@oneie/claude 0.4.0 → 0.6.0

package/scripts/do-auto.sh

@@ -11,23 +11,52 @@
 # cycle 6. Fresh-per-cycle eliminates it. The todo checkboxes are the only carried state.
 #
 # Internal usage (driven by do.md, not a human):
-#   bun .claude/scripts/do-auto.sh <slug> [--max-cycles N] [--dry-run]
+#   bash .claude/scripts/do-auto.sh <slug> [--max-cycles N] [--dry-run]
+#   (it's a bash script — invoking with `bun` parses it as JS and dies on `case ... )`)
 set -euo pipefail
 
 SLUG=""
 MAX_CYCLES=30
 DRY_RUN=false
+GC_ONLY=false
+SETUP_ONLY=false
 
 while [ "$#" -gt 0 ]; do
   case "$1" in
+    --setup-only) SETUP_ONLY=true; shift ;;
     --max-cycles) MAX_CYCLES="$2"; shift 2 ;;
     --dry-run)    DRY_RUN=true; shift ;;
+    --gc)         GC_ONLY=true; shift ;;
     -*)           echo "unknown flag: $1" >&2; exit 1 ;;
     *)            SLUG="$1"; shift ;;
   esac
 done
 
-[ -z "$SLUG" ] && { echo "usage: do-auto.sh <slug> [--max-cycles N] [--dry-run]" >&2; exit 1; }
+# Standalone GC: sweep all worktrees whose do/<slug> branch is fully merged into
+# the current branch. Safe-only: `worktree remove` refuses dirty, `branch -d`
+# refuses unmerged. Unmerged/dirty worktrees are listed, never touched.
+if $GC_ONLY; then
+  BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
+  removed=0; kept=0
+  for wt in .do-worktrees/*/; do
+    [ -d "$wt" ] || continue
+    s=$(basename "$wt"); b="do/${s}"
+    git show-ref --verify --quiet "refs/heads/$b" || { echo "[do-auto] gc: $wt has no branch $b — inspect manually"; kept=$((kept+1)); continue; }
+    if [ "$(git rev-list --count "${BASE}..${b}" 2>/dev/null || echo 1)" -eq 0 ]; then
+      if git worktree remove "$wt" 2>/dev/null && git branch -d "$b" 2>/dev/null; then
+        echo "[do-auto] gc: removed merged worktree $wt + branch $b"; removed=$((removed+1))
+      else
+        echo "[do-auto] gc: $wt merged but dirty — inspect manually"; kept=$((kept+1))
+      fi
+    else
+      echo "[do-auto] gc: $b has $(git rev-list --count "${BASE}..${b}") unmerged commit(s) — kept"; kept=$((kept+1))
+    fi
+  done
+  echo "[do-auto] gc done: removed=$removed kept=$kept"
+  exit 0
+fi
+
+[ -z "$SLUG" ] && { echo "usage: do-auto.sh <slug> [--max-cycles N] [--dry-run] | do-auto.sh --gc" >&2; exit 1; }
 
 # Validate slug is safe (kebab-case only) before it touches any shell string.
 # Prevents command injection if the slug ever contains metacharacters.
@@ -35,6 +64,15 @@ if ! printf '%s' "$SLUG" | grep -qE '^[a-zA-Z0-9][a-zA-Z0-9_-]*$'; then
   echo "[do-auto] unsafe slug (must be alphanumeric + hyphens/underscores): $SLUG" >&2; exit 1
 fi
 
+# Recursion guard: the conductor subprocess runs `/do <slug> --next-cycle` inside
+# the worktree. A buggy conductor may call do-auto.sh again despite the --next-cycle
+# flag. If our sentinel file exists, we're already inside a parent loop — exit cleanly.
+_sentinel=".do-worktrees/${SLUG}/.do-loop-running"
+if [ -f "$_sentinel" ]; then
+  echo "[do-auto] recursion guard: parent loop already running for $SLUG — exiting" >&2
+  exit 0
+fi
+
 # Trust boundary: this script runs in the developer's own workspace, invoked by /do
 # which resolves the slug from a text/ file the developer controls. The spawned
 # claude subprocess uses --dangerously-skip-permissions because it is non-interactive
@@ -42,6 +80,33 @@ fi
 # boundary. Do not expose this script to untrusted input or run it in shared environments.
 [ -f "text/${SLUG}-todo.md" ] || { echo "[do-auto] text/${SLUG}-todo.md not found — run /do $SLUG first" >&2; exit 1; }
 
+# Conductor model is ALWAYS sonnet — the conductor reads boxes, spawns agents, ticks
+# state; it needs no apex judgment. Without this pin the subprocess inherits the
+# session's saved default model (the /model trap), silently running Opus/Fable
+# conductors at 10-50x the cost. W2 escalation to Opus/Fable happens INSIDE the
+# cycle via the Agent tool, exactly where judgment is needed.
+CONDUCTOR_MODEL="sonnet"
+
+# Conductor effort is session-level (the `claude --effort` flag). The conductor
+# orchestrates — reads boxes, routes, spawns agents, ticks — so `medium` holds
+# without burning the cap; raise to `high` for a flaky plan via DO_CONDUCTOR_EFFORT.
+# NOTE: this sets the CONDUCTOR's effort only. Per-WAVE effort (W1 low, W2 high,
+# W4 medium) is NOT controllable here — the Agent tool has no effort param. For
+# true per-wave effort use the Workflow engine (.claude/workflows/do-engine.js,
+# see text/do-engine-plan.md), which the interactive session drives instead of
+# this shell loop.
+CONDUCTOR_EFFORT="${DO_CONDUCTOR_EFFORT:-medium}"
+
+# Per-iteration hang guard: `claude -p` has no built-in wall-clock limit, and the
+# stall guard only fires BETWEEN iterations — a conductor that truly hangs would
+# block the loop forever. Cap each iteration; on overrun, terminate the conductor
+# so the iteration ends, ticks no box, and the stall guard takes over. Generous by
+# default (a healthy batch of 3 cycles runs ~20-25 min); override via env.
+CONDUCTOR_TIMEOUT="${DO_CONDUCTOR_TIMEOUT:-2400}"
+
+# W1/W4 scripts (w1-recon.ts, w4-rubric.ts) always exit 2 and defer to agent
+# spawns through the Claude Code session (Claude Max subscription path).
+
 # ── Worktree isolation (one per plan) ────────────────────────────────────────
 # The loop's existence IS the trigger: do-auto only runs for multi-cycle plans
 # (>=2 incomplete cycles) = exactly the FEATURE/SCHEMA work that must not land
@@ -60,6 +125,23 @@ BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
 BR="do/${SLUG}"
 WT=".do-worktrees/${SLUG}"
 
+# Symlink node_modules + built SDK dist into the worktree. A git worktree omits
+# gitignored dirs (node_modules), so without this a worktree can't typecheck, run
+# vitest, or build — the kill-switch would fail for lack of deps, not lack of code.
+# Same set do-fleet's _link_deps uses; folding it here means EVERY worktree do-auto
+# cuts (inline /do, not just the fleet) is build-ready. Symlinks, so no copy cost.
+_link_deps() {
+  local wt="$1" root nm
+  root="$(git rev-parse --show-toplevel 2>/dev/null)" || return 0
+  for nm in node_modules one.ie/web/node_modules packages/node_modules \
+            packages/sdk/dist packages/sdk/node_modules; do
+    if [ -e "$root/$nm" ] && [ ! -e "$wt/$nm" ]; then
+      mkdir -p "$wt/$(dirname "$nm")"
+      ln -s "$root/$nm" "$wt/$nm" 2>/dev/null && echo "[do-auto] linked $nm" || true
+    fi
+  done
+}
+
 _setup_worktree() {
   # Idempotent: reuse an existing worktree (resume), else attach one to an
   # existing branch (prior halt), else create branch+worktree fresh from HEAD.
@@ -72,24 +154,110 @@ _setup_worktree() {
     echo "[do-auto] creating worktree $WT on new branch $BR (from $BASE)"
     git worktree add -b "$BR" "$WT" HEAD >/dev/null
   fi
+  _link_deps "$WT"
 
   # Carry the plan's own artifacts into the worktree. The spine walk may have
   # just written promise/spec/todo uncommitted in the main tree; a worktree cut
   # from HEAD wouldn't have them. Copy only this slug's files — never unrelated
   # working-tree changes — then commit them as the branch baseline.
+  #
+  # The todo is special: the subprocess ticks checkboxes in the *worktree* copy,
+  # so a blind root→worktree copy on resume would clobber committed progress
+  # (reset [x]→[ ] and re-run finished cycles). Only the non-todo spine docs
+  # blind-sync. For the todo, copy in only when root is strictly AHEAD — i.e.
+  # has more ticked boxes than the worktree (fresh setup, or new cycles the
+  # spine walk just added). If the worktree is ahead-or-equal, keep it.
   local f changed=0
-  for f in "text/${SLUG}.md" "text/${SLUG}-todo.md" ".w4-improvements.json"; do
+  # grep -c already prints a count (0 on no match) but then exits 1; `|| true`
+  # swallows the exit without appending a second line. Default to 0 if empty.
+  _ticked() { local n; n=$(grep -cE '\[[xX]\]' "$1" 2>/dev/null || true); echo "${n:-0}"; }
+  for f in "text/${SLUG}.md" "text/${SLUG}-plan.md" "text/${SLUG}-docs.md" \
+           "text/${SLUG}-features.md" "text/${SLUG}-ui.md" "text/${SLUG}-tutorial.md" \
+           "text/${SLUG}-how-to.md" "text/${SLUG}-reference.md" "text/${SLUG}-agents-docs.md" \
+           ".w4-improvements.json"; do
     if [ -f "$f" ]; then
       mkdir -p "$WT/$(dirname "$f")"
       if ! cmp -s "$f" "$WT/$f" 2>/dev/null; then cp "$f" "$WT/$f"; changed=1; fi
     fi
   done
+  f="text/${SLUG}-todo.md"
+  if [ -f "$f" ]; then
+    mkdir -p "$WT/$(dirname "$f")"
+    if ! cmp -s "$f" "$WT/$f" 2>/dev/null; then
+      if [ ! -f "$WT/$f" ] || [ "$(_ticked "$f")" -gt "$(_ticked "$WT/$f")" ]; then
+        cp "$f" "$WT/$f"; changed=1
+      else
+        echo "[do-auto] worktree todo ahead-or-equal — keeping worktree progress, not clobbering"
+      fi
+    fi
+  fi
+  # Worktree-relative outcome (kill-switch hardening). The conductor runs the plan
+  # `outcome:` command from the worktree root, so an ABSOLUTE repo path (e.g.
+  # /Users/.../one-ie/channels) points at TRUNK and gates nothing during the
+  # isolated build. Strip the repo-root prefix on the outcome line so its paths
+  # resolve inside the worktree. Idempotent — a relative outcome has no prefix.
+  local repo_root; repo_root="$(git rev-parse --show-toplevel 2>/dev/null)"
+  if [ -n "$repo_root" ] && [ -f "$WT/$f" ] && grep -q "^outcome:.*${repo_root}/" "$WT/$f" 2>/dev/null; then
+    sed -i '' "/^outcome:/ s#${repo_root}/##g" "$WT/$f" 2>/dev/null \
+      && { echo "[do-auto] relativized absolute repo paths in outcome: — worktree-safe kill-switch"; changed=1; }
+  fi
+  # W0 rubric baseline — copy into worktree so W4 can measure delta per axis.
+  # Auto-generate if missing AND a package dir named $SLUG exists (e.g. sync/, channels/).
+  local rubric_src="text/${SLUG}-w0-rubric.json"
+  local proj_root; proj_root="$(git rev-parse --show-toplevel 2>/dev/null)"
+  if [ ! -f "$rubric_src" ] && [ -n "$proj_root" ] && [ -d "${proj_root}/${SLUG}" ]; then
+    echo "[do-auto] W0 rubric: no baseline found — running do-rubric.py on ${SLUG}/ ..."
+    python3 "${proj_root}/.claude/scripts/do-rubric.py" "$SLUG" --json > "$rubric_src" 2>/dev/null \
+      || { echo "[do-auto] W0 rubric: do-rubric.py failed — skipping baseline"; rm -f "$rubric_src"; }
+  fi
+  if [ -f "$rubric_src" ]; then
+    if ! cmp -s "$rubric_src" "$WT/.w0-rubric.json" 2>/dev/null; then
+      cp "$rubric_src" "$WT/.w0-rubric.json"; changed=1
+      local w0c; w0c=$(python3 -c "import json,sys; d=json.load(open('$rubric_src')); print(d.get('composite','?'))" 2>/dev/null)
+      echo "[do-auto] W0 rubric baseline: composite=${w0c} (security/stability/simplicity/speed stored in .w0-rubric.json)"
+    fi
+  fi
+
   if [ "$changed" -eq 1 ]; then
-    git -C "$WT" add -A
+    _safe_stage "$WT" "$f" ".do-trust.json" ".w4-improvements.json" ".w0-rubric.json"
     git -C "$WT" commit -q -m "do(${SLUG}): sync spine artifacts" 2>/dev/null || true
   fi
 }
 
+# _safe_stage <dir> [explicit paths…] — NEVER blanket-add on the shared main tree.
+# In an isolated linked worktree (git-dir under .git/worktrees/…) a full `add -A`
+# is safe — only this cycle's changes live there. On the main tree it would sweep
+# concurrent windows' uncommitted work into this commit (the do(funnels) tangle,
+# 2026-06-20), so we stage only the explicit paths given — or nothing, loudly.
+_safe_stage() {
+  local d="$1"; shift
+  local gd; gd=$(git -C "$d" rev-parse --absolute-git-dir 2>/dev/null)
+  case "$gd" in
+    # In a worktree `add -A` is safe (only this cycle's changes live there) — BUT
+    # the fleet's `_link_deps` creates node_modules/dist SYMLINKS, and the
+    # `node_modules/` gitignore (trailing slash = dirs only) does NOT match a
+    # symlink, so a blind add -A commits them as junk that fights every later
+    # merge. Exclude them explicitly here (belt; the gitignore is the suspenders).
+    */worktrees/*) git -C "$d" add -A -- . ':(exclude)**/node_modules' ':(exclude)**/dist' ':(exclude).do-digest.md' ;;
+    *) if [ "$#" -gt 0 ]; then
+         echo "[do-auto] main tree ($d): staging explicit paths only, never -A (avoids sweeping concurrent work)" >&2
+         git -C "$d" add -- "$@" 2>/dev/null || true
+       else
+         echo "[do-auto] REFUSING 'git add -A' on the main tree ($d) — run cycles in a worktree. Nothing staged." >&2
+       fi ;;
+  esac
+}
+
+# --setup-only: the inline /do path (single-cycle · PATCH · FIX) wants the worktree
+# without the subprocess loop — it runs the spine in-session, cd'd into the tree.
+# Setup progress goes to stderr; stdout carries ONLY the absolute worktree path so
+# the caller can `WT=$(do-auto.sh <slug> --setup-only)` cleanly.
+if $SETUP_ONLY; then
+  _setup_worktree 1>&2
+  ( cd "$WT" && pwd )
+  exit 0
+fi
+
 if ! $DRY_RUN; then
   _setup_worktree
   # All loop state now lives in the worktree — read the boxes the subprocess ticks.
@@ -113,11 +281,112 @@ _trust() {
   jq -r '.level // "standard"' "$TRUST" 2>/dev/null || echo "standard"
 }
 
+_tier() {
+  grep -m1 '^tier:' "$TODO" 2>/dev/null | sed 's/^tier:[[:space:]]*//' | tr -d '"' || echo "feature"
+}
+
+# Emit a world:do-event signal at a cycle boundary. Fire-and-forget — never blocks the loop.
+_signal() {
+  bash "$(dirname "$0")/do-signal.sh" "$@" 2>/dev/null || true
+}
+
 _plan_done() {
   # Plan close item is ticked. -e marks the pattern explicitly (dash-safe).
   grep -qe '\[x\].*Plan outcome command exits 0' "$TODO" 2>/dev/null
 }
 
+# Objective security gate — secret-scan + dependency audit (W4 bash-first,
+# zero-LLM). Returns 0 = clean, 1 = finding. A scored security rubric can miss a
+# leaked key or a known-vuln dep; this is the deterministic backstop. gitleaks or
+# trufflehog when installed, else a builtin high-signal sweep of THIS cycle's diff
+# (added lines only — fast, false-positive-lean). `bun audit` gates deps only when
+# a lockfile/manifest moved. Every probe degrades to pass-if-tool-absent, so the
+# gate blocks on a real hit, never on a missing scanner.
+_secret_gate() {
+  local wt="$1" rc=0
+  if command -v gitleaks >/dev/null 2>&1; then
+    gitleaks detect --no-git --source "$wt" --redact -q 2>/dev/null || rc=1
+  elif command -v trufflehog >/dev/null 2>&1; then
+    trufflehog filesystem "$wt" --no-update --fail >/dev/null 2>&1 || rc=1
+  else
+    local diff hits
+    diff=$(git -C "$wt" diff HEAD 2>/dev/null | grep '^+' || true)
+    hits=$(printf '%s\n' "$diff" | grep -nE 'AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----|sk-[A-Za-z0-9]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{30,}' || true)
+    [ -n "$hits" ] && { echo "[do-auto] builtin secret-scan hit (cycle diff):" >&2; printf '%s\n' "$hits" | head -5 >&2; rc=1; }
+  fi
+  if command -v bun >/dev/null 2>&1; then
+    local changed_manifests
+    changed_manifests=$(git -C "$wt" diff HEAD --name-only 2>/dev/null | grep -E '(^|/)(bun\.lock|bun\.lockb|package\.json)$' || true)
+    if [ -n "$changed_manifests" ]; then
+      # No root package.json by design (do-folder.sh) — `bun audit` from $wt itself
+      # always fails with "No package.json was found", which read as a false
+      # "vulnerability" hit. Walk each changed manifest up to its nearest bun.lock
+      # ancestor (every buildable folder owns one) and audit from there instead.
+      local audit_roots dir found m
+      audit_roots=""
+      while IFS= read -r m; do
+        [ -z "$m" ] && continue
+        dir="$(dirname "$m")"
+        found=""
+        while [ "$dir" != "." ] && [ "$dir" != "/" ]; do
+          if [ -f "$wt/$dir/bun.lock" ] || [ -f "$wt/$dir/bun.lockb" ]; then found="$dir"; break; fi
+          dir="$(dirname "$dir")"
+        done
+        [ -z "$found" ] && { [ -f "$wt/bun.lock" ] || [ -f "$wt/bun.lockb" ]; } && found="."
+        [ -n "$found" ] && audit_roots="${audit_roots}${found}
+"
+      done <<EOF
+$changed_manifests
+EOF
+      audit_roots=$(printf '%s' "$audit_roots" | sed '/^$/d' | sort -u)
+      for f in $audit_roots; do
+        ( cd "$wt/$f" && bun audit --audit-level moderate >/dev/null 2>&1 ) || { echo "[do-auto] bun audit: moderate+ vulnerability in updated deps ($f)" >&2; rc=1; }
+      done
+    fi
+  fi
+  return "$rc"
+}
+
+_merge_digest() {
+  # Deterministic, zero-LLM record the human reads BEFORE landing do/<slug>.
+  # Context isolation discards each cycle's reasoning to save ~90-150k tokens, so
+  # without this the human merges blind — the comprehension debt a context-isolated
+  # loop uniquely creates (the prose that explained the change was the scaffolding
+  # we threw away). Pure git + jq: cycles closed, diffstat, gate verdict, open items,
+  # cycle commits. Written to trunk's root (.do-digest.md) where the human stands.
+  local digest=".do-digest.md"
+  local cycles shortstat trust composite open mb behind
+  cycles=$(grep -cE '\[[xX]\] C[0-9]+' "$TODO" 2>/dev/null || true); cycles=${cycles:-0}
+  # Diff from the MERGE-BASE, not BASE..BR. A two-dot BASE..BR diff conflates
+  # "what this branch added" with "what trunk advanced while we built" (the
+  # latter shows as spurious reversions), inflating the digest. merge-base..BR
+  # is exactly the branch's own changes. `behind` reports how far trunk moved.
+  mb=$(git -C "$WT" merge-base "$BASE" "$BR" 2>/dev/null || echo "$BASE")
+  behind=$(git -C "$WT" rev-list --count "$mb..$BASE" 2>/dev/null || echo 0)
+  shortstat=$(git -C "$WT" diff --shortstat "$mb..$BR" 2>/dev/null || true)
+  trust=$(jq -r '.level // "?"' "$TRUST" 2>/dev/null || echo "?")
+  composite=$(jq -r '.composite // "?"' "$TRUST" 2>/dev/null || echo "?")
+  open=0
+  [ -f "$WT/.w4-improvements.json" ] && open=$(jq -r 'if type=="array" then length elif type=="object" then ([.[]?]|length) else 0 end' "$WT/.w4-improvements.json" 2>/dev/null || echo 0)
+  {
+    echo "# Merge digest — ${SLUG}"
+    echo
+    echo "Branch \`${BR}\` → \`${BASE}\`. Context isolation discarded the per-cycle reasoning to save tokens — this is the record. Read it before you land the merge."
+    echo
+    echo "- **Cycles closed:** ${cycles}"
+    echo "- **This branch's changes (merge-base..${BR}):** ${shortstat:-none}"
+    [ "${behind:-0}" -gt 0 ] && echo "- **Trunk advanced during build:** ${behind} commit(s) — run \`git merge-tree ${BASE} ${BR}\` to confirm a clean merge before landing"
+    echo "- **Gate verdict:** trust=${trust} · composite=${composite}"
+    echo "- **Open improvements carried:** ${open}"
+    echo
+    echo "## Files changed (this branch only)"
+    git -C "$WT" diff --stat "$mb..$BR" 2>/dev/null | sed 's/^/    /' || true
+    echo
+    echo "## Cycle commits"
+    git -C "$WT" log --oneline "$mb..$BR" 2>/dev/null | sed 's/^/    /' || true
+  } > "$digest" 2>/dev/null || true
+}
+
 i=0
 prev_remaining=-1
 stall=0
@@ -141,6 +410,7 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
       echo "[do-auto] no progress for 2 iterations (${remaining} cycle(s) stuck) — halting." >&2
       echo "[do-auto] The last cycle ticked no checkbox. Inspect $TODO, fix the blocker, then re-run /do $SLUG." >&2
       echo "[do-auto] WIP preserved on branch $BR (worktree $WT)." >&2
+      _signal halt "$SLUG" "$(_tier)" "$i" "reason=stall"
       exit 1
     fi
   else
@@ -152,6 +422,7 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
   if [ "$trust" = "cautious" ]; then
     echo "[do-auto] trust=cautious — halting. Fix the issue, then re-run /do $SLUG."
     echo "[do-auto] WIP preserved on branch $BR (worktree $WT)."
+    _signal halt "$SLUG" "$(_tier)" "$i" "reason=trust-cautious"
     exit 1
   fi
 
@@ -162,21 +433,131 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo ""
 
+  # Autonomous passthrough: when the orchestrator set DO_AUTONOMOUS=1, tell the
+  # conductor to resolve gates by rule instead of asking (do.md "Autonomous gate
+  # resolution"). Without this the headless cycle wedges on AIM/CLARIFY/anchor-miss.
+  AUTO_FLAG=""
+  [ "${DO_AUTONOMOUS:-}" = "1" ] && AUTO_FLAG=" --autonomous"
+
+  # Ask world:pick-model which model has proven best for this task shape.
+  # Fire-and-forget: on any error (no server, no auth, timeout) keeps the
+  # CONDUCTOR_MODEL default (sonnet). The model id returned is the full
+  # canonical id (e.g. claude-haiku-4-5-20251001); map to the short alias
+  # claude uses (haiku/sonnet/opus) by stripping the prefix.
+  { _pm=$(curl -sf --max-time 5 -X POST \
+      -H 'Content-Type: application/json' \
+      -d "{\"shape\":\"do:$(_tier)\"}" \
+      "${DO_SIGNAL_URL:-https://one.ie}/api/ask/world:pick-model" 2>/dev/null) \
+    && _pm_model=$(printf '%s' "$_pm" | grep -o '"model":"[^"]*"' | sed 's/"model":"//;s/"//g') \
+    && [ -n "$_pm_model" ] && CONDUCTOR_MODEL="$_pm_model"; } 2>/dev/null || true
+
   if $DRY_RUN; then
-    echo "[do-auto] DRY RUN: would invoke — claude --dangerously-skip-permissions -p \"/do $SLUG --next-cycle\""
+    echo "[do-auto] DRY RUN: would invoke — claude --model $CONDUCTOR_MODEL --effort $CONDUCTOR_EFFORT --dangerously-skip-permissions -p \"/do $SLUG --next-cycle${AUTO_FLAG}\""
     break
   fi
 
+  # Emit cycle-open signal (world:do-event type:aim) before the conductor starts.
+  _signal aim "$SLUG" "$(_tier)" "$i"
+
+  # C6: Trail confidence hint — query KV trail before spawning the conductor.
+  # If confidence ≥ 0.8, write .do-trail-hint.json in the worktree so W1 can skip W2.
+  _trail_base="${ONEIE_BASE_URL:-${ONE_BASE_URL:-https://one.ie}}"
+  _trail_key="${ONEIE_API_KEY:-${ONE_API_KEY:-}}"
+  _plan_tags=$(grep -m1 '^tags:' "$WT/text/${SLUG}-todo.md" 2>/dev/null \
+    | sed 's/^tags:[[:space:]]*\[//;s/\]//;s/ //g;s/,/ /g' | tr ' ' '\n' \
+    | grep -v '^$' | sort | tr '\n' ',' | sed 's/,$//' || true)
+  if [ -n "$_plan_tags" ] && [ -n "$_trail_key" ]; then
+    # Token off argv (ps aux would leak a bare -H value) — one-shot 0600 curl config.
+    _trail_authcfg="$(mktemp)"; chmod 600 "$_trail_authcfg"
+    printf 'header = "Authorization: Bearer %s"\n' "$_trail_key" >"$_trail_authcfg"
+    _trail_resp=$(curl -sf --max-time 5 \
+      --config "$_trail_authcfg" \
+      "${_trail_base%/}/api/export/trail?tags=${_plan_tags}" 2>/dev/null) || _trail_resp=""
+    rm -f "$_trail_authcfg"
+    if [ -n "$_trail_resp" ]; then
+      _trail_conf=$(printf '%s' "$_trail_resp" | grep -o '"confidence":[0-9.]*' | head -1 | cut -d: -f2 || echo "0")
+      echo "[do-auto] trail confidence=${_trail_conf} for tags=${_plan_tags}"
+      _threshold="0.8"
+      if awk "BEGIN{exit !($_trail_conf >= $_threshold)}" 2>/dev/null; then
+        printf '%s' "$_trail_resp" > "$WT/.do-trail-hint.json"
+        echo "[do-auto] trail confidence ≥ ${_threshold} — hint written (.do-trail-hint.json); W2 may be skipped"
+      fi
+    fi
+  fi
+
   # Fresh context, isolated tree: the subprocess runs INSIDE the worktree, so
   # every edit/box-tick/state-write lands on branch $BR — trunk is never touched.
-  ( cd "$WT" && claude --dangerously-skip-permissions -p "/do $SLUG --next-cycle" )
+  # Sentinel prevents the conductor from spawning a recursive do-auto.sh loop.
+  touch "$WT/.do-loop-running"
+  # Pick the conductor model — fallback to sonnet (world:pick-model not yet wired).
+  _shape_pick="do:$(_tier)"
+  if [ -n "${_axis:-}" ]; then _shape_pick="${_shape_pick}·${_axis}"; fi
+
+  # Run the conductor in the background with a bash-native watchdog (macOS has no
+  # `timeout`). If it overruns CONDUCTOR_TIMEOUT, the watchdog terminates both the
+  # subshell and the claude process (matched by its --next-cycle command line).
+  # Unset Claude Code session vars so the subprocess starts a fresh session instead
+  # of being blocked by the anti-nesting guard (CLAUDECODE/CLAUDE_CODE_CHILD_SESSION).
+  ( cd "$WT" && unset CLAUDECODE CLAUDE_CODE_CHILD_SESSION CLAUDE_CODE_SESSION_ID AI_AGENT && claude --model "$CONDUCTOR_MODEL" --effort "$CONDUCTOR_EFFORT" --dangerously-skip-permissions -p "/do $SLUG --next-cycle${AUTO_FLAG}" ) &
+  cond_pid=$!
+  ( sleep "$CONDUCTOR_TIMEOUT"
+    if kill -0 "$cond_pid" 2>/dev/null; then
+      echo "[do-auto] conductor exceeded ${CONDUCTOR_TIMEOUT}s — terminating (hang guard); stall guard will halt if no progress" >&2
+      pkill -f "do ${SLUG} --next-cycle" 2>/dev/null || true
+      kill -TERM "$cond_pid" 2>/dev/null || true
+      sleep 5; kill -KILL "$cond_pid" 2>/dev/null || true
+    fi ) &
+  wd_pid=$!
+  wait "$cond_pid" 2>/dev/null || true
+  kill "$wd_pid" 2>/dev/null || true   # conductor finished first — cancel the watchdog
+  # Kill any child do-auto.sh the conductor may have spawned despite --next-cycle.
+  pkill -f "do-auto.sh ${SLUG}" 2>/dev/null || true
+  sleep 1
+  rm -f "$WT/.do-loop-running"
+
+  # Objective security gate (W4 bash-first, zero-LLM): before the cycle lands on
+  # the branch, secret-scan the worktree + audit deps. A scored security score can
+  # miss a leaked key or known-vuln dep; this is the deterministic backstop — a
+  # finding halts the loop so the secret never gets committed. Runs independent of
+  # the porcelain check so a self-committing conductor cannot bypass it.
+  if ! _secret_gate "$WT"; then
+    echo "[do-auto] secret-scan / bun audit found an issue — NOT committing cycle ${i}." >&2
+    echo "[do-auto] Inspect $WT, remove the secret/vuln, then re-run /do $SLUG. WIP preserved on $BR." >&2
+    _signal halt "$SLUG" "$(_tier)" "$i" "reason=secret-gate"
+    exit 1
+  fi
 
   # Commit the cycle on its branch. A cycle closes with a passing rubric, so it
   # is the natural commit unit — and committed progress survives a later halt.
   if [ -n "$(git -C "$WT" status --porcelain)" ]; then
-    git -C "$WT" add -A
+    _safe_stage "$WT"
     git -C "$WT" commit -q -m "do(${SLUG}): cycle ${i}" || true
   fi
+
+  # Sync loop state back to the main tree EVERY iteration. Trust and improvements
+  # gate the NEXT plan's behavior — stranded in the worktree they read days stale
+  # on main (the bug this fixes: voice closed at trust=trusted while main still
+  # said plan=connect from two days prior). Todo boxes stay worktree-only; they
+  # arrive on main via the merge.
+  for f in .do-trust.json .w4-improvements.json; do
+    [ -f "$WT/$f" ] && cp "$WT/$f" "$f"
+  done
+
+  # Emit cycle-close signal (world:do-event type:learn) after state is synced.
+  # shape = dominant axis (lowest-scoring advanced dim, remapped simplicity→structure).
+  # model = conductor model (C1 deliverable — receiver prepends model: for the actor aid).
+  _composite=$(jq -r '.composite // ""' "$TRUST" 2>/dev/null || true)
+  _axis=$(jq -r 'if type=="array" then ([.[] | select(.score < 1.0)] | if length > 0 then (min_by(.score) | .dim // "") else "" end) else "" end' "$WT/.w4-improvements.json" 2>/dev/null || true)
+  # remap simplicity → structure (UI label from the four-S spec; substrate attr stays rubric-simplicity)
+  [ "$_axis" = "simplicity" ] && _axis="structure"
+  _shape=""
+  [ -n "$_axis" ] && _shape="shape=do:$(_tier)·${_axis}"
+  _model="model=${CONDUCTOR_MODEL}"
+  if [ -n "$_composite" ]; then
+    _signal learn "$SLUG" "$(_tier)" "$i" "composite=${_composite}" ${_shape:+"$_shape"} "$_model"
+  else
+    _signal learn "$SLUG" "$(_tier)" "$i" ${_shape:+"$_shape"} "$_model"
+  fi
 done
 
 if $DRY_RUN; then exit 0; fi
@@ -184,14 +565,42 @@ if $DRY_RUN; then exit 0; fi
 if [ "$i" -ge "$MAX_CYCLES" ]; then
   echo "[do-auto] hit --max-cycles $MAX_CYCLES — halting"
   echo "[do-auto] WIP preserved on branch $BR (worktree $WT)."
+  _signal halt "$SLUG" "$(_tier)" "$i" "reason=max-cycles"
   exit 1
 fi
 
 # Plan complete. The branch holds every cycle, proven and committed; trunk is
 # untouched. Landing it is a human decision (commit/push only when asked), so we
 # report the merge instead of running it — the worktree stays for inspection.
+# Write the digest FIRST so the report can point the human at it: the loop threw
+# away the reasoning to stay cheap, so the digest is the only thing left to read
+# before an irreversible merge.
+_merge_digest
 echo ""
 echo "[do-auto] ✓ plan complete on branch $BR — trunk ($BASE) untouched."
+echo "[do-auto]   read:    .do-digest.md                 # what landed + gate verdict (reasoning was discarded)"
 echo "[do-auto]   land:    git merge --no-ff $BR        # from $BASE"
 echo "[do-auto]   inspect: git -C $WT log --oneline $BASE..$BR"
 echo "[do-auto]   discard: git worktree remove $WT && git branch -D $BR"
+echo "[do-auto]   gc:      after landing, run — .claude/scripts/do-auto.sh --gc"
+
+# ── GC mode: sweep worktrees whose branches are fully merged ────────────────
+# Invoked as `do-auto.sh --gc` (handled below via the flag parser) OR run here
+# opportunistically for OTHER plans' leftovers: any .do-worktrees/<s> whose
+# branch has 0 commits not in $BASE is finished work — remove it. Safe-only
+# commands: `worktree remove` refuses a dirty tree, `branch -d` refuses
+# unmerged. Active/unmerged worktrees are reported, never touched.
+for wt in .do-worktrees/*/; do
+  [ -d "$wt" ] || continue
+  s=$(basename "$wt")
+  [ "$s" = "$SLUG" ] && continue   # never GC the plan we just ran — human inspects first
+  b="do/${s}"
+  git show-ref --verify --quiet "refs/heads/$b" || continue
+  if [ "$(git rev-list --count "${BASE}..${b}" 2>/dev/null || echo 1)" -eq 0 ]; then
+    if git worktree remove "$wt" 2>/dev/null && git branch -d "$b" 2>/dev/null; then
+      echo "[do-auto] gc: removed merged worktree $wt + branch $b"
+    else
+      echo "[do-auto] gc: $wt is merged but dirty — inspect manually" >&2
+    fi
+  fi
+done