Gas City Doctrine Enforcement (v2.0) - Sessions perform work. (Sessions are disposable). - Beads remember work. (Durable universal substrate). - Convoys group work. - Mail coordinates work. - Formulas remember how. (Reusable methods). - Agents execute. - Packs configure. - Rigs scope. - Orders trigger. - Events prove what happened. - Work is not complete until verified and promoted (Capability, Skill, Formula, Pack, Order, Policy). (No parallel "learning lifecycles" or "agent memory" outside this machinery).

Factory Working Plan

Authority

FACT BOARD = document/projection
WORKING PLAN = document/projection
ACTIONABLE WORK = Beads
LIVE TRUTH = actual runtime/tool evidence

Field	Value
Purpose	Living projection of factory workstreams, sequence, and acceptance. Not the operating contract. Not live truth.
Standing contract	factory-operating-contract.md
Maintainer	BLU (architecture) · MAYOR (runtime proof) · REFINERY (GitLab delivery)
Last verified	2026-09-10 (live overlay) · recovered snapshot 2026-09-02T21:39:06Z
LEGACY_SOURCE_URL	https://claude.ai/code/artifact/00bc6877-e0f2-4431-a9d1-fe3340b5aa5b
AUTHORITY of Claude artifact	NO
CANONICAL_SOURCE	Engineering-Standard/operating-model/factory-working-plan.md
Recovered title in artifact	Bluefly Platform Architecture — AMCS & the Drupal Factory

Update rules

Same as the Fact Board: feature branch → verify live evidence → update this file and related Beads → MR to release/v0.1.x. Never push main. Never treat the Claude artifact as the live plan.

Goal

Prove the Bluefly Drupal Launch Factory: two governed consumer sites from one foundation (D2, LOCKED), without new projects/modules/recipes/templates.

Current State

Recovered 2026-09-02 founder board (DOCUMENT_AS_OF=2026-09-01, deltas 2026-09-02):

• 335 MRs merged in eight days; 272 (81%) targeted release/v0.1.x.
• Promotion release/v0.1.x → main is the lag, not integration.
• Every 2026-08-24 Fact Board P0 was recorded CLEARED or superseded except Cedar fail-open, which had not moved.
• D1–D6 LOCKED. No open architectural decision.

Live overlay 2026-09-10: Oracle city exists at /opt/bluefly/blucity; HQ Beads mail/sling from that checkout is blocked (gc.endpoint host/port on managed_city; missing project_id). /opt/bluefly cleanup is frozen. See mayor-fact-board.md.

Target State

UNIQUE_WORK_LOST=0
UNIQUE_DATA_LOST=0
SECOND_CITY_ROOT_RETIRED=YES
LIVE_SERVICE_FROM_BACKUP_TREE=0
RUNTIME_STATE_IN_SOURCE_CHECKOUTS=0
REBUILD_REPRODUCIBLE=YES
D2_TWO_CONSUMERS_ACCEPTED=YES
CLAUDE_ARTIFACT_AUTHORITY=NO

Architecture Invariants

From recovered Plan & Decisions (LOCKED — do not reopen here):

ID	Decision	State	Owner
D1	Commercial identity: governed modernization services now; standards platform later	LOCKED	Founder
D2	Immediate deliverable: Drupal Launch Factory, two governed sites from one foundation	LOCKED	Factory lane
D3	Drupal is the durable customer product, not the Bluefly platform. Invest in site_template_amcs	LOCKED	Drupal lane
D4	KEEP_BOTH_PLANES_CROSSWALKED — Control/Governance vs Product/Customer	LOCKED 2026-09-02	Architecture
D5	GRANT_CEDAR_PRODUCTION_POLICY_AUTHORITY — Cedar decides; owning system performs. Fail-open fix stays a schema/config defect	LOCKED 2026-09-02	cedar_policy / kb_cache
D6	DETERMINISTIC_RELEASE_TO_MAIN_PROMOTION — only release/v0.1.x → main. Adopt existing release-flow; do not author a second mechanism	LOCKED	Release lane

Branch doctrine: feature/fix/chore/docs → release/v0.1.x → main → deploy → Oracle acceptance. Do not skip gates.

Workstreams

WORKSTREAM_ID=WS-P0-GUARD
OWNER=gitlab_components + group settings
STATE=IMPLEMENTED, NOT BINDING as of 2026-09-02
BLOCKERS=automation still opens feature → main MRs
DEPENDS_ON=D6
BEADS=bl-swcn6
ACCEPTANCE=feature→main rejected even in projects that do not consume minimal-ci
LAST_VERIFIED=2026-09-02 (recovered)

WORKSTREAM_ID=WS-P0-AMCS-PROMOTE
OWNER=REFINERY
STATE=MERGED, NOT PROMOTED as of 2026-09-02
BLOCKERS=recipe_amcs / site_template_amcs / recipe_blucity default branches frozen; recipe_blucity main empty since 2026-06-25
DEPENDS_ON=D2 D6
BEADS=bl-32nn0 (factory substrate epic)
ACCEPTANCE=D2 two-consumer proof can begin
LAST_VERIFIED=2026-09-02 (recovered)

WORKSTREAM_ID=WS-P0-CEDAR-FAIL-OPEN
OWNER=cedar_policy + kb_cache + ai_agents_ossa
STATE=OPEN DEFECT as of 2026-09-02
BLOCKERS=enforcement_mode absent; NULL→FALSE fail-open
DEPENDS_ON=D5 (decision LOCKED; fix still required)
BEADS=bl-ofwag hq-z9sx
ACCEPTANCE=gate fails closed with a defined key; destructive cedar_policy path cannot fire unattended
LAST_VERIFIED=2026-09-02 (recovered)

WORKSTREAM_ID=WS-P1-MARKETPLACE
OWNER=agentic-marketplace
STATE=OPEN DEFECT as of 2026-09-02
BLOCKERS=!64/!65 closed unmerged; !66 conflicts and still cites !64 (merged)
DEPENDS_ON=
BEADS=bl-q8dat
LAST_VERIFIED=2026-09-02 (recovered)

WORKSTREAM_ID=WS-P1-OSSA-VALIDATE
OWNER=gitlab_components
STATE=REGRESSED as of 2026-09-02
BLOCKERS=README + pin destroyed by 08-25 release merge; consumer count 0
DEPENDS_ON=
BEADS=bl-mir0l
LAST_VERIFIED=2026-09-02 (recovered)

WORKSTREAM_ID=WS-PRESERVE
OWNER=HARBORMASTER
STATE=BLOCKED pending physical preservation
BLOCKERS=PRESERVATION_COMPLETE=NO; NAS blucity 33-commit tree unlocated from Mac/NAS home search 2026-09-10; 1.3G unmounted Oracle DB tree
DEPENDS_ON=cleanup freeze
BEADS=bl-7d7 hq-2ym
ACCEPTANCE=independent git bundle / patch / untracked archive / SHA256 / receipt outside original trees; then Witness proof
LAST_VERIFIED=2026-09-10 (live)

WORKSTREAM_ID=WS-ARTIFACT-RETIRE
OWNER=BLU
STATE=IN_PROGRESS
BLOCKERS=Claude artifacts were operational authority
DEPENDS_ON=bl-tf4
BEADS=bl-tf4 bl-q50qw
ACCEPTANCE=GitLab docs canonical; Beads own actions; Claude URLs historical only
LAST_VERIFIED=2026-09-10 (this conversion)

Dependencies

Preserve unique/non-proven state → verify preservation → classify ownership → fix runtime-state-placement (hq-wjxs class: host/port/project_id in tracked .beads) → IaC filesystem layout → retire second city root → retire proven orphans → reboot/redeploy proof → delete only after independent proof.

Sequence

1. Freeze /opt/bluefly cleanup.
2. HARBORMASTER physical preservation (NAS + Oracle DB trees).
3. Restore HQ Beads identity so MAYOR can sling (hq-x0rl, bl-5b39).
4. Bind remaining factory P0s (WS-P0-*) to existing HQ beads or create only after search.
5. Promotion/adoption of AMCS chain (D2/D6).
6. Cedar fail-open fix (config/schema, not a new enforcement product).

Acceptance Criteria

• No live operational fact or action item depends on a Claude artifact.
• Every actionable row in this file has BEADS= or an explicit DUPLICATE_EXISTING_BEAD / FACT_ONLY class.
• ORPHAN_ACTION_ITEMS=0.
• Factory operating contract remains the standing primitive/authority order.

Risks

• Recreating a live board in Markdown (treat rows as projections; re-measure).
• Duplicate beads for CLEARED 08-24 P0s.
• Cleaning /opt/bluefly before preservation.

Blockers

Blocker	RELATED_BEAD	Status
HQ Beads identity / gc bd from /opt/bluefly/blucity	bl-5b39 bl-54a0f hq-x0rl	BLOCKED 2026-09-10
NAS / off-host durability	bl-7d7 hq-2ym	OPEN
Unmounted 1.3G DB tree	bl-7d7	DELETION_ALLOWED=NO
Factory substrate cannot complete work	bl-32nn0	OPEN 2026-09-06

Decisions

All D1–D6 LOCKED. No founder decision is required to convert these artifacts to GitLab + Beads.

Verification

WITNESS: PASS / FAIL / NOT_PROVEN only. Never infer absence from an unprivileged scan. Negative evidence is not proof of absence.

Completion Criteria

This projection is complete for a given workstream when its Beads are closed with receipts (commit, push, MR to release/v0.1.x, merge, runtime proof where required). A chat update or Claude artifact edit is not completion.