@oneie/claude 0.6.0 → 0.7.0

package/scripts/factory-tasks-check.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# factory-tasks-check.sh — the LIVE half of text/factory-tasks.md.
+#
+# Every other check in that promise asserts an EMITTED TQL STRING. That is the right
+# instrument for a query-builder change, and it is not enough on its own: all of them
+# can be green while nothing ever came back from a substrate, because the production
+# graph holds 6 `deliverable` rows against 783 written in promise markdown. So this
+# check seeds a real objective -> deliverable -> task, reads it back through the
+# widened path, and asserts the nesting survives AND that a deliverable with no task
+# under it is visible as a gap.
+#
+# Modes:
+#   ladder-live   seed a ladder in a SCRATCH db, read it back nested
+#
+# Exit: 0 = ok · 1 = RED (the wire is broken) · 3 = CANNOT RUN (no scratch db / no creds)
+#
+# 1 vs 3 is load-bearing, same as factory-check.sh: red sends someone to fix the build,
+# cannot-run sends them to fix the environment. Never widen a cannot-run into a red.
+#
+# NEVER runs against `one`. The scratch db is named explicitly by TYPEDB_TEST_DB and
+# the guard below refuses if it resolves to the production database — a seeding check
+# pointed at production writes fabricated rungs into the graph the board reads.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+MODE="${1:-ladder-live}"
+
+red()    { echo "RED  $1" >&2; return 1; }
+cannot() { echo "CANNOT RUN: $1" >&2; return 3; }
+
+# Same parser as factory-check.sh — `set -a && . .env` aborts on that file's
+# hyphenated key + unquoted value.
+eval "$(python3 - "$ROOT/one.ie/web/.env" <<'PY'
+import re,sys,shlex
+for line in open(sys.argv[1], errors="replace"):
+    m = re.match(r'^\s*(TYPEDB_(?:URL|DATABASE|USERNAME|PASSWORD))\s*=\s*(.*?)\s*$', line)
+    if m: print(f"{m.group(1)}={shlex.quote(m.group(2).strip(chr(34)+chr(39)))}")
+PY
+)"
+: "${TYPEDB_URL:=}" "${TYPEDB_DATABASE:=}" "${TYPEDB_USERNAME:=}" "${TYPEDB_PASSWORD:=}" "${TYPEDB_TEST_DB:=}"
+
+check_ladder_live() {
+  local t="$ROOT/one.ie/web/src/lib/resolvers/factory-ladder-live.test.ts"
+  [ -f "$t" ] || return $(red "no factory-ladder-live.test.ts — the ladder read is unproven against any substrate")
+  [ -n "$TYPEDB_URL" ] || return $(cannot "no TYPEDB_URL in one.ie/web/.env")
+  [ -n "$TYPEDB_TEST_DB" ] \
+    || return $(cannot "no TYPEDB_TEST_DB scratch database — this check SEEDS rungs, so it must never point at the production graph the board reads")
+
+  # The production guard. TYPEDB_DATABASE is what the app talks to; if the scratch name
+  # equals it (or is the well-known prod name), refuse — seeding there would write
+  # fabricated rungs into the graph /factory and /u/<slug>/tasks both read.
+  if [ "$TYPEDB_TEST_DB" = "${TYPEDB_DATABASE:-}" ] || [ "$TYPEDB_TEST_DB" = "one" ]; then
+    return $(red "TYPEDB_TEST_DB is the PRODUCTION database — refusing to seed rungs into it")
+  fi
+
+  local out
+  out=$(cd "$ROOT/one.ie/web" && \
+        TYPEDB_URL="$TYPEDB_URL" \
+        TYPEDB_USERNAME="$TYPEDB_USERNAME" \
+        TYPEDB_PASSWORD="$TYPEDB_PASSWORD" \
+        TYPEDB_TEST_DB="$TYPEDB_TEST_DB" \
+        bunx vitest run src/lib/resolvers/factory-ladder-live.test.ts 2>&1)
+
+  # An empty scratch db answers "Type label 'thing' not found" — the schema was never
+  # loaded there. That is an environment gap, not a broken ladder.
+  printf '%s' "$out" | grep -qE "Type label '(thing|containment|blocks)' not found" \
+    && return $(cannot "scratch db $TYPEDB_TEST_DB has no schema loaded — load schema/one.tql into it first")
+  printf '%s' "$out" | grep -qE 'Failed to parse URL|ERR_INVALID_URL|signin failed' \
+    && return $(cannot "scratch db named but the credentials did not reach vitest")
+
+  # A SKIPPED test is not a proof. The test is `describe.skipIf(!TYPEDB_TEST_DB)`, so
+  # without this guard vitest exits 0 having run nothing — the exact fail-open this
+  # check exists to forbid.
+  printf '%s' "$out" | grep -qE 'Tests[[:space:]]+.*skipped' \
+    && return $(red "ladder-live tests SKIPPED — a skipped test is not a proof (fail-open)")
+  printf '%s' "$out" | grep -qE 'Tests[[:space:]]+[1-9][0-9]*[[:space:]]+passed' \
+    || return $(red "ladder-live tests did not pass — a seeded objective->deliverable->task did not come back nested")
+
+  echo "ok   ladder-live (scratch db $TYPEDB_TEST_DB)"
+}
+
+case "$MODE" in
+  ladder-live) check_ladder_live ;;
+  *) echo "usage: factory-tasks-check.sh ladder-live" >&2; exit 2 ;;
+esac

package/scripts/outcome-pull.ts

@@ -0,0 +1,279 @@
+#!/usr/bin/env bun
+/**
+ * outcome-pull.ts — pull production path weights into text/task-paths.json's `prod`
+ * field, provenance-tagged, never touching the local `strength`/`resistance`/`closed`
+ * fields `--mark`/`--sync-closes` own (do-rank.py). Part of text/self-improving-outcome.md.
+ *
+ * Reads LOCAL D1 only (`one-owners`, mirrored from prod by `bun run db:sync` — see
+ * hook:db-sync in .claude/settings.json, which runs this script right after). Never
+ * touches the network directly — do-rank.py's zero-network invariant is preserved by
+ * construction: this script is the only one that shells out, and only to local wrangler.
+ *
+ * Three prod sources, three mappers (text/self-improving-outcome-plan.md § Evidence):
+ *   1. a settled promise         — claw_paths  source="promise:<slug>" target="proof"
+ *   2. a /do cycle that closed   — entity_tags  tags ⊇ ["do:learn","slug:<slug>"]
+ *   3. a graded delivery         — claw_paths  source="tag:<board>:slug:<slug>"
+ * `shape→model` do-event marks are deliberately NOT mapped — verified slug-free.
+ *
+ * Usage:
+ *   bun .claude/scripts/outcome-pull.ts             # pull local D1 → text/task-paths.json
+ *   bun .claude/scripts/outcome-pull.ts --selftest   # offline fixture proof, no D1/network
+ */
+import { readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+
+const ROOT = join(dirname(new URL(import.meta.url).pathname), '..', '..')
+const WEB_DIR = join(ROOT, 'one.ie', 'web')
+const TASK_PATHS = join(ROOT, 'text', 'task-paths.json')
+const D1_BIN = process.env.D1_BIN ?? 'one-owners'
+
+export interface ClawPathRow {
+  source: string
+  target: string
+  strength: number
+  resistance: number
+  traversals: number
+}
+
+export interface EntityTagRow {
+  entity_id: string
+  tags: string // JSON array string, e.g. '["do:learn","slug:foo"]'
+}
+
+export interface MappedOutcome {
+  slug: string
+  strength: number
+  resistance: number
+  traversals: number
+  source: string
+}
+
+// ─── the three pure mappers (fixture-tested by --selftest) ─────────────────
+
+export function mapPromiseProof(row: ClawPathRow): MappedOutcome | null {
+  const m = /^promise:(.+)$/.exec(row.source)
+  if (!m || row.target !== 'proof') return null
+  return { slug: m[1]!, strength: row.strength, resistance: row.resistance, traversals: row.traversals, source: 'promise:proof' }
+}
+
+export function mapDoEventLearn(row: EntityTagRow): MappedOutcome | null {
+  let tags: unknown
+  try {
+    tags = JSON.parse(row.tags)
+  } catch {
+    return null
+  }
+  if (!Array.isArray(tags)) return null
+  const has = (t: string) => tags.includes(t)
+  if (!has('do:learn')) return null
+  const slugTag = tags.find((t): t is string => typeof t === 'string' && t.startsWith('slug:'))
+  if (!slugTag) return null
+  // Presence of a prod-recorded close is the signal — the composite score embedded in
+  // doEventTitle's display text is UI prose, not a stable machine field (plan § Decisions).
+  return { slug: slugTag.slice('slug:'.length), strength: 0.5, resistance: 0, traversals: 1, source: 'do:learn' }
+}
+
+export function mapWorldOutcome(row: ClawPathRow): MappedOutcome | null {
+  const m = /^tag:[^:]+:slug:(.+)$/.exec(row.source)
+  if (!m) return null
+  return { slug: m[1]!, strength: row.strength, resistance: row.resistance, traversals: row.traversals, source: 'world:outcome' }
+}
+
+// ─── the merge law: `prod` is a full overwrite per pull, local fields untouched ────
+
+type TaskPaths = Record<string, Record<string, unknown>>
+
+export function mergeIntoTaskPaths(existing: TaskPaths, mapped: MappedOutcome[], pulledAt: string): TaskPaths {
+  const out: TaskPaths = JSON.parse(JSON.stringify(existing))
+  const bySlug = new Map<string, { strength: number; resistance: number; traversals: number; sources: Set<string> }>()
+  for (const m of mapped) {
+    const acc = bySlug.get(m.slug) ?? { strength: 0, resistance: 0, traversals: 0, sources: new Set<string>() }
+    acc.strength += m.strength
+    acc.resistance += m.resistance
+    acc.traversals += m.traversals
+    acc.sources.add(m.source)
+    bySlug.set(m.slug, acc)
+  }
+  for (const [slug, acc] of bySlug) {
+    const key = `task:${slug}`
+    const entry = out[key] ?? { closed: 0, strength: 0, resistance: 0, traversals: 0 }
+    entry.prod = {
+      strength: round3(acc.strength),
+      resistance: round3(acc.resistance),
+      traversals: acc.traversals,
+      sources: [...acc.sources].sort(),
+      pulled_at: pulledAt,
+    }
+    out[key] = entry
+  }
+  return out
+}
+
+function round3(n: number): number {
+  return Math.round(n * 1000) / 1000
+}
+
+// ─── local D1 read (never network — reads the mirror db:sync already wrote) ────
+
+async function d1Query(sql: string): Promise<Array<Record<string, unknown>>> {
+  const proc = Bun.spawn(
+    ['bunx', 'wrangler', 'd1', 'execute', D1_BIN, '--local', '--json', '--command', sql],
+    { cwd: WEB_DIR, stdout: 'pipe', stderr: 'pipe' },
+  )
+  const out = await new Response(proc.stdout).text()
+  if ((await proc.exited) !== 0) throw new Error(`d1 execute failed: ${await new Response(proc.stderr).text()}`)
+  const parsed = JSON.parse(out)
+  return (parsed?.[0]?.results ?? []) as Array<Record<string, unknown>>
+}
+
+async function pull(): Promise<void> {
+  let mapped: MappedOutcome[] = []
+  try {
+    const promiseRows = (await d1Query(
+      `SELECT source, target, strength, resistance, traversals FROM claw_paths WHERE source LIKE 'promise:%' AND target = 'proof'`,
+    )) as unknown as ClawPathRow[]
+    const outcomeRows = (await d1Query(
+      `SELECT source, target, strength, resistance, traversals FROM claw_paths WHERE source LIKE 'tag:%:slug:%'`,
+    )) as unknown as ClawPathRow[]
+    const learnRows = (await d1Query(
+      `SELECT entity_id, tags FROM entity_tags WHERE tags LIKE '%"do:learn"%' AND tags LIKE '%"slug:%'`,
+    )) as unknown as EntityTagRow[]
+    mapped = [
+      ...promiseRows.map(mapPromiseProof),
+      ...outcomeRows.map(mapWorldOutcome),
+      ...learnRows.map(mapDoEventLearn),
+    ].filter((m): m is MappedOutcome => m !== null)
+  } catch (err) {
+    // Best-effort — matches hook:db-sync's own posture (session start must never block
+    // on an offline/unreachable local D1). No crash, no partial write.
+    console.error(`[outcome-pull] local D1 unreachable, skipping: ${(err as Error).message}`)
+    return
+  }
+  const existing: TaskPaths = existsSync(TASK_PATHS) ? JSON.parse(readFileSync(TASK_PATHS, 'utf8')) : {}
+  const merged = mergeIntoTaskPaths(existing, mapped, new Date().toISOString())
+  writeFileSync(TASK_PATHS, JSON.stringify(sortKeys(merged), null, 2) + '\n')
+  console.log(`[outcome-pull] merged prod outcomes for ${new Set(mapped.map((m) => m.slug)).size} slug(s) from ${mapped.length} row(s)`)
+}
+
+// Recursive — matches do-rank.py's `json.dumps(sort_keys=True)`, which sorts every nested
+// level. A top-level-only sort would make the two writers emit different byte order for
+// the same data (nested `prod`/etc. keys), causing spurious diffs on every session.
+function sortKeys<T>(value: T): T {
+  if (Array.isArray(value)) return value.map(sortKeys) as unknown as T
+  if (value !== null && typeof value === 'object') {
+    const out: Record<string, unknown> = {}
+    for (const k of Object.keys(value as Record<string, unknown>).sort()) {
+      out[k] = sortKeys((value as Record<string, unknown>)[k])
+    }
+    return out as T
+  }
+  return value
+}
+
+// ─── offline selftest — the only mode the promise's proof: runs ────────────
+
+function selftest(): void {
+  let pass = 0
+  let fail = 0
+  const check = (name: string, cond: boolean) => {
+    if (cond) {
+      pass++
+    } else {
+      fail++
+      console.error(`FAIL: ${name}`)
+    }
+  }
+
+  // 1. mapPromiseProof — direct slug extraction, rejects non-proof targets.
+  check(
+    'mapPromiseProof: extracts slug from promise:<slug>→proof',
+    mapPromiseProof({ source: 'promise:self-improving-outcome', target: 'proof', strength: 4, resistance: 0, traversals: 1 })?.slug === 'self-improving-outcome',
+  )
+  check(
+    'mapPromiseProof: rejects non-proof target',
+    mapPromiseProof({ source: 'promise:foo', target: 'other', strength: 1, resistance: 0, traversals: 1 }) === null,
+  )
+  check(
+    'mapPromiseProof: rejects non-promise source',
+    mapPromiseProof({ source: 'shape:foo', target: 'proof', strength: 1, resistance: 0, traversals: 1 }) === null,
+  )
+
+  // 2. mapDoEventLearn — requires BOTH do:learn and a slug: tag; ignores other stages.
+  check(
+    'mapDoEventLearn: extracts slug from a learn-tagged row',
+    mapDoEventLearn({ entity_id: 'conv:do-foo-c1', tags: JSON.stringify(['do:learn', 'do:cycle', 'tier:feature', 'slug:foo', 's:security']) })?.slug === 'foo',
+  )
+  check(
+    'mapDoEventLearn: rejects a non-learn stage (do:wave)',
+    mapDoEventLearn({ entity_id: 'conv:do-foo-c1', tags: JSON.stringify(['do:wave', 'slug:foo']) }) === null,
+  )
+  check(
+    'mapDoEventLearn: rejects a learn row with no slug tag',
+    mapDoEventLearn({ entity_id: 'conv:x', tags: JSON.stringify(['do:learn']) }) === null,
+  )
+  check(
+    'mapDoEventLearn: tolerates malformed tags JSON',
+    mapDoEventLearn({ entity_id: 'conv:x', tags: 'not-json' }) === null,
+  )
+
+  // 3. mapWorldOutcome — tag-node source, world:outcome's tagNode() shape.
+  check(
+    'mapWorldOutcome: extracts slug from tag:<board>:slug:<slug>',
+    mapWorldOutcome({ source: 'tag:acme:slug:foo', target: 'model:sonnet', strength: 1, resistance: 0, traversals: 1 })?.slug === 'foo',
+  )
+  check(
+    'mapWorldOutcome: rejects a shape→model row (verified slug-free, plan § Evidence)',
+    mapWorldOutcome({ source: 'shape:do:feature', target: 'model:sonnet', strength: 1, resistance: 0, traversals: 1 }) === null,
+  )
+  check(
+    'mapWorldOutcome: rejects a non-slug tag',
+    mapWorldOutcome({ source: 'tag:acme:vip', target: 'actor:x', strength: 1, resistance: 0, traversals: 1 }) === null,
+  )
+
+  // 4. mergeIntoTaskPaths — the merge law: outcome-weight (marked contributes, warned
+  //    contributes to resistance), provenance (sources tagged), idempotent re-pull,
+  //    and — the load-bearing one — LOCAL fields are never touched by a pull.
+  const local: TaskPaths = {
+    'task:foo': { closed: 1.2, strength: 0.4, resistance: 0.1, traversals: 3 },
+  }
+  const mapped: MappedOutcome[] = [
+    { slug: 'foo', strength: 2, resistance: 0, traversals: 1, source: 'promise:proof' },
+    { slug: 'foo', strength: 0.5, resistance: 0, traversals: 1, source: 'do:learn' },
+  ]
+  const merged = mergeIntoTaskPaths(local, mapped, '2026-07-08T00:00:00.000Z')
+  check('merge: prod.strength sums same-slug rows within one pull', (merged['task:foo'] as any).prod.strength === 2.5)
+  check('merge: prod.sources carries provenance for both mappers', JSON.stringify((merged['task:foo'] as any).prod.sources) === JSON.stringify(['do:learn', 'promise:proof']))
+  check('merge: LOCAL strength untouched by the pull', (merged['task:foo'] as any).strength === 0.4)
+  check('merge: LOCAL resistance untouched by the pull', (merged['task:foo'] as any).resistance === 0.1)
+  check('merge: LOCAL closed untouched by the pull', (merged['task:foo'] as any).closed === 1.2)
+
+  // merge law, other direction: a re-pull with different rows OVERWRITES prod, never adds.
+  const rePulled = mergeIntoTaskPaths(merged, [{ slug: 'foo', strength: 1, resistance: 0, traversals: 1, source: 'promise:proof' }], '2026-07-09T00:00:00.000Z')
+  check('merge: re-pull overwrites prod.strength, does not accumulate across pulls', (rePulled['task:foo'] as any).prod.strength === 1)
+  check(
+    'merge: two identical pulls are idempotent (byte-identical prod block)',
+    JSON.stringify(mergeIntoTaskPaths(local, mapped, 'T')['task:foo']) === JSON.stringify(mergeIntoTaskPaths(local, mapped, 'T')['task:foo']),
+  )
+
+  // warned outcome (resistance-only) — the "warned lowers rank" half of outcome-weight.
+  const warned = mergeIntoTaskPaths({}, [{ slug: 'bar', strength: 0, resistance: 2, traversals: 1, source: 'promise:proof' }], 'T')
+  check('merge: a warned outcome lands entirely in prod.resistance, not prod.strength', (warned['task:bar'] as any).prod.resistance === 2 && (warned['task:bar'] as any).prod.strength === 0)
+
+  // outcome-weight: a slug the world marked outranks an identical one the world warned —
+  // proven here at the merge layer (do-rank.py's own selftest proves it again at the
+  // path_momentum layer — two independent proofs of the same law, per plan § Pre-mortem).
+  const markedNet = ((merged['task:foo'] as any).closed) + ((merged['task:foo'] as any).strength) + ((merged['task:foo'] as any).prod.strength) - ((merged['task:foo'] as any).resistance) - ((merged['task:foo'] as any).prod.resistance)
+  const warnedNet = ((warned['task:bar'] as any).closed ?? 0) + ((warned['task:bar'] as any).strength ?? 0) + ((warned['task:bar'] as any).prod.strength) - ((warned['task:bar'] as any).resistance ?? 0) - ((warned['task:bar'] as any).prod.resistance)
+  check('outcome-weight: a marked prod outcome nets strictly above a warned one', markedNet > warnedNet)
+
+  console.log(`SELFTEST: ${pass}/${pass + fail} pass (mapPromiseProof · mapDoEventLearn · mapWorldOutcome · merge-law · provenance · outcome-weight)`)
+  if (fail > 0) process.exit(1)
+}
+
+// ─── entry ───────────────────────────────────────────────────────────────
+
+if (process.argv.includes('--selftest')) {
+  selftest()
+} else {
+  await pull()
+}

package/scripts/promise-manifest.mjs

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+// promise-manifest.mjs — project text/<slug>.md promise frontmatter into the two
+// JSON reads the Promise view needs (text/factory-promise-view.md §6).
+//
+// The promise files live in git and the web app is a CF Worker with no filesystem,
+// so the contract has to be projected at build time. Same shape as the precedent
+// at src/data/factory-check.json, which /factory imports.
+//
+// Two outputs, split so the bundle cost is bounded:
+//   src/data/promises-index.json   slug · title · counts. imported by the route.
+//   src/data/promises.json         full detail. imported ONLY by the API route.
+//
+// NOT written to public/ — a public JSON carrying accept: bodies would make the
+// shared lens's redaction (§4) cosmetic, and would be unauthenticated for every
+// workspace forever the moment a tenant writes a promise.
+//
+// Usage: node .claude/scripts/promise-manifest.mjs [--check]
+//        --check exits 3 if the committed output is stale (no write).
+
+import { readFileSync, readdirSync, writeFileSync, existsSync } from 'node:fs'
+import { resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { parse as parseYaml } from '../../one.ie/web/node_modules/yaml/dist/index.js'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..')
+const TEXT = resolve(ROOT, 'text')
+const OUT = resolve(ROOT, 'one.ie/web/src/data')
+
+// A promise is the bare slug — text/<feature>.md. Every suffixed sibling is derived
+// from it (text/CLAUDE.md § File naming) and carries its own frontmatter that is NOT
+// a contract; a -todo.md's `outcome:` is the promise's proof, not a second promise.
+const DERIVED = /-(plan|todo|docs|ui|features|tutorial|how-to|reference|agents|agents-docs|humans|lifecycle)\.md$/
+
+function splitFrontmatter(src) {
+  if (!src.startsWith('---\n')) return null
+  const end = src.indexOf('\n---', 4)
+  if (end === -1) return null
+  return { fm: src.slice(4, end), body: src.slice(end + 4) }
+}
+
+// The one-sentence claim — the largest thing on the rendered page, so a wrong pick
+// is loud. Prefer the section written to BE the claim (`## The promise`, or a
+// `## Who this is for` where the promise family uses that heading); otherwise the
+// first prose paragraph anywhere after the H1. Headings are skipped, not bailed on:
+// 56 of 79 promises open with a section heading immediately under the H1, so
+// stopping at the first heading returned an empty lead for most of the corpus.
+function firstProse(lines, from) {
+  for (let i = from; i < lines.length; i++) {
+    const l = lines[i].trim()
+    if (!l) continue
+    if (/^(#{1,6}\s|>\s|[-*+]\s|\d+\.\s|```|\||---|\*\*Status|<)/.test(l)) continue
+    // A one-line paragraph is the shape we want; join a wrapped one up to its break.
+    const buf = [l]
+    for (let j = i + 1; j < lines.length && lines[j].trim(); j++) {
+      const nxt = lines[j].trim()
+      if (/^(#{1,6}\s|>\s|[-*+]\s|\d+\.\s|```|\|)/.test(nxt)) break
+      buf.push(nxt)
+    }
+    return buf.join(' ')
+  }
+  return ''
+}
+
+// Only from a section written to BE the claim. Measured over the 79-file corpus:
+// falling back to "first prose after the H1" returned a lead for all 79, but the
+// leads were wrong — `affiliate-escrow-multichain` yielded "`resolveAffiliateLeg`
+// in pay/backend/src/routes/escrow.ts computes an AffiliateSplit…", which is
+// implementation detail presented as the headline claim. A confident wrong sentence
+// at the top of a contract is worse than no sentence, so the fallback is gone: the
+// TITLE carries the claim (they are written that way — "Affiliate escrow, every
+// chain — EVM and Solana pay the referral for real") and this is the optional
+// second line under it.
+function leadSentence(body) {
+  const lines = body.split('\n')
+  // `## The promise` ONLY. `## Who this is for` was tried and dropped: it is an
+  // audience section, and its opening prose is routinely implementation detail
+  // (affiliate-escrow-multichain opens it with a function name and a file path).
+  const at = lines.findIndex((l) => /^##+\s+The promise\b/i.test(l.trim()))
+  if (at === -1) return ''
+  const lead = firstProse(lines, at + 1)
+  // One sentence, not the whole section.
+  return lead ? (lead.match(/^.*?[.!?](?=\s|$)/)?.[0] ?? lead).slice(0, 320) : ''
+}
+
+// "Out of scope — not promised, by law" — the block the doc says gets equal weight
+// and must survive to the Delivery state. Bullets only; prose in the section is
+// context for us, not a scope line for the reader.
+function outOfScope(body) {
+  const m = body.match(/^##+\s+Out of scope[^\n]*\n([\s\S]*?)(?=\n##\s|\n---\s*\n|$)/m)
+  if (!m) return []
+  return m[1].split('\n')
+    .map((l) => l.trim())
+    .filter((l) => /^[-*+]\s+/.test(l))
+    .map((l) => l.replace(/^[-*+]\s+/, '').replace(/^\*\*(.+?)\*\*\s*/, '$1 — ').trim())
+    .filter(Boolean)
+}
+
+function toList(v) {
+  if (!v) return []
+  return Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []
+}
+
+const promises = []
+for (const file of readdirSync(TEXT).sort()) {
+  if (!file.endsWith('.md') || DERIVED.test(file)) continue
+  if (file.startsWith('template-')) continue
+  const src = readFileSync(resolve(TEXT, file), 'utf8')
+  const split = splitFrontmatter(src)
+  if (!split) continue
+
+  let fm
+  try { fm = parseYaml(split.fm) } catch { continue }   // an unparseable head is not a contract
+  if (!fm || typeof fm !== 'object') continue
+  const rows = Array.isArray(fm.deliverables) ? fm.deliverables : []
+  if (rows.length === 0) continue                        // no schedule = not a promise
+
+  const slug = typeof fm.slug === 'string' && fm.slug ? fm.slug : file.replace(/\.md$/, '')
+  promises.push({
+    slug,
+    title: typeof fm.title === 'string' ? fm.title : slug,
+    status: typeof fm.status === 'string' ? fm.status.split('\n')[0].trim() : '',
+    lead: leadSentence(split.body),
+    deliverables: rows
+      .filter((r) => r && typeof r.item === 'string')
+      .map((r) => ({ item: r.item, accept: typeof r.accept === 'string' ? r.accept : '' })),
+    assumes: toList(fm.assumes),
+    // `proof:` is deliberately NOT carried. By the schedule ⊆ proof law it is the
+    // verbatim `&&`-join of every accept: above (do-promise-lint.sh enforces the
+    // inclusion), so shipping it doubles the payload to say nothing new — it cost
+    // 190 KB of the first cut. The view renders verdicts, never the command.
+    outOfScope: outOfScope(split.body),
+  })
+}
+
+// The index carries the claim and the count and nothing else — it is imported by
+// the Astro route, so every field costs worker bundle on every tasks request.
+const index = promises.map((p) => ({
+  slug: p.slug,
+  title: p.title,
+  count: p.deliverables.length,
+}))
+
+const detail = Object.fromEntries(promises.map((p) => [p.slug, p]))
+
+const files = [
+  [resolve(OUT, 'promises-index.json'), index],
+  [resolve(OUT, 'promises.json'), detail],
+]
+
+if (process.argv.includes('--check')) {
+  for (const [path, data] of files) {
+    const want = JSON.stringify(data, null, 2) + '\n'
+    const have = existsSync(path) ? readFileSync(path, 'utf8') : ''
+    if (want !== have) {
+      console.error(`[promise-manifest] STALE: ${path.replace(ROOT + '/', '')} — run node .claude/scripts/promise-manifest.mjs`)
+      process.exit(3)
+    }
+  }
+  console.log(`[promise-manifest] fresh — ${promises.length} promises`)
+  process.exit(0)
+}
+
+for (const [path, data] of files) {
+  writeFileSync(path, JSON.stringify(data, null, 2) + '\n')
+  console.log(`[promise-manifest] ${path.replace(ROOT + '/', '')} — ${(JSON.stringify(data).length / 1024).toFixed(1)} KB`)
+}
+console.log(`[promise-manifest] ${promises.length} promises · ${promises.reduce((n, p) => n + p.deliverables.length, 0)} deliverables`)

package/scripts/reconcile-allow.txt

@@ -23,3 +23,8 @@ knowledge supplies
 # runs one), not the substrate "node". text/tokens.md, text/tokens-plan.md.
 lightning node
 node to run
+
+# playbook-node — a real one.tql attribute (ELEVATE playbook position marker),
+# a kebab-case compound where grep -w treats the hyphen as a word boundary and
+# false-positives on "node". Not the substrate dead name. schema/one.tql:385.
+playbook-node

package/scripts/rubric-weights.json

@@ -0,0 +1,64 @@
+{
+  "_": "Single source for every rubric weight. Docs and scripts READ this; none restate the numbers. Edit here, nowhere else.",
+  "_why": "Four files once carried four different formulas because two legitimately different rubrics were never named. They are named here: `cycle` gates a /do cycle and carries goal-fit; `task` scores a diff that has no plan context and deliberately does not. A file that computes one must never be read as the other.",
+  "_canon": "text/rubrics.md is the design source of truth. The `migration` block below records where this file deliberately lags it.",
+
+  "gate": 0.65,
+  "goalFitGate": 0.50,
+
+  "cycle": {
+    "_use": "The in-cycle W4 gate — the verdict that closes a /do cycle. Spec: .claude/commands/do.md § W4. Consumers: w4-verify agent, /close.",
+    "_gate": "composite >= gate AND goal-fit >= goalFitGate (hard) AND no adversarial > 0.5 AND delta_tsc <= 0. All four conjuncts, or the cycle does not close.",
+    "weights": {
+      "goal-fit": 0.30,
+      "security": 0.18,
+      "stability": 0.18,
+      "simplicity": 0.12,
+      "integration": 0.12,
+      "speed": 0.10
+    }
+  },
+
+  "task": {
+    "_use": "The 5-axis task rubric — scores a diff WITHOUT plan context, so goal-fit is unavailable and its absence is by design, not drift. Spec: .claude/commands/do-autonomous.md § CLOSE. Consumer: w4-rubric.ts.",
+    "_not": "NOT the cycle gate. A task composite has no goal-fit term and must never be compared to the cycle gate or written where a cycle composite is expected.",
+    "_copies": "one.ie/web/src/engine/rubric.ts CODE_RUBRIC_WEIGHTS is a pinned copy of this block (worker code cannot read this file at runtime). Change one, change both.",
+    "weights": {
+      "security": 0.30,
+      "stability": 0.25,
+      "simplicity": 0.20,
+      "integration": 0.15,
+      "speed": 0.10
+    }
+  },
+
+  "package": {
+    "_use": "Static scoring of a package source tree (no diff, no plan). Consumer: do-rubric.py, which writes the W0 baseline.",
+    "_partial": "goal-fit is unavailable here too. do-rubric.py normalises over these five and labels its output composite_partial. It is a BASELINE, never a gate verdict.",
+    "_sum": "These DELIBERATELY sum to 0.75, not 1.00 — they are the five code axes lifted from a larger set with goal-fit (0.30) removed, and do-rubric.py divides by their sum. Do not 'fix' them to 1.00; that would silently reweight the baseline. `cycle` and `task` DO sum to 1.00.",
+    "weights": {
+      "security": 0.20,
+      "stability": 0.20,
+      "simplicity": 0.15,
+      "integration": 0.10,
+      "speed": 0.10
+    }
+  },
+
+  "definitions": {
+    "_": "Every weighted axis needs a definition or the LLM judge improvises one per run. `stability` carried 0.25 undefined until 2026-08-02.",
+    "goal-fit": "Does the diff deliver the cycle's stated goal? Scored against the todo's outcome line, not against general quality.",
+    "security": "Zero vulnerabilities. Every boundary validated. No secrets. Authorization off ctx, never off a request body field.",
+    "stability": "Errors are handled, not swallowed: no empty catch, no bare Promise.all, no silent console-only catch. Every handler closes its loop with mark/warn/dissolve. TS strict holds.",
+    "simplicity": "Minimum code for maximum feature. Every line earns its place.",
+    "integration": "Wired, never orphaned — imports/exports used, routes registered, links added, docs synced. Scored deterministically from .w2-surface-checklist.json when available.",
+    "speed": "No added latency on a hot path; bundle and query cost do not regress."
+  },
+
+  "migration": {
+    "_status": "PENDING — design only, not executed. See text/rubric-migration-plan.md.",
+    "_target": "text/rubrics.md defines EIGHT code dims: security .20, structure .15, simplicity .15, speed .10, integration .15, code-reuse .10, test-coverage .10, ux .05, with in-cycle W4 = 0.30*goal-fit + 0.70*(the eight reweighted).",
+    "_gap": "`structure`, `code-reuse`, `test-coverage` and `ux` are scored by NOTHING today. `stability` is not a rename of `structure` — do-rubric.py's score_stability() conflates error-handling with test presence, which canon splits into `structure` and `test-coverage`. Landing the eight changes every score and breaks comparability with the 262 historical composites in text/learnings.md.",
+    "_do_not": "Do not silently substitute the eight-dim formula in any consumer. It lands as one edit to this file plus judge-prompt changes, with a dated changeover marker in learnings.md."
+  }
+}

package/scripts/spine-canary.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# spine-canary.sh — C7 nightly home. Walks a client spine in canary mode.
+# The spine's data/actors/<kind>.toml lives in a SEPARATE git repo
+# (apps/vespio/clients/<slug>/) that is never bundled into the one-prod
+# Cloudflare Worker, so this cannot run as a CF cron — it runs here, on the
+# machine that has both checkouts, same pattern as backup/scripts/pull-backup.ts.
+set -euo pipefail
+
+REPO_ROOT="/Users/toc/Server/one-ie"
+CLIENT_SLUG="${SPINE_CANARY_SLUG:-elitemoversca}"
+ACTOR_KIND="${SPINE_CANARY_KIND:-customer}"
+
+export SPINE_CLIENT_DIR="/Users/toc/Server/apps/vespio/clients/${CLIENT_SLUG}"
+export ONE_API_URL="${ONE_API_URL:-https://one.ie}"
+if [ -f "$REPO_ROOT/one.ie/web/.env" ]; then
+  export GATEWAY_SERVICE_SECRET="$(grep -m1 '^GATEWAY_SERVICE_SECRET=' "$REPO_ROOT/one.ie/web/.env" | cut -d= -f2-)"
+fi
+
+cd "$REPO_ROOT/one.ie/web"
+exec bun scripts/spine-walk.ts "$ACTOR_KIND" --mode=canary