Repository navigation
Description
Filed from fleet epic #5412 step 4 (#5432, the dispatch thin client), per that step's rule: interface gaps found while building the verbs are filed against pm-stack, not absorbed into the client.
Gap 1 — no read/status endpoint on pm-dispatch
pm-stack/dispatch/src/server.ts exposes exactly three routes: GET /health (unauthenticated), POST /v1/sessions, POST /v1/tasks. A caller that launched or enqueued work has no way to ask pm-dispatch about it afterwards — no GET /v1/tasks/<id>, no GET /v1/sessions/<id>. The thin client shipped in #5432 therefore answers "what happened to task N?" by crossing domains into the queue (fleet queue list / the queue store), which works but couples every dispatch caller to queue internals and to a second credential path.
A minimal fix on the pm-stack side would be one authenticated read route reusing the existing auth (authenticate() already gates the POSTs), e.g. GET /v1/tasks/:id returning the task row's status/worker/progress (the row dispatch itself created and claimed), and ideally GET /v1/sessions/:id proxying the session's existence/state from the OpenCode server. Read-only, no new write surface.
Gap 2 — DISPATCH_API_TOKEN had no by-name vault home (already fixed in the vault; recorded for the docs)
The dispatch README states pm-stack's secrets are filed in Bitwarden/1Password under dotted names. The bearer token was the exception: it existed only in the laptop's ~/secrets/dispatch.env, so the fleet-secrets resolver chain (the fleet's one secrets-by-name path) could not resolve it for a client. It has been filed in Bitwarden as pm-dispatch.api-token (value verified byte-identical to the service's, by hash) as part of #5432. The durable part of this gap is documentation: pm-stack/dispatch/install.sh / the dispatch README should name the token's vault home alongside the other pm-stack secrets so a future rotation updates both places.
Not gaps (checked and fine)
- Auth shapes: the static bearer is sufficient for local clients; GitHub Actions OIDC remains the CI form.
- Dedupe:
POST /v1/taskswith a consumeddedupe_keyreturns the pre-existing task withpre_existing: true— exactly what a thin client needs. - The design note for the fleet epic claimed a rendered state dir at
~/.local/state/pm-dispatch/; none exists. Not a pm-stack defect — the note was wrong; corrected on fleet step 4: dispatch thin client domain over pm-stack #5432.
Acceptance criteria
- pm-dispatch exposes an authenticated read route for a launched/enqueued task (and ideally a session) returning status/worker/progress
- The dispatch README / install docs name the
pm-dispatch.api-tokenvault home alongside the other pm-stack secrets - A thin client can answer "what happened to task N?" from pm-dispatch alone, without crossing into queue internals
Activity
dezren39 commentedon Nov 4, 2026
Intake review
dezren39 commentedon Nov 5, 2026
🤖 Agent note · handed off
144 remaining items
dezren39 commentedon Nov 6, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 6, 2026
agent-note:v1
opencode. Checkpointedhanded_offfor the opencode claimant. Attempts 4/4 AT CAP — claimant must bind this cycle or a cap raise is needed.dezren39 commentedon Nov 6, 2026
🤖 Agent note · handed off