Record owner rulings resolving registry review gates

docs/SESSIONS.md

@@ -170,3 +170,5 @@ are never rewritten or removed; corrections are new entries.
 - 2026-09-10 — darkwing — Owner ruled yes to all three O3 decisions (fork pins original account; unpinned relaunch uses profile default; named launch profiles deferred). Registry draft gates 5/6 marked RESOLVED and runtime-selection section revised to per-execution semantics. Pending focused r2 review before any commit.
 
 - 2026-09-10 — darkwing — REGISTRY-GATE7-FILBERT-R2 follow-up APPROVED at 2ec6634f; owner rulings and draft revision committed at b8008eda and pushed, fresh remote identity verified. Documentation only; gates 2/3/4/7/8/9/10 remain owner decisions, no implementation authorized.
+
+- 2026-09-10 — darkwing — ms-grill-me rounds 1-2: owner resolved remaining registry gates 2/3/4/8/9/10 and new-model Q8 (per-execution selection); pi pin moves to 0.85.1; remote Ollama http needs allowInsecureTransport flag; fixtures now with optional later real Ollama; OpenBao recorded as future seam only. Draft gate list updated. Gate 7 refresh investigation authorized read-only against 0.85.1.

docs/plans/2026-09-03_auth-provider-harness-registry.md

@@ -470,34 +470,44 @@ No named accounts currently exist, so migration is state-free:
 1. **RESOLVED (owner, #50):** canonical harness IDs are executable names:
    `pi`, `claude`, `codex`, `opencode`; validation is registry/manifest-driven,
    not a schema enum. `mosaic harness detect/install/list/rm/status` owns the
-   lifecycle. Remaining seam to approve: detected host executables are
+   lifecycle. Detected host executables are available but not launch-ready
-   available but not launch-ready under the container boundary until
+   under the container boundary until imported/installed into a managed
-   imported/installed into a managed runtime (unless host execution receives a
+   runtime (unless host execution receives a separate reviewed adapter).
-   separate reviewed adapter).
+2. **RESOLVED (owner, 2026-09-10):** one-time reviewed cutover to
-2. Confirm `agentVersion: 2` migration and whether `settingsProfile` becomes
+   `agentVersion: 2`; `settingsProfile` is mandatory for defined seats. v1
-   mandatory for defined seats.
+   seats resolve to `pi` with a loud deprecation warning until migrated.
-3. Confirm registry path/schema split (`account.json` metadata +
+3. **RESOLVED (owner, 2026-09-10):** keep the split — `account.json` non-secret
-   `credential.json` secret) versus one encrypted/combined file.
+   metadata + `credential.json` secret, both 0600.
-4. Decide encryption-at-rest requirement. Filesystem 0600 is specified now;
+4. **RESOLVED (owner, 2026-09-10):** filesystem 0600 now. OpenBao is the
-   external keyring/envelope encryption would change login/refresh design.
+   intended eventual secret backend; the credential-type field and materializer
-5. **RESOLVED (owner, 2026-09-10):** named launch profiles are deferred. Per-execution
+   interface are the design seam. No OpenBao work is authorized yet.
-   selection recorded in execution records/context manifests (per the Gate 7
+5. **RESOLVED (owner, 2026-09-10):** named launch profiles are deferred.
-   reconciliation and #53 model) covers the need; a named-profile layer would be
+   Per-execution selection recorded in execution records/context manifests
-   a separate future decision if a use case emerges.
+   (per the Gate 7 reconciliation and #53 model) covers the need; a named-profile
-6. **RESOLVED (owner, 2026-09-10):** forked sessions pin the original account in
+   layer would be a separate future decision if a use case emerges.
-   immutable session metadata. Ordinary relaunches of an unpinned session
+6. **RESOLVED (owner, 2026-09-10):** forked sessions pin the original account
-   materialize the current profile default. Selection changes apply between
+   in immutable session metadata; unpinned relaunches materialize the current
-   executions, never mid-session.
+   profile default; selection applies between executions, never mid-session.
-7. Determine pi's supported host-side noninteractive OAuth refresh trigger;
+7. **PARTIALLY RESOLVED (owner, 2026-09-10):** the pin moves to pi 0.85.1
-   implementation must prove refresh without exposing or duplicating tokens.
+   (exact). A bounded read-only investigation of the 0.85.1 package will
-8. Confirm local Ollama container routing (`host-gateway`) and remote Ollama
+   determine the supported noninteractive OAuth refresh path; owner approves
-   transport/auth requirements.
+   the mechanism from those findings before implementation. Refresh stays
-9. Decide whether M20 `packages/mosaic` begins with this auth/provider/harness
+   host-side, fail-closed, no token exposure or duplication.
-   domain or whether scripts prototype it first. Confirm managed harness
+8. **RESOLVED (owner, 2026-09-10):** local Ollama routes via `host-gateway`
-   packaging: harness-specific container image/bundle survives dataRoot reset;
+   (`http://host.docker.internal:11434/v1`). Remote Ollama supports http and
+   https; plain http requires an explicit per-provider `allowInsecureTransport:
+   true` flag (loud, opt-in, audited). Ollama is not currently installed on the
+   workstation; suites use fixtures/mocks, and the owner may install Ollama
+   with a small model for real-endpoint testing later.
+9. **RESOLVED (owner, 2026-09-10):** M20 `packages/mosaic` begins with the
+   auth/provider/harness domain. `scripts/auth.sh` becomes a thin compatibility
+   shim over it, removed at the version-2 cutover. Harness runtime bundles
+   package beside the active release image so `reset.sh` does not destroy them;
    registry state and receipts remain under dataRoot.
-10. Define backup/reset semantics for the central registry. Current reset wipes
+10. **RESOLVED (owner, 2026-09-10):** registry stays inside the data root;
-    the data root; OAuth re-login cost may justify a separately protected
+    `reset.sh` keeps wiping it but prints a loud warning about OAuth re-login
-    registry root, but that would require an explicit canon change.
+    cost. Revisit a separate protected registry root only if re-login pain
+    proves real (would be a canon change).
 
-Implementation is blocked until these gates are reviewed and owner-approved.
+Remaining open item before implementation: gate 7's 0.85.1 refresh investigation
+findings and the owner's approval of the refresh mechanism it proposes.