Engineering stabilization sprint plan: make cnb ready for owner-led development

[ApolloZhangOnGithub]

Goal

Make cnb ready for owner-led development after the user migrates to another iMac, without spawning additional classmates before that migration. This sprint is about stabilization and operating discipline, not new large features.

Sprint window

2026-05-10 through 2026-05-24.

Operating rules

• Do not start additional cnb classmates until the user finishes iMac migration.
• Prefer GitHub issue/milestone/label work over editing the already-dirty local worktree.
• Keep PRs small and independently verifiable.
• Every implementation issue needs an explicit acceptance command or external verification step.
• Phase 3 and experiment issues stay out of the sprint unless they unblock stabilization.

P0: unblock reliable install, ownership, CI, and release

• Critical: c-n-b package rename merged before npm package exists #132 Restore package/release correctness after c-n-b rename landed before npm package exists.
• 20260508_组织体制改革提案（重点） #64 Decide and document device supervisor vs project lead responsibilities.
• Tech debt ownership: dedicated code health role #48 Establish code health owner scope and handoff expectations.
• Lead repository maintenance sweep: dirty worktree, stale PRs, and CI follow-ups #74 Sweep dirty worktree, stale PRs, and CI follow-ups.
• P0: 加密邮箱私钥安全 — gitignore 缺失 + 命名冲突 + 存储位置错误 #60 Fix private-key/secret storage and gitignore safety.
• Tests pollute real ~/.cnb project registry and pubkeys #77 Stop tests from polluting real ~/.cnb state.
• Default pytest can fail when ambient pytest-randomly reseeds numpy #67 Make default pytest robust against ambient pytest-randomly.
• sync-issues workflow records failed push run with no jobs or logs #73 Fix noisy/failed sync-issues workflow behavior.
• Add npm stable tag after refreshing npm auth #100 Resolve npm stable tag after package/auth state is safe.

P1: make owner-led work executable

• Pending actions queue: batch user-required operations with verification #34 Pending actions queue for user-required approvals and verification.
• Add read-only board inspection without impersonating sessions #75 Read-only board inspection without impersonating sessions.
• Improve ownership routing beyond prefix and substring matching #87 Routing evidence beyond prefix/substring ownership matching.
• Harden Feishu local_openapi and webhook test coverage #90 Harden Feishu local_openapi and webhook tests.
• Add project discovery and Codex engine CLI regression tests #91 Add project discovery and Codex engine CLI regression tests.
• Testing roadmap: post-update regression matrix for local-first features #88 Convert testing roadmap into practical regression matrix.
• Feishu bridge should refresh or restart stale device-supervisor prompt after upgrades #128 Refresh/restart stale device-supervisor prompt after upgrades.
• Feishu live activity should surface stale open requests before users ask why it is stuck #129 Surface stale open requests before users ask why stuck.
• Secure remote Feishu TUI watch over tunnel #114 Keep secure remote Feishu TUI watch production-ready.
• Device supervisor portability: keepalive, migration, and one-command bootstrap #121 Portability/bootstrap path for moving to another Mac.

P2: useful but not allowed to block stabilization

Tracked with priority:p2, generally after this sprint: #127, #131, #99, #56, #43, #63, #41, #42, #47, #65.

Acceptance for this planning issue

• P0/P1 issues are labeled and placed in the sprint milestone.
• P2 issues are labeled but not treated as blockers.
• The next project lead/code health owner can start from this issue without rereading all open issues.
• The user can migrate first; no new classmates are required to preserve this plan.

[ApolloZhangOnGithub]

Sprint progress update — 2026-05-17 (day 7 of 14) by lead

P0 items 进展

• Lead repository maintenance sweep: dirty worktree, stale PRs, and CI follow-ups #74 Lead 维护 sweep — in active progress (此 sprint 期内多次 PR、CI 修复，Lead repository maintenance sweep: dirty worktree, stale PRs, and CI follow-ups #74 comment 内有今日 detail)
• [partial] Add npm stable tag after refreshing npm auth #100 npm stable tag — blocked on user npm auth refresh (triaged today，需要 user 介入)
• Default pytest can fail when ambient pytest-randomly reseeds numpy #67 pytest-randomly — earlier sprint 已修 (cnb: unblock master CI (lint + check-consistency) #222 master CI fix)
• sync-issues workflow records failed push run with no jobs or logs #73 sync-issues workflow — earlier sprint 已修 (cnb: unblock master CI (lint + check-consistency) #222 round 1)
• 其他 P0 (Critical: c-n-b package rename merged before npm package exists #132 20260508_组织体制改革提案（重点） #64 Tech debt ownership: dedicated code health role #48 P0: 加密邮箱私钥安全 — gitignore 缺失 + 命名冲突 + 存储位置错误 #60 Tests pollute real ~/.cnb project registry and pubkeys #77) — 未在今日触发

今日 (2026-05-17) PR/issue 动作

已 merge 到 master:

• cnb: team reorg, site cleanup, fetch-site tool, blog fixes #218 (team reorg / blog server pull)
• cnb: unblock master CI (lint + check-consistency) #222 (master CI round 1: lint + check-consistency)
• cnb: bring board_pending + board_view coverage to 100% #225 (board_pending + board_view 100% coverage)
• cnb: dispatcher skip nudge when same command already at prompt (#226) #227 (dispatcher nudge dedup — fixes Dispatcher nudge 应检查屏幕是否已有同样命令，避免重复塞 #226)
• cnb: unblock master CI round 2 (lib/blog_* lint + mypy) #230 (master CI round 2: lib/blog_* lint + mypy per-module override)
• cnb: per-session model badge on overview row (#153) #231 (per-session model badge)
• cnb: token + model section in board daily report (#153) #232 (token + 模型 section in board daily)
• cnb: bring shutdown coverage from 89% to 100% #234 (shutdown.py 89→100% coverage)

In flight (7 open):

• cnb: worktree checkpoint + dirty-state guard (#135) #219 musk worktree checkpoint (含 cnb: dispatcher skip nudge when same command already at prompt (#226) #227 base)
• cnb: simplify supervisor identity wording (#213) #220 bezos drift wording
• cnb: surface model downgrade + token budget alerts (#153) #221 lisa-su alerts + daily token consolidated
• cnb: tongxue update-check via board startup hook (#43) #224 lisa-su update-check (CI fix in progress)
• cnb: bring capture_ingest coverage from 83% to 99% #229 bezos capture_ingest 99% (Testing roadmap: post-update regression matrix for local-first features #88 partial)
• cnb: bring github_app_guard coverage from 58% to 99% #233 bezos github_app_guard 99% (Testing roadmap: post-update regression matrix for local-first features #88 partial)
• cnb: dispatcher keeps lead session alive (#223) #236 bezos dispatcher keep lead alive (closes Dispatcher 应当保活 lead session — 停了自动 nudge 继续 #223)

今日新开 issue:

• Dispatcher 应当保活 lead session — 停了自动 nudge 继续 #223 dispatcher 保活 lead → cnb: dispatcher keeps lead session alive (#223) #236 implementing
• Dispatcher nudge 应检查屏幕是否已有同样命令，避免重复塞 #226 nudge 去重 → cnb: dispatcher skip nudge when same command already at prompt (#226) #227 closed
• Dispatcher 应检测 lib/concerns/* 改动并自动 reload #235 dispatcher auto-reload on lib/concerns/* — musk owner queued

Acceptance gap:
sprint deadline 2026-05-24 还有 7 天。P0 大部分已推进，#132 #64 #48 #60 #77 还需评估今日改动后是否仍 P0。下个 standup 建议 lead 主动重排 P0 列表。

— lead