worker/docs/source-plan-migration.md

# Source Plan Migration Ledger

## Purpose

This ledger records how worker-related documents from the RSMon control-plane
repository were converted. The source plans are historical input, not runtime
authority. Their worker-owned requirements now live in this repository's
implementation documents; control-plane-owned requirements stay in RSMon.

Conversion date: 2026-07-13.

## Direct Worker Documents

| Former RSMon document | Worker implementation document | Resolution |
| --- | --- | --- |
| `docs/new-worker.md` | root `README.md`, `architecture.md`, `private-workers.md` | Replaced monorepo commands with standalone binary/container/systemd operation |
| `docs/worker-container.md` | root `README.md`, `implementation-roadmap.md` | Distribution ownership moved here; production image tags retained |
| `docs/worker-http-settings.md` | `web-console-and-observability.md`, root `README.md` | Current port/auth behavior retained; Compose-only `WORKER_BIND_IP` clarified |
| `docs/worker-protocol.md` | `control-plane-protocol.md` | Current tagged task envelope is normative; stale jobs/results envelopes rejected |
| `docs/worker-cluster-quickstart.md` | `critical-check-cluster.md` | Existing cluster scaffold separated from unimplemented critical engine |
| `docs/rsmon-distributed-api-plan.md` | `architecture.md`, `control-plane-protocol.md`, `implementation-roadmap.md` | PostgreSQL normal path retained; Redis/Rabbit/NATS queue proposal superseded |
| `docs/plans/worker-notifier-mvp.md` | `tasks-and-notifications.md` | Final `task_envelope` and credential implementation supersede older sibling-field drafts |
| `docs/sessions/monitor-transfer-and-admin-workers.md` | `architecture.md`, `private-workers.md` | Historical operator/session decisions reduced to current ownership and account-isolation rules |

## Distributed Plans

| Former RSMon document | Worker implementation document | Resolution |
| --- | --- | --- |
| `docs/distributed/notifications-from-worker.md` | `tasks-and-notifications.md`, `private-workers.md` | Implemented methods/statuses recorded; old credential assumptions replaced |
| `docs/distributed/private-workers.md` | `private-workers.md` | Scheduler isolation marked current; bootstrap, signed config, and mTLS remain explicit work |
| `docs/distributed/network-diagnostics.md` | `network-diagnostics.md` | Current confirmation separated from future rich diagnostic tasks |
| `docs/distributed/worker-to-worker-raft.md` | `critical-check-cluster.md` | Converted to package-specific ordered implementation and release gates |
| `docs/distributed/critical-check-amendments.md` | `critical-check-cluster.md` | No-leases, four-quorum, external-witness, and commit-before-notify rules made normative |
| `docs/distributed/worker-web-app.md` | `web-console-and-observability.md`, `inventory.md` | Existing console recognized; future OAuth/Compose/hardware scope split into staged work |

## Inventory And Host Documents

| Former RSMon document | Worker implementation document | Resolution |
| --- | --- | --- |
| `docs/inventory-management.md` | `inventory.md` | Control-plane projection retained as dependency; worker owns collection only |
| `docs/plans/inventory-management.md` | `inventory.md` | deploymentd and worker reports defined as source-aware complementary producers |
| `docs/parity/rstuff-inventory.md` | `inventory.md` | Historical only; RSMon owns inventory and RSLogin supplies project/access input |
| `docs/parity/deploymentd.md` | `inventory.md` | deploymentd parity becomes fixture normalization and comparison gate |
| `docs/deploymentd-replay-rollout.md` | `inventory.md` | HTTP nonce rollout remains deploymentd-specific; worker uses authenticated typed reports |
| `docs/integrations/rstuff-inventory-stream.md` | `inventory.md` | Superseded; no rstuff service is planned and Valkey is not the target inventory authority |
| `docs/plans/servers-and-hardware-metrics.md` | `web-console-and-observability.md`, `inventory.md` | Implemented server metric report retained; local hardware extensions staged |
| `docs/server-observability.md` | `web-console-and-observability.md`, `control-plane-protocol.md` | Current wire fields, ownership validation, and TSDB boundary retained |
| `docs/parity/capture.md` | `web-console-and-observability.md`, `implementation-roadmap.md` | Worker-host coverage gaps converted into staged collector work |

## Diagnostics, Policy, And Product Documents

| Former RSMon document | Worker implementation document | Resolution |
| --- | --- | --- |
| `docs/network-diagnostics.md` | `network-diagnostics.md` | Implemented confirmation/quarantine baseline retained |
| `docs/plans/network-diagnostics-partial.md` | `network-diagnostics.md` | Partial implementation folded into explicit rich-task phases |
| `docs/notification-task-delivery.md` | `tasks-and-notifications.md`, `control-plane-protocol.md` | Durable queue remains control-plane-owned; attempt execution remains worker-owned |
| `docs/notification-credentials.md` | `tasks-and-notifications.md`, `private-workers.md` | SMTP/Telegram current scope retained; webhook/Mattermost gaps explicit |
| `docs/billing-and-entitlements.md` | `private-workers.md`, `implementation-roadmap.md` | Entitlement remains a control-plane gate, never trusted from worker config |
| `docs/plans/public-checks.md` | `private-workers.md`, `implementation-roadmap.md` | Public tasks use a separate safe grant, not widened account access |
| `docs/plans/plans-and-billing.md` | `private-workers.md` | Plan eligibility remains control-plane policy |
| `docs/check-kinds.md` | `tasks-and-notifications.md` | Worker-supported executor list tied to `internal/checkexec` |
| `docs/plans/uptimerobot-parity.md` | `implementation-roadmap.md` | Worker-owned parity dependencies ordered by security prerequisites |
| `docs/plans/krasichka.md` | none | External Krasichka runtime is not a feature of this worker binary; only protocol compatibility applies |

## Operations And CI Documents

| Former RSMon document | New authority | Resolution |
| --- | --- | --- |
| `docs/local-processes.md` | root `README.md` | Standalone development commands replace monorepo process instructions |
| `docs/ci.md` | `.github/workflows/*.yml`, `implementation-roadmap.md` | Worker image build is owned by Gitea Actions here |
| `docs/CI_QUICKSTART.md` | root `README.md` | Standalone make, Docker, and Compose commands are authoritative |

## Resolved Conflicts

### Protocol

Old plans used `type: jobs/results`, separate notification siblings, and
version-string feature detection. Current code uses `kind`, explicit branches,
`task_envelope`, exact lease tokens, and explicit capabilities. The current
model is authoritative.

### Queue Ownership

Normal task ownership is PostgreSQL with `FOR UPDATE SKIP LOCKED`. Redis
Streams, RabbitMQ, and NATS are not worker dependencies. The critical path is
dispatchless Raft and cannot reuse normal leases.

### Credentials

SMTP and Telegram use scoped pushed credential lists. Webhook and Mattermost
are not yet equivalently persisted per account. SMS and voice are unsupported.
No document may claim universal per-account provider isolation before those
gaps close.

### Web Console

The console exists on port 27401 with Basic auth or local bcrypt. The former
draft's port 7401, OAuth-first behavior, and entirely unimplemented status are
obsolete. Collector lifecycle remains a real implementation gap.

### Inventory

deploymentd HTTP ingest is currently implemented on the control plane. Worker
inventory is local/partial and has no upstream report yet. RSMon is the target
inventory authority; RSLogin supplies trusted project and SSH-access input.
Future worker and deploymentd reports are complementary source-scoped inputs;
neither may erase the other's observations.

### Private Workers And Public Work

Private workers are account-restricted. Public cross-account checks require a
separate signed and SSRF-safe grant. Empty account scope continues to mean a
platform-operated worker and must never be customer-selectable.

### Raft Maturity

Membership, persistence, snapshots, transport, and placeholder FSM entries
exist. Production `distributed_critical` behavior does not. The control plane
is an external witness, never a voter; provider calls remain outside Raft.

## Maintenance

When a new RSMon plan adds worker behavior, update this ledger and one concrete
implementation document in the same change. Do not copy a planning draft into
this repository without reconciling it against current packages, wire types,
security boundaries, and tests.