quest: adopt kix on moq-dev's repositories first

quest/README.md

@@ -7,11 +7,12 @@ versioned Markdown, with a standalone CLI and a reversible adoption path.
 
 ## Plan
 
-`m0` is the first public release; `m1` holds later work. Add `m2` and later
-horizons when concrete work warrants them, keeping milestone numbers stable as
-earlier milestones complete.
+`m0` is adoption on moq-dev's own repositories, `m1` the public release,
+and `m2` later work. Add later horizons when concrete work warrants them,
+keeping milestone numbers stable as earlier milestones complete.
 
 ## Required
 
-- [M0: First public release](/quest/m0/README.md) - install, set up, work, and leave, driven from one pinned binary, paired with the Kix decision UI and your own runners
-- [M1: Later work](/quest/m1/README.md) - cloud runners, a native mobile app, shared runners, and donated reviews and CI
+- [M0: moq-dev adoption](/quest/m0/README.md) - kix at quest.moq.dev, used daily on moq-dev/moq, moq-dev/quest, and moq-dev/moq.pro, beside the standalone CLI
+- [M1: Public release](/quest/m1/README.md) - kix.quest open to any maintainer, with onboarding, contributor sandboxing, the themed site, and launch material
+- [M2: Later work](/quest/m2/README.md) - cloud runners, a native mobile app, shared runners, and donated reviews and CI

quest/m0/README.md

@@ -1,23 +1,49 @@
-# First public release
+# moq-dev adoption
 
 ## Goal
 
-Ship Quest v0.1.0. A developer using Claude Code or Codex with GitHub pastes one
-line into their agent to set Quest up in any repository, plans and runs agent
-work through quests, and can remove it without losing their own content.
-It runs on macOS, Linux, and native Windows.
+moq-dev plans and runs its own work through Quest and kix:
+moq-dev/moq, moq-dev/quest, and moq-dev/moq.pro are enrolled at
+`https://quest.moq.dev`, maintainers answer decisions from a phone-friendly
+web app with push notifications, and their own Linux and macOS runners do
+the work through Claude Code and opencode inside each project's Nix
+devShell. The GitHub App bot publishes ordinary PRs. The standalone CLI
+(v0.1.0 shipped on 2026-10-07) keeps serving the same repositories locally on
+macOS, Linux, and native Windows.
 
-The hosted launch is kix.quest, a cloud for creating software: maintainers
-answer interactive prompts, from a phone-friendly web app with push
-notifications, to plan issues, start ready quests, and act on new PRs. Their
-own Linux and macOS runners do the work through Claude Code and opencode,
-with any number of signed-in accounts, inside each project's Nix devShell.
-The GitHub App bot publishes ordinary PRs. The contest no longer gates launch.
-The standalone v0.1.0 CLI shipped on 2026-10-07; remaining work expands the
-product without changing the core's independence.
+Work that only third-party repositories need, and the public launch, belong
+to [m1](/quest/m1/README.md).
 
 ## Plan
 
+Decided 2026-10-30 (user, /quest-plan), replacing "First public release":
+
+- Should m0 serve moq-dev's repositories before third parties?
+  - ✅ Yes: m0 is adoption on moq-dev/moq, moq-dev/quest, and moq-dev/moq.pro;
+    a new m1 holds the public release, and the old m1 became m2
+  - Fold third-party work into the existing later milestone
+
+  No resources go into a public service before it works for moq-dev.
+- Where does the Worker live until the public launch?
+  - ✅ quest.moq.dev
+  - kix.moq.dev
+
+  [Open kix.quest](/quest/m1/open.md) moves it for the launch.
+- Which kix work leaves m0? ✅ Onboarding (pick repositories, setup PR,
+  guide), ✅ the public face (theme, landing page, launch material), ✅
+  contributor sandboxing (untrusted-head VM, stock-Ubuntu AppArmor, macOS
+  verification), and ✅ the enrollment-time read-only CI check. Head approval
+  and opencode sandboxing stay, since moq-dev's own jobs need them.
+- moq-dev/moq comes first, then private repositories so moq.pro can enroll.
+- Where does Kix rank in m0? Decided 2026-11-01 (user, /quest-complete):
+  - ✅ Land work first (the host gate, the land fixer and the land quests),
+    then Kix, then the rest of m0
+  - Kix first
+  - Kix below the review quests
+
+  The land work is what moq-dev's repositories use every day, and the
+  maintainer ranked it first in the 2026-10-30 and 2026-11-01 sessions.
+
 Decided while planning m0 (2026-09-26), replacing the earlier copied-files and
 ownership-manifest design:
 
@@ -46,10 +72,10 @@ ownership-manifest design:
 - [GitHub retries](/quest/m0/github-retry.md) - one 5xx or dropped connection no longer fails a command or land step
 - [Current conflict reports](/quest/m0/land-conflicts-refresh.md) - a queued PR's conflict report updates when the queue ahead of it changes
 - [Land checks at gate priority](/quest/m0/land-priority-sandbox.md) - `quest land serve` passes `QUEST_GATE_PRIORITY` to its sandbox
+- [Kix decision UI](/quest/m0/kix/README.md) - planning and implementation through prompts and summaries, run on the maintainer's own runners
 - [Codex cloud off](/quest/m0/codex-cloud-off.md) - automatic Codex cloud reviews stop once no open PR relies on them
 - [Review handles expired and environment logins](/quest/m0/review-login.md) - `quest review` says to log in again instead of failing with a 401, and reviews with credentials from the environment
 - [Live sandbox test](/quest/m0/review-sandbox.md) - the real reviewer CLIs run nothing a reviewed head plants
-- [Kix decision UI](/quest/m0/kix/README.md) - planning and implementation through prompts and summaries, run on the maintainer's own runners
 - [Agent test environment](/quest/m0/agent-test-env.md) - `just test` passes inside agent sessions
 - [Stale skill stubs](/quest/m0/init-prune.md) - `quest init` and `quest uninstall` remove stubs of retired skills such as `quest-ready`
 - [Bun EFAULT report](/quest/m0/bun-efault.md) - condition: Bun fixes concurrent `rmSync` on Windows; report it, then drop the workaround
@@ -58,6 +84,4 @@ ownership-manifest design:
 - [Gate admission on CI](/quest/m0/gate-ci-admission.md) - gated commands admit on loaded hosted runners like arm64 macOS
 - [Agent lifecycle integration](/quest/m0/worktree-agents.md) - reclaim completed and suspended Claude checkouts through its hooks
 - [Agent workflow helpers](/quest/m0/helpers/README.md) - CLI commands for CI waits, PR status, claims, quest moves, and serialized merges
-- [Quest log theme](/quest/m0/theme/README.md) - an MMO-style identity, copy, board, landing page, and CLI output for the demo and launch
-- [Launch material](/quest/m0/launch.md) - README, quickstart, demo, comparison, and launch-post drafts
 - [Review harness check](/quest/m0/review-harness.md) - recurring each milestone: newest pinned review models, and the live sandbox test passes

quest/m0/kix/README.md

@@ -2,7 +2,8 @@
 
 ## Goal
 
-kix.quest is a cloud for creating software. Maintainers make decisions in a
+kix is a cloud for creating software, served at `https://quest.moq.dev`
+for moq-dev's repositories in m0. Maintainers make decisions in a
 phone-friendly web app with push notifications, while kix routes the work to
 any runner they own, using whatever agent accounts they connect. CLIs and
 providers stay hidden behind summaries and prompts.
@@ -27,6 +28,12 @@ live rehearsal on the operator's runner.
 
 ## Plan
 
+Decided 2026-10-30 (user, /quest-plan): m0 serves moq-dev/moq, then
+moq-dev/quest, then the private moq-dev/moq.pro, at quest.moq.dev with only
+moq-dev allowed to enroll. Onboarding, read-only CI checks, contributor
+sandboxing, and the guide moved to [m1](/quest/m1/kix/README.md), and
+kix.quest opens in [m1](/quest/m1/open.md).
+
 Decided on 2026-10-15 through the decisions-not-implementations interview,
 superseding the 2026-10-13 hosted-first, Claude-SDK-only, and
 operator-paid-hosting decisions:
@@ -36,12 +43,12 @@ operator-paid-hosting decisions:
   the whole default UI. Raw agent output is collapsed behind a per-job
   disclosure that only current maintainers can expand.
 - **Phone first.** m0 ships an installable PWA with Web Push for decision
-  items. A [native mobile app](/quest/m1/mobile-app.md) follows in m1.
+  items. A [native mobile app](/quest/m2/mobile-app.md) follows in m2.
 - **Your own runners first.** `quest runner` turns any Linux or macOS machine
   into a runner. It claims jobs over HTTPS and drives the official CLIs with
   that machine's own logins, so kix never holds provider tokens. There are no
-  Windows runners. Free, capped [cloud runners](/quest/m1/cloud/README.md)
-  and API-key or donor funding follow in m1, with paid compute later.
+  Windows runners. Free, capped [cloud runners](/quest/m2/cloud/README.md)
+  and API-key or donor funding follow in m2, with paid compute later.
 - **Abstract the CLIs.** A runner adapter interface hides each CLI: start or
   resume, structured questions, checkpoint summaries, and results. Claude
   Code covers Claude subscriptions; opencode covers OpenCode Go, ChatGPT
@@ -56,7 +63,7 @@ operator-paid-hosting decisions:
   shell, with no other way to install dependencies, for cache efficiency and
   reproducibility. The runner pins the agent CLIs through Nix as well.
   Runners keep a persistent local store and honor the flake's substituters;
-  a [shared cache](/quest/m1/automation/cache.md) follows in m1.
+  a [shared cache](/quest/m2/automation/cache.md) follows in m2.
 - **Sandboxed jobs.** Every job's commands run in an OS sandbox. PR heads
   with non-maintainer commits route to Linux runners, which build the PR's
   devShell in a VM first; macOS runners take trusted revisions only. Cloud
@@ -126,14 +133,12 @@ fixes what it finds:
 
 ## Required
 
-- [Deploy kix.quest](/quest/m0/kix/deploy.md) - the operator registers the App and deploys the Worker with GitHub sign-in at kix.quest
+- [Deploy quest.moq.dev](/quest/m0/kix/deploy.md) - the operator registers the App and deploys the Worker with GitHub sign-in at quest.moq.dev
 - [Upstream branches](/quest/m0/kix/upstream-branches.md) - jobs publish on the enrolled repository itself, with no service forks
-- [Read-only CI](/quest/m0/kix/ci-read-only.md) - enrolled repositories keep pull-request CI read-only, checked at enrollment, with every trust boundary written down
-- [Operator setup](/quest/m0/kix/operator-setup.md) - pilot installations and a verified test PR on moq-dev/quest and moq-dev/moq
-- [Pick repositories](/quest/m0/kix/pick-repos.md) - after installing, the maintainer enables repositories from a list
-- [Setup PR](/quest/m0/kix/setup-pr.md) - enrolling a repository without Quest makes the App open its `quest init` pull request
-- [Job sandbox](/quest/m0/kix/sandbox/README.md) - untrusted PR devShells built in a VM on Linux runners, maintainer PR heads trusted, opencode sandboxed, and macOS verified
+- [Owner allowlist](/quest/m0/kix/owners.md) - only moq-dev may enroll until the public release
+- [Operator setup](/quest/m0/kix/operator-setup.md) - pilot installations and a verified test PR on moq-dev/moq and moq-dev/quest
+- [Private repositories](/quest/m0/kix/private.md) - moq-dev/moq.pro enrolls, visible only to signed-in users who can read it
+- [Job sandbox](/quest/m0/kix/sandbox/README.md) - head approval for kix-pushed heads, and opencode sandboxed
 - [Web execution](/quest/m0/kix/execution.md) - spawn and iterate through the UI, ending in contribution PRs
 - [Land review](/quest/m0/kix/land-review.md) - kix lands only heads with a review that counts on that exact head
-- [Onboarding guide](/quest/m0/kix/guide.md) - a complete maintainer path, from runner setup through a reviewed PR
 - [Fast runner continuation test](/quest/m0/kix/runner-timeout.md) - the conflicted-continuation test passes on a loaded host without a longer timeout

quest/m0/kix/deploy.md

@@ -1,20 +1,29 @@
-# [S] Deploy the Worker to kix.quest
+# [S] Deploy the Worker to quest.moq.dev
 
 ## Goal
 
-An operator registers the GitHub App and deploys `main` to `https://kix.quest`
-with GitHub sign-in pointed at it. The condition clears when
-`https://kix.quest/health` returns `{"status":"ok"}`, `https://kix.quest/setup`
-redirects to `SETUP.md`, a browser sign-in and sign-out on kix.quest succeed,
-and the App's ping to `https://kix.quest/webhooks/github` shows a successful
-delivery. Follow the Deployment section of `cloudflare/README.md` and steps 1,
-2 and 4 of `cloudflare/GITHUB.md`; delete this quest once verified.
+The Worker's checked-in origin is `https://quest.moq.dev`, and an operator
+registers the GitHub App and deploys `main` there with GitHub sign-in pointed
+at it. The condition clears when `https://quest.moq.dev/health` returns
+`{"status":"ok"}`, `https://quest.moq.dev/setup` redirects to `SETUP.md`, a
+browser sign-in and sign-out succeed, and the App's ping to
+`https://quest.moq.dev/webhooks/github` shows a successful delivery. Follow
+the Deployment section of `cloudflare/README.md` and steps 1, 2 and 4 of
+`cloudflare/GITHUB.md`; delete this quest once verified.
 
 ## Plan
 
+- ✅ Decided 2026-10-30 (user, /quest-plan): host at quest.moq.dev, not
+  kix.quest, until [the public release](/quest/m1/open.md), so nothing public
+  is launched before it works for moq-dev. Change the origin in
+  `cloudflare/wrangler.jsonc` (route and `AUTH_URL`),
+  `cloudflare/worker-configuration.d.ts`,
+  `cloudflare/github-app-manifest.json`, `quest runner`'s `DEFAULT_URL`
+  (`src/runner/cli.ts`) and its examples, and the docs that name kix.quest as
+  the live origin. The product keeps the kix name.
 - ✅ Decided 2026-10-14: deprecate kixel.quest without redirects or legacy
-  auth handling, because nobody uses it. kix.quest is the only site and
-  authentication origin. Remove the Worker's kixel.quest custom domain when
+  auth handling, because nobody uses it. quest.moq.dev is the only site and
+  authentication origin (amended 2026-10-30, was kix.quest). Remove the Worker's kixel.quest custom domain when
   deploying; the checked-in config no longer lists it.
 - Merging to `main` does not deploy: no workflow runs Wrangler, and
   deployment is a manual `bun run deploy` from `cloudflare/`.
@@ -31,11 +40,13 @@ delivery. Follow the Deployment section of `cloudflare/README.md` and steps 1,
   adds to the README's Deployment section, and confirm the rule with
   `bun run wrangler r2 bucket lifecycle list quest-output`. Until then,
   `main` has no R2 binding and needs no bucket. Decided 2026-10-18.
-- Add the `kix.quest` zone to the Worker's Cloudflare account. Keep the
+- Serve the Worker on `quest.moq.dev` from the `moq.dev` zone, which
+  already hosts `token.moq.dev`; if that zone sits in another Cloudflare
+  account, say which in `cloudflare/README.md`. Keep the
   Worker name, D1 database ID, and `AUTH_SECRET`; do not create a new
   production database.
-- Set the production GitHub App's homepage to `https://kix.quest` and
-  its callback to `https://kix.quest/api/auth/callback/github`.
+- Set the production GitHub App's homepage to `https://quest.moq.dev` and
+  its callback to `https://quest.moq.dev/api/auth/callback/github`.
 - The deploy deletes the legacy `RepositoryCoordinator` Durable Object and
   any storage it held, approved 2026-10-14 since nothing is stored. Afterwards
   remove its `exports` tombstone from `cloudflare/wrangler.jsonc`.

quest/m0/kix/execution.md

@@ -2,7 +2,7 @@
 
 ## Goal
 
-A maintainer starts ready work through kix.quest, follows it through agent
+A maintainer starts ready work through kix, follows it through agent
 summaries, answers its questions, and receives a normal contribution PR. New
 PR notifications present useful next actions, including explicitly
 requested iteration, in the same decision UI.
@@ -68,4 +68,4 @@ Earlier guidance:
 
 ## Required
 
-- [Job sandbox](/quest/m0/kix/sandbox/README.md) - safe iteration on PRs with contributors' commits
+- [Job sandbox](/quest/m0/kix/sandbox/README.md) - iterate and merge jobs on approved kix-pushed heads, with opencode sandboxed

quest/m0/kix/land-review.md

@@ -46,4 +46,4 @@ Decided 2026-10-28 (user, /quest-plan of the follow-ups from
 ## Related
 
 - [Web execution](/quest/m0/kix/execution.md) - merge jobs this rule gates
-- [Require read-only pull-request CI](/quest/m0/kix/ci-read-only.md) - the trust model this completes
+- [Require read-only pull-request CI](/quest/m1/kix/ci-read-only.md) - the trust model this completes

quest/m0/kix/operator-setup.md

@@ -3,15 +3,17 @@
 ## Goal
 
 The operator installs the registered GitHub App on the pilot repositories,
-moq-dev/quest and moq-dev/moq, and enrolls them. A real issue event and a
+moq-dev/moq and moq-dev/quest, and enrolls them on quest.moq.dev. A real issue event and a
 bounded test PR verify the integration before contributors are invited.
 
 ## Plan
 
 - This is an operator/setup outcome. App registration and its secrets belong
-  to [Deploy kix.quest](/quest/m0/kix/deploy.md), because every deploy needs them.
+  to [Deploy quest.moq.dev](/quest/m0/kix/deploy.md), because every deploy needs them.
 - Pilot repositories decided 2026-10-27 (user): moq-dev/quest and
-  moq-dev/moq, ranked first so kix.quest is usable on moq-dev/moq soonest.
+  moq-dev/moq, ranked first so kix is usable on moq-dev/moq soonest.
+  Decided 2026-10-30 (user): start with moq-dev/moq; the private
+  moq-dev/moq.pro follows in [Private repositories](/quest/m0/kix/private.md).
   Service forks were dropped the same day for
   [upstream branches](/quest/m0/kix/upstream-branches.md), so there is no
   fork namespace to set up.
@@ -40,5 +42,6 @@ bounded test PR verify the integration before contributors are invited.
 
 ## Required
 
-- [Deploy kix.quest](/quest/m0/kix/deploy.md) - the live origin and registered App
+- [Deploy quest.moq.dev](/quest/m0/kix/deploy.md) - the live origin and registered App
+- [Owner allowlist](/quest/m0/kix/owners.md) - only moq-dev can enroll before contributors are invited
 - [Upstream branches](/quest/m0/kix/upstream-branches.md) - jobs publish on the pilot repositories themselves

quest/m0/kix/owners.md

@@ -0,0 +1,29 @@
+# [S] Allow only moq-dev to enroll
+
+## Goal
+
+Until the public release, only repositories whose owner is on an operator
+allowlist can be enrolled on quest.moq.dev. Anyone else who signs in or
+installs the App sees that kix isn't open yet, instead of an enrollment form,
+and no job, webhook, or board runs for their repositories. The deployed
+allowlist is `moq-dev`.
+
+## Plan
+
+Decided 2026-10-30 (user, /quest-plan): don't spend resources on a public
+service before it works for moq-dev's own repositories.
+
+- Who may enroll before the launch?
+  - ✅ Only moq-dev
+  - Anyone, with the host simply not advertised
+
+- A Worker variable such as `ENROLL_OWNERS` in `cloudflare/wrangler.jsonc`
+  holds a comma-separated list of GitHub owner IDs, with each owner's login
+  in a comment beside it. Enrollment checks the repository owner's ID
+  beside its existing checks; webhooks from other owners' installations are
+  acknowledged and dropped. The local dev seed's owners are listed in dev.
+- Store IDs, not logins resolved at read time: GitHub frees a deleted or
+  renamed account's login for anyone to claim, so a name lookup could
+  admit a different account.
+- [Open kix.quest](/quest/m1/open.md) removes the allowlist for the launch.
+- Test enrollment and a webhook for a listed and an unlisted owner.