@oneie/claude 0.5.0 → 0.7.0

package/scripts/subdomains-proof.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# subdomains-proof.sh — the subdomains promise's proof: — text/subdomains.md
+#
+# Seeds a disposable fixture agency (plan=agency, a verified parent domain, and a
+# world-key to authenticate as it), provisions a disposable client subdomain via
+# POST /api/domain?action=provision-subdomain, curls the resulting host with a
+# Host-header override and confirms the response is the CLIENT's own workspace
+# (page <title> carries the client's identity, not the agency's), then tears
+# down every fixture row it created — success or failure (trap).
+#
+# Exit 0 — provisioned, live-routed to the client's own workspace.
+# Exit 1 — an assertion failed.
+# Exit 2 — environment not ready (wrangler/curl/jq missing, D1 seed failed).
+#
+# Env: ONE_API_URL (default http://localhost:4321), ONE_D1_DB (default one-owners).
+set -u
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+WEB_DIR="$ROOT/one.ie/web"
+API_URL="${ONE_API_URL:-http://localhost:4321}"
+DB_NAME="${ONE_D1_DB:-one-owners}"
+
+for bin in curl jq openssl bunx; do
+  command -v "$bin" >/dev/null 2>&1 || { echo "[subdomains-proof] $bin required"; exit 2; }
+done
+
+# Sanity gate: $API_URL must be the one.ie/web dev server, not a neighbouring
+# app squatting the default port (an unauthenticated POST to /api/domain must
+# return JSON — the route answers {"error":"unauthorized"}; a squatter serves
+# its HTML 404 page).
+probe="$(curl -sS --max-time 5 -X POST "$API_URL/api/domain" -H 'Content-Type: application/json' -d '{}' || true)"
+if ! printf '%s' "$probe" | jq -e . >/dev/null 2>&1; then
+  echo "[subdomains-proof] environment not ready: $API_URL is not the one.ie/web dev server (set ONE_API_URL)"
+  exit 2
+fi
+
+SUFFIX="$$"
+AGENCY="do-proof-agency-$SUFFIX"
+CLIENT="do-proof-client-$SUFFIX"
+AGENCY_DOMAIN="proof-agency-$SUFFIX.test"
+RAW_KEY="one-$(openssl rand -hex 24)"
+KEY_HASH="$(printf '%s' "$RAW_KEY" | openssl dgst -sha256 -hex | awk '{print $NF}')"
+KEY_ID="$(openssl rand -hex 16)"
+CLIENT_HOST="$CLIENT.$AGENCY_DOMAIN"
+
+d1() { (cd "$WEB_DIR" && bunx wrangler d1 execute "$DB_NAME" --local --command "$1"); }
+
+SEEDED=0
+AUTHCFG=""
+teardown() {
+  [ -n "$AUTHCFG" ] && rm -f "$AUTHCFG"
+  [ "$SEEDED" -eq 1 ] || return 0
+  d1 "DELETE FROM domains WHERE host IN ('$AGENCY_DOMAIN','$CLIENT_HOST');
+      DELETE FROM owners WHERE slug IN ('$AGENCY','$CLIENT');
+      DELETE FROM world_keys WHERE actor_id = '$AGENCY';
+      DELETE FROM world_actors WHERE aid = '$AGENCY';" >/dev/null 2>&1
+}
+trap teardown EXIT
+# Token off argv (ps aux would leak a bare -H value) — one private 0600 curl
+# --config file for the process lifetime.
+AUTHCFG="$(mktemp)"; chmod 600 "$AUTHCFG"
+printf 'header = "Authorization: Bearer %s"\n' "$RAW_KEY" >"$AUTHCFG"
+
+d1 "INSERT INTO owners (slug, pubkey, credential_id, plan) VALUES ('$AGENCY','group','group','agency');
+    INSERT INTO world_actors (aid, name, type) VALUES ('$AGENCY','$AGENCY','agent');
+    INSERT INTO world_keys (key_id, key_hash, actor_id, label) VALUES ('$KEY_ID','$KEY_HASH','$AGENCY','subdomains-proof');
+    INSERT INTO domains (host, gid, verified_at) VALUES ('$AGENCY_DOMAIN','group:$AGENCY', unixepoch());" >/dev/null 2>&1
+if [ $? -ne 0 ]; then echo "[subdomains-proof] seed failed"; exit 2; fi
+SEEDED=1
+
+resp="$(curl -sS --max-time 10 -X POST "$API_URL/api/domain?action=provision-subdomain" \
+  -H 'Content-Type: application/json' --config "$AUTHCFG" \
+  -d "$(jq -nc --arg s "$AGENCY" --arg c "$CLIENT" '{slug:$s,parentSlug:$s,clientSlug:$c}')")"
+host="$(printf '%s' "$resp" | jq -r '.host // empty')"
+has_edge="$(printf '%s' "$resp" | jq 'has("edgeRouted")')"
+echo "[subdomains-proof] provision host=$host edgeRouted-present=$has_edge resp=$resp"
+if [ "$host" != "$CLIENT_HOST" ] || [ "$has_edge" != "true" ]; then
+  echo "[subdomains-proof] FAIL — unexpected provision response"
+  exit 1
+fi
+
+page="$(curl -sS --max-time 10 -H "Host: $CLIENT_HOST" "$API_URL/")"
+case "$page" in
+  *"@$CLIENT"*) : ;;
+  *) echo "[subdomains-proof] FAIL — live host did not serve the client's own workspace"; exit 1 ;;
+esac
+case "$page" in
+  *"@$AGENCY"*) echo "[subdomains-proof] FAIL — live host served the agency's workspace instead"; exit 1 ;;
+esac
+
+echo "[subdomains-proof] PASS — $CLIENT_HOST provisioned live and routed to $CLIENT's own workspace"
+exit 0

package/scripts/tg-listen.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# tg-listen — listen for Telegram messages and auto-reply via Claude Code
+# Usage:
+#   tg-listen.sh start [group]   # start background listener (default: donal)
+#   tg-listen.sh stop  [group]
+#   tg-listen.sh status
+#   tg-listen.sh log   [group]
+
+set -uo pipefail
+
+REPO="$(git -C "$(dirname "$0")" rev-parse --show-toplevel)"
+SCRIPTS="$REPO/.claude/scripts"
+CHANNELS_URL="${CHANNELS_URL:-https://channels.one.ie}"
+DIR="$REPO/.claude/.tg-listen"
+mkdir -p "$DIR"
+
+DEFAULT_GROUP="tg-1328669602-714125982"
+
+# Map group id → notify.sh recipient name
+recipient_for() {
+  case "$1" in
+    tg-1328669602-714125982) echo "donal" ;;
+    *) echo "" ;;
+  esac
+}
+
+all_groups() {
+  echo "tg-1328669602-714125982"
+}
+
+pid_file() { echo "$DIR/$1.pid"; }
+log_file() { echo "$DIR/$1.log"; }
+ts_file()  { echo "$DIR/$1.last_ts"; }
+
+is_running() {
+  local pidf; pidf=$(pid_file "$1")
+  [[ -f "$pidf" ]] && kill -0 "$(<"$pidf")" 2>/dev/null
+}
+
+start_listener() {
+  local group="${1:-$DEFAULT_GROUP}"
+  local foreground="${2:-}"
+  local recipient; recipient=$(recipient_for "$group")
+
+  if [[ -z "$recipient" ]]; then
+    echo "unknown group: $group" >&2; exit 1
+  fi
+
+  if [[ -z "$foreground" ]] && is_running "$group"; then
+    echo "already listening on $group (pid=$(cat "$(pid_file "$group")"))"
+    return 0
+  fi
+
+  [[ -f "$(ts_file "$group")" ]] || echo "0" > "$(ts_file "$group")"
+
+  run_loop() {
+    while true; do
+      last_ts=$(cat "$(ts_file "$group")" 2>/dev/null || echo 0)
+      curl -N -sS --max-time 90 \
+        --header "Last-Event-ID: $last_ts" \
+        "$CHANNELS_URL/stream/$group?since=$last_ts" 2>/dev/null \
+      | while IFS= read -r line; do
+          [[ "$line" != "data: "* ]] && continue
+          payload="${line#data: }"
+
+          sender=$(echo "$payload" | jq -r '.sender // empty' 2>/dev/null)
+          content=$(echo "$payload" | jq -r '.content // empty' 2>/dev/null)
+          ts=$(echo "$payload" | jq -r '.ts // empty' 2>/dev/null)
+          [[ -z "$sender" || -z "$content" ]] && continue
+          [[ -n "$ts" ]] && echo "$ts" > "$(ts_file "$group")"
+
+          # skip our own replies and system messages
+          [[ "$sender" == "claude-code" || "$sender" == "onedotbot" || "$sender" == "assistant" || "$sender" == "workflow" ]] && continue
+
+          echo "[$(date '+%H:%M:%S')] $sender: $content" >> "$(log_file "$group")"
+
+          CONTEXT_FILE="$DIR/context.md"
+          if [[ -f "$CONTEXT_FILE" ]]; then
+            reply=$(echo "$content" | claude -p --system "$(cat "$CONTEXT_FILE")" 2>/dev/null)
+          else
+            reply=$(echo "$content" | claude -p --system "You are onedotbot, replying via Telegram on behalf of Tony O'Connell (one.ie). Donal is Tony's co-founder. Be concise and direct." 2>/dev/null)
+          fi
+          [[ -z "$reply" ]] && continue
+
+          echo "[$(date '+%H:%M:%S')] reply: $reply" >> "$(log_file "$group")"
+          "$SCRIPTS/notify.sh" --to "$recipient" "$reply"
+        done
+      sleep 1
+    done
+  }
+
+  if [[ "$foreground" == "--foreground" ]]; then
+    echo "listening on $group → $recipient (foreground)"
+    run_loop >> "$(log_file "$group")" 2>&1
+  else
+    run_loop >> "$(log_file "$group")" 2>&1 &
+    echo $! > "$(pid_file "$group")"
+    echo "listening on $group → $recipient (pid=$!)"
+  fi
+}
+
+stop_listener() {
+  local group="${1:-$DEFAULT_GROUP}"
+  local pidf; pidf=$(pid_file "$group")
+  if [[ -f "$pidf" ]]; then
+    kill "$(<"$pidf")" 2>/dev/null && echo "stopped $group" || echo "already stopped"
+    rm -f "$pidf"
+  else
+    echo "not running"
+  fi
+}
+
+status() {
+  for group in $(all_groups); do
+    recipient=$(recipient_for "$group")
+    if is_running "$group"; then
+      echo "✓ $group → $recipient (pid=$(cat "$(pid_file "$group")"))"
+    else
+      echo "✗ $group → $recipient (stopped)"
+    fi
+  done
+}
+
+cmd="${1:-status}"
+group="${2:-}"
+foreground="${3:-}"
+
+case "$cmd" in
+  start)  start_listener "${group:-$DEFAULT_GROUP}" "$foreground" ;;
+  stop)   stop_listener  "${group:-$DEFAULT_GROUP}" ;;
+  status) status ;;
+  log)    tail -f "$(log_file "${group:-$DEFAULT_GROUP}")" ;;
+  *)      echo "usage: tg-listen.sh <start|stop|status|log> [group] [--foreground]" >&2; exit 1 ;;
+esac

package/scripts/typedb-cluster-status.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# typedb-cluster-status.sh — read the TypeDB Cloud CONTROL plane and answer the
+# one question the data plane cannot: is the instance running and the process
+# dying, or is the instance never coming up at all?
+#
+# This is step 1 of text/typedb-production-problem-solutions.md § Solutions.
+# Everything else about the cluster (resize vs rebuild vs escalate) is guessing
+# until this is read.
+#
+#   servers present but unhealthy  -> instance runs, TypeDB process fails
+#                                     => resource limits, resize (solution 2)
+#   servers empty / missing        -> instance is not being provisioned
+#                                     => platform issue, TypeDB support (solution 4)
+#   servers appear/disappear       -> crash loop, which is what the external
+#     between polls                  behaviour has looked like all along
+#
+# Usage:
+#   bash .claude/scripts/typedb-cluster-status.sh          # one read
+#   bash .claude/scripts/typedb-cluster-status.sh --watch  # poll 10x/5s — catches a crash loop
+#
+# Needs ONE secret this machine does not have. Mint it in the TypeDB Cloud
+# console (Settings -> API keys) and put it in .claude/typedb/prod.env
+# (gitignored, mode 600):
+#
+#   TYPEDB_CLOUD_TOKEN=<the key>
+#
+# The team / space / cluster IDs are DISCOVERED from the token — don't hunt for
+# them. Override only if discovery picks the wrong one:
+#   TYPEDB_CLOUD_TEAM_ID= / TYPEDB_CLOUD_SPACE_ID= / TYPEDB_CLOUD_CLUSTER_ID=
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+PROD_ENV="$ROOT/.claude/typedb/prod.env"
+API="${TYPEDB_CLOUD_API:-https://cloud.typedb.com}"
+WATCH=0; [ "${1:-}" = "--watch" ] && WATCH=1
+
+[ -f "$PROD_ENV" ] && eval "$(python3 - "$PROD_ENV" <<'PY'
+import re,sys,shlex
+for line in open(sys.argv[1], errors="replace"):
+    m = re.match(r'^\s*(?:export\s+)?(TYPEDB_CLOUD_\w+)\s*=\s*(.*?)\s*$', line)
+    if m: print(f"{m.group(1)}={shlex.quote(m.group(2).strip(chr(34)+chr(39)))}")
+PY
+)"
+: "${TYPEDB_CLOUD_TOKEN:=}" "${TYPEDB_CLOUD_TEAM_ID:=}" "${TYPEDB_CLOUD_SPACE_ID:=}" "${TYPEDB_CLOUD_CLUSTER_ID:=}"
+
+if [ -z "$TYPEDB_CLOUD_TOKEN" ]; then
+  cat >&2 <<EOF
+CANNOT RUN: no TYPEDB_CLOUD_TOKEN.
+
+This is the control-plane credential, and it is NOT the same as the four
+TYPEDB_* keys already in prod.env — those log in to the cluster to run queries
+and carry no authority over the instance.
+
+  1. TypeDB Cloud console -> Settings -> API keys -> create
+  2. printf 'TYPEDB_CLOUD_TOKEN=%s\n' '<key>' >> $PROD_ENV
+     chmod 600 $PROD_ENV
+  3. re-run this script
+
+Verified reachable 2026-07-29: ${API}/api/v1/{team,teams,clusters,user} all
+answer 401 UNAUTHENTICATED_REQUEST, so the API is live and only wants the key.
+EOF
+  exit 3
+fi
+
+# The console has used more than one header scheme over time; try each and keep
+# whichever authenticates, rather than guessing one and reporting a false 401.
+AUTH=""
+for scheme in "Authorization: Bearer $TYPEDB_CLOUD_TOKEN" "X-API-Key: $TYPEDB_CLOUD_TOKEN" "Authorization: $TYPEDB_CLOUD_TOKEN"; do
+  code=$(curl -s -o /dev/null -m 20 -w '%{http_code}' -H "$scheme" "$API/api/v1/teams")
+  [ "$code" = "200" ] && { AUTH="$scheme"; break; }
+done
+if [ -z "$AUTH" ]; then
+  echo "CANNOT RUN: token rejected by every auth scheme tried (Bearer / X-API-Key / raw)." >&2
+  echo "  The key may be expired, scoped to another team, or the API may have moved." >&2
+  exit 3
+fi
+
+get() { curl -s -m 30 -H "$AUTH" "$API$1"; }
+
+# ── discover the IDs so nobody has to hunt for them ───────────────────────
+[ -z "$TYPEDB_CLOUD_TEAM_ID" ] && TYPEDB_CLOUD_TEAM_ID=$(get /api/v1/teams | python3 -c '
+import sys,json
+try:
+    d=json.load(sys.stdin)
+    ts=d.get("teams") or d.get("data") or (d if isinstance(d,list) else [])
+    print((ts[0].get("id") or ts[0].get("uuid") or ts[0].get("slug") or "") if ts else "")
+except Exception: print("")')
+[ -z "$TYPEDB_CLOUD_TEAM_ID" ] && { echo "CANNOT RUN: authenticated, but no team returned." >&2; exit 3; }
+
+[ -z "$TYPEDB_CLOUD_SPACE_ID" ] && TYPEDB_CLOUD_SPACE_ID=$(get "/api/v1/team/$TYPEDB_CLOUD_TEAM_ID/spaces" | python3 -c '
+import sys,json
+try:
+    d=json.load(sys.stdin)
+    ss=d.get("spaces") or d.get("data") or (d if isinstance(d,list) else [])
+    print((ss[0].get("id") or ss[0].get("uuid") or ss[0].get("slug") or "") if ss else "")
+except Exception: print("")')
+
+BASE="/api/v1/team/$TYPEDB_CLOUD_TEAM_ID/spaces/$TYPEDB_CLOUD_SPACE_ID/clusters"
+echo "team=$TYPEDB_CLOUD_TEAM_ID space=$TYPEDB_CLOUD_SPACE_ID"
+
+report() {
+  get "$BASE${TYPEDB_CLOUD_CLUSTER_ID:+/$TYPEDB_CLOUD_CLUSTER_ID}" | python3 - "$@" <<'PY'
+import sys, json
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    print("  (unparseable response)"); sys.exit(0)
+cs = d.get("clusters") or d.get("data") or (d if isinstance(d, list) else [d])
+for c in cs:
+    if not isinstance(c, dict): continue
+    name = c.get("id") or c.get("name") or c.get("slug") or "?"
+    servers = c.get("servers") or []
+    line = f"  cluster {name}  status={c.get('status','?')}  tier={c.get('machineType') or c.get('tier') or c.get('size','?')}  servers={len(servers)}"
+    for s in servers:
+        line += f"\n      server {s.get('id') or s.get('name','?')}  status={s.get('status','?')}"
+    print(line)
+    if not servers:
+        print("      NO SERVERS -> the instance is not being provisioned. Platform issue: raise with TypeDB support.")
+    elif any(str(s.get("status","")).lower() not in ("running","ready","healthy") for s in servers):
+        print("      UNHEALTHY SERVER -> the instance runs and the TypeDB process fails. Resource limits: resize.")
+PY
+}
+
+if [ $WATCH -eq 1 ]; then
+  echo "polling 10x every 5s — servers appearing and disappearing between polls IS the crash loop"
+  for i in $(seq 1 10); do printf '[%02d] ' "$i"; report; sleep 5; done
+else
+  report
+fi

package/scripts/typedb-env.sh

@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+# typedb-env.sh — switch one.ie/web/.env between the local (dev) and cloud (prod)
+# TypeDB substrate. Rewrites only the four TYPEDB_* lines; everything else in
+# .env is untouched.
+#
+#   .claude/scripts/typedb-env.sh            # status
+#   .claude/scripts/typedb-env.sh dev        # point at local OrbStack container
+#   .claude/scripts/typedb-env.sh prod       # point back at TypeDB Cloud
+#   .claude/scripts/typedb-env.sh up         # start the local container
+#   .claude/scripts/typedb-env.sh down       # stop the local container
+#
+# Profiles live in .claude/typedb/{dev,prod}.env (gitignored — prod holds a
+# password). Re-snapshot prod at any time with:  cp-from-env prod
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENVF="$ROOT/one.ie/web/.env"
+PROFILES="$ROOT/.claude/typedb"
+KEYS='TYPEDB_URL TYPEDB_DATABASE TYPEDB_USERNAME TYPEDB_PASSWORD'
+CONTAINER=typedb
+# Pinned to the version TypeDB Cloud runs (checked via GET $TYPEDB_URL/v1/version).
+# Dev mirrors the substrate, it does not lead it — bump only when prod does.
+# Prod moved to 3.12.1 on 2026-07-29 and the local container was migrated in place
+# the same day; this pin was left at 3.8.3, so a container rebuild would have
+# silently DOWNGRADED local back under the two 3.8.3 server-killing bugs
+# (`\uXXXX` in a literal, and the same var in two roles → PANIC, not an error).
+IMAGE=typedb/typedb:3.12.1
+VOLUME=typedb-data
+# The path the SERVER actually writes to, not the one the tarball layout suggests.
+# `docker inspect typedb` -> `server --storage.data-directory=/var/lib/typedb/data`.
+# The old value mounted the named volume at /opt/... where nothing was ever written,
+# so every local database lived in an ANONYMOUS volume — one `docker rm` from being
+# orphaned, and no local backup would have contained anything.
+DATA_DIR=/var/lib/typedb/data
+
+die() { echo "typedb-env: $*" >&2; exit 1; }
+val() { grep -E "^$1=" "$ENVF" | tail -1 | cut -d= -f2-; }
+
+# Which profile does the live .env currently match? (compare URL only)
+current() {
+  local url; url=$(val TYPEDB_URL)
+  for p in dev prod; do
+    [ -f "$PROFILES/$p.env" ] || continue
+    if [ "$url" = "$(grep -E '^TYPEDB_URL=' "$PROFILES/$p.env" | cut -d= -f2-)" ]; then
+      echo "$p"; return
+    fi
+  done
+  echo "custom"
+}
+
+status() {
+  local cur; cur=$(current)
+  echo "profile : $cur"
+  echo "url     : $(val TYPEDB_URL)"
+  echo "database: $(val TYPEDB_DATABASE)"
+  local st; st=$(docker ps -a --filter "name=^${CONTAINER}$" --format '{{.Status}}' 2>/dev/null || true)
+  echo "local   : ${st:-not created}"
+  local url; url=$(val TYPEDB_URL)
+  if curl -sf -m 5 -X POST "$url/v1/signin" -H 'content-type: application/json' \
+       -d "{\"username\":\"$(val TYPEDB_USERNAME)\",\"password\":\"$(val TYPEDB_PASSWORD)\"}" \
+       >/dev/null 2>&1; then
+    echo "signin  : ok"
+  else
+    echo "signin  : FAILED"
+  fi
+  echo "scope   : one.ie/web/.env only — api/wrangler.toml stays pinned to cloud,"
+  echo "          as do tools that default to it when env is unset (pay/tools/"
+  echo "          simulate-market.ts, text/seed-tasks-typedb.ts, text/backfill-task-context.ts)"
+}
+
+use() {
+  local p="$1" src="$PROFILES/$1.env"
+  [ -f "$src" ] || die "no profile $p (expected $src)"
+  [ -f "$ENVF" ] || die "no env file at $ENVF"
+  # Snapshot named for the profile being LEFT, so a rollback target is never
+  # clobbered by the next switch (a single .bak slot ends up holding the very
+  # profile you were trying to get away from).
+  cp "$ENVF" "$ENVF.bak.$(current)"
+  for k in $KEYS; do
+    local line; line=$(grep -E "^$k=" "$src" | tail -1) || die "$p profile missing $k"
+    # in-place replace; portable sed needs the value escaped for & and /
+    local esc; esc=$(printf '%s' "$line" | sed -e 's/[\/&]/\\&/g')
+    if grep -qE "^$k=" "$ENVF"; then
+      sed -i '' -E "s/^$k=.*/$esc/" "$ENVF"
+    else
+      printf '%s\n' "$line" >> "$ENVF"
+    fi
+  done
+  echo "switched to $p"
+  status
+}
+
+up() {
+  docker info >/dev/null 2>&1 || { open -a OrbStack; echo "starting OrbStack..."; }
+  for _ in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 2; done
+  docker info >/dev/null 2>&1 || die "docker daemon did not come up"
+  if docker ps -a --format '{{.Names}}' | grep -qx "$CONTAINER"; then
+    docker start "$CONTAINER" >/dev/null
+  else
+    docker volume create "$VOLUME" >/dev/null
+    docker run -d --name "$CONTAINER" --restart unless-stopped \
+      -p 1729:1729 -p 8000:8000 -v "$VOLUME:$DATA_DIR" "$IMAGE" >/dev/null
+  fi
+  for _ in $(seq 1 30); do
+    curl -sf -m 3 -X POST http://127.0.0.1:8000/v1/signin -H 'content-type: application/json' \
+      -d '{"username":"admin","password":"password"}' >/dev/null 2>&1 && { echo "local TypeDB ready"; return; }
+    sleep 2
+  done
+  die "local TypeDB did not become ready — docker logs $CONTAINER"
+}
+
+down() { docker stop "$CONTAINER" >/dev/null 2>&1 && echo "local TypeDB stopped" || echo "not running"; }
+
+# Canonical load order — schema/CLAUDE.md § Files, narrowed to what production
+# actually carries (probed via GET $TYPEDB_URL/v1/databases/one/schema, 2026-07-28).
+# Deliberately excluded, because prod does NOT have them and dev must mirror the
+# substrate rather than lead it:
+#   factory-*.tql            — "DEFINES CLEAN, NOT DEPLOYED" per schema/CLAUDE.md
+#   marketing/contact/education-schema.tql
+#                            — documented "LOAD-SAFE against prod 2026-07-08", but
+#                              absent from the live schema AND they fail to commit
+#                              on a clean 3.8.3 db (INF11: `incremental_roas` and
+#                              `recommend_strategy` read attributes off variables
+#                              whose inferred types can't own them). Loading them
+#                              is a schema fix, not an env switch.
+SCHEMA_STACK='one.tql roles.tql do.tql reason.tql router.tql channels.tql'
+
+# seed — create the local `one` database and define the canonical stack.
+# LOCAL ONLY: refuses to run unless the active profile is dev, so a stray
+# invocation can never define schema against TypeDB Cloud.
+seed() {
+  [ "$(current)" = dev ] || die "refusing: active profile is '$(current)', not dev. Run 'typedb-env.sh dev' first."
+  local url; url=$(val TYPEDB_URL)
+  local db;  db=$(val TYPEDB_DATABASE)
+  local tok
+  tok=$(curl -s -m 15 -X POST "$url/v1/signin" -H 'Content-Type: application/json' \
+        -d "{\"username\":\"$(val TYPEDB_USERNAME)\",\"password\":\"$(val TYPEDB_PASSWORD)\"}" \
+        | python3 -c 'import sys,json;print(json.load(sys.stdin).get("token",""))' 2>/dev/null)
+  [ -n "$tok" ] || die "signin failed at $url"
+
+  if curl -s -m 10 "$url/v1/databases/$db" -H "Authorization: Bearer $tok" | grep -q '"name"'; then
+    echo "database '$db' exists"
+  else
+    curl -sf -m 30 -X POST "$url/v1/databases/$db" -H "Authorization: Bearer $tok" >/dev/null \
+      || die "could not create database '$db'"
+    echo "created database '$db'"
+  fi
+
+  for f in $SCHEMA_STACK; do
+    local path="$ROOT/schema/$f"
+    [ -f "$path" ] || die "missing $path"
+    python3 - "$path" "$db" > /tmp/typedb-seed.json <<'PY'
+import json, sys
+print(json.dumps({
+    "databaseName": sys.argv[2],
+    "transactionType": "schema",
+    "query": open(sys.argv[1]).read(),
+}))
+PY
+    local out
+    out=$(curl -s -m 120 -X POST "$url/v1/query" -H "Authorization: Bearer $tok" \
+          -H 'Content-Type: application/json' --data-binary @/tmp/typedb-seed.json)
+    if printf '%s' "$out" | grep -q '"code"'; then
+      echo "  FAIL $f"
+      printf '%s\n' "$out" | head -c 600; echo
+      die "schema load aborted at $f"
+    fi
+    echo "  ok   $f"
+  done
+  rm -f /tmp/typedb-seed.json
+  echo "local schema loaded ($(printf '%s' "$SCHEMA_STACK" | wc -w | tr -d ' ') files)"
+}
+
+case "${1:-status}" in
+  dev)    up; use dev ;;
+  prod)   use prod ;;
+  up)     up ;;
+  down)   down ;;
+  seed)   seed ;;
+  status) status ;;
+  *)      die "usage: typedb-env.sh [status|dev|prod|up|down|seed]" ;;
+esac

package/scripts/typedb-flap-recorder.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# typedb-flap-recorder.sh — record the NEXT production flap in full, so it does
+# not have to be reconstructed by hand the way 2026-07-28/29 was.
+#
+# The cluster is healthy between failures, which is exactly why this is hard:
+# by the time anyone looks, the transition is gone. This samples the three
+# layers that fail INDEPENDENTLY and timestamps every change of state:
+#
+#   /v1/health   204  — readiness. Cheapest, and the first to go.
+#   /v1/signin   200  — auth path. Can pass while queries fail.
+#   /v1/query    200  — the data plane actually doing work, with latency.
+#
+# The doc's open question is whether the backend dies under no load. This answers
+# it with a timeline instead of an inference: if health flips to 5xx while this
+# is the only client, that is measured, not argued.
+#
+# Usage:
+#   bash .claude/scripts/typedb-flap-recorder.sh              # foreground
+#   nohup bash .claude/scripts/typedb-flap-recorder.sh &      # leave it running
+#   INTERVAL=5 bash .claude/scripts/typedb-flap-recorder.sh   # tighter sampling
+#
+# Log: text/typedb-flap-log.tsv (append-only, gitignored-safe to commit if short)
+#   ts  health  signin  query  query_ms  note
+#
+# Writes a line on EVERY sample to the log, but prints to the terminal only when
+# the state CHANGES — so a week of green is quiet and the flap is loud.
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+LOG="${FLAP_LOG:-$ROOT/text/typedb-flap-log.tsv}"
+INTERVAL="${INTERVAL:-15}"
+
+eval "$(python3 - "$ROOT/.claude/typedb/prod.env" <<'PY'
+import re,sys,shlex
+try: f = open(sys.argv[1], errors="replace")
+except OSError: sys.exit(0)
+for line in f:
+    m = re.match(r'^\s*(?:export\s+)?(TYPEDB_(?:URL|DATABASE|USERNAME|PASSWORD))\s*=\s*(.*?)\s*$', line)
+    if m: print(f"{m.group(1)}={shlex.quote(m.group(2).strip(chr(34)+chr(39)))}")
+PY
+)"
+: "${TYPEDB_URL:=}" "${TYPEDB_DATABASE:=one}" "${TYPEDB_USERNAME:=admin}" "${TYPEDB_PASSWORD:=}"
+[ -z "$TYPEDB_URL" ] && { echo "CANNOT RUN: no TYPEDB_URL in .claude/typedb/prod.env" >&2; exit 3; }
+case "$TYPEDB_URL" in
+  *127.0.0.1*|*localhost*) echo "refusing: prod.env points at a LOCAL substrate — nothing to record" >&2; exit 2 ;;
+esac
+
+[ -f "$LOG" ] || printf 'ts\thealth\tsignin\tquery\tquery_ms\tnote\n' > "$LOG"
+echo "recording $TYPEDB_URL every ${INTERVAL}s -> $LOG   (ctrl-c to stop)"
+
+last=""
+while true; do
+  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  health=$(curl -s -o /dev/null -m 10 -w '%{http_code}' "$TYPEDB_URL/v1/health")
+  tok=$(curl -s -m 10 -X POST "$TYPEDB_URL/v1/signin" -H 'Content-Type: application/json' \
+        -d "{\"username\":\"$TYPEDB_USERNAME\",\"password\":\"$TYPEDB_PASSWORD\"}" \
+        | python3 -c 'import sys,json
+try: print(json.load(sys.stdin).get("token",""))
+except Exception: print("")' 2>/dev/null)
+  if [ -n "$tok" ]; then
+    signin=200
+    t0=$(python3 -c 'import time;print(int(time.time()*1000))')
+    query=$(curl -s -o /dev/null -m 30 -w '%{http_code}' -X POST "$TYPEDB_URL/v1/query" \
+      -H "Authorization: Bearer $tok" -H 'Content-Type: application/json' \
+      -d "{\"databaseName\":\"$TYPEDB_DATABASE\",\"transactionType\":\"read\",\"query\":\"match \$x isa thing; reduce \$c = count;\"}")
+    t1=$(python3 -c 'import time;print(int(time.time()*1000))')
+    qms=$((t1 - t0))
+  else
+    # A signin that returns no token is NOT necessarily auth failure — on this
+    # cluster it is usually the backend being gone. Record the transport code.
+    signin=$(curl -s -o /dev/null -m 10 -w '%{http_code}' -X POST "$TYPEDB_URL/v1/signin" \
+             -H 'Content-Type: application/json' \
+             -d "{\"username\":\"$TYPEDB_USERNAME\",\"password\":\"$TYPEDB_PASSWORD\"}")
+    query="-"; qms="-"
+  fi
+
+  state="$health/$signin/$query"
+  note=""
+  [ "$state" != "$last" ] && [ -n "$last" ] && note="STATE CHANGE from $last"
+  printf '%s\t%s\t%s\t%s\t%s\t%s\n' "$ts" "$health" "$signin" "$query" "$qms" "$note" >> "$LOG"
+  if [ "$state" != "$last" ]; then
+    printf '%s  health=%-4s signin=%-4s query=%-4s %sms  %s\n' "$ts" "$health" "$signin" "$query" "$qms" "$note"
+    last="$state"
+  fi
+  sleep "$INTERVAL"
+done