Maintenance framework: a maintainer crew role with scheduled duties, budgets and probe-backed findings #7554

Part of the epic #7553. Blocked by the pipeline model (#7562).

Problem

Crew roles are builder | planner | reviewer (src/core/agents.ts:282). The sentinel (src/crew/sentinel.ts:1) and hunters (src/hunt/) run on the autonomy clock (src/crew/autonomy.ts:1374) but have no budget, no schedule per duty, and no record of what they did and whether it helped. The steward's work (tick, unstick, lull watch, release, verify) has nowhere to live inside the forge.

Build

• A maintainer role. A maintainer is a crew member with a list of duties; each duty has a name, a trigger (interval, or an event such as "queue gate red"), a budget (runs per day, dollars per day, a network/CPU ceiling), an on/off switch, and a handler that returns findings and actions.
• A duty runner in src/maintain/ (own files): runs due duties, serializes per duty, records every run in a maintenance_run table (duty, started, finished, findings, actions, probes, outcome, cost).
• Probe record: every finding and action stores the probe that backed it (the query or measurement, the number it returned, the time). The runner refuses a finding without one.
• Output rules built in: file or comment on the existing issue for the same finding (de-duplicate by a stable key, as the sentinel does); fixes only as pulls through the normal gate; the maintainer role has no path to merge or push main; bulk actions run on one item first, the probe is checked, then the rest (capped per run).
• Pause and resume a duty from the board and over the API; a duty that errors three times in a row pauses itself and says why.
• A duty registry so workers #7555 to #7560 plug in with one file each.

Done when

• A duty registered in one file runs on schedule and leaves a run row with findings, actions and probe.
• A finding without a probe is refused.
• A bulk action touches one item, waits for its probe to pass, then continues; if the canary probe fails nothing else is touched.
• A duty over budget stops and records "budget" as the outcome.
• Tests: test/maintain-runner.test.ts, test/maintain-probe-required.test.ts, test/maintain-canary.test.ts, test/maintain-budget.test.ts, test/maintain-no-land.test.ts.
• Overlap: sentinel (#1131) and hunters (#5846) keep working; move them onto the registry only if cheap, otherwise leave and list as a follow-up.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.

Parked by the crew: the check stayed red through 2 automatic tries (pull #8927 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Sent back, Mason. #8927 parked on two tests, both from a new route: "the gathered routes > the index is current: run bun scripts/openapi-routes.ts" and "no GET route answers 200 without a session phase unless the allowlist names it". Run that script, give the new route its session phase, and open it again from the same branch.

Parked by the crew: the check stayed red through 2 automatic tries (pull #8933 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Sent back, Mason. #8933 parked on a test that was not its own: "the snapshot destination in the terminal > a bad endpoint is refused in the page's words, and nothing is sealed" (test/tui-backups.test.ts), which was red on main itself (#8993) and was fixed in #8995 (7c54a924). Your code was not the cause. Start from main as it is now, take the work up again, and the check judges your change alone. #9017 makes that test order-independent and makes admission refuse the shape that let it in.

Split by the planner after the crew parked it: the maintainer role is #11203, the duty registry, runner and maintenance_run record with probes is #11204, pause/resume and pausing after three errors is #11205, and per-duty budgets are #11206. #7555, #7556, #7558, #7560 and #7561 now wait on #11204.