`NEXT-BATCH.md`

92 lines

# TK-11438 — applied Ken batch and retained scope

Status: APPLIED AND INDEPENDENTLY VERIFIED, 2026-09-11. Overall fleet remains incomplete.
Owner: codex-run-11438. Source commit d840eb6; independent26/26PASS.
Approval received via TK-11478, excluding all email sends. See verification/ken-rollout/parent-acceptance.json.

The following is the retained approved scope.

Approve this Ken batch, including its service restart and reconciliation job
reload. Restarting Ken resumes its existing autonomous loops and therefore needs
approval covering that operational effect. Preserve trading mode, risk settings,
balances, credentials, and PostgreSQL TCP listening.

## Exact scope

1. `~/Projects/Ken/kalshi-dash/.env`, lines 3–4: add URI query `host=/tmp` to
DATABASE_URL (bertha_betting) and KEN_DATABASE_URL (ken), preserving all other
parameters. `start.sh` sources this file, overriding PM2 environment.
2. Only the `ken` PM2 effective and saved dump entry: align both URL keys, top
level and nested env, to the same socket values. Guard identity and current
hash; preserve all unrelated fields and services.
3. `~/Projects/Ken/kalshi-dash/follow-the-winners-check.sh`, line 13: apply the
exact hashed replacement in `next-batch.json`. This hourly job sets the URL
inline. Do not run its wrapper for verification: it can send email on a
signal transition.
4. `~/Library/LaunchAgents/com.steve.ken-reconcile-canary.plist`:
EnvironmentVariables.KEN_DATABASE_URL gets the same socket query. Reload
this job alone after guarding identity; interval 1,800 seconds. Its inspected
reconciliation script performs SELECTs only.

The safemode guard uses hostless psql with no PGHOST in its plist. Preserve it;
verify its inherited host separately before accepting full-fleet coverage.
Ken/ecosystem.config.js targets remote Bertha processes and is excluded.

## Completed evidence

- Fresh direct read-only PM2 RPC found 147 services. Original two-service batch:
15/15 assertions pass. Saved showroom .env, effective URL and both dump fields
agree. Authenticated reads pass, unauthenticated reads return 401, and counts
remain 3,201 showroom products and 1,694 PDL designs. No reboot was performed.
- PostgreSQL activity still shows Ken on `::1`. TCP remains required.
- Ken's installed driver passed four socket/read-only/missing-socket checks for
both databases. All test connections closed; no app or job boot.
- Source/env hashes and scheduler metadata are in next-batch.json and
verification/{env-provenance,ken-schedulers,ken-driver-proof}.json.
- Initial PM2 API verification timed out. Direct getMonitorData RPC succeeded;
saved verification scripts avoid API initialization/startup. Missing pm2.pid
was observed while daemon PID 27622 existed; no daemon repair was attempted.

## Execution and acceptance after approval

Recheck ownership and hashes. Snapshot dirty source trees without staging secrets.
Privately capture exact previous URL fields and source. Verify shell-sourced .env
and PM2 precedence, and rehearse field-level rollback on copies. Apply the batch,
restart only Ken, then prove BOTH pools preserve DB/role identity with read-only
SELECTs, no TCP 5432 sockets, and the existing auth boundary. Choose a reviewed
local DB-only endpoint: `/api/health` calls Kalshi balance APIs.

Reload only reconciliation launchd and observe loaded env, exit status and its
reconciliation result. Distinguish an existing reconciliation failure from a new
connection failure. Observe the hourly job during its normal authorized schedule;
do not trigger its possible email path manually. Independent verification must
accept service and scheduler evidence before claiming batch completion.

On regression restore only captured target fields/source and restart/reload only
the affected service/job. Never restore the fleet's entire PM2 dump.

## Remaining and stop condition

Gracie is a separate batch. Although its catalog can use JSONL, mounting
lib/vendor-requests.js immediately attempts CREATE TABLE IF NOT EXISTS against
dw_unified via a hardcoded TCP pool. Restarting it crosses the canonical DDL gate.
No Gracie source/config changes are proposed here.

Original inventory: 217 files plus one invalid directory entry. Expanded
candidates, shared vendor modules, inherited hosts, remote/container targets,
other live services and schedulers still need disposition. Do not disable TCP
or mark TK-11438 done.

Gate source: Steve's current ticket instruction requires a pending-approval
draft and STOP for production/customer-facing/spend/send/canonical changes.
E2E Proof requires approved R4 rollout and independent verification.

## Result and limitations

Ken PID25903 is using sockets for both databases. Saved fields match runtime.
Reconciliation is loaded with socket URL and1800-second interval, and exited0.
The underlying signal module passed using the changed wrapper URL; the wrapper
itself was not invoked because it can send email. Captured trading settings
match; full risk_state hash is volatile and uncaptured keys were not independently
proven unchanged. Private rollback materials are retained and gitignored.