@oneie/claude 0.4.0 → 0.6.0

package/scripts/do-fleet.sh

@@ -0,0 +1,337 @@
+#!/usr/bin/env bash
+# do-fleet.sh — run several /do plans in parallel, each in its own worktree.
+#
+# The layer above do-auto.sh: do-auto runs ONE plan's cycles in a worktree;
+# do-fleet picks the top-ranked, file-disjoint plans and launches a do-auto per
+# plan, concurrently. Ranking comes from do-rank.py. Merges are NOT automated —
+# each plan's do-auto writes its own .do-digest.md; a human lands them.
+#
+# v2: slot-pool queue. Starts up to --slots live plans; as each exits a new one
+# pops from the ranked queue (file-disjoint against the CURRENTLY live set).
+# Supports --slots 10 safely — the queue feeds slots as they free up.
+#
+# SAFETY (non-negotiable):
+#   - DRY-RUN by default. Real launch needs --go.
+#   - Hard --slots cap (default 3). Override with --slots N.
+#   - Conflict filter: greedy by score, skips any plan whose deliverable dirs
+#     overlap a currently-live plan. Re-checks on every pop (dynamic).
+#   - _link_deps symlinks node_modules + built sdk dist into each worktree.
+#   - One slug ⇒ one worktree. Refuses to schedule a slug already running.
+#   - Stall watchdog: kills any slot alive > STALL_TIMEOUT seconds, marks stalled.
+#
+# Usage:
+#   do-fleet.sh                      # dry-run, top 3 slots
+#   do-fleet.sh --slots 2 --go       # launch 2 at a time from queue
+#   do-fleet.sh --slots 10 --go      # 10-slot queue mode
+#   do-fleet.sh --top 40 --slots 10 --go
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+RANK="$ROOT/.claude/scripts/do-rank.py"
+AUTO="$ROOT/.claude/scripts/do-auto.sh"
+WT_BASE="$ROOT/.do-worktrees"
+
+GO=false
+SLOTS=3
+TOP=40
+STALL_TIMEOUT=1800   # 30 min — kill a stuck do-auto
+POLL=10              # seconds between slot checks
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --go)    GO=true; shift ;;
+    --slots|--max) SLOTS="$2"; shift 2 ;;
+    --top)   TOP="$2"; shift 2 ;;
+    --stall) STALL_TIMEOUT="$2"; shift 2 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+[ -f "$RANK" ] || { echo "do-fleet: missing $RANK" >&2; exit 1; }
+
+# Cap slots by (cores - 2), never exceed --slots.
+CORES=$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)
+CORE_CAP=$(( CORES - 2 )); [ "$CORE_CAP" -lt 1 ] && CORE_CAP=1
+[ "$SLOTS" -gt "$CORE_CAP" ] && SLOTS="$CORE_CAP"
+
+echo "[do-fleet] ranking… (top $TOP candidates, $SLOTS slots, $( $GO && echo LIVE || echo DRY-RUN ))"
+
+# Load ranked queue into an array (bash 3.2 compatible — no mapfile).
+QUEUE=()
+while IFS= read -r line; do [ -n "$line" ] && QUEUE+=("$line"); done \
+  < <(python3 "$RANK" --top "$TOP" 2>/dev/null)
+
+[ "${#QUEUE[@]}" -eq 0 ] && { echo "[do-fleet] no ready plans — nothing to do"; exit 0; }
+
+# --- helpers -------------------------------------------------------------------
+
+deliverable_dirs() {
+  # SINGLE source of truth: do-rank.py owns deliverable-path parsing + the subtree
+  # granularity. The fleet's live conflict check and the displayed waves now read the
+  # SAME extractor, so they can never drift (the old bash re-parser at top/second dir
+  # granularity disagreed with do-rank and serialized every one.ie/web plan).
+  python3 "$RANK" --dirs "$1" 2>/dev/null
+}
+
+link_deps() {
+  local wt="$1"
+  for nm in node_modules one.ie/web/node_modules packages/node_modules \
+            packages/sdk/dist packages/sdk/node_modules; do
+    if [ -e "$ROOT/$nm" ] && [ ! -e "$wt/$nm" ]; then
+      mkdir -p "$wt/$(dirname "$nm")"
+      ln -s "$ROOT/$nm" "$wt/$nm" 2>/dev/null && echo "    linked $nm" || true
+    fi
+  done
+}
+
+# Dynamic file-lock registry: "dir<TAB>slug" lines in a temp file.
+LOCK_FILE="$(mktemp)"
+trap 'rm -f "$LOCK_FILE"' EXIT
+
+claim_dirs() {   # claim_dirs <slug>
+  local n=0
+  while IFS= read -r d; do
+    [ -n "$d" ] && { printf '%s\t%s\n' "$d" "$1" >> "$LOCK_FILE"; n=$(( n + 1 )); }
+  done < <(deliverable_dirs "$1")
+  # An unscoped plan (no deliverables:) declares zero dirs — the conflict filter
+  # would treat it as disjoint from EVERYTHING and parallelize it blindly, which
+  # clobbers shared trees (one.ie/web). Claim the __ANY__ sentinel so it conflicts
+  # with any other plan: it only ever runs as the sole slot. Declare deliverables
+  # to make it fleet-safe (see do-rank.py UNSCOPED warning).
+  [ "$n" -eq 0 ] && printf '%s\t%s\n' "__ANY__" "$1" >> "$LOCK_FILE"
+}
+
+free_dirs() {    # free_dirs <slug>
+  local tmp; tmp="$(mktemp)"
+  grep -v "	$1$" "$LOCK_FILE" > "$tmp" 2>/dev/null || true
+  mv "$tmp" "$LOCK_FILE"
+}
+
+has_conflict() { # has_conflict <slug> → exit 0 if conflict
+  # A live unscoped plan holds the __ANY__ sentinel → nothing may share with it.
+  any_owner=$(awk -F'\t' '$1=="__ANY__"{print $2; exit}' "$LOCK_FILE" 2>/dev/null || true)
+  if [ -n "$any_owner" ] && [ "$any_owner" != "$1" ]; then
+    echo "  ✗ $1 — unscoped plan $any_owner holds the fleet (sole slot), deferring"
+    return 0
+  fi
+  # This plan is itself unscoped (no deliverable dirs) → only runs alone.
+  ndirs=$(deliverable_dirs "$1" | grep -c . || true)
+  if [ "$ndirs" -eq 0 ] && [ -s "$LOCK_FILE" ]; then
+    echo "  ✗ $1 — unscoped (no deliverables:), defers while any plan is live"
+    return 0
+  fi
+  while IFS= read -r d; do
+    [ -z "$d" ] && continue
+    owner=$(awk -F'\t' -v k="$d" '$1==k{print $2; exit}' "$LOCK_FILE" 2>/dev/null || true)
+    if [ -n "$owner" ]; then
+      echo "  ✗ $1 — dir $d locked by $owner, deferring"
+      return 0
+    fi
+  done < <(deliverable_dirs "$1")
+  return 1
+}
+
+launch_plan() {  # launch_plan <slug> → echoes PID
+  local slug="$1"
+  local wt="$WT_BASE/$slug"
+  if [ ! -d "$wt" ]; then
+    git -C "$ROOT" worktree add -b "do/$slug" "$wt" HEAD >/dev/null 2>&1 \
+      || git -C "$ROOT" worktree add "$wt" "do/$slug" >/dev/null 2>&1 || true
+  fi
+  link_deps "$wt"
+  claim_dirs "$slug"
+  echo "  ▶ launching $slug (log: $wt/.fleet.log)"
+  # Direct exec (no subshell wrapper) so $! is the do-auto.sh bash process itself.
+  # A ( cmd ) & subshell forks cmd and exits immediately — the fleet would track the
+  # subshell PID, which dies before cmd finishes, misreporting the slot as done.
+  "$AUTO" "$slug" >"$wt/.fleet.log" 2>&1 &
+  echo $!
+}
+
+# --- dry-run preview -----------------------------------------------------------
+if ! $GO; then
+  echo ""
+  echo "  DRY-RUN — first $SLOTS disjoint plans from queue:"
+  CLAIMED_DRY=""
+  COUNT=0
+  for slug in "${QUEUE[@]}"; do
+    [ "$COUNT" -ge "$SLOTS" ] && break
+    if [ -d "$WT_BASE/$slug" ]; then
+      if pgrep -f "do-auto.sh ${slug}" >/dev/null 2>&1; then
+        echo "  ~ $slug — do-auto already running, skipping"
+        continue
+      fi
+    fi
+    conflict=""
+    ndirs=$(deliverable_dirs "$slug" | grep -c . || true)
+    any_owner=$(printf '%s\n' "$CLAIMED_DRY" | awk -F'\t' '$1=="__ANY__"{print $2; exit}')
+    if [ -n "$any_owner" ]; then
+      echo "  ✗ $slug — unscoped plan $any_owner holds the fleet, deferring"
+      continue
+    fi
+    if [ "$ndirs" -eq 0 ] && [ -n "$CLAIMED_DRY" ]; then
+      echo "  ✗ $slug — unscoped (no deliverables:), defers while a plan is claimed"
+      continue
+    fi
+    while IFS= read -r d; do
+      [ -z "$d" ] && continue
+      owner=$(printf '%s\n' "$CLAIMED_DRY" | awk -F'\t' -v k="$d" '$1==k{print $2; exit}')
+      [ -n "$owner" ] && { conflict="$d ($owner)"; break; }
+    done < <(deliverable_dirs "$slug")
+    if [ -n "$conflict" ]; then
+      echo "  ✗ $slug — $conflict, deferring"
+      continue
+    fi
+    echo "  ✓ $slug"
+    if [ "$ndirs" -eq 0 ]; then
+      CLAIMED_DRY="$CLAIMED_DRY__ANY__	$slug
+"
+    else
+      while IFS= read -r d; do
+        [ -n "$d" ] && CLAIMED_DRY="$CLAIMED_DRY$d	$slug
+"
+      done < <(deliverable_dirs "$slug")
+    fi
+    COUNT=$(( COUNT + 1 ))
+  done
+  echo ""
+  echo "  Re-run with --go to launch. Queue depth: ${#QUEUE[@]} plans."
+  exit 0
+fi
+
+# --- LIVE: slot-pool queue loop ------------------------------------------------
+echo ""
+echo "[do-fleet] LIVE — $SLOTS slots, ${#QUEUE[@]} queued plans"
+echo "[do-fleet] stall watchdog: ${STALL_TIMEOUT}s · poll: ${POLL}s"
+echo ""
+
+# Parallel arrays (bash 3.2: no associative arrays).
+# SLOT_PIDS[i], SLOT_SLUGS[i], SLOT_START[i] track each live slot.
+SLOT_PIDS=()
+SLOT_SLUGS=()
+SLOT_START=()
+DONE_COUNT=0
+STALLED=()
+DONE_SLUGS=()   # slugs that finished or stalled — skip on every re-scan
+
+# Pop next eligible plan from QUEUE.
+# Scans from 0 on every call so deferred items (conflicts) are re-checked after each slot frees.
+# Skips SLOT_SLUGS (live) and DONE_SLUGS (finished/stalled).
+# Sets NEXT_SLUG or leaves it empty.
+pop_next() {
+  NEXT_SLUG=""
+  local i=0
+  while [ "$i" -lt "${#QUEUE[@]}" ]; do
+    local s="${QUEUE[$i]}"
+    i=$(( i + 1 ))
+    # Skip currently-live slugs.
+    local skip=false
+    if [ "${#SLOT_SLUGS[@]}" -gt 0 ]; then
+      for live in "${SLOT_SLUGS[@]}"; do
+        [ "$live" = "$s" ] && { skip=true; break; }
+      done
+    fi
+    $skip && continue
+    # Skip already-finished slugs.
+    if [ "${#DONE_SLUGS[@]}" -gt 0 ]; then
+      for ds in "${DONE_SLUGS[@]}"; do
+        [ "$ds" = "$s" ] && { skip=true; break; }
+      done
+    fi
+    $skip && continue
+    if [ -d "$WT_BASE/$s" ]; then
+      # Worktree exists — only skip if a live do-auto process is already running for it.
+      # (Worktrees from failed/stalled prior attempts are re-launchable — do-auto resumes them.)
+      if pgrep -f "do-auto.sh ${s}" >/dev/null 2>&1; then
+        echo "  ~ $s — do-auto already running, skipping"
+        continue
+      fi
+    fi
+    if has_conflict "$s" 2>/dev/null; then
+      continue
+    fi
+    NEXT_SLUG="$s"
+    return 0
+  done
+}
+
+# Fill empty slots from the queue.
+fill_slots() {
+  while [ "${#SLOT_PIDS[@]}" -lt "$SLOTS" ]; do
+    pop_next
+    [ -z "$NEXT_SLUG" ] && break
+    local pid; pid=$(launch_plan "$NEXT_SLUG")
+    SLOT_PIDS+=("$pid")
+    SLOT_SLUGS+=("$NEXT_SLUG")
+    SLOT_START+=("$(date +%s)")
+  done
+}
+
+# Initial fill.
+fill_slots
+
+[ "${#SLOT_PIDS[@]}" -eq 0 ] && {
+  echo "[do-fleet] no disjoint plans to launch — all candidates conflicted or in-flight"
+  exit 0
+}
+
+echo "[do-fleet] ${#SLOT_PIDS[@]} slot(s) live. PIDs: ${SLOT_PIDS[*]}"
+echo "[do-fleet] tail a plan:  tail -f .do-worktrees/<slug>/.fleet.log"
+echo ""
+
+# Event loop: poll until all slots empty and queue exhausted.
+while [ "${#SLOT_PIDS[@]}" -gt 0 ]; do
+  sleep "$POLL"
+
+  NEW_PIDS=()
+  NEW_SLUGS=()
+  NEW_START=()
+  for idx in "${!SLOT_PIDS[@]}"; do
+    pid="${SLOT_PIDS[$idx]}"
+    slug="${SLOT_SLUGS[$idx]}"
+    start="${SLOT_START[$idx]}"
+
+    if kill -0 "$pid" 2>/dev/null; then
+      # Still running — check stall.
+      now=$(date +%s)
+      age=$(( now - start ))
+      if [ "$age" -gt "$STALL_TIMEOUT" ]; then
+        echo "[do-fleet] ⚠ $slug stalled (${age}s > ${STALL_TIMEOUT}s) — killing PID $pid"
+        kill "$pid" 2>/dev/null || true
+        free_dirs "$slug"
+        STALLED+=("$slug")
+        DONE_SLUGS+=("$slug")
+        DONE_COUNT=$(( DONE_COUNT + 1 ))
+        echo "[do-fleet]   stalled: $slug"
+      else
+        NEW_PIDS+=("$pid")
+        NEW_SLUGS+=("$slug")
+        NEW_START+=("$start")
+      fi
+    else
+      # Finished.
+      DONE_COUNT=$(( DONE_COUNT + 1 ))
+      DONE_SLUGS+=("$slug")
+      free_dirs "$slug"
+      echo "[do-fleet] ✓ $slug exited (slot freed, $DONE_COUNT done)"
+    fi
+  done
+
+  SLOT_PIDS=(); [ "${#NEW_PIDS[@]}" -gt 0 ] && SLOT_PIDS=("${NEW_PIDS[@]}")
+  SLOT_SLUGS=(); [ "${#NEW_SLUGS[@]}" -gt 0 ] && SLOT_SLUGS=("${NEW_SLUGS[@]}")
+  SLOT_START=(); [ "${#NEW_START[@]}" -gt 0 ] && SLOT_START=("${NEW_START[@]}")
+
+  # Refill freed slots.
+  fill_slots
+
+  # Progress line.
+  live="${#SLOT_PIDS[@]}"
+  remaining=$(( ${#QUEUE[@]} - ${#DONE_SLUGS[@]} - live ))
+  echo "[do-fleet] live=$live · done=$DONE_COUNT · queued=$remaining"
+done
+
+echo ""
+echo "[do-fleet] all plans exited. $DONE_COUNT completed, ${#STALLED[@]} stalled."
+[ "${#STALLED[@]}" -gt 0 ] && echo "[do-fleet] stalled: ${STALLED[*]}"
+echo "[do-fleet] merges are NOT automated — review each .do-worktrees/<slug>/.do-digest.md; land one at a time."
+echo "[do-fleet] gc: after merging, run — .claude/scripts/do-auto.sh --gc"

package/scripts/do-killswitch-audit.py

@@ -0,0 +1,177 @@
+#!/usr/bin/env python3
+"""do-killswitch-audit.py — sweep every plan's kill-switch, sort it, give the
+loop real fuel. A kill-switch is only useful if it is hermetic, runnable, and
+honestly red-or-done. This finds the ones that aren't.
+
+Buckets:
+  PROD     — outcome hits prod/network (curl one.ie, wrangler, deploy) → needs-human
+  NONE     — no outcome: command → can't gate at all
+  BROKEN   — command can't run: stale `cd` path, missing script, ENOENT → fix the gate
+  GREEN    — passes NOW → work shipped; reconcile to DONE (tick boxes / log close)
+  ARMED    — red because the feature is unbuilt → THE LOOP'S FUEL
+  SLOW     — exceeded the run timeout → audit separately
+
+Static pass (instant, no execution): PROD / NONE / BROKEN(stale-cd) / HERMETIC.
+Dynamic pass (--run, bounded by --timeout): runs HERMETIC outcomes → GREEN/ARMED/BROKEN/SLOW.
+
+Usage:
+  do-killswitch-audit.py                 static only — instant, sorts every plan
+  do-killswitch-audit.py --run           also run hermetic outcomes (slow, real)
+  do-killswitch-audit.py --run --ready   only audit do-rank's READY set (the loop's candidates)
+  do-killswitch-audit.py --json [...]    machine output
+"""
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+TEXT = ROOT / "text"
+RANK = ROOT / ".claude" / "scripts" / "do-rank.py"
+
+# Network/prod markers. NOT bare `one.ie` — that's the `one.ie/web` LOCAL DIR, not
+# the host. Match real network refs: curl/wget, any URL, a SUBDOMAIN.one.ie
+# (api./pay./channels.one.ie), or deploy tooling.
+PROD = re.compile(r"\bcurl\b|\bwget\b|https?://|[a-z0-9-]+\.one\.ie|wrangler|deploy|--remote", re.I)
+BROKEN_OUT = re.compile(
+    r"not found|no such file|cannot find|command not found|ENOENT|"
+    r"cannot find module|is not a function|unknown command",
+    re.I,
+)
+EXCLUDE = {"template", "todo"}
+
+
+def parse_outcome(text):
+    m = re.match(r"^---\n(.*?)\n---", text, re.DOTALL)
+    body = m.group(1) if m else text
+    # block form: outcome: |  (indented lines follow). Strip a TRAILING backslash
+    # per line (shell line-continuation) before joining — else `test -f x \` +
+    # join makes `test -f x \ && …` which the shell mis-parses. Internal `\|`
+    # (grep alternation) is preserved (rstrip only the line end).
+    bm = re.search(r"^outcome:\s*\|\s*\n((?:[ \t]+.*\n?)+)", body, re.MULTILINE)
+    if bm:
+        lines = [re.sub(r"\\$", "", l.strip()) for l in bm.group(1).splitlines() if l.strip()]
+        return " ".join(lines).strip()
+    # inline form: outcome: "..."  or  outcome: ...
+    im = re.search(r'^outcome:\s*"?(.+?)"?\s*$', body, re.MULTILINE)
+    return im.group(1).strip() if im else ""
+
+
+def stale_cd(cmd):
+    """Walk the &&/; chain tracking cwd — `cd a && cd ../b` makes ../b relative
+    to a, not to root. Return the first cd target that doesn't exist, else None."""
+    cwd = ROOT
+    for seg in re.split(r"&&|;|\|", cmd):
+        m = re.search(r"\bcd\s+([^\s&|;]+)", seg)
+        if not m:
+            continue
+        t = m.group(1)
+        nxt = Path(t) if t.startswith("/") else (cwd / t)
+        try:
+            nxt = nxt.resolve()
+        except Exception:
+            return t
+        if not nxt.exists():
+            return t
+        cwd = nxt
+    return None
+
+
+def classify_static(outcome):
+    if not outcome:
+        return "NONE", "no kill-switch — can't gate"
+    if PROD.search(outcome):
+        return "PROD", "hits prod/network → needs-human"
+    bad = stale_cd(outcome)
+    if bad:
+        return "BROKEN", f"stale path: cd {bad}"
+    return "HERMETIC", "local — runnable"
+
+
+def run_outcome(outcome, timeout):
+    # shell=True is REQUIRED and contained here: kill-switches are compound shell
+    # commands (`cd x && bun test | jq …`) that cannot be arg-lists, and running
+    # them is this tool's entire purpose. Containment: (1) source is the repo's
+    # own trusted text/*-todo.md, not external input; (2) only outcomes already
+    # classified HERMETIC reach this — PROD/network (curl/deploy/wrangler) are
+    # filtered out by classify_static BEFORE any execution; (3) bounded timeout.
+    try:
+        r = subprocess.run(outcome, shell=True, cwd=str(ROOT),  # noqa: S602
+                           capture_output=True, text=True, timeout=timeout)
+    except subprocess.TimeoutExpired:
+        return "SLOW", f"exceeded {timeout}s"
+    except Exception as e:
+        return "BROKEN", f"spawn error: {e}"
+    if r.returncode == 0:
+        return "GREEN", "passes now → reconcile to DONE"
+    blob = (r.stderr or "") + (r.stdout or "")
+    if BROKEN_OUT.search(blob):
+        first = next((l for l in blob.splitlines() if BROKEN_OUT.search(l)), "")
+        return "BROKEN", f"errored: {first.strip()[:60]}"
+    return "ARMED", "red — unbuilt → FUEL"
+
+
+def main():
+    args = sys.argv[1:]
+    do_run = "--run" in args
+    as_json = "--json" in args
+    ready_only = "--ready" in args
+    timeout = 90
+    if "--timeout" in args:
+        timeout = int(args[args.index("--timeout") + 1])
+
+    slugs = None
+    if ready_only:
+        try:
+            out = subprocess.run([sys.executable, str(RANK), "--top", "200"],
+                                capture_output=True, text=True, cwd=str(ROOT))
+            slugs = set(out.stdout.split())
+        except Exception:
+            slugs = None
+
+    rows = []
+    for f in sorted(TEXT.glob("*-todo.md")):
+        slug = f.name[: -len("-todo.md")]
+        if slug in EXCLUDE:
+            continue
+        if slugs is not None and slug not in slugs:
+            continue
+        outcome = parse_outcome(f.read_text(errors="ignore"))
+        bucket, why = classify_static(outcome)
+        if do_run and bucket == "HERMETIC":
+            bucket, why = run_outcome(outcome, timeout)
+        rows.append({"slug": slug, "bucket": bucket, "why": why,
+                     "outcome": outcome[:70]})
+
+    order = ["ARMED", "GREEN", "BROKEN", "PROD", "SLOW", "HERMETIC", "NONE"]
+    rows.sort(key=lambda r: (order.index(r["bucket"]) if r["bucket"] in order else 9, r["slug"]))
+
+    if as_json:
+        buckets = {}
+        for r in rows:
+            buckets.setdefault(r["bucket"], []).append(r["slug"])
+        print(json.dumps({"buckets": buckets, "rows": rows}, indent=2))
+        return
+
+    counts = {}
+    for r in rows:
+        counts[r["bucket"]] = counts.get(r["bucket"], 0) + 1
+    mode = "DYNAMIC (ran outcomes)" if do_run else "STATIC (no execution)"
+    scope = "READY set only" if ready_only else "all plans"
+    print(f"\n  KILL-SWITCH AUDIT — {mode} · {scope}")
+    print("  " + " · ".join(f"{k}:{counts.get(k,0)}" for k in order if counts.get(k)))
+    print()
+    for r in rows:
+        tag = {"ARMED": "🔥", "GREEN": "✓", "BROKEN": "✗", "PROD": "⤫",
+               "SLOW": "⏱", "HERMETIC": "·", "NONE": "∅"}.get(r["bucket"], " ")
+        print(f"  {tag} {r['bucket']:9} {r['slug']:26} {r['why']}")
+    if not do_run:
+        print(f"\n  → re-run with --run to resolve HERMETIC into GREEN/ARMED/BROKEN")
+    else:
+        print(f"\n  🔥 ARMED = the loop's fuel. ✓ GREEN = reconcile to DONE. ✗ BROKEN = fix the gate.")
+    print()
+
+
+if __name__ == "__main__":
+    main()

package/scripts/do-learn-loop.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# do-learn-loop.sh — self-improving loop
+# Runs rubric across all packages, reads learnings, synthesises gap todos, fleets.
+# Called by the scheduled trigger every 2 hours.
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+echo "[learn-loop] $(date -u +%Y-%m-%dT%H:%M:%SZ) — starting self-improve pass"
+
+# 1. Baseline rubric
+echo "[learn-loop] running rubric across all packages..."
+python3 .claude/scripts/do-rubric.py --all 2>&1 | tee /tmp/rubric-snapshot.txt
+
+# 2. Extract failing axes (score < 0.80)
+echo "[learn-loop] extracting gaps..."
+python3 - <<'EOF'
+import re, sys
+
+with open('/tmp/rubric-snapshot.txt') as f:
+    text = f.read()
+
+# find lines like:  security        ████░░ 0.35  ×0.20
+gaps = []
+pkg = None
+for line in text.splitlines():
+    if 'CODE RUBRIC —' in line:
+        pkg = line.split('—')[1].strip().split()[0]
+    m = re.match(r'\s+(security|stability|simplicity|speed)\s+.*?(\d+\.\d+)\s+×', line)
+    if m and pkg:
+        axis, score = m.group(1), float(m.group(2))
+        if score < 0.80:
+            gaps.append((pkg, axis, score))
+
+if gaps:
+    print(f"[learn-loop] gaps found: {len(gaps)}")
+    for pkg, axis, score in sorted(gaps, key=lambda x: x[2]):
+        print(f"  {pkg} / {axis}: {score:.2f}")
+else:
+    print("[learn-loop] all axes ≥ 0.80 — no new gap todos needed")
+EOF
+
+# 3. Fleet any armed todos not yet in the queue
+echo "[learn-loop] running fleet..."
+bash .claude/scripts/do-fleet.sh --max 8 --go 2>&1 | tail -20
+
+# 4. Append to learnings
+echo "- $(date -u +%Y-%m-%d) · learn-loop · auto-pass · rubric swept + fleet run · source=loop" >> text/learnings.md
+
+echo "[learn-loop] done."