@oneie/claude 0.4.0 → 0.6.0

package/scripts/cc-connect.sh

@@ -7,6 +7,7 @@
 # default to your "default" group; pass --to / <group> to address another.
 #
 # Subcommands:
+#   auth <key>                         save ONE_API_KEY to ~/.cc-connect/.auth.conf
 #   init <sender> [group]              first-time setup
 #   join <group>                       subscribe + start its listener
 #   leave <group>                      stop listener + unsubscribe
@@ -14,7 +15,7 @@
 #   stop [group]                       kill one listener (or all if no arg)
 #   status                             show config + listener state per group
 #   listeners                          list all running listener PIDs
-#   groups                             ask claw what groups exist (discovery)
+#   groups                             ask channels what groups exist (discovery)
 #   send [--to <group>] <text>         send to default (or specific) group
 #   read [<group>]                     show new messages since last read (one group)
 #   read --all                         merge new across every subscribed group
@@ -24,7 +25,9 @@
 
 set -e
 
-CLAW_URL="${CLAW_URL:-https://claw.oneie.workers.dev}"
+CHANNELS_URL="${CHANNELS_URL:-https://channels.one.ie}"
+ONE_API_URL="${ONE_API_URL:-https://one.ie}"
+ONE_API_KEY="${ONE_API_KEY:-}"
 if ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" && [ -n "$ROOT" ] && [ -d "$ROOT/.cc-connect" ]; then
   DIR="$ROOT/.cc-connect"
 else
@@ -34,6 +37,33 @@ CFG="$DIR/config.json"
 
 mkdir -p "$DIR"
 
+# notify.sh lives beside this script — used for the optional Telegram push from the
+# always-on daemon listener (listen-fg, gated by CC_TG_NOTIFY).
+SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
+NOTIFY_SH="$SELF_DIR/notify.sh"
+
+# Auth: prefer --config <file> (token stays off ps aux) over bare --header CLI arg.
+# If .auth.conf exists use it directly; else fall back to ONE_API_KEY from env.
+if [ -f "$DIR/.auth.conf" ]; then
+  CURL_AUTH="--config $DIR/.auth.conf"
+  # Also populate ONE_API_KEY so the space:post JSON path still works
+  if [ -z "$ONE_API_KEY" ]; then
+    ONE_API_KEY=$(grep '^header = "Authorization: Bearer ' "$DIR/.auth.conf" 2>/dev/null \
+      | sed 's/header = "Authorization: Bearer \(.*\)"/\1/' | head -1)
+  fi
+elif [ -n "$ONE_API_KEY" ]; then
+  # Token off argv (ps aux would leak a bare --header value) — write a private,
+  # session-scoped curl config instead. Not persisted to .auth.conf: that file is
+  # only ever written by the explicit `auth` subcommand.
+  AUTH_TMP="$(mktemp "${TMPDIR:-/tmp}/cc-connect-auth.XXXXXX")"
+  chmod 600 "$AUTH_TMP"
+  printf 'header = "Authorization: Bearer %s"\n' "$ONE_API_KEY" > "$AUTH_TMP"
+  trap 'rm -f "$AUTH_TMP"' EXIT
+  CURL_AUTH="--config $AUTH_TMP"
+else
+  CURL_AUTH=""
+fi
+
 # ─── config helpers ─────────────────────────────────────────────────────────
 
 cfg_read() {
@@ -76,12 +106,106 @@ listener_pid_file() { /bin/echo "$DIR/$1.pid"; }
 listener_jsonl()    { /bin/echo "$DIR/$1.jsonl"; }
 listener_offset()   { /bin/echo "$DIR/$1.offset"; }
 
+# Shared dedup store — last 2000 signal IDs across all groups (gap 4).
+_SEEN="$DIR/.seen"
+_seen_check() {
+  local id="$1"
+  [ -z "$id" ] && return 1  # no id → can't dedup, allow through
+  [ -f "$_SEEN" ] && /usr/bin/grep -qF "$id" "$_SEEN" && return 0  # already seen
+  /bin/echo "$id" >> "$_SEEN"
+  # Keep the file bounded — trim to last 2000 lines in-place
+  if [ "$(/usr/bin/wc -l < "$_SEEN" 2>/dev/null | /usr/bin/tr -d ' ')" -gt 2000 ]; then
+    /usr/bin/tail -n 2000 "$_SEEN" > "$_SEEN.tmp" && /bin/mv "$_SEEN.tmp" "$_SEEN"
+  fi
+  return 1  # not seen before
+}
+
 listener_running() {
   local pidf
   pidf=$(listener_pid_file "$1")
   [ -f "$pidf" ] && kill -0 "$(/bin/cat "$pidf" 2>/dev/null)" 2>/dev/null
 }
 
+# The SSE read loop for one group. Blocking — callers either background it
+# (listener_start) or run it in the foreground under launchd (listen-fg).
+# Writes each signal to the group jsonl, fires a macOS notification, and — when
+# CC_TG_NOTIFY is set (the always-on daemon) — pushes a Telegram alert via
+# notify.sh, skipping our own and bot/system senders so Tony isn't pinged by his
+# own posts or automated replies.
+_listener_loop() {
+  local group="$1" jsonl="$2" last_ts_file="$3"
+  while true; do
+    last_ts=$(/bin/cat "$last_ts_file" 2>/dev/null || /bin/echo 0)
+    [ -z "$last_ts" ] && last_ts=0
+    curl -N -sS --max-time 90 \
+      --header "Last-Event-ID: $last_ts" \
+      ${CURL_AUTH:+$CURL_AUTH} \
+      "$CHANNELS_URL/stream/$group?since=$last_ts" 2>/dev/null \
+    | while IFS= read -r line; do
+        case "$line" in
+          "data: "*)
+            payload="${line#data: }"
+            # Gap 4: dedup by signalId — skip if we've seen this signal before
+            sig_id=$(/bin/echo "$payload" | jq -r '.id // .signalId // empty' 2>/dev/null)
+            if _seen_check "$sig_id"; then continue; fi
+            /bin/echo "$payload" >> "$jsonl"
+            # Gap 6: heartbeat — record last activity time for watchdog
+            /bin/date +%s > "$DIR/$group.heartbeat" 2>/dev/null || true
+            new_ts=$(/bin/echo "$payload" | jq -r '.ts // empty' 2>/dev/null)
+            [ -n "$new_ts" ] && /bin/echo "$new_ts" > "$last_ts_file"
+            sender=$(/bin/echo "$payload" | jq -r '.sender // empty' 2>/dev/null | tr -cd 'A-Za-z0-9 _.:@-')
+            # Strip ALL shell-/AppleScript-special chars; no quotes, backslashes, dollars, or backticks.
+            snippet=$(/bin/echo "$payload" | jq -r '.content // empty' 2>/dev/null | /usr/bin/cut -c1-220 | tr -cd 'A-Za-z0-9 _.:@/=,.!? ')
+            # Smart priority from the content — louder for things that need Tony now.
+            prio="🔵"
+            case " $(/bin/echo "$snippet" | tr 'A-Z' 'a-z') " in
+              *urgent*|*asap*|*emergency*|*blocker*|*" p1"*|*" down"*|*"right now"*|*"need you"*|*approve*|*broken*) prio="🔴" ;;
+              *"?"*) prio="🟡" ;;
+            esac
+            # Reply surface per channel: vespio/oo land in the workspace inbox; all are cc-connect-replyable.
+            case "$group" in
+              space:*) inbox="one.ie/u/${group#space:}/in" ;;
+              *) inbox="" ;;
+            esac
+            # Pass notification content via env vars — never via osascript -e string interpolation.
+            # terminal-notifier (brew install terminal-notifier) opens the inbox on click.
+            # Falls back to display notification (opens Script Editor — less useful).
+            if [ -n "$sender" ]; then
+              _inbox_url="${inbox:+https://$inbox}"
+              if command -v terminal-notifier &>/dev/null; then
+                terminal-notifier \
+                  -title "$prio $group · $sender" \
+                  -message "$snippet" \
+                  ${_inbox_url:+-open "$_inbox_url"} \
+                  -sound default 2>/dev/null || true
+              else
+                CC_SNIPPET="$snippet" CC_TITLE="$prio $group · $sender" CC_SUBTITLE="${_inbox_url:-reply: cc-connect send --to $group}" \
+                osascript <<'APPLESCRIPT' 2>/dev/null || true
+on run
+  set t to system attribute "CC_TITLE"
+  set s to system attribute "CC_SNIPPET"
+  set u to system attribute "CC_SUBTITLE"
+  display notification s with title t subtitle u
+end run
+APPLESCRIPT
+              fi
+            fi
+            # Telegram push (always-on daemon only). Skip our own + bot/system senders. Smart + actionable.
+            if [ -n "${CC_TG_NOTIFY:-}" ] && [ -n "$sender" ]; then
+              case "$sender" in
+                tony|Tony|claude-code|onedotbot|assistant|workflow|system) : ;;
+                *) "$NOTIFY_SH" --to tony "$prio $group · $sender
+$snippet
+↳ reply: cc-connect send --to $group \"…\"${inbox:+  ·  $inbox}" >/dev/null 2>&1 || true ;;
+              esac
+            fi
+            ;;
+        esac
+      done
+    sleep 1
+  done
+}
+
 listener_start() {
   local group="$1"
   local pidf jsonl last_ts_file
@@ -103,30 +227,54 @@ listener_start() {
       || /bin/echo 0 > "$last_ts_file"
   fi
   (
-    while true; do
-      last_ts=$(/bin/cat "$last_ts_file" 2>/dev/null || /bin/echo 0)
-      [ -z "$last_ts" ] && last_ts=0
-      curl -N -sS --max-time 90 \
-        --header "Last-Event-ID: $last_ts" \
-        "$CLAW_URL/stream/$group?since=$last_ts" 2>/dev/null \
-      | while IFS= read -r line; do
-          case "$line" in
-            "data: "*)
-              payload="${line#data: }"
-              /bin/echo "$payload" >> "$jsonl"
-              new_ts=$(/bin/echo "$payload" | jq -r '.ts // empty' 2>/dev/null)
-              [ -n "$new_ts" ] && /bin/echo "$new_ts" > "$last_ts_file"
-              sender=$(/bin/echo "$payload" | jq -r '.sender // empty' 2>/dev/null)
-              snippet=$(/bin/echo "$payload" | jq -r '.content // empty' 2>/dev/null | /usr/bin/cut -c1-80)
-              [ -n "$sender" ] && osascript -e "display notification \"$snippet\" with title \"cc-connect · $group\" subtitle \"$sender\"" 2>/dev/null || true
-              ;;
-          esac
-        done
-      sleep 1
+    _listener_loop "$group" "$jsonl" "$last_ts_file"
+  ) > /dev/null 2>&1 &
+  listener_pid=$!
+  /bin/echo $listener_pid > "$pidf"
+  # Gap 6: watchdog — restarts the listener if no SSE data received for 120s
+  (
+    while kill -0 $listener_pid 2>/dev/null; do
+      sleep 30
+      hb_file="$DIR/$group.heartbeat"
+      if [ -f "$hb_file" ]; then
+        last=$(/bin/cat "$hb_file" 2>/dev/null)
+        now=$(/bin/date +%s)
+        age=$(( now - last ))
+        if [ "$age" -gt 120 ]; then
+          # Stale — kill so the outer while-true in _listener_loop reconnects
+          pkill -P $listener_pid 2>/dev/null || true
+          /bin/date +%s > "$hb_file"
+        fi
+      fi
     done
   ) > /dev/null 2>&1 &
-  /bin/echo $! > "$pidf"
-  /bin/echo "  + $group listening (pid=$(/bin/cat "$pidf"))"
+  /bin/echo "  + $group listening (pid=$listener_pid)"
+}
+
+# Foreground listener for launchd supervision (always-on daemon). Takes ownership
+# of the group (kills any stale/session listener), writes its own pidfile so
+# interactive sessions see it as live and don't double-listen, then blocks.
+listen_fg() {
+  local group="$1"
+  local pidf jsonl last_ts_file oldpid
+  pidf=$(listener_pid_file "$group")
+  jsonl=$(listener_jsonl "$group")
+  last_ts_file="$DIR/$group.last_ts"
+  oldpid=$(/bin/cat "$pidf" 2>/dev/null || true)
+  if [ -n "$oldpid" ] && [ "$oldpid" != "$$" ] && kill -0 "$oldpid" 2>/dev/null; then
+    pkill -P "$oldpid" 2>/dev/null || true
+    kill "$oldpid" 2>/dev/null || true
+  fi
+  /usr/bin/touch "$jsonl"
+  [ -f "$(listener_offset "$group")" ] || /bin/echo 0 > "$(listener_offset "$group")"
+  if [ ! -f "$last_ts_file" ]; then
+    /usr/bin/tail -n 1 "$jsonl" 2>/dev/null | jq -r '.ts // 0' 2>/dev/null > "$last_ts_file" \
+      || /bin/echo 0 > "$last_ts_file"
+  fi
+  /bin/echo $$ > "$pidf"
+  trap '/bin/rm -f "'"$pidf"'"' EXIT
+  /bin/echo "listen-fg $group (pid=$$, tg_notify=${CC_TG_NOTIFY:-0})"
+  _listener_loop "$group" "$jsonl" "$last_ts_file"
 }
 
 listener_stop() {
@@ -206,6 +354,11 @@ case "$cmd" in
     done < <(cfg_groups)
     ;;
 
+  listen-fg)
+    g="${1:?usage: cc-connect listen-fg <group>}"
+    listen_fg "$g"
+    ;;
+
   stop)
     g="${1:-}"
     if [ -n "$g" ]; then
@@ -248,16 +401,19 @@ case "$cmd" in
     ;;
 
   groups)
-    /bin/echo "claw says:"
-    curl -s "$CLAW_URL/groups" -m 5 \
+    /bin/echo "channels says:"
+    curl -s "$CHANNELS_URL/groups" -m 5 \
+      ${CURL_AUTH:+$CURL_AUTH} \
       | jq -r '.groups[] | "  \(.id)  msgs=\(.message_count)  last=\(.last_sender // "—"): \((.last_content // "")[0:60])"' \
-      || /bin/echo "  (could not reach claw)"
+      || /bin/echo "  (could not reach channels)"
     /bin/echo "you are subscribed to:"
     cfg_groups | /usr/bin/sed 's/^/  /'
     ;;
 
   send)
-    # send [--to <group>] <text...>  (--group is an alias for --to; flag can appear anywhere)
+    # send [--to <space>] <text...>  (--group is an alias for --to; flag can appear anywhere)
+    # C6: routes through space:post so messages are mirrored to the workspace inbox.
+    # Set ONE_API_URL + ONE_API_KEY to authenticate; falls back to direct channels signal.
     target="$DEFAULT"
     args=()
     while [ $# -gt 0 ]; do
@@ -274,10 +430,21 @@ case "$cmd" in
     done
     text="${args[*]}"
     [ -z "$text" ] && { /bin/echo "error  usage: cc-connect send [--to <group>] <text>"; exit 1; }
-    body=$(jq -n --arg s "$SENDER" --arg c "$text" '{sender: $s, content: $c}')
-    resp=$(curl -s -X POST "$CLAW_URL/signal/$target" \
-      -H 'Content-Type: application/json' \
-      -d "$body")
+    if [ -n "$ONE_API_KEY" ]; then
+      # space:post adds "space:" prefix — strip it from the target if already present
+      space_name="${target#space:}"
+      body=$(jq -n --arg sp "$space_name" --arg c "$text" '{data: {space: $sp, content: $c}}')
+      resp=$(curl -s -X POST "${ONE_API_URL}/api/ask/space:post" \
+        -H 'Content-Type: application/json' \
+        ${CURL_AUTH:+$CURL_AUTH} \
+        -d "$body")
+    else
+      body=$(jq -n --arg s "$SENDER" --arg c "$text" '{sender: $s, content: $c}')
+      resp=$(curl -s -X POST "$CHANNELS_URL/signal/$target" \
+        -H 'Content-Type: application/json' \
+        ${CURL_AUTH:+$CURL_AUTH} \
+        -d "$body")
+    fi
     /bin/echo "ok  →$target  $resp"
     ;;
 
@@ -338,8 +505,69 @@ case "$cmd" in
     fi
     ;;
 
+  auth)
+    # Save ONE_API_KEY to .auth.conf so the script auto-authenticates without env vars.
+    key="${1:?usage: cc-connect auth <one-... key>}"
+    # Write with tight permissions from the start (no TOCTOU window)
+    old_umask=$(umask)
+    umask 177
+    /bin/echo "header = \"Authorization: Bearer $key\"" > "$DIR/.auth.conf"
+    umask "$old_umask"
+    ONE_API_KEY="$key"
+    /bin/echo "ok  key saved to $DIR/.auth.conf"
+    ;;
+
+  broadcast)
+    # broadcast [--to g1,g2,...] <text>  — fan-out to all subscribed space:* groups (or listed ones).
+    # Uses space:post (same auth path as send) for space:* targets when ONE_API_KEY is set.
+    targets=""
+    args=()
+    while [ $# -gt 0 ]; do
+      case "$1" in
+        --to)
+          targets="${2:?usage: cc-connect broadcast --to g1,g2 <text>}"
+          shift 2
+          ;;
+        *)
+          args+=("$1")
+          shift
+          ;;
+      esac
+    done
+    text="${args[*]}"
+    [ -z "$text" ] && { /bin/echo "error  usage: cc-connect broadcast [--to g1,g2] <text>"; exit 1; }
+    if [ -z "$targets" ]; then
+      # Default: all space:* groups only (skip raw peer groups like "newco" or "donal")
+      targets=$(cfg_groups | /usr/bin/grep '^space:' | /usr/bin/tr '\n' ',')
+    fi
+    IFS=',' read -ra gs <<< "$targets"
+    ok_count=0
+    for g in "${gs[@]}"; do
+      g="${g// /}"
+      [ -z "$g" ] && continue
+      if [ -n "$ONE_API_KEY" ] && [[ "$g" == space:* ]]; then
+        space_name="${g#space:}"
+        body=$(jq -n --arg sp "$space_name" --arg c "$text" '{data: {space: $sp, content: $c}}')
+        resp=$(curl -s -X POST "${ONE_API_URL}/api/ask/space:post" \
+          -H 'Content-Type: application/json' \
+          ${CURL_AUTH:+$CURL_AUTH} \
+          -d "$body" 2>/dev/null)
+      else
+        body=$(jq -n --arg s "$SENDER" --arg c "$text" '{sender: $s, content: $c}')
+        resp=$(curl -s -X POST "$CHANNELS_URL/signal/$g" \
+          -H 'Content-Type: application/json' \
+          ${CURL_AUTH:+$CURL_AUTH} \
+          -d "$body" 2>/dev/null)
+      fi
+      sig=$(/bin/echo "$resp" | jq -r '.result.id // .id // "err"' 2>/dev/null)
+      /bin/echo "  → $g  $sig"
+      ok_count=$((ok_count + 1))
+    done
+    /bin/echo "ok  broadcast to $ok_count space(s)"
+    ;;
+
   *)
-    /bin/echo "usage: cc-connect {init|join|leave|listen|stop|status|listeners|groups|send|read}"
+    /bin/echo "usage: cc-connect {init|join|leave|listen|listen-fg|stop|status|listeners|groups|send|broadcast|read|auth}"
     exit 1
     ;;
 esac

package/scripts/cc-events-proof.sh

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# cc-events-proof.sh — the code-signals promise's proof: — text/code-signals.md
+#
+# Proves both wires deliver, not just accept: registers a throwaway listener distinct
+# from the CC engine's own identity (fanOut never delivers to its own sender — see
+# tag-match.ts), fires one authenticated session signal (wire 1) and one bridged
+# tasks:announce batch (wire 3), and asserts each response is ok:true with matched>=1.
+#
+# Exit 0  — session wire matched, AND task wire matched (or explicitly skipped: empty
+#           local queue is not a failure, see text/code-signals-plan.md pre-mortem).
+# Exit 1  — a wire ran and did not match.
+# Exit 2  — GATEWAY_API_KEY unresolved (named reason, not a generic non-zero).
+#
+# Env: ONE_API_URL (default http://localhost:4321), DO_ENV_FILE (override secret file),
+#      CC_PROOF_SLUG (default cc-proof-listener — the throwaway subscriber identity).
+#
+# Port-collision self-heal: :4321 is Astro's own default, so an unrelated sibling app
+# (e.g. apps/one/site) can already be squatting on it in a shared dev machine — its 404
+# HTML then breaks every jq parse below with a blank ok=, not a wrong-answer. If
+# ONE_API_URL is unset and nothing at :4321 answers /api/health as one.ie/web, this
+# script starts its own one.ie/web on an ephemeral port for the proof's lifetime and
+# tears it down on exit. An explicit ONE_API_URL is trusted as-is (fails loudly instead,
+# see below) — the auto-start only ever fills in the unset default.
+set -u
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+# shellcheck source=/dev/null
+source "$ROOT/.claude/hooks/lib/signal.sh"
+
+command -v jq >/dev/null 2>&1 || { echo "[cc-events-proof] jq required"; exit 2; }
+
+PROOF_SLUG="${CC_PROOF_SLUG:-cc-proof-listener}"
+API_URL="${ONE_API_URL:-http://localhost:4321}"
+
+_is_one_web() {
+  jq -e '.status == "ok"' >/dev/null 2>&1 <<<"$(curl -sS --max-time 3 "$1/api/health" 2>/dev/null)"
+}
+
+SELF_STARTED_PID=""
+if ! _is_one_web "$API_URL"; then
+  if [ -n "${ONE_API_URL:-}" ]; then
+    echo "[cc-events-proof] FAIL — ONE_API_URL=$API_URL did not answer /api/health as one.ie/web"
+    exit 2
+  fi
+  echo "[cc-events-proof] :4321 isn't one.ie/web (port occupied by another app, or nothing's listening) — starting one.ie/web on an ephemeral port for this proof"
+  DEV_PORT="$(python3 -c 'import socket; s=socket.socket(); s.bind(("",0)); print(s.getsockname()[1]); s.close()')"
+  ( cd "$ROOT/one.ie/web" && exec ./node_modules/.bin/astro dev --port "$DEV_PORT" ) >/tmp/cc-events-proof-web.log 2>&1 &
+  SELF_STARTED_PID=$!
+  API_URL="http://localhost:$DEV_PORT"
+  for _ in $(seq 1 30); do
+    _is_one_web "$API_URL" && break
+    sleep 1
+  done
+  if ! _is_one_web "$API_URL"; then
+    echo "[cc-events-proof] FAIL — could not start one.ie/web for the proof (see /tmp/cc-events-proof-web.log)"
+    kill "$SELF_STARTED_PID" 2>/dev/null
+    exit 2
+  fi
+  # do-tasks-bridge.py (wire 3, invoked below) reads this same env var independently —
+  # without exporting it here it would still default to the wrong :4321.
+  export ONE_API_URL="$API_URL"
+fi
+
+API_KEY="$(_one_secret GATEWAY_API_KEY)"
+if [ -z "$API_KEY" ]; then
+  echo "[cc-events-proof] GATEWAY_API_KEY not found — checked shell env and $(_one_env_file)"
+  [ -n "$SELF_STARTED_PID" ] && kill "$SELF_STARTED_PID" 2>/dev/null
+  exit 2
+fi
+
+# Token off argv (ps aux would leak a bare -H value) — one private 0600 curl
+# --config file for the process lifetime.
+AUTHCFG="$(mktemp)"; chmod 600 "$AUTHCFG"
+printf 'header = "Authorization: Bearer %s"\n' "$API_KEY" >"$AUTHCFG"
+cleanup() {
+  rm -f "$AUTHCFG"
+  [ -n "$SELF_STARTED_PID" ] && kill "$SELF_STARTED_PID" 2>/dev/null
+}
+trap cleanup EXIT
+
+# ── wire 2 setup — register the throwaway listener ──────────────────────────
+# Cookie: signed_out=1 opts out of local dev's DEV_SLUG bypass (middleware.ts), which
+# would otherwise resolve EVERY caller to the same identity and make the subscriber
+# self-exclude (fanOut never delivers to its own sender). No effect in prod, where
+# DEV_SLUG doesn't exist.
+register_resp="$(curl -sS --max-time 5 -X POST "$API_URL/api/ask/subscriptions:register" \
+  -H 'Content-Type: application/json' --config "$AUTHCFG" \
+  -H 'Cookie: signed_out=1' \
+  -d "$(jq -nc --arg slug "$PROOF_SLUG" '{data:{receiver:"world:announce",tags:["cc","session"],board:"marketplace",slug:$slug}}')")"
+register_ok="$(printf '%s' "$register_resp" | jq -r '.result.ok // false' 2>/dev/null)"
+echo "[cc-events-proof] register listener=$PROOF_SLUG ok=$register_ok"
+if [ "$register_ok" != "true" ]; then
+  echo "[cc-events-proof] FAIL — could not register the standing listener: $register_resp"
+  exit 1
+fi
+
+# ── wire 1 — one authenticated session signal, through the SAME nomination path ──
+# emit_world itself is fire-and-forget and (locally) never needs to nominate — local
+# dev's DEV_SLUG=one bypass resolves ctx.ownerSlug to "one" for ANY request regardless
+# of auth headers, so routing this through emit_world unmodified would pass even with a
+# missing/wrong key and prove nothing about authentication. Cookie: signed_out=1 (same
+# trick as the register step above) opts OUT of that bypass, forcing ctx.ownerSlug to
+# come from the service-caller nomination this feature actually wires — the real path
+# prod always takes (no DEV_SLUG there). This is what "session signals authenticate"
+# in the promise means, and the only way to prove it locally.
+session_payload="$(jq -nc '{tags:["cc","session"],slug:"one",board:"marketplace"}')"
+session_resp="$(curl -sS --max-time 5 -X POST "$API_URL/api/ask/world:announce" \
+  -H 'Content-Type: application/json' --config "$AUTHCFG" \
+  -H 'Cookie: signed_out=1' -d "{\"data\":$session_payload}")"
+session_ok="$(printf '%s' "$session_resp" | jq -r '.result.ok // false' 2>/dev/null)"
+session_matched="$(printf '%s' "$session_resp" | jq -r '.result.matched // 0' 2>/dev/null)"
+echo "[cc-events-proof] wire1 session ok=$session_ok matched=$session_matched"
+
+# Negative control — if auth isn't load-bearing, a wrong key would ALSO succeed here.
+# Same nomination attempt, deliberately wrong Bearer: must be rejected (ownerSlug never
+# resolves), proving the gateway/nomination gate is actually doing something.
+neg_resp="$(curl -sS --max-time 5 -X POST "$API_URL/api/ask/world:announce" \
+  -H 'Content-Type: application/json' -H 'Authorization: Bearer wrong-key-0000000000000000' \
+  -H 'Cookie: signed_out=1' -d "{\"data\":$session_payload}")"
+neg_ok="$(printf '%s' "$neg_resp" | jq -r '.result.ok // false' 2>/dev/null)"
+if [ "$neg_ok" = "true" ]; then
+  echo "[cc-events-proof] FAIL — a wrong Bearer key still resolved ok:true; auth is not load-bearing: $neg_resp"
+  exit 1
+fi
+echo "[cc-events-proof] wire1 negative control ok — wrong key correctly rejected ($neg_resp)"
+
+# ── wire 3 — the tasks bridge sends ──────────────────────────────────────────
+send_out="$(python3 "$ROOT/.claude/scripts/do-tasks-bridge.py" --send 2>/dev/null)"
+send_count="$(printf '%s' "$send_out" | jq 'length' 2>/dev/null || echo 0)"
+send_matched_total="$(printf '%s' "$send_out" | jq '[.[] | .result.matched // 0] | add // 0' 2>/dev/null)"
+if [ "${send_count:-0}" -eq 0 ]; then
+  echo "[cc-events-proof] wire3 tasks skipped — local build queue is empty (not a failure)"
+  wire3_ok=skip
+elif [ "${send_matched_total:-0}" -ge 1 ]; then
+  echo "[cc-events-proof] wire3 tasks ok — $send_count sent, matched_total=$send_matched_total"
+  wire3_ok=true
+else
+  echo "[cc-events-proof] wire3 tasks FAIL — $send_count sent, matched_total=$send_matched_total"
+  wire3_ok=false
+fi
+
+# ── verdict ───────────────────────────────────────────────────────────────────
+if [ "$session_ok" = "true" ] && [ "${session_matched:-0}" -ge 1 ] && [ "$wire3_ok" != "false" ]; then
+  echo "[cc-events-proof] PASS"
+  exit 0
+fi
+echo "[cc-events-proof] FAIL — session_ok=$session_ok session_matched=$session_matched wire3_ok=$wire3_ok"
+exit 1

package/scripts/do-accept.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# do-accept.sh — record a human's merge/abandon decision on a do/<slug> branch.
+#
+# The cost-per-accepted-change signal (the one the improvements queue flagged and
+# the trust ladder needs). Trust climbs on ACCEPTED change, not self-graded
+# rubric. Run at the merge gate: `do-accept.sh <slug> accept` when you land a
+# branch, `do-accept.sh <slug> reject` when you abandon it. Updates the rolling
+# acceptCount/acceptTotal in .do-trust.json — autonomyLevel (do-autonomous.ts)
+# reads them to decide L3 (auto-build) / L4 (auto-merge).
+#
+# Mirrors recordAccept() in one.ie/web/src/lib/do-autonomous.ts.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+TRUST="$ROOT/.do-trust.json"
+slug="${1:?usage: do-accept.sh <slug> accept|reject}"
+decision="${2:?usage: do-accept.sh <slug> accept|reject}"
+case "$decision" in accept|reject) ;; *) echo "decision must be accept|reject" >&2; exit 2 ;; esac
+
+python3 - "$TRUST" "$slug" "$decision" << 'PY'
+import json, sys, os
+trust_path, slug, decision = sys.argv[1], sys.argv[2], sys.argv[3]
+t = {}
+if os.path.exists(trust_path):
+    try: t = json.load(open(trust_path))
+    except Exception: t = {}
+t["acceptCount"] = int(t.get("acceptCount", 0)) + (1 if decision == "accept" else 0)
+t["acceptTotal"] = int(t.get("acceptTotal", 0)) + 1
+rate = t["acceptCount"] / t["acceptTotal"] if t["acceptTotal"] else 0.0
+t["acceptRate"] = round(rate, 4)
+json.dump(t, open(trust_path, "w"), indent=2)
+print(f"[do-accept] {slug} {decision} → {t['acceptCount']}/{t['acceptTotal']} accepted (rate {t['acceptRate']})")
+# echo the level gate the ladder would now allow (informational)
+if t["acceptTotal"] >= 20 and rate >= 0.9: lvl = "L4 (auto-merge eligible)"
+elif t["acceptTotal"] >= 10 and rate >= 0.7: lvl = "L3 (auto-build eligible)"
+else: lvl = "L1-L2 (build stays supervised)"
+print(f"[do-accept] trust ladder: {lvl}")
+PY