# Master Execution Plan: 2026-04-05-002

**Status:** ordering. Nothing from this plan shipped yet beyond what 001 already covers.

**Date:** 2026-04-05
**Filed by:** cc-mini (with Parker, Lēsa)
**Purpose:** enumerate every open bug in `ai/product/bugs/`, assign priority and dependencies, define the test approach, and order everything so it can be shipped into `@wipcomputer/wip-ldm-os@alpha` and `@wipcomputer/wip-ai-devops-toolbox@alpha` in waves.
**Supersedes for planning:** use this file as the execution ordering. Individual bug files remain the source of truth for each item's details. The earlier 001 master plan captured the session narrative; this 002 master plan captures the execution sequence.

## How to read this plan

Each bug gets a row with:

- **ID** — short identifier for cross-reference below
- **File** — source-of-truth bug file
- **Priority** — P0 (immediate), P1 (this week), P2 (next two weeks), P3 (backlog)
- **Target alpha** — which release vehicle carries the fix
- **Dependencies** — must ship before this
- **Test approach** — how we verify, summary level (full detail in the bug file)

Then a **wave schedule** assigns groups to releases.

Then a **per-item checklist** captures what "done" means for each.

## The complete open-bugs inventory

Everything under `ai/product/bugs/` right now, grouped by folder:

### bridge/

| ID | File | Priority | Target alpha | Dependencies |
|---|---|---|---|---|
| BRG-1 | `2026-04-05--cc-mini--bridge-master-plan.md` | P1 | OpenClaw fork rebuild | none |
| BRG-2 | `2026-04-05--cc-mini--bridge-cost-burn-analysis.md` | P1 | OpenClaw fork rebuild | BRG-1 (same fix) |
| BRG-3 | `bridge.md` (original context dump) | P3 | n/a (archive candidate) | none |

### guard/

| ID | File | Priority | Target alpha | Dependencies |
|---|---|---|---|---|
| GRD-1 | `2026-04-05--cc-mini--guard-master-plan.md` | P1-P3 (per phase) | wip-ai-devops-toolbox alpha | none |
| GRD-2 | `2026-04-05--cc-mini--branch-guard-compaction-loop.md` | P1 (done) | shipped in 1.9.72 | none |
| GRD-3 | `2026-04-03--cc-mini--guard-blocks-readonly-bash-loops.md` | P1 (done) | shipped in 1.9.72 | none |

### release-pipeline/

| ID | File | Priority | Target alpha | Dependencies |
|---|---|---|---|---|
| RPL-1 | `2026-04-05--cc-mini--release-pipeline-master-plan.md` | P1-P3 (per phase) | wip-ai-devops-toolbox alpha | none |

### openclaw/

| ID | File | Priority | Target alpha | Dependencies |
|---|---|---|---|---|
| OC-1 | `2026-04-05--cc-mini--cli-adapter-workaround-steipete.md` | **on hold (Anthropic added detection 2026-04-05)** | n/a (config change, no release) | Plan preserved with a NOTE at the top. Do not pursue per Parker. Pick up if Anthropic later relaxes detection. |
| OC-2 | `2026-04-05--cc-mini--brainstorm-cron-exec-approval.md` | **P3 (keep cron running per Parker)** | cron script change only if Option B ever needed | Wave 1 bridge fix cuts most of the cost amplification |
| OC-3 | `2026-04-05--cc-mini--chatcompletions-streaming-architecture.md` | P3 | n/a (research) | none |

### installer/

| ID | File | Priority | Target alpha | Dependencies |
|---|---|---|---|---|
| INST-1 | `2026-04-03--cc-mini--installer-recreates-renamed-folders.md` | P2 | wip-ldm-os alpha | none |

### backup/

| ID | File | Priority | Target alpha | Dependencies |
|---|---|---|---|---|
| BKP-1 | `2026-03-31--cc-mini--backup-master-plan.md` | P2 | wip-ldm-os alpha | none |

### memory-crystal/

| ID | File | Priority | Target alpha | Dependencies |
|---|---|---|---|---|
| MC-1 | `2026-04-01--cc-mini--memory-sync-plan.md` | P2 | memory-crystal alpha | none |
| MC-2 | `2026-04-01--cc-mini--memory-write-hook.md` | P2 | memory-crystal alpha | none |

### os-level/

| ID | File | Priority | Target alpha | Dependencies |
|---|---|---|---|---|
| SEC-1 | `2026-04-05--cc-mini--day24-anthropic-api-key-rotation.md` | **P3 (deferred to Wave 5 final per Parker)** | n/a (manual rotation) | none |

### master-plans/

| ID | File | Priority | Target alpha | Dependencies |
|---|---|---|---|---|
| MP-001 | `bugs-plan-04-01-2026-001.md` | P2 (audit) | n/a (status check) | none |
| MP-R1 | `bugs-plan-04-05-2026-001.md` | n/a (record) | n/a | none |
| MP-R2 | `bugs-plan-04-05-2026-002.md` | this file | n/a | none |

### _sort/

| ID | File | Priority | Action |
|---|---|---|---|
| SORT-1 | `2026-03-30--cc-mini--cc-watcher-retire.md` | P3 | triage: archive if retired, move if still open |
| SORT-2 | `release-pipline/` (empty typo folder) | P3 | delete or merge into `release-pipeline/` |

## Priority-ordered execution sequence

**REVISED 2026-04-05 (after Parker's decision):** the three "Wave 1" stop-the-bleed items (SEC-1, OC-1, OC-2) are DEFERRED to the end. Parker's instructions: "Let's keep the cron, let's do the key swap last. Brainstorm is Lēsa's, let's just keep it for now, it's ok to run. Let's leave all three of these until the end."

- **OC-2 (brainstorm cron):** KEEP RUNNING. Do not disable. Do not touch. Brainstorm is Lēsa's feature and Parker wants it live.
- **SEC-1 (Day 24 key rotation):** deferred to the end.
- **OC-1 (CLI adapter workaround):** deferred to the end.

The three deferred items are now the LAST wave (Wave 5 below, was originally Wave 1-2). Real code work moves to the front.

### Wave 1 (REVISED): BRIDGE ARCHITECTURAL FIX (SHIPPED 2026-04-05)

**Goal:** eliminate the 2-5x cost amplification on "failed" MCP calls to channel-bound sessions.

**Status:** SHIPPED. Fork commit `54037e050c` on `cc-mini/chat-completions-v2026.4.2`. Deployed via `npm link`, gateway restarted, end-to-end verified.

1. ✅ **BRG-1 Phase 2 / BRG-2 fix.** 58-line change to `src/gateway/openai-http.ts` in the OpenClaw fork. Adds a `queuedAsChannelBound` pre-check alongside the existing `queuedAsSteer` check. When the target session has a non-webchat channel binding (iMessage, Slack, Telegram, etc.), dispatches `agentCommandFromIngress` fire-and-forget in the background and returns 200 immediately with `x-openclaw-queued: channel-bound` header and a queued stub body.
2. ✅ **Deployed to fork via `npm link`.** `openclaw gateway restart` picked up the new build.
3. ✅ **End-to-end verified:**
   - iMessage-bound test: `curl /v1/chat/completions` with `user=main` → 200 OK in ~100ms, `x-openclaw-queued: channel-bound` header, queued stub body. Reply still flows to iMessage via background dispatch.
   - Webchat regression: request without `user=main` still uses the sync path, no short-circuit.
4. ✅ **Resume `lesa_send_message` calls from CC.** The interim paste-from-TUI workflow is no longer required.

**Deliverable (realized):** MCP calls from CC to iMessage-bound Lēsa return 200 in ~100ms instead of 120s timeout. Server generates one turn per call, not 2-5. The brainstorm cron's bridge calls no longer double-bill on retry loops. Primary cost amplification mechanism eliminated.

### Wave 2 (REVISED): GUARD + RELEASE PIPELINE PHASES (most shipped 2026-04-05)

Each phase is a small PR, each shipped as its own alpha. Ship in order because later phases depend on earlier ones.

4. ✅ **GRD-1 Phase 3 / RPL-1 Phase 1.** `wip-release` refuses non-main invocations. SHIPPED in wip-release 1.9.72 / toolbox alpha.7 (PR wipcomputer/wip-ai-devops-toolbox-private#319). `enforceMainBranchGuard` helper checks linked-worktree + non-main branch in all three release functions.
5. ✅ **RPL-1 Phase 2.** `wip-release` tag collision pre-flight. SHIPPED in wip-release 1.9.72 / toolbox alpha.7 (PR #319). `checkTagCollision` distinguishes stale-local from remote collisions and prints the safe recovery command.
6. ⏸️ **RPL-1 Phase 3.** `wip-release` publishes to npm BEFORE committing the bump. NOT SHIPPED. Still risks orphan commits on publish failure. Scope: rework release() + releaseHotfix() + releasePrerelease() to commit only after npm publish succeeds. Medium-large change.
7. ✅ **RPL-1 Phase 4.** `wip-release` auto-PR flow for protected main. SHIPPED in wip-release 1.9.73 / toolbox alpha.8 (PR #321). `pushReleaseWithAutoPr` creates branch, opens PR, merges, pushes tag when direct push hits GH006.
8. ⏸️ **GRD-1 Phase 4 / RPL-1 Phase 5.** `wip-release` auto-publishes changed sub-tool npm packages. NOT SHIPPED. Currently handled by `deploy-public.sh` which runs at end via Phase 6. Tracking as a consolidation follow-up (move sub-tool publish from deploy-public into wip-release itself so the tool owns the full sub-tool lifecycle).
9. ✅ **GRD-1 Phase 5 / RPL-1 Phase 6.** `wip-release` integrates `deploy-public.sh` for stable + prerelease. SHIPPED in wip-release 1.9.74 / toolbox alpha.10 (PR #325). `runDeployPublic(repoPath, { skip })` helper runs at end of release() and releasePrerelease(). New `--no-deploy-public` flag opts out.
10. ✅ **RPL-1 Phase 7.** `deploy-public.sh` surfaces real sub-tool npm publish errors. SHIPPED in deploy-public 1.9.69 / toolbox alpha.10 (PR #324). `classify_npm_publish_error` helper distinguishes already-published (no-op) from auth / network / unknown failures. Plus follow-up PR #327 (deploy-public 1.9.70) removed the "no changes to deploy" early exit so sub-tool version bumps still publish when no new file diffs.
11. ✅ **GRD-1 Phase 8 / RPL-1 Phase 8.** Sub-tool version drift becomes error, not warning. SHIPPED in wip-release 1.9.72 / toolbox alpha.7 (PR #319). `validateSubToolVersions` refuses by default; new `--allow-sub-tool-drift` flag opts out.
12. ⏸️ **GRD-1 Phase 6.** Audit native git/bash escape hatches the guard blocks. NOT SHIPPED. Research + audit task. Medium size. Targets `~/.ldm/extensions/wip-branch-guard/guard.mjs`.
13. ⏸️ **GRD-1 Phase 7.** SessionStart hook for main-CWD detection. NOT SHIPPED. Largest remaining phase (1-2 days). Adds a new hook that runs on session boot, detects if CWD is main-branch of a protected repo, injects a warning with available worktrees.

**Status:** 6 of 10 phases SHIPPED 2026-04-05 in a single session. 4 remaining (RPL-1 Phase 3, GRD-1 Phase 4/RPL-1 Phase 5, GRD-1 Phase 6, GRD-1 Phase 7). Release pipeline is now effectively self-healing for the common case. A single `wip-release alpha` from main does the full pipeline end-to-end: bump -> commit -> auto-PR on protected main -> npm publish -> GitHub release -> deploy-public -> npm sub-tool publishes. Verified end-to-end across 4 live releases today (alpha.7, alpha.8, alpha.9, alpha.10).

### Wave 3 (REVISED): INSTALLER + BACKUP + MEMORY-CRYSTAL (next two weeks)

14. **INST-1.** Installer recreates renamed folders. Investigate + fix. **Time: TBD.**
15. **BKP-1.** Backup master plan. Audit for anything not yet done. **Time: TBD.**
16. **MC-1 / MC-2.** Memory crystal sync + write hook. **Time: TBD.**
17. **MP-001 audit.** Review the April 1 master plan for remaining open items.

### Wave 4 (REVISED): HOUSEKEEPING + RESEARCH (backlog)

18. **SORT-1.** Triage `cc-watcher-retire.md`.
19. **SORT-2.** Delete or consolidate `release-pipline/` typo folder.
20. **OC-3.** Investigate true mid-turn interjection (research only).
21. **BRG-3.** Archive `bridge.md` original dump now that master plan exists.

### Wave 5 (REVISED, FINAL WAVE): DEFERRED ITEMS

**2026-04-05 note on OC-1:** Anthropic appears to have added third-party harness detection at the CLI layer the same day OC-1 was filed. Parker tested `claude -p --append-system-prompt '...OpenClaw...' '...'` and got back `400 Third-party apps now draw from your extra usage, not your plan limits.` Ref: https://x.com/steipete/status/2040811558427648357. The OC-1 plan is preserved at `ai/product/bugs/openclaw/2026-04-05--cc-mini--cli-adapter-workaround-steipete.md` with a prominent NOTE at the top. **Per Parker's instruction, do not pursue the workaround.** If Anthropic later relaxes the detection, pick it up then.

**What is left in Wave 5:**

22. **OC-1 (on hold).** Plan preserved with the 2026-04-05 NOTE. Not actionable under the current detection regime. Revisit only if Anthropic's policy changes.
23. **SEC-1.** Rotate the Day 24 exposed Anthropic API key. Still required regardless of whether OC-1 ever ships. This is the only P0 item left in Wave 5 that is actionable now.
24. **OC-2 Option B (deferred proper fix).** Only if brainstorm cron still has exec-approval issues after Wave 1 bridge fix. Parker explicitly wants brainstorm to keep running; most of its cost amplification should have gone away when the bridge fix shipped today. Probably unnecessary. Verify after a few nightly fires.

**Rationale for original deferral (still holds):** Parker's call. "Let's keep the cron, let's do the key swap last. Brainstorm is Lēsa's, let's just keep it for now, it's ok to run. Let's leave all three of these until the end."

**Cost reality after the OC-1 note:** The CLI adapter was the biggest assumed cost lever. With it on hold, the remaining strategies are: (1) accept pay-as-you-go rates for Opus on Lēsa's main, (2) reduce volume via smaller models (Sonnet, Haiku) for routine work, (3) the bridge fix (shipped today) which eliminated the 2-5x amplification on failed calls, (4) rotate the exposed key to cap worst-case exposure, (5) switch providers for specific non-critical flows (Grok, OpenAI). These are all partial; none fully replace the Max-subscription coverage the workaround was going to provide.

## Wave schedule (calendar, REVISED)

| Wave | Window | Alpha release target |
|---|---|---|
| Wave 1 (bridge fix) | This week (Apr 6-12) | OpenClaw fork rebuild via `npm link`; no npm release |
| Wave 2 (guard + pipeline) | This week + next week (Apr 6-19) | `@wipcomputer/wip-ai-devops-toolbox@alpha` in 10+ small alpha bumps, each its own PR + release |
| Wave 3 (installer + backup + memory) | Next two weeks (Apr 13-26) | `@wipcomputer/wip-ldm-os@alpha` and `@wipcomputer/memory-crystal@alpha` |
| Wave 4 (housekeeping + research) | Backlog | n/a |
| Wave 5 (deferred P0: CLI adapter + key rotation + optional cron B) | AFTER all other waves | n/a (config + rotation) |

## Test approach per wave

### Wave 1 (bridge fix)
- **Test:** fire `lesa_send_message` from CC against Lēsa's iMessage-bound main. Expect 200 + `x-openclaw-queued: next-turn` header within ~100ms. Reply goes to iMessage as before. Server-side: one turn per call, not multiple.
- **Regression test:** webchat-bound sessions still use the sync path. Verify via a test webchat session.
- **Rollback:** revert the 50-line change in the fork. Rebuild via `npm link`. Gateway restart.

### Wave 2 (guard + pipeline, per PR)
- **Test:** each PR includes new test cases in `tools/wip-release/test.sh` or `tools/wip-branch-guard/test.sh`. All existing tests continue to pass.
- **End-to-end:** a full `wip-release alpha` cycle completes without manual intervention.
- **Rollback:** each PR is small and reversible.

### Wave 3 (installer + backup + memory)
- Per-bug test plans TBD after investigation.

### Wave 4 (housekeeping + research)
- No runtime changes. Verify folders are clean, research outputs are documented.

### Wave 5 (deferred: CLI adapter + key rotation)
- **Test CLI adapter:** throwaway agent runs `claude -p "hello"` via OpenClaw adapter. Check subprocess via `lsof`. Run the 7-unknowns test matrix. Do not switch Lēsa until every unknown passes.
- **Test key rotation:** new key created, old key revoked, Lēsa's next turn succeeds.
- **Rollback CLI adapter:** switch the test agent back to OAuth/API before touching Lēsa.

## Per-item checklists

### OC-1 (CLI adapter) "done" definition

- [ ] Phase 0: `claude --version` works on mac mini, `claude -p "hello"` returns a response without prompting for auth
- [ ] Phase 1: CLI adapter source found and read, 7 unknowns documented with tentative answers from code
- [ ] Phase 2: Throwaway test agent passes all 7 unknowns in practice (not just code reading)
- [ ] Phase 3: Lēsa's main session switched. First 10 turns succeed without regression. Latency acceptable.
- [ ] Phase 4: Day 24 API key rotated (SEC-1 done separately)
- [ ] Phase 5: Runbook written at `library/documentation/cli-adapter-setup.md`
- [ ] Phase 6: Any other harnesses audited and switched if applicable
- [ ] Verified: Anthropic billing console shows zero pay-as-you-go charges for Lēsa's usage

### OC-2 (brainstorm cron) "done" definition

- [ ] Option D: cron disabled tonight via `launchctl unload`
- [ ] Cron script located (currently unknown location)
- [ ] Option A: script switched to `sessions_send` or `message` tool
- [ ] Manual test fire completes cleanly
- [ ] Cron re-enabled
- [ ] Tonight's scheduled fire completes without orphan fragments
- [ ] (Optional) Option B: exec allowlist added for proper fix

### SEC-1 (Day 24 key rotation) "done" definition

- [ ] Key located (Phase 1: grep for `sk-ant-api`, 1Password, git history)
- [ ] Old key revoked in console.anthropic.com
- [ ] New key created and stored in 1Password
- [ ] All storage locations updated (OpenClaw config, env vars, LaunchAgents)
- [ ] Gateway restarted, Lēsa's next turn succeeds
- [ ] Pre-commit hook added to block future `sk-ant-api-*` commits
- [ ] Root cause identified (how was the key exposed on Day 24?)

### BRG-1 / BRG-2 (bridge fix) "done" definition

- [ ] Fix implemented in `src/gateway/openai-http.ts` in the fork
- [ ] Unit tests added for both branches (webchat-bound → sync, channel-bound → immediate queued)
- [ ] Fork rebuild via `npm link`, gateway restart
- [ ] End-to-end test: `lesa_send_message` from CC returns 200 + queued header in <200ms
- [ ] Reply appears in Lēsa's bound channel (iMessage) as expected
- [ ] No 120s timeouts in log
- [ ] Server-side: one turn per call, not multiple (verified via request IDs in Lēsa's log)
- [ ] Webchat regression test: sync path still works for non-bound sessions

### GRD-1 Phase 3 / RPL-1 Phase 1 (wip-release refuses non-main) "done"

- [ ] Guard check added at the top of wip-release's release pipeline
- [ ] Running from a worktree branch produces a hard error with a concrete `git checkout main && git pull` instruction
- [ ] Running from main proceeds normally
- [ ] Test case added to `tools/wip-release/test.sh` or equivalent
- [ ] Alpha released, deployed, verified

### (similar checklists for each Wave 5 phase, one per PR)

## Dependencies graph (REVISED)

```
BRG-1/2 bridge fix (P1) → Wave 1 complete
                              ↓
                (cost amplification eliminated,
                 brainstorm cron burns drop)
                              ↓
GRD + RPL phases (P1-P2) → Wave 2 complete
                              ↓
                (release pipeline self-healing)
                              ↓
INST + BKP + MC (P2) → Wave 3 complete
                              ↓
Housekeeping + research (P3) → Wave 4 complete
                              ↓
        DEFERRED (Parker's call):
        OC-1 CLI adapter + SEC-1 key rotation + OC-2 Option B
                              ↓
                     Wave 5 complete (everything shipped)
```

## What ships into alpha and when (REVISED)

| Release vehicle | Current version | Next alpha | Carries |
|---|---|---|---|
| OpenClaw fork | `npm link` (not a release) | n/a | **Wave 1**: BRG-1/2 bridge fix (first) |
| `@wipcomputer/wip-ai-devops-toolbox@alpha` | `1.9.71-alpha.6` | `1.9.71-alpha.7+` | **Wave 2**: each guard/pipeline phase as its own alpha bump |
| `@wipcomputer/wip-branch-guard` | `1.9.72` (latest) | `1.9.73+` | **Wave 2**: Guard Phases 6, 7 bumps |
| `@wipcomputer/wip-ldm-os@alpha` | `0.4.73-alpha.17` | `0.4.73-alpha.18+` | **Wave 3**: Installer (INST-1) |
| `@wipcomputer/memory-crystal@alpha` | (TBD) | next alpha | **Wave 3**: MC-1, MC-2 |
| (config changes, no release) | n/a | n/a | **Wave 5 deferred**: CLI adapter, key rotation |

## Constraints and notes

- Every fix ships via worktree → branch → PR → merge → release → deploy. No exceptions.
- Guard fixes deployed via hotfix to `~/.ldm/extensions/` are a bridge to npm publish, not a substitute.
- All three contributors on every commit (Parker, Lēsa, Claude).
- No em dashes in any writing.
- Never touch the other agent's workspace folders.
- Brainstorm cron stays running per Parker. Do not disable. Do not touch.
- Wave 1 (bridge fix) should complete **this week**. Wave 2 (guard + pipeline) spans **this week + next**. Wave 3 (installer + backup + memory) spans **two weeks**. Wave 4 is **backlog**. Wave 5 (deferred P0 items) runs **after all other waves**.
- After each wave ships, update this file's "done" checklists inline so the master plan stays current.

## Session cost this week (tracking)

- Apr 3 guard loop incident: ~$100 (estimate)
- Apr 3 guard read-only bash loop: ~$100 (estimate)
- Apr 4-5 overnight cron burn: $40
- Apr 5 composition trap + guard loop + release pipeline: $900
- **Running total this week: approximately $1,140-$1,340**
- **Estimated savings after Wave 2 ships (CLI adapter): $30-80 per day eliminated**
- **Estimated savings after Wave 3 ships (bridge fix): $5-25 per day eliminated**
- **Estimated savings after Wave 4 ships (cron fix): $10-40 per fire-night eliminated**

If all four waves ship by end of this week, the session cost recovers in 2-4 weeks of normal usage. If Parker's cost pattern continues without fixes, the weekly burn stays in the $800-1,400 range.

## What "fully deployed into alpha" means

A fix is "in alpha" when:

1. Source code is merged to main in its source repo
2. The relevant package is published to npm under the `@alpha` tag
3. `ldm install @alpha` on a fresh machine deploys the fix
4. The runtime (Lēsa's gateway, CC's guard, etc.) picks up the new version without manual intervention
5. The fix is verified end-to-end on Parker's actual workstation (not just in tests)
6. The bug file is updated with "shipped in vX.Y.Z" and the status changed to `shipped`

Nothing is "done" until step 6.

## Cross-references

- `ai/product/bugs/master-plans/bugs-plan-04-05-2026-001.md` — session narrative (001 is the story, 002 is the plan)
- `ai/product/bugs/master-plans/bugs-plan-04-01-2026-001.md` — prior master plan, some items still open
- All individual bug files listed in the inventory above are the source of truth for their respective fixes
- `library/documentation/` — runbook targets for CLI adapter and other deployment docs (Phase 5 of OC-1)

## Open questions for Parker (REVISED)

Many of the original questions are now answered by Parker's deferral decision. What remains:

1. **Wave 1 (bridge fix) authorization.** OK to start the ~50 line change to `src/gateway/openai-http.ts` in the OpenClaw fork, deploy via `npm link`, and verify end-to-end? This is the new first-up work.
2. **Wave 2 batching.** Ship each guard/pipeline phase as its own alpha, or batch several into one release? Recommendation: one alpha per phase. Small, testable, reversible.
3. **Wave 3 priority.** Which of MC-1, MC-2, INST-1, BKP-1 is most urgent? I do not have enough context on any of them to rank within the wave. Will need to read each bug file when we get there.
4. **Wave 5 (deferred items, final wave).** When we eventually get to the CLI adapter + key rotation, do we still do the 7-unknowns test matrix, or ship faster?

## What I am doing next

1. ~~Commit this file and the three new bug files~~ (done, PR #454)
2. **Waiting on Parker's authorization to start Wave 1 (bridge fix).** This is the new first-up code work now that Wave 1-2 stop-the-bleed items are deferred.

Once authorized, I will proceed through Waves 1-4 in order, reporting after each wave completes with updated checklists inline in this file. Wave 5 (deferred P0 items) runs last per Parker's instruction.

## Revision history

- **2026-04-05 (initial):** complete inventory + 7-wave execution plan. All 8 phases of guard/release-pipeline master plans incorporated. All new bug files from today (SEC-1, OC-1, OC-2, OC-3, BRG-2) referenced.
- **2026-04-05 (revision 1, Parker's deferral):** Parker deferred SEC-1 + OC-1 + OC-2 to the end ("keep the cron, do the key swap last, brainstorm is Lēsa's"). Waves reordered:
  - New Wave 1: bridge architectural fix (was Wave 3)
  - New Wave 2: guard + release-pipeline phases (was Wave 5)
  - New Wave 3: installer + backup + memory-crystal (was Wave 6)
  - New Wave 4: housekeeping + research (was Wave 7)
  - New Wave 5 (final): deferred P0 items: CLI adapter + key rotation + optional OC-2 Option B
  - Priority on SEC-1, OC-1, OC-2 downgraded from P0 to P3.
  - Brainstorm cron explicitly stays running; Parker's feature, not touched.
