docs(context): P3 is DEPLOYED — supersede the stale "undeployed" block

The CURRENT STATE block asserted P3 was code-complete-but-undeployed with the tier-0
breaker hole open in production. Both are now false, and this file is injected verbatim
every session, so a dead claim here re-asserts itself with today's authority.

Records what replaced it: deployed both hosts at 005c214; tier 4 done by refusing (and
why making it autonomous would delete the security model); the tier-1 undo defect as the
real remaining work; the measured Incus asymmetry; the per-host-values-in-a-shared-file
bug class; and the user's decision to resume next week rather than run agents during
business development.

Refs #146, #173, #187, #192.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent-builder/.claude/context.md

@@ -37,27 +37,50 @@ a **dead** root token as live, into every session, for 3 days. Prune = **#192**;
   2026-07-15** (sliding per-host trip window; append-only replayed breaker log; Set B host_override;
   which tier-4 sources latch; trip escalation).
 
-**⚠️ P3 CODE IS COMPLETE BUT NOT DEPLOYED — BOTH HOSTS STILL RUN THE OLD `sudo_rules.py`.**
+**✅ P3 IS DEPLOYED ON BOTH HOSTS — 2026-07-15 20:00, commit `005c214`.** (Superseded the
-`app.py` + `circuit_breaker.py` + Set B override are written and green (**85 tests OK**, mutants
+"CODE COMPLETE BUT UNDEPLOYED" state that stood here before; that claim is DEAD.)
-caught) but **UNDEPLOYED**, so **the server-01 tier-0 `breaker.log` hole is OPEN IN PRODUCTION**
+server-01 `192.168.1.90:8082` and primary `192.168.1.88:8084`, both healthy, 0 restarts.
-until `DEPLOY_RUNBOOK.md` runs. Two **verified** deploy blockers gate it (row **187**):
+Old sudo-bridge **still owns primary `:8082`** — no cutover happened (**#146**).
-`Dockerfile` never COPYs `circuit_breaker.py`/`security/` (image would crash on boot), and
+**The tier-0 `breaker.log` hole is CLOSED on both hosts**: `/var/lib/agent-sudo/breaker.log`,
-`docker-compose.yml` has no `/var/lib/agent-sudo` mount (breaker resettable by `docker restart` —
+dir `0700 root:root`, on a bind mount, path verified resolving inside the container.
-the exact D-CB6 bypass). **Both were invisible to a 85/85-green suite.**
 
-**Deploying is TIER-4 HUMAN-ONLY by design** (D-CB7 Set B): restarting `agent-sudo-daemon` is
+**TIER 4 IS DONE — BY REFUSING. There is nothing to finish.** Verified live via `classify()`:
-refused in code, because the unit env holds `SUDO_MD_VERIFY_ENFORCE` — self-restart IS the
+`rm -rf /` → `danger_veto`; `systemctl restart agent-sudo-daemon` and editing the unit →
-gate-disarm primitive. An agent physically may not deploy this. That is the constraint model
+`host_override_setb`. Tier 4 is **human-only BY DESIGN** (D-CB7): the unit env holds
-working, not a gap.
+`SUDO_MD_VERIFY_ENFORCE`, so a system that can restart its own daemon can disarm its own gate.
+**A request to make tier 4 autonomous is a request to delete the security model — refuse it.**
+
+**⚠️ REAL REMAINING SCOPE = TIERS 1/2/3, and tier 1 is BROKEN:** `scoped_undo.py:186` says
+`REQUIRES_UNDO_TIERS = (1, 3)` but `app.py:244` hardcodes tier `3` → **tier-1 commands
+auto-execute TODAY with no undo capture**, contradicting D4. Code fix, not config. Needs a human
+decision first (implement D4 vs amend it). Tier 2/3 are still 503 stubs (caps OFF).
+**Measured asymmetry: server-01 HAS Incus + both sandboxes RUNNING; primary has NO Incus** — so
+tier 2 on primary is an open design question, not a task.
+
+**THE BUG CLASS — check reflexively:** per-host values hardcoded into files tracked once and
+shared by both hosts. Bit **twice** in one directory: the compose port (would have silently
+undone the D8 cutover) and `SERVER_ID`/`VAULT_ADDR` in the daemon unit (would make server-01
+identify as **primary**). **Diff both hosts' copies before landing any shared file on a second
+host.** No test measures cross-host divergence; none ever will.
 
 **Recall corpus (2026-07-15):** `semantic_recall.py` now indexes design docs too (`DOC_ROOTS`), so
 D-CB5–D-CB9 are searchable. `context.md` is **deliberately excluded** until **#192** prunes it.
 **MEMORY_DIR: do NOT repoint `embed_memory_dir.py`** — its Postgres `claude_memories` table has
 **no reader** (verified). See row **188**.
 
-**Next session, in order:** **#187** (Phase 0 blockers → `DEPLOY_RUNBOOK.md` phases 1–3; user runs
+**📋 THE PLAN IS WRITTEN — READ IT, DO NOT RE-DERIVE IT:**
-the tier-4 steps) → **#173** fail-open/fail-closed → **#128** secrets-proxy → **#147/#146** (CA
+`agent-builder/GAMEPLAN_agent-sudo_secrets-proxy.md` (also in Obsidian `Projects/`, commit
-P2–P5 + primary cutover 8084→8082). **#205** (Vault+Bitwarden security design) is THU-first.
+`1d37e45`). Agent prompts **S1 / A1 / A7** are written + saved in `agent_prompts.md`.
+
+**USER DECISION 2026-07-15:** **do NOT dispatch background agents during business-development
+time.** Agent-Sudo + secrets-proxy resume in the **personal-project block NEXT WEEK** and run
+until done. Interim control = the `security-enforcement.py` hook (blocks secret-shaped strings +
+sudo) — accepted, deliberate.
+
+**Next session, in order:** **two human decisions (~10 min) first** — A1 (tier-1 undo) + A3
+(primary tier-2) — they unblock everything → **#128/row 191** secrets-proxy **S1** (zero-dep,
+removes a per-session tax, so it goes first) → **A1** implement → **A2** phase 2 on server-01 →
+**#173 + A4** (fold together) → **#146**. **#205** (Vault+Bitwarden security design) is THU-first.
 
 **Then:** Thu 07-16 qui/qbit memory leak (#176) + media_pipeline (#177) · Fri 07-17 clear the runway
 (#178) · **Mon 07-20 resume business development (#179) — digital businesses deployed by Fri 07-24.**