claim(porepo): all 5 DoD built + cold-verified from anon /tmp recursive clone (deliverable 346ed31) — awaiting Adversary

machine-docs/JOURNAL-porepo.md

@@ -24,6 +24,38 @@ required.
 Gitea API reachable with bot creds (200); `recipe-maintainers/project-orchestrator` does not yet
 exist (404); org `recipe-maintainers` exists (id 65).
 
+## 2026-06-13T19:20Z — Built + cold-verified, claiming gate
+
+Built the whole PO repo in `/home/loops/porepo/project-orchestrator`, pushed `main` at `346ed31`.
+
+Design choices (the WHY behind STATUS facts):
+- **PO agent is a single `persistent` fleet-management agent**, not a `[loop]` pair — the plan says
+  "a persistent project-orchestrator agent is enough to start; add a loop only if useful." A loop's
+  phase machine models a build-to-DoD sequence, which fleet management is not. So no `[loop]` block;
+  `status` simply prints the agents table (no phase line). Hourly `wake` → `prompts/supervise.md`
+  gives it a periodic read-only fleet sweep.
+- **`fleet.toml` uses `[[project]]` array-of-tables** with required `name/location/harness/ref/
+  enabled/secrets` + optional `config/notes`. `scripts/fleet.py` validates (rejects unknown fields
+  and dup names — a typo guard) and reports. The registry is the *only* project↔harness↔ref record;
+  the in-project `engine/` submodule pin is the in-repo half (a plain git fact, no fleet semantics).
+- **create-project.sh deliberately keeps the project ignorant of the PO**: it `git submodule add`s
+  the harness, checks out the ref, then scaffolds config with the harness's *own* `agents.py init`
+  (harness-only config), stamps a unique `session_prefix`, and commits. Registering in `fleet.toml`
+  is a *separate*, opt-in `--register` step that writes only to the PO side. The scratch project's
+  tracked files are exactly `.gitignore .gitmodules agents.toml` — zero PO/fleet metadata.
+- **Nix flake reuses the engine's nixpkgs pin** (`50ab7937…`, lastModified 1751274312) so the
+  devShell is identical/known-good (python311 + tmux + git). flake.lock written by hand to match.
+- **Pinned engine at the v0.1.0 commit `289ef07`** (the tag points there); the later `cdcece9`
+  tests commit is intentionally not pinned (DoD says v0.1.0).
+
+Verification (full command+output transcript): ran every DoD check from a fresh **anonymous**
+recursive `/tmp` clone inside `nix develop` (Python 3.11.11, tmux 3.5a, git 2.47.2). All passed:
+recursive submodule fetch worked with no creds; `agents.py status` listed the PO agent; `fleet.py
+validate` → `OK — 1 project(s), schema v1`; `import tomllib` rc=0; `create-project.sh` produced a
+valid standalone scratch project (`engine` @ v0.1.0, status rc=0, grep → `clean: no PO/fleet
+metadata`). Cleaned up all /tmp scratch artifacts. Exact commands + expected outputs mirrored into
+STATUS-porepo.md for the Adversary.
+
 ### File-ownership coordination note
 The Adversary had pre-created STATUS-porepo.md / JOURNAL-porepo.md as placeholders before I started.
 Per protocol §6.1 these are Builder-owned (STATUS is the authoritative `## DONE` handshake file the