PLAN.md gains §15 and the phase-2 row is marked done.
What the phase found worth recording:
- The starting position was worse than the row implied: phase 1 built five
guards and ran every one by hand, because the repo had no .gitea/workflows at
all. So the org lead widened the phase to include the gate, not only the
release (D4), and the frozen-manifest job shipped with it rather than waiting.
- That job answers a question §13 had to take on trust. Core mounts /status and
/version at a tier root where the loader's collision probe cannot see them, so
phase 1 could only check /rust by reading. Locally and in CI, against the same
pinned core: 280 core routes, 6 added, all documented, none of core's moved.
- The bundle carries no node_modules (D5), and checkBundle.js asserts the
emptiness rather than assuming it — the day a dependency appears is meant to
be a loud day. Verified by breaking the include list.
- No Sonar for the three Rust repos until phase 19 (D6).
- The criterion is met. v0.1.0 published, downloaded, hashed independently
(7296c76b… matches the manifest), and installed from its manifest URL through
Admin → Modules into a core with the phase-1 directory and row torn down
first. The volume received exactly the twenty files the include list names;
the row reads started with a source and a sha where phase 1's had nulls; the
public route answers 200, the player and admin tiers 401, and all five /rust
paths merged into core's own spec.
- REGISTRY_TOKEN was already configured — the one prerequisite this work could
not check for itself, since the bot can read no Actions secrets.
- One rig finding: Docker Desktop's Linux engine was found dead and answered
every call with a bare 500, which presents as the website being broken.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4
wtclaude
5274d5a744