{
  "schema": "bbi.pstack-program-workgraph/v1",
  "programme": "authentik-rke2-reliability",
  "authority": "https://github.com/Biji-Biji-Initiative/bbi-infrastructure/issues/11515",
  "wip": {
    "mutation_slots": 2,
    "classes": ["ci-control", "runtime-remediation"]
  },
  "status_vocabulary": [
    "BLOCKED",
    "READY",
    "ACTIVE",
    "SOURCE_FIXED",
    "MERGED",
    "REALIZED",
    "VERIFIED",
    "SOAKED",
    "SUPERSEDED",
    "CLOSED"
  ],
  "tranches": [
    {
      "id": "PSTACK-000",
      "title": "Admit the causal-truth foundation",
      "priority": 0,
      "owner_role": "independent-reviewer",
      "mutation_class": "ci-control",
      "status": "READY",
      "dependencies": [],
      "coordination_key": "pstack-foundation",
      "owned_paths": [
        "config/pstack-evidence-contract.json",
        "config/pstack-program-workgraph.json",
        "docs/architecture/pstack-causal-truth-plane.md",
        "docs/runbooks/pstack-agent-loop.md",
        "scripts/ops/pstack/pstack_evidence.py",
        "scripts/qa/test-pstack-evidence-contract.py"
      ],
      "first_legal_action": "Run an independent exact-head review and hostile suite.",
      "success_receipt": "PSTACK_FOUNDATION_MERGED",
      "abort_conditions": [
        "exact head moved",
        "hostile test fails",
        "contract permits a universal claim on partial evidence"
      ],
      "non_goals": [
        "No production mutation",
        "No new collector",
        "No replacement of canonical domain authorities"
      ]
    },
    {
      "id": "PSTACK-110",
      "title": "Shadow-adopt bounded Linux process truth",
      "priority": 1,
      "owner_role": "mode-s-runtime",
      "mutation_class": "runtime-remediation",
      "status": "BLOCKED",
      "dependencies": ["PSTACK-000"],
      "coordination_key": "mode-s-process-truth",
      "owned_paths": ["internal/ci/mode_s/execution/**"],
      "first_legal_action": "Compare existing #11478 envelopes against the shared contract without changing consumers.",
      "success_receipt": "PROCESS_TRUTH_SHADOW_AGREEMENT",
      "abort_conditions": ["unbounded procfs read", "PID identity race", "helper leak budget exhausted"],
      "non_goals": ["No signal or reap behavior change"]
    },
    {
      "id": "PSTACK-111",
      "title": "Prove scheduler-state classification",
      "priority": 1,
      "owner_role": "mode-s-runtime",
      "mutation_class": "runtime-remediation",
      "status": "BLOCKED",
      "dependencies": ["PSTACK-110"],
      "coordination_key": "mode-s-process-truth",
      "owned_paths": ["scripts/ops/fastlane/protected-candidate/**", "scripts/qa/test-mode-s-*.py"],
      "first_legal_action": "Plant R/S/D/Z fixtures and kill the all-R mutation.",
      "success_receipt": "PROCESS_STATE_CLASSIFIER_MUTATION_KILLED",
      "abort_conditions": ["fixture does not exercise production parser"],
      "non_goals": ["No candidate attribution from a bare PID"]
    },
    {
      "id": "PSTACK-112",
      "title": "Bound every potentially blocking procfs read",
      "priority": 0,
      "owner_role": "mode-s-runtime",
      "mutation_class": "runtime-remediation",
      "status": "BLOCKED",
      "dependencies": ["PSTACK-110"],
      "coordination_key": "mode-s-process-truth",
      "owned_paths": ["internal/ci/mode_s/execution/**"],
      "first_legal_action": "Run stack/wchan/syscall reads in isolated helpers with per-surface deadlines and a locked leak budget.",
      "success_receipt": "PROCFS_BLOCKING_READ_BOUNDED",
      "abort_conditions": ["unreaped helper budget exceeded", "collector blocks caller"],
      "non_goals": ["No always-on process monitor"]
    },
    {
      "id": "PSTACK-210",
      "title": "Add executable Mode S attribution-hold resolution",
      "priority": 1,
      "owner_role": "mode-s-lifecycle",
      "mutation_class": "ci-control",
      "status": "BLOCKED",
      "dependencies": ["PSTACK-000", "PSTACK-111", "PSTACK-112"],
      "coordination_key": "mode-s-attribution",
      "owned_paths": ["internal/ci/mode_s/candidate_lifecycle/**", ".github/workflows/mode-s-*.yml"],
      "first_legal_action": "Separate ATTRIBUTION_HOLD from permanent typed-red quarantine.",
      "success_receipt": "ATTRIBUTION_RESOLUTION_STATE_MACHINE_VERIFIED",
      "abort_conditions": ["typed-red quarantine can be exonerated", "resolution is not bound to original hold digest"],
      "non_goals": ["No retrospective rewrite of historical evidence"]
    },
    {
      "id": "PSTACK-310",
      "title": "Emit the admission-to-merge process vector",
      "priority": 0,
      "owner_role": "ci-control",
      "mutation_class": "ci-control",
      "status": "BLOCKED",
      "dependencies": ["PSTACK-000"],
      "coordination_key": "conveyor-02",
      "owned_paths": [".github/workflows/policy-admission-*.yml", "scripts/ci/app-only-merge-*.py", "scripts/ops/butler/**"],
      "first_legal_action": "Observe one exact PR generation and report the first missing edge.",
      "success_receipt": "ADMISSION_PROCESS_VECTOR_EMITTED",
      "abort_conditions": ["head moved", "check census incomplete", "trusted-row cardinality ambiguous"],
      "non_goals": ["No merge authority in the observer"]
    },
    {
      "id": "PSTACK-311",
      "title": "Repair the first missing admission edge",
      "priority": 0,
      "owner_role": "ci-control",
      "mutation_class": "ci-control",
      "status": "BLOCKED",
      "dependencies": ["PSTACK-310"],
      "coordination_key": "conveyor-02",
      "owned_paths": [".github/workflows/policy-admission-*.yml", "scripts/ci/app-only-merge-*.py", "scripts/ops/butler/**"],
      "first_legal_action": "Modify only the publisher, reconciler, or merger edge identified by PSTACK-310.",
      "success_receipt": "NATURAL_BUTLER_CONVERSION_VERIFIED",
      "abort_conditions": ["retrospective pre-merge receipt", "operator performs canary merge", "receipt not exact-head bound"],
      "non_goals": ["No new merge controller"]
    },
    {
      "id": "PSTACK-410",
      "title": "Trace sustained stream survival",
      "priority": 0,
      "owner_role": "underlay-truth",
      "mutation_class": "read-only",
      "status": "BLOCKED",
      "dependencies": ["PSTACK-000"],
      "coordination_key": "issue-10080",
      "owned_paths": ["scripts/ops/network/**", "scripts/qa/*egress*", "docs/evidence/network/**"],
      "first_legal_action": "Capture natural Longhorn, Git, and GHCR streams with route/MTU/TCP/RST identity.",
      "success_receipt": "STREAM_FAILURE_EDGE_IDENTIFIED",
      "abort_conditions": ["synthetic load risks a crown jewel", "stream identity incomplete"],
      "non_goals": ["No timeout or concurrency increase"]
    },
    {
      "id": "PSTACK-420",
      "title": "Trace one critical alert to acknowledgement",
      "priority": 0,
      "owner_role": "incident-routing",
      "mutation_class": "read-only",
      "status": "BLOCKED",
      "dependencies": ["PSTACK-000"],
      "coordination_key": "alert-lifecycle",
      "owned_paths": ["platform/monitoring/**", "docs/runbooks/**"],
      "first_legal_action": "Follow one firing Longhorn critical through Alertmanager, receiver, external message ID, and acknowledgement.",
      "success_receipt": "FIRST_MISSING_ALERT_EDGE_IDENTIFIED",
      "abort_conditions": ["alert fingerprint changed", "route census incomplete"],
      "non_goals": ["No duplicate alert"]
    },
    {
      "id": "PSTACK-510",
      "title": "Publish evidence-addressed agent handoffs",
      "priority": 1,
      "owner_role": "agent-control-plane",
      "mutation_class": "ci-control",
      "status": "BLOCKED",
      "dependencies": ["PSTACK-000", "PSTACK-310", "PSTACK-410", "PSTACK-420"],
      "coordination_key": "agent-mission-control",
      "owned_paths": ["CONTROL.md", "specs/agent-control-plane.md", "bin/gitops-ops"],
      "first_legal_action": "Attach a compact frontier handoff and bundle digest to one live programme transition.",
      "success_receipt": "FRESH_AGENT_TAKES_CORRECT_FIRST_MOVE",
      "abort_conditions": ["handoff contains uncited facts", "evidence expired", "raw secret-bearing payload embedded"],
      "non_goals": ["No second work tracker"]
    }
  ]
}