quest: record the 2026-11-08 /quest-unblock answers

quest/m0/codex-cloud-off.md

@@ -1,4 +1,4 @@
-# [XS] Turn off Codex cloud reviews
+# [S] Turn off Codex cloud reviews
 
 ## Goal
 
@@ -12,12 +12,15 @@ Local review (`quest review` and `/quest-review`) has landed. As of
 2026-11-02, moq, rind and rust2's `CONTRIBUTING.md` no longer name Codex's
 cloud review; moq.pro's still does.
 
-## Waiting
+Decided 2026-11-08 (maintainer, /quest-unblock): ✅ an agent moves moq.pro to
+local review and updates its stragglers (rejected: keep Codex cloud review
+for moq.pro and delete this quest; leave it waiting).
 
-- moq.pro: its review policy stops naming Codex's cloud review, as moq's,
-  rind's and rust2's did. Check its `CONTRIBUTING.md` for
-  `chatgpt-codex-connector`.
-- moq, moq.pro, rind, rust2, quest: no open PR was opened before its
-  repository adopted local review without having merged main since. To
-  check, list each repository's open PRs and compare them with the adoption
-  merge. To advance it, update the stragglers to main.
+- One moq.pro PR rewrites its `CONTRIBUTING.md` review policy to local
+  review, as moq's did, dropping the `chatgpt-codex-connector[bot]`
+  findings rule.
+- Once it lands, merge main into every open moq.pro PR opened before it
+  (on 2026-11-08: 3215, 3211, 3209 and 3091, all the maintainer's drafts).
+  moq, rind, rust2 and quest had no such stragglers that day.
+- Then the maintainer turns off automatic reviews in Codex's settings, and
+  this quest is deleted.

quest/m0/kix/operator-setup.md

@@ -1,59 +1,64 @@
-# [S] Set up the Kix bot's pilot repositories
+# [S] Turn on kix for moq-dev's repositories
 
 ## Goal
 
-The operator installs the registered GitHub App on the pilot repositories,
-moq-dev/moq and moq-dev/quest, and enrolls them on quest.moq.dev. A real issue event and a
-bounded test PR verify the integration before contributors are invited.
+kixel-quest is installed on moq-dev/moq and moq-dev/quest, both are
+enrolled on quest.moq.dev, and a real issue event and a bounded test PR show
+the integration works against GitHub rather than the fake.
 
 ## Plan
 
-- This is an operator/setup outcome. The Worker is live at quest.moq.dev
-  (deployed 2026-11-04, /quest-unblock) with the production App
+- The Worker is live at quest.moq.dev (deployed 2026-11-04, /quest-unblock)
+  with the production App
   [kixel-quest](https://github.com/apps/kixel-quest) (ID 5622964, owned by
   moq-dev); its registration and secrets were part of that deploy.
-- Pilot repositories decided 2026-10-27 (user): moq-dev/quest and
-  moq-dev/moq, ranked first so kix is usable on moq-dev/moq soonest.
-  Decided 2026-10-30 (user): start with moq-dev/moq; the private
-  moq-dev/moq.pro follows in [Private repositories](/quest/m0/kix/private.md).
-  Job branches publish on the upstream itself (decided the same day), so
-  there is no fork namespace to set up.
-- Validate real installation-token behavior, which publication's tests only
-  mock (Publication in `cloudflare/GITHUB.md`): a job branch pushed to the
-  upstream under its branch rules, GitHub's signature on the App's API
-  commits, a same-repository pull request opened by the App, and an
-  iteration pushing an upstream pull request head under branch rules.
-- Check a runner's review against the real checks API, which
-  [moq-dev/quest#417](https://github.com/moq-dev/quest/pull/417) tests only
-  against the fake: a merge job's delivered head gets the App's
-  `quest review` check run, a failing round followed by a passing one leaves
-  the passing run as the latest, and kix lands the head with no human
-  approval. The installation needs **Checks: write** for it.
-- Install the PWA and receive a push notification on real Android, iOS, and
-  desktop devices (from
+- Repositories decided 2026-10-27 (user): moq-dev/quest and moq-dev/moq,
+  ranked first so kix is usable on moq-dev/moq soonest. Decided 2026-10-30
+  (user): start with moq-dev/moq; the private moq-dev/moq.pro follows in
+  [Private repositories](/quest/m0/kix/private.md). Job branches publish on
+  the upstream itself (decided the same day), so there is no fork namespace
+  to set up.
+- Decided 2026-11-08 (maintainer, /quest-unblock): Quest serves moq-dev
+  only, so this is turning kix on for our own repositories, not a pilot ahead
+  of outside contributors. ✅ Keep the quest and drop its outsider steps
+  (rejected: delete this quest only; drop hosted kix entirely, which belongs
+  to the factory re-scope's /quest-plan rounds if anywhere). Dropped: the
+  check that each setup page shows no Pull-request CI warning before
+  contributors are invited.
+- Once installed, an agent validates what only a real installation shows:
+  - Installation tokens, which publication's tests only mock (Publication in
+    `cloudflare/GITHUB.md`): a job branch pushed to the upstream under its
+    branch rules, GitHub's signature on the App's API commits, a
+    same-repository pull request opened by the App, and an iteration pushing
+    an upstream pull request head under branch rules.
+  - A runner's review against the real checks API, which
+    [moq-dev/quest#417](https://github.com/moq-dev/quest/pull/417) tests only
+    against the fake: a merge job's delivered head gets the App's
+    `quest review` check run, a failing round followed by a passing one
+    leaves the passing run as the latest, and kix lands the head with no
+    human approval. The installation needs **Checks: write** for it.
+  - Reading a deleted issue by number, which the background reconcile from
+    [moq-dev/quest#170](https://github.com/moq-dev/quest/pull/170) only
+    tests against the fake.
+  - What GitHub does to an open pull request when "Start over" resets its
+    head branch to the base, which
+    [moq-dev/quest#190](https://github.com/moq-dev/quest/pull/190) handles
+    either way (adopt it if open, open a new one if closed) but tests only
+    against the fake. Added 2026-10-22 (user).
+- Rehearse on the maintainer's own runner and an explicitly selected
+  account.
+- Record nonsecret setup and run instructions and deployment identifiers,
+  then delete this quest.
+
+## Waiting
+
+- Maintainer: install kixel-quest on moq-dev/moq and moq-dev/quest and
+  enroll both on quest.moq.dev. An agent can't: installing an App and
+  enrolling need the maintainer's signed-in GitHub session. Check that
+  `gh api orgs/moq-dev/installations` lists `kixel-quest` with both
+  repositories and that quest.moq.dev shows both enrolled.
+- Maintainer: install the PWA and receive a push notification on real
+  Android, iOS, and desktop devices (from
   [moq-dev/quest#165](https://github.com/moq-dev/quest/pull/165), whose
-  tests use fakes).
-- Read a deleted issue by number against a real installation, which the
-  background reconcile from
-  [moq-dev/quest#170](https://github.com/moq-dev/quest/pull/170) only
-  tests against the fake.
-- Check what GitHub does to an open pull request when "Start over" resets
-  its head branch to the base, which
-  [moq-dev/quest#190](https://github.com/moq-dev/quest/pull/190) handles
-  either way (adopt it if open, open a new one if closed) but tests only
-  against the fake. Added 2026-10-22 (user).
-- Each pilot's setup page shows no Pull-request CI warning before
-  contributors are invited (Read-only pull-request CI in
-  `cloudflare/GITHUB.md`; moved from the read-only CI quest on 2026-11-02).
-  Read with `gh api` that day: both default workflow tokens are read-only,
-  but the moq-dev organization shares its `DISCORD_WEBHOOK` secret with both
-  pilots, and moq-dev/moq keeps 18 repository secrets, including the
-  `MBX_R2_*` pair its `check.yml` passes to `pull_request` checks; moq-dev/moq
-  tracks moving them in
-  [read-only secrets](https://github.com/moq-dev/moq/blob/main/quest/m0/ci/read-only-secrets.md).
-  Its environments name only protected branches, its merge queue's, and tags.
-  Accept the App's new CI-check permissions on both installations first.
-- Rehearse on the operator's own runner and an explicitly selected
-  operator account.
-- Record nonsecret setup/run instructions and deployment identifiers.
-  Remove the quest when the setup condition is fulfilled.
+  tests use fakes). An agent can't hold the devices. Check by the
+  maintainer's report.

quest/m0/queue-watcher/follow.md

@@ -48,10 +48,25 @@ By 2026-11-03 both had landed PRs through their queues
 [moq-dev/rust2#467](https://github.com/moq-dev/rust2/pull/467) and later), so
 only the fork case remains.
 
+Decided 2026-11-08 (maintainer, /quest-unblock): ✅ the maintainer lands a
+PR of their own from a fork, prepared by an agent (rejected: wait for an
+outside contributor; drop the fork check and delete this quest). The prepared
+PR is this quest's deletion, so landing it from the fork both proves the case
+and finishes the quest. It also exercises the runner groups
+[Harden the queue runners](/quest/m0/queue-watcher/runners.md) restricted that
+day.
+
 ## Waiting
 
-- Fork contributor: a PR from a fork lands through any of the three merge
-  queues. Check with
-  `gh pr list -R moq-dev/<repo> --state merged --json number,isCrossRepository`
-  and the `merge_group` runs on its `<repo>-queue` runner. A maintainer can
-  advance it by landing a PR of their own from a fork.
+- Maintainer: push the prepared local branch `fork-check/follow` (commit
+  `aade5b62` in the moq-dev/quest checkout's shared git directory) from a
+  personal fork and pick merge on it. kixelated/quest is an unrelated
+  repository, so the fork takes another name. An agent can't: the PR must
+  come from the maintainer's own fork and account.
+  `gh repo fork moq-dev/quest --fork-name quest-fork --clone=false`, then
+  `git push git@github.com:kixelated/quest-fork.git fork-check/follow`, then
+  `gh pr create -R moq-dev/quest --head kixelated:fork-check/follow --fill`.
+  If main moved, merge it into the branch locally and rerun `quest check --fix`
+  first. Check with
+  `gh pr list -R moq-dev/quest --state merged --json number,isCrossRepository`
+  and its `merge_group` run on `quest-queue`.

quest/m0/queue-watcher/pro-cutover.md

@@ -48,7 +48,9 @@ queue, so it is the repository the own queue exists for.
   `Queue` does.
 - The own queue's token asks moq-bot's App for `actions: write` (to cancel a
   stale build) and `checks: write` (each pick's `quest queue` check run),
-  beyond what the gate uses; grant them on moq.pro's installation first.
+  beyond what the gate uses. Granted 2026-11-08 (maintainer, /quest-unblock):
+  moq-bot's moq-dev installation, which covers every repository, now has
+  both.
 - Drain or carry over the gate's queue before switching: picks already armed
   stay armed, so the watcher reads them in the same order. Switch only once
   the gate has no fixer job running or uncollected: the gate records each in

quest/m0/queue-watcher/runners.md

@@ -65,23 +65,21 @@ and [moq-dev/rust2#650](https://github.com/moq-dev/rust2/pull/650).
 What remains: restrict each group, and verify that a fork PR's workflow waits
 for approval (see Waiting).
 
+Done 2026-11-08 (maintainer, /quest-unblock): moq-dev/rind#491 and
+moq-dev/rust2#650 merged, so every `queue.yml` calls `queue-build.yml@main`,
+and the coordinator restricted runner groups 8 (quest-queue), 9 (rind-queue)
+and 10 (rust2-queue) to their repository's
+`.github/workflows/queue-build.yml@refs/heads/main` with the maintainer's
+org-admin login. GitHub kept the fields on the Team plan.
+
 ## Waiting
 
-- moq-dev/rind, moq-dev/rust2: merge moq-dev/rind#491 and moq-dev/rust2#650.
-  Check with `gh pr view <n> --repo moq-dev/<repo> --json state`.
-- Maintainer: once a repository's `queue.yml` calls `queue-build.yml@main` on
-  main, restrict its runner group to that workflow. An agent can't: the
-  runner-group admin API needs org-admin scope the agents' tokens lack. Not before: the group
-  would then admit no merge-group job and stall the queue. For moq-dev/quest
-  (group 8; rind-queue is 9 and rust2-queue is 10, each with its own name and repository):
-  `gh api -X PATCH orgs/moq-dev/actions/runner-groups/8 -f name=quest-queue -F restricted_to_workflows=true -f 'selected_workflows[]=moq-dev/quest/.github/workflows/queue-build.yml@refs/heads/main'`.
-  Check that `gh api orgs/moq-dev/actions/runner-groups/8` shows
-  `restricted_to_workflows: true` with that one workflow, and that the next
-  merge group's `Queue build / Build` job still runs on the runner. GitHub
-  documents workflow restriction for Enterprise Cloud while moq-dev is on the
-  Team plan, though the API accepts the fields; if GitHub rejects or drops
-  them, revert with `-F restricted_to_workflows=false` and fall back to option
-  (2) above.
+- moq-dev/quest, rind, rust2: the next merge group's
+  `Queue build / Build` job still runs on the repository's restricted runner
+  group. Check with `gh run list -R moq-dev/<repo> --event merge_group` for a
+  run created after 2026-11-08T04:40Z that leaves no job queued for a runner.
+  If one stalls, revert that group with `-F restricted_to_workflows=false`
+  and fall back to option (2) above.
 - Maintainer: the next time an outside contributor opens a fork PR on
   moq-dev/quest, moq-dev/rind or moq-dev/rust2, check that its workflow runs
   wait for approval.

quest/m0/user-dev-shell/repo-config.md

@@ -13,23 +13,23 @@ still runs the pinned tools, through the maintainer's user-level hooks.
 
 Decided 2026-11-07 (maintainer): moq.pro drops all of its dev-shell config.
 Its Claude direnv hook is already gone. Its Codex config stays until the
-condition below holds.
+Goal's check passes.
 
 - Keep `.claude/hooks/submodule.sh`, `worktree.sh`, `tofu-secrets.py`, and
   `.codex/environments/environment.toml`'s submodule setup.
 - Check: in a fresh moq.pro clone with `.codex/` removed and a clean
   environment, `codex exec` resolves `which just`.
 
-## Waiting
+Decided 2026-11-08 (maintainer, /quest-unblock): a fresh headless Codex
+session in moq.pro couldn't load the dev shell without the repo hooks, since
+the flake takes `path:./moq` and nothing initialized that submodule for
+`codex exec`. ✅ (a) the user-level `dev-shell-hook` runs
+`git submodule update --init` when `.gitmodules` lists an uninitialized path
+the flake needs (rejected: (b) keep moq.pro's Codex config for good; (c)
+accept a manual submodule init in fresh clones). It also fixes a cold first
+Claude session, where the user-level hook ran before moq.pro's
+`submodule.sh` and printed no `just`.
 
-- Maintainer: a fresh headless Codex session in moq.pro can't load the dev
-  shell without the repo hooks. The flake takes `path:./moq`, nothing
-  initializes that submodule for `codex exec`, and the user-level
-  `dev-shell-hook` (in the maintainer's dotfiles, outside this tree) doesn't
-  initialize submodules. With the submodule initialized, the same check passed.
-  Options: (a) `dev-shell-hook` runs `git submodule update --init` when
-  `.gitmodules` lists an uninitialized path the flake needs; (b) keep moq.pro's
-  Codex config for good, and close this quest; (c) accept that fresh clones
-  need a manual submodule init. Recommendation: (a). It also fixes a cold first Claude
-  session, where the user-level hook ran before moq.pro's `submodule.sh` and
-  printed no `just`. Check: the Goal's check passes.
+- The hook lives in kixelated/dotfiles (`bin/dev-shell-hook`, documented in
+  `docs/dev-shell.md`), so this quest's work opens a PR there first, then
+  the moq.pro PR that drops the Codex config once the Goal's check passes.

quest/m1/decisions-needed.md

@@ -16,11 +16,6 @@ m1.
   and `handBackWaits`, which makes every `Decisions needed` item the
   maintainer's) and every doc and skill that names both.
 
-## Waiting
-
-- moq, moq.pro, rind, rust2, quest: no open draft carries
-  `## Decisions needed` (on 2026-11-04, 4 in moq, 5 in moq.pro, 2 in rind,
-  3 in rust2, none in quest). Check with
-  `gh pr list -R moq-dev/<repo> --state open --draft --json number,body` and
-  search the bodies for the heading. To advance it, rewrite each to
-  `## Waiting`.
+Cleared 2026-11-08 (/quest-unblock): no open draft in moq, moq.pro, rind,
+rust2 or quest carries `## Decisions needed` any more; the last one,
+moq-dev/rust2#426, was rewritten to `## Waiting`.