[0.12] Prove migration, retention, and release readiness

Goal

Prove the complete Facility 0.12 workflow and prepare the breaking release.

Automated journey

Add an end-to-end command that uses real application boundaries and deterministic local fakes. It should:

1. run kickstart and inspect the generated .agents/ crew;
2. create a project and story through the actual MCP endpoint;
3. select an agent and verify its configured model reaches a fake engine;
4. create a workspace, worktree, and native session marker;
5. suspend and replace compute, then resume the same files;
6. switch agents or engines without deleting the earlier session;
7. start the Compose fixture and run its browser test;
8. open the authenticated preview through the local proxy;
9. create a branch, commit, push, issue comment, workflow change, and pull request against a GitHub fake;
10. dispatch PR reviewer, CI doctor, and a scheduled security audit;
11. merge, archive, restore, and confirm that durable state remains;
12. rerun the story checks from the UI issue through a real browser;
13. request explicit deletion and verify isolated, idempotent cleanup.

The default suite uses local servers, local repositories, a fake clock, and fake Claude Code and Codex executables. It cannot require internet access or live credentials.

Retention tests

Run a 14-calendar-day soak with a merged and archived story. The release waits for this test to finish. The worktree and native session files must still be present after wake.

Re-run the backup, restore, provider failure, preview, compute replacement, and explicit deletion checks implemented by the architecture and removal issues against the release candidate.

Pilot work

Before release, use one authorized repository with Claude Code and one with Codex. Run an interactive story, a PR event, a CI doctor event, and a scheduled security audit. Test the preview from another computer or network.

Record defects as separate issues under the epic when they can be fixed independently.

Documentation and release

Update the README, quickstart, architecture, security model, MCP reference, UI guide, self-hosting guide, migration guide, and roadmap. The docs should describe .agents/, full maintainer access, indefinite state retention, scheduled agents, and explicit deletion in direct language.

Publish the release with a breaking Conventional Commit subject, for example:

feat!: replace governed runs with persistent story workspaces

The pull request title and commit range must declare the same release impact.

Acceptance criteria

• The full automated journey passes from a clean checkout.
• Security-sensitive tests cover valid, malformed, expired, revoked, replayed, and cross-tenant inputs.
• The 14-calendar-day retention test keeps sessions and worktree files.
• Backup and restore recover the same workspace data.
• Claude Code and Codex pilots complete a real story.
• Scheduled and GitHub-triggered agents run in the pilot.
• MCP and UI complete equivalent workflows.
• A clean 0.12 install works.
• A 0.11 database is rejected without modification and can be restored with the documented procedure.
• Current documentation contains no instructions for the removed run and receipt model.
• pnpm verify passes and its output is attached to the release pull request.
• The release commit and pull request title use the required breaking-change syntax.

Release boundary

Remove workspaces_v2 before publishing. Facility 0.12 cannot ship with a permanent switch between the old and new execution models.

Start by reading the README, architecture, migration guide, and the existing architecture and removal checks, then run pnpm verify. Trace the automated journey, Compose/browser fixture, retention soak, pilots, and release-boundary requirements from the issue. Done means every acceptance criterion passes, documentation reflects the new model, and workspaces_v2 is removed before release.