Meet slices 2 to 6: programme plan

Written 2026-09-09 after slice 1 merged (cae60ed) and went live at meet.bds.oncarlos.com (fd626d6). This is the plan for the remaining five slices of spec revision 8 §12, run by subagents, alongside the Codex-orchestrated overnight programme on oficina/suite discussion 5. Each slice still gets its own implementation plan in the slice-1 shape (verbatim code per task); this document decides order, ownership, models, gates and the coordination rules the slice plans inherit.

1. What is fixed by others, and what Meet must not touch

| Item | Where decided | Meet's stance | |---|---|---| | Queue item 12 is Meet's, owned by this session | suite #5 | Post a checkpoint on suite #5 at every slice merge and every deploy. | | Platform relay is live (CARLOS_RELAY, contract rev 6) | platform #112, spec §5.2 | Slice 3 consumes it. Enabling needs a current carlos binary (installed v0.17.0 lacks relay; platform main is built at /tmp/oficina-carlos-current/carlos, rebuild if absent). | | No SFU; mesh cap of four stays | platform #112 | Slice 2 enforces the cap; spec §5.7 waits. | | Estilo: theme on fix/rastrillo-023-theme (rastrillo 0.23 pin), save-status primitive; no sign-in, error or empty-state primitive exists | estilo #1, #2, suite #5 audit | Adopt the theme in slice 6 only once a merged, tagged release exists (Fable's standing condition). Never claim sign-in, error or empty-state primitives. Meet is the first builder of the chat panel (slice 4) and must meet Estilo's gates at first landing: attribute grammar, twelve locales, stated script-off behaviour, 24px targets, 320px reflow, contrast arithmetic. | | Home assertions, shared sign-in, team-aware entry | home #10, suite #5 | Slice 6 adopts nothing from the home; the lone shape ships. Do not widen sign-in callbacks. | | Agents as principals | suite #4, unruled | Slice 5 builds Slides-shaped instance tokens and cites #4; adopt the home's shape when ruled. | | Copy review | suite #5 (Paul's steering) | Waived for this round. Slice plans still catalogue strings in docs/superpowers/copy/ so a later pass is one sitting. | | Open-source acknowledgements, reusable Estilo presentation | plan line 284 | Slice 6 adds Meet's acknowledgements page from the runtime module inventory; Meet does not build the presentation. | | Continuous staged deploys with a notification per verified deploy | plan line 285 | Every slice from 2 on deploys a canary and posts the notification (§5). | | Outsider addresses in persons.email and sessions.subject (Codex C1-1) | oficina/meet review record 2026-09-09 | Suite-wide shape; filed on suite #5 as a question for Paul, not fixed in any slice here. | | Trusted client address from the edge | spec §3.2 residue | Filed on carlos/platform with slice 1; no Meet change. |

2. Order and dependencies

1. Slice 2, holding screen and room, direct connectivity (spec §12 item 2). Largest slice: the hub with participations, cap, limits, resume with roster reconciliation, replay ring, pair generations, terminal replaced, the tick; the stream and hello; every message in §4.3 except chat and share; removal and takeover confirm pages; room.js with perfect negotiation and the §4.6 queue; devices.js; the AGENTS.md scriptless exception. Establishes the Playwright gate. Nothing else can start before it merges, except slice 5.
2. Slice 5, drive surface (spec §8) can run in parallel with slice 2 on its own branch: agents table, the five operations, per-request reach, the badge. It touches store.go, app.go routes and a new api.go; slice 2 touches the hub, stream and room. Merge order: whichever is reviewed first; the second rebases.
3. Slice 3, relay (spec §5.2, §5.3): CARLOS_RELAY parsing and the startup refusal, minting with the vector test, /ice, renewal state machine under shortened timers. Depends on slice 2's room.js (renewal drives ICE restart). Verified against the live relay by enabling it on the canary.
4. Slice 4, chat and screen share (spec §6, §5.4): chat.js built as an Estilo-grade primitive, chat and share with recipient rules, display-media transceivers, stop ends the track. Depends on slice 2.
5. Slice 6, deploy (spec §7.3, §9, §10): domain already attached and live; this slice is PRODUCT.md, the README with the floor and relay paragraphs first, AGENTS.md's final notes, the acknowledgements page, the Consumed suite rulings commit for suite Appendix A.6, the Estilo theme pin if a tagged release exists, and the production promotion with its notification.

Slices 2, 3 and 4 are strictly sequential. Slice 5 overlaps slice 2. Slice 6 closes.

3. Per-slice mechanics

Every slice runs the same loop, unchanged from slice 1:

1. Worktree and branch under /home/paulca/amadan.net/oficina/meet/.claude/worktrees/slice-N, branch slice/N-<name>, pushed at once, described with amadan branch describe, a branch discussion on oficina/meet opened before the plan, tasks mirrored with amadan task add.
2. Plan with the writing-plans skill: verbatim code per task, a Global Constraints block copied from the spec, interfaces per task. The controller runs a pre-flight scan and ledgers rulings.
3. Execution with subagent-driven development: one implementer per task, one task review, fix rounds capped at five, then a whole-branch review, one fix wave, one scoped re-review.
4. Independent Codex review of the merged code (GPT-6 via codex exec -s read-only, detached with setsid, outside the sandbox), findings committed under docs/superpowers/reviews/, one fix wave, a second Codex round until accept.
5. Gates: make ci on every task; make browser (Playwright) green on every slice from 2; remote CI green on the tip; spec §13 gates for the slice present by name in the slice's tests.
6. Canary: carlos canary --app meet --account oficina releases/meet-linux-arm64 from the slice branch (channel canary/slice-N, host slice-N.meet.bds.oncarlos.com), a browser walk on the canary URL recorded on the branch discussion, then fast-forward main and carlos deploy to the edge channel, then the notification (§5).
7. Checkpoint on suite #5: slice, tip, what is live, what is next.

4. Subagents and models

| Role | Model | Why | |---|---|---| | Controller (plan, dispatch, rulings, hub record) | this session, Fable 5.1 | Holds the spec and the cross-task context. | | Implementers, transcription tasks with complete code in the brief | Sonnet | Slice 1 showed one fix round per eight tasks at this tier. | | Implementers, WebRTC client code (room.js, devices.js, chat.js) and the hub | Opus | Design judgment: perfect negotiation, resume reconciliation, generations. Slice 1 had no client code; these are the risky tasks. | | Task reviewers | Sonnet; Opus for the hub, stream, /signal and any auth change | Security-sensitive diffs get the stronger reviewer, as slice 1 did for tasks 6 and 7. | | Whole-branch review | Opus (Fable when its quota allows) | The spec review pattern. | | Independent spec and code review | Codex, GPT-6 (the box's default) | Six rounds found 52 spec defects and one deploy blocker in code; keep it. | | Mechanical or bulk work when Claude quota is tight (fixture generation, locale files for the chat primitive, test-table expansion, the acknowledgements inventory) | Codex with -m gpt-5 | Cheaper and out-of-band; read-only review of its output by a Sonnet reviewer before commit. Never for the hub, auth, or the signalling client. |

Quota: Fable's weekly review quota for Codex's jobs resets 2026-09-10 19:05 UTC; this session's own limit reset at 08:20 Dublin today. If a Claude tier is refused mid-slice, the controller records it in the ledger and either waits or substitutes the next tier down for implementers only, never for reviews.

5. Deployment notification

Posted on the oficina/meet slice discussion and mirrored on suite #5, in this form, after /api/version on the host reports the tip:

Deployed: meet <tip> to <URL> (preview | production)
What changed: <one paragraph>
What to inspect: <three bullets: the pages or flows that changed>
Rollback: carlos deploy --app meet --account oficina --version <previous>

A queued promotion is never announced as live.

6. Slice 2 in detail, because it is next

Scope (spec §2.4, §2.5, §3.3, §3.4, §3.5, §4.1 to §4.6, §5.1, §9, §12 item 2, §13 slice-2 lines):

• Hub (internal/calls/hub/): rooms, participations bound to session and peer, kind re-derived on tick and on request, the cap at every admission, limits (§4.4), replay ring with seq and last, pair generations and reset/pair, resume branched on admission, boot id, 404/409/410 answers, the fifteen-second tick, lost reasons.
• Stream and signal (stream.go, signal.go): SSE with heartbeat and TTL, hello {peer, boot}, POST /m/{sqid}/signal with the §2.5 contract per type, roster with the waiting queue for members, knock, knock-gone, full, ended.
• Pages: the holding screen's scripted half (devices.js), the room (room.js: perfect negotiation, outbound queue, generations, reconciliation, terminal handling), removal and takeover confirm pages and POSTs, AGENTS.md's exception.
• Tests: the §13 slice-2 Go gates (peer binding, cross-room refusal, sixteen-participation and unjoined-timeout limits, waiting-guest isolation, roster contents, guest-first arrival, promotion under the cap, cap at join and admit with concurrency, resume with roster and replay, gap, terminal replaced with the notice undelivered, same-boot and different-boot 404, stale gen 409, reset convergence, admit after expiry refused, member dropped on tick, captured-log test for join, admit, offer, candidate, refusal, error) and the Playwright gates (devices enumerate and preview; two isolated contexts complete a call with fake media and a non-zero frame count; guest knocks and is admitted having seen no peer; stream TTL shortened to seconds keeps the call up; member removed mid-call dropped on tick; resume after a peer leaves closes the departed connection; restart closes connections before rejoin; second tab refused with 409, takeover confirmed, first shows the link; cross-site navigation ends nothing; scriptless pages render their paragraph).
• Estimated tasks: nine to eleven, three of them Opus-tier (hub core, room.js, resume and generations).

Playwright copied from Calendar: make browser runs npm install --no-save playwright then go test -tags browser ./internal/callstest/; a private package.json pins playwright 1.62.1; the Go test listens on 127.0.0.1:0, signs two contexts in over HTTP, and runs node test/browser/call.mjs <origin> <cookie…> with Chromium launched with --use-fake-device-for-media-stream --use-fake-ui-for-media-stream. Not in make ci; run by the controller before every task review that touches a page, and by remote CI only if the runner has node (check the runner first; if not, it is a controller gate and recorded as such on the branch).

7. Open items carried

• Codex code round 1 fix wave (branch fix/codex-code-r1) merges before slice 2 starts; its round 2 runs against main.
• Suite question for Paul, to file with the fix wave: whether persons.email and the session subject should be sealed suite-wide (Codex C1-1); Meet follows the ruling when it comes.
• The stale carlos CLI: use /tmp/oficina-carlos-current/carlos for apps build-probe and relay enable, or rebuild it from platform main into $TMPDIR; set the build probe on meet before slice 2's canary.