VERIFY stage for P1 v0.7. Four verification layers:
1. STRUCTURAL: go vet ./x/cover/... ./lexicon_meta_cover/... — CLEAN
2. BEHAVIORAL: go test -race ./x/cover/... — GREEN (no race conditions)
3. SECURITY: 4 lexicon meta-tests green (x/, docs/, web/, cover/); G-003
production firewall intact (no cross-module struct imports in
x/cover/types — only expected_keepers.go interface references); G-028
go.mod/go.sum diff EMPTY
4. QUALITY: coverage x/cover/types 97.8%, x/cover/keeper 94.1%,
x/cover/firewall 100.0% — all ≥80% target
All existing v0.1-v0.6 tests still pass (no regressions).
---ci---
project: oy
phase: 1
milestone: v0.7
status: verify
---/ci---
Add the new x/cover module (Cover Pool runtime) implementing P1 of the
v0.7 milestone: CoverPool/CoverFeeTag/CoverCall types with the 4 GRILL-
ratified locked consts (CoverReserveFloorAnnualContribX=1.5,
CoverReserveCeilingAnnualContribX=2.5, CoverStandingGateTrusted=4.0,
CoverStandingGatePreferred=4.5), the 8-category/3-phase CoverCategory
enum with D-086 FactoryAllowedPhases=[Phase2]-only default, three Msg*
types (LaunchCoverPool/RouteCoverFee/FileCoverCall) with full sdk.Msg
impls, store-backed Keeper with 4 G-003 expected-keeper shims
(StandingKeeper/WatcherKeeper/BondKeeper/StillKeeper), and three
handlers enforcing the D-077 Standing gate, D-086 category phase check,
REQ-047 reserve floor + below-floor auto-pause (D-089(1) Still
invocation), and REQ-050 category-tag match.
Add the x/cover/firewall subpackage (Anti-Crowding-Out firewall, D-079/
D-088): a stdlib-only leaf checker enforcing RightNoTaxOnPersonalStash
by rejecting Cover-Fee routing to the Root-Pool operating-expenses
destination (defense in depth with the lexicon meta-test).
Add the lexicon_meta_cover meta-test (4th lexicon firewall, D-088):
scans x/cover/**/*.go for both lexicon.FindBannedTerm (10 project-wide
terms) AND lexicon.FindCoverBannedTerm (4 Cover-specific terms), with
G-013 walk-coverage + G-009 self-test tables.
Add lexicon.CoverBannedTerms()/FindCoverBannedTerm()/
SyntheticCoverBannedStrings() helpers (additive to the existing
project-wide BannedTerms — no changes to existing helpers).
Apply D-088(3) optional doc-fix: replace 'insurance-like' with
'Cover-like' in x/pact/types docstrings.
Coverage: x/cover/types 97.8%, x/cover/keeper 94.1%, x/cover/firewall
100.0%. go.mod/go.sum unchanged (G-006/G-028). All existing tests pass.
REQs: REQ-046, REQ-047, REQ-049, REQ-050
---ci---
project: oy
phase: 1
milestone: v0.7
status: execute
---/ci---
GRILL stage for v0.7. ci-griller red-teamed the plan across 9 axes + 7
specific probes. Overall verdict: CONDITIONAL PASS (confidence 0.72).
5 binding decisions applied to PLANS.md + ARCHITECTURE.md + oy-state + PROJECT.md:
- D-086: P1 Factory functional for Phase-2 categories ONLY (FactoryAllowedPhases
= [Phase2] in P1; P2 extends to [Phase2,Phase3,Phase4]); P1 simtest adds
out-of-phase rejection negative case
- D-087: PierCarriesVoice=false added as 12th locked const (was 11; now 12)
in x/guild/types (FR-VOICE-6 mission-locked invariant)
- D-088: lexicon_meta_cover uses new lexicon.CoverBannedTerms() helper
(insurance/premium/claim/policy scoped to Cover surface, NOT project-wide);
x/cover/firewall pinned to allow-list of routing destinations (string-
equality check); optional x/pact insurance-like -> Cover-like doc-fix
- D-089: StillKeeper satisfied by simtest-local stub (x/still NOT extended
this milestone; x/still/keeper/ verified empty); x/bond -> x/cover
CoverKeeper reverse edge added to dependency map (MsgDebitMABProceeds
queries CoverKeeper.GetPoolReserveAccount; no import cycle, interface only)
- D-090: Bill of Rights temporal-gap fix (RightID + 13 Waivable* consts +
RightIsWaivable() + ValidateBasic gate land in P2, NOT P5 — closes the
P2->P5 window where rights were waivable); Voucher cold-start fix
(bond = max(10x avg, MinimumVoucherBond) — no zero-bond bypass); Standing-
gate dual check (floor enforced at BOTH launch handler AND Params-amendment
ValidateBasic); D-085 escalation window tightened to before P2
3 escalations to PO: D-085 (13th right identity, confidence 0.55),
lexicon banned-term scope (griller recommends Cover-scoped helper),
pen-test third party (this grill IS the self-administered review per
oy-state §7 item 4).
This grill IS the self-administered adversarial review (pen-test) per
oy-state §7 remaining-open item 4. High/critical findings (D-090(1)
temporal gap, D-088 lexicon paper tiger, D-090(2) Voucher cold-start)
are remediated in P0 via binding decisions D-086..D-090.
---ci---
project: oy
phase: 0
milestone: v0.7
status: grill
---/ci---
Ingest oy-spec v3 (net-new-only diff against spec-v2):
- 52 new REQs REQ-046..REQ-097 (v0.7 REQ-046..066, v0.8+ REQ-067..097)
- §5: 4 new constraints (no subsidies, Anchor no-Voice, Sovereign Anchors
separate SPEC, Pier-Routed Legal Wrapper OPTIONAL)
- §7: v0.7 Fraternal Groups Foundation + v0.8 Risk Mitigations plan
- §8: 8 open questions with PO recommendations
- Trimmed restated baseline/Principles/Lexicon/invariants (locked, in force)
Per PO ruling 2026-08-18. ciagent acknowledges; P0 will regenerate oy-state v2.
OY-specific template the PO copies to .ciagent/oy/oy-spec (no .md) when
starting a fresh milestone cycle. Pre-fills the locked baseline that does not
change between milestones (Six Principles §3, Constraints §5, Lexicon §6,
REQ-001..REQ-021 locked-vision rows in §4, Rules + Commit convention blocks).
Clears the per-milestone content the PO must fill (§1 Objective, §2 Vision
source locked-sections, §4 acceptance criteria, §4 new REQ-022+ rows, §7
Milestone intent, §8 Open questions, §9 Changelog).
Each placeholder is a <!-- TODO --> comment so the PO can grep for unfilled
slots. The header comment block explains what is pre-filled vs what the PO
fills, and points to oy-state §2 for the current max REQ-ID before adding new
rows.
Lives at .ciagent/oy/oy-spec-template.md (.md extension because it is a
reference file the PO reads in an editor, not ingested by the ciagent — the
working oy-spec / oy-state keep the bare-stem convention for ingestion).
---ci---
phase: 0
milestone: v0.6
status: execute
project: oy
---/ci---
Establishes the two-doc contract between the product owner and the ciagent:
- oy-spec (PO-authored, ciagent ingests): authoritative product input
- oy-state (ciagent-authored, PO ingests): current shipped state
Both live in .ciagent/oy/ with no .md extension (PO ingestion keys on the
bare stem oy-spec / oy-state). The 10 existing .ciagent/oy/*.md files remain
ciagent-internal working memory. PROJECT/REQUIREMENTS/ARCHITECTURE gain a
one-line header note pointing to oy-spec as the source and oy-state as the
shipped-state mirror.
oy-spec holds the schema the PO fills (Objective, Vision source, Principles
[locked], Requirements table with acceptance criteria, Constraints, Lexicon
[locked], Milestone intent, Open questions, Changelog) + the mandatory
docs(spec): Conventional Commit convention for spec edits.
oy-state is backfilled from shipped v0.6 state: 45-REQ coverage table, 24
locked constants, 18 deferred items, firewall status (G-003 GREEN, G-006
controlled exception cosmos-sdk v0.50.8, REQ-012 GREEN x3, Mission Lock
GREEN, coverage >=80% GREEN), and 5 open PO decisions for v0.7 scoping.
Closes the loop: PO reads oy-state -> edits oy-spec (docs(spec): commit) ->
ciagent regenerates PROJECT/REQUIREMENTS/ARCHITECTURE at next P0 -> flags
drift in oy-state §5. Prevents re-proposing shipped or explicitly-deferred
REQs.
---ci---
phase: 0
milestone: v0.6
status: execute
project: oy
---/ci---
web/handlers/window.go: GET /window (list), GET /window/new (form),
POST /window (open), GET /window/{id} (detail+lifecycle+audit), POST
/window/{id}/activate|revoke|expire (lifecycle transitions). Store
extensions: OpenWindow/ActivateWindow/RevokeWindow/ExpireWindow/
ListWindows/GetWindow/GetAuditLog — all call the REAL x/window/types
Window.Activate/Revoke/Expire methods (not reimplementation). Revoke on
Expired is a no-op (v0.2 terminal-state contract). AuditEntry appended on
each transition. 3 Window templates. window_test.go: lifecycle
correctness (asserts real methods invoked), idempotent revoke, revoke-on-
expired no-op, G-026 error lexicon checks. Coverage: store 99.2%,
handlers 87.7%.
---ci---
project: oy
phase: 3
milestone: v0.6
status: execute
---/ci---
Go 1.22 net/http.ServeMux + html/template + http.FileServer for static.
HTMX 2.0.10 vendored as web/static/htmx.min.js (NOT go get; G-006).
base.html layout with nav to all 5 screens. home.html overview.
---ci---
project: oy
phase: 1
milestone: v0.6
status: execute
---/ci---
Add lexicon_meta_web/ sibling meta-test mirroring lexicon_meta_docs/. Scans
web/templates/**/*.html + web/static/**/*.js + web/**/*.go using the shared
lexicon.FindBannedTerm (no detection reimplementation). Includes G-009
self-test table (lexicon.SyntheticBannedStrings), banned-terms count (10),
openyield/european false-positive guard, and G-013 walk-coverage (injects a
synthetic banned-term fixture into web/templates/.lexicon_fixture/ and
asserts the walk finds it). Firewall passes green with zero web content
(closed by the walk-coverage test).
---ci---
project: oy
phase: 1
milestone: v0.6
status: execute
---/ci---
cloudinit-bot