BULGAR DEV CONTROL V2 — build report

Projects and components

The brief says "17 components across 13 repositories". The manifest contains 14 distinct repositories, and I did not reconcile that by dropping one. Counted from estate-manifest.json.components[].repository: sarafski7979/{raglub, bizi, bulgar-dev-control, bulgar-dna, bulgar-showcase, raw-podcast, louie-doherty, superfit-gym-app, stella-h, sponsorme, shopify-design-louie, bulgar-base} (12), kristiyanpts/bulgar-studio, diannescotland/akh-peptides. A test pins the app's count to the manifest's, so if the manifest changes the interface follows it rather than a number I typed.

Per project, as Dev Control now reports it

Nine of fourteen projects have UNKNOWN engineering readiness. That is the honest answer: eight have never been run at all, and Louie Doherty's only two runs both ended in INFRASTRUCTURE_FAILURE, so no gate value on them describes the product.

2. Previews — available vs unavailable

13 of 17 components declare a way to be previewed; 4 have none.

A preview link is only ever rendered when a run is `RUNNING` and its `preview` field is `RUNNING`. A declared start command is not a running app. A test asserts that no component outside LIVE_PREVIEW exposes a port.

louie-doherty is recorded as a LIVE SITE in its manifest note, and that fact is shown as a settled milestone — but the manifest carries no URL field, so no link is offered. I did not invent one. If you want that link, the manifest needs a live_url (see §10).

3. Progress — milestones only, with a real denominator

PRODUCT PROGRESS = settled milestone weight / total milestone weight. Nothing else. There is no code path anywhere in this app that turns a commit count, a file count, a line count or an elapsed time into a percentage, and a test proves it: adding 25 synthetic passing runs to DNA does not move its number by one point.

If a project has no milestones there is no percentage — it renders UNKNOWN, not 0%.

Draft roadmaps created

14 draft roadmaps, 64 draft milestones. 0 confirmed — confirming is Ivan's action and I did not perform it. Every draft is labelled DRAFT; the percentage renders as DRAFT 62%, never bare.

Where the 64 came from, and the exact rule for each:

Runs whose task is "started via bulgarctl" produce no milestone — 13 of the 28 runs carry that non-descriptive task, and inventing a milestone from them would be inventing a denominator.

A run-task milestone is only SETTLED when all four of these are true: exit_reason: COMPLETED, agent is not AGENT_FAILED, remote_checkpoint: PUSHED, and every gate the manifest declares reported PASS. A gate that did not run is not a pass. INFRASTRUCTURE_FAILURE yields BLOCKED; SUPERVISOR_LOST yields NEEDS_REVIEW, because the record is incomplete.

Result across the estate: 9 SETTLED, 23 NEEDS_REVIEW, 22 IN_PROGRESS, 5 BLOCKED, 5 NOT_STARTED.

Engineering readiness

A second, separate number: checks passing / checks declared, from install, test, typecheck, lint, build, preview.

• A check the manifest does not declare (*_command: null) is NOT_PRESENT and is excluded from the denominator — it is never counted as passing. Shown as "N not present, excluded".
• Each check is answered by the most recent run that actually recorded it, and cites that run id on the page. A later, shorter run cannot erase what an earlier one proved.
• Runs that ended in INFRASTRUCTURE_FAILURE, or whose install failed, are excluded entirely — their gate values describe the harness.
• If no run can speak for the product, readiness is UNKNOWN, not "0 of 6".

Thin denominators are admitted

Three projects read DRAFT 100% off a single manifest-note milestone. Rather than let that pass as a finished product, the card says "thin denominator: too few milestones for this number to mean much", the status reads SETTLED ON A DRAFT ROADMAP (visually dashed), and the home counter shows SETTLED 0 with "3 more settled on a draft roadmap" underneath. Nothing counts as settled until Ivan confirms the roadmap it was measured against.

4. Human state is authoritative

Human state lives in `${BULGAR_ROOT}/dev-control/human-state.json` — Dev Control's own file. It never touches a product repository or a product database. Writes are atomic (temp file + rename), so a crash cannot half-write a decision.

It holds: milestone states, titles, weights and tombstones; Ivan's own milestones; per-project priority, tier, note and roadmap confirmation; review marks; and an event log (last 500) that feeds the Activity page.

Generated drafts can never overwrite it. mergeMilestones() lets a draft fill only an id human state does not carry; a milestone Ivan removed stays removed; a milestone Ivan added exists with no evidence behind it and says so. Two tests cover this, one of them by regenerating the whole snapshot twice against the same human state.

Ivan can, from the UI, with no JavaScript: set a milestone state, set a weight (1–5), remove or add a milestone, confirm or reopen a roadmap, set priority, set tier, save a note, mark or unmark a review. All of it verified over real HTTP against the running server.

5. Which real field backs each displayed value

Nothing is rendered that is not in this table. /run/<id> prints the raw meta.json so any value can be checked against its source.

From runs/<id>/meta.json

From estate-manifest.json

From discovered-estate.json

From reports/<id>.md or runs/<id>/report.md

From Dev Control's own dev-control/human-state.json

Milestone overrides and additions, priority, tier, notes, roadmap confirmation, review marks, and the "your decision" entries in Activity.

6. What renders UNKNOWN, and why

7. Agents and the liveness model

ACTIVE_WORK_CONFIRMED requires at least two of four independent signals of change: checkpoint TREE change, workspace writes, child process activity, CPU progression. NO_ACTIVE_WORK is only stated when all four are known and none is changing. Otherwise: UNKNOWN.

A checkpoint COUNT is not a signal and there is no field for one — an agent that checkpoints on a timer produces checkpoints forever without doing work. A test feeds five identical checkpoint tree SHAs and asserts the signal reads STATIC and the verdict stays UNKNOWN.

Signals are read from an optional runs/<id>/liveness.json. The supervisor does not write that file today. Until it does, every run shows UNKNOWN and the Agents page explains why in plain words. That is the honest state, not a bug — and it is the one place where a small supervisor change would light up a whole surface (§10).

Active agents right now: 0. No run in the record has exit_reason: RUNNING.

8. Review, blockers, and the estate

• Review inbox: 8 items, plus 8 pushes that moved nothing listed separately. A run enters the inbox when it pushed and the branch actually moved, when it pushed and the record cannot say what moved, or when it wrote a report. Eight real runs pushed a branch whose head equals its base SHA — those are shown under "Pushed, but the branch did not move" rather than dressed up as work.
• MARK REVIEWED merges nothing. It writes one line to Dev Control's own file. The card says so under the button, and a test asserts the git-derived fields of an item are identical before and after marking.
• Blockers: 16, all traced: 5 BLOCKED milestones, 4 components whose last run ended in INFRASTRUCTURE_FAILURE, 1 gate_note (test NOT_RUN: needs a local DATABASE_URL…), and 6 from the two reports that recorded blockers.
• NEEDS IVAN: 48 — 8 reviews, 14 unconfirmed roadmaps, 23 report items the agents themselves addressed to a human, and 3 decisions from the manifest findings.
• Authority ambiguity is shown twice and resolved nowhere. Both kristiyanpts/bulgar-studio :: superfit-gym-app and sarafski7979/superfit-gym-app :: web carry an AUTHORITATIVE COPY — NEEDS DECISION banner listing both copies and quoting findings.duplicate_application ("NEITHER COPY DELETED, MERGED OR MIGRATED"). A test fails if either copy stops being flagged or if the decision milestone ever leaves NEEDS_REVIEW by itself.
• Estate map groups by CORE BULGAR (4) / CLIENT (5) / EXPERIMENTAL (2) / INFRASTRUCTURE (2) / ARCHIVED (1), every default citing the manifest text it came from, all changeable by Ivan. Only recorded relationships are drawn: containment, the documented duplicate, and declared service dependencies. No invented graph.

9. Gates, tests, mobile QA, screenshots, security

Gates — exact vocabulary

Tests are TypeScript executed by node --test with type stripping, and run against the real fixtures, not mocks. They are honesty tests: the vocabulary is never widened; SUPERVISOR_LOST is never a clean finish; an infrastructure failure never supplies product evidence; a component with no run reads UNKNOWN; progress cannot be moved by adding runs; a report claim is never SETTLED; human state always wins; the operation set contains nothing that merges, pushes, deploys or executes; no identifier can escape BULGAR_ROOT; and every one of the 28 real run ids resolves.

Two changes to the repository's own tooling (both needed for the gates to be real):

1. "lint": "next lint" → "lint": "eslint ." with a new flat eslint.config.mjs. Next 16 removed `next lint` — npx next lint now reports "no such directory: /work/lint". The previous Dev Control agent reached the same conclusion (report …0ed7.md §11.7). The rule set is eslint-config-next flat, and it is yours to confirm.
2. "type": "module" in package.json and allowImportingTsExtensions in tsconfig.json, so node --test can run the TypeScript library modules directly. next build is green with both.
3. next build also rewrote tsconfig.json itself — jsx: preserve to react-jsx, plus the .next/types includes and the next plugin. Those three edits are the tool's, not mine, and are committed as it made them. The previous Dev Control agent hit the same thing.
4. npm test pins BULGAR_ROOT=./fixtures so the gate is deterministic wherever the supervisor runs it, rather than depending on an environment variable being set for it.

/run/<id> — fixed

The brief reports /run/<id> returning not-found for a real run id. There was no /run route in this checkout, so it is implemented correctly rather than patched: the id is validated as a path segment, the run directory is read directly, and notFound() is only called when the file truly is not there. A test walks all 28 real ids and asserts each resolves and agrees with its own directory name; hostile ids (../../etc/passwd, /etc/shadow, embedded newlines) resolve to null.

Mobile QA

Mobile is the primary device and the home order is the required one: NEEDS IVAN · ACTIVE AGENTS · PROJECTS · NEEDS REVIEW · BLOCKED · RECENT ACTIVITY, with the counts strip above it. Cards everywhere; the only tables in the app are inside agent reports, and those are wrapped in a horizontal scroller.

Checks performed at a 390px budget (390 − 32 shell − 32 card = 326px of content):

• Every layout is single-column by default. The first breakpoint is 620px, then 700/760/980/1000.
• No fixed pixel width anywhere in the CSS or in any inline style exceeds 326px; the only inline width in the codebase is the viewport meta.
• overflow-wrap: break-word globally, overflow-wrap: anywhere on every monospace element, and a .chip.wrap variant for branch names and repository paths.
• A script fetched all 12 route shapes, extracted every non-wrapping chip and estimated its rendered width. One overflow was found and fixed — kristiyanpts/bulgar-studio :: superfit-gym-app at ~358px on the Estate page. Re-run afterwards: nothing over 300px.
• Nav is a horizontal scroller; the run record's key/value grid collapses to one column at 520px.
• Every mutating control is a plain <form> + server action: the whole app works with JavaScript off, which was verified by driving the real HTTP endpoints with curl.

Screenshots — NOT TAKEN, and why

There is no browser in this container. chromium, chromium-browser, google-chrome and firefox are all absent, and neither Playwright nor Puppeteer is installed. Installing one would mean pulling a browser into an agent image, which is not my call. So the mobile work above is reasoned and measured, not seen — the same limitation the two other agents recorded this week. A human with a phone should open all eleven routes before this is trusted visually. This is the first item in §12.

Security

• No secrets, ever. The app reads no environment variable other than BULGAR_ROOT. There is no token, no key, no credential, no .env read, and nothing from the manifest's credential fields is rendered beyond the *requirement* label (STORE_TOKEN_REQUIRED, DEV_DATABASE_REQUIRED).
• No shell, no exec, no Docker socket. There is no child_process import, no exec, no spawn, no Docker client, and no remote terminal of any kind. A grep for those is in the report trail and comes back empty.
• No network egress. No fetch, no analytics, no web fonts — every font is a system stack, so the app makes no outbound request at all.
• One write path, to one file, under BULGAR_ROOT, via one server action, behind a fixed enumerated operation set (13 operations). Anything else is rejected before it reaches the reducer. Free text exists only as stored data (a milestone title, a note): control characters are stripped, length is capped at 200, and it is never used as a path, a command or an argument.
• Path safety: every identifier that reaches the filesystem is matched against a strict allow-list, .. is rejected, and the resolved path is asserted to stay under BULGAR_ROOT.
• No `dangerouslySetInnerHTML` anywhere, including the report renderer, which builds React elements only. An agent report cannot inject markup into Dev Control.
• No auth of its own. Dev Control assumes tailnet-only exposure exactly as V1 did; see §12.

10. Fields I want that do not exist

Rather than invent them:

1. `live_url` on a manifest component. louie-doherty is a LIVE SITE with no address, so Dev Control cannot offer the one link an owner would most want.
2. `runs/<id>/liveness.json` — checkpoint tree SHA, workspace write count, child process count and CPU seconds, sampled a few times per run. Without it every liveness verdict is UNKNOWN.
3. `remote_sha` written on every push. Four runs pushed without recording a head, so their change renders UNKNOWN and no comparison link can be offered.
4. `ended` written on every terminal run. Three runs have no end time.
5. A merged/unmerged flag per branch in discovered-estate.json. Twenty milestones are drafted from branches that may already be merged; today the caveat says so on every one of them.
6. A `task` for every run. Thirteen runs say only "started via bulgarctl", and a milestone cannot be drafted from that.

11. Approaches that FAILED

1. `FlatCompat` to load `eslint-config-next`. Crashed with "Converting circular structure to JSON". The package ships its own flat config; using that export directly works.
2. One "basis run" for all of a component's checks. RAW Podcast read 2 of 5 because its most recent usable run only got as far as test, while a run fifteen minutes earlier had proved four gates. Replaced with per-check "most recent run that recorded *this* check", each citing its own run id on the page.
3. `known = any check has a non-UNKNOWN status`. Louie Doherty read "0 of 6 checks passing" — indistinguishable from six broken checks, when the truth is that both its runs died in infrastructure and nothing was ever measured. Readiness is now UNKNOWN unless a run exists whose gates can speak for the product.
4. Status `SETTLED` straight from draft milestones. Three projects announced SETTLED / 100% off a single manifest-note milestone. Now: SETTLED ON A DRAFT ROADMAP (dashed, distinct), a "thin denominator" warning under any percentage with fewer than three milestones, and a home counter that keeps confirmed and draft-settled apart.
5. Report milestones from every level-3 subsection. Report B's chapter on website capture filled all eight slots and its SSRF, conflicts, blueprint and Instagram chapters vanished entirely. Now only a container section ("Changes made, and why") expands, capped at four children, so breadth beats depth.
6. Sentence splitting on `[.!?]` for the one-line description. "Node 22.16.0" became "Node 22. 16." and "Next.js" became "Next. js". A sentence now only ends at a terminator followed by whitespace, and there is a test with those exact real strings.
7. **Taking the *latest* attempt as a milestone's outcome. Sprint C's latest attempt was an infrastructure failure, which would have marked the finished work BLOCKED. A milestone now takes the best** outcome across its attempts and shows the attempt count.
8. Rejected before building: deriving progress from commits or elapsed time; a markdown library (none is available offline — hence the small element-building renderer); storing anything in a product database; and a "start a run" button, which would mean executing commands.

12. What I deliberately did NOT build

• No merge, push, deploy, restart, or "start a run" control. The supervisor does all git and all execution. Dev Control observes and records decisions.
• No Docker integration. The container cannot see the socket, and on the host it would be a second source of truth competing with what the supervisor wrote.
• No authentication. Dev Control still assumes it is only reachable on the tailnet. If it is ever exposed more widely, everything on it — including Ivan's notes and the estate's structure — is readable, and every mutating form is usable, by whoever reaches it.
• No screenshot or thumbnail store, so preview tiles say "no screenshot — Dev Control stores no images" rather than showing a fake.
• No auto-refresh, websockets or polling. Every route is force-dynamic; a reload is the refresh.
• No editing of the manifest, the fixtures, or any product file.
• No invented estate relationships — no dependency graph beyond containment, the documented duplicate, and declared services.
• No multi-line notes or rich text. One 200-character note per project.
• No changes to any other repository, and no git push.

13. What a human must review

Ranked by how much I want a second pair of eyes.

1. Everything visual, on a real phone. I have no browser (§9). The 390px work is measured and reasoned, not seen. Open all eleven routes at 390px before trusting them.
2. The rule that makes a draft milestone SETTLED (§3). It is the only rule in the app that claims success, and it is mine, not the supervisor's. If "PUSHED + COMPLETED + every declared gate PASS" is too generous or too strict, it is one function — stateFromRun in src/lib/drafts.ts — and one test.
3. Branch-derived milestones. Twenty of the sixty-four come from branches whose merge status is not recorded, so they all read IN_PROGRESS. AKH Peptides is 9 of its 12 milestones this way, and its DRAFT 0% is therefore a statement about *unknown branches*, not about the product. If that reads wrong, either delete them per project or ask discovery for a merged flag (§10.5).
4. Report-section milestones. Fourteen milestones are an agent's claim about its own work, and they are all NEEDS_REVIEW so they weigh on the denominator without ever helping the numerator. That is deliberate, and it is arguable.
5. The tier defaults on the Estate map. Each cites the manifest phrase behind it, but "Experimental" for Raglub and Bizi comes from "Phase 0 architecture" and "architecture for 25 products", which is my reading of your words, not your judgement.
6. The lint gate change (next lint → eslint .) and the two toolchain changes in §9. Confirm the rule set is the one you want.
7. The review inclusion rule. A run enters the inbox if it moved a branch, if it pushed with an unrecorded head, or if it wrote a report. That last clause is what puts the three reported runs in front of you even when their branch head equals their base.
8. The manifest says 14 repositories, the brief says 13 (§1). Something upstream disagrees with something else, and it is not for me to reconcile.
9. The unreadable-source screen. If BULGAR_ROOT is wrong on the worker, Dev Control now says so instead of reporting an empty estate. Worth seeing once deliberately, by starting it with a bad root, so the failure mode is familiar before it happens for real.
10. The eight `SUPERVISOR_LOST` runs between 14:01 and 16:52 on 2026-08-25 are still a real signal, as the previous agent noted. Dev Control now shows them as never-clean finishes, two of them having already pushed — but nothing has explained what killed those supervisors.
11. Exposure. Dev Control has no login. Confirm the tailnet boundary is actually enforced before anyone opens it from a phone on a mobile network.

14. Files

New: src/lib/{manifest,read,human-state,ops,report-parse,drafts,derive,load}.ts; src/app/{layout,page,actions,globals.css} and the ten route folders; src/components/{ui,project-card,milestone-list,review-card,markdown}.tsx; test/{fixtures,vocabulary,readiness,progress,human-state,review,liveness,runs-and-paths,previews,estate,description}.ts; eslint.config.mjs.

Changed: src/lib/estate.ts (appended only, V1 exports untouched), package.json (type, scripts), tsconfig.json (allowImportingTsExtensions), .gitignore, README.md.

Not changed: every file under fixtures/, and every other repository on this machine.