@oneie/claude 0.6.0 → 0.7.0

package/scripts/do-auto.sh

@@ -20,23 +20,30 @@ MAX_CYCLES=30
 DRY_RUN=false
 GC_ONLY=false
 SETUP_ONLY=false
+SELF_TEST_LIFECYCLE=false
+SELF_TEST_KANBAN=false
 
 while [ "$#" -gt 0 ]; do
   case "$1" in
-    --setup-only) SETUP_ONLY=true; shift ;;
-    --max-cycles) MAX_CYCLES="$2"; shift 2 ;;
-    --dry-run)    DRY_RUN=true; shift ;;
-    --gc)         GC_ONLY=true; shift ;;
-    -*)           echo "unknown flag: $1" >&2; exit 1 ;;
-    *)            SLUG="$1"; shift ;;
+    --setup-only)          SETUP_ONLY=true; shift ;;
+    --max-cycles)          MAX_CYCLES="$2"; shift 2 ;;
+    --dry-run)             DRY_RUN=true; shift ;;
+    --gc)                  GC_ONLY=true; shift ;;
+    --self-test-lifecycle) SELF_TEST_LIFECYCLE=true; shift ;;
+    --self-test-kanban)    SELF_TEST_KANBAN=true; shift ;;
+    -*)                    echo "unknown flag: $1" >&2; exit 1 ;;
+    *)                     SLUG="$1"; shift ;;
   esac
 done
 
 # Standalone GC: sweep all worktrees whose do/<slug> branch is fully merged into
-# the current branch. Safe-only: `worktree remove` refuses dirty, `branch -d`
-# refuses unmerged. Unmerged/dirty worktrees are listed, never touched.
+# trunk (main; DO_BASE_REF overrides). Safe-only: `worktree remove` refuses
+# dirty, `branch -d` refuses unmerged. Unmerged/dirty worktrees are listed,
+# never touched.
 if $GC_ONLY; then
-  BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
+  BASE="${DO_BASE_REF:-main}"
+  git show-ref --verify --quiet "refs/heads/$BASE" \
+    || BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
   removed=0; kept=0
   for wt in .do-worktrees/*/; do
     [ -d "$wt" ] || continue
@@ -56,6 +63,195 @@ if $GC_ONLY; then
   exit 0
 fi
 
+# _remaining/_reap_check/_reap_watcher are defined here (ahead of the SLUG
+# requirement) so --self-test-lifecycle can exercise them without a plan.
+_remaining() {
+  # Count cycles in the Status section that are open ([ ]) or in-flight ([~]) — i.e. not [x].
+  # Pattern starts with '\[' (not '-') so grep never mistakes it for an option flag.
+  # grep -c already prints a count (0 on no match) but exits 1 then — capture it so
+  # the `|| true` swallows the exit without appending a second "0" to the output.
+  # IC3 hardened: requires the em-dash after `C<n> ` so a prose bullet like
+  # "C2's collapsed into C1" is never mistaken for a real Status-block line.
+  # `^[[:space:]]*` (zero-or-more, not one-or-more) so the --self-test-lifecycle
+  # fixture (no leading indentation) still matches.
+  local n; n=$(grep -cE '^[[:space:]]*- \[[ ~]\] C[0-9]+ —' "$TODO" 2>/dev/null) || true
+  echo "${n:-0}"
+}
+
+# IC3: keep the Status-block checkbox in sync with each cycle's own wave checkboxes —
+# a cycle is done iff its `## C<n>` section has zero remaining `- [ ] W` lines.
+# POSIX-portable (no gawk-only 3-arg match()) — works with BSD awk/sed (macOS) and GNU.
+_sync_status() {
+  local todo="$1"
+  [ -f "$todo" ] || return 0
+  local total_lines
+  total_lines=$(wc -l < "$todo" 2>/dev/null | tr -d ' ') || return 0
+  # Line numbers of every `## C<n>` header (cycle-section starts) and every
+  # `## ` header (section starts in general, used to find where a cycle ends).
+  local cid_lines
+  cid_lines=$(grep -nE '^## C[0-9]+' "$todo" 2>/dev/null) || true
+  [ -z "$cid_lines" ] && return 0
+  local all_hdr_lines
+  all_hdr_lines=$(grep -nE '^## ' "$todo" 2>/dev/null) || true
+  local entry cid start_line end_line section
+  while IFS= read -r entry; do
+    [ -z "$entry" ] && continue
+    start_line="${entry%%:*}"
+    cid=$(sed -E 's/^[0-9]+:## (C[0-9]+).*/\1/' <<<"$entry")
+    # End line = line number of the next header strictly after start_line, minus 1;
+    # if none, end of file.
+    end_line=$(awk -F: -v s="$start_line" '$1 > s {print $1; exit}' <<<"$all_hdr_lines")
+    if [ -z "$end_line" ]; then
+      end_line="$total_lines"
+    else
+      end_line=$((end_line - 1))
+    fi
+    section=$(sed -n "$((start_line + 1)),${end_line}p" "$todo" 2>/dev/null)
+    if ! printf '%s\n' "$section" | grep -qE '^[[:space:]]*- \[ \] W'; then
+      # No open wave line left in this cycle's section — flip the Status-block
+      # line for this cid from [ ]/[~] to [x] if not already ticked.
+      sed -i.bak -E "s/^([[:space:]]*- \\[)[ ~](\\] ${cid} —)/\\1x\\2/" "$todo" 2>/dev/null || true
+      rm -f "${todo}.bak"
+    fi
+  done <<<"$cid_lines"
+}
+
+# IC2: reap a lingering conductor whose close-commit already landed. Split into
+# a pure decision (_reap_check, unit-testable) and the polling loop (_reap_watcher).
+_reap_check() {
+  local cur_sha="$1" iter_sha="$2" cur_remaining="$3" iter_remaining="$4"
+  [ -n "$cur_sha" ] && [ "$cur_sha" != "$iter_sha" ] && [ "$cur_remaining" -lt "$iter_remaining" ]
+}
+
+# interval/grace default to 60s/120s in production; --self-test-lifecycle passes
+# 1s/1s so the fixture doesn't block on real wall-clock time.
+_reap_watcher() {
+  local wt="$1" cond_pid="$2" iter_sha="$3" iter_remaining="$4"
+  local interval="${5:-60}" grace="${6:-120}"
+  # Iteration cap (backstop): the CONDUCTOR_TIMEOUT watchdog is what actually
+  # bounds this loop in production (it kills cond_pid, so `kill -0` fails and
+  # the while exits) — this cap only guards against a logic regression turning
+  # the loop infinite, at production defaults that's ~24h, harmless.
+  local max_iters=1440 n=0
+  while kill -0 "$cond_pid" 2>/dev/null; do
+    n=$((n + 1)); [ "$n" -gt "$max_iters" ] && return 1
+    sleep "$interval"
+    kill -0 "$cond_pid" 2>/dev/null || break
+    local cur_sha cur_remaining
+    cur_sha=$(git -C "$wt" rev-parse HEAD 2>/dev/null || echo "")
+    cur_remaining=$(_remaining)
+    if _reap_check "$cur_sha" "$iter_sha" "$cur_remaining" "$iter_remaining"; then
+      echo "[do-auto] reap watcher: close-commit detected (HEAD moved, remaining ${iter_remaining}→${cur_remaining}) — grace ${grace}s" >&2
+      sleep "$grace"
+      if kill -0 "$cond_pid" 2>/dev/null; then
+        kill -TERM "$cond_pid" 2>/dev/null || true
+        echo "[do-auto] reaped conductor — close-commit detected" >&2
+      fi
+      return 0
+    fi
+  done
+}
+
+# IC1: JSON sentinel — {"pid":N,"port":N,"iteration":N,"started_at":"<iso>"}.
+# Port is derived deterministically from the slug so a self-started dev server
+# (do-ui-gate.sh, C5) and the sentinel agree without a coordination file.
+_sentinel_port() {
+  echo $(( 4400 + $(cksum <<<"$1" | cut -d' ' -f1) % 100 ))
+}
+_write_sentinel() {
+  local path="$1" pid="$2" iteration="$3" slug="$4"
+  printf '{"pid":%d,"port":%d,"iteration":%d,"started_at":"%s"}\n' \
+    "$pid" "$(_sentinel_port "$slug")" "$iteration" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$path"
+}
+
+if $SELF_TEST_LIFECYCLE; then
+  rc=0
+  tmp=$(mktemp -d)
+  echo "[self-test-lifecycle] stale sentinel sweep..."
+  mkdir -p "$tmp/.do-worktrees/fake-slug"
+  sfile="$tmp/.do-worktrees/fake-slug/.do-loop-running"
+  _write_sentinel "$sfile" 99999999 1 "fake-slug"
+  spid=$(jq -r '.pid // empty' "$sfile" 2>/dev/null || true)
+  if [ -n "$spid" ] && kill -0 "$spid" 2>/dev/null; then
+    echo "[self-test-lifecycle] FAIL: expected dead pid $spid to fail kill -0" >&2; rc=1
+  else
+    rm -f "$sfile"
+    if [ -f "$sfile" ]; then echo "[self-test-lifecycle] FAIL: sentinel not swept" >&2; rc=1
+    else echo "[self-test-lifecycle] PASS: stale sentinel swept"; fi
+  fi
+
+  echo "[self-test-lifecycle] reap watcher..."
+  grepo=$(mktemp -d)
+  ( cd "$grepo" && git init -q && git commit --allow-empty -q -m init )
+  iter_sha=$(git -C "$grepo" rev-parse HEAD)
+  TODO="$tmp/fake-todo.md"
+  printf -- '- [x] C1 — reap + sentinel\n- [ ] C2 — kanban sync\n' > "$TODO"
+  iter_remaining=$(_remaining)
+  sleep 300 & fake_cond=$!
+  ( cd "$grepo" && git commit --allow-empty -q -m close )
+  printf -- '- [x] C1 — reap + sentinel\n- [x] C2 — kanban sync\n' > "$TODO"
+  cur_sha=$(git -C "$grepo" rev-parse HEAD); cur_remaining=$(_remaining)
+  if _reap_check "$cur_sha" "$iter_sha" "$cur_remaining" "$iter_remaining"; then
+    echo "[self-test-lifecycle] PASS: reap check fires on close-commit"
+  else
+    echo "[self-test-lifecycle] FAIL: reap check should fire" >&2; rc=1
+  fi
+  _reap_watcher "$grepo" "$fake_cond" "$iter_sha" "$iter_remaining" 1 1
+  sleep 1
+  if kill -0 "$fake_cond" 2>/dev/null; then
+    echo "[self-test-lifecycle] FAIL: fake conductor not reaped" >&2; rc=1; kill -KILL "$fake_cond" 2>/dev/null || true
+  else
+    echo "[self-test-lifecycle] PASS: fake conductor reaped"
+  fi
+
+  rm -rf "$tmp" "$grepo"
+  [ "$rc" -eq 0 ] && echo "[self-test-lifecycle] all checks passed"
+  exit "$rc"
+fi
+
+if $SELF_TEST_KANBAN; then
+  rc=0
+  tmp=$(mktemp -d)
+  TODO="$tmp/fake-todo.md"
+  cat > "$TODO" <<'EOF'
+## Status
+
+Batch 1
+  - [x] C1 — reap + sentinel (do-auto lifecycle)     state: done
+    - [x] W1 · W2 · W3 · W4
+
+Batch 2
+  - [ ] C2 — kanban sync + do-engine pick            state: blocked-on-C1
+    - [ ] W1 · W2 · W3 · W4
+
+Prose note: C2's collapsed into C1 because both touch the same file — not a real Status line.
+
+## C1 — reap + sentinel
+some text, no open wave boxes here
+
+## C2 — kanban sync + do-engine pick
+- [ ] W1 · W2 · W3 · W4
+EOF
+  before=$(_remaining)
+  # Now tick C2's wave line to simulate it finishing, then sync should flip Status too
+  sed -i.bak 's/^- \[ \] W1/- [x] W1/' "$TODO" && rm -f "$TODO.bak"
+  _sync_status "$TODO"
+  after=$(_remaining)
+  if grep -qE '^\s*- \[x\] C2 —' "$TODO"; then
+    echo "[self-test-kanban] PASS: Status line auto-ticked for C2"
+  else
+    echo "[self-test-kanban] FAIL: C2 Status line not ticked" >&2; rc=1
+  fi
+  if [ "$before" -eq 1 ] && [ "$after" -eq 0 ]; then
+    echo "[self-test-kanban] PASS: count correct before=$before after=$after"
+  else
+    echo "[self-test-kanban] FAIL: count wrong before=$before after=$after (expected 1,0)" >&2; rc=1
+  fi
+  rm -rf "$tmp"
+  [ "$rc" -eq 0 ] && echo "[self-test-kanban] all checks passed"
+  exit "$rc"
+fi
+
 [ -z "$SLUG" ] && { echo "usage: do-auto.sh <slug> [--max-cycles N] [--dry-run] | do-auto.sh --gc" >&2; exit 1; }
 
 # Validate slug is safe (kebab-case only) before it touches any shell string.
@@ -66,11 +262,20 @@ fi
 
 # Recursion guard: the conductor subprocess runs `/do <slug> --next-cycle` inside
 # the worktree. A buggy conductor may call do-auto.sh again despite the --next-cycle
-# flag. If our sentinel file exists, we're already inside a parent loop — exit cleanly.
+# flag. If our JSON sentinel exists AND its pid is alive, we're already inside a
+# parent loop — exit cleanly. A dead pid means a prior run crashed without
+# cleanup (kill -9, machine sleep) — self-heal by sweeping it instead of wedging
+# every future invocation forever.
 _sentinel=".do-worktrees/${SLUG}/.do-loop-running"
 if [ -f "$_sentinel" ]; then
-  echo "[do-auto] recursion guard: parent loop already running for $SLUG — exiting" >&2
-  exit 0
+  _sentinel_pid=$(jq -r '.pid // empty' "$_sentinel" 2>/dev/null || true)
+  if [ -n "$_sentinel_pid" ] && kill -0 "$_sentinel_pid" 2>/dev/null; then
+    echo "[do-auto] recursion guard: parent loop already running for $SLUG (pid $_sentinel_pid) — exiting" >&2
+    exit 0
+  else
+    echo "[do-auto] swept stale sentinel (pid ${_sentinel_pid:-unknown} dead)" >&2
+    rm -f "$_sentinel"
+  fi
 fi
 
 # Trust boundary: this script runs in the developer's own workspace, invoked by /do
@@ -99,13 +304,28 @@ CONDUCTOR_EFFORT="${DO_CONDUCTOR_EFFORT:-medium}"
 
 # Per-iteration hang guard: `claude -p` has no built-in wall-clock limit, and the
 # stall guard only fires BETWEEN iterations — a conductor that truly hangs would
-# block the loop forever. Cap each iteration; on overrun, terminate the conductor
-# so the iteration ends, ticks no box, and the stall guard takes over. Generous by
-# default (a healthy batch of 3 cycles runs ~20-25 min); override via env.
+# block the loop forever.
+#
+# F11 (2026-07-23): the guard is PROGRESS-BASED, not wall-clock. The old fixed
+# `sleep CONDUCTOR_TIMEOUT` killed live-but-slow COMPLEX/UI cycles mid-edit (done-ui:
+# a healthy cycle was murdered at 900s while actively editing). Now the watchdog
+# polls the worktree for SILENCE — it resets whenever the conductor writes anything
+# (new/edited files, growing diffs, a commit) and kills only after DO_IDLE_SECS of
+# NO change, with an absolute DO_HARD_CAP backstop against a pathological write-loop.
+# DO_CONDUCTOR_TIMEOUT is retained as the default hard-cap for back-compat.
 CONDUCTOR_TIMEOUT="${DO_CONDUCTOR_TIMEOUT:-2400}"
-
-# W1/W4 scripts (w1-recon.ts, w4-rubric.ts) always exit 2 and defer to agent
-# spawns through the Claude Code session (Claude Max subscription path).
+IDLE_SECS="${DO_IDLE_SECS:-600}"                       # 10 min of total silence = hung
+HARD_CAP="${DO_HARD_CAP:-$(( CONDUCTOR_TIMEOUT > 0 ? CONDUCTOR_TIMEOUT * 3 : 7200 ))}"  # absolute backstop
+POLL_SECS="${DO_POLL_SECS:-30}"
+
+# W1/W4 scripts (w1-recon.ts, w4-rubric.ts) exit 2 and defer to agent spawns
+# through the Claude Code session (Claude Max subscription path) ONLY when no
+# OPENROUTER_API_KEY resolves. With a key present — and one is present in
+# one.ie/web/.env, which both scripts fall back to — they call OpenRouter and
+# exit 0/1 with a REAL verdict. "Always defers" was wrong and hid that
+# w4-rubric.ts gates for real: its exit 1 fails a wave without any agent
+# adjudicating. Note its number is the TASK rubric (no goal-fit); the cycle gate
+# is W4's own, per .claude/scripts/rubric-weights.json.
 
 # ── Worktree isolation (one per plan) ────────────────────────────────────────
 # The loop's existence IS the trigger: do-auto only runs for multi-cycle plans
@@ -121,7 +341,14 @@ CONDUCTOR_TIMEOUT="${DO_CONDUCTOR_TIMEOUT:-2400}"
 #        └─ do/<slug>  (worktree .do-worktrees/<slug>) ── every cycle commits here
 #   plan complete → report `git merge do/<slug>`  (human lands it — never auto)
 #   halt          → worktree persists → re-run /do <slug> resumes in place
-BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
+#
+# BASE is pinned to main, not HEAD: a shared tree parked on someone's feature
+# branch would otherwise seed every new do/<slug> with that branch's commits
+# (plans cross-contaminating across concurrent sessions, 2026-07-21).
+# DO_BASE_REF overrides for a deliberate stack on another branch.
+BASE="${DO_BASE_REF:-main}"
+git show-ref --verify --quiet "refs/heads/$BASE" \
+  || BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
 BR="do/${SLUG}"
 WT=".do-worktrees/${SLUG}"
 
@@ -152,7 +379,7 @@ _setup_worktree() {
     git worktree add "$WT" "$BR" >/dev/null
   else
     echo "[do-auto] creating worktree $WT on new branch $BR (from $BASE)"
-    git worktree add -b "$BR" "$WT" HEAD >/dev/null
+    git worktree add -b "$BR" "$WT" "$BASE" >/dev/null
   fi
   _link_deps "$WT"
 
@@ -263,19 +490,20 @@ if ! $DRY_RUN; then
   # All loop state now lives in the worktree — read the boxes the subprocess ticks.
   TODO="$WT/text/${SLUG}-todo.md"
   TRUST="$WT/.do-trust.json"
+  # Plan arm (tasks-do C1): file the origin substrate task once per plan — a
+  # worktree-local sentinel (persists across a resumed loop on the same branch)
+  # keeps a re-run from re-creating it.
+  if [ ! -f "$WT/.task-created" ]; then
+    _title=$(grep -m1 '^title:' "$TODO" 2>/dev/null | sed 's/^title:[[:space:]]*//' | tr -d '"' || true)
+    bash "$(dirname "$0")/do-signal.sh" --task-create "$SLUG" "${_title:-$SLUG}" "tags=do:cycle" >/dev/null 2>&1 || true
+    touch "$WT/.task-created"
+  fi
 else
   TODO="text/${SLUG}-todo.md"
   TRUST=".do-trust.json"
 fi
 
-_remaining() {
-  # Count cycles in the Status section that are open ([ ]) or in-flight ([~]) — i.e. not [x].
-  # Pattern starts with '\[' (not '-') so grep never mistakes it for an option flag.
-  # grep -c already prints a count (0 on no match) but exits 1 then — capture it so
-  # the `|| true` swallows the exit without appending a second "0" to the output.
-  local n; n=$(grep -cE '\[[ ~]\] C[0-9]+' "$TODO" 2>/dev/null) || true
-  echo "${n:-0}"
-}
+# _remaining() is defined earlier (ahead of the SLUG check, for --self-test-lifecycle).
 
 _trust() {
   jq -r '.level // "standard"' "$TRUST" 2>/dev/null || echo "standard"
@@ -355,7 +583,7 @@ _merge_digest() {
   # we threw away). Pure git + jq: cycles closed, diffstat, gate verdict, open items,
   # cycle commits. Written to trunk's root (.do-digest.md) where the human stands.
   local digest=".do-digest.md"
-  local cycles shortstat trust composite open mb behind
+  local cycles shortstat trust composite open mb behind agents
   cycles=$(grep -cE '\[[xX]\] C[0-9]+' "$TODO" 2>/dev/null || true); cycles=${cycles:-0}
   # Diff from the MERGE-BASE, not BASE..BR. A two-dot BASE..BR diff conflates
   # "what this branch added" with "what trunk advanced while we built" (the
@@ -368,6 +596,11 @@ _merge_digest() {
   composite=$(jq -r '.composite // "?"' "$TRUST" 2>/dev/null || echo "?")
   open=0
   [ -f "$WT/.w4-improvements.json" ] && open=$(jq -r 'if type=="array" then length elif type=="object" then ([.[]?]|length) else 0 end' "$WT/.w4-improvements.json" 2>/dev/null || echo 0)
+  # IC7: exact agent count, not a guess — every wave agent appends a census
+  # line to $WT/.do-census.jsonl as it settles (do.md wave instructions,
+  # do-engine.js agent() wrapper); the digest just counts lines.
+  agents=0
+  [ -f "$WT/.do-census.jsonl" ] && agents=$(wc -l < "$WT/.do-census.jsonl" 2>/dev/null | tr -d ' ')
   {
     echo "# Merge digest — ${SLUG}"
     echo
@@ -378,6 +611,7 @@ _merge_digest() {
     [ "${behind:-0}" -gt 0 ] && echo "- **Trunk advanced during build:** ${behind} commit(s) — run \`git merge-tree ${BASE} ${BR}\` to confirm a clean merge before landing"
     echo "- **Gate verdict:** trust=${trust} · composite=${composite}"
     echo "- **Open improvements carried:** ${open}"
+    echo "- **Agents:** ${agents:-0}"
     echo
     echo "## Files changed (this branch only)"
     git -C "$WT" diff --stat "$mb..$BR" 2>/dev/null | sed 's/^/    /' || true
@@ -387,6 +621,34 @@ _merge_digest() {
   } > "$digest" 2>/dev/null || true
 }
 
+# --- Nested-CLI probe (fail-fast) --------------------------------------------
+# do-auto drives every cycle by spawning `claude -p` in a fresh session (line ~729).
+# In environments without a headless claude CLI / auth, those spawns die instantly
+# ("Execution error") and the loop grinds out ZERO work while LOOKING like a stall
+# (verified done-ui 2026-07-23: 3 launches, 0 cycles built, ~45min wasted). Probe
+# once, up front, and fail LOUDLY with the real cause + the Path-2 fallback instead
+# of two silent no-progress iterations. Override with DO_SKIP_CLI_PROBE=1.
+if [ "${DO_SKIP_CLI_PROBE:-0}" != "1" ] && ! $DRY_RUN; then
+  ( cd "$WT" && unset CLAUDECODE CLAUDE_CODE_CHILD_SESSION CLAUDE_CODE_SESSION_ID AI_AGENT && \
+    claude --model "$CONDUCTOR_MODEL" --dangerously-skip-permissions -p "Reply with exactly: PROBE_OK" ) >"$WT/.do-probe.out" 2>&1 &
+  _probe_pid=$!
+  ( sleep 45; kill -0 "$_probe_pid" 2>/dev/null && { pkill -f "PROBE_OK" 2>/dev/null || true; kill -TERM "$_probe_pid" 2>/dev/null || true; } ) &
+  _probe_wd=$!
+  wait "$_probe_pid" 2>/dev/null || true
+  kill "$_probe_wd" 2>/dev/null || true
+  if ! grep -q "PROBE_OK" "$WT/.do-probe.out" 2>/dev/null; then
+    echo "[do-auto] FATAL: nested \`claude -p\` cannot run in this environment — the conductor would build zero work." >&2
+    echo "[do-auto]   probe said: $(head -c 200 "$WT/.do-probe.out" 2>/dev/null | tr '\n' ' ')" >&2
+    echo "[do-auto]   Run Path 2 instead (in-process agents, no nested CLI):" >&2
+    echo "[do-auto]     Workflow({scriptPath: \".claude/workflows/do-engine.js\", args:{slug:\"$SLUG\"}})" >&2
+    rm -f "$WT/.do-probe.out"
+    _signal halt "$SLUG" "$(_tier)" 0 "reason=nested-cli-unavailable" 2>/dev/null || true
+    exit 3
+  fi
+  rm -f "$WT/.do-probe.out"
+  echo "[do-auto] nested-CLI probe: ok"
+fi
+
 i=0
 prev_remaining=-1
 stall=0
@@ -396,6 +658,7 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
     break
   fi
 
+  _sync_status "$TODO"
   remaining=$(_remaining)
   if [ "$remaining" -eq 0 ]; then
     echo "[do-auto] no open cycles — plan complete"
@@ -458,6 +721,10 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
 
   # Emit cycle-open signal (world:do-event type:aim) before the conductor starts.
   _signal aim "$SLUG" "$(_tier)" "$i"
+  # Lease the plan's substrate task (tasks-do C1/C5 — claim = lease, same verb
+  # do-fleet.sh checks before spawning a worktree). Fire-and-forget: a missing
+  # task (never seeded) or a claim race never blocks the loop.
+  bash "$(dirname "$0")/do-signal.sh" --task-claim "$SLUG" >/dev/null 2>&1 || true
 
   # C6: Trail confidence hint — query KV trail before spawning the conductor.
   # If confidence ≥ 0.8, write .do-trail-hint.json in the worktree so W1 can skip W2.
@@ -488,32 +755,65 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
   # Fresh context, isolated tree: the subprocess runs INSIDE the worktree, so
   # every edit/box-tick/state-write lands on branch $BR — trunk is never touched.
   # Sentinel prevents the conductor from spawning a recursive do-auto.sh loop.
-  touch "$WT/.do-loop-running"
   # Pick the conductor model — fallback to sonnet (world:pick-model not yet wired).
   _shape_pick="do:$(_tier)"
   if [ -n "${_axis:-}" ]; then _shape_pick="${_shape_pick}·${_axis}"; fi
 
-  # Run the conductor in the background with a bash-native watchdog (macOS has no
-  # `timeout`). If it overruns CONDUCTOR_TIMEOUT, the watchdog terminates both the
-  # subshell and the claude process (matched by its --next-cycle command line).
+  # HEAD baseline + open-cycle baseline captured BEFORE the conductor runs — the
+  # reap watcher (IC2) compares against these to detect a close-commit.
+  _iter_sha=$(git -C "$WT" rev-parse HEAD 2>/dev/null || echo "")
+  _iter_remaining="$remaining"
+
+  # Run the conductor in the background with a bash-native, PROGRESS-BASED watchdog
+  # (macOS has no `timeout`). It kills the conductor only after IDLE_SECS of worktree
+  # SILENCE (or the HARD_CAP absolute backstop) — never mid-edit on a slow-but-live
+  # cycle. Matches the claude process by its --next-cycle command line.
   # Unset Claude Code session vars so the subprocess starts a fresh session instead
   # of being blocked by the anti-nesting guard (CLAUDECODE/CLAUDE_CODE_CHILD_SESSION).
   ( cd "$WT" && unset CLAUDECODE CLAUDE_CODE_CHILD_SESSION CLAUDE_CODE_SESSION_ID AI_AGENT && claude --model "$CONDUCTOR_MODEL" --effort "$CONDUCTOR_EFFORT" --dangerously-skip-permissions -p "/do $SLUG --next-cycle${AUTO_FLAG}" ) &
   cond_pid=$!
-  ( sleep "$CONDUCTOR_TIMEOUT"
-    if kill -0 "$cond_pid" 2>/dev/null; then
-      echo "[do-auto] conductor exceeded ${CONDUCTOR_TIMEOUT}s — terminating (hang guard); stall guard will halt if no progress" >&2
-      pkill -f "do ${SLUG} --next-cycle" 2>/dev/null || true
-      kill -TERM "$cond_pid" 2>/dev/null || true
-      sleep 5; kill -KILL "$cond_pid" 2>/dev/null || true
-    fi ) &
+  _write_sentinel "$WT/.do-loop-running" "$cond_pid" "$i" "$SLUG"
+  # Progress signal (F11): ANY file written under the worktree since the last poll —
+  # code edits, new files, commits, AND gitignored state (.w2-spec.json, .w1-cache/,
+  # .do-census.jsonl) that a git-only signal would miss during a long W1/W2 phase that
+  # writes no tracked code. `find -newer <marker> | head -1` is POSIX-portable (BSD +
+  # GNU). Marker lives OUTSIDE the worktree so it never lands in a commit; excludes
+  # .git + node_modules (the linked heavy tree).
+  _wd_marker="${TMPDIR:-/tmp}/.do-wd-${SLUG}-$$"; : > "$_wd_marker"
+  ( _t0=$(date +%s); _last_change=$_t0
+    while kill -0 "$cond_pid" 2>/dev/null; do
+      sleep "$POLL_SECS"
+      _now=$(date +%s)
+      if [ -n "$(find "$WT" -type f -not -path '*/.git/*' -not -path '*/node_modules/*' -newer "$_wd_marker" 2>/dev/null | head -1)" ]; then
+        : > "$_wd_marker"; _last_change=$_now
+      fi
+      _idle=$(( _now - _last_change )); _elapsed=$(( _now - _t0 ))
+      if [ "$_idle" -ge "$IDLE_SECS" ]; then
+        echo "[do-auto] conductor idle ${_idle}s (no worktree write ≥ ${IDLE_SECS}s) — terminating (progress guard); stall guard halts if no box ticked." >&2
+        pkill -f "do ${SLUG} --next-cycle" 2>/dev/null || true
+        kill -TERM "$cond_pid" 2>/dev/null || true; sleep 5; kill -KILL "$cond_pid" 2>/dev/null || true; break
+      fi
+      if [ "$_elapsed" -ge "$HARD_CAP" ]; then
+        echo "[do-auto] conductor exceeded hard cap ${HARD_CAP}s (writing but never closing) — terminating (backstop)." >&2
+        pkill -f "do ${SLUG} --next-cycle" 2>/dev/null || true
+        kill -TERM "$cond_pid" 2>/dev/null || true; sleep 5; kill -KILL "$cond_pid" 2>/dev/null || true; break
+      fi
+    done
+    rm -f "$_wd_marker" ) &
   wd_pid=$!
+  # IC2: reap a conductor that's already committed its close but is still idling
+  # (e.g. waiting on a tool call that never returns) — the 3600s+ hang guard above
+  # stays as the backstop for a truly stuck conductor; this catches the faster,
+  # more common case of "done but not exiting."
+  TODO="$WT/text/${SLUG}-todo.md" _reap_watcher "$WT" "$cond_pid" "$_iter_sha" "$_iter_remaining" &
+  reap_pid=$!
   wait "$cond_pid" 2>/dev/null || true
   kill "$wd_pid" 2>/dev/null || true   # conductor finished first — cancel the watchdog
+  kill "$reap_pid" 2>/dev/null || true # conductor finished first — cancel the reap watcher
   # Kill any child do-auto.sh the conductor may have spawned despite --next-cycle.
   pkill -f "do-auto.sh ${SLUG}" 2>/dev/null || true
   sleep 1
-  rm -f "$WT/.do-loop-running"
+  rm -f "$WT/.do-loop-running" "${_wd_marker:-}"   # marker cleanup (subshell's rm is skipped when the conductor finishes first)
 
   # Objective security gate (W4 bash-first, zero-LLM): before the cycle lands on
   # the branch, secret-scan the worktree + audit deps. A scored security score can
@@ -553,10 +853,13 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
   _shape=""
   [ -n "$_axis" ] && _shape="shape=do:$(_tier)·${_axis}"
   _model="model=${CONDUCTOR_MODEL}"
+  # worktags = the plan's dept+topic tags (the vocabulary real tasks carry) — the reputation
+  # harvest credits these tag-nodes so tasks:mine ranks by proven work (text/reputation.md § A).
+  _worktags=$(python3 "$(dirname "$0")/do-rank.py" --worktags "$SLUG" 2>/dev/null || true)
   if [ -n "$_composite" ]; then
-    _signal learn "$SLUG" "$(_tier)" "$i" "composite=${_composite}" ${_shape:+"$_shape"} "$_model"
+    _signal learn "$SLUG" "$(_tier)" "$i" "composite=${_composite}" ${_shape:+"$_shape"} "$_model" ${_worktags:+"worktags=$_worktags"}
   else
-    _signal learn "$SLUG" "$(_tier)" "$i" ${_shape:+"$_shape"} "$_model"
+    _signal learn "$SLUG" "$(_tier)" "$i" ${_shape:+"$_shape"} "$_model" ${_worktags:+"worktags=$_worktags"}
   fi
 done
 
@@ -576,6 +879,10 @@ fi
 # away the reasoning to stay cheap, so the digest is the only thing left to read
 # before an irreversible merge.
 _merge_digest
+# Close the loop on the origin task (tasks-do C1): the handoff-completion
+# record — provenance line + task-status:done — lands once, at PLAN close,
+# not per cycle (a plan's cycles all serve the same origin task).
+bash "$(dirname "$0")/do-signal.sh" --task-link "$SLUG" "docs=${SLUG}" >/dev/null 2>&1 || true
 echo ""
 echo "[do-auto] ✓ plan complete on branch $BR — trunk ($BASE) untouched."
 echo "[do-auto]   read:    .do-digest.md                 # what landed + gate verdict (reasoning was discarded)"

package/scripts/do-consumer-sweep.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# do-consumer-sweep.sh — path-prefix table mapping a changed public surface to
+# the commands that prove its consumers still build. W4's RECONCILES gate can
+# see that A changed; it can't see that B silently broke because it imports A.
+# This does — by rule, not by LLM judgment.
+#
+# Usage: do-consumer-sweep.sh [--exec] <changed-file>...
+#        do-consumer-sweep.sh --self-test
+#   default: prints one command per matched rule (no execution)
+#   --exec:  also runs each printed command; any non-zero exit fails the sweep
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/../.." || exit 2
+
+EXEC=false
+FILES=()
+for a in "$@"; do
+  case "$a" in
+    --exec)       EXEC=true ;;
+    --self-test)  SELF_TEST=true ;;
+    *)            FILES+=("$a") ;;
+  esac
+done
+SELF_TEST="${SELF_TEST:-false}"
+
+# rule: <path-prefix or exact path>|<command>  (one rule may repeat a prefix for multiple commands)
+RULES='
+packages/sdk/src/|(cd packages/cli && bun run test)
+packages/sdk/src/|(cd packages/mcp && bunx tsc --noEmit)
+schema/one.tql|(cd packages/sdk && bun run generate:base && git diff --exit-code src/generated/)
+packages/sdk/src/receivers.ts|(cd one.ie/web && bunx vitest run tests/unit/done/surfaces.test.ts)
+'
+
+_match() {
+  local f="$1" prefix cmd matched=false
+  while IFS='|' read -r prefix cmd; do
+    [ -z "$prefix" ] && continue
+    case "$f" in
+      "$prefix"*) matched=true; echo "$cmd" ;;
+    esac
+  done <<< "$RULES"
+  $matched
+}
+
+if $SELF_TEST; then
+  echo "[consumer-sweep] self-test: packages/sdk/src/client.ts"
+  out=$(_match "packages/sdk/src/client.ts" || true)
+  ok=true
+  echo "$out" | grep -q "cd packages/cli && bun run test" || { echo "[consumer-sweep] FAIL: cli rule missing" >&2; ok=false; }
+  echo "$out" | grep -q "cd packages/mcp && bunx tsc --noEmit" || { echo "[consumer-sweep] FAIL: mcp rule missing" >&2; ok=false; }
+  $ok && echo "[consumer-sweep] self-test OK" || exit 1
+  exit 0
+fi
+
+[ "${#FILES[@]}" -eq 0 ] && { echo "[consumer-sweep] no changed files given — nothing to sweep"; exit 0; }
+
+any=false
+rc=0
+for f in "${FILES[@]}"; do
+  cmds=$(_match "$f" || true)
+  [ -z "$cmds" ] && continue
+  any=true
+  while IFS= read -r cmd; do
+    [ -z "$cmd" ] && continue
+    echo "[consumer-sweep] $f → $cmd"
+    if $EXEC; then
+      eval "$cmd" || { echo "[consumer-sweep] FAIL: consumer command failed for $f: $cmd" >&2; rc=1; }
+    fi
+  done <<< "$cmds"
+done
+
+$any || echo "[consumer-sweep] no rule matched any changed file — nothing to sweep"
+exit "$rc"