session-sunset: no agent sandman-trigger + config-migrate on dev-pull

Context

Operator directive (@tobiu, 2026-06-06): "the /session-sunset skill needs an update => agents must not trigger sandman." The session-sunset skill currently mandates agents run the sandman (REM / Golden-Path) pipeline at sunset. This is the consumer-side complement to Epic #12065 (Orchestrator-as-SSOT for the REM/Sandman Pipeline): an agent triggering ai:run-sandman from the sunset skill is exactly the scattered trigger that SSOT direction exists to eliminate.

Live latest-open sweep: checked the latest 20 open issues + Epic #12065's 9 subs at filing time; no equivalent found. #12065 covers the pipeline execution-path consolidation (executeRemCycle / refreshGoldenPath / runSandman-thin-CLI), NOT the consumer-side session-sunset trigger removal — distinct, complementary work.

Meta-skill check (§1b): the change is a net-reduction in the references/ Atlas file (session-sunset-workflow.md), not the top-level SKILL.md router — adheres to Progressive Disclosure (no router bloat).

The Problem

.agents/skills/session-sunset/references/session-sunset-workflow.md Step 2 ("Refresh Active PR Cycle State") mandates that on scope: solo-refresh the agent MUST execute npm run ai:run-sandman (forcing GoldenPathSynthesizer to query GitHub + write sandman_handoff.md), and lets the lead-role agent run it "exceptionally" on scope: convergent when the daemon path is stale.

This is wrong-ownership. The REM/Golden-Path (sandman) pipeline is orchestrator-daemon-owned SSOT — the daemon's dream + golden-path periodic service-tasks (ai/daemons/TaskDefinitions.mjs) are already named, in the same Step 2, as "the canonical writer." Agents triggering the pipeline ad-hoc: (a) duplicate the daemon's work; (b) contend on the shared SQLite + Chroma substrate (≈45min serialization + last-write-wins overwrites when agents converge — already documented in the convergent branch); (c) couple a deployment-specific local command (ai:run-sandman queries GitHub directly) into the agent's sunset flow, which won't behave correctly outside the local/single-tenant context. The empirical anchor on #12065 is a live ai:run-sandman failure (graph corruption + provider rejection) — exactly what agents should not be triggering.

The Architectural Reality

• session-sunset-workflow.md:92 — solo-refresh MUST run ai:run-sandman.
• :94 — convergent SKIPs it but allows the lead-role exception; already names the orchestrator-daemon dream+golden-path tasks as the canonical writer.
• :96 — "overwritten by the canonical writer (daemon OR ai:run-sandman)" — the redundant "OR ai:run-sandman" clause.
• Daemon path: ai/daemons/TaskDefinitions.mjs periodic dream + golden-path tasks (the SSOT writer per Epic #12065).

The Fix

Rewrite Step 2 so agents NEVER trigger sandman:

• Remove the solo-refresh MUST run ai:run-sandman mandate.
• Remove the convergent lead-role MAY exceptionally run ai:run-sandman exception.
• State the daemon (dream+golden-path periodic tasks) is the sole writer of sandman_handoff.md.
• A stale sandman_handoff.md (mtime > 4h / daemon dead) is surfaced as a daemon-health issue (A2A / ticket), not compensated by an agent running the pipeline.
• Drop "OR ai:run-sandman" from :96.

Decision Record impact

none (no ADR). Aligned-with Epic #12065 (Orchestrator-as-SSOT for REM/Sandman) — the consumer-side complement.

Acceptance Criteria

• session-sunset-workflow.md Step 2 no longer instructs any agent (solo-refresh or convergent/lead) to run npm run ai:run-sandman.
• Step 2 names the orchestrator-daemon dream+golden-path tasks as the sole canonical writer of sandman_handoff.md.
• Step 2 routes a stale/missing handoff to a daemon-health escalation, not an agent-side pipeline trigger.
• The :96 "OR ai:run-sandman" clause is removed.
• Net loaded-bytes for the reference file is ≤ pre-change (Substrate Accretion Defense — a removal).
• The Step 10 add_memory "Sandman memory" persistence is preserved unchanged (it is agent memory persistence, NOT the pipeline trigger).

Out of Scope

• The pipeline execution-path consolidation (executeRemCycle / refreshGoldenPath / runSandman-thin-CLI) — Epic #12065's subs.
• The Step 10 add_memory "Sandman memory" (agent memory persistence).
• Any change to the daemon's dream/golden-path tasks themselves.

Related

• Epic #12065 — Orchestrator-as-SSOT for the REM (Sandman) Pipeline (consumer-side complement; @neo-opus-ada may adopt this as a sub).
• Discussion #12062 — origin of the REM/Sandman SSOT direction.

Origin Session ID: db066a97 Retrieval Hint: "session-sunset agents must not trigger sandman ai:run-sandman daemon SSOT"