Implementation ADR — Self-updating Reconciliation Dashboard

Knowing the true state of the work is, today, a manual end-of-shift archaeology dig: sweep dashboard folders, ssh into bigblack, read loop panes, and guess which worktrees are stale. It is slow, error-prone, and stale the moment it's finished — the first manual pass even mislabeled which loop was live.

We want one always-current, trustworthy view of what's done, in progress, live right now, and waiting on the operator — plus a coach that compounds the operator's skill over time.

Build a self-updating page from three engines feeding one source-of-truth HTML file:

• Engine A · Collect (deterministic, no AI) — parses every campaign's HTML for status, scans all ccmax-claude processes + bigblack loops, lists git worktrees with staleness heuristics. Laptop every 5 min (EON-gated), bigblack every 15 min.
• Engine B · Judge (Claude, daily) — LLM-as-judge for the fuzzy calls (worktree safe-to-remove? loop live vs gated?) with a one-line reason. Report-only — never deletes.
• Engine C · Coach (Claude, per session via the Stop hook) — grades the operator's own prompts against a rubric, surfaces recurring anti-patterns with real examples, and teaches the matching state-of-the-art technique (gap-driven).

One file, updated in place: findings/reconciliation/index.html is the single source of truth; state.json + coach store sit beside it as supporting data.

Runtime gate: on the laptop the whole run only fires when on the EON network (Tailscale up + bigblack reachable); off-net it exits silently.

Git: the file lives on main, reached via one working branch + one open PR — the automation never commits to main directly; the operator squash-merges.

Deploy & serve: rsync over Tailscale to /home/nasimubd/sites/opendeviationbar-py/reconciliation/ (a sibling of dashboard/, so the dashboard's --delete can never wipe it), served by Caddy behind a Cloudflare zero-trust tunnel (odb.epatner.com) — authorized personnel only. Secrets are redacted before any AI sees a transcript.

• Rejected — an hourly full-LLM loop for everything: costly + non-deterministic. A deterministic collector + a once-daily judge is cheaper and more reliable.
• Rejected — a permanent orphan side-branch for the file: the operator wants the file to live on main through the normal PR flow.
• Rejected — deploying into the dashboard/ dir: the dashboard's rsync --delete would wipe it. A sibling reconciliation/ dir is immune.
• Rejected — plain cron polling: replaced by a timer + EON gate, plus an event trigger (the Stop hook) for the coach.

1. scripts/reconcile/{collect,render,judge,coach} + the prompt-quality rubric + a secret-redaction pass.
2. mise reconcile namespace: collect · render · judge · coach · deploy · run · doctor · check-full + .claude/commands/reconcile/* wrappers.
3. Git/PR "ensure exactly one open PR" helper (idempotent, on-host gh).
4. [operator go] laptop launchd 5-min agent (EON-gated) + wire the Coach into the session-monitor Stop hook.
5. [operator go] bigblack systemd 15-min + daily judge timers + create the protected deploy dir.

Guardrails: read-only prod diagnostics; never touch /home/tca; no AI attribution in git/PR artifacts; report-only worktree cleanup; one HTML file, updated in place.