@oneie/claude 0.6.0 → 0.8.0

package/commands/rag.md

@@ -41,6 +41,12 @@ Search, synthesize, verify, and ingest notes from the OO-Brain corpus (Obsidian
 
 ## Steps per mode
 
+**"Delegate to `<name>` skill" below means: Read `.claude/skills/<name>.md` and
+follow it.** Those six files are flat `.md`, not `<name>/SKILL.md` directories,
+so the runtime does not register them — the Skill tool cannot invoke them by
+name even though each carries valid `name`/`description` frontmatter. Read the
+file directly; it is the live contract either way.
+
 ### `/rag <query>` — Quick Search
 
 1. Auto-route vault from query topic.

package/commands/release.md

@@ -2,8 +2,15 @@
 
 Release the ONE OSS template and/or npm packages.
 
-**Template source:** `one-ie/template/` → `apps/one/` (github.com/one-ie/one)
-**npm packages:** `packages/{sdk,react,mcp,cli}` → npm registry
+**Template direction flipped 2026-07-23 — `apps/one/` is now the SINGLE SOURCE OF TRUTH.**
+Real development happens directly in the public clone; `one-ie/template/` is a read-only-by-
+convention **mirror** kept inside the monorepo so `packages/` and `/do` cycles can reference it
+without a second clone. Edit `apps/one` directly, then pull it back:
+**`apps/one/` → `one-ie/template/` (+ `apps/oo/site/`)**. There is deliberately **no**
+template → apps/one push path; the old direction would have destroyed apps/one-only work.
+
+**npm packages:** `packages/{sdk,react,mcp,cli}` → npm registry (a separate job — the release
+script does not publish; see Step 4)
 
 ---
 
@@ -11,8 +18,8 @@ Release the ONE OSS template and/or npm packages.
 
 | Command | What |
 |---|---|
-| `/release` | Full pipeline: template + npm packages |
-| `/release template` | Sync template to apps/one and push (no npm publish) |
+| `/release` | Full pipeline: template pull + npm packages |
+| `/release template` | Pull apps/one into the template mirror and commit in one-ie (no npm publish) |
 | `/release npm` | Bump + build + publish npm packages only |
 | `/release --dry-run` | Print what would happen, no writes |
 
@@ -30,31 +37,36 @@ test -d /Users/toc/Server/apps/one/.git || {
   exit 1
 }
 
-# Run strip guard — zero moat source in template
-cd one-ie/template && bash scripts/strip-guard.sh
+# Run strip guard — zero moat/do-engine source in the template's site/src/
+# (maintainer-only tooling lives in template-release/, a SIBLING of template/,
+#  and never ships in the published repo)
+cd one-ie/template-release && bash scripts/strip-guard.sh
 
 # Run test suite
-cd one-ie/template && bun vitest run
+cd one-ie/template-release && bun vitest run
 ```
 
 ---
 
-## Step 2 — Sync template to apps/one
+## Step 2 — Pull apps/one into the template mirror
 
 ```bash
-cd one-ie/template
+cd one-ie/template-release
 bash scripts/release.sh --message "release: $(date +%Y-%m-%d)"
+# flags: --dry-run | --no-push | --message "<note>"
 ```
 
-The script (`template/scripts/release.sh`):
-1. `rsync` template/ → apps/one/ (excludes node_modules, dist, .do-* state)
-2. Stubs paid plugins — replaces `src/` with a single `index.ts` pointing to `pay.one.ie/x/<plugin>.js`
-3. `git add -A && git commit && git push origin main`
-
-**Paid plugins** (stubbed at release — source stays private):
-- `plugin-admin` → `pay.one.ie/x/admin.js`
+The script (`template-release/scripts/release.sh`):
+1. `rsync` apps/one/ → one-ie/template/ (excludes local-only / secret files)
+2. Sync per-package LICENSE files (`sync-licenses.sh`)
+3. `git commit` (+ push unless `--no-push`) **inside the one-ie monorepo — NOT apps/one.**
+   Nothing here writes to apps/one or to github.com/one-ie/one; that clone owns its own history.
+4. `rsync` apps/one/site/ → apps/oo/site/ (keeps the agency node current, if apps/oo exists)
 
-Add more to the `PAID_PLUGINS` array in `template/scripts/release.sh` as you build them.
+**Paid plugins are not stubbed by this script.** The 5 paid plugins backing `PAID_FEATURES`
+(`one.ie/web/src/lib/billing/gate.ts`) — `plugin-{admin,course,dashboard,premium,shop}` — live in
+`apps/one/packages/` and are mirrored into `template/packages/` unpublished. Their delivery
+mechanism is still undecided: `text/plugin-delivery-plan.md` § Scope correction.
 
 ---
 
@@ -101,6 +113,13 @@ cd packages/cli   && npm publish --access public && cd ../..
 
 **Gotcha:** `workspace:*` deps must be temporarily pinned to `^x.y.z` before publishing, then restored. See memory entry `reference_oneie_npm_publish_workspace`.
 
+**The other npm packages have their own door.** `@oneie/design`, `@oneie/frontend`, and the 9
+free plugins (auth/backend/blog/booking/chat/docs/mail/media/track) publish per-package via
+`bash packages/publish-plugin.sh <plugin-dir-name> [--dry-run]` — it rewrites `workspace:*`
+peers to a loose optional `*` and restores `package.json` on exit. It **hard-refuses** the 5
+paid plugins unconditionally, even with `--dry-run`: public npm has no purchase gate. Do not
+remove that block to work around it.
+
 ---
 
 ## Step 5 — Tag + report
@@ -113,7 +132,7 @@ git tag "v$VERSION" && git push origin "v$VERSION"
 
 Report format:
 ```
-Template:  strip-guard ✓  34/34 tests ✓  synced → apps/one  pushed → github.com/one-ie/one
+Template:  strip-guard ✓  N/N tests ✓  pulled apps/one → template/  committed in one-ie
 npm:       @oneie/sdk@0.14.0 ✓  @oneie/react@0.14.0 ✓  @oneie/mcp@0.14.0 ✓  @oneie/cli@0.14.0 ✓
 Tag:       v0.14.0 → main
 ```
@@ -122,12 +141,14 @@ Tag:       v0.14.0 → main
 
 ## x402-gated plugins
 
-Paid plugins are served from `pay.one.ie/x/<name>.js`. The `release.sh` script stubs them in the OSS repo. To add a new paid plugin:
+**Design, not shipped.** `release.sh` does not stub paid plugins and there is no `PAID_PLUGINS`
+array in it — the x402 delivery path (`pay.one.ie/x/<name>.js`) is the undecided half of
+`text/plugin-delivery-plan.md`. What IS enforced today is the refusal: `packages/publish-plugin.sh`
+blocks the 5 paid plugins from npm, and they ship to nobody until that plan lands.
 
-1. Build the full plugin in `template/packages/plugin-<name>/`
-2. Add `plugin-<name>` to `PAID_PLUGINS` in `template/scripts/release.sh`
-3. Set `serves: "pay.one.ie/x/<name>.js"` in the plugin's `index.ts`
-4. Wire the x402 endpoint in `pay/backend/` to serve the compiled JS after payment
+The paid set is defined in one place — `PAID_FEATURES` in `one.ie/web/src/lib/billing/gate.ts`,
+mirrored by the `PAID_PLUGINS` string in `packages/publish-plugin.sh`. Adding a paid plugin means
+editing both, not a release-script array.
 
 ---
 
@@ -137,8 +158,8 @@ Paid plugins are served from `pay.one.ie/x/<name>.js`. The `release.sh` script s
 - **npm token** — automation token stored in memory as `reference_npm_token` (expires 2026-08-26)
 - **SDK publishes first** — registry must have it before react/mcp/cli resolve it
 - **Paid plugin source never ships** — `strip-guard.sh` verifies this; if it fails, fix before publish
-- **`apps/one` keeps its git history** — `release.sh` commits on top of existing history, preserving stars/forks
+- **`apps/one` is never written by `release.sh`** — it is the SSOT and owns its own history; the commit lands in the one-ie monorepo. Anything the mirror has that apps/one lacks must be moved by hand, deliberately.
 
 ---
 
-*Template syncs via rsync. Paid plugins stub to x402. npm packages publish in dependency order.*
+*apps/one is the source; the template mirrors it via rsync. Paid plugins ship to nobody yet. npm packages publish in dependency order.*

package/commands/restart.md

@@ -18,9 +18,7 @@ Use when: you want a clean restart without the full `/kill` overhead. Takes ~15s
 ```bash
 cd /Users/toc/Server/one-ie/one.ie/web && \
   (lsof -ti:4321,4322,4323,4324,4325,4326,4327,4328,4329,8787,8788,8789,8790,8791,8792,8793,8794,8795,8796,8797,8798,8799 2>/dev/null | xargs kill -9 2>/dev/null; \
-   pkill -f "astro dev" 2>/dev/null; \
-   pkill -f "wrangler dev" 2>/dev/null; \
-   pkill -f "local-gateway" 2>/dev/null; true)
+   pkill -f "one\.ie/web.*(astro|wrangler|local-gateway)" 2>/dev/null; true)
 ```
 
 **Step 2 — db-sync (blocking, must finish before servers start):**
@@ -36,10 +34,13 @@ cd /Users/toc/Server/one-ie/one.ie/web && bun run dev
 # Gateway — TypeDB-backed local gateway on 8788
 cd /Users/toc/Server/one-ie/one.ie/web && bun run dev:gateway
 
-# Channels worker — wrangler on 8787
+# Channels worker — wrangler on 8787 (`bun run dev` = bare `wrangler dev`)
 cd /Users/toc/Server/one-ie/channels && bun run dev
 ```
 
+`/kill` puts `one.ie/web`'s `dev:wrangler` on 8787 instead. Only one of the two
+can hold that port — don't run both; the second bind fails.
+
 Poll `http://localhost:4321/` until 200, then confirm all three up:
 - Astro: http://localhost:4321 → 200
 - Gateway: http://localhost:8788 → 404 (expected)

package/commands/see.md

@@ -17,7 +17,7 @@ Read the world — query substrate state without emitting signals.
 | `evolved` | Agents that rewrote their system prompts | L5 |
 | `revenue` | Per-path earnings from L4 economic loop | L4 |
 | `events [--since T]` | Signal history and Four Outcomes audit | L1 |
-| `memory <uid>` | Full memory card for an actor (reveal) | L6 |
+| `memory <uid>` | Unseal one PII field for an actor (reveal) — authenticated | L6 |
 
 ## Routing
 
@@ -26,22 +26,30 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 | Noun | Primitive | Source |
 |------|-----------|--------|
-| tasks | `follow()` queue read | `/api/tasks` or `scanTodos()` |
-| highways | `follow()` path read | `/api/state` strength ≥ 50 |
-| toxic | `follow()` path read | `/api/state` resistance > strength |
-| frontiers | `follow()` gap read | `/api/state` <10% traversed |
-| paths | `follow()` path query | `/api/state` filtered |
-| hypotheses | TypeDB read | learning entities |
-| evolved | TypeDB read | units where generation > 1 |
-| revenue | TypeDB read | paths with revenue attribute |
-| events | TypeDB read | signal history |
-| memory | `reveal(uid)` | `/api/memory/reveal/:uid` |
+| tasks | `follow()` queue read | `.claude/scripts/do-rank.py` |
+| highways | `follow()` path read | `GET /api/export/highways` |
+| toxic | `follow()` path read | `GET /api/export/toxic` |
+| frontiers | `follow()` gap read | `GET /api/frontiers` |
+| paths | `follow()` path query | `GET /api/paths` |
+| hypotheses | TypeDB read | `GET /api/export/hypotheses` |
+| evolved | TypeDB read | `GET /api/export/units`, filter `generation > 1` |
+| revenue | TypeDB read | `GET /api/revenue` |
+| events | TypeDB read | signal history — no GET route (see below) |
+| memory | `reveal(uid)` | `GET /api/pii/reveal/:uid?field=` |
+
+**Not built (do not invoke, do not describe as live) — verified 2026-08-02:**
+`GET /api/tasks`, `GET /api/state`, `GET /api/memory/reveal/:uid`, and
+`scanTodos()` in `src/engine/task-parse.ts` (the whole `src/engine/` dir holds
+only `rubric.ts`). Every noun that used to name one has been repointed above.
+`/api/events` exists but is **POST-only tracking ingest**, not a signal-history
+read — do not GET it.
 
 ## Steps
 
 ### tasks
 
-1. GET `http://localhost:4321/api/tasks` (falls back to `scanTodos()` in `src/engine/task-parse.ts` if server not running)
+1. `python3 .claude/scripts/do-rank.py` — the ranker reads `text/*-todo.md` directly and needs no dev server. Add `--tasks` for the tagged-signal view, `--json` for machine output, `--top N` to cap.
+   - **The one exception to this file's no-side-effects rule.** The ranker refreshes a `text/task-paths.json` memo as it runs. It does **not** write `todo.md` — that is the hourly `fade-toxic.sh` launchd loop (since 2026-09-05 the only writer). No substrate write, no `mark()`/`warn()`.
 2. Filter by `$ARGUMENTS` if provided — tags or phase (e.g. `/see tasks build P0`, `/see tasks C1`)
 3. Report tasks sorted by effective priority (priority score + pheromone strength − resistance):
    - Name, id, priority formula (e.g. `90 = critical=30 + C1=40 + dev=20`)
@@ -56,7 +64,7 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### highways
 
-1. GET `http://localhost:4321/api/export/highways?context=1` (falls back to `/api/state` if server not running)
+1. GET `http://localhost:4321/api/export/highways?limit=50` — the route takes `limit` (default 50, capped 200) and an optional `from=<aid>` to scope to one source actor. There is no `context=` param and no `/api/state` fallback.
 2. Show paths where `strength ≥ 50`, sorted by strength desc (default limit 20; use `--limit N` to override)
 3. Each: from → to, strength, traversals, revenue — and `context: <docs>` if contextHint is present
 4. Report:
@@ -69,7 +77,8 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### toxic
 
-1. GET `http://localhost:4321/api/state`
+1. GET `http://localhost:4321/api/export/toxic?limit=200` (limit capped at 500; returns warned/faded paths with `resistance > 0`, sorted by resistance desc)
+   - **Empty ≠ clean.** Every `/api/export/*` route scopes via `scopeToGroup(viewer, …)`, defaulting to `viewer='end_user'` / `workspace='default'`. An unauthenticated call returns an empty set, not a 401 — so "0 toxic paths" may mean "not authorized to see any". The same applies to `hypotheses` and `evolved` below. Authenticate, or read the count as unknown.
 2. Show paths where `resistance > strength`
 3. Each: from → to, resistance, strength, hypothesis (if any)
 4. Report:
@@ -80,7 +89,7 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### frontiers
 
-1. GET `http://localhost:4321/api/state`
+1. GET `http://localhost:4321/api/frontiers` (optional `?limit=N`)
 2. Show tag clusters with <10% traversal rate
 3. Each: tag cluster, % explored, expected value
 4. Report:
@@ -91,14 +100,14 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### paths
 
-1. GET `http://localhost:4321/api/state`
-2. Filter by `--from` and/or `--to` if provided in `$ARGUMENTS`
+1. GET `http://localhost:4321/api/paths` — params are `from=<aid>`, `to=<aid>`, `limit` (default 20), `min_strength` (default 1)
+2. Filter by `--from` and/or `--to` if provided in `$ARGUMENTS` — pass them through as `from=`/`to=`
 3. Show matching paths: from → to, strength, resistance, net weight (strength − resistance)
 4. Report all matching paths with full pheromone state
 
 ### hypotheses
 
-1. Query TypeDB: match hypothesis entities
+1. GET `http://localhost:4321/api/export/hypotheses?limit=100` (or query TypeDB directly for hypothesis entities)
 2. Show each: pattern, confidence, created, reinforced count
 3. Report:
    ```
@@ -108,7 +117,7 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### evolved
 
-1. Query TypeDB: units where `generation > 1`
+1. GET `http://localhost:4321/api/export/units`, then filter to `generation > 1` client-side (the route has no generation filter) — or query TypeDB directly
 2. Show each: uid, name, generation, current model, last evolution timestamp
 3. Report:
    ```
@@ -118,7 +127,7 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### revenue
 
-1. Query TypeDB: paths with revenue attribute, sorted desc
+1. GET `http://localhost:4321/api/revenue` (or query TypeDB for paths with a revenue attribute, sorted desc)
 2. Show per-path earnings
 3. Report:
    ```
@@ -128,7 +137,7 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 
 ### events
 
-1. Query TypeDB signals, optionally filtered by `--since T` from `$ARGUMENTS`
+1. Query TypeDB signals directly, optionally filtered by `--since T` from `$ARGUMENTS`. **No HTTP read route exists** — `/api/events` is POST-only tracking ingest and will not serve this.
 2. Show each signal: receiver, data summary, outcome, timestamp
 3. Report:
    ```
@@ -139,23 +148,24 @@ No mark(), no warn(), no side effects. Every noun is read-only.
 ### memory
 
 1. Extract `<uid>` from `$ARGUMENTS` (e.g. `/see memory person:a7f3`)
-2. GET `http://localhost:4321/api/memory/reveal/<uid>`
-3. Display the full MemoryCard:
-   - **Actor**: uid, kind, firstSeen
-   - **Hypotheses**: pattern + confidence (asserted capped at 0.30)
-   - **Highways**: top paths by strength
-   - **Signals**: last 200 episodes
-   - **Groups**: memberships
-   - **Capabilities**: offered skills + prices
-   - **Frontier**: unexplored tag clusters
-4. Report:
+2. GET `http://localhost:4321/api/pii/reveal/<uid>?field=email` — this is the only
+   shipped `reveal`. It unseals **one PII field at a time**
+   (`email|phone|address|name|dob|custom`), not a memory card.
+   - **Authenticated and audited.** It calls `requireAuth` + `requireContactOwner`,
+     so an anonymous or non-owning caller gets denied. Rate-limited to 100
+     reads/hour per reader; every read emits a `pii.read` audit event.
+   - The MCP tool `reveal` is the same route.
+3. Report:
    ```
-   Memory: <uid>
-   Hypotheses: N  (observed=X  asserted=Y)
-   Highways: N paths
-   Frontier: [tag1, tag2, ...]  — N unexplored tags
+   Reveal: <uid>  field=<field>
    ```
 
+**The aggregate MemoryCard was never built.** There is no route returning
+hypotheses + highways + last-200 signals + groups + capabilities + frontier for
+one actor. To assemble that view today, compose the other nouns for that uid:
+`/see hypotheses`, `/see highways` (`?from=<uid>`), `/see paths` (`?from=<uid>`),
+`/see frontiers`. Do not describe a single-call memory card as live.
+
 ---
 
 *Every `/see` query is a `follow()` call — the substrate answers without learning.*

package/commands/skill-create.md

@@ -27,7 +27,7 @@ tail -5 text/learnings.md
 
 # Recent cycle diff (what actually changed)
 git diff HEAD~1 HEAD --stat
-git diff HEAD~1 HEAD -- $(git diff HEAD~1 HEAD --name-only | grep -v 'text/\|text/' | head -20)
+git diff HEAD~1 HEAD -- $(git diff HEAD~1 HEAD --name-only | grep -v 'text/' | head -20)
 ```
 
 **Step 2 — Extract the pattern (Haiku · low)**
@@ -42,9 +42,25 @@ Ignore one-off specifics (feature names, slugs). Keep the reusable skeleton.
 
 **Step 3 — Write `.claude/skills/<slug>/SKILL.md`**
 
+The path is `.claude/skills/<slug>/SKILL.md` — a **directory** containing
+`SKILL.md`. A bare `.claude/skills/<slug>.md` is not loaded by the runtime
+(several flat files there — `build.md`, `typecheck.md`, `dev.md`, `signal.md`,
+`cloudflare.md`, the `rag-*.md` set — exist as canon but never trigger as skills).
+
+The YAML frontmatter is **load-bearing, not decoration**: `name` and
+`description` are what the runtime matches against to decide whether to surface
+the skill. A SKILL.md with no frontmatter never triggers. Put the trigger phrases
+in `description` — the `## When to use` body section is read only *after* the
+skill has already been selected.
+
 Use this template:
 
 ```markdown
+---
+name: <slug>
+description: <what this does, then the trigger conditions — "Use when …". Include the literal phrases a user would type. This field is the whole triggering surface.>
+---
+
 # <title> skill
 
 <one-sentence description — what this skill does for the model>
@@ -65,14 +81,31 @@ Use this template:
 
 **Step 4 — Wire it (if applicable)**
 
-- If the skill has a natural trigger phrase, append a row to the skills table in
-  `.claude/CLAUDE.md` so it auto-loads.
+- Auto-loading comes from the frontmatter `description`, not from any index —
+  get the trigger phrases into that field or the skill stays dark.
+- Then add the name to the `skills/` line in `.claude/CLAUDE.md` § Structure so
+  the harness inventory stays true. That listing is documentation of what exists;
+  it does not itself wire anything.
 - If it extends an existing skill, note the relation.
 
 **Step 5 — Close**
 
-Emit `signal("learning:harden", 1, "skill=<slug>")` and append one line to
-`text/learnings.md`:
+Append one line to `text/learnings.md`. That line **is** the close — it is
+deterministic and it is what the next cycle reads.
+
+Do **not** emit `learning:harden` or `learning:know`. Neither is a registered
+receiver: `grep -c '"learning:' packages/sdk/src/receivers.ts` → **0**. The
+earlier version of this step instructed `signal("learning:know", { skill })`,
+which fails silently — the same defect its own warning described, one line
+down. The whole `learning:` namespace is unregistered; `harden`'s only shipped
+wire is `chat:harden`, which needs a threadable `entityId` and does not fit a
+skill close.
+
+If you want the creation recorded in the substrate, `skill:save` is real
+(`packages/sdk/src/receivers.ts`). Check the receiver exists before emitting —
+the signature is `signal(receiver, data)`, and there is no three-argument form.
+
+The line:
 
 ```
 - YYYY-MM-DD · skill:<slug> · crystallised from <source-slug> · source=skill-create

package/commands/sync.md

@@ -14,10 +14,10 @@ Reconcile substrate state — report the growth loops, fire the on-demand ones,
 | L3 fade | channels cron `fade-tick` daily, rate 0.05 — TypeDB + D1 `claw_paths` | LIVE | `POST /api/fade` (web) |
 | L4 pay | signal with payment data → path revenue | LIVE | `POST /api/signal/<receiver>` |
 | L5 evolve | channels cron `evolution-tick` hourly → `agents:evolve` signal | LIVE | `POST /api/signal/agents:evolve` |
-| L6 know | channels cron `harden-tick` hourly (D1 strength≥10 → TypeDB hypotheses) | LIVE | `POST /api/ask/learning:know` |
+| L6 know | channels cron `harden-tick` hourly (D1 strength≥10 → TypeDB hypotheses, via `rememberHypothesis`) | LIVE (cron only) | **no HTTP door** — `learning:know` is unregistered |
 | L7 frontier | read surface only — no detection job exists | READ-ONLY | `GET /api/frontiers` |
 
-**Not built (do not invoke, do not describe as live):** `GET /api/tick`, `POST /api/tasks/sync`, `src/engine/{doc-scan,task-parse,reusable-tasks}.ts`. The `sync-todo-docs.sh` hook still best-effort-POSTs `/api/tasks/sync` and silently no-ops — known drift. If a tick aggregator is ever wanted, it's a `/do` cycle (thin web route composing `fade()` + `agents:evolve` + `learning:know` + frontiers read), not a doc edit.
+**Not built (do not invoke, do not describe as live):** `GET /api/tick`, `POST /api/tasks/sync`, `src/engine/{doc-scan,task-parse,reusable-tasks}.ts`. The `sync-todo-docs.sh` hook that best-effort-POSTed `/api/tasks/sync` was removed 2026-09-05 (it only ever no-op'd). If a tick aggregator is ever wanted, it's a `/do` cycle (thin web route composing `fade()` + `agents:evolve` + a harden receiver that must first be BUILT + frontiers read), not a doc edit.
 
 ## Nouns
 
@@ -28,19 +28,19 @@ Reconcile substrate state — report the growth loops, fire the on-demand ones,
 | `agents` | Scan agent `.md` frontmatter (`channels/src/lib/agent-md.ts` / `web/src/lib/agent-md.ts`) → sync units + skills + subscriptions to TypeDB | L1 |
 | `fade` | Fire L3 once — asymmetric decay | L3 |
 | `evolve` | Fire L5 once — rewrite struggling agents | L5 |
-| `know` | Fire L6 once — harden highways + hypothesize | L6 |
+| `know` | **Read** L6 — no on-demand door; `harden-tick` is the only writer | L6 |
 | `frontier` | Read L7 — current frontiers (detection job unbuilt) | L7 |
 | `pay <receiver> <amt>` | Emit L4 payment signal | L4 |
-| `<path>` | Absorb a markdown file/dir — extract concepts → `learning:know` | L6 |
+| `<path>` | Absorb a markdown file/dir — extract concepts (no harden door; see below) | L6 |
 
 ## Steps
 
 ### *(default)*
 
-1. `bun run verify` — W0 gate (skip if already passed this session)
+1. `(cd one.ie/web && bun run verify)` — W0 gate (skip if already passed this session). The `cd` is required: there is no root `package.json`, so a bare `bun run verify` from the repo root errors with "Script not found".
 2. `python3 .claude/scripts/do-rank.py` — rank + report the task queue
 3. Fire on-demand loops against the local dev server (or `ONE_API_URL`):
-   `POST /api/fade` · `POST /api/ask/learning:know` · `GET /api/frontiers`
+   `POST /api/fade` · `GET /api/frontiers` — L6 has no on-demand door (below)
 4. Report:
    ```
    Queue:    N ready  M gated  K faded  (top slug + score)
@@ -70,14 +70,24 @@ Reconcile substrate state — report the growth loops, fire the on-demand ones,
 
 ### evolve
 
-1. `POST /api/signal/agents:evolve` — same signal the hourly channels cron emits
-2. Targets units with `success-rate < 0.50` AND `sample-count ≥ 20`
+1. **Select the targets first — the receiver does not.** The hourly
+   `evolution-tick` (`channels/src/cron.ts`) runs the TypeDB query
+   `match $a isa actor, has aid $id, has success-rate $r, has sample-count $n; $r < 0.5; $n >= 20; select $id;`
+   and then posts **one signal per uid**. A bare `POST /api/signal/agents:evolve`
+   with an empty body targets nobody — it just writes a signal row.
+2. For each selected uid: `POST /api/signal/agents:evolve` with
+   `{ "data": { "uid": "<aid>" } }` (the cron posts to `$ONE_EVENTS_URL`; locally that is `http://localhost:4321`).
 3. Report: agents evaluated, agents evolved, generation numbers.
 
 ### know
 
-1. `POST /api/ask/learning:know` — promote strong paths to TypeDB hypotheses
-2. Report: highways hardened, hypotheses written. (The hourly `harden-tick` cron does this automatically from D1 `claw_paths`.)
+1. **There is no manual door.** `learning:know` is in no registry, so
+   `POST /api/ask/learning:know` 404s — this subcommand cannot force a harden.
+   The promotion happens only on the hourly `harden-tick` cron
+   (`channels/src/cron.ts:121`), which reads D1 `claw_paths` where
+   `strength >= 10` and calls `rememberHypothesis` directly.
+2. Report what the cron last wrote: highways hardened, hypotheses written. To
+   verify, read the hypotheses rather than trying to trigger a write.
 
 ### frontier
 
@@ -94,7 +104,7 @@ Reconcile substrate state — report the growth loops, fire the on-demand ones,
 
 1. Read markdown file or directory at `<path>` from `$ARGUMENTS`
 2. If directory: scan all `*.md` files recursively
-3. Extract concepts → `POST /api/ask/learning:know` per concept (or agent specs → the `agents` flow)
+3. Extract concepts → **no door exists** (`learning:know` unregistered); record them in `text/` and let `harden-tick` promote what earns strength (or agent specs → the `agents` flow)
 4. Report: files processed, entities written.
 
 ---

package/commands/vespio.md

@@ -0,0 +1,110 @@
+# /vespio — the standing sync fleet
+
+```
+  ██╗   ██╗███████╗███████╗██████╗ ██╗ ██████╗
+  ██║   ██║██╔════╝██╔════╝██╔══██╗██║██╔═══██╗
+  ██║   ██║█████╗  ███████╗██████╔╝██║██║   ██║   one-ie ──▶ vespio
+  ╚██╗ ██╔╝██╔══╝  ╚════██║██╔═══╝ ██║██║   ██║   one way · manifest-driven
+   ╚████╔╝ ███████╗███████║██║     ██║╚██████╔╝
+    ╚═══╝  ╚══════╝╚══════╝╚═╝     ╚═╝ ╚═════╝
+```
+
+Keep `apps/vespio` current with the tools it can actually use. One word to see
+the gap, close it, and push.
+
+**Vespio is not a smaller monorepo.** It is an agency tree — `clients/`, `site/`,
+`web/`, `ai/`, `packages/`. There is no `schema/`, no `pay/`, no `channels/`, and
+no `text/` promise layer. Most of one-ie's harness hard-asserts against a tree
+vespio does not have. So the interesting question was never *"how do we copy
+everything"* — it is *"what is portable, and who decides?"*
+
+---
+
+## 0 · The manifest decides — there is no second list
+
+`.claude/scripts/factory-repo.sh` already classifies every script:
+
+| bucket | means | ships to vespio |
+|---|---|---|
+| `portable` | no monorepo path, no credential read | **yes** |
+| `needs-env` | wants `ONE_ENV_FILE`, or names paths that degrade to no-ops | **yes** |
+| `monorepo-only` | hard-asserts against THIS tree; refuses without it | **never** |
+| *unclassified* | nobody has decided yet | **never — silence is not a licence** |
+
+`vespio-sync.sh` reads that manifest rather than keeping its own copy. Two lists
+drift; one cannot. Adding a script to `.claude/scripts/` therefore means adding a
+manifest line — `factory-repo.sh --check-portability` names every script that
+still has none, and `/vespio` prints them so they cannot rot in silence.
+
+**The `needs-env` bucket was classified against the FACTORY tree, not vespio's.**
+Same three buckets, different destination. When a `needs-env` script misbehaves in
+vespio, that is a reclassification, not a bug — fix the manifest.
+
+---
+
+## 1 · Run it
+
+```bash
+bash .claude/scripts/vespio-sync.sh --check    # read-only: missing · drifted
+bash .claude/scripts/vespio-sync.sh            # copy, then show the diff
+bash .claude/scripts/vespio-sync.sh --commit   # copy + commit (never pushes)
+git -C ../apps/vespio push origin main         # the human step, always separate
+```
+
+`--check` costs nothing. Run it first and last.
+
+**Pull before you sync.** Vespio's `main` drifts behind `origin/main` — it was
+9 commits behind on 2026-08-26. Syncing onto a stale local tree and pushing is
+the one irreversible mistake available here.
+
+```bash
+git -C ../apps/vespio fetch origin && git -C ../apps/vespio pull --ff-only origin main
+```
+
+---
+
+## 2 · What ships, and what is held back on purpose
+
+Held back is a **decision**, not an oversight. Record the reason or it will be
+"fixed" by the next person.
+
+| Held back | Why |
+|---|---|
+| `deploy.md` · `db-sync.md` · `release.md` | the 5-service pipeline; vespio ships a site |
+| `one.md` | nine fleets over `text/*.md` docs that do not exist here |
+| `oo-push.md` · `rag.md` | monorepo-specific surfaces |
+| skills `typedb` `sdk` `mcp` `cli` `puck` `promise-*` | need `schema/`, `packages/`, or the promise layer |
+| every `monorepo-only` script | by manifest |
+
+`cp -RL`, not `cp -R`: `.claude/skills/livekit-agents` is a **symlink out of the
+tree** and would land in vespio as a dangling link.
+
+---
+
+## 3 · Staging law — the neighbour's work is not yours
+
+Vespio carries uncommitted `clients/*/data/lifecycles/*.toml` edits that belong to
+somebody else. A harness sync must never carry them.
+
+- `git add .claude` — explicit path, always.
+- Never `git add -A`, never `git add .`, never `git commit -a`.
+- Commit and push are **separate breaths**. Show the file list, then push.
+
+---
+
+## 4 · Standing state
+
+**`.env.local.bak` is TRACKED in vespio and contains a real `ONE_API_KEY`.**
+It entered at `b931b69` and `.gitignore` covers `.env.local` but not the `.bak`.
+Untracking it forward is safe and done; **the key is still in git history and must
+be rotated** — that is an operator action, not a fleet's. Do not attempt a history
+rewrite on a shared remote.
+
+---
+
+## Don't
+
+- Don't sync while a fleet is mid-write in vespio. Land the board, don't widen it.
+- Don't hand-edit vespio's `.claude/` — it is generated output. Change one-ie, sync.
+- Don't ship an unclassified script. Classify it in the manifest first.
+- Don't push in the same breath as the commit. Look at the file list.