Board: integrate head-bound evidence and qualify local and hosted session visibility

[jeffhuber]

Part of #945 and roadmap #900.

Integrated Board qualification

PR #1003 merged as 6501feb4185e98c971b93dac18f46c37514bee79 after an independent exact-head Claude PASS with P0/P1/P2=0, focused and privacy validation, full CI, Board qualification and authoritative code-mower/gate.

Accepted

• Active work, next action/actor and per-source freshness are visible at desktop and phone widths.
• Fresh work without a PR and distinct review/implementation/merge states are covered.
• Gate publisher, authoritative gate verdict, CI, audit, merge state and human policy remain independent evidence.
• Fresh, stale, unreachable, restarted, waiting, failed, cancelled, unlinked, no-work, multiple-worktree and historical cases pass deterministic regression.
• Local maintained-path qualification and privacy-safe fixtures pass.
• Time, cost and outcome values carry coverage; absent data remains unknown.
• Private session/provider/context/Slack/Graphify/source/path content is excluded.
• A concrete operator checklist covers the external hosted observation.

Hosted observation

• One bounded hosted Devin canary produced the same closed Board projection.

The v1.5.1 qualification used one explicitly authorized task and one provider create under a 2 ACU / $100 campaign cap. Code Mower verified the exact draft PR head, observed provider and reviewer exit separately, obtained independent exact-head Claude and Codex PASS verdicts, observed the authoritative gate pass, and recorded fresh provisional usage of 0.0 ACU. No retry, clarification, fix, recovery create, merge, or auto-merge occurred. The candidate Board service was verified on v1.5.1 with redacted local paths and no private task, provider-session, Slack, credential, or account data in public evidence.

[jeffhuber]

Work Order: integrate and qualify head-bound Board evidence

Build issue #951 on current main after merged PRs #1000, #1001, and #1002. Produce one focused draft PR and keep one writer on its branch. Do not launch paid or hosted sessions in this writer lane.

Integrate the work-first Board with local and remote observation contracts so exact-head PR/review/CI/gate, worktree, restart, freshness, provider, and session-outcome facts remain independent. Implement deterministic next-action/next-actor precedence and a sanitized qualification scorecard with explicit coverage.

Required regression/fixture coverage:

• fresh run without PR; review requested/running/changes requested; implementation complete without review/merge completion;
• behind-main plus review-needed grouped once, with routine remediation excluded from owner-decision counts;
• independent gate publisher, authoritative gate verdict, required/sampled CI, exact-head audit, merge state, and human policy evidence;
• fresh, stale, unreachable, restarted, waiting, failed, cancelled, unlinked, no-work, multiple-worktree, and historical-running sources;
• Release evidence: separate completion, provider exit, usage settlement, and cloud freshness #976 distinctions: implementation complete while provider active/unknown, cancellation accepted before observed exit, user-cancelled-before-delivery, exact-head contributor/reviewer exclusion, and missing/unsettled usage;
• desktop and phone discoverability against live-shaped privacy-safe fixtures, with active work, next action/actor, and freshness visible without opening private details;
• measured time/cost/outcomes always include coverage; missing/partial data stays unknown and never becomes zero or a productivity claim;
• privacy assertions exclude private session/provider/context/Slack/Graphify/source/path content.

Exercise one maintained local execution path in tests or a bounded local canary. Represent the planned hosted Devin canary through the closed #976 contract and a concrete operator checklist, but do not create a paid session; the orchestrator will separately obtain a campaign cap before that final external action. Do not change Slack/cloud mappings or add provider mutations.

Run permitted focused tests, privacy and package checks, open a draft PR linked to #951, request an independent Claude exact-head audit, and stop without merging.

[jeffhuber]

Draft delivery: #1003

Builder: Code Mower Codex, single writer. The first CI qualification passed all 8 contract/lifecycle suites and caught a phone first-viewport failure. The follow-up moves summary cards below active work and requires a fresh explicit policy observation before merge readiness. The same branch is being revalidated; an independent Claude exact-head audit remains requested.

No paid/hosted sessions or provider mutations were performed. Live hosted Devin execution and human discovery timing remain unmeasured and have an operator checklist in the PR. Slack/cloud mappings are unchanged.

[jeffhuber]

PR #1003 merged as 6501feb4185e98c971b93dac18f46c37514bee79 after exact-head Claude PASS (P0/P1/P2=0), full CI, Board qualification, privacy/focused verification, and authoritative code-mower/gate.

This issue remains open only for the acceptance criterion requiring one bounded hosted Devin canary to produce the same closed Board projection. The canary requires a new explicit campaign-wide ACU cap; no prior #935 allowance will be reused. Release preparation may proceed in parallel, but #951 will close only after that observed canary result is recorded.