@oneie/claude 0.6.0 → 0.7.0

package/commands/see.md

@@ -17,7 +17,7 @@ Read the world — query substrate state without emitting signals.
 | `evolved` | Agents that rewrote their system prompts | L5 |
 | `revenue` | Per-path earnings from L4 economic loop | L4 |
 | `events [--since T]` | Signal history and Four Outcomes audit | L1 |
-| `memory <uid>` | Full memory card for an actor (reveal) | L6 |
+| `memory <uid>` | Unseal one PII field for an actor (reveal) — authenticated | L6 |
 
 ## Routing
 
@@ -26,22 +26,30 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 | Noun | Primitive | Source |
 |------|-----------|--------|
-| tasks | `follow()` queue read | `/api/tasks` or `scanTodos()` |
-| highways | `follow()` path read | `/api/state` strength ≥ 50 |
-| toxic | `follow()` path read | `/api/state` resistance > strength |
-| frontiers | `follow()` gap read | `/api/state` <10% traversed |
-| paths | `follow()` path query | `/api/state` filtered |
-| hypotheses | TypeDB read | learning entities |
-| evolved | TypeDB read | units where generation > 1 |
-| revenue | TypeDB read | paths with revenue attribute |
-| events | TypeDB read | signal history |
-| memory | `reveal(uid)` | `/api/memory/reveal/:uid` |
+| tasks | `follow()` queue read | `.claude/scripts/do-rank.py` |
+| highways | `follow()` path read | `GET /api/export/highways` |
+| toxic | `follow()` path read | `GET /api/export/toxic` |
+| frontiers | `follow()` gap read | `GET /api/frontiers` |
+| paths | `follow()` path query | `GET /api/paths` |
+| hypotheses | TypeDB read | `GET /api/export/hypotheses` |
+| evolved | TypeDB read | `GET /api/export/units`, filter `generation > 1` |
+| revenue | TypeDB read | `GET /api/revenue` |
+| events | TypeDB read | signal history — no GET route (see below) |
+| memory | `reveal(uid)` | `GET /api/pii/reveal/:uid?field=` |
+
+**Not built (do not invoke, do not describe as live) — verified 2026-08-02:**
+`GET /api/tasks`, `GET /api/state`, `GET /api/memory/reveal/:uid`, and
+`scanTodos()` in `src/engine/task-parse.ts` (the whole `src/engine/` dir holds
+only `rubric.ts`). Every noun that used to name one has been repointed above.
+`/api/events` exists but is **POST-only tracking ingest**, not a signal-history
+read — do not GET it.
 
 ## Steps
 
 ### tasks
 
-1. GET `http://localhost:4321/api/tasks` (falls back to `scanTodos()` in `src/engine/task-parse.ts` if server not running)
+1. `python3 .claude/scripts/do-rank.py` — the ranker reads `text/*-todo.md` directly and needs no dev server. Add `--tasks` for the tagged-signal view, `--json` for machine output, `--top N` to cap.
+   - **The one exception to this file's no-side-effects rule.** The ranker refreshes a `text/task-paths.json` memo as it runs. It does **not** write `todo.md` — that is `hook:sync-priority-todo`, fired on Stop and SessionStart. No substrate write, no `mark()`/`warn()`.
 2. Filter by `$ARGUMENTS` if provided — tags or phase (e.g. `/see tasks build P0`, `/see tasks C1`)
 3. Report tasks sorted by effective priority (priority score + pheromone strength − resistance):
    - Name, id, priority formula (e.g. `90 = critical=30 + C1=40 + dev=20`)
@@ -56,7 +64,7 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### highways
 
-1. GET `http://localhost:4321/api/export/highways?context=1` (falls back to `/api/state` if server not running)
+1. GET `http://localhost:4321/api/export/highways?limit=50` — the route takes `limit` (default 50, capped 200) and an optional `from=<aid>` to scope to one source actor. There is no `context=` param and no `/api/state` fallback.
 2. Show paths where `strength ≥ 50`, sorted by strength desc (default limit 20; use `--limit N` to override)
 3. Each: from → to, strength, traversals, revenue — and `context: <docs>` if contextHint is present
 4. Report:
@@ -69,7 +77,8 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### toxic
 
-1. GET `http://localhost:4321/api/state`
+1. GET `http://localhost:4321/api/export/toxic?limit=200` (limit capped at 500; returns warned/faded paths with `resistance > 0`, sorted by resistance desc)
+   - **Empty ≠ clean.** Every `/api/export/*` route scopes via `scopeToGroup(viewer, …)`, defaulting to `viewer='end_user'` / `workspace='default'`. An unauthenticated call returns an empty set, not a 401 — so "0 toxic paths" may mean "not authorized to see any". The same applies to `hypotheses` and `evolved` below. Authenticate, or read the count as unknown.
 2. Show paths where `resistance > strength`
 3. Each: from → to, resistance, strength, hypothesis (if any)
 4. Report:
@@ -80,7 +89,7 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### frontiers
 
-1. GET `http://localhost:4321/api/state`
+1. GET `http://localhost:4321/api/frontiers` (optional `?limit=N`)
 2. Show tag clusters with <10% traversal rate
 3. Each: tag cluster, % explored, expected value
 4. Report:
@@ -91,14 +100,14 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### paths
 
-1. GET `http://localhost:4321/api/state`
-2. Filter by `--from` and/or `--to` if provided in `$ARGUMENTS`
+1. GET `http://localhost:4321/api/paths` — params are `from=<aid>`, `to=<aid>`, `limit` (default 20), `min_strength` (default 1)
+2. Filter by `--from` and/or `--to` if provided in `$ARGUMENTS` — pass them through as `from=`/`to=`
 3. Show matching paths: from → to, strength, resistance, net weight (strength − resistance)
 4. Report all matching paths with full pheromone state
 
 ### hypotheses
 
-1. Query TypeDB: match hypothesis entities
+1. GET `http://localhost:4321/api/export/hypotheses?limit=100` (or query TypeDB directly for hypothesis entities)
 2. Show each: pattern, confidence, created, reinforced count
 3. Report:
    ```
@@ -108,7 +117,7 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### evolved
 
-1. Query TypeDB: units where `generation > 1`
+1. GET `http://localhost:4321/api/export/units`, then filter to `generation > 1` client-side (the route has no generation filter) — or query TypeDB directly
 2. Show each: uid, name, generation, current model, last evolution timestamp
 3. Report:
    ```
@@ -118,7 +127,7 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### revenue
 
-1. Query TypeDB: paths with revenue attribute, sorted desc
+1. GET `http://localhost:4321/api/revenue` (or query TypeDB for paths with a revenue attribute, sorted desc)
 2. Show per-path earnings
 3. Report:
    ```
@@ -128,7 +137,7 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### events
 
-1. Query TypeDB signals, optionally filtered by `--since T` from `$ARGUMENTS`
+1. Query TypeDB signals directly, optionally filtered by `--since T` from `$ARGUMENTS`. **No HTTP read route exists** — `/api/events` is POST-only tracking ingest and will not serve this.
 2. Show each signal: receiver, data summary, outcome, timestamp
 3. Report:
    ```
@@ -139,23 +148,24 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 ### memory
 
 1. Extract `<uid>` from `$ARGUMENTS` (e.g. `/see memory person:a7f3`)
-2. GET `http://localhost:4321/api/memory/reveal/<uid>`
-3. Display the full MemoryCard:
-   - **Actor**: uid, kind, firstSeen
-   - **Hypotheses**: pattern + confidence (asserted capped at 0.30)
-   - **Highways**: top paths by strength
-   - **Signals**: last 200 episodes
-   - **Groups**: memberships
-   - **Capabilities**: offered skills + prices
-   - **Frontier**: unexplored tag clusters
-4. Report:
+2. GET `http://localhost:4321/api/pii/reveal/<uid>?field=email` — this is the only
+   shipped `reveal`. It unseals **one PII field at a time**
+   (`email|phone|address|name|dob|custom`), not a memory card.
+   - **Authenticated and audited.** It calls `requireAuth` + `requireContactOwner`,
+     so an anonymous or non-owning caller gets denied. Rate-limited to 100
+     reads/hour per reader; every read emits a `pii.read` audit event.
+   - The MCP tool `reveal` is the same route.
+3. Report:
    ```
-   Memory: <uid>
-   Hypotheses: N  (observed=X  asserted=Y)
-   Highways: N paths
-   Frontier: [tag1, tag2, ...]  — N unexplored tags
+   Reveal: <uid>  field=<field>
    ```
 
+**The aggregate MemoryCard was never built.** There is no route returning
+hypotheses + highways + last-200 signals + groups + capabilities + frontier for
+one actor. To assemble that view today, compose the other nouns for that uid:
+`/see hypotheses`, `/see highways` (`?from=<uid>`), `/see paths` (`?from=<uid>`),
+`/see frontiers`. Do not describe a single-call memory card as live.
+
 ---
 
 *Every `/see` query is a `follow()` call — the substrate answers without learning.*

package/commands/skill-create.md

@@ -27,7 +27,7 @@ tail -5 text/learnings.md
 
 # Recent cycle diff (what actually changed)
 git diff HEAD~1 HEAD --stat
-git diff HEAD~1 HEAD -- $(git diff HEAD~1 HEAD --name-only | grep -v 'text/\|text/' | head -20)
+git diff HEAD~1 HEAD -- $(git diff HEAD~1 HEAD --name-only | grep -v 'text/' | head -20)
 ```
 
 **Step 2 — Extract the pattern (Haiku · low)**
@@ -42,9 +42,25 @@ Ignore one-off specifics (feature names, slugs). Keep the reusable skeleton.
 
 **Step 3 — Write `.claude/skills/<slug>/SKILL.md`**
 
+The path is `.claude/skills/<slug>/SKILL.md` — a **directory** containing
+`SKILL.md`. A bare `.claude/skills/<slug>.md` is not loaded by the runtime
+(several flat files there — `build.md`, `typecheck.md`, `dev.md`, `signal.md`,
+`cloudflare.md`, the `rag-*.md` set — exist as canon but never trigger as skills).
+
+The YAML frontmatter is **load-bearing, not decoration**: `name` and
+`description` are what the runtime matches against to decide whether to surface
+the skill. A SKILL.md with no frontmatter never triggers. Put the trigger phrases
+in `description` — the `## When to use` body section is read only *after* the
+skill has already been selected.
+
 Use this template:
 
 ```markdown
+---
+name: <slug>
+description: <what this does, then the trigger conditions — "Use when …". Include the literal phrases a user would type. This field is the whole triggering surface.>
+---
+
 # <title> skill
 
 <one-sentence description — what this skill does for the model>
@@ -65,14 +81,31 @@ Use this template:
 
 **Step 4 — Wire it (if applicable)**
 
-- If the skill has a natural trigger phrase, append a row to the skills table in
-  `.claude/CLAUDE.md` so it auto-loads.
+- Auto-loading comes from the frontmatter `description`, not from any index —
+  get the trigger phrases into that field or the skill stays dark.
+- Then add the name to the `skills/` line in `.claude/CLAUDE.md` § Structure so
+  the harness inventory stays true. That listing is documentation of what exists;
+  it does not itself wire anything.
 - If it extends an existing skill, note the relation.
 
 **Step 5 — Close**
 
-Emit `signal("learning:harden", 1, "skill=<slug>")` and append one line to
-`text/learnings.md`:
+Append one line to `text/learnings.md`. That line **is** the close — it is
+deterministic and it is what the next cycle reads.
+
+Do **not** emit `learning:harden` or `learning:know`. Neither is a registered
+receiver: `grep -c '"learning:' packages/sdk/src/receivers.ts` → **0**. The
+earlier version of this step instructed `signal("learning:know", { skill })`,
+which fails silently — the same defect its own warning described, one line
+down. The whole `learning:` namespace is unregistered; `harden`'s only shipped
+wire is `chat:harden`, which needs a threadable `entityId` and does not fit a
+skill close.
+
+If you want the creation recorded in the substrate, `skill:save` is real
+(`packages/sdk/src/receivers.ts`). Check the receiver exists before emitting —
+the signature is `signal(receiver, data)`, and there is no three-argument form.
+
+The line:
 
 ```
 - YYYY-MM-DD · skill:<slug> · crystallised from <source-slug> · source=skill-create

package/commands/sync.md

@@ -14,10 +14,10 @@ Reconcile substrate state — report the growth loops, fire the on-demand ones,
 | L3 fade | channels cron `fade-tick` daily, rate 0.05 — TypeDB + D1 `claw_paths` | LIVE | `POST /api/fade` (web) |
 | L4 pay | signal with payment data → path revenue | LIVE | `POST /api/signal/<receiver>` |
 | L5 evolve | channels cron `evolution-tick` hourly → `agents:evolve` signal | LIVE | `POST /api/signal/agents:evolve` |
-| L6 know | channels cron `harden-tick` hourly (D1 strength≥10 → TypeDB hypotheses) | LIVE | `POST /api/ask/learning:know` |
+| L6 know | channels cron `harden-tick` hourly (D1 strength≥10 → TypeDB hypotheses, via `rememberHypothesis`) | LIVE (cron only) | **no HTTP door** — `learning:know` is unregistered |
 | L7 frontier | read surface only — no detection job exists | READ-ONLY | `GET /api/frontiers` |
 
-**Not built (do not invoke, do not describe as live):** `GET /api/tick`, `POST /api/tasks/sync`, `src/engine/{doc-scan,task-parse,reusable-tasks}.ts`. The `sync-todo-docs.sh` hook still best-effort-POSTs `/api/tasks/sync` and silently no-ops — known drift. If a tick aggregator is ever wanted, it's a `/do` cycle (thin web route composing `fade()` + `agents:evolve` + `learning:know` + frontiers read), not a doc edit.
+**Not built (do not invoke, do not describe as live):** `GET /api/tick`, `POST /api/tasks/sync`, `src/engine/{doc-scan,task-parse,reusable-tasks}.ts`. The `sync-todo-docs.sh` hook still best-effort-POSTs `/api/tasks/sync` and silently no-ops — known drift. If a tick aggregator is ever wanted, it's a `/do` cycle (thin web route composing `fade()` + `agents:evolve` + a harden receiver that must first be BUILT + frontiers read), not a doc edit.
 
 ## Nouns
 
@@ -28,19 +28,19 @@ Reconcile substrate state — report the growth loops, fire the on-demand ones,
 | `agents` | Scan agent `.md` frontmatter (`channels/src/lib/agent-md.ts` / `web/src/lib/agent-md.ts`) → sync units + skills + subscriptions to TypeDB | L1 |
 | `fade` | Fire L3 once — asymmetric decay | L3 |
 | `evolve` | Fire L5 once — rewrite struggling agents | L5 |
-| `know` | Fire L6 once — harden highways + hypothesize | L6 |
+| `know` | **Read** L6 — no on-demand door; `harden-tick` is the only writer | L6 |
 | `frontier` | Read L7 — current frontiers (detection job unbuilt) | L7 |
 | `pay <receiver> <amt>` | Emit L4 payment signal | L4 |
-| `<path>` | Absorb a markdown file/dir — extract concepts → `learning:know` | L6 |
+| `<path>` | Absorb a markdown file/dir — extract concepts (no harden door; see below) | L6 |
 
 ## Steps
 
 ### *(default)*
 
-1. `bun run verify` — W0 gate (skip if already passed this session)
+1. `(cd one.ie/web && bun run verify)` — W0 gate (skip if already passed this session). The `cd` is required: there is no root `package.json`, so a bare `bun run verify` from the repo root errors with "Script not found".
 2. `python3 .claude/scripts/do-rank.py` — rank + report the task queue
 3. Fire on-demand loops against the local dev server (or `ONE_API_URL`):
-   `POST /api/fade` · `POST /api/ask/learning:know` · `GET /api/frontiers`
+   `POST /api/fade` · `GET /api/frontiers` — L6 has no on-demand door (below)
 4. Report:
    ```
    Queue:    N ready  M gated  K faded  (top slug + score)
@@ -70,14 +70,24 @@ Reconcile substrate state — report the growth loops, fire the on-demand ones,
 
 ### evolve
 
-1. `POST /api/signal/agents:evolve` — same signal the hourly channels cron emits
-2. Targets units with `success-rate < 0.50` AND `sample-count ≥ 20`
+1. **Select the targets first — the receiver does not.** The hourly
+   `evolution-tick` (`channels/src/cron.ts`) runs the TypeDB query
+   `match $a isa actor, has aid $id, has success-rate $r, has sample-count $n; $r < 0.5; $n >= 20; select $id;`
+   and then posts **one signal per uid**. A bare `POST /api/signal/agents:evolve`
+   with an empty body targets nobody — it just writes a signal row.
+2. For each selected uid: `POST /api/signal/agents:evolve` with
+   `{ "data": { "uid": "<aid>" } }` (the cron posts to `$ONE_EVENTS_URL`; locally that is `http://localhost:4321`).
 3. Report: agents evaluated, agents evolved, generation numbers.
 
 ### know
 
-1. `POST /api/ask/learning:know` — promote strong paths to TypeDB hypotheses
-2. Report: highways hardened, hypotheses written. (The hourly `harden-tick` cron does this automatically from D1 `claw_paths`.)
+1. **There is no manual door.** `learning:know` is in no registry, so
+   `POST /api/ask/learning:know` 404s — this subcommand cannot force a harden.
+   The promotion happens only on the hourly `harden-tick` cron
+   (`channels/src/cron.ts:121`), which reads D1 `claw_paths` where
+   `strength >= 10` and calls `rememberHypothesis` directly.
+2. Report what the cron last wrote: highways hardened, hypotheses written. To
+   verify, read the hypotheses rather than trying to trigger a write.
 
 ### frontier
 
@@ -94,7 +104,7 @@ Reconcile substrate state — report the growth loops, fire the on-demand ones,
 
 1. Read markdown file or directory at `<path>` from `$ARGUMENTS`
 2. If directory: scan all `*.md` files recursively
-3. Extract concepts → `POST /api/ask/learning:know` per concept (or agent specs → the `agents` flow)
+3. Extract concepts → **no door exists** (`learning:know` unregistered); record them in `text/` and let `harden-tick` promote what earns strength (or agent specs → the `agents` flow)
 4. Report: files processed, entities written.
 
 ---

package/hooks/scripts/auto-continue.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# AUTO-CONTINUE — Stop hook: keep the session moving without the operator
+# typing "continue" / "do it" / "yes" / "merge and deploy" over and over.
+#
+# OPT-IN. Armed only while the flag file exists:
+#   .claude/auto-continue.local        (toggle with /go on · /go off)
+#
+# Flag file format (all lines optional):
+#   max=12                — continuation budget per session (default 12)
+#   mission=<free text>   — shown in every continuation directive
+#
+# When armed and the budget isn't spent, this hook BLOCKS the stop and hands
+# Claude the standing instruction: finish in-flight work → merge and deploy
+# when green → pick the next slug from todo.md → fan out when file-disjoint.
+# Claude escapes the loop by finishing everything or removing the flag file
+# (which it is told to do when genuinely blocked on a human-only decision).
+#
+# Safety:
+#   - per-session counter in /tmp caps continuations (no infinite loop)
+#   - absent flag file = hook is a no-op (default state)
+#   - ECC_DISABLED_HOOKS=hook:auto-continue disables it entirely
+#
+# Per Rule 1 (closed loop) — emits hook:auto-continue:{block,done}.
+
+# shellcheck source=lib/hook.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/hook.sh"
+# shellcheck source=lib/signal.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/signal.sh"
+is_hook_disabled "hook:auto-continue" && exit 0
+
+FLAG="$CLAUDE_PROJECT_DIR/.claude/auto-continue.local"
+[[ -f "$FLAG" ]] || exit 0
+
+PAYLOAD="${1:-}"
+
+MAX=$(grep -E '^max=' "$FLAG" 2>/dev/null | head -1 | cut -d= -f2 | tr -dc '0-9')
+[[ -z "$MAX" ]] && MAX=12
+MISSION=$(grep -E '^mission=' "$FLAG" 2>/dev/null | head -1 | cut -d= -f2-)
+
+SESSION_KEY=$(hook_session_key "$PAYLOAD")
+COUNT_FILE="/tmp/oneie-auto-continue-${SESSION_KEY}.count"
+COUNT=$(cat "$COUNT_FILE" 2>/dev/null | tr -dc '0-9')
+[[ -z "$COUNT" ]] && COUNT=0
+COUNT=$((COUNT + 1))
+
+if (( COUNT > MAX )); then
+  # Budget spent — let the stop through, but say so out loud.
+  echo "[auto-continue] budget spent (${MAX} continuations this session) — letting the stop through. /go on resets next session; rm $COUNT_FILE resets now."
+  emit_signal "hook:auto-continue:done" 1 "count=$COUNT max=$MAX"
+  exit 0
+fi
+printf '%s' "$COUNT" > "$COUNT_FILE"
+
+REASON="AUTO-CONTINUE is ON (/go). Standing instruction from the operator: fill the gaps · do it · continue · merge and deploy · fan out.
+
+Do not stop yet — take the next action, in this order:
+1. Work in flight → finish it. A failed command is not a stopping point: diagnose, fix, retry.
+2. Work done and green (tsc + tests + kill-switch) → close the loop: commit by explicit path (check the current branch first), merge, deploy, verify live.
+3. Idle → read todo.md, take the top unblocked slug, run /do <slug>. Independent file-disjoint work → fan out parallel agents in one message.
+4. ONLY stop if genuinely blocked on a human-only decision (destructive action, spend, scope change) or everything is shipped and verified. In that case run: rm .claude/auto-continue.local — then report state honestly and stop.
+
+Never fabricate green: if something fails, say so and keep working on it.${MISSION:+
+
+Mission: $MISSION}
+
+[continuation $COUNT of $MAX this session]"
+
+emit_signal "hook:auto-continue:block" 1 "count=$COUNT max=$MAX"
+jq -nc --arg r "$REASON" '{"decision":"block","reason":$r}'
+exit 0

package/hooks/scripts/branch-pin.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# BRANCH-PIN — PreToolUse(Bash): the SHARED MAIN tree's HEAD is pinned.
+#
+# Multiple windows share ONE working tree. When any session switches HEAD
+# (`git checkout <branch>`, `git switch`, `checkout -b`), every neighbouring
+# session is silently pulled onto that branch — their reads see its files and
+# their commits land on it (3 collisions 2026-07-08; do loops confused across
+# sessions 2026-07-21). Branch work belongs in a linked worktree:
+#   bash .claude/scripts/do-auto.sh <slug> --setup-only     # /do plans
+#   git worktree add -b feat/<slug> .do-worktrees/<slug> main   # anything else
+#
+# Rule: on the shared main tree, any command that moves HEAD is denied —
+# EXCEPT converging back to `main` (re-parking is the one allowed direction).
+# Inside a linked worktree (git-dir under .git/worktrees/…) everything is
+# allowed. Pathspec restores (`checkout [<ref>] -- <paths>`) don't move HEAD
+# and pass through here (git-add-guard territory).
+#
+# Disable: ECC_DISABLED_HOOKS=hook:branch-pin
+
+# shellcheck source=lib/hook.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/hook.sh"
+is_hook_disabled "hook:branch-pin" && exit 0
+
+PAYLOAD="${1:-}"
+[[ -z "$PAYLOAD" ]] && exit 0
+
+TOOL=$(printf '%s' "$PAYLOAD" | jq -r '.tool_name // empty' 2>/dev/null)
+[[ "$TOOL" == "Bash" ]] || exit 0
+
+CMD=$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[[ -z "$CMD" ]] && exit 0
+
+# The checkout/switch segment (up to a pipe/;/&&). `git worktree add` contains
+# neither verb and never matches.
+SEG=$(printf '%s' "$CMD" | grep -oE '\bgit\b[^|&;]*\b(checkout|switch)\b[^|&;]*' | head -1)
+[[ -z "$SEG" ]] && exit 0
+
+# A `--` pathspec means file restore, not a HEAD move.
+printf '%s' "$SEG" | grep -qE '[[:space:]]--([[:space:]]|$)' && exit 0
+
+# BSD sed has no \b — use an explicit space boundary.
+ARGS=$(printf '%s' "$SEG" | sed -E 's/.*[[:space:]](checkout|switch)([[:space:]]+|$)/ /')
+
+# Branch creation / detach / previous-branch shorthand always move HEAD.
+if printf '%s' "$ARGS" | grep -qE '(^|[[:space:]])(-b|-B|-c|-C|--orphan|--detach|-)([[:space:]]|$)'; then
+  :
+else
+  # First non-flag arg is the target ref; bare `git checkout` errors on its own.
+  REF=""
+  for a in $ARGS; do case "$a" in -*) ;; *) REF="$a"; break ;; esac; done
+  [[ -z "$REF" ]] && exit 0
+  [[ "$REF" == "main" ]] && exit 0   # converging home is allowed
+fi
+
+# Resolve the target dir: `git -C <path>`, else a leading `cd <path>`, else cwd.
+_target() {
+  local c="$1" t=""
+  t=$(printf '%s' "$c" | grep -oE "git[[:space:]]+-C[[:space:]]+(\"[^\"]+\"|'[^']+'|[^[:space:]]+)" | head -1 | sed -E "s/^git[[:space:]]+-C[[:space:]]+//; s/^[\"']//; s/[\"']$//")
+  if [[ -z "$t" ]]; then
+    t=$(printf '%s' "$c" | grep -oE "(^|&&|;|\|)[[:space:]]*cd[[:space:]]+(\"[^\"]+\"|'[^']+'|[^[:space:]]+)" | head -1 | sed -E "s/.*cd[[:space:]]+//; s/^[\"']//; s/[\"']$//")
+  fi
+  [[ -z "$t" ]] && t=$(printf '%s' "$PAYLOAD" | jq -r '.cwd // empty' 2>/dev/null)
+  [[ -z "$t" ]] && t="."
+  printf '%s' "$t"
+}
+TARGET="$(_target "$CMD")"
+case "$TARGET" in *'$'*) TARGET=$(printf '%s' "$PAYLOAD" | jq -r '.cwd // "."' 2>/dev/null) ;; esac
+
+GITDIR=$(git -C "$TARGET" rev-parse --absolute-git-dir 2>/dev/null)
+[[ -z "$GITDIR" ]] && exit 0                       # not a git repo
+case "$GITDIR" in */worktrees/*) exit 0 ;; esac    # linked worktree — switch freely
+
+MSG="[branch-pin] HEAD switches on the shared main tree are blocked.
+
+Multiple sessions share this working tree; moving HEAD pulls every one of
+them onto your branch — their reads and commits land there silently.
+
+Do the work in a linked worktree instead:
+  - /do plan:        bash .claude/scripts/do-auto.sh <slug> --setup-only
+  - anything else:   git worktree add -b feat/<slug> .do-worktrees/<slug> main
+  - returning home:  git switch main   (always allowed)
+
+Override for a deliberate switch:  ECC_DISABLED_HOOKS=hook:branch-pin"
+jq -nc --arg r "$MSG" '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":$r}}'
+exit 0

package/hooks/scripts/git-add-guard.sh

@@ -34,9 +34,18 @@ printf '%s' "$CMD" | grep -qE '\bgit\b' || exit 0
 # Blanket stage = `add -A`, `add --all`, `add .` (bare dot), or `commit` with a
 # short-flag cluster containing `a` (-a/-am/…) or `--all`. (`--amend`/`--author`
 # are `--` long flags, so the `-[a-z]*a` short-cluster test never matches them.)
+# Also blanket: any MUTATING `git stash` (bare/push/-u/pop/apply/drop) — a stash
+# on the shared main tree sweeps every neighbour's uncommitted work into one
+# stash entry, and pop/apply dumps foreign state back mixed with yours
+# (near-miss 2026-07-06: a loop conductor ran `git stash -u` on main and picked
+# up a neighbour's edits). `stash list` / `stash show` are read-only — allowed.
 _is_blanket() {
   printf '%s' "$1" | grep -qE '\bgit\b[^|&;]*\badd\b[^|&;]*(-A\b|--all\b|[[:space:]]\.([[:space:]]|$))' && return 0
   printf '%s' "$1" | grep -qE '\bgit\b[^|&;]*\bcommit\b[^|&;]*([[:space:]]-[a-zA-Z]*a[a-zA-Z]*\b|--all\b)' && return 0
+  if printf '%s' "$1" | grep -qE '\bgit\b[^|&;]*\bstash\b' \
+     && ! printf '%s' "$1" | grep -qE '\bgit\b[^|&;]*\bstash\b[[:space:]]+(list|show)\b'; then
+    return 0
+  fi
   return 1
 }
 _is_blanket "$CMD" || exit 0
@@ -64,17 +73,19 @@ GITDIR=$(git -C "$TARGET" rev-parse --absolute-git-dir 2>/dev/null)
 case "$GITDIR" in */worktrees/*) exit 0 ;; esac    # isolated linked worktree — blanket is safe
 
 # Main tree → deny.
-MSG="[git-add-guard] Blanket staging on the shared main tree is blocked.
+MSG="[git-add-guard] Blanket staging/stashing on the shared main tree is blocked.
 
-Multiple windows share this working tree. A blanket add (-A, bare dot, or commit -a)
-would sweep a neighbouring window uncommitted work into your commit
-(the do(funnels) tangle, 2026-06-20).
+Multiple windows share this working tree. A blanket add (-A, bare dot, commit -a)
+or a mutating stash (bare/push/-u/pop/apply) sweeps a neighbouring window's
+uncommitted work into your commit or stash
+(the do(funnels) tangle 2026-06-20; the stash -u near-miss 2026-07-06).
 
 Do one of:
   - stage by explicit path:    git add path/to/file ...
   - isolate the work:          git worktree add -b feat/<slug> ../wt-<slug> main
+  - read-only stash views (git stash list / show) are always allowed
 
 Deploy/release (a command containing git push) is exempt.
-Override once for this command:  ECC_DISABLED_HOOKS=hook:git-add-guard"
+Override once for a deliberate scoped action:  ECC_DISABLED_HOOKS=hook:git-add-guard"
 jq -nc --arg r "$MSG" '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":$r}}'
 exit 0

package/hooks/scripts/post-edit-check.sh

@@ -16,6 +16,22 @@ if [[ -z "$FILE" ]] || [[ ! "$FILE" =~ \.(ts|tsx|js|jsx)$ ]]; then
   exit 0
 fi
 
+# Dynamic workflow scripts fail SILENTLY — a syntax error doesn't error, it stops
+# the workflow from launching at all. biome won't catch the two structural traps
+# (a second top-level export; a missing `meta` block), and `node --check` exits 0
+# for any file starting with `export`. wf-check parses the body as the runtime
+# does. Non-blocking, per this hook's contract — but loud, because the default
+# failure mode is silence.
+if [[ "$FILE" == *".claude/workflows/"*.js ]]; then
+  if ! WF=$(cd "$CLAUDE_PROJECT_DIR" && node .claude/scripts/wf-check.mjs "$FILE" 2>&1); then
+    echo "wf-check: $(echo "$WF" | grep FAIL || echo "$WF")" >&2
+    echo "wf-check: this workflow will NOT launch until fixed" >&2
+    emit_signal "hook:post-edit:warn" -1 "file=$(basename "$FILE") wf-check=fail"
+    exit 0
+  fi
+  emit_signal "hook:post-edit:ok" 1 "file=$(basename "$FILE") wf-check=ok"
+fi
+
 # Quick biome lint on the single file (non-blocking)
 RESULT=$(cd "$CLAUDE_PROJECT_DIR" && bun biome check "$FILE" 2>&1)
 EXIT=$?

package/hooks/scripts/session-start.sh

@@ -39,15 +39,20 @@ MODULES=(
   "sync"
   "backup"
 )
+# `/name` = a registered directory skill, invocable via the Skill tool.
+# `name.md` = a flat file under .claude/skills/ — canon, but NOT registered in
+# this tree, so it cannot be invoked by name. Read it by path. (The published
+# oneie-claude plugin registers these, because sync-claude-mirror.sh converts
+# each flat file into <name>/SKILL.md on the way out.)
 HINTS=(
-  "/astro · /react19 · /shadcn · /dev · /build"
-  "/cloudflare · /ai-sdk · /signal"
-  "/cloudflare · /typedb · /signal"
-  "/typecheck · /signal (substrate verbs)"
-  "/typecheck · MCP server"
-  "/typecheck · CLI bins"
-  "/cloudflare (Scheduled Worker)"
-  "/cloudflare (Scheduled Worker)"
+  "/astro · /react19 · /shadcn · dev.md · build.md"
+  "cloudflare.md · /ai-sdk · signal.md"
+  "cloudflare.md · /typedb · signal.md"
+  "typecheck.md · signal.md (substrate verbs)"
+  "typecheck.md · MCP server"
+  "typecheck.md · CLI bins"
+  "cloudflare.md (Scheduled Worker)"
+  "cloudflare.md (Scheduled Worker)"
 )
 
 NEWEST_TS=0

package/hooks/scripts/sync-priority-todo.sh

@@ -25,6 +25,11 @@ if [ -n "$1" ]; then
   esac
 fi
 
+# Hook-driven run: this fires on every session open and every plan edit, so the ranker's
+# tasks:everywhere board read gets a short budget and degrades to file-only rather than
+# blocking the session on an ~11s receiver. An explicit `/do next` waits for the real answer.
+export DO_RANK_HOOK=1
+
 # Close → weight: reconcile path strength from learnings.md closes (idempotent) before
 # we rank, so a cycle close moves the next pick autonomously. See text/loop-plan.md.
 python3 "$CLAUDE_PROJECT_DIR/.claude/scripts/do-rank.py" --sync-closes >/dev/null 2>&1 || true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneie/claude",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "ONE Claude Code plugin — /do lifecycle, W0-W4 BUILD engine, 7-canon reconcile, ONE substrate via MCP, signals, and rules",
   "files": [
     ".claude-plugin",

package/rules/api.md

@@ -45,6 +45,15 @@ The `>` separator works as a fallback to `→`. Always pass `{ strength }` in th
 
 Active state (saved, archived, completed) belongs on the pheromone path, not in `localStorage`. Poll `/api/export/highways?from=source&limit=200` and classify by strength/resistance thresholds. This keeps state honest across devices.
 
+## Authorize off the context, never the body
+
+Scope every read and write to `ctx.ownerSlug`. A `slug`, `actorId`, `gid`, or
+`workspace` arriving in the request body or query string is **caller-supplied
+input, not identity** — trusting one is an IDOR, and this family has had ~80 of
+them fixed. A `?slug=` route must call `authorizeWorkspace` before it touches
+data. Ownership questions resolve by the authority walk (`schema/roles.tql`),
+not by comparing a body field to anything.
+
 ## No stubs
 
 Do not create a no-op endpoint (one that always returns `[]` or `{ok:true}`) as a placeholder. If the backend isn't ready, the caller handles the empty response from `signal`/`ask`.

package/rules/design.md

@@ -203,11 +203,21 @@ Three layers, all automatic:
 2. **PostToolUse hook** — `.claude/hooks/design-check.sh` greps every Write/Edit
    to `one.ie/web/**/*.{tsx,astro,css}` for banned patterns. Exit 2 on violation feeds
    the diff back to Claude as a tool error; the model self-corrects next turn.
-3. **This rule** — auto-loaded on the same files via `.claude/settings.json`,
-   so the constraints are in context before the first character is written.
+3. **This rule** — auto-loaded on the same files via the `paths:` frontmatter at
+   the top of this file (not `settings.json`, which wires hooks only), so the
+   constraints are in context before the first character is written.
 
 The hook allowlists `Layout.astro` (token source) and `design.astro` (showcase).
-There is no opt-out for other files.
+
+**Layers 2 and 3 are edit-triggered, so pre-existing violations survive.** The
+hook is PostToolUse: it only sees a file when that file is written. Nothing
+sweeps the tree, and layer 1 structurally cannot catch a hex string inside a JS
+object — it nulls Tailwind palette *classes*, not literals. So a file untouched
+since this rule landed can carry banned patterns indefinitely.
+`src/components/paths/PathGraph.tsx` did: it carried hex literals at lines 27,
+28, 29 and 55 until they were swept to `var(--color-{success,secondary,destructive})`.
+Treat "the hook is green" as "nobody has edited the offender", not as "the tree
+is clean".
 
 ---