Board Reliability And Cutover

Runtime contract

Morning and EOD boards run on weekday Trigger.dev schedules in America/New_York. A run is serialized on the board queue and follows this order:

1. Refresh the configured connectors with bounded lookbacks and idempotent writes.
2. Read connector checkpoints and report readiness for the requested New York calendar date.
3. Stop and create an operator-visible failure when required evidence is stale or a connector failed.
4. Start a temporary session on the existing SABLE Claude Managed Agent. The session is draft-only, has read-only spine access, and returns the governed JSON contract.
5. Validate run id, report date, kind, structure, and evidence. Same-day movement requires a same-day activity event linked to a governed project; unmatched connector activity is withheld.
6. Render deterministically, persist the validated draft, then deliver through an atomic database claim and a draft-specific Resend idempotency key.

The agent is retained. Trigger replaces the managed-agent deployment clock and direct-delivery path, not its reasoning or writing role.

Approved degraded-source operation

REPORT_REQUIRED_CONNECTORS may temporarily omit a connector only with explicit operator approval. Set the value identically in Trigger production and the Supabase spine-mcp Edge environment; any mismatch blocks the workflow before managed-agent generation. The omitted source is skipped during refresh, and the deterministic renderer marks both the subject and body as degraded. Claude does not author or remove this warning. Restore the full default set fathom,granola,asana,gmail,calendar,toggl as soon as the connector is approved and operational.

Fail-closed behavior

A board is not sent when readiness fails, the agent times out, JSON is malformed, an item has no evidence, or a daily claim cites an event outside the requested day. The run records the failed stage and error for operators. Never turn stale data into a low-confidence board.

If failure occurs before draft persistence, resolve the connector or contract error and rerun. If a delivery attempt fails or its outcome is ambiguous, do not create a fresh same-day draft. Retry the existing draft with its original context_run_id inside Resend's 24-hour idempotency window; the same provider key returns the original message instead of sending twice. A sending claim is recoverable after 15 minutes but fails closed after 24 hours, when an operator must reconcile the provider message id and board_runs.delivery_status manually.

The learning loop is a separate weekday task after EOD. It cannot render, persist, or deliver a board. It may propose an evidence-backed prompt_update, which still requires human approval before it can affect the live prompt.

Shadow rollout

Keep SABLE_REPORT_DELIVERY_MODE=shadow for at least five business days:

1. Deploy migrations and changed Edge Functions.
2. Generate four independent MCP bearers (interactive agent, report staging, learning, orchestrator), set their Edge/Trigger secrets, and let cma-admin create the versioned report/learning vaults. Archive the old sable-spine-staging / sable-spine-learning vaults after verifying the new ones; never reuse the former suffix-derived credentials.
3. Configure Trigger.dev and connector secrets; deploy Trigger tasks in shadow mode.
4. Manually run morning and EOD for the current date. Confirm readiness, activity-event evidence, deterministic output, draft persistence, and delivery only to the first configured test recipient.
5. Compare each shadow draft with the existing board. Lindsey reviews content quality and approves the temporary report contract; an operator reviews freshness and delivery controls.
6. Exercise failure cases: stale connector, bad CMA JSON, duplicate run, and delivery retry.
7. After five clean weekdays and written approval, set SABLE_REPORT_DELIVERY_MODE=live.

Single-scheduler cutover

Only after Trigger smoke tests pass and live delivery is approved:

1. Pause/archive both built-in Claude Managed Agent board deployments.
2. Unschedule legacy pg_cron board jobs. Connector reconciliation jobs may remain only if they do not overlap Trigger-owned refreshes; choose one owner per connector.
3. Enable the Trigger morning and EOD schedules.
4. Trigger one controlled report and verify exactly one board_runs delivery record and one message.
5. Record the cutover time, deployment ids, approver, recipient set, and rollback owner.

Rollback is to set Trigger delivery back to shadow or disable its schedules first. Do not re-enable the old scheduler until its direct delivery instructions have been removed or isolated, or duplicate boards can occur.

Manual prerequisites

• Lindsey: approve the report contract, shadow output, and any live-prompt change. This implementation does not modify the live SABLE prompt.
• Google Workspace super admin: enable the Gmail API and grant domain-wide delegation for https://www.googleapis.com/auth/gmail.readonly to the service-account OAuth client, then provide the Workspace mailbox to impersonate. Treat Gmail as a restricted-scope connector and complete the organization's security/privacy review before production use. Approve and set a narrow GMAIL_SYNC_QUERY plus a raw-message retention/deletion policy; the connector fails closed when the query is absent.
• Google/Asana/Granola operators: finish Calendar delegation, set ASANA_WORKSPACE_GID, verify the Asana project map, and create the Granola workspace API key.
• Supabase operator: apply migrations, deploy functions, set secrets, run database/security advisors, and verify connector checkpoints and RLS.
• Trigger operator: set production variables, deploy tasks, create schedules, and verify queues/retries.
• Communications owner: approve BOARD_RECIPIENTS ordering and membership before any send. Shadow mode sends only to the first configured recipient.