[addisdev]

Summary

LOOP-PLAN Phase 3, items 1–8 as briefed. Not #82, and not the OpenAPI 422 description (another branch owns the generated output). routes.ts changes only inside handler bodies and imports. gen-api --check shows openapi.json and api.gen.ts unchanged.

1. Legacy cancel/retry owner check. A new module, collector/src/api/policy.ts, holds notOwned() and needsAdmin(). /api/v1's owned() and prepareSpec() call them, and so do POST /api/jobs/:id/cancel|retry.
2. Legacy enqueue shell check. POST /jobs and POST /api/jobs call needsAdmin(). /api/jobs has to ask itself, because its forward to /jobs arrives as an internal request. Nothing changes with auth off. deploy/auth.md and api.md are corrected.
3. ci-enqueue / ci-upload.
   • ci-enqueue uses POST /api/v1/jobs and GET /api/v1/jobs/{id}/wait through the generated client.
   • It exits like fleetr: 0 passed, 1 failed, 2 usage/invalid, 3 still running, 4 skipped, 5 refused/unreachable.
   • Both scripts send FLEET_RUNNER_TOKEN (or FLEET_TOKEN) as a bearer token, and still send FLEET_DASH_TOKEN as x-fleet-token.
   • The replaced-by-upload substitution is kept.
   • Integration docs, collector/ci/README.md and both workflow templates are updated.
4. PR builds never move latest.
   • New artifacts.channel column. Existing rows are NULL, so they count as merged builds.
   • x-artifact-channel: pr puts an upload on the pr channel. Any other value is a 400, checked before any bytes are read.
   • resolveLatestBuild skips pr builds.
   • The same bytes republished from main come off the channel. A PR upload of bytes main already published leaves that row alone.
   • Both scripts set the header when GITHUB_EVENT_NAME is pull_request or pull_request_target, or when given --channel pr|main.
5. fleet/package.json. bin now points at dist/bin/fleet.mjs for both fleet and fleetr. I also added "files": ["dist/"]: fleet/.gitignore lists dist/, so without it npm pack left the bundle out entirely.
6. scripts/version.mjs now also writes desktop/src-tauri/Cargo.toml (matched inside [package]) and tauri.conf.json. Both are set to 0.8.0. There is no committed Cargo.lock. The CI version job runs the same script, so it covers them. CONTRIBUTING's caveat is gone, and the CHANGELOG count goes from eleven to thirteen.
7. Smaller items.
   • check-examples.ts now runs the API's strict schema plus the params manifests. The compiled validators moved from routes.ts into a new src/api/v1/spec-check.ts that both import.
   • CHECK_NAMES drops regression, agent_stuck and leash. Nothing raises them. Reads don't validate the name, so a stored row would still show. bug-garden/defects.json uses leash/regression as bench labels, not as finding check names, so it is untouched.
   • FLEET_PEER_TOKENS is a JSON map from peer URL to token, sent as a bearer token to that peer only. It is documented under "More than one brain".
   • Explore mirror frames also send Authorization: Bearer $FLEET_TOKEN.
   • FLEET_SWEEP_MS, FLEET_SCHEDULER_TICK_MS and FLEET_ALERT_TICK_MS must be whole milliseconds, at least 1000. Anything else falls back to the default with a startup warning.
   • The stale discovery comments are fixed.
8. Schedule job_id. POST /schedules already refused a non-empty job_id. The silent case was an empty or null one: it was stored and then replaced at every firing. That is now dropped, and the reply carries a warnings array (passed through by /api/schedules). A stored template that still has one gets a log line when it fires. Documented in api.md.

Not verified / not done

• The /api/v1 artifact document and the OpenAPI uploadArtifact description don't mention channel / x-artifact-channel. That would change generated output, which another branch owns. GET /api/artifacts does show channel.
• The workflow templates have still never run on a real GitHub runner. The scripts are covered only by the suite below.
• I didn't run desktop cargo check. The only change there is the version string, and CI's desktop job will cover it.
• ci-upload now exits 5 instead of 1 when the upload is refused or the collector is unreachable.

Test evidence (ultra, Node 24)

• collector: CI=true npm test passes, 0 FAIL lines.
  • typecheck clean
  • check-examples: "ok — 37 example job specs pass /api/v1's strict schema and their params manifests"
  • gen-api --check: ok openapi.json, ok src/client/api.gen.ts
  • check-auth: ALL PASS, 60 checks. New checks cover legacy owner/shell, each ci-enqueue exit code (0/1/2/3/4/5), ci-upload with and without a token and the pr channel, and a second collector reading this one through FLEET_PEER_TOKENS.
  • lifecycle: ALL PASS
  • smoke: ALL PASS, 973 checks. New checks cover PR-channel resolution, the schedule job_id warning, and interval/peer-token parsing.
  • api v1 contract: ALL PASS
• fleet: npm test passes: tests 80, pass 80, fail 0, skipped 0 (runner-machine deps installed).
• node scripts/version.mjs check: version: ALL PASS.
• mkdocs build --strict: rc 0.
• npm pack of fleet installed into a temp prefix: fleet --version and fleetr --version both print 0.8.0.

🤖 Generated with Claude Code

[addisdev]

Self-review: read policy.ts (owner + shell checks shared by /api/v1 and the legacy routes; internal bypass uses the per-process random secret), the ci-enqueue exit-code change and the artifact channel. All checks green. Merging (LOOP-PLAN Phase 3).