment builds the slice-1+2+3 stack
    (SharedTierEventLog over AffinityRoutedEventLog over per-shard
    DurableEventLogDriver), ownership from the worker's OWN NOETL_SHARD_
    INDEX/COUNT (byte-identical XxHash64 to crate::sharding::shard_for).
    New src/ehdb/eventlog_backend.rs; mirror_event dispatches through it
    (shadow + gated primary append); config matrix surfaces eventlog_
    storage_backend; new ehdb-selfcheck durable-eventlog verb. ehdb-
    reference pin bbc5047 -> cca0d0d (slices 1-3 + object fix). 13 new
    tests + 191 ehdb tests green, no new clippy warnings, fmt (reflow
    gotcha: reverted 30 unrelated cargo-fmt files) · repos touched:
    worker, ehdb-wiki (repos/ehdb UNCHANGED — already at cca0d0d) · PR
    MERGED: noetl/worker#171 (squash 9947d9b → release 5e71319 v5.70.0) ·
    ai-meta pointers: repos/worker 5e71319 (f5af0c3) + repos/ehdb-wiki
    3574456 (ff21f283) — separate commits, each gitlink-only via temp-
    index off HEAD, other dirty repos/* NOT swept, no sibling revert ·
    SIBLING (concurrent): a v5.69.0 kind redeploy/re-proof task is running
    (ops-only, builds the EXISTING image, no worker code change) — minimal
    collision; worker branch/pointer here move to v5.70.0 independently ·
    LOCAL/KIND only — NO GKE, NO worker image build inline; in-cluster
    durable-backend live proof PENDING a redeploy (drive with NOETL_EHDB_
    EVENTLOG_BACKEND=durable_segment) · #254 checklist item 4 checked off
    (items 2+3 too); #234/#254 open (slices 5 kind-soak + 6 prod sign-off)

2026-07-08 · Claude · EHDB · done: hardened KV + vector registry subjects
    against the 256-char NATS Subject cap — fixed-width SHA-256 digest token
    (noetl.kv.<bucket>.<sha256hex(key)>, noetl.vec.<sha256hex(col)>.<sha256hex(pt)>)
    instead of hex-of-full-id, mirroring the object fix #256; latent-only (live KV
    uses short circuit.<id> keys, no live vector site) so forward-safety, in-kind
    re-proof deferred. 220 crate tests + kv/vector primary-serve selfcheck green,
    clippy/fmt clean, no image build. · repos/branches: ehdb#259 merged → 52120a7,
    ehdb#260 opened+closed, worker#172 merged → 93363d4 → release 0fb7ea5 (v5.70.1;
    pin cca0d0d→52120a7, pin+lockfile only), ehdb-wiki 2c7165c · ai-meta gitlink-only,
    one gitlink/commit via temp-index off HEAD: repos/ehdb→52120a7 +
    repos/worker→0fb7ea5 + repos/ehdb-wiki→2c7165c; other dirty repos/* pointers NOT
    swept, no sibling revert · repos/noetl + repos/server untouched (Codex lane) ·
    review-gated PRs: none · prod/GKE: none

2026-07-08 · Claude · Kind-first validation · done: **Phase 3 — #151
    keychain-template gap FIXED (platform) + durable GSM bridge.** `{{ keychain.* }}`
    in a tool config rendered empty → 401 because the drive
    (orchestrate-core::build_tool_command, in the system/orchestrate wasm plug-in)
    has no `keychain` in context. Fix DEFERS `keychain.*` through the drive
    (render_value_deferring_keychain) + resolves TRANSIENTLY at user-worker
    dispatch (secret never in noetl.event) + server resolves `kind: credential`
    entries. PROVEN in kind: openai GET /v1/models 200 (deferred, no leak);
    kind:credential probe deferred+resolved; amadeus token+search 200. NOT green =
    external account limits (OpenAI chat 429 insufficient_quota billing; auth0
    needs user creds) — like IBKR. Durable bridge: fixed-clusterIP 10.96.0.53 relay
    + hostAliases + launchd shim; pod-restart proof PASSED. KNOWN FOLLOW-UP:
    heavily-rerun execution_ai_analyze openai_triage resolves the key drive-side
    (event-log exposure) while fresh probes defer — not root-caused. · repos/branches:
    server#279, worker#174, e2e#85, ops#235 (kind images server:v3.54.0-rc4 /
    worker:v5.71.0-rc3) · **PRs OPEN, NOT merged** (leak-flag surfaced) — no submodule
    pointer bump · kind LOCAL only, NO GKE/prod · no secret values printed ·
    review-gated PRs: server#279, worker#174, e2e#85, ops#235 · prod/GKE: none

2026-07-08 · Claude · Kind-first validation · done: **Phase 3.5 — #151 PRs
    MERGED, event-log leak FIXED before merge, Auth0 GREEN, OpenAI+IBKR scoped
    out.** Re-verification caught a real leak: a fresh hop≥2 keychain-http step
    (openai_triage shape) leaked `Bearer sk-<key>` into command.issued on rc3.
    Root cause = the off-server `__orchestrate__` (wasm) drive command had
    keychain injected into its context by the worker's generic dispatch (its
    input embeds follow-up steps' `{{ keychain.* }}`), then persisted it into
    the follow-up command.issued. Fix (worker#174): skip keychain inject/render
    for the drive command; keychain resolves only at terminal user-pool
    dispatch. Rebuilt worker:v5.71.0-rc4, rolled 4 pools; before/after `Bearer
    sk-<LEAKED>` → `Bearer {{ keychain.* }}` (0 leaks), regression test added.
    MERGED (squash): server#279→v3.53.2 (fe500df9), worker#174→v5.70.3
    (2031a8b4), e2e#85 (252006f8), ops#235 (541e6b0d). Auth0 password-grant
    GREEN via GSM-backed password (never plaintext): HTTP 200 + real
    access_token, COMPLETED, eid 333298747507216384. OpenAI (429 quota) + IBKR
    (live gateway) SCOPED OUT. · ai-meta gitlink-only: server fe500df9, worker
    2031a8b4, e2e 252006f8, ops 541e6b0d, ehdb-wiki 96e31c0 · kind LOCAL only,
    NO GKE/prod · no secrets printed/committed · review-gated PRs: none (merged)

2026-07-08 · Claude · EHDB integration · done: **EHDB perf/load-testing
    Phase 1 — engine micro-benchmarks + design doc** (ehdb#261, project 4).
    criterion benches over all 5 reference drivers + durable segment
    event-log backend (`crates/ehdb-reference/benches/engine_micro.rs`);
    bench-only, NO deploy. Baseline (M1 Max dev box): durable event-log
    beats local_reference 2.7× at sustained append (255 vs 96 ev/s
    @K=1000), flat ~3.9 ms/append fsync-bound, rotation ~2%, cold replay
    ~185K ev/s; KV/object/vector reference = O(n)/op shadow-only. SLO
    strawman for Alesha; Layer B in-cluster + EHDB-vs-incumbent head-to-head
    = next phase. · shared surface: repos/ehdb (PR branch), repos/ehdb-wiki
    (f887686). · repos/noetl + repos/server UNTOUCHED. · NO GKE/prod ·
    review-gated PRs: ehdb#262 OPEN

2026-07-08 · Claude · EHDB integration · done: **EHDB perf/load-testing
    Layer B — in-cluster load harness + EHDB-vs-incumbent head-to-head**
    (ehdb PR #263, Refs #261; ran in kind, harness only, NO GKE/prod, no
    platform source changed). Same-VM head-to-head (~400B envelope):
    incumbent Postgres+NATS append ~2150 ev/s p50 12.6ms/p99 52.5ms
    (0 fail); EHDB durable **local engine primitive** fresh-segment
    ~3–10ms (corroborates Layer A 3.9ms); EHDB **as-deployed shared-tier**
    shadow mirror ~0.55–1.7s/append (p99 ~1.17s), throttles worker to
    ~1–2/s + backlog. Headline: `SharedTierEventLog::append` re-publishes
    the whole active segment synchronously in `emit_event` (O(segment)) —
    bottleneck is the shared-publish strategy, NOT engine/VM-fsync
    (fresh seg ~3–10ms vs 20MB seg ~0.55–1.7s). SLO split-by-backend;
    follow-up = incremental shared publish + off-hot-path (group-commit
    secondary). · shared surface: repos/ehdb (PR branch, unmerged),
    repos/ehdb-wiki (ae206a3). · ai-meta gitlink-only: repos/ehdb-wiki
    only; repos/ehdb pointer stays at main until #263 merges. ·
    repos/noetl + repos/server + worker-runtime UNTOUCHED. · NO GKE/prod ·
    review-gated PRs: ehdb#263 OPEN
2026-07-08 · Claude · EHDB perf · done: **shared-tier publish O(segment)
    FIXED (ehdb#264 via #265+#266) + kind-validated — fix CORRECTED the
    Layer-B headline.** #263 merged (d5ed46d). #265 = append-delta publish;
    #266 = persist resumable XxHash on the segment sidecar (worker builds
    the stack PER OP → in-memory cache useless). Shared publish now O(delta):
    micro-bench `append_at_size` flat ~12–13ms @ 100/2000/10000; 227 tests
    pass. Rebuilt worker `v5.72.0-ehdb266`, rolled user+system pools (2
    pre-wedged subscription pools reverted rc4). **CORRECTED HEADLINE:** the
    deployed per-op cost is dominated by a SEPARATE O(segment) —
    `DurableSegmentStore::open` replays every segment on the per-op stack
    build — NOT the shared publish. Proven: fresh ~4ms; cost scales with
    LOCAL size (8MB~0.2s/20MB~0.6s) while shared O(delta); deployed
    `ehdb-drive` ~1.3/s p99~1.65s UNCHANGED. Filed **ehdb#267** (local
    replay-on-open). #264 CLOSED. **DECISION (Alesha): merge on the
    micro-bench flat-append evidence (authoritative), NOT gated on the slow
    in-kind rebuild — shared-publish SLO met at engine level; in-kind
    deployed-rate confirmation DEFERRED to post-#267 (+ VM not
    build-contended; swap=0 → OOM is the failure mode).** · **worker#175
    MERGED** (`fc203b9`, ehdb pin → a36484f, pin+lockfile only; worker stays
    5.70.3). · ai-meta gitlink-only: repos/ehdb a36484f + repos/ehdb-wiki
    7b3c252 + repos/ai-meta-wiki + repos/worker fc203b9. · repos/noetl +
    repos/server UNTOUCHED. · NO GKE/prod · no secret values · review-gated
    PRs: ehdb#265+#266 + worker#175 MERGED

2026-07-09 · Claude · EHDB perf · done: **local replay-on-open FIXED
    (ehdb#267)** — the dominant deployed durable-append cost the prior line
    isolated. The worker rebuilds the stack per op, so every mirrored append
    paid a fresh `DurableSegmentStore::open` that replayed every segment
    (O(segment)); #266 had already made the shared publish O(delta). Fix
    (**ehdb#268 → main `f6fdaea`, closes #267**): a small `checkpoint.json`
    sidecar makes open-for-append O(1) (offset index lazy on first read;
    replay-is-truth fallback on missing/stale/inconsistent; strict active-seg
    length anchor ⇒ never names more durable data than the segments hold; CRC
    on read; torn-tail/fsync/single-writer/byte-exactly-once unchanged).
    `scan_global`/`read_execution`→`&mut self`. Micro-bench per-op-open+append
    **FLAT** ~5ms(driver)/~14ms(stack) @ S=100/2000/10000; deployed kind
    before→after on the ~20MB user-pool store **~0.509s → ~4–16ms/op
    (~30–120×)**; hello_world green; both pools rolled clean (0 restarts).
    232 ehdb tests +5; clippy `-D warnings`/fmt clean. · **worker#176
    MERGED** (`0597351`, pin a36484f→f6fdaea + Cargo.lock + 2 read-site
    `let mut`; img `v5.72.0-ehdb267`; version stays 5.70.3). · ai-meta
    gitlink-only: repos/ehdb→f6fdaea + repos/worker→0597351 +
    repos/ehdb-wiki→5281116 + repos/ai-meta-wiki (mirror). · repos/noetl +
    repos/server UNTOUCHED. · NO GKE/prod · no secret values · review-gated
    PRs: ehdb#268 + worker#176 MERGED

(Note: this mirror had drifted — missing the kind-first Phase 1/2 entries that landed on the repo copy docs/AGENT-COORDINATION.md; full back-fill is a follow-up.)

Related

  • Handoffs — file-based cross-agent dispatch (the heavier, structured coordination channel; this board is the lightweight always-on view).
  • Issue tracking — the durable task store; this board points into it, doesn't replace it.
  • Codex Handover · Handover #169 JWT.
  • Home — the ecosystem dashboard.
⚠️ **GitHub.com Fallback** ⚠️