@oneie/claude 0.4.0 → 0.6.0

package/scripts/do-signal.sh

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# Internal: emit world:do-event signals at /do phase boundaries.
+# Called by do-auto.sh at cycle open, close, and halt. Not a user command.
+#
+# Usage:
+#   do-signal.sh [--print] <type> <slug> <tier> <cycle> [key=value ...]
+#
+# --print: write JSON to stdout without POSTing (tests + dry runs).
+# Extra key=value pairs are merged into the payload.
+#   axis=security,structure  → adds s:security + s:structure tags + "axis" field
+#   composite=0.82           → numeric field (no quotes)
+#   wave=W3                  → string field
+#   deliverable=...          → string field
+#
+# Env overrides:
+#   DO_SIGNAL_URL  default: https://one.ie
+#   DO_ENV_FILE    default: one.ie/web/.env  (read SERVER_SECRET for auth)
+#
+# Signal failure never blocks the build loop — callers wrap with `|| true`.
+set -euo pipefail
+
+PRINT=false
+DO_ENV_FILE="${DO_ENV_FILE:-one.ie/web/.env}"
+DO_SIGNAL_URL="${DO_SIGNAL_URL:-https://one.ie}"
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --print) PRINT=true; shift ;;
+    *) break ;;
+  esac
+done
+
+if [ "$#" -lt 4 ]; then
+  echo "usage: do-signal.sh [--print] <type> <slug> <tier> <cycle> [key=value ...]" >&2
+  exit 1
+fi
+
+TYPE="$1"; SLUG="$2"; TIER="$3"; CYCLE="$4"; shift 4
+
+# Core tags — all match ^(do|tier|slug|cycle|s):
+TAGS="\"do:cycle\",\"slug:${SLUG}\",\"tier:${TIER}\",\"cycle:${CYCLE}\""
+case "$TYPE" in
+  aim)    TAGS="${TAGS},\"do:aim\""                 ;;
+  wave)   TAGS="${TAGS},\"do:wave\",\"do:build\""   ;;
+  verify) TAGS="${TAGS},\"do:verify\""              ;;
+  learn)  TAGS="${TAGS},\"do:learn\""               ;;
+  halt)   TAGS="${TAGS},\"do:halt\""                ;;
+esac
+
+# Parse extra key=value pairs into the payload.
+EXTRA_JSON=""
+for kv in "$@"; do
+  k="${kv%%=*}"; v="${kv#*=}"
+  case "$k" in
+    axis)
+      # comma-list → s:* tags + "axis" field
+      _a="${v}"
+      while [ -n "$_a" ]; do
+        _item="${_a%%,*}"
+        TAGS="${TAGS},\"s:${_item}\""
+        [ "$_a" = "$_item" ] && break
+        _a="${_a#*,}"
+      done
+      EXTRA_JSON="${EXTRA_JSON},\"axis\":\"${v}\""
+      ;;
+    composite)
+      EXTRA_JSON="${EXTRA_JSON},\"${k}\":${v}"
+      ;;
+    *)
+      EXTRA_JSON="${EXTRA_JSON},\"${k}\":\"${v}\""
+      ;;
+  esac
+done
+
+PAYLOAD="{\"type\":\"${TYPE}\",\"slug\":\"${SLUG}\",\"tier\":\"${TIER}\",\"cycle\":${CYCLE},\"tags\":[${TAGS}]${EXTRA_JSON}}"
+
+if $PRINT; then
+  printf '%s\n' "$PAYLOAD"
+  exit 0
+fi
+
+# Read SERVER_SECRET for the Authorization header — first file that has it wins.
+# .env historically lacks it; .secrets.generated.local is what push-prod-secrets.sh
+# pushed to the worker, so it matches prod. Without a matching secret the POST is
+# silently 401/403-dropped at the gateway (verified 2026-07-04 — zero do-* threads
+# had ever landed in prod D1).
+_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+SERVER_SECRET=""
+for _f in "$DO_ENV_FILE" "$_ROOT/one.ie/web/.env" "$_ROOT/one.ie/web/.secrets.generated.local" "$_ROOT/one.ie/web/.dev.vars"; do
+  [ -f "$_f" ] || continue
+  SERVER_SECRET=$(grep -E '^SERVER_SECRET=' "$_f" 2>/dev/null | head -1 | sed 's/^[^=]*=//;s/^"//;s/"$//' || true)
+  [ -n "$SERVER_SECRET" ] && break
+done
+
+# POST — fire-and-forget; failures are silent so the build loop is never blocked.
+_url="${DO_SIGNAL_URL}/api/signal/world:do-event"
+if [ -n "$SERVER_SECRET" ]; then
+  # Token off argv (a bare -H "Authorization: Bearer ..." leaks via `ps aux` to any
+  # local user for the life of the process) — write a private, one-shot curl config.
+  _authcfg="$(mktemp)"
+  chmod 600 "$_authcfg"
+  printf 'header = "Authorization: Bearer %s"\n' "$SERVER_SECRET" > "$_authcfg"
+  curl -sf -X POST "$_url" \
+    -H "Content-Type: application/json" \
+    --config "$_authcfg" \
+    -d "$PAYLOAD" >/dev/null 2>&1 || true
+  rm -f "$_authcfg"
+else
+  curl -sf -X POST "$_url" \
+    -H "Content-Type: application/json" \
+    -d "$PAYLOAD" >/dev/null 2>&1 || true
+fi

package/scripts/do-smoke.sh

@@ -17,6 +17,9 @@ echo "== C0 do-folder =="
 echo "== C7 do-tier =="
 "$S/do-tier.sh" text/x.md | grep -q '"tier":"PATCH"' && ok "typo → PATCH" || no "PATCH"
 "$S/do-tier.sh" schema/one.tql | grep -q '"tier":"SCHEMA"' && ok ".tql → SCHEMA" || no "SCHEMA"
+"$S/do-tier.sh" channels/migrations/0001_init.sql | grep -q '"tier":"SCHEMA"' && ok "D1 migration → SCHEMA" || no "D1 migration"
+"$S/do-tier.sh" pay/contracts/sui/sources/one_token.move | grep -q '"tier":"SCHEMA"' && ok "contract source → SCHEMA" || no "contract source"
+"$S/do-tier.sh" pay/contracts/sui/tests/gateway_tests.move | grep -q '"tier":"FIX"' && ok "contract test → FIX (not SCHEMA)" || no "contract test"
 "$S/do-tier.sh" --intent "add billing" one.ie/web/src/api/b.ts | grep -q '"tier":"FEATURE"' && ok "intent → FEATURE" || no "FEATURE"
 
 echo "== C2 do-reconcile — substrate canon =="
@@ -97,6 +100,11 @@ echo "== /do-loop removed (single front door) =="
 if grep -rn '/do-loop' .claude/commands .claude/agents 2>/dev/null | grep -vq 'no separate'; then no "/do-loop still referenced"; else ok "/do-loop gone (only the 'no separate' note)"; fi
 [ -f .claude/commands/do.md ] && ok "do.md is the spec (single front door)" || no "do.md missing"
 
+echo "== do-auto merge digest wired =="
+grep -q '^_merge_digest()' "$S/do-auto.sh" && ok "_merge_digest defined" || no "_merge_digest missing"
+grep -qE '^_merge_digest$' "$S/do-auto.sh" && ok "_merge_digest called at plan-complete" || no "_merge_digest never called"
+grep -q '\.do-digest\.md' .gitignore && ok ".do-digest.md gitignored (ephemeral)" || no ".do-digest.md not ignored"
+
 echo "----"
 if [ "$fail" -ne 0 ]; then echo "do-smoke: FAIL"; exit 1; fi
 echo "do-smoke: PASS — all canon fixtures green, navigation self-test green, do-prove pure."; exit 0

package/scripts/do-tasks-bridge.py

@@ -0,0 +1,366 @@
+#!/usr/bin/env python3
+"""do-tasks-bridge — make /do an actor in the world's task queue (tasks-integration Wire B).
+
+The /do build queue (do-rank.py over text/*-todo.md + task-paths.json) and the world's
+task queue (tasks:announce / tasks:mine, subscriptions in D1) are two views of one thing.
+This bridge reconciles them in three directions:
+
+  C1 EMIT       do-rank's OPEN tasks → tasks:announce payloads (humans + agents see the
+                build queue; a saved lens / subscription then routes them — tasks-push). ✓
+  C2 INGEST     world tasks tagged with build-words → do-rank's pick (anyone can post
+                build work and /do will consider it).                             ✓
+  C3 RECONCILE  the local weight tier (task-paths.json path.strength) and the substrate
+                tier (path-context.context-strength) become ONE number.           ✓
+
+`--selftest` asserts ALL THREE — the plan-level kill-switch in text/tasks-bridge-todo.md.
+
+Design: text/tasks-integration.md § Wire B · text/loop-plan.md (task-paths.json ⇄ path.strength).
+"""
+import json
+import os
+import subprocess
+import sys
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+DO_RANK = HERE / "do-rank.py"
+ROOT = HERE.parents[1]
+
+# Tags that route world tasks into /do's pick.  Must intersect a world task's tags.
+BUILD_WORDS = frozenset({
+    "builds", "build", "loop", "do", "tasks", "engine", "cycles",
+    "work", "code", "dev", "infrastructure", "platform",
+})
+
+
+# ── C1 EMIT — do-rank open tasks → tasks:announce payloads ────────────────────
+
+def tasks_json():
+    """The do-rank task seed (the JSON contract this bridge consumes). One source of
+    truth for the open-task set + their tags + learned weight — never re-parsed here."""
+    out = subprocess.run(
+        [sys.executable, str(DO_RANK), "--tasks-json"],
+        capture_output=True, text=True, check=True,
+    ).stdout
+    return json.loads(out)
+
+
+def emit_payloads(seed):
+    """Map do-rank's OPEN tasks to tasks:announce payloads. The shape matches the
+    resolver contract in one.ie/web/src/lib/resolvers/subscriptions.ts:
+        { taskId, tags[], title?, payload? }
+    Blocked tasks are excluded — they are not yet actionable, so announcing them would
+    wake a worker for work it cannot start. Weight rides in the payload (the receiver
+    fans by tag; the weight is what tasks:mine later ranks by)."""
+    payloads = []
+    for t in seed.get("tasks", []):
+        if t.get("taskStatus") != "open":
+            continue
+        tags = [x for x in t.get("tag", []) if x]
+        if not tags:
+            continue  # a task with no words can reach no follower — skip
+        payloads.append({
+            "taskId": t.get("tid", ""),
+            "tags": tags,
+            "title": t.get("name", ""),
+            "weight": t.get("weight", 50),
+            "dept": t.get("dept", ""),
+        })
+    return payloads
+
+
+# ── C2 INGEST — world tasks (by build-word) → do-rank queue ───────────────────
+
+def ingest(world_tasks):
+    """Filter world tasks tagged with build-words into do-rank-compatible task dicts.
+
+    world_tasks: list of task dicts in the tasks:mine / tasks:announce shape:
+        { id: str, name: str, tags: [str], weight: int, status?: str }
+    Returns: list of do-rank task dicts (tid, name, tag, taskStatus, weight, dept)
+        ready to be merged into do-rank's pick alongside local text/*-todo.md tasks.
+
+    Only tasks whose tags intersect BUILD_WORDS reach /do's queue.  Blocked tasks
+    and tag-less tasks are already excluded by the world-side resolver; this filter
+    adds the semantic gate (build-domain only, not sales/service/etc.).
+    """
+    result = []
+    for t in world_tasks:
+        tags = [x for x in t.get("tags", []) if x]
+        if not any(w in BUILD_WORDS for w in tags):
+            continue  # no build-word → not for /do's pick
+        result.append({
+            "tid": t.get("id", ""),
+            "name": t.get("name", ""),
+            "tag": tags,
+            "taskStatus": t.get("status", "open"),
+            "weight": t.get("weight", 50),
+            "dept": "builds",  # world build-word tasks land in builds dept
+        })
+    return result
+
+
+# ── C3 RECONCILE — task-paths.json ⇄ substrate path-context.context-strength ──
+
+_RECONCILE_TOLERANCE = 0.05  # divergence below this is noise — don't write
+
+def reconcile(local, substrate):
+    """Merge local task-paths.json strength with substrate context-strength into one number.
+
+    local:     { "task:<slug>": {strength, resistance, traversals, closed} }
+               — the on-disk tier written by do-rank.py --mark / --sync-closes
+    substrate: { word: context_strength }
+               — from TypeDB path-context.context-strength via readContextStrength()
+               (subscriptions.ts:144), keyed by the word the path-context entity carries
+
+    Strategy: for each local task, derive its implied substrate score by looking up the
+    max context-strength across the words in its slug.  If substrate_score > local net
+    strength (closed + strength − resistance), raise local.strength so both tiers agree
+    and the next do-rank pick reflects the substrate's learned knowledge.
+
+    Returns a copy of `local` with updated `strength` fields.  The caller is responsible
+    for writing it back to task-paths.json (do-rank.py --sync-closes idiom).
+
+    Unidirectional: substrate → local only.  The reverse direction (local → substrate)
+    happens via do-rank.py --mark which calls mark() over HTTP, already shipped.
+    """
+    merged = {k: dict(v) for k, v in local.items()}  # shallow-copy each entry
+
+    for key, entry in merged.items():
+        # key shape: "task:<slug>" — split slug words (hyphen-separated)
+        slug = key[len("task:"):] if key.startswith("task:") else key
+        slug_words = [w for w in slug.replace("-", " ").split() if w]
+
+        substrate_scores = [substrate[w] for w in slug_words if w in substrate]
+        if not substrate_scores:
+            continue
+
+        substrate_strength = max(substrate_scores)
+        local_net = (
+            float(entry.get("closed", 0))
+            + float(entry.get("strength", 0))
+            - float(entry.get("resistance", 0))
+        )
+
+        if substrate_strength > local_net + _RECONCILE_TOLERANCE:
+            # Substrate learned this word is stronger than local records — sync up
+            entry["strength"] = round(
+                max(float(entry.get("strength", 0)), substrate_strength), 3
+            )
+
+    return merged
+
+
+# ── send — do-rank's OPEN tasks → delivered tasks:announce calls (code-signals wire 3) ──
+# Same auth + identity pairing as .claude/hooks/lib/signal.sh's emit_world (see
+# text/code-signals-plan.md): the local dev server reads secrets from .dev.vars (a
+# DIFFERENT value than .env — verified 2026-07-02), so which file to read must match
+# ONE_API_URL's target. slug:"one" + board:"marketplace" let this service-nominated
+# sender reach a subscriber registered under a different actor (fanOut never delivers
+# to its own sender — tag-match.ts).
+
+def _one_env_file():
+    override = os.environ.get("DO_ENV_FILE")
+    if override:
+        return Path(override)
+    url = os.environ.get("ONE_API_URL", "http://localhost:4321")
+    web = ROOT / "one.ie" / "web"
+    return web / ".dev.vars" if ("localhost" in url or "127.0.0.1" in url) else web / ".env"
+
+
+def _one_secret(name):
+    val = os.environ.get(name)
+    if val:
+        return val
+    f = _one_env_file()
+    if not f.is_file():
+        return ""
+    prefix = f"{name}="
+    for line in f.read_text().splitlines():
+        if line.startswith(prefix):
+            return line[len(prefix):].strip().strip('"')
+    return ""
+
+
+def tag_for_bridge(payload):
+    """Append 'cc' to a payload's tags (dedup, order-preserving) — marks it as a
+    code-signal, so the standing ['cc','session'] subscription (wire 2) catches wire 3's
+    task announces too, without widening what the subscription itself follows."""
+    tags = list(dict.fromkeys([*payload.get("tags", []), "cc"]))
+    return {**payload, "tags": tags, "slug": "one", "board": "marketplace"}
+
+
+def send_payloads(payloads, dry_run=False):
+    """POST each payload to tasks:announce. Returns one result dict per payload —
+    either the parsed {outcome,result:{ok,matched,...}} response, or {"dry_run":True,
+    "payload":...} when dry_run (no network, provable by inspection)."""
+    url = os.environ.get("ONE_API_URL", "http://localhost:4321") + "/api/ask/tasks:announce"
+    api_key = _one_secret("GATEWAY_API_KEY") if not dry_run else ""
+    results = []
+    for payload in payloads:
+        tagged = tag_for_bridge(payload)
+        if dry_run:
+            results.append({"dry_run": True, "payload": tagged})
+            continue
+        headers = {"Content-Type": "application/json"}
+        if api_key:
+            headers["Authorization"] = f"Bearer {api_key}"
+        req = urllib.request.Request(
+            url, data=json.dumps({"data": tagged}).encode(), method="POST", headers=headers,
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=5) as resp:
+                results.append(json.loads(resp.read().decode()))
+        except urllib.error.URLError as e:
+            results.append({"error": str(e)})
+    return results
+
+
+# ── selftest — the plan kill-switch (all three; RED until C3) ─────────────────
+
+def _check_emit():
+    """Emit round-trip on a fixture in the do-rank --tasks-json contract shape."""
+    seed = {
+        "tasks": [
+            {"tid": "task:alpha", "name": "Alpha", "tag": ["builds", "loop"],
+             "taskStatus": "open", "weight": 72, "dept": "builds"},
+            {"tid": "task:beta", "name": "Beta", "tag": ["sales"],
+             "taskStatus": "blocked", "weight": 50, "dept": "sales"},      # excluded (blocked)
+            {"tid": "task:gamma", "name": "Gamma", "tag": [],
+             "taskStatus": "open", "weight": 50, "dept": "builds"},        # excluded (no words)
+        ],
+    }
+    out = emit_payloads(seed)
+    if len(out) != 1:
+        return False, f"expected 1 open+tagged payload, got {len(out)}"
+    p = out[0]
+    if p["taskId"] != "task:alpha":
+        return False, f"wrong task emitted: {p['taskId']}"
+    if set(p["tags"]) != {"builds", "loop"}:
+        return False, f"tags not preserved: {p['tags']}"
+    if p["weight"] != 72:
+        return False, f"weight not preserved: {p['weight']}"
+    # contract: every payload carries the fields tasks:announce requires
+    if not (p["taskId"] and p["tags"]):
+        return False, "payload missing taskId/tags (tasks:announce contract)"
+    return True, "emit: open+tagged tasks → tasks:announce payloads, weight preserved"
+
+
+def _check_ingest():
+    world = [
+        # ✓ build-word hit → ingested
+        {"id": "world:1", "name": "Build the loop", "tags": ["builds", "loop"], "weight": 80, "status": "open"},
+        # ✗ no build-word → excluded
+        {"id": "world:2", "name": "Sales email", "tags": ["sales", "email"], "weight": 60, "status": "open"},
+        # ✓ build-word hit → ingested
+        {"id": "world:3", "name": "Coding tasks", "tags": ["code", "tasks"], "weight": 70, "status": "open"},
+        # ✗ no tags → excluded
+        {"id": "world:4", "name": "Empty", "tags": [], "weight": 50, "status": "open"},
+    ]
+    out = ingest(world)
+    if len(out) != 2:
+        return False, f"expected 2 build-word tasks, got {len(out)}: {[t['tid'] for t in out]}"
+    tids = {t["tid"] for t in out}
+    if tids != {"world:1", "world:3"}:
+        return False, f"wrong tasks ingested: {tids}"
+    if any(t["dept"] != "builds" for t in out):
+        return False, f"dept not 'builds' for all: {[t['dept'] for t in out]}"
+    return True, "ingest: build-word tasks selected + shaped, non-build + no-tag excluded"
+
+
+def _check_reconcile():
+    local = {
+        # local_net = 0.5 + 1.0 - 0.5 = 1.0 ; substrate max(loop=3.5) = 3.5 → update
+        "task:loop-plan": {"strength": 1.0, "resistance": 0.5, "traversals": 3, "closed": 0.5},
+        # local_net = 2.0 + 0.0 - 0.0 = 2.0 ; substrate max(tasks=2.0) = 2.0 → within tolerance, no-op
+        "task:tasks-bridge": {"strength": 0.0, "resistance": 0.0, "traversals": 0, "closed": 2.0},
+        # no substrate entry for any word → unchanged
+        "task:pay-links": {"strength": 0.5, "resistance": 0.0, "traversals": 1, "closed": 0.0},
+    }
+    substrate = {"loop": 3.5, "plan": 0.5, "tasks": 2.0, "bridge": 1.5}
+    merged = reconcile(local, substrate)
+
+    lp = merged.get("task:loop-plan", {})
+    if lp.get("strength", 0) < 3.0:
+        return False, f"loop-plan strength not raised from substrate: {lp}"
+    tb = merged.get("task:tasks-bridge", {})
+    if tb.get("strength", 0) != 0.0:
+        return False, f"tasks-bridge strength should be unchanged (within tolerance): {tb}"
+    pl = merged.get("task:pay-links", {})
+    if pl.get("strength") != 0.5:
+        return False, f"pay-links strength should be unchanged (no substrate word): {pl}"
+    return True, "reconcile: substrate-stronger words raise local tier; equal/weaker and no-match are untouched"
+
+
+def selftest():
+    checks = [
+        ("emit", _check_emit()),
+        ("ingest", _check_ingest()),
+        ("reconcile", _check_reconcile()),
+    ]
+    passed = 0
+    for name, (ok, msg) in checks:
+        print(f"  {'✓' if ok else '✗'} {name:<10} {msg}")
+        passed += 1 if ok else 0
+    print(f"SELFTEST: {passed}/{len(checks)} pass "
+          f"({'bridge complete' if passed == len(checks) else 'C2 ingest + C3 reconcile remain'})")
+    return 0 if passed == len(checks) else 1
+
+
+def main():
+    args = sys.argv[1:]
+    if "--selftest" in args:
+        sys.exit(selftest())
+    if "--emit" in args:
+        print(json.dumps(emit_payloads(tasks_json()), indent=2))
+        return
+    if "--send" in args:
+        dry_run = "--dry-run" in args
+        payloads = emit_payloads(tasks_json())
+        if not payloads:
+            print("[]")
+            print("send: 0 open+tagged task(s) — nothing to announce", file=sys.stderr)
+            return
+        results = send_payloads(payloads, dry_run=dry_run)
+        print(json.dumps(results, indent=2))
+        if not dry_run:
+            ok = sum(
+                1 for r in results
+                if isinstance(r, dict) and r.get("outcome") == "result" and r.get("result", {}).get("ok")
+            )
+            print(f"send: {ok}/{len(results)} task(s) announced ok", file=sys.stderr)
+        return
+    if "--ingest" in args:
+        # Read world tasks from stdin (JSON array) or print usage
+        try:
+            world_tasks = json.load(sys.stdin)
+        except (json.JSONDecodeError, ValueError) as e:
+            print(f"error: --ingest reads a JSON array of world tasks from stdin: {e}", file=sys.stderr)
+            sys.exit(1)
+        print(json.dumps(ingest(world_tasks), indent=2))
+        return
+    if "--reconcile" in args:
+        # Read substrate context-strength map from stdin: {"word": strength}
+        try:
+            substrate = json.load(sys.stdin)
+        except (json.JSONDecodeError, ValueError) as e:
+            print(f"error: --reconcile reads a JSON {{word: strength}} map from stdin: {e}", file=sys.stderr)
+            sys.exit(1)
+        from pathlib import Path as _P
+        task_paths_file = _P(__file__).resolve().parents[2] / "text" / "task-paths.json"
+        try:
+            local = json.loads(task_paths_file.read_text())
+        except (FileNotFoundError, ValueError):
+            local = {}
+        merged = reconcile(local, substrate)
+        task_paths_file.write_text(json.dumps(merged, indent=2, sort_keys=True) + "\n")
+        changed = sum(1 for k in merged if merged[k].get("strength") != local.get(k, {}).get("strength"))
+        print(f"reconciled {changed} task(s) from substrate context-strength → {task_paths_file.name}")
+        return
+    print(__doc__)
+    print("usage: do-tasks-bridge.py [--emit | --send [--dry-run] | --ingest | --reconcile | --selftest]")
+
+
+if __name__ == "__main__":
+    main()

package/scripts/do-tier.sh

@@ -18,7 +18,13 @@ schema=false; code=false; doconly=true
 for p in "${paths[@]}"; do
   case "$p" in
     *.tql|schema/*) schema=true; code=true; doconly=false ;;
-    *.md|.claude/*|text/*|text/*|docs/*) ;;
+    # Persistent-shape + irreversible surfaces escalate like schema: an applied
+    # D1 migration is append-only and a deployed contract can't be patched, so
+    # a wrong shape here taxes every future cycle the same way a .tql one does.
+    */migrations/*.sql|migrations/*.sql) schema=true; code=true; doconly=false ;;
+    */tests/*.move) code=true; doconly=false ;;  # contract tests are code, not shape
+    *.move|*.sol) schema=true; code=true; doconly=false ;;
+    *.md|.claude/*|text/*|docs/*) ;;
     "") ;;
     *) code=true; doconly=false ;;
   esac
@@ -33,11 +39,18 @@ elif ! $code; then tier=FIX
 else tier=FIX
 fi
 
+# w2_model — who decides. SCHEMA verdicts compound across the whole substrate
+# (one wrong entity shape taxes every future cycle), so W2 escalates to Fable
+# whenever FABLE_AVAILABLE=on (restored 2026-07-04; set in settings.json's env
+# block) — falls back to Opus if that var is ever unset again. The plan can
+# still override per-cycle.
+W2_SCHEMA=opus
+[ "${FABLE_AVAILABLE:-off}" = "on" ] && W2_SCHEMA=fable
 case "$tier" in
-  PATCH)   spine="code verify";                                            cls=TRIVIAL; ceil=5000 ;;
-  FIX)     spine="survey code tests proof";                               cls=SIMPLE;  ceil=30000 ;;
-  FEATURE) spine="promise survey spec clarify todo analyze code tests proof docs release"; cls=COMPLEX; ceil=150000 ;;
-  SCHEMA)  spine="promise survey spec reconcile clarify todo analyze code tests proof docs release"; cls=COMPLEX; ceil=200000 ;;
+  PATCH)   spine="code verify";                                            cls=TRIVIAL; ceil=5000;   w2=opus ;;
+  FIX)     spine="survey code tests proof";                               cls=SIMPLE;  ceil=30000;  w2=opus ;;
+  FEATURE) spine="promise survey spec clarify todo analyze code tests proof docs release"; cls=COMPLEX; ceil=150000; w2=opus ;;
+  SCHEMA)  spine="promise survey spec reconcile clarify todo analyze code tests proof docs release"; cls=COMPLEX; ceil=200000; w2="$W2_SCHEMA" ;;
 esac
 
-printf '{"tier":"%s","spine":"%s","classifier":"%s","ceiling_tokens":%s}\n' "$tier" "$spine" "$cls" "$ceil"
+printf '{"tier":"%s","spine":"%s","classifier":"%s","ceiling_tokens":%s,"w2_model":"%s"}\n' "$tier" "$spine" "$cls" "$ceil" "$w2"

package/scripts/do-validate-armed.py

@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+"""do-validate-armed.py — the deeper pass. For each ARMED∩ready plan, run its
+kill-switch and READ the failure to tell real fuel from a broken gate:
+
+  GENUINE-ARMED — the test runner RAN and tests failed (or the deliverable file
+                  is plainly absent) → the loop can build this.
+  BROKEN-GATE   — the runner couldn't start (no vitest, missing module, no test
+                  files, stale import) → fix the gate, don't build.
+  NOW-GREEN     — exits 0 on re-run (flaky/state) → reconcile to done.
+  UNCLEAR       — needs a human eye; evidence printed.
+
+Reads ARMED from /tmp/ksaudit.json, READY from do-rank. Bounded per-plan timeout.
+"""
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+TEXT = ROOT / "text"
+RANK = ROOT / ".claude" / "scripts" / "do-rank.py"
+AUDIT = Path("/tmp/ksaudit.json")
+TIMEOUT = 50
+
+# the runner actually executed tests (⇒ failures are real ⇒ armed)
+RAN = re.compile(r"\d+\s+(pass|fail)|Tests?\s+\d|expect\(|✓|✗|FAIL |PASS |"
+                 r"\bAssertionError\b|toBe|toEqual|\d+\s+passing|\d+\s+failing", re.I)
+# the gate couldn't even start (⇒ broken)
+BROKE = re.compile(r"not found|no such file|cannot find module|script not found|"
+                   r"no test (files? )?found|cannot find package|error: cannot find|"
+                   r"unknown command|is not a function|command not found|"
+                   r"failed to (load|resolve)|ERR_MODULE", re.I)
+
+
+def parse_outcome(text):
+    m = re.match(r"^---\n(.*?)\n---", text, re.DOTALL)
+    body = m.group(1) if m else text
+    bm = re.search(r"^outcome:\s*\|\s*\n((?:[ \t]+.*\n?)+)", body, re.MULTILINE)
+    if bm:
+        # strip trailing line-continuation backslash before joining (keep \| escapes)
+        lines = [re.sub(r"\\$", "", l.strip()) for l in bm.group(1).splitlines() if l.strip()]
+        return " ".join(lines).strip()
+    im = re.search(r'^outcome:\s*"?(.+?)"?\s*$', body, re.MULTILINE)
+    return im.group(1).strip() if im else ""
+
+
+def main():
+    armed = set(json.load(open(AUDIT))["buckets"].get("ARMED", []))
+    rank = json.loads(subprocess.run([sys.executable, str(RANK), "--json"],
+                                     capture_output=True, text=True, cwd=str(ROOT)).stdout)
+    ready = {p["slug"]: p for p in rank["ready"]}
+    cands = sorted([s for s in armed if s in ready], key=lambda s: -ready[s]["score"])
+
+    results = []
+    for slug in cands:
+        outcome = parse_outcome((TEXT / f"{slug}-todo.md").read_text(errors="ignore"))
+        try:
+            # shell=True contained: ARMED is hermetic-by-construction (the audit
+            # only reaches ARMED by running a hermetic outcome; prod/network is
+            # filtered upstream), source is trusted in-repo, timeout-bounded.
+            r = subprocess.run(outcome, shell=True, cwd=str(ROOT),  # noqa: S602
+                               capture_output=True, text=True, timeout=TIMEOUT)
+            blob = (r.stdout or "") + (r.stderr or "")
+            if r.returncode == 0:
+                verdict, ev = "NOW-GREEN", "exits 0 on re-run"
+            elif RAN.search(blob) and not BROKE.search(blob.split("\n")[0]):
+                verdict = "GENUINE-ARMED"
+                m = re.search(r"(\d+\s+fail\w*|\d+\s+failing|FAIL[^\n]{0,50})", blob, re.I)
+                ev = (m.group(1) if m else "tests ran and failed").strip()
+            elif BROKE.search(blob):
+                verdict = "BROKEN-GATE"
+                m = BROKE.search(blob)
+                line = next((l for l in blob.splitlines() if BROKE.search(l)), "")
+                ev = line.strip()[:70]
+            else:
+                verdict, ev = "UNCLEAR", (blob.strip().splitlines()[-1][:70] if blob.strip() else "no output")
+        except subprocess.TimeoutExpired:
+            verdict, ev = "SLOW", f">{TIMEOUT}s"
+        except Exception as e:
+            verdict, ev = "ERROR", str(e)[:60]
+        results.append({"slug": slug, "score": ready[slug]["score"],
+                        "priority": ready[slug]["priority"], "verdict": verdict, "evidence": ev})
+        print(f"  {verdict:14} {slug:24} score={results[-1]['score']:>3}  {ev}", flush=True)
+
+    json.dump(results, open("/tmp/armed_validated.json", "w"), indent=2)
+    fuel = [r["slug"] for r in results if r["verdict"] == "GENUINE-ARMED"]
+    print(f"\n  REAL FUEL ({len(fuel)}): {', '.join(fuel) or 'none'}")
+    print(f"  broken gates: {', '.join(r['slug'] for r in results if r['verdict']=='BROKEN-GATE') or 'none'}")
+
+
+if __name__ == "__main__":
+    main()