truf-server/openspec/changes/run-bounded-rank1-breadth-experiment/tasks.md

1. Reviewed Profile And Schema

• 1.1 Add exact versioned depth and rank-one breadth profile validation while preserving the existing depth profile hashes and behavior.
• 1.2 Widen PostgreSQL/SQLite experiment bounds only to the reviewed 39-repository and 2,000-target profile.
• 1.3 Make persisted resolver authority dynamic from the exact reviewed profile instead of hardcoded depth constants.

2. Deterministic Cohort

• 2.1 Select fresh candidates from the existing complete frozen pass while excluding the prior depth cohort and unsafe queue state.
• 2.2 Validate exact fully reversed prior Docker-experiment policy history without accepting unrelated or incomplete events.
• 2.3 Implement physically deduplicated pinned-query round-robin planning to exactly 2,000 repositories with 38/39/0 keyword ownership.
• 2.4 Preserve the old depth plan and manifest bytes and add strict breadth plan/manifest validation.
• 2.5 Revalidate every reviewed cohort row and its provenance/history under locks before application.

3. Runtime Authority

• 3.1 Enforce that no other Docker experiment is nonterminal, unreleased, or fenced at breadth application and activation.
• 3.2 Reuse reversible holds for safely released rows and retain exact append-only policy-event authority.
• 3.3 Resolve at most one newest immutable image per repository and prohibit breadth selections above rank one.
• 3.4 Keep experiment-row-first leases, reservations, capacity, finite retries, and terminal target reconciliation unchanged.

4. Reporting And Verification

• 4.1 Add secret-safe breadth reporting for globally deduplicated credentials, alive credentials, keyword attribution, coverage, scan-hours, and yield per scanner-hour.
• 4.2 Add focused unit tests for profile validation, exact balanced physical selection, old-profile compatibility, and prior-release history.
• 4.3 Add focused PostgreSQL integration coverage for authority handoff, locked cohort application, rank-one dispatch, and reversible holds.
• 4.4 Run focused tests and strict OpenSpec validation.

5. Reviewed Launch

• 5.1 Canonically stop runtime and verify sources, workers, leases, reservations, and experiment fences are quiescent.
• 5.2 Complete and report the two remaining depth targets or apply only an existing reviewed terminal protocol.
• 5.3 Generate and approve the depth release manifest, then verify every owned cold event is exactly reversed.
• 5.4 Generate, review, and apply the exact 2,000-repository breadth cohort and hold manifests.
• 5.5 Update the reviewed runtime profile, canonically restart, and verify secret-safe live progress with no hold, exhausted retry, or fence anomaly.