Backlog sequencing: dependency DAG and build order (moat → hosted V1)

[BunsDev]

Tracking issue for build ordering and dependencies across the moat → hosted V1 backlog. Native GitHub "blocked by" relationships are now set on every issue below; this is the human-readable topological view.

Critical path (the spine)

#2 → #4 → #10 → #13 → #19
Durable queue → auth split → review triggers → command protocol → reference demo. Nothing in the operating loop ships before #2.

Build waves (topological)

Wave 0 — foundation (no blockers)

• Add durable task queue and GitHub delivery idempotency #2 Durable task queue + delivery idempotency — unblocks everything in M2/M3/M4
• Ship opencoven.ai/github landing page and hosted beta waitlist #16 Landing page + beta waitlist · Decide and document hosted pricing tiers #17 Pricing tiers decision (parallelizable, no code deps)

Wave 1 — unblocked by #2

• Add tenant-scoped task API authentication for CovenCave and hosted clients #3 Tenant-scoped task API auth
• Split agent read auth from publication write auth #4 Split agent read auth from publication write auth
• Add hosted worker container isolation and resource limits #5 Hosted worker container isolation
• Resolve Check Run head SHA and target ref correctly #8 Check Run head SHA / target ref
• Use repository default branch for session brief and PR base #9 Repo default branch for brief + PR base
• Add structured review output and deterministic publication gates #11 Structured review output + publication gates
• Implement Branch Gardener scheduled branch-hygiene skill #14 Branch Gardener scheduled skill

Wave 2

• Implement PR, push, and commit review triggers #10 PR/push/commit review triggers — blocked by Split agent read auth from publication write auth #4
• Define hosted memory governance contract between coven-github and coven-code #6 Hosted memory governance contract — blocked by Add tenant-scoped task API authentication for CovenCave and hosted clients #3
• Add installation-scoped familiar routing and repository policy #7 Installation-scoped familiar routing — blocked by Add tenant-scoped task API authentication for CovenCave and hosted clients #3
• Add usage metering plus tier limits and concurrency controls #15 Usage metering + tier limits + concurrency — blocked by Add tenant-scoped task API authentication for CovenCave and hosted clients #3
• Add audit, artifact retention, and redaction controls #12 Audit, artifact retention, redaction — blocked by Add hosted worker container isolation and resource limits #5

Wave 3

• Add marker-backed comments and maintainer command protocol #13 Marker-backed comments + command protocol — blocked by Implement PR, push, and commit review triggers #10
• Build Cave oversight dashboard for task history, routing, usage, and audit #18 Cave oversight dashboard — blocked by Add tenant-scoped task API authentication for CovenCave and hosted clients #3 and Add audit, artifact retention, and redaction controls #12

Wave 4

• Produce ClawSweeper-style reference demo of the operating loop #19 ClawSweeper-style reference demo — blocked by Add marker-backed comments and maintainer command protocol #13

Full edge list (blocked → blocking)

Issue	Blocked by
#3, #4, #5, #8, #9, #11, #14	#2
#10	#4
#6, #7, #15	#3
#12	#5
#13	#10
#18	#3, #12
#19	#13

Roots: #2 (engineering spine), #16/#17 (GTM, no code deps). Hosted paid gates (#5, #3, #7, #6) all sit ≤2 hops from #2.

[BunsDev]

Wave 1 grooming — execution order & sizing

All seven Wave 1 issues (#3, #4, #5, #8, #9, #11, #14) are unblocked by #2 but are not equal priority. Each now carries a ## Wave 1 grooming section (size · intra-wave rank · scope in/out · ready checklist · definition-of-done). Recommended start order, by downstream leverage:

Rank	Issue	Size	Lane	Why now
1	#4 Split read/write auth	M–L	critical path	spine #4 → #10 → #13 → #19; closes token-leak boundary
2	#3 Tenant task-API auth	L	hosted gate	highest fan-out — unblocks #6, #7, #15, #18
3	#8 Check Run head SHA	M	correctness	feeds #11 stale-ref gate
3	#9 Repo default branch	S–M	correctness	feeds #11 + brief; pairs with #8
4	#11 Structured output + gates	L	correctness capstone	consumes #8/#9; pairs with #4 boundary
—	#5 Worker isolation	L	independent	parallel lane; unblocks #12
—	#14 Branch Gardener	M	standalone	no downstream; was thinnest spec, now groomed to peer bar

Parallelizable lanes (across owners):

• A — critical path/security: Split agent read auth from publication write auth #4 → (enables Implement PR, push, and commit review triggers #10)
• B — hosted gate/fan-out: Add tenant-scoped task API authentication for CovenCave and hosted clients #3 → (enables Define hosted memory governance contract between coven-github and coven-code #6, Add installation-scoped familiar routing and repository policy #7, Add usage metering plus tier limits and concurrency controls #15, Build Cave oversight dashboard for task history, routing, usage, and audit #18)
• C — review correctness: Resolve Check Run head SHA and target ref correctly #8 ∥ Use repository default branch for session brief and PR base #9 → Add structured review output and deterministic publication gates #11
• D — independent infra: Add hosted worker container isolation and resource limits #5 → (enables Add audit, artifact retention, and redaction controls #12)
• E — standalone skill: Implement Branch Gardener scheduled branch-hygiene skill #14

Must-start-first: #4 and #3 — each is the sole prerequisite for a downstream cluster. Verification bar for every issue: cargo check --all-targets + cargo clippy --all-targets -- -D warnings + cargo test --all green.

[BunsDev]

Wave 1 ownership

• Split agent read auth from publication write auth #4 (read/write auth split — critical path) → Owner: Cody (engineering lane)
• Add tenant-scoped task API authentication for CovenCave and hosted clients #3 (tenant task-API auth — highest fan-out) → Owner: Cody (engineering lane)

Approval gate: Val (merge/publication decisions). GitHub-native assignee is @BunsDev on both (only repo-assignable account; familiars aren't GitHub users, so lane ownership is tracked here + in each issue body). Remaining Wave 1 issues (#5, #8, #9, #11, #14) are unowned — assign as lanes pick up.

[BunsDev]

Execution status — the DAG is nearly cleared

Every engineering wave in this tracker has now landed on main via green squash-merged PRs:

Wave	Issue	Status
0	#2 durable queue + idempotency	✅ closed (#43 #44 #46)
1	#4 auth split	✅ closed (#37)
1	#3 tenant task-API auth	✅ closed (#51)
1	#5 container isolation	✅ closed (#59)
1	#8 head SHA / stale-ref gate	✅ closed (#42)
1	#9 default branch	✅ closed (evidence comment)
1	#11 publication gates	✅ closed (#53)
2	#10 review triggers	✅ closed (#38)
2	#6 memory governance	✅ closed (#48 #50 #54 #56)
2	#7 installation-scoped routing	✅ closed (#55)
2	#15 metering + limits	✅ closed (#57)
3	#13 command protocol + markers	✅ closed (#39, hardened in #49)
4	#19 reference demo	✅ closed (#40) — examples/demo/run-demo.sh, self-verifying

In flight right now: #12 (audit/retention — branch feat/issue-12-audit-retention) and #14 (Branch Gardener — branch feat/issue-14-branch-gardener).

Remaining after those: the GTM/product items #16 (landing page) and #17 (pricing), and #18 (Cave dashboard, largely coven-cave work — its blockers #3 and #12 are/soon-are cleared).

Suggest closing this tracker once #12 and #14 merge — the build-order question it exists to answer is resolved.