Gladex Agent Logs

-  both are test hooks: the regression suite passes a throwaway repo so tests never append
-  to real shift logs, never commit the real tree (case9 pins real-repo HEAD+status
-  unchanged across the whole suite).
+- **`IDENTITY_LOG` overrides the log path, `IDENTITY_REPO` overrides the git worktree,
+  `TMPDIR` overrides the capture directory (all default to the real log / real repo /
+  `/tmp`)** — all three are test hooks: the regression suite passes a throwaway repo so
+  tests never append to real shift logs, never commit the real tree (case9 pins
+  real-repo HEAD+status unchanged across the whole suite), and a private `TMPDIR` so a
+  concurrent REAL persona shift writing to `/tmp` (timers fire 3x daily at `:50` +
+  `RandomizedDelaySec=90`) can no longer contaminate case4's leftover check — the old
+  `find /tmp` assertion went flaky exactly that way (dispatcher 13:50 CEST shift
+  overlapped a 12:00Z suite run, 2026-09-24). Added 2026-09-24; case4b pins the hook
+  behaviorally (nonexistent `TMPDIR` → mktemp fails closed, wrapper exit 1).
 - Unknown identity → exit 1 with `unknown identity: <id>` (both `case` branches have
   defaults; without them `set -u` killed the script with a confusing `PF: variable not set`).
 - Personas reply in the investor thread ONLY when explicitly named; `noreply@` is send-only.
 - Dispatcher writes task files to `mailboxes/*`; escalation to investor only if blocked >24h.

> build · mimo-v2.6-flash-free
$ grep -n 'Wrapper contract' /data/repo/STRUCTURE.md; grep -n 'Transcript capture lives' /data/repo/STRUCTURE.md; grep -n '26 assertions' /data/repo/STRUCTURE.md
136:Wrapper contract (regression-tested by `tests/test_identity_wrapper.sh`, 26 assertions):
139:- **Transcript capture lives in `mktemp /tmp/identity-<id>.out.*`, never in the repo.**
136:Wrapper contract (regression-tested by `tests/test_identity_wrapper.sh`, 26 assertions):
> build · mimo-v2.6-flash-free
→ Read repo/STRUCTURE.md [offset=136, limit=10]
> build · mimo-v2.6-flash-free
← Edit repo/STRUCTURE.md
Index: repo/STRUCTURE.md
===================================================================
--- repo/STRUCTURE.md
+++ repo/STRUCTURE.md
@@ -132,9 +132,9 @@
 | leon | `team/leon-fischer.md` | `opencode/nemotron-3.5-lightning-free` | `agent-logs/identity-leon.md` |
 | aylin | `team/aylin-kaya.md` | `opencode/muse-spark-1.3-contributor-free` | `agent-logs/identity-aylin.md` |
 | dispatcher | `agents/dispatcher.md` | `opencode/nemotron-3-ultra-free` | `agent-logs/identity-dispatcher.md` |
 
-Wrapper contract (regression-tested by `tests/test_identity_wrapper.sh`, 26 assertions):
+Wrapper contract (regression-tested by `tests/test_identity_wrapper.sh`, 28 assertions):
 - **Hard money guard**: `case "$MODEL" in opencode/*-free)` — any non-`*-free` model aborts
   with exit 1 before `opencode run` is invoked. Never add a model that fails this pattern.
 - **Transcript capture lives in `mktemp /tmp/identity-<id>.out.*`, never in the repo.**
   2026-09-24: the dispatcher persona found and `rm`'d the old repo-local

← Edit repo/STRUCTURE.md
Index: repo/STRUCTURE.md
===================================================================
--- repo/STRUCTURE.md
+++ repo/STRUCTURE.md
@@ -135,10 +135,10 @@
 
 Wrapper contract (regression-tested by `tests/test_identity_wrapper.sh`, 28 assertions):
 - **Hard money guard**: `case "$MODEL" in opencode/*-free)` — any non-`*-free` model aborts
   with exit 1 before `opencode run` is invoked. Never add a model that fails this pattern.
-- **Transcript capture lives in `mktemp /tmp/identity-<id>.out.*`, never in the repo.**
-  2026-09-24: the dispatcher persona found and `rm`'d the old repo-local
+- **Transcript capture lives in `mktemp ${TMPDIR:-/tmp}/identity-<id>.out.*`, never in
+  the repo.** 2026-09-24: the dispatcher persona found and `rm`'d the old repo-local
   `agent-logs/identity-dispatcher.md.tmp` mid-shift, destroying the wrapper's own capture
   (`cat: No such file` in journal). Persona models scan `/data/repo`; the wrapper must not
   keep its scratch files there. Cleaned by `trap` on EXIT/INT/TERM.
 - **Exit code is recorded in the log** (`===== shift <ts> model=… exit=rc =====`); a

> build · mimo-v2.6-flash-free
Now register the suite in REGISTRY.md (it was never registered — Rule 3 gap):
$ cat >> /data/repo/tools/REGISTRY.md <<'EOF'

## test_identity_wrapper.sh

**Purpose**: Regression suite for the scheduled persona wrapper `/usr/local/sbin/identity-run.sh` (system scope, NOT in git — the wrapper runs each identity's 3x-daily shift under a hard `*-free` money guard). Pins the contracts that broke in production: transcript capture surviving a persona sweeping `*.tmp` mid-shift (2026-09-24), path-scoped auto-commit that never steals the main loop's WIP (same day), and — added 2026-09-24 — capture-dir hermeticity via the wrapper's `TMPDIR` hook, so a REAL concurrent persona shift writing to `/tmp` (timers fire at `:50` + `RandomizedDelaySec=90`) can no longer make this suite flaky (the old case4 `find /tmp` counted the dispatcher's 13:50 CEST shift files during a 12:00Z run).

**Location**: `/data/repo/tests/test_identity_wrapper.sh`

**Usage**:
```
bash tests/test_identity_wrapper.sh
```

**How it stays hermetic**: a stub `opencode` is prepended to `PATH` (no model calls, no spend, 0.00 EUR); the wrapper runs against a throwaway git repo (`IDENTITY_REPO`), a private shift log (`IDENTITY_LOG`) and a private capture dir (`TMPDIR`), all inside a `mktemp -d` sandbox removed on exit. Case9 asserts the real repo's HEAD + `status --porcelain` are byte-identical after the whole suite.

**Exit codes**:
- `0` - all assertions pass (also `0` with a SKIP line if the wrapper is absent)
- `1` - one or more assertions failed

**Test hooks (env)**: `IDENTITY_REPO`, `IDENTITY_LOG`, `TMPDIR` — consumed by the wrapper under test; the suite always sets all three. Production defaults unchanged: real repo, real `agent-logs/identity-<id>.md`, `/tmp`.

**Dependencies**: bash, git, POSIX sh, find, grep — no network, no sqlite, no systemd.

**Tests**:
- `bash tests/test_identity_wrapper.sh` → **28 assertions**, <1s: `*-free` money guard (static: all 6 identity models + refusal branch), TMPDIR contract (static: 3/3 `mktemp "${TMPDIR:-/tmp}/identity…` + case4b behavioral — nonexistent dir ⇒ mktemp fails closed, wrapper exit 1), transcript stdout/stderr/rc-marker capture (case1-2), tmp-sweep survival — the original bug replayed (case3), no repo-local captures + trap cleanup asserted against the SANDBOX `TMPDIR` (case4), no-commit-on-no-op + pre-existing-WIP-survives (case5/5b), unknown identity exit 1 (case6), persona resolution (case7), scoped persona-work commit + msg format (case8), real-repo untouched (case9)
- Hermeticity proven: planted decoy `/tmp/identity-dispatcher.out.*` (simulated concurrent real shift) → suite still 28/28; the pre-fix `find /tmp` assertion counted it and failed

**Status**: Green ✅ 2026-09-24 (28/28 twice: clean run + concurrent-shift decoy run)
EOF
grep -c '^## ' /data/repo/tools/REGISTRY.md
15
> build · mimo-v2.6-flash-free
Now append the PROGRESS.md entry (STEP 0 note + step record):
$ cat >> /data/repo/agent-logs/PROGRESS.md <<'EOF'

## 2026-09-24T~13:00Z main-loop run — STEP 0 clear; hermetic case4 (identity suite) landed

**STEP 0 — investor reply check (ran FIRST, before any other work):**
- Unread `investor_to_agent` rows: **0** in dev (`/opt/startup/dev/data/messages.db`) and
  **0** in prod (`/opt/startup/prod/data/messages.db`) — both threads checked, per the
  unread-count contract (investor reads prod primarily).
- INBOX.md: grep for `## ` entries without a `~~HANDLED~~` marker → **none**. All five
  RECENT INBOX items in this run's brief were handled in earlier runs (mail :465/:993
  LE-cert adoption + MX, team page + `/team` routing fix + DNS standing rule, Dispatcher
  roster adoption, webmail operator fixes with PHP committed).
- **Replies owed: NONE** → no `agent_to_investor` rows inserted (nothing unanswered; an
  unanswered investor would have been a failed run). Still open on the INVESTOR's side:
  NEEDS-INVESTOR **msg #57** (A/B/C public-gating decision) — sent, still unopened;
  investor surface stays as-is until the call.

**Small verifiable step (the queued candidate from last run — DONE):** made
`tests/test_identity_wrapper.sh` case4 hermetic by teaching the system wrapper
`/usr/local/sbin/identity-run.sh` to honor `TMPDIR`.
- **Root cause**: case4 asserted `find /tmp -maxdepth 1 -name "identity-dispatcher.out.*"`
  == 0, but the real dispatcher persona's scheduled shift (identity-run@dispatcher.timer,
  13:50 CEST + `RandomizedDelaySec=90`) writes its own capture files to exactly that glob —
  a concurrent shift made the suite flaky (the 12:00Z run overlapped the 13:50 shift).
- **Fix**: wrapper's 3 `mktemp` calls now use `${TMPDIR:-/tmp}/identity-$ID.{out,pre,post}`
  (default unchanged: `/tmp`); the suite sets a private `TMPDIR=$SANDBOX/tmp` for every
  `run_wrapper` call and case4 now `find`s that sandbox dir instead of `/tmp`.
  (Wrapper is system scope, not in git — mirrors the `agent-loop.sh` rule; the contract is
  enforced by the in-repo test, which reads the live wrapper.)
- **2 new assertions** pin the hook so it can't silently regress: static `3/3` mktemp lines
  honor TMPDIR + **case4b** behavioral (nonexistent `TMPDIR` ⇒ mktemp fails closed ⇒
  wrapper exit 1 — an ignored hook would exit 0 via the stub).
- **Verified**: `bash tests/test_identity_wrapper.sh` → **28/28, exit 0**; then re-ran with
  a decoy `/tmp/identity-dispatcher.out.DECOY-CONCURRENT-SHIFT` planted (simulated real
  concurrent shift) → still **28/28** (the pre-fix assertion counted such files and failed);
  decoy removed after, `/tmp` clean of capture files. Case9: real repo HEAD + status
  byte-identical across the whole suite. No model calls (stub `opencode`), spend 0.00.
- **Docs**: `STRUCTURE.md` (wrapper contract: 26→28 assertions, `TMPDIR` hook bullet with
  the flake incident, capture-path line now `${TMPDIR:-/tmp}`), `tools/REGISTRY.md` —
  **new section**: the suite was never registered there (Rule 3 gap) — now registered with
  purpose/usage/exit codes/ hooks/28-assertion breakdown.
- **Money**: model spend **0.00** (`*-free` only — suite stubs `opencode`), no purchase,
  no DNS write, no secret read, no service restart, prod untouched.

**Next-candidate queued, not actioned**: (1) `source-sync-check` invoked via the
`/data/tools` symlink resolves `repo=/data` — `abspath` not `realpath` in
`default_repo()` — fails closed with exit 3 instead of comparing wrong trees; one-word
fix (`realpath`) + doc note if promoted. (2) NEEDS-INVESTOR msg #57 still awaiting the
investor's A/B/C public-gating decision.
EOF
echo APPENDED; tail -5 /data/repo/agent-logs/PROGRESS.md
APPENDED
**Next-candidate queued, not actioned**: (1) `source-sync-check` invoked via the
`/data/tools` symlink resolves `repo=/data` — `abspath` not `realpath` in
`default_repo()` — fails closed with exit 3 instead of comparing wrong trees; one-word
fix (`realpath`) + doc note if promoted. (2) NEEDS-INVESTOR msg #57 still awaiting the
investor's A/B/C public-gating decision.
$ cd /data/repo && git status --porcelain
M STRUCTURE.md
 M agent-logs/PROGRESS.md
 M tests/test_identity_wrapper.sh
 M tools/REGISTRY.md
> build · mimo-v2.6-flash-free
$ cd /data/repo && git add -A && git commit -q -m "fix: identity-run.sh honors TMPDIR + case4 asserts the sandbox capture dir — suite hermetic against concurrent real persona shifts (28 assertions, decoy-/tmp verified); register test_identity_wrapper.sh in REGISTRY, STRUCTURE 26->28 + TMPDIR hook contract, PROGRESS STEP-0 clear" && git log --oneline -1 && git push origin main 2>&1 | tail -3; git ls-remote origin main
b4eee82 fix: identity-run.sh honors TMPDIR + case4 asserts the sandbox capture dir — suite hermetic against concurrent real persona shifts (28 assertions, decoy-/tmp verified); register test_identity_wrapper.sh in REGISTRY, STRUCTURE 26->28 + TMPDIR hook contract, PROGRESS STEP-0 clear
To git://git.gladex.de/gladex.git
   0253d54..b4eee82  main -> main
b4eee82c98823e956c959da85b2c03e9c1e443b6	refs/heads/main
> build · mimo-v2.6-flash-free
Committed and pushed (`b4eee82`, remote verified at same SHA). Final sanity checks:
$ sh -n /usr/local/sbin/identity-run.sh && echo "wrapper syntax OK"; ls -d /tmp/idw-test.* 2>/dev/null || echo "no sandbox leftovers"; grep -n 'mktemp "' /usr/local/sbin/identity-run.sh
wrapper syntax OK
no sandbox leftovers
34:OUT="$(mktemp "${TMPDIR:-/tmp}/identity-$ID.out.XXXXXX")" || { echo "mktemp failed" >&2; exit 1; }
35:PRE="$(mktemp "${TMPDIR:-/tmp}/identity-$ID.pre.XXXXXX")" || { rm -f "$OUT"; echo "mktemp failed" >&2; exit 1; }
36:POST="$(mktemp "${TMPDIR:-/tmp}/identity-$ID.post.XXXXXX")" || { rm -f "$OUT" "$PRE"; echo "mktemp failed" >&2; exit 1; }
$ cd /data/repo && bash tests/test_identity_wrapper.sh 2>&1 | tail -2; sqlite3 /opt/startup/dev/data/messages.db "SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0;"; sqlite3 /opt/startup/prod/data/messages.db "SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0;"
ok   - case9 real repo status unchanged (d41d8cd98f00b204e9800998ecf8427e  -)
Results: 28 passed, 0 failed
0
0
> build · mimo-v2.6-flash-free
Run complete. Summary:

**STEP 0 — investor replies (ran first):**
- Unread `investor_to_agent` rows: **0** in dev and **0** in prod DBs — both threads checked.
- INBOX.md: zero unhandled entries (all five RECENT INBOX items — mail :465/:993 LE certs + MX, team page & `/team` fix, Dispatcher roster, webmail operator fixes — already handled in prior runs).
- **Nothing owed → no replies inserted**; noted in PROGRESS.md. Still open on the investor's side: NEEDS-INVESTOR **msg #57** (A/B/C public-gating decision), sent but unopened.

**This run's small verifiable step — identity-wrapper case4 made hermetic** (the queued candidate from last run):
- **Root cause**: case4 asserted `find /tmp ... identity-dispatcher.out.*` == 0, but the real dispatcher persona's scheduled shift writes its own captures to that exact glob — a concurrent shift (13:50 CEST) made the suite flaky.
- **Fix**: `/usr/local/sbin/identity-run.sh` now honors `TMPDIR` in all 3 `mktemp` calls (`${TMPDIR:-/tmp}/…`, production default unchanged); the suite runs every wrapper invocation with a private sandbox `TMPDIR` and case4 asserts against that dir instead of `/tmp`.
- **2 new assertions** pin the hook: static 3/3 mktemp-lines + case4b behavioral (nonexistent `TMPDIR` ⇒ mktemp fails closed ⇒ exit 1; an ignored hook would exit 0).
- **Verified**: suite **28/28 exit 0**, then again with a planted decoy `/tmp/identity-dispatcher.out.*` simulating a real concurrent shift → still 28/28 (the old assertion would have failed). Wrapper `sh -n` clean, no sandbox leftovers, case9 real repo untouched.
- **Docs**: STRUCTURE.md (26→28 assertions, TMPDIR hook bullet + incident), REGISTRY.md (**new section** — this suite was never registered, Rule 3 gap), PROGRESS.md entry appended.

**Money**: model spend **0.00** (`*-free` only; suite stubs `opencode`, zero model calls), no purchases, no DNS writes, no service changes.

**Commit**: `b4eee82` — pushed to `git://git.gladex.de/gladex.git`, remote main verified at same SHA.

**Queued for next run**: `source-sync-check` `abspath`→`realpath` one-word fix (fails closed today via the `/data/tools` symlink), plus chasing msg #57 once the investor opens it.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Sep 25 01:43:00 2026] 127.0.0.1:44134 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44134 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Closing
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Accepted
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Closing
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Accepted
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53610 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53610 Closing
[Fri Sep 25 01:43:39 2026] 127.0.0.1:34760 Accepted
[Fri Sep 25 01:43:39 2026] 127.0.0.1:34760 Closing
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34764 Accepted
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34764 Closing
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34780 Accepted
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34780 Closing
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51444 Accepted
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51444 Closing
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51450 Accepted
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51450 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51462 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51462 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51470 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51470 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51474 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51474 Closing
[Fri Sep 25 01:44:41 2026] 127.0.0.1:51486 Accepted
[Fri Sep 25 01:44:41 2026] 127.0.0.1:51486 Closing
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51490 Accepted
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51490 Closing
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51494 Accepted
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51494 Closing
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53326 Accepted
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53326 Closing
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53332 Accepted
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53332 Closing
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53346 Accepted
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53346 Closing
[Fri Sep 25 01:45:12 2026] 127.0.0.1:53360 Accepted
[Fri Sep 25 01:45:12 2026] 127.0.0.1:53360 Closing
[Fri Sep 25 01:45:12 2026] 127.0.0.1:53368 Accepted
[Fri Sep 25 01:45:12 2026] 127.0.0.1:53368 Closing
[Fri Sep 25 01:45:13 2026] 127.0.0.1:53382 Accepted
[Fri Sep 25 01:45:13 2026] 127.0.0.1:53382 Closing
[Fri Sep 25 01:46:00 2026] 127.0.0.1:34850 Accepted
[Fri Sep 25 01:46:00 2026] 127.0.0.1:34850 Closing
[Fri Sep 25 01:46:01 2026] 127.0.0.1:34858 Accepted