@oneie/claude 0.5.0 → 0.6.0

package/commands/sync.md

@@ -1,185 +1,102 @@
 # /sync
 
-**Skills:** `/typedb` (tick loops, query & write) · `/signal` (per-loop outcomes, L4 payment emissions)
+**Skills:** `/typedb` (loop queries & writes) · `/signal` (per-loop outcomes, L4 payment emissions)
 
-Reconcile substrate state — tick loops, absorb markdown, propagate knowledge.
+Reconcile substrate state — report the growth loops, fire the on-demand ones, absorb markdown.
+
+**Where the loops actually run:** L3/L5/L6 are LIVE on the **channels worker's Cloudflare cron** (`channels/src/cron.ts`, triggers in `channels/wrangler.toml`, re-enabled 2026-06-28). There is no `/api/tick` aggregator — the world breathes on cron, not on request. `/sync` therefore has two jobs: fire the on-demand loops that have real endpoints, and report the state of the ones that run themselves.
+
+## Loop reality map (verified 2026-07-02)
+
+| Loop | Mechanism | Status | On-demand handle |
+|------|-----------|--------|------------------|
+| L1 tasks | `do-rank.py` → local `todo.md` (+ Stop/SessionStart hooks) | LIVE (local) | `python3 .claude/scripts/do-rank.py` |
+| L3 fade | channels cron `fade-tick` daily, rate 0.05 — TypeDB + D1 `claw_paths` | LIVE | `POST /api/fade` (web) |
+| L4 pay | signal with payment data → path revenue | LIVE | `POST /api/signal/<receiver>` |
+| L5 evolve | channels cron `evolution-tick` hourly → `agents:evolve` signal | LIVE | `POST /api/signal/agents:evolve` |
+| L6 know | channels cron `harden-tick` hourly (D1 strength≥10 → TypeDB hypotheses) | LIVE | `POST /api/ask/learning:know` |
+| L7 frontier | read surface only — no detection job exists | READ-ONLY | `GET /api/frontiers` |
+
+**Not built (do not invoke, do not describe as live):** `GET /api/tick`, `POST /api/tasks/sync`, `src/engine/{doc-scan,task-parse,reusable-tasks}.ts`. The `sync-todo-docs.sh` hook still best-effort-POSTs `/api/tasks/sync` and silently no-ops — known drift. If a tick aggregator is ever wanted, it's a `/do` cycle (thin web route composing `fade()` + `agents:evolve` + `learning:know` + frontiers read), not a doc edit.
 
 ## Nouns
 
 | Noun | What | Loop |
 |------|------|------|
-| *(default)* | Tick all loops + scan docs + todos + agents | L1-L7 |
-| `tick` | Fire all L1-L7 loops once (one full growth cycle) | L1-L7 |
-| `docs` | Scan `text/*.md` → memory → TypeDB | L6 |
-| `todos` | Scan `text/*-todo.md` → tasks → TypeDB + KV | L1 |
-| `tasks [dir]` | Import reusable task templates from `tasks/` (or `[dir]`) → world-scoped tasks + skills + capabilities | L1 |
-| `agents` | Scan `agents/**/*.md` → units → TypeDB | L1 |
-| `fade` | Fire L3 only — asymmetric decay | L3 |
-| `evolve` | Fire L5 only — rewrite struggling agents | L5 |
-| `know` | Fire L6 only — harden highways + hypothesize | L6 |
-| `frontier` | Fire L7 only — detect unexplored tag clusters | L7 |
+| *(default)* | Verify + rank todos + fire on-demand loops + report | L1, L3-L7 |
+| `todos` | `do-rank.py` — rank `text/*-todo.md` into `todo.md` | L1 |
+| `agents` | Scan agent `.md` frontmatter (`channels/src/lib/agent-md.ts` / `web/src/lib/agent-md.ts`) → sync units + skills + subscriptions to TypeDB | L1 |
+| `fade` | Fire L3 once — asymmetric decay | L3 |
+| `evolve` | Fire L5 once — rewrite struggling agents | L5 |
+| `know` | Fire L6 once — harden highways + hypothesize | L6 |
+| `frontier` | Read L7 — current frontiers (detection job unbuilt) | L7 |
 | `pay <receiver> <amt>` | Emit L4 payment signal | L4 |
-| `<path>` | Absorb any markdown file or directory into substrate | L6 |
-
-## Routing
-
-`/sync` maps to `tick()` + `know()` — running all seven loops and hardening highways.
-Individual noun invocations target a single loop layer; default runs all of them.
-
-| Noun | Primitive | L |
-|------|-----------|---|
-| default / tick | `tick()` all loops | L1-L7 |
-| docs / todos / agents / tasks / `<path>` | `know()` absorption | L6 |
-| fade | `fade()` | L3 |
-| evolve | agent prompt rewrite | L5 |
-| know | `know()` harden | L6 |
-| frontier | frontier detection | L7 |
-| pay | `send()` payment signal | L4 |
+| `<path>` | Absorb a markdown file/dir — extract concepts → `learning:know` | L6 |
 
 ## Steps
 
 ### *(default)*
 
 1. `bun run verify` — W0 gate (skip if already passed this session)
-2. Scan `text/*-todo.md` → parse checkboxes → POST `/api/tasks/sync`
-3. Scan `text/*.md` → extract concepts → write to memory → TypeDB
-4. Scan `agents/**/*.md` → parse frontmatter → sync units + skills
-5. GET `http://localhost:4321/api/tick?interval=0` — fire all L1-L7 loops
-6. Report:
+2. `python3 .claude/scripts/do-rank.py` — rank + report the task queue
+3. Fire on-demand loops against the local dev server (or `ONE_API_URL`):
+   `POST /api/fade` · `POST /api/ask/learning:know` · `GET /api/frontiers`
+4. Report:
    ```
-   Tasks:    N synced  M hash-deltas  K KV writes
-   Docs:     N scanned  M gaps found  K TypeDB writes
-   Agents:   N synced  M skills
-   Tick:     cycle=N  highways=M  evolved=K  hardened=J  hypotheses=I  frontiers=H
+   Queue:    N ready  M gated  K faded  (top slug + score)
    L3 fade:  N paths decayed
-   L5 evolve: N agents evaluated  M evolved
    L6 know:  N highways hardened  M hypotheses written
-   L7 frontier: N clusters detected
-   ```
-
-### tick
-
-1. GET `http://localhost:4321/api/tick?interval=0`
-2. Report full tick output:
-   ```
-   Cycle:      N
-   Highways:   N (strength ≥ 50)
-   Evolved:    N agents rewrote prompts
-   Hardened:   N paths promoted to permanent
-   Hypotheses: N generated
-   Frontiers:  N unexplored clusters
-   Per-loop timings: L3 lastAtMs=N nextAtMs=M  L5 lastAtMs=N  L6 lastAtMs=N  L7 lastAtMs=N
+   L7:       N frontiers (read)
+   Cron:     L3 daily · L5/L6 hourly on channels (no action needed)
    ```
 
-### docs
-
-1. Scan all `text/*.md` files via `src/engine/doc-scan.ts`
-2. Extract key concepts, verify doc-code alignment
-3. Write to memory → TypeDB
-4. Report: docs scanned, gaps found, TypeDB writes
-
 ### todos
 
-1. Scan all `text/*-todo.md` files via `src/engine/task-parse.ts` (`scanTodos()`)
-2. POST to `http://localhost:4321/api/tasks/sync` (hash-gated: skips if data unchanged)
-3. KV update (~10ms), async TypeDB sync (~100ms)
-4. Report:
-   ```
-   Tasks:   N synced across M TODO files
-   Phases:  C1=N C2=M C3=K ...
-   Top 10:  <task> priority=N, ...
-   KV:      N writes (hash-gated)
-   ```
-
-### tasks
-
-Import a reusable task catalog (markdown templates with frontmatter) into the
-current world. Scopes every `template.id` to `{worldId}:{template.id}` so
-multiple worlds can share a catalog without collisions. Idempotent — re-running
-skips tasks that already exist.
-
-1. Resolve catalog directory from `$ARGUMENTS` or default to `tasks/` at repo root
-2. Load templates via `loadTemplates(dir)` (`src/engine/reusable-tasks.ts`)
-3. Instantiate via `instantiateTemplates(templates, { worldId, providerUid })`
-4. Hand off to `syncTasks()` for core TypeDB insert (task + skill + capability)
-5. Layer on extension attributes — rubric weights, price, currency, template-source
-6. Report:
-   ```
-   Templates: N loaded from <dir>
-   Scoped:    {worldId}:<id> × N
-   Inserted:  N tasks, N skills, N capabilities
-   Skipped:   M (already exist — idempotent re-sync)
-   Errors:    K (malformed frontmatter or missing required fields)
-   Rubric:    N templates carried rubric weights
-   Pricing:   N templates carried price + currency
-   ```
-
-**Template format:** see `tasks/README.md`. Required fields: `id`, `name`.
-Optional: `description`, `tags`, `wave`, `value`, `effort`, `phase`, `persona`,
-`rubric: { security, stability, simplicity, speed }`, `price`, `currency`, `blocks`.
-
-**Example:**
-
-```bash
-/sync tasks                         # Import ./tasks into current world
-/sync tasks ./my-catalog            # Import from a custom directory
-/sync tasks ../shared/task-library  # Cross-repo catalog
-```
-
-**Why this noun exists:** Stage 1 (LIST) of the trade lifecycle needs inventory.
-A new seller world with zero listings is a dead market. Reusable task templates
-are pre-packaged LIST entries — import the catalog, your world has a starter
-set of listings ready to receive offers. See `text/trade-lifecycle-todo.md § Cycle 6`.
+1. `python3 .claude/scripts/do-rank.py` (add `--tasks` for the tagged-signal view, `--json` for the fleet)
+2. Report: ready/gated/faded counts, top-N slugs, fleet waves.
 
 ### agents
 
-1. Scan `agents/**/*.md` files
-2. Parse frontmatter via `src/engine/agent-md.ts` → `AgentSpec[]`
-3. Sync each to TypeDB: unit + skills + capabilities + group membership
-4. Report: agents synced, skills synced, TypeDB insert count
+1. Scan agent `.md` files (`one.ie/ai/agents/`, `channels` agent dirs)
+2. Parse frontmatter via the shipped parser (`channels/src/lib/agent-md.ts` or `one.ie/web/src/lib/agent-md.ts`) → `AgentSpec[]`
+3. Sync to TypeDB: unit + skills + capabilities + group membership; register `meta.subscribes` tags via `subscriptions:register`
+4. Report: agents synced, skills synced, subscriptions registered.
 
 ### fade
 
-1. GET `http://localhost:4321/api/tick?loops=L3`
-2. Asymmetric decay: resistance forgives 2× faster than strength decays
-3. Report: paths decayed, net strength/resistance changes
+1. `POST /api/fade` (web) — same decay the daily channels cron runs
+2. Asymmetric: resistance forgives 2× faster than strength decays
+3. Report: paths decayed, net strength/resistance changes.
 
 ### evolve
 
-1. GET `http://localhost:4321/api/tick?loops=L5`
-2. For each unit with `success-rate < 0.50` AND `sample-count ≥ 20` AND last evolution > 24h ago:
-   - Rewrite system prompt based on failure patterns
-   - Increment `generation` counter
-3. Report: agents evaluated, agents evolved, generation numbers
+1. `POST /api/signal/agents:evolve` — same signal the hourly channels cron emits
+2. Targets units with `success-rate < 0.50` AND `sample-count ≥ 20`
+3. Report: agents evaluated, agents evolved, generation numbers.
 
 ### know
 
-1. GET `http://localhost:4321/api/tick?loops=L6`
-2. Promote top highways (strength ≥ 50, consistent) to permanent TypeDB hypotheses
-3. Auto-hypothesize patterns from accumulated path data
-4. Report: highways hardened, hypotheses written, confidence scores
+1. `POST /api/ask/learning:know` — promote strong paths to TypeDB hypotheses
+2. Report: highways hardened, hypotheses written. (The hourly `harden-tick` cron does this automatically from D1 `claw_paths`.)
 
 ### frontier
 
-1. GET `http://localhost:4321/api/tick?loops=L7`
-2. Detect tag clusters with <10% traversal rate
-3. Report: clusters detected, expected value per cluster
+1. `GET /api/frontiers` — read current frontiers from TypeDB
+2. Report: frontiers listed. **Detection** (finding new unexplored clusters) has no job yet — flag it, don't fake it.
 
 ### pay
 
 1. Parse `<receiver>` and `<amount>` from `$ARGUMENTS`
-2. POST `http://localhost:4321/api/signal` with `{ receiver, data: { type: "payment", amount } }`
-3. Revenue recorded on path
-4. Report: payment signal sent, path updated, revenue total for that path
+2. `POST /api/signal/<receiver>` with `{ data: { type: "payment", amount } }`
+3. Report: payment signal sent, path updated, revenue total for that path.
 
 ### `<path>`
 
 1. Read markdown file or directory at `<path>` from `$ARGUMENTS`
 2. If directory: scan all `*.md` files recursively
-3. Parse content → extract concepts, tasks, or agent specs as appropriate
-4. Write to memory → TypeDB
-5. Report: files processed, entities written
+3. Extract concepts → `POST /api/ask/learning:know` per concept (or agent specs → the `agents` flow)
+4. Report: files processed, entities written.
 
 ---
 
-*`/sync` is `tick()` + `know()` — seven loops, one command.*
+*The world breathes on cron. `/sync` reads the pulse and squeezes the on-demand loops — it does not pretend to be the heart.*

package/hooks/hooks.json

@@ -1,5 +1,57 @@
 {
+  "UserPromptSubmit": [
+    {
+      "matcher": "*",
+      "hooks": [
+        {
+          "id": "hook:staff-announce",
+          "type": "command",
+          "command": "bun \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/announce.ts\"",
+          "timeout": 6000,
+          "blocking": false
+        },
+        {
+          "id": "hook:staff-inbox",
+          "type": "command",
+          "command": "bun \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/inbox.ts\"",
+          "timeout": 5000,
+          "blocking": true
+        },
+        {
+          "id": "hook:user-prompt-signal",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/user-prompt-signal.sh\"",
+          "timeout": 3000,
+          "blocking": false
+        }
+      ]
+    }
+  ],
   "PreToolUse": [
+    {
+      "matcher": "Bash",
+      "hooks": [
+        {
+          "id": "hook:git-add-guard",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/git-add-guard.sh\"",
+          "timeout": 5000,
+          "blocking": true
+        }
+      ]
+    },
+    {
+      "matcher": "Agent|Task",
+      "hooks": [
+        {
+          "id": "hook:fable-fallback",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/fable-fallback.sh\"",
+          "timeout": 5000,
+          "blocking": true
+        }
+      ]
+    },
     {
       "matcher": "Edit|Write|MultiEdit",
       "hooks": [
@@ -47,6 +99,13 @@
           "type": "command",
           "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/post-edit-check.sh\"",
           "timeout": 15000
+        },
+        {
+          "id": "hook:priority-todo",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/sync-priority-todo.sh\"",
+          "timeout": 10000,
+          "blocking": false
         }
       ]
     },
@@ -73,6 +132,30 @@
         }
       ]
     },
+    {
+      "matcher": "Write",
+      "hooks": [
+        {
+          "id": "hook:do-doc-check",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/do-doc-check.sh\"",
+          "timeout": 3000,
+          "blocking": false
+        }
+      ]
+    },
+    {
+      "matcher": "Write|Edit",
+      "hooks": [
+        {
+          "id": "hook:do-outcome-gate",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/do-outcome-gate.sh\"",
+          "timeout": 60000,
+          "blocking": true
+        }
+      ]
+    },
     {
       "matcher": "*",
       "hooks": [
@@ -116,6 +199,20 @@
           "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/stop-reflect.sh\"",
           "timeout": 10000,
           "blocking": false
+        },
+        {
+          "id": "hook:staff-cleanup",
+          "type": "command",
+          "command": "bun \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/cleanup.ts\"",
+          "timeout": 3000,
+          "blocking": false
+        },
+        {
+          "id": "hook:priority-todo-stop",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/sync-priority-todo.sh\"",
+          "timeout": 10000,
+          "blocking": false
         }
       ]
     }
@@ -130,6 +227,13 @@
           "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/session-start.sh\"",
           "timeout": 5000,
           "blocking": false
+        },
+        {
+          "id": "hook:priority-todo-start",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/sync-priority-todo.sh\"",
+          "timeout": 10000,
+          "blocking": false
         }
       ]
     }

package/hooks/lib/signal.sh

@@ -1,28 +1,111 @@
 #!/usr/bin/env bash
-# Shared signal emitter. Source from any hook:
+# Shared signal emitter — every Claude Code session broadcasts RICH signals to the world.
+# Source from any hook:
 #   source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/signal.sh"
-#   emit_signal <receiver> <weight> [key=value ...]
+#   emit_world  <type> <priority> <tags_csv> <text> [key=value ...]   # rich session/world signal
+#   emit_signal <receiver> <weight> [data...]                         # back-compat, routed as a world tag
 #
-# Fire-and-forget POST to /api/signal (2s max, backgrounded). Never blocks.
-# Receiver naming + weight semantics: .claude/skills/signal.md
+# Every signal is a fire-and-forget POST to /api/ask/world:announce — the PUBLIC front
+# door, now sent with the service credential (GATEWAY_API_KEY / GATEWAY_SERVICE_SECRET)
+# so the gateway accepts it (armed in prod — see text/code-signals-plan.md) and
+# world:announce can attest a sender identity for it (slug:"one"). world:announce reads
+# data.tags and fans the payload to every subscriber whose follow-tags intersect,
+# marking each delivery (closed loop). A hook must broadcast to the world, never write raw
+# substrate — direct /api/signal is gateway-guarded by design.
+# Contract: one.ie/web/src/lib/resolvers/subscriptions.ts (world:announce · subscriptions:register)
+# Point ONE_API_URL at https://one.ie to broadcast into the live world instead of local dev.
 
-emit_signal() {
-  local receiver="$1"
-  local weight="${2:-1}"
-  shift 2 || true
-  local data="$*"
+_one_world_url() { printf '%s' "${ONE_API_URL:-http://localhost:4321}/api/ask/world:announce"; }
+
+# Where the service credential lives — hooks don't reliably inherit a login shell's
+# exports, so read straight out of the web env file (same pattern do-signal.sh
+# established). The LOCAL astro/wrangler dev server reads secrets from .dev.vars, not
+# .env — they hold DIFFERENT values, so which file we read must match ONE_API_URL's
+# target: localhost → .dev.vars, anything else (prod) → .env. Override with DO_ENV_FILE.
+# An explicitly-exported shell var always wins over either file.
+_one_env_file() {
+  [ -n "${DO_ENV_FILE:-}" ] && { printf '%s' "$DO_ENV_FILE"; return 0; }
+  local root="${CLAUDE_PROJECT_DIR:-$PWD}" url="${ONE_API_URL:-http://localhost:4321}"
+  case "$url" in
+    *localhost*|*127.0.0.1*) printf '%s' "$root/one.ie/web/.dev.vars" ;;
+    *) printf '%s' "$root/one.ie/web/.env" ;;
+  esac
+}
+_one_secret() { # $1 = VAR name → value or empty, never printed by any caller
+  local val="${!1:-}"
+  if [ -n "$val" ]; then printf '%s' "$val"; return 0; fi
+  local f; f="$(_one_env_file)"
+  [ -f "$f" ] || return 0
+  grep -E "^$1=" "$f" 2>/dev/null | head -1 | sed 's/^[^=]*=//;s/^"//;s/"$//'
+}
+
+# Rich broadcast — the structured envelope the routing + marketplace can stake on.
+emit_world() {
+  local type="${1:-event}" priority="${2:-fyi}" tags_csv="${3:-}" text="${4:-}"
+  shift 4 2>/dev/null || true
+  command -v jq >/dev/null 2>&1 || return 0   # rich payload needs jq; degrade silently, never block
+
+  local session="${CLAUDE_SESSION_ID:-${CC_SESSION_ID:-unknown}}"
+  local root="${CLAUDE_PROJECT_DIR:-$PWD}"
+  local proj branch; proj="$(basename "$root")"
+  branch="$(git -C "$root" rev-parse --abbrev-ref HEAD 2>/dev/null || printf '')"
 
-  # JSON-escape data (backslash + double-quote)
-  data="${data//\\/\\\\}"
-  data="${data//\"/\\\"}"
+  # extra key=value pairs → JSON object
+  local extras='{}' kv k v
+  for kv in "$@"; do
+    [ -z "$kv" ] && continue
+    k="${kv%%=*}"; v="${kv#*=}"
+    extras="$(jq -c --arg k "$k" --arg v "$v" '. + {($k):$v}' <<<"$extras" 2>/dev/null || printf '%s' "$extras")"
+  done
 
-  local url="${ONE_API_URL:-http://localhost:4321}/api/signal"
+  # tags: caller csv + always-on cc/session/<proj>/<type> so any subscriber can route it
+  local tags_json
+  tags_json="$(jq -Rc --arg proj "$proj" --arg type "$type" \
+    'split(",")|map(select(length>0)) + ["cc","session",$proj,$type]|unique' <<<"$tags_csv" 2>/dev/null || printf '%s' '["cc","session"]')"
 
-  # Backgrounded, silent, non-blocking. Telemetry failure never breaks tooling.
-  curl -sS -o /dev/null --max-time 2 -X POST "$url" \
-    -H 'Content-Type: application/json' \
-    -d "{\"sender\":\"hook\",\"receiver\":\"$receiver\",\"amount\":$weight,\"data\":\"$data\"}" \
-    >/dev/null 2>&1 &
+  # slug/board are the service-caller nomination pair (text/code-signals-plan.md § The
+  # pairing constraint): "one" is the platform's own workspace (PLATFORM_SLUG default,
+  # world-receivers.ts), "marketplace" is the one board a sender and a differently-
+  # identified subscriber can both land in — world:announce never delivers to its own
+  # sender. Only honored server-side when the request also authenticates below.
+  local payload
+  payload="$(jq -nc \
+    --argjson tags "$tags_json" --argjson extras "$extras" \
+    --arg type "$type" --arg text "$text" --arg pri "$priority" \
+    --arg sender "cc:$proj" --arg session "$session" --arg proj "$proj" --arg branch "$branch" \
+    --arg slug "${CC_WORLD_SLUG:-one}" \
+    '{sender:$sender, data: ({tags:$tags, type:$type, text:$text, priority:$pri, session:$session, cwd:$proj, branch:$branch, source:"claude-code", slug:$slug, board:"marketplace"} + $extras)}' 2>/dev/null)"
+  [ -z "$payload" ] && return 0
 
+  local -a hdr=(-H 'Content-Type: application/json')
+  local api_key gw_secret authcfg=""
+  api_key="$(_one_secret GATEWAY_API_KEY)"
+  gw_secret="$(_one_secret GATEWAY_SERVICE_SECRET)"
+  if [ -n "$api_key" ] || [ -n "$gw_secret" ]; then
+    # Secrets off argv (ps aux would leak a bare -H value) — fold both into a
+    # private 0600 curl --config file instead.
+    authcfg="$(mktemp)"; chmod 600 "$authcfg"
+    [ -n "$api_key" ] && printf 'header = "Authorization: Bearer %s"\n' "$api_key" >>"$authcfg"
+    [ -n "$gw_secret" ] && printf 'header = "X-Gateway-Key: %s"\n' "$gw_secret" >>"$authcfg"
+    hdr+=(--config "$authcfg")
+  fi
+
+  ( curl -sS -o /dev/null --max-time 2 -X POST "$(_one_world_url)" \
+      "${hdr[@]}" -d "$payload" >/dev/null 2>&1
+    [ -n "$authcfg" ] && rm -f "$authcfg" ) &
+  return 0
+}
+
+# Back-compat low-level emitter — LOCAL crumb only, never the world.
+# tool-signal.sh fires this on EVERY tool (PostToolUse *); broadcasting each one to
+# world:announce would be a firehose that floods the live world. Tool-level telemetry
+# stays a local per-session crumb (greppable, zero network); the world only hears the
+# session-level rich signals (emit_world: session:intent/start/stop) + /do's own
+# world:do-event milestones. Roll tool activity up into session:stop, don't stream it.
+emit_signal() {
+  local receiver="${1:-hook}" weight="${2:-1}"
+  shift 2 2>/dev/null || true
+  local log="${TMPDIR:-/tmp}/cc-signals-${CLAUDE_SESSION_ID:-session}.log"
+  printf '%s\t%s\t%s\n' "$receiver" "$weight" "$*" >>"$log" 2>/dev/null || true
   return 0
 }

package/hooks/scripts/announce.ts

@@ -0,0 +1,74 @@
+#!/usr/bin/env bun
+export {}
+// UserPromptSubmit hook — announce Claude Code session to space:<slug> #staff once per session.
+// Reads ONE_WORKSPACE_SLUG + ONE_API_KEY from $CLAUDE_PROJECT_DIR/.env.local.
+
+const projectDir = process.env.CLAUDE_PROJECT_DIR ?? process.cwd()
+
+async function readEnv(): Promise<Record<string, string>> {
+  const out: Record<string, string> = {}
+  for (const src of ['.env', '.env.local']) {
+    const f = Bun.file(`${projectDir}/${src}`)
+    if (!await f.exists()) continue
+    for (const line of (await f.text()).split('\n')) {
+      const [k, ...rest] = line.split('=')
+      if (k && rest.length) out[k.trim()] = rest.join('=').trim()
+    }
+  }
+  // Also honour process.env overrides
+  for (const k of ['ONE_API_KEY', 'ONE_WORKSPACE_SLUG', 'ONE_API_URL']) {
+    if (process.env[k]) out[k] = process.env[k]!
+  }
+  return out
+}
+
+async function main(): Promise<void> {
+  let stdin = ''
+  try {
+    for await (const chunk of (process as unknown as { stdin: AsyncIterable<Uint8Array> }).stdin) {
+      stdin += new TextDecoder().decode(chunk)
+    }
+  } catch { /* no payload */ }
+
+  let ctx: { session_id?: string } = {}
+  try { ctx = JSON.parse(stdin) } catch {}
+
+  const sessionId = ctx.session_id
+  if (!sessionId) return
+
+  const flagFile = `/tmp/one-announced-${sessionId}`
+  if (await Bun.file(flagFile).exists()) return
+  await Bun.write(flagFile, '1')
+  await Bun.write(`/tmp/one-ts-${sessionId}`, String(Date.now()))
+
+  const env = await readEnv()
+  const slug = env.ONE_WORKSPACE_SLUG
+  const key  = env.ONE_API_KEY
+  const base = env.ONE_API_URL ?? 'https://one.ie'
+  if (!slug || !key) return
+
+  // Start SSE listener for macOS notifications (best-effort).
+  const ccConnect = `${projectDir}/node_modules/@oneie/claude/scripts/cc-connect.sh`
+  try {
+    Bun.spawn(['bash', ccConnect, 'join', `space:${slug}`], { stdout: 'pipe', stderr: 'pipe' })
+  } catch {}
+
+  // Start watcher daemon.
+  try {
+    Bun.spawn(['bun', `${projectDir}/node_modules/@oneie/claude/hooks/scripts/watcher.ts`, sessionId], {
+      stdout: 'ignore', stderr: 'ignore', cwd: projectDir,
+    })
+  } catch {}
+
+  // Announce to space:<slug> #staff.
+  try {
+    await fetch(`${base}/api/ask/space:post`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${key}` },
+      body: JSON.stringify({ data: { space: slug, content: `Claude Code session started (${slug})`, tags: ['staff'] } }),
+      signal: AbortSignal.timeout(5000),
+    })
+  } catch {}
+}
+
+await main()

package/hooks/scripts/cleanup.ts

@@ -0,0 +1,17 @@
+#!/usr/bin/env bun
+export {}
+// Stop hook — remove session flag files so watcher.ts exits cleanly.
+let stdin = ''
+try {
+  for await (const chunk of (process as unknown as { stdin: AsyncIterable<Uint8Array> }).stdin) {
+    stdin += new TextDecoder().decode(chunk)
+  }
+} catch {}
+
+let ctx: { session_id?: string } = {}
+try { ctx = JSON.parse(stdin) } catch {}
+
+const sessionId = ctx.session_id
+if (sessionId) {
+  Bun.spawn(['rm', '-f', `/tmp/one-announced-${sessionId}`, `/tmp/one-ts-${sessionId}`])
+}

package/hooks/scripts/compact-hint.sh

@@ -7,8 +7,7 @@
 # Disable: ECC_DISABLED_HOOKS=hook:compact-hint
 
 # shellcheck source=lib/hook.sh
-_HOOK_LIB="${CLAUDE_PLUGIN_ROOT:-$CLAUDE_PROJECT_DIR/.claude}/hooks/lib"
-source "$_HOOK_LIB/hook.sh"
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/hook.sh"
 is_hook_disabled "hook:compact-hint" && exit 0
 
 PAYLOAD="${1:-}"

package/hooks/scripts/config-protect.sh

@@ -11,8 +11,7 @@
 # Disable: ECC_DISABLED_HOOKS=hook:config-protect
 
 # shellcheck source=lib/hook.sh
-_HOOK_LIB="${CLAUDE_PLUGIN_ROOT:-$CLAUDE_PROJECT_DIR/.claude}/hooks/lib"
-source "$_HOOK_LIB/hook.sh"
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/hook.sh"
 is_hook_disabled "hook:config-protect" && exit 0
 
 PAYLOAD="${1:-}"