@liftleadershipgroup/lifty 0.1.0-next.0

package/README.md

@@ -0,0 +1,92 @@
+# LIFTY installer
+
+Installs the public `lifty-onboarding` skill for one supported agent at a time.
+
+```sh
+npx --yes @liftleadershipgroup/lifty@next init
+```
+
+Project scope is the default. Select an agent explicitly with `--agent cursor`,
+`--agent claude-code`, or `--agent codex`; use `--global` only when you intend to
+install into that agent's user-level skill directory.
+
+The package embeds and verifies its onboarding bundle. Installation itself
+performs no network, authentication, protected-tool, telemetry, or data-send
+operation. Run `lifty status`, `lifty update`, `lifty rollback`, or
+`lifty uninstall` with the same agent and scope flags to manage the
+installation.
+
+## Account commands
+
+Once the onboarding skill has written `<project>/.lifty/onboarding-draft.json`
+with `status: "ready_for_auth"`, five agent-independent commands take over. They
+accept no `--agent`, `--global`, `--dry-run`, or `--force` flag; `lifty push`
+accepts `--project-dir PATH`.
+
+```sh
+lifty login     # browser handoff, stores ~/.lifty/credentials.json (0600)
+lifty whoami    # prints the signed-in email and Supabase Auth host
+lifty push      # provisions the workspace from the local onboarding draft
+lifty connect hubspot # opens hosted OAuth and waits for portal connection
+lifty logout    # revokes the session best-effort and deletes the credentials
+```
+
+`lifty login` starts a listener on `127.0.0.1` with an OS-assigned port, opens
+`{LIFTY_APP_URL}/cli/auth?state=<nonce>&port=<port>`, and waits up to ten
+minutes for the hosted page to POST `{state, access_token, refresh_token,
+expires_at}` back to `/callback`. Callbacks whose `state` does not match the
+nonce are rejected with 403 and the CLI keeps waiting; exactly one valid
+callback is accepted. Set `LIFTY_NO_BROWSER=1`, or run where no browser can be
+spawned, and the URL is printed for manual use instead. Tokens travel only in
+the loopback POST body. They never appear in a URL, log line, or terminal output.
+
+`lifty push` refuses to send anything unless the draft is a real file (never a
+symlink), parses as a JSON object, and records `status: "ready_for_auth"`. It
+calls `POST {LIFTY_API_URL}/v1/workspaces` with the account's JWT, prints the
+returned workspace name, state, and draft digest, and leaves the draft file
+byte-for-byte untouched. `lifty status` reads
+`GET {LIFTY_API_URL}/v1/workspace`. Neither business request sends a Supabase
+API key; Supabase remains the auth provider only. Status never fails when the
+network or configuration is unavailable.
+
+`lifty connect hubspot` requires a provisioned workspace. It asks the hosted
+LIFTY API for a ten-minute, one-use connection URL, opens the DigitalOcean
+handoff in the browser, and polls secret-free connection status. The CLI
+accepts only an HTTPS URL on the configured API origin and prints only the
+connected HubSpot portal ID. HubSpot access and refresh tokens are exchanged,
+verified, encrypted, and rotated server-side; no founder environment variable
+or provider credential is required.
+
+Credentials live at `~/.lifty/credentials.json`, written atomically through a
+temporary file and rename, mode 0600 inside a 0700 directory. Access tokens are
+refreshed automatically when they are within sixty seconds of expiry; an
+unusable refresh token produces `Your session expired. Run lifty login again.`
+and nothing else.
+
+## Endpoint configuration
+
+No endpoint setup is required for the hosted LIFTY environment. The package
+embeds the DigitalOcean app/API ingress, Supabase project URL, and Supabase publishable key,
+so a registry install can proceed directly to `lifty login`.
+
+`LIFTY_APP_URL`, `LIFTY_API_URL`, `LIFTY_SUPABASE_URL`, and
+`LIFTY_SUPABASE_PUBLISHABLE_KEY` remain explicit overrides for local development
+and staged cutovers. The app URL hosts the browser handoff, the API URL handles
+workspace business operations, and the Supabase values are used only for
+account profile, token refresh, and logout. All three URLs must be HTTPS, except
+on loopback hosts. `LIFTY_SUPABASE_ANON_KEY` remains a compatibility alias.
+
+Each managed target has a private ownership receipt at
+`<agent-config-root>/.lifty-onboarding-owner.json`. It contains only installer
+identity, version, provenance, and one-way path digests. It never stores filesystem paths,
+onboarding data, or credentials. The receipt prevents another profile from
+force-claiming the same physical target and is removed when managed ownership
+ends.
+
+Lifecycle mutations coordinate through private, checksummed lease files in
+`<agent-config-root>/.lifty-onboarding.lock`. A lease records only a random
+token, process ID, user ID, and creation time. Locks whose owner process is
+demonstrably dead are recovered automatically; live locks remain busy. Corrupt
+or unverifiable lock metadata fails closed. If that happens, inspect the path
+reported by the error and remove it manually only after confirming that no
+LIFTY process is active.

package/bundle/manifest.json

@@ -0,0 +1,43 @@
+{
+  "schemaVersion": 1,
+  "packageVersion": "0.1.0-next.0",
+  "bundleVersion": "0.1.0-next.0",
+  "treeDigest": "ac1693c8f0f979fbea64b2581f251dea768249cd4475c27739fcc1d9360cfe48",
+  "rootMode": 493,
+  "directories": [
+    {
+      "path": "references",
+      "mode": 493
+    },
+    {
+      "path": "scripts",
+      "mode": 493
+    }
+  ],
+  "files": [
+    {
+      "path": "SKILL.md",
+      "mode": 420,
+      "size": 6412,
+      "sha256": "8bc20af7ab5c5166dfd33f9dabd5335154d9d316c184048e59a37b1b478252cc"
+    },
+    {
+      "path": "references/interview-contract.md",
+      "mode": 420,
+      "size": 4915,
+      "sha256": "5ea57a996a3a7f1c559cd074cc1a45b7ff0909df19647b66e493516cb9004091"
+    },
+    {
+      "path": "references/onboarding-draft.schema.json",
+      "mode": 420,
+      "size": 8022,
+      "sha256": "e6e584a4d8c9189d6032d9ab94ed2139eb3d18ff5a8cf8274e90b3a1650ac9a9"
+    },
+    {
+      "path": "scripts/write-onboarding-draft.mjs",
+      "mode": 493,
+      "size": 19114,
+      "sha256": "368535d1f798af1246d7dd15593be91aee7fe77f402429eaa83a932c8d6d638c"
+    }
+  ]
+}

package/bundle/skill/SKILL.md

@@ -0,0 +1,127 @@
+---
+name: lifty-onboarding
+description: Use when a founder has installed LIFTY and wants to define one primary outbound motion, authenticate, provision the hosted workspace, and optionally connect HubSpot.
+---
+
+# LIFTY founder onboarding
+
+Build one founder-confirmed targeting draft, save it privately in the active
+project, complete the hosted browser handoff, and provision one LIFTY workspace.
+
+## Boundary and completion
+
+This flow may research public company information, interview the founder, run
+the installed LIFTY CLI's hosted login, and submit the validated local draft to
+the LIFTY API, and—when the founder asks for it—launch the CLI's reviewed
+HubSpot OAuth handoff. It never asks for or prints tokens, manually installs
+provider apps, launches lead research, activates outreach, or sends anything.
+Configure one primary motion; record every secondary motion as parked.
+
+Completion means exactly:
+
+- `<active-project>/.lifty/onboarding-draft.json` exists with status
+  `ready_for_auth` and remains byte-for-byte local after submission;
+- the local writer has validated the draft and privacy controls;
+- hosted browser authentication has returned successfully to the CLI; and
+- `lifty push` has returned workspace state `ready_for_connections`.
+
+When HubSpot connection was part of the founder's request, completion also
+requires `lifty connect hubspot` to report the secret-free portal ID as
+connected. OAuth credentials remain backend-only.
+
+Read [the interview contract](references/interview-contract.md) in full before
+starting. Use [the draft schema](references/onboarding-draft.schema.json) as the
+only output shape.
+
+## Workflow
+
+1. Identify the active project and the founder's company/domain. If either is
+   ambiguous, ask one clarifying question.
+2. Before interview questions, research public sources: the company website
+   and relevant subpages, public founder/company profiles, case studies,
+   reviews, hiring pages, and reputable news. Degrade gracefully when a source
+   is unavailable.
+3. Present a short research playback that opens with what could not be learned.
+   Label every researched value `inferred`. An inference cannot enter the
+   confirmed configuration until the founder explicitly confirms or corrects
+   it.
+4. Interview one question at a time. Wait for the answer before asking the
+   next question. Reject adjective-only sizing; require a numeric floor and
+   the founder's unit. When two operating states are bundled, separate them
+   and ask which is the priority. Capture the founder's CTA.
+5. When an answer changes, say what changed. The newest statement replaces the
+   older value; never average or merge contradictions.
+6. Run negative playback throughout: name what is excluded, weak, unknown, or
+   still inferred and ask the founder to correct it.
+7. Before writing, verify all eight hard gates in the interview contract,
+   workspace-specific Decision Maker/Influencer tells, one-rule boundary
+   cases, CTA, one primary motion, and parked secondary motions. Continue the
+   one-question loop if anything is missing.
+8. Build the JSON defined by the schema. Pass it to the bundled writer over
+   process stdin; do not embed draft content in command text, shell history,
+   logs, or telemetry:
+
+   ```text
+   node <skill-root>/scripts/write-onboarding-draft.mjs \
+     --project-dir <active-project> --input -
+   ```
+
+9. After a successful write, tell the founder that the draft is private and
+   local and that LIFTY will now open the hosted authentication page. Resolve
+   the persisted CLI as `<active-project>/.lifty/bin/lifty.mjs`; refuse to use
+   it if it is missing, not a real file, or resolves outside the active
+   project's `.lifty` directory.
+10. Run the browser handoff and wait for its result:
+
+    ```text
+    node <active-project>/.lifty/bin/lifty.mjs login
+    ```
+
+    The founder may need to sign up or sign in and approve the local CLI. Never
+    ask them to paste a token or callback payload. If they deny, close the page,
+    or the CLI times out, preserve the draft and tell them to rerun login.
+11. Only after login succeeds, submit the draft through the hosted REST API:
+
+    ```text
+    node <active-project>/.lifty/bin/lifty.mjs push \
+      --project-dir <active-project>
+    ```
+
+    Report only the CLI's secret-free workspace name, state, and draft digest.
+    Confirm that the returned state is `ready_for_connections`; otherwise stop
+    and report the CLI error without attempting provider setup or lead work.
+12. Tell the founder that the workspace is provisioned, the local draft was
+    left untouched, and outreach remains off. If HubSpot connection was part
+    of their request, run the persisted CLI's hosted OAuth flow:
+
+    ```text
+    node <active-project>/.lifty/bin/lifty.mjs connect hubspot
+    ```
+
+    The CLI owns the short-lived connection URL, opens it in the browser, and
+    waits for secret-free status. The founder approves the reviewed LIFTY app
+    in HubSpot; never ask for a client ID, client secret, authorization code,
+    access token, or refresh token. Report only the portal ID and connected
+    status returned by the CLI. If HubSpot was not requested, describe this as
+    the next explicit command and do not run it.
+13. Stop after provisioning or the requested HubSpot connection. Do not launch
+    lead work or outreach.
+
+## Hard stops
+
+- Do not accept "mid-market", "enterprise", or another adjective as size.
+- Do not promote public research because it seems credible. Founder
+  confirmation is the boundary.
+- Do not invent an exclusion or tooling policy. Ask for the founder's explicit
+  judgment; an empty exclusion set is incomplete.
+- Do not configure two motions. Park the secondary motion in the draft.
+- Do not hand-write the destination file. The bundled writer owns validation,
+  symlink refusal, atomic replacement, mode `0600`, and `.lifty/.gitignore`.
+- Do not ask for, paste, echo, log, or summarize access tokens, refresh tokens,
+  callback payloads, Supabase keys, or provider credentials.
+- Do not run `push` before the writer succeeds and hosted login returns
+  successfully.
+- Do not manually install provider apps or invent provider authorization URLs.
+  The only allowed provider handoff is the persisted CLI's `connect hubspot`
+  command after a workspace exists and HubSpot was requested.
+- Do not launch lead work, enable outreach, or send anything.

package/bundle/skill/references/interview-contract.md

@@ -0,0 +1,104 @@
+# Founder interview contract
+
+Use this sequence conversationally. Ask exactly one question, wait for the
+answer, then choose the next question or follow-up. Confirmed research may skip
+the corresponding question; founder-only judgments never skip.
+
+## Public research playback
+
+Research first. Draft possible answers for the description, named customer or
+look-alike examples, industries, geography, structural signals, and persona
+titles. Each stays `inferred` until explicit founder confirmation.
+When confirmed research enters the configuration, `field` is its dotted output
+path and `value` exactly matches the value stored there. Corrected research
+records the corrected value, never the stale inference.
+
+Open playback with the negatives: what was unavailable, ambiguous, excluded,
+or weak. Ask the founder to correct one item at a time. Do not infer numeric
+bounds, exclusions, Decision Maker/Influencer roles or tells, tooling judgment,
+boundary decisions, voice bans, sender intent, or CTA.
+
+## Interview sequence
+
+### 1. What the company sells
+
+1. Confirm a standalone description a smart outsider can understand. Reject
+   unexplained category jargon.
+2. Get three named example companies that represent the intended ICP. They may
+   be best customers or founder-confirmed look-alikes.
+3. Ask what buyers use instead today.
+
+If the founder answers with an abstraction, recover in this order: verticals;
+why those; pain; how the company solves it; three named examples. If the
+founder does not know, derive a hypothesis from their best examples and ask
+them to confirm or correct it. Keep it inferred until they do.
+
+### 2. The company that buys
+
+1. Ask what was operationally true about the best-fit company that made it
+   need the offer. The final structural signal must be publicly observable.
+2. If the answer bundles different states, split them—for example,
+   founder-solo versus has-reps—and ask which closes faster or is the primary
+   fit. Record the priority; do not silently combine them.
+3. Ask industries in and adjacent industries out. Empty exclusions are not a
+   completed judgment.
+4. Force size to numbers: minimum, unit, and—when the founder knows it—a
+   ceiling. Probe one notch below the minimum: customer or mistake?
+5. Ask for a look-alike company that appears right but must be excluded and
+   the hard, observable tell. Capture at least one disqualifier.
+6. Ask whether existing or competitor tooling is a positive signal, a
+   disqualifier, or mixed. Record the founder's rationale; never create a
+   policy for them.
+
+### 3. The person who buys
+
+1. Ask who champions a good deal and who makes the decision.
+2. For each persona, capture whether that person is a `decision_maker` or
+   `influencer` for this specific motion and the organizational tell that
+   proves it. Titles alone do not decide the role.
+3. Capture at least three first-contact titles for one persona. Ask which
+   similar titles waste time and who actually replies at the target size.
+
+### 4. Signals and boundary cases
+
+Ask what public evidence makes an account timely and what separates the best
+ten from fifty plausible accounts. Translate private judgments into observable
+proxies and confirm the translation.
+
+Create two or three cases from the founder's hard rules. Each case changes
+exactly one hard rule while holding all others constant. Ask for `A`, `B`, or
+`pass` and one-line reasoning. Record any refinement as a new statement; the
+newest statement replaces the old one.
+
+### 5. Voice and motion
+
+1. Ask what outreach the founder deletes instantly. Capture at least one
+   forbidden move and the positive voice adjectives they want protected.
+2. Ask whose voice the writing represents and how that sender asks for a
+   meeting. Capture an explicit CTA.
+3. Confirm one primary motion. Name each secondary motion, mark it `parked`,
+   and do not interview or configure it further.
+
+## Negative close
+
+Play back the complete configuration in founder language. Start with what is
+out, weak, unknown, parked, or still inferred. Invite corrections one at a
+time. If a correction contradicts an earlier answer, announce the replacement
+and retain the sequence in `founder_statement_history`; never average.
+
+## Eight hard gates
+
+Keep interviewing until every item exists:
+
+1. Standalone company description without unexplained jargon.
+2. Three named example companies matching the ICP.
+3. Numeric size floor plus the founder's unit.
+4. At least one hard disqualifier.
+5. At least one publicly observable structural buy signal.
+6. At least one persona with three or more titles.
+7. Explicit founder judgment of tooling as signal, disqualifier, or mixed.
+8. At least one tone forbidden move.
+
+The JSON writer also requires industries in/out, persona roles and tells,
+voice adjectives, sender intent, CTA, negative playback, and one-rule boundary
+cases before it will produce `ready_for_auth`.

package/bundle/skill/references/onboarding-draft.schema.json

@@ -0,0 +1,266 @@
+{
+  "title": "LIFTY pre-authentication onboarding draft",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "status",
+    "company",
+    "primary_motion",
+    "parked_secondary_motions",
+    "icp",
+    "personas",
+    "voice",
+    "boundary_cases",
+    "negative_playback",
+    "research_findings",
+    "founder_statement_history"
+  ],
+  "properties": {
+    "schema_version": {"const": "1.0"},
+    "status": {"const": "ready_for_auth"},
+    "company": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "description", "example_companies"],
+      "properties": {
+        "name": {"type": "string", "minLength": 1},
+        "description": {"type": "string", "minLength": 20},
+        "example_companies": {
+          "type": "array",
+          "minItems": 3,
+          "uniqueItems": true,
+          "items": {"type": "string", "minLength": 1}
+        }
+      }
+    },
+    "primary_motion": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "outcome"],
+      "properties": {
+        "name": {"type": "string", "minLength": 1},
+        "outcome": {"type": "string", "minLength": 1}
+      }
+    },
+    "parked_secondary_motions": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "status"],
+        "properties": {
+          "name": {"type": "string", "minLength": 1},
+          "status": {"const": "parked"}
+        }
+      }
+    },
+    "icp": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "industries_in",
+        "industries_out",
+        "size",
+        "hard_disqualifiers",
+        "structural_buy_signals",
+        "tooling_judgment",
+        "operating_state_split"
+      ],
+      "properties": {
+        "industries_in": {
+          "type": "array",
+          "minItems": 1,
+          "items": {"type": "string", "minLength": 1}
+        },
+        "industries_out": {
+          "type": "array",
+          "minItems": 1,
+          "items": {"type": "string", "minLength": 1}
+        },
+        "size": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["floor", "ceiling", "unit"],
+          "properties": {
+            "floor": {"type": "number", "exclusiveMinimum": 0},
+            "ceiling": {"type": ["number", "null"], "exclusiveMinimum": 0},
+            "unit": {"type": "string", "minLength": 1}
+          }
+        },
+        "hard_disqualifiers": {
+          "type": "array",
+          "minItems": 1,
+          "items": {"type": "string", "minLength": 1}
+        },
+        "structural_buy_signals": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["signal", "observable_via"],
+            "properties": {
+              "signal": {"type": "string", "minLength": 1},
+              "observable_via": {"type": "string", "minLength": 1}
+            }
+          }
+        },
+        "tooling_judgment": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["classification", "rationale"],
+          "properties": {
+            "classification": {
+              "enum": ["signal", "disqualifier", "mixed"]
+            },
+            "rationale": {"type": "string", "minLength": 1}
+          }
+        },
+        "operating_state_split": {
+          "type": ["object", "null"],
+          "additionalProperties": false,
+          "required": ["states", "priority"],
+          "properties": {
+            "states": {
+              "type": "array",
+              "minItems": 2,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["name", "fit"],
+                "properties": {
+                  "name": {"type": "string", "minLength": 1},
+                  "fit": {"type": "string", "minLength": 1}
+                }
+              }
+            },
+            "priority": {"type": "string", "minLength": 1}
+          }
+        }
+      }
+    },
+    "personas": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "role", "titles", "tell"],
+        "properties": {
+          "name": {"type": "string", "minLength": 1},
+          "role": {"enum": ["decision_maker", "influencer"]},
+          "titles": {
+            "type": "array",
+            "minItems": 3,
+            "uniqueItems": true,
+            "items": {"type": "string", "minLength": 1}
+          },
+          "tell": {"type": "string", "minLength": 1}
+        }
+      }
+    },
+    "voice": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["adjectives", "forbidden_moves", "sender_intent", "cta"],
+      "properties": {
+        "adjectives": {
+          "type": "array",
+          "minItems": 1,
+          "items": {"type": "string", "minLength": 1}
+        },
+        "forbidden_moves": {
+          "type": "array",
+          "minItems": 1,
+          "items": {"type": "string", "minLength": 1}
+        },
+        "sender_intent": {"type": "string", "minLength": 1},
+        "cta": {"type": "string", "minLength": 1}
+      }
+    },
+    "boundary_cases": {
+      "type": "array",
+      "minItems": 2,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "rule_under_test",
+          "all_other_hard_rules_held",
+          "scenario",
+          "decision",
+          "reason"
+        ],
+        "properties": {
+          "rule_under_test": {"type": "string", "minLength": 1},
+          "all_other_hard_rules_held": {"const": true},
+          "scenario": {"type": "string", "minLength": 1},
+          "decision": {"enum": ["A", "B", "pass"]},
+          "reason": {"type": "string", "minLength": 1}
+        }
+      }
+    },
+    "negative_playback": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["omission_or_weak_signal", "founder_response", "result"],
+        "properties": {
+          "omission_or_weak_signal": {"type": "string", "minLength": 1},
+          "founder_response": {"type": "string", "minLength": 1},
+          "result": {"type": "string", "minLength": 1}
+        }
+      }
+    },
+    "research_findings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "field",
+          "value",
+          "source",
+          "state",
+          "used_in_configuration",
+          "founder_confirmation"
+        ],
+        "properties": {
+          "field": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Dotted path to the real configured output field when used_in_configuration is true."
+          },
+          "value": {
+            "description": "Must deep-equal the configured field resolved from field when used_in_configuration is true."
+          },
+          "source": {"type": "string", "minLength": 1},
+          "state": {
+            "enum": ["inferred", "founder_confirmed", "founder_corrected"]
+          },
+          "used_in_configuration": {
+            "type": "boolean",
+            "description": "True only after founder confirmation or correction and exact placement at field."
+          },
+          "founder_confirmation": {"type": ["string", "null"]}
+        }
+      }
+    },
+    "founder_statement_history": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["sequence", "field", "value"],
+        "properties": {
+          "sequence": {"type": "integer", "minimum": 1},
+          "field": {"type": "string", "minLength": 1},
+          "value": {}
+        }
+      }
+    }
+  }
+}