plan: shadow-env-self-host

[yihanzhu]

Tracks #263

High-risk plan for the merged spec (G2, PR #268). Frontmatter records spec-blob bb4993f44fd0d56e84d54dab33c5758bfa12bce7 (main's current work/shadow-env-self-host/spec.md). This PR changes only work/shadow-env-self-host/plan.md; the operator merging it accepts the plan. Implementation follows on ystack/impl/shadow-env-self-host from updated main. It does not close the intake issue.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	c7d7c63
Status:	✅  Deploy successful!
Preview URL:	https://4fd21203.fabrica-6yx.pages.dev
Branch Preview URL:	https://ystack-plan-shadow-env-self.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: d241ea9
Reviewed-base: 1095ca4
reviewer: gpt-5.5 @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/277-59671/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The plan introduces an unsatisfiable proof requirement, so a later implementation cannot comply with the repository's proof rules while following the plan as written.

Review comment:

• [P2] Make the ordering proof achievable — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.OHZoreyVwM/work/shadow-env-self-host/plan.md:316-318
  With the current work order, Step 0 runs before anything else and the regression cases are not added until Step 3, so this proof bullet asks the implementer to paste failures “before step 0” and before Step 1/2 edits that cannot be produced by following the plan. Since the repo requires implementers to run and paste the checks the plan names (AGENTS.md:410-411), either move the test additions ahead of the fixes or change this proof to an achievable comparison.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: c7d7c63
Reviewed-base: 1095ca4
reviewer: gpt-5.5 @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/277-65933/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The plan is hash-linked to the accepted spec, touches only the high-risk plan artifact, and its implementation steps/proof align with the stated requirements. I found no discrete blocking issues in the changed file.