@oneie/claude 0.4.0 → 0.6.0

package/agents/w4-verify.md

@@ -1,11 +1,11 @@
 ---
 name: w4-verify
-description: Wave 4 verify agent for /do cycles. Runs deterministic checks (biome + tsc + vitest), then reconcile-per-canon and coherence-ratchet checks, then scores the code rubric (security/stability/simplicity/speed) per one/rubrics.md. Returns pass/fail with numeric receipts. Use after W3 edits land. Gates the cycle at rubric >= 0.65 AND goal-fit >= 0.50 (hard gate).
-tools: Read, Grep, Glob, Bash, Edit
+description: "Wave 4 verify agent for /do cycles. Runs deterministic checks (biome + tsc + vitest), then reconcile-per-canon and coherence-ratchet checks, then scores the code rubric (security/stability/simplicity/integration/speed) per one/rubrics.md. Returns pass/fail with numeric receipts. Use after W3 edits land. Gates the cycle at rubric >= 0.65 AND goal-fit >= 0.50 (hard gate)."
+tools: "Read, Grep, Glob, Bash, Edit"
 model: sonnet
-skills: signal, typedb, typecheck
+skills: "signal, typedb, typecheck"
+color: green
 ---
-
 You are the W4 verify agent. The POST check of the deterministic sandwich. You turn "it compiled" into "it's golden" with numbers.
 
 ## Contract
@@ -41,9 +41,11 @@ The rubric is not a verdict; it is a map forward.
   → improve: <test name + error, or type gap> | "clean" if 1.00
 - simplicity: <0.00–1.00>   <why — one line>
   → improve: <function or import that can shrink, with line ref> | "clean" if 1.00
+- integration: <0.00–1.00>  <deterministic — fraction of .w2-surface-checklist.json surfaces verified (nav entry · inbound links · SDK/MCP/CLI exports · docs synced); no checklist → score wired-vs-orphaned from the diff>
+  → improve: <surface or export left unwired, with checklist key> | "clean" if 1.00
 - speed:      <0.00–1.00>   <why — one line>
   → improve: <Lighthouse audit + component, or bundle culprit> | "clean" if 1.00
-- composite:  <N.NN>        (0.35·goal-fit + 0.20·sec + 0.20·sta + 0.15·sim + 0.10·spd)
+- composite:  <N.NN>        (0.30·goal-fit + 0.18·sec + 0.18·sta + 0.12·sim + 0.12·int + 0.10·spd)
 
 ### Gate
 - threshold:  composite ≥ 0.65  AND  goal-fit ≥ 0.50 (hard)
@@ -64,7 +66,7 @@ The rubric is not a verdict; it is a map forward.
 
 1. Run `bun run verify` (biome + tsc + vitest). Capture exit code and counts. If the command fails because `bun` isn't available, fall back to `npm run verify`.
 2. If biome/tsc/vitest fail on files touched in W3 → route failure back to W3 (the parent handles the W3.5 reloop; you emit `w4:verify:fail` with the failure list). Max 3 loops per cycle.
-2.5. **Contract gate** — for any verb touched in W3 (`signal`, `mark`, `warn`, `fade`, `follow`, `harden`), read `text/contracts-plan.md` and verify the diff against the verb's pre/post/inv. Until a property-test suite exists, this is a manual check; emit `contracts: reviewed` or `contracts: violated <verb> <clause>` in receipts. A violation is **non-bypassable** — cycle does not close regardless of rubric. If no verb touched → `contracts: n/a`.
+2.5. **Contract gate** — for any verb touched in W3 (`signal`, `mark`, `warn`, `fade`, `follow`, `harden`), read `text/contracts.md` and verify the diff against the verb's pre/post/inv. Until a property-test suite exists, this is a manual check; emit `contracts: reviewed` or `contracts: violated <verb> <clause>` in receipts. A violation is **non-bypassable** — cycle does not close regardless of rubric. If no verb touched → `contracts: n/a`.
 
 3. **Reconcile per canon** — run after deterministic checks pass, before rubric scoring.
 
@@ -82,22 +84,22 @@ The rubric is not a verdict; it is a map forward.
 
    ```bash
    # DATA
-   do2-reconcile.sh substrate <file>
-   do2-reconcile.sh dictionary <file>
-   do2-reconcile.sh types
+   do-reconcile.sh substrate <file>
+   do-reconcile.sh dictionary <file>
+   do-reconcile.sh types
 
    # SURFACE
-   do2-reconcile.sh design <file>
-   do2-reconcile.sh navigation <file>
+   do-reconcile.sh design <file>
+   do-reconcile.sh navigation <file>
 
    # GATEWAY
-   do2-reconcile.sh sdk <file>
-   do2-reconcile.sh authority <file>
+   do-reconcile.sh sdk <file>
+   do-reconcile.sh authority <file>
 
    # PROOF — no canon check; exit code IS the check (vitest already ran above)
 
    # TEACH
-   do2-reconcile.sh dictionary <file>
+   do-reconcile.sh dictionary <file>
    ```
 
    Report each result as `canon/<name>: ok | warn | FAIL`. Any FAIL → cycle does not close, same as a tsc failure. Emit the FAIL stdout in the report so W2 can target the exact gap.
@@ -117,10 +119,10 @@ The rubric is not a verdict; it is a map forward.
    | Dim | Check | Command | Gate |
    |-----|-------|---------|------|
    | types | delta_tsc ≤ 0 | already in deterministic checks (step 1) | tsc errors this cycle ≤ tsc errors at W0 |
-   | names | 0 dead names in touched docs | `do2-reconcile.sh dictionary <touched_docs>` | exit 0 |
+   | names | 0 dead names in touched docs | `do-reconcile.sh dictionary <touched_docs>` | exit 0 |
    | primitives | net new ≤ 0 | `git diff --name-status HEAD \| grep -c '^A'` minus `git diff --name-status HEAD \| grep -c '^D'` | new_files − deleted_files ≤ 0 |
-   | schema | no fork | `do2-reconcile.sh substrate <touched_schema_files>` | exit 0 |
-   | surfaces | registered + linked | `do2-reconcile.sh navigation <touched_pages>` | exit 0 |
+   | schema | no fork | `do-reconcile.sh substrate <touched_schema_files>` | exit 0 |
+   | surfaces | registered + linked | `do-reconcile.sh navigation <touched_pages>` | exit 0 |
    | docs | no broken link | `markdown-link-check <touched_docs>` | exit 0 |
 
    ```bash
@@ -131,15 +133,15 @@ The rubric is not a verdict; it is a map forward.
    # pass if NET_PRIMITIVES <= 0; warn if > 0 and justify with PRIMITIVE verdict from W2
 
    # names ratchet
-   do2-reconcile.sh dictionary $(git diff --name-only HEAD | grep '\.md$' | tr '\n' ' ')
+   do-reconcile.sh dictionary $(git diff --name-only HEAD | grep '\.md$' | tr '\n' ' ')
 
    # schema fork check
    SCHEMA_TOUCHED=$(git diff --name-only HEAD | grep '\.tql$' | tr '\n' ' ')
-   [ -n "$SCHEMA_TOUCHED" ] && do2-reconcile.sh substrate $SCHEMA_TOUCHED
+   [ -n "$SCHEMA_TOUCHED" ] && do-reconcile.sh substrate $SCHEMA_TOUCHED
 
    # surfaces ratchet
    PAGES_TOUCHED=$(git diff --name-only HEAD | grep -E 'src/pages/' | tr '\n' ' ')
-   [ -n "$PAGES_TOUCHED" ] && do2-reconcile.sh navigation $PAGES_TOUCHED
+   [ -n "$PAGES_TOUCHED" ] && do-reconcile.sh navigation $PAGES_TOUCHED
 
    # broken links
    DOCS_TOUCHED=$(git diff --name-only HEAD | grep '\.md$' | tr '\n' ' ')
@@ -151,25 +153,39 @@ The rubric is not a verdict; it is a map forward.
 5. If deterministic checks, reconcile-per-canon, and coherence ratchet all pass → score the code rubric. Target is 1.0 on every dim.
    Full KPIs, scoring bands, and improvement format are in `one/rubrics.md` — Code Rubric.
 
-5.5. **Goal-fit (0.35 — the heaviest dim, hard gate ≥ 0.50):** re-read the cycle's
+5.5. **Goal-fit (0.30 — the heaviest dim, hard gate ≥ 0.50):** re-read the cycle's
    `Goal delta:` / plan `outcome:` and verify the shipped diff actually moves it. Confirm the
    deliverable proof is present (curl / screenshot / log) and the `ux_after` journey is reachable.
    Clean, fast, safe code that does NOT advance the goal scores low here and **cannot close** —
    goal-fit < 0.50 fails the cycle regardless of the other four dims, regardless of composite.
    This is a hard gate: a cycle that produces clean code solving the wrong problem does not ship.
    `→ improve:` names what the goal still needs.
+   When `text/<slug>.md` exists, the plan `outcome:` IS the promise's `proof:` — re-running it
+   here re-runs the contract's oracle (do-prove.sh / do-reconcile design), and at close the cycle
+   composite becomes the `mark` amount on `promise:<slug>→proof` (`do-promise-settle.sh` settles
+   the on-chain half from the same proof exit code).
 
-6. **Security (0.20):** grep the diff for `/api[_-]?key|secret|password|token/i`, `eval(`,
+6. **Security (0.18):** grep the diff for `/api[_-]?key|secret|password|token/i`, `eval(`,
    `dangerouslySetInnerHTML`. Check every `src/pages/api/*.ts` route validates input with Zod
    at the boundary. CF Worker env via `context.env` only. No wildcard CORS headers.
-   Score 1.0 = all greps return 0. For every gap, emit `→ improve: file:line — what`.
-
-7. **Stability (0.20):** biome + tsc + vitest already ran. Now check: no new `any`, no
+   **IDOR:** any new/changed API route reading `searchParams.get('slug'|'workspace')` or
+   `body.slug`/`body.workspace` MUST call `authorizeWorkspace()` (or anchor to `locals.slug`) —
+   `do-reconcile.sh authority` now gates this per GATEWAY file; verify it ran on EVERY touched route.
+   **Same-pattern sweep (mandatory):** when ANY security gap is found or fixed in one file,
+   extract the pattern and grep it across the ENTIRE cycle diff (`git diff HEAD --name-only`),
+   not just the flagged file — fix every instance in the same wave or the cycle does not close.
+   A finding patched in one file but left in a sibling created the same cycle is an open
+   vulnerability, not a closed one. (Real case: a cycle fixed an IDOR in `observability.ts` but
+   shipped the identical IDOR in `agent-eval.ts` because the sweep was skipped.)
+   Score 1.0 = all greps return 0 AND the sweep found no unfixed siblings. For every gap, emit `→ improve: file:line — what`.
+
+7. **Stability (0.18):** biome + tsc + vitest already ran. Now check: no new `any`, no
    `@ts-ignore` without WHY comment, no silent returns (Rule 1), no wall-clock units in new
-   code or docs (Rule 2), no retired names `knowledge|connections|people|node|scent|alarm|
-   trail|colony`. Score 1.0 = all zero. For each gap, emit `→ improve: exact location`.
+   code or docs (Rule 2), no retired dead-names (the locked list in root `CLAUDE.md` —
+   `do-reconcile.sh dictionary` is the oracle). Score 1.0 = all zero. For each gap, emit
+   `→ improve: exact location`.
 
-8. **Simplicity (0.15):** the philosophy is small, focused files. The substrate — the
+8. **Simplicity (0.12):** the philosophy is small, focused files. The substrate — the
    entire schema + engine — is 200 lines total. Use that as your reference point.
 
    ```bash
@@ -198,6 +214,17 @@ The rubric is not a verdict; it is a map forward.
    Score 1.0 = all files feel focused and single-purpose; functions tight; zero ceremony.
    For each gap, name what to split or delete.
 
+8.5. **Integration (0.12 — deterministic first):** wired, never orphaned. If
+   `.w2-surface-checklist.json` exists, the score IS the fraction of declared surfaces
+   verified — nav entry registered in `navigation.ts`, every inbound link present, every
+   declared SDK/MCP/CLI export wired, docs from `.w2-doc-plan.json` synced (the same greps
+   the W4 surface-layer gate runs; score = verified/declared, no judgment involved). No
+   checklist → score wired-vs-orphaned from the diff: new exports have a caller or a barrel
+   re-export, new files have an importer, no dangling route/component. The surface hard
+   gates still block independently — this score is what makes the axis compound
+   (`mark` amount + `s:integration` signal). For each gap, emit
+   `→ improve: <checklist key or file> — left unwired`.
+
 9. **Speed (0.10):** Three sub-checks, all must pass for 1.0.
 
    **Lighthouse:** run against all pages derived from the file→route map. Target 100 on all
@@ -226,7 +253,26 @@ The rubric is not a verdict; it is a map forward.
    Score 1.0 = all Lighthouse 100, bundle ≤ W0, agent lines ≤ W0, no context stuffing, cache ≥ 80%.
    For each gap, name the audit, component, or file.
 
-10. Composite = `0.35·goal-fit + 0.20·security + 0.20·stability + 0.15·simplicity + 0.10·speed`. Gate: composite ≥ 0.65 AND goal-fit ≥ 0.50 (hard).
+10. **W0 rubric delta** — read the pre-cycle baseline if present. Report the delta for each axis so the cycle shows measurable improvement, not just an absolute score.
+
+```bash
+# Load W0 rubric baseline (written by do-rubric.py before the first cycle)
+if [ -f .w0-rubric.json ]; then
+  W0_SEC=$(jq -r '.scores.security'   .w0-rubric.json 2>/dev/null)
+  W0_STA=$(jq -r '.scores.stability'  .w0-rubric.json 2>/dev/null)
+  W0_SIM=$(jq -r '.scores.simplicity' .w0-rubric.json 2>/dev/null)
+  W0_INT=$(jq -r '.scores.integration // empty' .w0-rubric.json 2>/dev/null)
+  W0_SPD=$(jq -r '.scores.speed'      .w0-rubric.json 2>/dev/null)
+  W0_CMP=$(jq -r '.composite'         .w0-rubric.json 2>/dev/null)
+  echo "W0 baseline — security:$W0_SEC stability:$W0_STA simplicity:$W0_SIM integration:${W0_INT:-n/a} speed:$W0_SPD composite:$W0_CMP"
+fi
+```
+
+In the receipt, for each axis report: `score (Δ vs W0)` — e.g. `security: 0.90 (+0.10)`.  
+Set `velocity` in `.w4-improvements.json` to `composite − W0_CMP` (positive = improvement).  
+If `.w0-rubric.json` is absent, set `velocity: null` and omit deltas.
+
+11. Composite = `0.30·goal-fit + 0.18·security + 0.18·stability + 0.12·simplicity + 0.12·integration + 0.10·speed`. Gate: composite ≥ 0.65 AND goal-fit ≥ 0.50 (hard).
 
 11. Must-not checks (bypass composite — immediate warn):
    - Hardcoded secret or API key → `warn(1)` on security, cycle fails.
@@ -239,6 +285,18 @@ The rubric is not a verdict; it is a map forward.
 12. Cross-consistency checks from the TODO's verify checklist (doc terms match code identifiers,
     no 404 links, no retired names leaked).
 
+12.5. **Shipped-status check (doc-sync hard gate, zero LLM)** — the just-built slug's own
+    plan/docs must not still say the feature is unbuilt:
+    ```bash
+    grep -liE 'design doc \(not an armed|not yet built|^not shipped|is the A2A follow-on|durable.*follow-on, not' \
+      text/$(cycle.slug)-plan.md text/$(cycle.slug)-docs.md 2>/dev/null
+    ```
+    A hit on the plan that was *just built* is a doc that lies about what shipped → fail the doc-sync
+    gate; reconcile the phrase (or reword if it genuinely names a separate future item). Recurring 3/3
+    runs (eve-C5 · remote-durable · remote-suspend): an extension cycle ships the capability but leaves
+    "X is the follow-on / not shipped" in its own plan/docs/code-headers. Also scan touched code-file
+    header comments for the same.
+
 ---
 
 ## Verification Tools
@@ -383,7 +441,8 @@ cat > .w4-improvements.json <<EOF
   "cycle": N,
   "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
   "composite": COMPOSITE,
-  "velocity": COMPOSITE_MINUS_PREV_COMPOSITE,
+  "w0_composite": W0_CMP_OR_NULL,
+  "velocity": COMPOSITE_MINUS_W0_COMPOSITE_OR_NULL,
   "open": [
     { "dim": "security",   "score": SEC,  "file": "...", "line": N, "action": "..." },
     { "dim": "stability",  "score": STA,  "file": "...", "line": N, "action": "..." },

package/commands/cc-connect.md

@@ -1,67 +1,77 @@
 # /cc-connect — Claude Code ↔ Claude Code messaging
 
-Real-time peer chat between Claude Code sessions over the substrate. **SSE push, no client polling.**
+Real-time peer chat between Claude Code sessions over the substrate. **SSE push, no polling.**
 
-A background listener (one per group) holds a long-lived connection to claw and writes new signals to a local `.cc-connect/<group>.jsonl` file. Reading is a local file tail — instant, zero network. Sending is one HTTP POST.
+Three spaces wired by default:
+
+| Space | Who | Inbox |
+|---|---|---|
+| `space:vespio` | Donal's Claude Code | one.ie/u/vespio/in |
+| `space:elitemoversca` | Elite Movers agents | one.ie/u/elitemoversca/in |
+| `space:world` | World broadcast | one.ie/u/world/in |
 
 ## Usage
 
 ```
-/cc-connect                    # read new messages since last read
-/cc-connect send "your text"              # send to default group
-/cc-connect send --to founders "text"     # send to specific group (--group also works)
-/cc-connect listen             # start background SSE listener (idempotent)
-/cc-connect stop               # kill listener
-/cc-connect status             # show config + listener PID + unread count
-/cc-connect init tony newco    # set sender + group (once per project)
+/cc-connect                          # read new messages (default space)
+/cc-connect read --all               # fan in — all spaces merged, sorted by ts
+/cc-connect send "text"              # send to default space
+/cc-connect send --to space:vespio "text"   # targeted send
+/cc-connect broadcast "text"         # fan out — all space:* groups at once
+/cc-connect listen                   # start SSE listeners for all subscribed spaces
+/cc-connect stop                     # kill all listeners
+/cc-connect status                   # listener PIDs + unread counts per space
+/cc-connect join space:X             # subscribe + start listener for a new space
+/cc-connect leave space:X            # unsubscribe + stop listener
 ```
 
-## How to invoke
+**→ Use `/chat` for the simple two-key interface: read = fan in, send = fan out.**
 
-Run the script via Bash:
+## How to invoke
 
 ```bash
 .claude/scripts/cc-connect.sh <subcommand> [args]
 ```
 
-Examples:
+## First-time setup (one-time per repo)
 
 ```bash
-.claude/scripts/cc-connect.sh send "hey donal, did you see the rename plan?"
-.claude/scripts/cc-connect.sh                       # = read
-.claude/scripts/cc-connect.sh listen                # start once per session
+.claude/scripts/cc-connect.sh auth <ONE_API_KEY>          # saves key to ~/.cc-connect/.auth.conf
+.claude/scripts/cc-connect.sh init <yourname> space:vespio # set sender + default space
+.claude/scripts/cc-connect.sh join space:elitemoversca
+.claude/scripts/cc-connect.sh join space:world
+.claude/scripts/cc-connect.sh listen                       # starts all listeners
 ```
 
-## First-time setup
+At session start: just re-run `listen` — idempotent, won't spawn duplicates.
+
+## Notifications
+
+Clicking the macOS banner opens the inbox directly:
 
 ```bash
-.claude/scripts/cc-connect.sh init <yourname> newco
-.claude/scripts/cc-connect.sh listen
+brew install terminal-notifier   # one-time
 ```
 
-That's it. The listener runs in the background until you `stop` it. Across Claude Code sessions, just re-run `listen` — it's idempotent.
+Without it, the banner still fires but clicking opens Script Editor (useless).
 
 ## What's stored
 
 | File | Purpose |
 |---|---|
-| `.cc-connect/config.json` | `{sender, group}` |
-| `.cc-connect/<group>.jsonl` | Append-only message log (one JSON per line) |
-| `.cc-connect/<group>.offset` | Last-read line count |
-| `.cc-connect/<group>.pid` | Background listener PID |
-
-The `.cc-connect/` dir is gitignored.
+| `.cc-connect/config.json` | `{sender, default, groups}` |
+| `.cc-connect/<group>.jsonl` | Append-only message log |
+| `.cc-connect/<group>.offset` | Last-read position |
+| `.cc-connect/<group>.pid` | Listener PID |
+| `~/.cc-connect/.auth.conf` | ONE API key (chmod 600, never in repo) |
 
 ## Tech
 
-- **claw endpoint:** `GET /stream/:group` — Server-Sent Events, 25s heartbeat, resumable via `Last-Event-ID`
-- **Client:** `curl -N` holding the SSE connection in a background process
-- **Storage:** local JSONL append; reads tail since byte offset
-
-No client polling. The CF worker pushes; your terminal stays asleep until a message lands.
+- **Send**: `POST /api/ask/space:post` (authenticated, mirrors to workspace inbox + thread)
+- **Listen**: `GET channels.one.ie/stream/<group>` — SSE, 25s heartbeat, resumable via `Last-Event-ID`
+- **Storage**: local JSONL append; reads tail since byte offset
 
 ## See also
 
-- `web/src/pages/peer/[group].astro` — web view of the same group (`app.one.ie/peer/newco`)
-- `claw/src/index.ts` — `GET /stream/:group` SSE source
-- `.claude/scripts/cc-connect.sh` — the worker script
+- `/chat` — simple fan-in / fan-out wrapper
+- `one.ie/u/<space>/in` — web inbox for any space

package/commands/chat.md

@@ -0,0 +1,35 @@
+# /chat — fan in · fan out across all spaces
+
+The simple two-key interface for talking across Claude Code sessions. Three moves, nothing else:
+
+```
+/chat                          # read — every new message, across every space you're in
+/chat "your message"           # send to everyone — fans out to all your spaces at once
+/chat @vespio "your message"   # send to one space only
+```
+
+That's the whole interface. Everything below is what happens under the hood — you don't need it to use `/chat`.
+
+## What's a "space"?
+
+A space is a shared inbox both sides watch — you and whoever you're talking to (a person's Claude Code, or a workspace's team). Each space also has a web view: `one.ie/u/<space>/in`.
+
+| Space | Inbox |
+|---|---|
+| `space:vespio` | one.ie/u/vespio/in |
+| `space:elitemoversca` | one.ie/u/elitemoversca/in |
+| `space:world` | one.ie/u/world/in |
+
+## First time only
+
+```bash
+.claude/scripts/cc-connect.sh listen   # starts live listeners — run once per session
+```
+
+Without this running, `/chat` still sends, but you won't get pushed new messages in real time — you'd have to run `/chat` again to check.
+
+Want a desktop popup when something lands? `brew install terminal-notifier` (one-time, optional).
+
+## Advanced (raw commands, rarely needed)
+
+`/chat` is a shortcut for `.claude/scripts/cc-connect.sh`. Reach for the raw form only when you need something `/chat` doesn't expose — joining a new space, checking listener status, reading offline history. See `/cc-connect` for the full surface.

package/commands/close.md

@@ -45,10 +45,11 @@ This is Rule 1 enforced at the human boundary.
    - **security**:   no injections, no secrets, all API routes validated
    - **stability**:  tests pass, zero type errors, every handler closes its loop
    - **simplicity**: files focused, functions ≤ 20 lines, no ceremony beyond scope
+   - **integration**: every declared surface wired — nav + inbound links + SDK/MCP/CLI exports + docs (deterministic from `.w2-surface-checklist.json`)
    - **speed**:      Lighthouse held, bundle ≤ W0, tokens lean, cache hit ≥ 80%
-   - composite: `0.35·security + 0.30·stability + 0.25·simplicity + 0.10·speed`
+   - composite: `0.30·security + 0.25·stability + 0.20·simplicity + 0.15·integration + 0.10·speed`
 2. POST `http://localhost:4321/api/tasks/{id}/complete`
-3. POST `http://localhost:4321/api/loop/mark-dims` with `{ security, stability, simplicity, speed }`:
+3. POST `http://localhost:4321/api/mark-dims` with `{ security, stability, simplicity, integration, speed }`:
    - Dim ≥ 0.5 → mark() on that dimension path (strength++)
    - Dim < 0.5 → warn() on that dimension path (resistance++)
 4. Self-checkoff: update task checkbox in the TODO file `[ ]` → `[x]`
@@ -61,7 +62,7 @@ This is Rule 1 enforced at the human boundary.
        "strength": "<composite 0–1>",
        "content": {
          "task_id": "<id>",
-         "rubric": { "security": X, "stability": Y, "simplicity": Z, "speed": W },
+         "rubric": { "security": X, "stability": Y, "simplicity": Z, "integration": I, "speed": W },
          "composite": N,
          "velocity": "±N",
          "outcome": "result"
@@ -69,10 +70,18 @@ This is Rule 1 enforced at the human boundary.
      }
    }
    ```
-   This is the return-path pheromone. Future agents with matching tags follow this trail.
+   This is the return-path pheromone. Future agents with matching tags follow this path.
    `composite >= 0.65` → mark each tag path. `composite < 0.65` → warn(0.5) each tag path.
-6. Report unlocked tasks (tasks where this was in their `blocks` list)
-7. **Propagate to docs** — auto-edit when triggers from the cycle's `.w2-doc-plan.json` match. Zero agent spawns; all bash + Edit tool.
+6. **Settle the promise** — if the slug has a promise (`text/<slug>.md` with a `proof:`), run
+   `.claude/scripts/do-promise-settle.sh <slug> --composite <composite>`. Zero LLM: proof exits 0
+   → `mark` on `promise:<slug>→proof` (strength = composite×5) + `world:announce` broadcast; non-zero
+   → `warn`; no observable → dissolved (reported, never silent). If the promise was minted on-chain
+   (`object_id:` in its contract block) the same run submits the generated `settle_promise`
+   (kept/broken, amount = strength×1000 bps) — the state ratchet makes settlement final; unarmed or
+   failed chain write degrades cleanly, the off-chain settle stands. Build-time reputation lands on
+   the same weighted path run-time routing reads — see `text/marketplace.md`.
+7. Report unlocked tasks (tasks where this was in their `blocks` list)
+8. **Propagate to docs** — auto-edit when triggers from the cycle's `.w2-doc-plan.json` match. Zero agent spawns; all bash + Edit tool.
 
    | Trigger from W3 diff | Target | Edit |
    |---|---|---|
@@ -84,11 +93,12 @@ This is Rule 1 enforced at the human boundary.
 
    For each trigger, the bash dispatcher reads the W3 diff, locates the anchor in the target doc, and applies the Edit tool inline. Anchor mismatch → log to `docs/improvements.md` for manual W2 next cycle (no halt).
 
-8. Report:
+9. Report:
    ```
    mark(+5) on <from>→<to>
-   Rubric: security=X  stability=Y  simplicity=Z  speed=W  composite=N  velocity=±N
+   Rubric: security=X  stability=Y  simplicity=Z  integration=I  speed=W  composite=N  velocity=±N
    Feedback: signal emitted → loop:feedback  tags=[<tags>]  strength=N
+   Promise: <kept|broken|dissolved|none> → <mark|warn> promise:<slug>→proof strength=N
    Propagate: docs=N edited  triggers=[<codes>]  manual=N
    Unlocked: N tasks
    ```
@@ -132,7 +142,7 @@ This is Rule 1 enforced at the human boundary.
    ```
    Session:    N tasks completed  M tests  K commits
    Pheromone:  N marks  M warns this session
-   Rubric:     security=X  stability=Y  simplicity=Z  speed=W  composite=N  velocity=±N  (session averages)
+   Rubric:     security=X  stability=Y  simplicity=Z  integration=I  speed=W  composite=N  velocity=±N  (session averages)
    Hardened:   N highways promoted to permanent (L6)
    Frontiers:  N new unexplored clusters (L7)
    Next:       1. <task>  priority=N  2. <task>  priority=M  3. <task>  priority=K

package/commands/create.md

@@ -49,6 +49,7 @@ Every noun writes to TypeDB and/or the in-memory queue.
 4. Promote raw tasks into full wave template:
    - Group by cycles (Wire → Prove → Grow) and waves (W1=Haiku, W2=Opus, W3=Sonnet, W4=Sonnet)
    - Assign full metadata per task: id, value, effort, phase, persona, blocks, exit, tags
+   - `outcome:` — when a promise exists (`text/<slug>.md` with `proof:`), the todo's `outcome:` is the promise's `proof:`, verbatim — never restated loosely
    - Include: routing diagram, schema reference, wave structure, rubric scoring in W4, self-checkoff
 5. Write `docs/{docname}-todo.md`
 6. Verify: all tasks have 7 metadata fields, blocks references are valid, exit conditions are verifiable

package/commands/db-sync.md

@@ -0,0 +1,51 @@
+# /db-sync — Sync production D1 → local miniflare
+
+Mirror the production `one-owners` D1 database into the local miniflare SQLite state.
+Run this any time local data goes missing (after a `git clean`, fresh checkout, or new worktree).
+
+## What it does
+
+1. Exports the remote `one-owners` D1 via `wrangler d1 export --remote`
+2. Drops all non-`_cf_` tables in the local SQLite file
+3. Imports the prod SQL dump via `sqlite3` (bypasses wrangler's SQLITE_TOOBIG limit)
+4. Re-inserts the local-only `one` workspace seed row (not in prod)
+
+## Prerequisites
+
+`CLOUDFLARE_EMAIL` and `CLOUDFLARE_GLOBAL_API_KEY` must be in env (both are in `.env` — already loaded in your shell).
+
+## One-shot command
+
+```bash
+cd /Users/toc/Server/one-ie/one.ie/web && bun scripts/sync-from-prod.ts --only=d1
+```
+
+Or via the npm script:
+
+```bash
+cd /Users/toc/Server/one-ie/one.ie/web && bun run db:sync
+```
+
+To also sync R2 content and KV namespaces (SESSION, CHAT_CACHE, THREADS) — slower, ~5–10 min:
+
+```bash
+cd /Users/toc/Server/one-ie/one.ie/web && bun run db:sync:all
+```
+
+## After sync
+
+No migrations to apply — the D1 export from prod includes the migration ledger and all schema.
+Local state will reflect prod exactly, plus the seeded `one` workspace row.
+
+Verify with:
+
+```bash
+sqlite3 /Users/toc/Server/one-ie/one.ie/web/.wrangler/state/v3/d1/miniflare-D1DatabaseObject/*.sqlite \
+  "SELECT 'owners', COUNT(*) FROM owners UNION SELECT 'messages', COUNT(*) FROM messages UNION SELECT 'threads', COUNT(*) FROM threads;" 2>/dev/null | grep -v metadata
+```
+
+## Why data gets lost
+
+`.wrangler/` is gitignored — it does not survive `git clean -fd`, a fresh worktree (`git worktree add`), or a fresh clone. The `/kill` command explicitly preserves it, but `git clean` doesn't know that.
+
+Run `/db-sync` whenever local feels stale or empty.