ID-71.26/.27 — goose pilot deploy plan

ID-71.26 + 71.27 — goose pilot deploy plan

S436 drift notes (body unchanged below): (1) the ~16 GB box assumption is wrong — Server B is 4 GB, so the cocoindex/goose images must build off-host (the soak’s “box RAM < 16GB” line reflects the stale assumption); (2) the “pinned v1.38.0” tag actually resolves to goose 1.30.0 (digest sha256:d85a724e…) — verify the digest at G1; (3) the G4 supervised run has never completed — the pilot is not yet proven end-to-end. See reference/deployment-architecture.md §7.

Authored S420 by a read-only Plan agent over TECH.md, headless-requirement-refinement.md, onprem-deploy.yml, deploy/coolify/*.yaml, app/api/mcp/[transport]/route.ts, lib/mcp/auth.ts, onprem-b1-deploy.md. READ-ONLY design — create the repo files + run the interactive deploy when executing {71.26}. Both subtasks remain pending in the ledger.

Decisions

1. Image + sizing. Pin ghcr.io/block/goose@sha256:<digest> resolved from v1.38.0 (never :latest; pin-and-soak). Container cpus:1.0 / memory:512M (res 128M). Local footprint is orchestration/IO only (inference = remote-Anthropic, MCP = remote-Vercel). Real risk is Anthropic token-burn, handled by boot-idle (sleep infinity); the recipe fires ONLY via one Coolify scheduled task (mirrors the cocoindex boot-never-walks gate).
2. Remote-MCP auth. Recipe → /api/mcp/mcp with a Supabase OAuth bearer JWT + X-MCP-Actor: headless (lib/mcp/actor.ts opt-in → propose-writes allowed, publication refused). JWT minted per-run by a wrapper from a dedicated editor service-actor user (password-grant). /api/ already bypasses the proxy login-redirect → no publicRoutes change.
3. Healthcheck = pgrep -f 'sleep infinity' — no goosed, no TLS port → sidesteps goose #7685.
4. OQ-A RESOLVED (Liam, S420): deploy on 87.106.72.59 (Server B = Platform box + Coolify control plane; client is 88.208.255.178). The runbook’s 77.68.122.71 was stale → fix the runbook.

Proposed new files (author at execution)

• deploy/coolify/docker-compose.goose.yaml — service def (boot-idle, 512M cap, #7685-safe healthcheck).
• deploy/coolify/goose/o4-pilot.yaml — recipe: cron → remote-MCP get_reorientation → push + create_content_item (publication_status draft = the propose-row / {71.9} whats_in_my_queue).
• deploy/coolify/goose/run-pilot.sh — wrapper: mint Supabase token → goose run --no-session --recipe.
• deploy/coolify/goose/config.yaml — GOOSE_PROVIDER: anthropic / GOOSE_MODEL: claude-sonnet-4-6.

Deploy gates

G0 land files → G1 pin image + tool-probe (curl/python3/goose in image) → G2 create Supabase service-actor (editor role) → G3 deploy idle (healthcheck green, burn-guard headroom) → G4 supervised first run (O4 read → push → ONE draft, no publish, one Anthropic run) → G5 ~7-day soak → G6 adopt (enable cron, ratify the digest pin = B-INV-21 gate).

Open questions (Liam ratify at execution)

• OQ-B headless auth lifecycle: dedicated editor service user + per-run password-grant wrapper (recommended) vs goose-native OAuth; verify curl+python3 present in the image at G1.
• OQ-C push leg via builtin shell curl (push-channel.ts is a server lib, not an MCP tool) — post-pilot wrap as a deliver_briefing MCP tool; confirm the concrete MCP_PUSH_WEBHOOK_URL.
• OQ-D recipe/config provisioning: Coolify bind-mount (+Base Directory) vs file-mounts.
• OQ-E confirm the production MCP URL (repo only has staging Vercel URLs) + the exact model id.
• OQ-F eval harness wiring into ID-104 (Raindrop Workshop-local, zero egress).

Soak (7d): box RAM < 16GB; goose RSS < 512M no OOM; cocoindex walks still complete; exactly one run

per tick + zero unexpected Anthropic spend; FC push + inventory-equality green; healthcheck green; one draft per run (no dupes), push delivered or clean skip, never a publish.