# BACKLOG — phase `canon`

## Build backlog (Builder-owned)

Milestone map → Definition of Done (§5). M1 = machinery + unit tests (Adversary cold-verifies the
pieces). M2 = proven end-to-end in real CI.

### M1 — machinery works locally, each piece proven

- [x] **M1.1 Tagged-promote gate (§2.A).** Extend `should_promote_canonical` to ALSO require the
      tested head version corresponds to a published release tag. Add a `tagged: bool` param computed
      at the call site (`head_version in recipe_tags(recipe)`); keep the function pure. Untagged head
      → no promote. Unit tests: enrolled+green+cold+not-ref+tagged → True; each missing condition
      (incl. untagged) → False.
- [x] **M1.2 Release-tag trigger + mirror-sync in the sweep (§2.C/§2.D).** New pure helper
      `sweep_decision(recipe, latest_tag, canon_version)` → `run` | `skip:no-new-version` |
      `skip:never-released`, keyed on `version_key` (NOT commit). Wire `nightly_sweep.sweep()` to, per
      enrolled recipe: (1) faithful mirror-sync main+tags to upstream (reuse open-recipe-pr.sh
      `--reconcile-only`, vendored into the repo for reproducibility); (2) compute latest release tag
      vs canonical; (3) skip or run cold ON THE TAG (checkout tag + `CCCI_SKIP_FETCH=1`). Unit tests
      for `sweep_decision` (new tag → run; equal → skip; older/no tag → skip).
- [x] **M1.3 Enroll all recipes (§2.B).** Set `WARM_CANONICAL = True` in each of the 21 used-recipes
      `tests/<r>/recipe_meta.py`. Leave fixtures (custom-html-*-bad, concurrency, regression) alone.
- [x] **M1.4 Hollow-sweep fix (root cause).** Make the deployed sweep read the REAL tests/ + run
      current code: set `CCCI_REPO=/etc/cc-ci` in the sweep service and run `nightly_sweep.py` from
      the checkout (not the store copy). Deploy procedure pulls `/etc/cc-ci` before nixos-rebuild.
- [x] **M1.5 Weekly timer (§2.F).** `nightly-sweep.nix` `OnCalendar` daily → weekly (one line),
      `Persistent=true` (already set). Low-traffic slot.

### M2 — proven end-to-end in real CI

- [ ] **M2.1 Deploy** the M1 changes: `git -C /etc/cc-ci pull` + `nixos-rebuild switch`; verify host
      health after.
- [ ] **M2.2 Full sweep run** across the enrolled set on cc-ci: mirrors synced, canonicals promoted
      for green recipes (records with correct version+commit), red recipes left intact, no-new-tag
      recipes skipped. Per-recipe results log captured.
- [ ] **M2.3 Determinism proof:** run the sweep a SECOND time immediately → every recipe SKIPS
      (latest tag == canonical for all) = clean no-op, no CI rerun.
- [ ] **M2.4 Tagged-promote proof:** a green run on an UNTAGGED state does NOT promote; a green run
      on a TAGGED release DOES. Construct if the live set doesn't cover it.
- [ ] **M2.5 Real (non-hollow) timer fire:** after a timer fire, canonicals have ADVANCED (evidence),
      not exit-0 on an empty set.
- [ ] **M2.6 samever orthogonality:** (a) no new tag (even with untagged commits on main) → SKIP, no
      upgrade-tier run, no promote; (b) new tag → cold-test new tag, canonical(older)→new, promote.
      Show step-back never fires inside the sweep.
- [ ] **M2.7 Disk budget recorded;** all recipes enrolled (or documented exception in DECISIONS).
- [ ] **M2.8 §2.G UPGRADE_BASE_VERSION retirement** — after plausible's canonical lands at 3.0.1:
      remove the pin, confirm dynamic base resolves 3.0.1 + passes; if it holds, strip the key
      (meta KEYS, resolver branch, docs, unit tests) + update bluesky-pds comment. Else KEEP with a
      recorded reason in DECISIONS.

## Notes
- Order within M1: M1.1 → M1.2 (depend on version helpers) → M1.3/M1.4/M1.5 (config). Claim M1 only
  when all unit tests green + tree clean + pushed.