Tyrell restore and ticket ownership audit

Restored two proven-stale Tyrell deployment scripts to the current committed version, added a stale-mtime commit guard, verified the live integrity watcher, and documented the ticket library's incomplete app-owner coverage so future portfolio work does not overwrite unowned state.

Scope

• Host: rdmsm4x
• Project: /Users/richh/dev/apps/Tyrell
• Portfolio evidence: /Users/richh/dev/apps and /Users/richh/dev/issues

Changes

• Restored only these two Tyrell working-tree paths from HEAD 2f4a1222979530d50598394d2b3dd66f2c43b3a4:
  • /Users/richh/dev/apps/Tyrell/scripts/deploy_fleet.zsh
  • /Users/richh/dev/apps/Tyrell/scripts/make_app_bundle.zsh
• Extended /Users/richh/dev/apps/Tyrell/.git/hooks/pre-commit to reject a staged file whose filesystem mtime predates the commit that last changed it, unless the explicit recovery override is set.
• Added the read-only audit: /Users/richh/dev/_ops/app-health-20260901/TICKET-OWNERSHIP-AUDIT.md.
• Opened ISSUE-20260901-04 for the incomplete ticket claim-history index and EPIC-20260901-02 for portfolio-wide source integrity, ecs0lib adoption, rebuild, launch, and runtime QA.

Preservation and rollback

• Pre-restore snapshot: /Users/richh/.agent-coordination/snapshots/rdmsm4x/Tyrell/20260901-144708
• The event-driven watcher retains content-addressed dirty revisions under: /Users/richh/.agent-coordination/worktree-integrity/rdmsm4x/Tyrell-849b79905b71
• To remove the local containment only, unload com.eastcoastscience.worktree-integrity.tyrell, remove its LaunchAgent, remove /Users/richh/bin/worktree_integrity_watch.zsh, and restore or remove the repository-local pre-commit hook. Do not delete captured objects until the incident is fully attributed.

Verification

• scripts/deploy_fleet.zsh and scripts/make_app_bundle.zsh are diff-clean against HEAD and pass zsh -n.
• Watcher script passes zsh -n; pre-commit hook passes sh -n; LaunchAgent passes plutil -lint and is running in the Aqua user domain.
• A disposable-repository regression retained both the newer and older blobs and emitted one critical backward-mtime transition.
• The pre-commit regression blocks canonical-main commits, split-index files, and staged content carrying a stale preserved mtime; each documented override was separately verified.
• Ticket index evidence: 5 indexed claim events across 5 tickets versus 34 Markdown files with embedded claim history; only 2 of 5 stored claims were unexpired at observation time.
• The ticket tool also reports 35 Markdown ticket files shadowed by duplicate IDs and therefore unreachable through normal indexed queries.
• App-root evidence: 53 directories, 45 exact repositories, 40 dirty repositories, 11 repositories with multiple linked worktrees, and 43 roots without a matching non-resolved project ticket.

Outstanding work

• The specific process that performed the preserved-mtime write-back remains unattributed; INCIDENT-20260901-04 stays open but contained.
• Claude owns the portfolio-wide ecs0lib/rebuild/launch lane under EPIC-20260901-02; Codex owns Tyrell and will not write other live repos.
• ISSUE-20260901-04 must repair lossless ticket reindexing before the ticket database can be treated as the complete app checkout/owner ledger.
• Duplicate ticket IDs require an explicit provenance-preserving migration map; they were not auto-renumbered during this audit.
• The isolated Tyrell feature worktree remains preserved and clean for later resumption.