The operator approved manual AutoCoder/AutoCoder-Engine chat during the existing global pause. No authorized reviewer exists; no reviewer approval gate was added. Autonomous implementation and other repository chat workers remain paused.
PR #6739 added a dedicated operator-chat worker scope for the canonical AutoCoder/AutoCoder-Engine repository and its four repository-chat task kinds. It retains normal Codex account, budget, model, and lease admission. It routes canonical AutoCoder chat through Codex App Server while other repository chat keeps the existing codex exec route. A worker claim for this scope cannot select unrelated queued work. PR #6740 fixed the shared chat-kind reference found by candidate test compilation. Candidate 0c79bdda0128d04c1a7fc43a7b8fb950f99523c8-3917-1 passed and production promotion run #3923 succeeded after configuration preparation.
Worker image publish run #3922 succeeded from matching main source. The production backend's AUTOCODER_WORKER_IMAGE is gitea.app.lan/autocoder/autocoder-engine@sha256:060932b720ca1b2826556fea4fb5a16b346432258cadd49269046c3fb01a4ab9.
PR #6742 changed only the production operator-chat flag to true. Candidate 1f927a5d777494ba0ea0d47202b70b5e826ad411-3925-1 passed and promotion run #3927 succeeded. The production backend and frontend are ready at source revision 1f927a5d777494ba0ea0d47202b70b5e826ad411.
The administrator rendered the exact source-backed immutable production configuration, verified the canonical instruction ConfigMap digest, created/verified the immutable environment and root ConfigMaps, then used a resourceVersion guarded Deployment metadata patch to prepare each contract without changing the running pod template. The first contract was 53350f8b55b70882e601a1bd6bfda8b447292fb85910b2c3983fe852a1a4dffa; the activated contract is d51d47e95d7a2a3bee434ae61ce570418e8fe089b1c886ddf445a52663e07cbc. The active environment map is autocoder-env-73534d35f4c8706f3bace172a16f8a56470ced286f1720e02c92028de6da1f86. Both promotions used the repository workflow.
Promotion run #3920 was canceled after it acquired Lease autocoder-engine/autocoder-database-migration; its exact holder was production-9035-3855f92b-8e2e-4afb-ae45-edc8009ee312. After confirming run 9035 had stopped and the Lease had not renewed, the administrator released only that holder with the repository lock script. The waiting run 9038 acquired the Lease and promotion #3923 succeeded.
The active environment map has AUTOCODER_OPERATOR_CHAT_WORKERS_ENABLED=true, AUTOCODER_BACKGROUND_AUTOMATION_ENABLED=false, AUTOCODER_IMPLEMENTATION_WORKERS_ENABLED=false, and AUTOCODER_REQUIREMENTS_AUTOMATION_ENABLED=false. Two operator-chat pods are Ready on drg-k8s-worker-01.auth.home.lan, both using image digest 060932b7... and task-kind scope autocoder-operator-chat; no general worker pods were present. Both operator worker leases were online and unexpired at inspection. The canonical AutoCoder chat queue had no old queued tasks before activation.
Live infrastructure and scope are verified. A fresh authenticated AutoCoder chat turn through the UI/API, its resumed second turn, and a normal-project chat turn have not yet been observed. Do not report that model-level behavior as verified until those user-facing paths produce evidence. Existing subscription account admission and protected reserves remain in force; no paid account or budget override was used.
Rollback is a source-managed change of AUTOCODER_OPERATOR_CHAT_WORKERS_ENABLED to false with candidate promotion, or an exact rollback to the earlier immutable configuration and image through the release workflow. When deselected, the reconciler drains operator chat pods, lets active turns finish, and removes them; the global autonomous pause remains.
After the lane was live, read-only inspection found the canonical AutoCoder chat session had zero messages but still held issue #8 in awaiting_answer with inquiry task chat-issue-inquiry-8-1787918911161122600. The send handler would treat a new chat message as a reply to that invisible question and return a conflict. The existing clear-chat method cleared messages but retained issue focus. No diagnostic model turn was sent into the shared conversation.
PR #6744 corrected the clear operation to reset focus with the transcript and added a narrow, idempotent migration for empty/awaiting-answer sessions. The earlier inquiry task and issue history remain. A restricted local snapshot of the one affected row was taken before deployment and removed after the migration was verified. Candidate 30b6480fc8a4ae552f7b2f6a91cd62e0b067463d-3930-1 passed; production promotion run #3932 succeeded. Production backend is Ready at source 30b6480fc8a4ae552f7b2f6a91cd62e0b067463d with the same immutable configuration contract d51d47e95d7a2a3bee434ae61ce570418e8fe089b1c886ddf445a52663e07cbc.
After rollout, the canonical session still has zero messages and all three focus fields are null. The former inquiry task remains completed. Operator-chat worker pods are Ready; autonomous pause values remain unchanged. A new actual chat turn through App Server and a normal-project exec turn are still missing behavioral evidence.
At the later production inspection, the backend remains Ready at source 30b6480fc8a4ae552f7b2f6a91cd62e0b067463d; three operator-chat pods are Ready. The repository chat task table has no new chat-kind tasks since lane activation, so neither an actual App Server turn nor a normal-project exec turn has been observed. Three online subscription account leases each advertise seven Codex models, but the shared AutoCoder chat session's saved account is marked pay as you go. The chat API can fall back from an unavailable requested account to that saved account. No diagnostic model turn was submitted into the shared session and no paid usage was initiated for this acceptance check. The goal remains active pending real turn evidence.
A short-lived, credential-free Codex App Server 0.156.1 process was started inside an operator-chat worker pod using the repository's autocoder-implementation profile. Its permissionProfile/list response marked the profile allowed, and thread/start with that profile, approvalPolicy=never, and task-local workspace roots succeeded. No turn/start request or model call was made, and the temporary profile/session files were removed. A thread/resume request for that empty thread returned no rollout found; because no turn had been run, this does not establish the behavior of resuming a completed conversation. Worker code has an explicit fallback to a fresh App Server thread using the persisted chat transcript if a prior rollout is absent from the next task's local Codex home. No real CodeCartography chat task has appeared after activation, so the user-facing route is still unverified.