validate: bankbuddy pilot - retrofit on current Base with loop, MCP, and friction log #2592

Goal

Validate Base on an existing, already Base-managed project through the real workflow, and record every papercut.

Background

codeforester/bankbuddy is already Base-managed (base_manifest.yaml with uv, AGENTS.md, .ai-context/, issue-branch-policy and project-intake workflows), with about 36K words of Markdown and real open issues (#100, #86, #74, #44). Its last commit was 2026-07-29, so it has not been exercised against Base 1.10.x. It is a financial application, which makes data exposure through an agent loop or an index a first-order concern.

Next-release planning review of 2026-10-14/15 against main at 7faf6dfb. Tracking: #2555.

Prerequisites: #2561.

Scope

• Bring bankbuddy to current Base and confirm setup, check, doctor, and test pass.
• Run it as the project in matrix scenarios in addition to base-demo.
• Run at least two real bankbuddy issues through the loop at L1/L2 once available.
• Index its docs and answer at least ten bankbuddy questions measured like the test: documentation question eval set with token baselines #2585 set.
• Verify that statement files, personal data, and secrets never reach the index or the ledger.
• Record each papercut with the dogfood-friction label.

Acceptance Criteria

• bankbuddy passes check, doctor, and test on the current Base release.
• Two loop-driven PRs are merged, with evidence in the ledger.
• The index and ledger are demonstrated free of sensitive data.
• A friction summary links every filed issue.

Validation

basectl check bankbuddy && basectl doctor bankbuddy && basectl test bankbuddy

Plus matrix result JSON and the friction summary.

Non-Goals

• Do not move product features into Base to suit bankbuddy.
• Do not commit bankbuddy data to any Base repository.

Project Fields

• Status: Backlog
• Priority: P1
• Area: Product
• Initiative: Adoption Polish
• Size: S
• Milestone: v1.13.0
• Category: enhancement

Agent Assignment

Assignee: codeforester. Work spans Base and codeforester/bankbuddy; the maintainer drives project-side changes. Blocked on #2561 for matrix use.

Plan revision (2026-10-16)

Move this issue to v1.13.0. Prerequisites are #2561, #2580, #2581, #2588, #2590, #2599, #2601, and #2602. The two merged loop-driven PRs must be produced by the released/accepted controller path and have evidence accepted by #2601; a manually repaired Base state does not count. Keep the financial-data boundary explicit: use redacted fixtures, verify statement files/secrets/PII do not enter the index, ledger, prompts, or issue comments, and record any shortfall as a friction finding. This pilot is maintainer-owned reference evidence, not independent adoption evidence.