docs(harness): #820 single-deployment RFC run record — rev 10 design + 9-cycle eval trail

[rickylabs]

RFC single-deployment run record (Refs #820 — no closing keyword; the RFC comment on #820 is still PASS-gated)

This PR lands the complete harness run record for the owner-mandated single-deployment RFC
(.llm/runs/rfc-single-deployment--orchestrator/), through plan.md rev 10. Docs-only diff —
ci:skip-e2e + ci:skip-scaffold applied intentionally.

What the run produced

• research.md — eis-chat#150 POC forensics @ aeaf2df (supervision/discovery/telemetry/
  packaging seams, 8 failure modes, script-glue vs framework-worthy), gap analysis G1–G8
  against the PM (Epic: NetScript Process Manager — bare-metal supervisor + admin console (pup/pm2 done right) #510) / deploy (epic: NetScript enterprise deployment framework (cloud-agnostic + bare-metal, CLI + Aspire) #327) board, an origin/main re-baseline, and reconciliation
  of the four load-bearing deployment/runtime debt entries.
• plan.md rev 10 — the RFC design: PM-first Tier-4 sequencing (single-runtime lane stays
  beta.11; singleton-graph behind the beta.12 PM engine into beta.13); the installer as
  DeployTargetPort adapters + a narrow MaintenancePort with fully journaled
  install/repair/uninstall/purge state machines; ONE journaled release-snapshot update mechanism
  from beta.11 (real Windows apply; Deno.autoUpdate never the authority) with crash-recoverable
  three-phase boot composition, migration barriers, replay high-water, and a pinned trust root;
  the two-mode composition contract (typed manifests + a cross-mode conformance suite as the
  anti-fork enforcement); a 22-draft dependency-ordered board with exact-one G1–G8 ownership; and
  11 owner forks (OF-A..OF-K) for stage-H ratification.
• plan-eval-cycle{1..9}.md — the full adversarial trail: nine separate-session Codex
  GPT-5.6 Sol·max PLAN-EVAL cycles, monotonically converging to 6/8 plan-gate boxes PASS
  (including Decisions locked, board adjustments, risk register, gate set, deferred scope).
• escalation.md (the cycle-2 loop-limit stop + owner re-authorization), closure.md (the
  cycle-9 design-record close + re-open amendment), corpus/ (the cited evidence — evaluators
  reference exact file/line locations in it), and the standard supervisor/worklog/context-pack/
  drift artifacts.

The rev-10 revision (this commit's delta, folding the final cycle-9 residual)

Cycle 9's only remaining design finding was missing public-vs-internal classification for
three planned surfaces. Rev 10 locks them in §I.2/§E.2/§H:

1. PM-5's RuntimeCommandSpec additions (clearEnv + the inherited-state strip list) →
   PUBLIC: an additive extension of the already-published plugin-process-manager-core
   contract, with the full JSR rubric + a consumer-compile gate bound inside PM-5's slice.
2. PM-15's systemd renderer knobs (KillMode, Requires, Type=oneshot,
   RemainAfterExit) → INTERNAL at beta.12: the renderer is CLI-kernel mechanism and the
   public knob surface is the deploy.targets config; the classification is explicitly
   re-decided at the PM-20 deploy-core move, where a published renderer would enter that slice's
   JSR/consumer gates.
3. SD-1's host-side surface (desktop-supervisor host, token broker, /_svc proxy internals,
   Job-Object wiring) → INTERNAL with a non-export invariant lint; the public consumption
   surfaces are exactly the feat(sdk): in-process link-mode adapter for single-process service mounting #451 SDK transport seam and SD-6's client/widget exports.

Process state

• Zero board mutations were made by this run (issues/labels/milestones untouched;
  evaluator-audited in every one of the nine cycles). The RFC: single deployment — enterprise installation layer, update lifecycle, PM foundation, single-runtime composition #820 RFC comment and the drafts/
  board-adjustment files remain gated on a PASS from the final eval, which the owner runs
  directly (recipe in context-pack.md § "How the owner runs cycle 10"), followed by stage-H
  ratification of OF-A..OF-K.
• Do not treat this PR as design ratification; it lands the record. Merge whenever convenient —
  nothing downstream executes from the merge itself.

🤖 Generated with Claude Code

https://claude.ai/code/session_016wV13zTE9bz2Yf1iR762qZ

[rickylabs]

@openhands-agent model=openrouter/minimax/minimax-m3 output=pr-comment iterations=100

use harness

SKILL

• netscript-harness — preserve evaluator separation and record a concise, evidence-based verdict.
• netscript-tools — use repository-native commands and keep lock/worktree state clean.
• openhands-handoff — honor the pr-comment output contract and write the required summary.
• netscript-cli — hand-test scaffold and documented CLI commands when executable claims exist.
• rtk — keep changed-file and command inspection compact.

Act as a cheap-and-quick documentation accuracy evaluator. Do not edit source, documentation,
deno.lock, or run artifacts, and do not create commits. Write the complete result to
OPENHANDS_SUMMARY_PATH; output mode pr-comment will publish that result as the single PR
comment.

1. Identify every changed documentation file in this PR and read each one fully. Include Markdown,
   MDX, READMEs, RFCs, harness/process docs, and skill instructions; do not review only the diff
   hunks.
2. For every executable claim, QUICKLY hand-test the exact documented command or snippet from the
   repository root. Use the smallest representative scaffold/workspace needed, compare real output
   and generated paths with the document's claim, and stop after the highest-value small checks. Do
   not substitute a full expensive E2E suite for a focused manual check.
3. If the changed set contains no executable command, snippet, flag, verb, or path claim, say
   exactly:
   No executable documentation claims in this changed set; manual command testing was not applicable.
   Full accuracy and hallucination review is still mandatory.
4. Check every named command verb, flag, file path, package, API, and expected output against the
   repository. Any hallucinated or nonexistent verb, flag, or path is a BLOCKING finding.
5. Return a compact per-file table with accurate, inaccurate, or unverifiable, the commands or
   snippets tested, observed-versus-claimed output, and blocking findings. End with one overall
   PASS or FAIL_FIX verdict and a short list of exact fixes.

Keep the iteration budget small. Prefer one to three decisive manual checks over broad exploration,
but never omit a changed documentation file from the per-file verdict table.

[rickylabs]

OpenHands Agent — Agent failed

OPENHANDS_VERDICT: NONE

Model: openrouter/minimax/minimax-m3
Provider: OPENROUTER
Job status: failure
Verdict source: none
Summary source: none
Housekeeping: ack=success trace=success commit-artifacts=success replies=skipped draft-pr=skipped
Trace: .llm/tmp/run/openhands/pr-821/run-29595303240-1 (in the Actions artifact)
Artifact: openhands-agent-29595303240-1

OpenHands Agent Summary

The agent run failed before producing a summary.

This is a workflow failure, not a task verdict.

Diagnostics

• Bootstrap: success
• Agent: failure
• Model: openrouter/minimax/minimax-m3
• Provider: OPENROUTER
• Output mode: pr-comment
• Run: https://github.com/rickylabs/netscript/actions/runs/29595303240

See the uploaded Actions artifact for bootstrap.log and agent.log when present.

Run: https://github.com/rickylabs/netscript/actions/runs/29595303240

[rickylabs]

Closed: opened from the stale local feat/beta10-cli-integration branch by mistake. The run record is re-landed on a fresh branch from main (plan/rfc-single-deployment); the superseding PR carries the same summary. The accidental remote branch is deleted.