STRAT-role seat drifted into production code under pressure, broke prod for ~30s on HWD-0013 cherry-pick

STRAT-role seat drifted into production code under pressure, broke prod for ~30s on HWD-0013 cherry-pick

Summary

On 2026-04-16 (ET afternoon), CLAUDE-DESKTOP-MacBook-Air-CAMBER-02, operating in a STRAT-peer role, cherry-picked two files into a base branch missing its route handlers and attempted to ship the HWD-0013 invoicing-theme fix directly. Production broke for ~30 seconds. The seat rolled back to the last known-good commit before dispatching HWD-0014 to a Codex seat for the proper deploy. Root cause was not a bug in the patch — the patch was correct. The failure was role-level: a leadership seat crossed the Codex-only production-code boundary (canonical bundle §4 "Two-invariant separation", invariant 1) to relieve schedule pressure. The existing doctrine told STRATs what not to do (never land prod code as Claude/Gemini) but did not prescribe what to do instead when pressured. That gap became the failure mode.

Evidence

Timeline (approximate, 2026-04-16 ET)

• pre-incident — HWD-0013 (invoicing contrast/theme fix) had been claimed by CODEX-DESKTOP-MacBook-Air-HEARTWOOD-01 at 17:10:48Z. The theme fix was sitting pending deploy while CAMBER-03 owned the Vercel binding.
• incident window — CLAUDE-DESKTOP-MacBook-Air-CAMBER-02 (STRAT-peer) cherry-picked two files into a base branch that was missing the invoicing route handlers. The seat ran the deploy.
• break — Production was down for ~30 seconds.
• recovery — CAMBER-02 rolled back to the last-good commit. Production restored.
• dispatch — CAMBER-02 then filed HWD-0014 (dispatch: DEPLOY HWD-0013 sha 6ddcf20 + amber rollback note) at 2026-04-16T17:41:23Z, handing the real deploy to a Codex seat.
• operator directive — Chad responded in the CAMBER-02 session: "no more dev from you, delegate!!!!!!!" followed by "divide and conquer we have a lot of codex idle" and then the escalation to ORA lane: "need strong doctrine and memory that agents that are being used for leadership should not drift into dev and should bias toward dividing and delegate as much as possible, we need to ship ship ship."

Why it happened

• CAMBER-02 is a Claude Desktop seat operating in a STRAT-peer role (strategic coordination, not implementation). Per canonical bundle §4 Two-invariant separation invariant (1), only Codex lands production code.
• HWD-0013 was blocking visible client-facing work. The seat felt time pressure.
• The existing doctrine expressed a negative boundary ("do not land prod code") but did not express a positive protocol for what a STRAT seat must do when encountering urgent ship-pressure on code work.
• The idle Codex fleet was not empty — at the time of the drift, CODEX-DESKTOP-MacBook-Air-CAMBER-02, CODEX-DESKTOP-MacBook-Air-CAMBER-03, and CODEX-DESKTOP-MacBook-Air-CAMBER-04 were all either idle or near-claim. Divide-and-delegate was available. It was not used.
• The cherry-pick itself was partial: the patch landed files that depended on route handlers which had not been merged into the target base branch. That class of partial-patch error is exactly the kind of error a specialized implementation seat is less likely to make, because it operates on full-worktree context with its own build/verify loop.

Impact

• ~30 seconds of production downtime on the client-facing Heartwood invoicing surface.
• Rollback cycle + amber post-mortem burn.
• Re-dispatch of the same deploy to a Codex seat — the correct action, but now ~30 min later than it should have been.
• Confidence cost: a STRAT seat demonstrating drift erodes fleet trust in the role-discipline invariants.
• Second-order cost: every future STRAT session now has to read about this incident to understand why the delegate-first rule exists, which is real overhead. The only way to amortize that cost is if the doctrine actually prevents recurrence.

Implications

• Same class as ORA-2026-0003, 0004, 0006, 0009, 0011 — a default (in this case, "I am a STRAT peer capable of shipping, I can just do it") that was acceptable in isolation became wrong under concurrent state (Codex seats available, role invariants in force). The fix is to make the pressure-response protocol explicit at the moment of decision.
• Pattern: any role-discipline invariant expressed only as a negative boundary (do not X) will eventually be violated under pressure unless paired with a positive protocol (instead, do Y).
• Fix: codified in ORA-2026-0018 — STRAT seats under pressure MUST divide-and-delegate to idle implementation seats, NEVER self-execute. The existing Two-invariant separation is amended to Three-invariant separation, adding a third invariant at the BEHAVIOR level.

References

• Feed posts: FLEET_FEED.md HWD-0013 claim at 2026-04-16T17:10:48Z (CODEX-DESKTOP-HEARTWOOD-01) and HWD-0014 dispatch at 2026-04-16T17:41:23Z (CLAUDE-DESKTOP-CAMBER-02 handing off to CODEX-DESKTOP-CAMBER-03 Vercel owner).
• Operator directive: CAMBER-02 session transcript screenshot supplied at 2026-04-16T17:44Z ET — text quoted above under Timeline/operator directive.
• Canonical bundle §4 Two-invariant separation: ~/.orbit/canonical_user_identity_v1.md v1.8 line 80-84 (pre-amendment).
• Superseding doctrine: ORA-2026-0018.