Skip to content

P1-005 — Multi-Channel Request Intake And Control Tower/Orca/Codex Baseline

  • Status owner: P1-010 final ROADMAP schema — transition evidence only
  • Execution result: IN PROGRESS — CROSS-REPOSITORY CLOUD RO COMPLETE / FRESH LOCAL RO REQUIRED
  • Owning Phase: P1 — Product, Documentation, Benchmark And Repository Foundation
  • Lane: Cross-repo Cloud RO + Local RO
  • Parallel: possible
  • Depends on: none
  • Activation condition: the user's instruction to run P1-005; no dependency
  • Unlocks: P1-006 only after the Local RO closure evidence is attached; this Cloud baseline may be used as draft input but is not full dependency closure
  • Observation date: 2026-07-30 Asia/Ho_Chi_Minh
  • CTC Runtime source basis: kylejang1/ctc master@d61b5cba1395d795469dcf9556d902290a633ded
  • CTC transition-document basis: kylejang1/ctc qa as observed before this record
  • Control Tower source basis: kylejang1/control-tower main@239ca7503350d943278a5d5b440a6847d726705d
  • Product value: before designing Request Operations, separate the real intake, session, identity, tenant, duplicate, audit and retired development surfaces, so that errors premised on restoring an old Task or on a registry that does not exist are prevented.
  • Stable planning input: ../requirements/CTC_PRODUCT_PLATFORM_AND_DOCUMENTATION_RESET.md
  • Current CTC boundary: ../../.agents/rules/CONTROL_TOWER.md

1. Outcome And Completion Boundary

The following was confirmed in the cross-repository Cloud read-only scope of P1-005.

  1. No current generic Request registry, Request API, Request store or cross-channel Request lifecycle exists in the active source of either repository.
  2. The current intake surfaces are not one system; they are separated as follows:
  3. developer/direct session and repository evidence
  4. maintenance-only Codex Portal session API
  5. CTC-only Orca launch/admission/audit bridge
  6. disabled-by-default legacy Orca Pilot
  7. tenant-aware monitoring incident ingestion
  8. deployment/tenant/mapping admin integration of CTC Runtime
  9. A Codex session, an Orca access action, a monitoring incident and an HTTP request each have some persistence and identity, but there is no versioned envelope, canonical ID, duplicate relation, owner/status lifecycle or retention contract binding them into one business Request.
  10. The old Control Tower Managed Task/Program/Feature/session-binding surfaces are blocked with HTTP 410 in the current source and removed from operational persistence. Surviving type/import/helper/schema names are not Request authority.
  11. The old docs/REQUESTS.md on CTC master and the invalidation notice on qa conflict with each other. The reset and the qa transition notice are the current planning inputs, and the Markdown REQ-xxx queue is not used as a live system.
  12. The Request Operations topology that P3 will choose is an OPEN_DECISION. This Task selects none of the Control Tower DB, the CTC operational DB, the old Task SQLite or GitHub Issues/Projects as the default store.

P1-005 as a whole is not yet COMPLETE. The lane includes Local RO, and the following could not be proven by connector-only source review:

  • the real enablement flags and installed service state on QA/Hub
  • the deployed Control Tower SHA and the static-server/interceptor entrypoint
  • the real 410/403/404/200 response matrix of authenticated HTTP
  • the current control-plane.sqlite, Codex session owner/audit state and the absence of retired keys
  • the installed schema and current rows of the CTC Control Tower DB
  • the actual Orca Runtime, pairing boundary, workspace/session handoff and filesystem isolation
  • production/QA browser behaviour, log redaction, retention and operator use

Cloud source facts and Local facts are not mixed. This document is a source baseline that keeps P1-006/P3 from designing against a current Request system that does not exist.

2. Evidence Classes

Class Meaning Use
CURRENT_SOURCE executable source read directly from the named current branch/ref judging the active route, payload, persistence and guards
CURRENT_TEST_CONTRACT a current test pins a source string or behaviour confirms the intended regression boundary; does not mean the test run passed
CURRENT_BOUNDARY_DOC the owning boundary/disposition document reconciled against the current source product intent and source reconciliation
BRANCH_DIVERGENCE master and qa claim different authority neither side may be generalised uncritically before merge or cleanup
RESIDUAL_SOURCE the owning route/state is retired but a type/import/helper/schema remains must not be read as an active capability; it is input for later cleanup
DOMAIN_SPECIFIC valid only in one domain such as incident, session or access must not be generalised into a generic Request capability
LOCAL_UNVERIFIED requires a host, environment, filesystem, service, DB or browser no enabled/absent/PASS assumption before fresh Local RO
OPEN_DECISION a P3 ADR/owner review has to choose no implementation or topology decision in this Task

3. Current Architecture Baseline

3.1 Current source reality

Developer/direct --------> source session / repository evidence
Codex Portal ------------> Codex session + transcript + attachment + audit
CTC-only Orca -----------> fixed CTC access admission + launch/pairing audit
Legacy Orca Pilot -------> generic private launcher, disabled by default
System/monitoring -------> tenant incident + event + delivery ledger
CTC Runtime admin -------> deployment / tenant / deployment mapping registry

                 no shared Request envelope
                 no shared Request registry
                 no cross-channel dedup/lifecycle

3.2 P3 target input, not current implementation

Developer / Codex / Orca / Field / System
                    |
                    v
         Versioned Request Envelope
                    |
                    v
          Request Registry / Events
                    |
        Triage / Dedup / Routing
                    |
  Bounded work | Existing Phase Task | Promotion review | Incident

The target diagram does not select storage and does not authorize reuse of old Managed Task surfaces.

4. Channel And Surface Matrix

Channel / surface Current source entry Current persisted evidence Actor provenance Tenant provenance Duplicate behavior Request-system result
Developer / direct user request No generic HTTP or repository service endpoint identified; current request/session and approved repository evidence are manually preserved chat/session outside these repos, Git commit/doc evidence when explicitly written external to current source external/manual manual comparison only SOURCE_CHANNEL / NO CURRENT ADAPTER
Codex Portal create POST /api/control-tower/codex/projects/:projectKey/sessions with prompt, workload, model, attachments Codex JSONL/thread, owner record, attachment links, action audit/runtime log Control Tower authenticated user; owner fields include createdByUserId/createdByUsername optional access-scope arrays exist, but no canonical tenant is carried in the create payload or session Request record no generic dedup; misleading createOrReuse... currently delegates directly to create MAINTENANCE_ONLY SESSION INTAKE
Codex Portal follow-up POST .../sessions/:sessionId/messages, stop/rename/archive/restore/delete/read/search endpoints existing session lineage, activity/queue, audit authenticated browser or explicit loopback agent for the narrow update endpoint no per-message canonical Request tenant session/run queue semantics only SESSION LIFECYCLE, NOT REQUEST LIFECYCLE
CTC-only Orca GET .../ctc-orca/bootstrap, POST .../launch, current source also has POST .../pairing sanitized JSONL audit for launch/pairing; external Orca owns workspace/session signed Control Tower browser account with canonical CTC project access none in the access action; target is fixed repository, not tenant no request payload and no duplicate relation FIXED ACCESS/ADMISSION BRIDGE
Legacy Orca Pilot /orca-pilot/bootstrap and /orca-pilot/launch operational audit/runtime log authenticated superadmin browser only none none DISABLED-BY-DEFAULT LEGACY ACCESS SURFACE
Field/operator Named by the reset/Request transition notice no generic current source adapter identified in inspected active API/client/server surfaces undefined undefined undefined REQUIREMENT / SOURCE GAP; absence of an adapter is not proof that no manual field channel exists
System/monitoring POST /api/control-tower/incidents/canary-results incidents, incident events, Telegram delivery ledger superadmin API caller plus probe fields required tenantId event duplicate by incident/probe/kind; callback and delivery idempotency are domain-specific DOMAIN-SPECIFIC INCIDENT INTAKE
CTC Runtime Control Tower admin CTC admin API/helper and Control Tower runtime synchronization deployment, tenant, tenant-deployment mapping CTC admin/session and Control Tower actor depending on call path explicit tenant registry/mapping entity upsert semantics, not Request duplicate OPERATIONAL REGISTRY, NOT REQUEST STORE
GitHub repository source/commit collaboration Git history Git identity none as Request provenance commit/content semantics only SOURCE HISTORY; NOT REQUEST/TASK STATUS AUTHORITY

5. Active Control Tower Product Boundary

Current Control Tower active frontend API client exposes these capability families:

  • project/GitHub repository metadata
  • deployment, tenant and tenant mapping
  • runtime config draft/dry-run/release
  • health, smoke test and history
  • audit, activity and runtime logs
  • Codex access/session compatibility
  • API catalog and DB inspector

It exposes no Request, RequestEvent, RequestRelation, RequestOwner, RequestStatus or generic intake method.

Control Tower is therefore currently an operational control plane, not a development Task manager and not yet a Request Operations service.

Owner Current authority Explicit non-authority
CTC repository Product Phase/Task, CTC Runtime/module/process/entity routing metadata and consumption boundary generic Request store is not selected
Control Tower repository operational registry/config/health/inspection/audit and bounded access surfaces Managed Task/Program/Feature and repository development governance
Codex active/archive session, transcript, attachment, model/run process Phase Task status, Request lifecycle and deployment acceptance
Orca workspace, worktree, terminal, session, pairing/runtime source generic Control Tower project gateway or Request registry
GitHub source history and collaboration Request/Task status authority
Future Request Operations OPEN_DECISION in P3 no current implementation may be presumed

6. Identity, Provenance And Correlation

6.1 Existing provenance fragments

Current source has useful fragments, but they are not one Request envelope.

  • Every Control Tower API handling path creates an HTTP requestId for response/audit correlation.
  • Control Tower audit/runtime-log entries commonly record actor, action, outcome, target, deployment and HTTP requestId.
  • Codex owner records persist projectKey, sessionId, source and creator identity.
  • Codex session summaries expose cwd, originator, model/workload and timestamps.
  • Codex access rules can contain project-level tenant/deployment scopes.
  • CTC-only Orca audit records actor, action, outcome and the fixed kylejang1/ctc@origin/master target while excluding the private URL.
  • Monitoring incidents require tenantId, monitorId, endpoint, observation time and probe ID.
  • CTC Runtime's Control Tower integration maintains explicit tenant/deployment mapping.

6.2 Missing cross-channel Request provenance

No current common contract provides all of the following:

  • stable business requestId distinct from an HTTP request correlation ID
  • schema/version and source channel
  • source session/event/message reference
  • actor type, immutable actor ID, role snapshot and delegation source
  • tenant/process/module/entity scope with explicit unknown/not-applicable states
  • protected raw evidence reference and redacted display summary
  • received/occurred timestamps and channel ordering
  • duplicate/related/supersedes links
  • classification, severity, owner, status and lifecycle events
  • retention, legal/privacy class, deletion hold and audit policy
  • routing result to bounded work, existing Phase Task, promotion review or incident

An HTTP requestId, Codex sessionId, Orca launch action, incident ID and Phase Task ID are distinct identifiers and must not be equated.

7. Duplicate, Idempotency And Relation Baseline

7.1 Generic Request duplicate

NOT_IMPLEMENTED in the inspected current source.

  • There is no cross-channel content fingerprint, source-message natural key, idempotency key or duplicateOf/relatedTo relation for generic requests.
  • There is no canonical comparison window or actor/tenant/channel-aware duplicate rule.
  • No current adapter decides whether a direct request, Codex prompt, Orca session or incident refers to the same business demand.

7.2 Codex

The server function named createOrReuseCodexSessionForProject() currently calls createCodexSessionForProject() directly. The active app-server path starts a new thread and stores its owner/attachments. The name is compatibility residue; it does not prove Request or session-create idempotency.

Codex contains other dedup-like mechanics that must not be generalized:

  • transcript lineage display merges repeated event keys;
  • session identity/cursor guards prevent stale pane and pagination merging;
  • active-turn queue/steer logic controls execution concurrency.

These protect session rendering/execution, not duplicate business requests.

7.3 Incident

Incident processing has valid domain idempotency:

  • correlation by tenantId + monitorId;
  • duplicate event detection by incident, probe ID and event kind;
  • duplicate Telegram callback detection by callback ID;
  • delivery idempotency by delivery key.

This contract may inform P3 design patterns, but its semantics cannot be copied as generic Request dedup without an ADR.

7.4 Retired Task migration

Legacy primary-session conflict checks, Program natural keys and task migration helpers are RESIDUAL_SOURCE. They are not available as a current Request relation engine because Task routes/state are retired.

8. Session Evidence And Handoff

8.1 Codex current capability

Codex Portal currently provides durable session evidence through:

  • active/archive/restored session source
  • transcript JSONL/thread identity and lineage
  • session owner metadata
  • attachment records and content hashes
  • activity/run/queue state
  • rename/archive/restore/delete and audit records

This is a usable source-session reference for future adapters. It is not itself a Request record.

8.2 Orca current boundary

Control Tower's CTC-only Orca source performs admission and returns a server-owned private entry URL only at launch. Control Tower does not accept a Request body, prompt, target repository, path or command. Orca remains the workspace/session source, so current Control Tower source provides no Orca-to-Request session handoff record.

The current pairing endpoint is an already-recorded boundary discrepancy: it can return pairing material through the Control Tower API/browser path even though the locked design keeps pairing/access material outside that path. Do not exercise or accept this endpoint as a completed boundary during P1-005 Local RO.

8.3 Legacy Task handoff residue

Current source still contains a detailed Task context/handoff schema with objective, scope, confirmed facts/evidence, decisions, unknowns, changes, verification, rollback and next start. It also contains rendering text that tells an agent to append a handoff through the Task mutation API.

That is not an active handoff contract because:

  • Managed Task/session-binding route families return 410;
  • operational state load/save removes retired Task keys;
  • current frontend API and navigation expose no Task workflow;
  • the accepted disposition is signed-export-only history, not active archive/API restoration.

Useful handoff field ideas may be absorbed into P3, but the old API path and Task identity must not be reused by default.

8.4 Required future handoff boundary

A future adapter should preserve, at minimum:

  • source channel and immutable source session/message reference
  • actor and tenant provenance or explicit unknown/not-applicable reason
  • protected raw reference plus redacted summary
  • objective, scope, confirmed evidence, decisions, unknowns and next start
  • changed resources, verification, external writes and rollback
  • content hash/version and producer timestamp
  • relation to an existing Request/Phase Task/incident without automatic Task creation

9. Retired Development Surfaces And Residual Source

9.1 Enforced retirement

After authentication, current custom-server source returns HTTP 410 for:

  • /work-items/**
  • /agent/work-items/**
  • /task-projects/**
  • /programs/**
  • /features/**
  • /session-bindings/**

Non-read project namespace/next-ID mutations and task-coupled deploy-apply are also retired. Current operational persistence strips retired work-item/session/governance keys on load and save.

9.2 Active Codex compatibility

Codex Portal remains enabled by default unless the legacy flag disables it. It is maintenance-only and may continue bounded session, transcript, attachment, access and audit behavior. It must not regain Task inference, Task mapping, status progression, release gating or hosted repository governance.

9.3 Non-authoritative residue

The following source remains but does not grant active product authority:

  • WorkItem/Program/Feature/governance types in src/types/controlTower.ts;
  • Task/Program/session/governance imports and helper bodies in the custom server;
  • enrichCodexSessionWithWorkItem(...) calls on active Codex responses;
  • Task context/handoff rendering and legacy prompt cleanup markers;
  • taskArchiveEnabled=true / taskArchiveMode=read-only bootstrap metadata despite no active archive API/UI/reader;
  • control_plane_task_write_journal schema and methods;
  • downstream project mutation handlers that are blocked earlier by the generic retirement guard;
  • names such as createOrReuseCodexSessionForProject although active reuse is absent.

Reachability, route guards, active client methods and persisted-state filtering decide current behavior. Name/type/import presence alone does not.

10. HTTP Request Versus Business Request

Several source identifiers contain request but are not Request Operations:

  • control-tower-request-mutation.mjs classifies HTTP methods/paths that mutate state so the server can serialize them.
  • Some legacy GET routes refresh and persist registry/session state; they are treated as mutations for concurrency safety.
  • CTC control_tower_request_scheme() resolves HTTP/forwarded protocol.
  • API envelopes expose requestId as one HTTP call's correlation identifier.

None of these provides a business Request entity, intake queue, lifecycle or registry. P3 naming must keep transport request and domain Request unambiguous.

11. CTC Runtime Integration Boundary

Current CTC source requires only these Control Tower registry tables:

  • T_CONTROL_TOWER_DEPLOYMENT
  • T_CONTROL_TOWER_TENANT
  • T_CONTROL_TOWER_TENANT_DEPLOYMENT

The helper reads/writes deployment, tenant and mapping payloads, current server identity and local clients. It defines no Request table or Request envelope.

CTC business requests/jobs must not add a request-time dependency on Control Tower. Runtime behavior must remain available from local DB/env or an approved local snapshot. A future Request adapter is a separate bounded integration decision.

12. Documentation And Branch Reconciliation

Source Current observation P1-005 rule
CTC master:docs/REQUESTS.md claims a canonical Markdown REQ-xxx registry and mandatory first-row triage BRANCH_DIVERGENCE; do not use as current architecture
CTC qa:docs/REQUESTS.md explicitly invalidates the Markdown queue and lists distributed channels current transition input under the reset
CTC qa:docs/ROADMAP.md invalidates old ROADMAP/task/request authority and points to the reset preserve until P1-010 replacement
CTC .agents/rules/CONTROL_TOWER.md states operational boundary and P3 open decisions current boundary/P3 input
Control Tower README/current disposition operational plane; Task/Program/Feature retired; Codex maintenance-only source-aligned current product boundary

P1-006/P1-007 own canonical hierarchy and absorption/deletion. P1-005 does not merge qa to master, rewrite common docs or restore REQUESTS.md rows.

13. Source Findings

ID Severity Finding Disposition / owner
P1005-F01 blocker for full P1-005 closure No unified current Request envelope, registry, API, lifecycle or store exists. Expected P3 design input; do not fabricate current behavior.
P1005-F02 high CTC master and qa make opposite claims about docs/REQUESTS.md authority. P1-006/P1-007/P1-010 must resolve and merge/delete through approved hierarchy work.
P1005-F03 high Generic actor/tenant/channel/session provenance and cross-channel correlation are absent. P3 envelope, auth, routing, privacy and audit tasks.
P1005-F04 high Generic duplicate/relation logic is absent; Codex createOrReuse... does not reuse. P3 dedup/relationship contract; rename residual helper in later cleanup.
P1005-F05 high / existing Local blocker CTC-only Orca pairing API returns pairing material through the browser/API path contrary to the locked boundary. Reconcile before Local acceptance; do not exercise during read-only closure.
P1005-F06 high Legacy Task handoff schema references a retired mutation path. Treat as field-design input only; never restore old Task API to satisfy it.
P1005-F07 medium Active Codex responses still call WorkItem enrichment despite retired state/API. Residual cleanup after import/call-graph and regression evidence.
P1005-F08 medium Task archive bootstrap metadata and task-write journal remain although active Task archive/state is retired. Bounded cleanup/migration; no ad hoc schema or host-data deletion.
P1005-F09 medium Some GET APIs mutate/persist state, so HTTP method alone does not identify read-only behavior. Preserve mutation serialization; future Request API must use explicit effect contracts.
P1005-F10 medium / open decision CTC-only Orca fixed base is origin/master, while current P1 documentation work is integrated on qa. P3/Orca workflow must define branch/session handoff explicitly; do not assume automatic qa routing.
P1005-F11 positive Task/Program/Feature/session-binding routes are fail-closed 410 and operational persistence strips retired keys. Preserve through cleanup/refactor.
P1005-F12 positive CTC-only Orca fixes the repository/branch server-side, accepts no launch body, validates private URL, and writes sanitized actor/action audit. Preserve; separately resolve pairing discrepancy.
P1005-F13 positive Incident path demonstrates tenant correlation and domain idempotency without becoming generic Task authority. Use as pattern input only, not direct schema reuse.

14. Minimum P3 Contract Input

P1-005 does not select final field names or storage, but P3 must explicitly decide these capabilities.

14.1 Versioned Request envelope

  • schema version and globally stable Request ID
  • occurred/received timestamps
  • source channel and source adapter version
  • immutable source session/message/event reference
  • actor type, ID, role and delegation/auth source
  • tenant, module, process and entity scope with explicit unknown states
  • protected raw reference, redacted summary and privacy class
  • request kind, severity, urgency and incident relation
  • idempotency/natural key and duplicate/related/supersedes links
  • current owner, lifecycle status and append-only events
  • routing decision and reason
  • retention, legal hold, deletion and export policy

14.2 Adapter rules

  • preserve source evidence before transformation;
  • fail closed on unknown actor/tenant where the operation requires them;
  • do not store secrets, pairing URLs, credentials or raw sensitive attachments in general logs;
  • do not auto-create a persisted Phase Task graph;
  • do not change Product Objective from a direct request;
  • distinguish bounded work, existing Phase Task, promotion review and incident;
  • make retry/idempotency explicit per channel;
  • retain source-session handoff without making Codex or Orca the registry authority.

14.3 Storage ADR

P3 must compare at least:

  • bounded Request Operations module in Control Tower;
  • independent small service/database;
  • another approved shared service.

The ADR must reject implicit reuse of CTC operational tables, old Control Tower Task state or GitHub workflow merely because those systems already exist.

15. Fresh Local RO Closure Checklist

P1-005 may become complete only after a fresh, no-write Local evidence pass records the following without secrets.

15.1 Exact source and deployment identity

  • clean/dirty status and exact SHA for local CTC qa/master and Control Tower main;
  • exact deployed QA Control Tower SHA and static service entrypoint;
  • source/deployed mismatch explicitly recorded;
  • no pull/merge/restart/config change during read-only evidence unless separately authorized.

15.2 Feature/config state

Record boolean/configured state only, not values, for:

  • legacy Codex Portal enablement;
  • legacy Orca Pilot enablement;
  • CTC-only Orca enablement and conflict state;
  • CTC-only private entry configured state;
  • app-server/CLI Codex runtime selection;
  • state DB/path ownership and service environment-file references.

15.3 Authenticated API contract probes

Read-only probes should verify:

  • authentication precedes retirement response;
  • all retired Task/Program/Feature/session-binding families return expected 410 codes;
  • active Control Tower capability list contains no generic Request endpoint;
  • Codex overview/list/detail authorization and owner visibility;
  • CTC-only Orca bootstrap disabled/configured behavior without exposing the private URL;
  • legacy Pilot conflict/disabled behavior;
  • monitoring incident read shape if current policy permits.

Do not create/send/archive/delete a Codex session, launch Orca, call pairing, ingest a canary, change access, mutate registry/config or execute deployment actions in this read-only pass.

15.4 Persistence and evidence

  • inspect control-plane.sqlite schema/version and sanitized top-level state keys;
  • prove retired Task/governance state is not loaded/persisted;
  • identify whether task-write-journal rows exist without changing them;
  • inspect sanitized Codex owner/audit field presence and retention location;
  • inspect CTC Control Tower DB required-table readiness and table names/counts only;
  • verify no generic Request table/store is installed under an unexpected current owner;
  • record filesystem/service/audit permissions without copying sensitive content.

15.5 Orca boundary

  • exact installed dedicated service/identity/workspace/repository/base ref;
  • private/non-forwarded listener fact;
  • fixed CTC-only project isolation;
  • Control Tower/browser launch path state;
  • no pairing/access material in evidence;
  • current pairing-endpoint discrepancy remains a blocker until explicitly corrected or re-decided.

16. Verification

Check Result Evidence / limit
CTC task/reset/Request/boundary source review PASS — CLOUD SOURCE qa transition docs, master runtime helper and current boundary inspected
Control Tower active frontend API surface PASS — CLOUD SOURCE current API client contains operational/Codex methods and no generic Request methods
Control Tower route retirement PASS — CLOUD SOURCE current static server and legacy-surface policy return 410 for Task families
Operational-state retirement boundary PASS — CLOUD SOURCE current SQLite wrapper strips retired development keys
Codex payload/session/provenance review PASS — CLOUD SOURCE create/message API, types, owner visibility and server route inspected
Codex generic duplicate CONFIRMED ABSENT IN CURRENT CREATE PATH createOrReuse... directly delegates to create; no Request idempotency contract
Incident duplicate/provenance review PASS — CLOUD SOURCE tenant/probe/callback/delivery domain logic inspected
CTC-only/legacy Orca source boundary PASS — CLOUD SOURCE policy, interceptor, test contract and execution-sequence discrepancy inspected
Repository test execution NOT_RUN no local checkout/runtime in connector-only Cloud review
Authenticated browser/API runtime probes NOT_RUN Local RO required
Service/systemd/env/filesystem inspection NOT_RUN Local RO required
DB/runtime state inspection NOT_RUN Local RO required
Runtime/provider/deployment write NOT_APPLICABLE read-only investigation; no operational change authorized

17. Handoff

  • P1-006 may use this file to define the future REQUEST_MANAGEMENT document owner and template, but must not treat P1-005 as fully closed before Local RO evidence.
  • P1-007 owns removal/absorption of conflicting REQUESTS.md and legacy planning content after hierarchy approval.
  • P3-001 and later P3 tasks receive the authority matrix, channel matrix, provenance gaps, dedup gaps, session handoff requirements, storage ADR inputs and Orca/Codex boundary findings.
  • Control Tower residual Task code cleanup belongs to bounded Control Tower work with route/client/persistence regression evidence; it is not part of this CTC source investigation.
  • The pairing discrepancy belongs to the existing CTC-only Orca execution sequence and blocks Local acceptance; P1-005 does not silently waive it.
  • No current Request row, GitHub Issue/Project, Control Tower Task or automatic child graph was created from this investigation.

18. Impact And Rollback

  • Changed repository: kylejang1/ctc only.
  • Changed file: docs/tasks/P1-005.md only.
  • Control Tower source change: none.
  • Runtime, DB, provider, service, filesystem, production and deployment impact: none.
  • Branch action: evidence record committed to qa; no master merge or deployment.
  • Rollback: revert this file commit; no external rollback is required.

Source: docs/research/platform-foundation/2026-07-30/raw/request-control-tower-orca-codex-baseline.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged. A user instruction quoted inside the text is kept in its original language.