@oneie/claude 0.6.0 → 0.8.0

package/scripts/governor-doors-check.sh

@@ -0,0 +1,281 @@
+#!/usr/bin/env bash
+# governor-doors-check.sh — the DOORS half of the governor guard.
+#
+#   bash .claude/scripts/governor-doors-check.sh          # audit + reentrancy
+#   bash .claude/scripts/governor-doors-check.sh --list    # every heavy script
+#   bash .claude/scripts/governor-doors-check.sh --self-test
+#
+# hook:governor-escape guards what an executor TYPES. This guards what the tree
+# OFFERS. They are different holes and only the second one explains the real
+# failure: `cd channels && bun run test` is an ungoverned 135-file two-runner
+# suite, and nothing about that command string looks like an escape. The hole
+# was the package script, not the command.
+#
+# Enumerated from `git ls-files` at run time, never from a hardcoded package
+# list -- the rot test-lanes.sh explicitly avoided. A NEW package, or a new
+# heavy script in an existing one, is therefore a failure the day it lands
+# rather than the day someone remembers to look.
+#
+# WHAT COUNTS AS A DOOR: a package.json script that reaches a runner pool --
+# vitest / bun test / playwright / astro check -- directly, or one hop through
+# `bash <script>.sh`. `channels`' test is the one-hop case and the reason the
+# hop is followed: its own file, not its package.json, holds the two runners.
+#
+# WHAT IS DELIBERATELY NOT A DOOR is in SKIP below, each with its reason. That
+# list is the argument, not an allowlist of convenience: a governed slot on a
+# 2-second typecheck is cost with no benefit, and `tsc` already has its own
+# lock via tsc-cached.sh -- nesting it would put two locks on one logical gate.
+# SHIPS (needs-env). In a generated factory clone this enumerates THAT repo
+# package.json files, while every line in the skip list names a monorepo path
+# that can never match there -- so it may report open doors it has no opinion
+# about. That is loud rather than wrong: the doors it names really are
+# ungoverned in that tree. Read the skip list as this repo argument, not as a
+# universal one.
+set -uo pipefail
+# GOV_DOORS_ROOT lets --self-test point the REAL audit at a sandbox tree.
+# Without it the red proof has to duplicate the classifier, and a duplicated
+# classifier is the drift this file exists to avoid.
+ROOT="${GOV_DOORS_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+cd "$ROOT" || exit 1
+
+HEAVY_RE='vitest|tsc[[:space:]]+--noEmit|astro[[:space:]]+check|playwright[[:space:]]+test|(^|[^a-zA-Z0-9_-])bun[[:space:]]+test([^a-zA-Z0-9_:-]|$)'
+
+# ── the reasoned skips ──────────────────────────────────────────────────────
+# <pkg-relpath>::<script>   why
+skips() {
+  cat <<'SKIP'
+*::typecheck                a bare tsc, seconds not minutes, and verify-fast routes tsc through tsc-cached.sh which takes its OWN gate lock -- wrapping would be a second lock on one logical gate
+*::test:watch               a watch never exits; a wall-clock bound would kill it
+*::test:raw                 an escape hatch by definition -- ungoverned is the whole point
+*::verify:raw               an escape hatch by definition
+*::test:coverage            watch-mode vitest (no `run`); a bound would kill it
+one.ie/web::test:e2e:pw     opt-in e2e needing a live server; a 1800s bound could kill a legitimate long run
+one.ie/web::test:e2e:pw:ui  interactive -- a bound would kill a human's session
+one.ie/web::test:e2e:pw:debug interactive -- a bound would kill a human's session
+backup::test                2 test files under `bun test`, no fork pool -- cannot be the memory driver
+packages/evals::test        1 test file -- cannot be the memory driver
+packages/plugin-pages::test 1 test file -- cannot be the memory driver
+packages/plugin-pages::build tsc --noEmit wearing a build's name; same reason as typecheck
+pay/packages/one-protocol::test watch-mode vitest (no `run`) AND 0 test files -- see FINDINGS
+pay/packages/sdk::test      0 test files
+oo-brain::typecheck         not a deployed service
+template/site::typecheck    Astro 7 template, not a deployed service
+template-release::test      a release template, not a live package
+template-release::verify    a TEMPLATE: it is copied out to users WITHOUT .claude/, so wrapping it would bake in a gate-run.sh path that does not exist downstream and break the template itself
+SKIP
+}
+
+is_skipped() { # is_skipped <pkgdir> <script>
+  local pkg="$1" name="$2" k v
+  while read -r k v; do
+    [ -z "$k" ] && continue
+    case "$k" in
+      "*::$name")      return 0 ;;
+      "$pkg::$name")   return 0 ;;
+    esac
+  done < <(skips)
+  return 1
+}
+
+# ── enumerate ───────────────────────────────────────────────────────────────
+# Emits: <state> <pkgdir> <script> <command>   state = GOVERNED|OPEN|SKIP
+# Tracked files in a repo; a plain walk in a sandbox. Never node_modules.
+_list_package_jsons() {
+  if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    git ls-files '*package.json' | grep -v node_modules
+  else
+    find . -name package.json -not -path '*/node_modules/*' | sed 's|^\./||'
+  fi
+}
+
+enumerate() {
+  local pj
+  while IFS= read -r pj; do
+    [ -f "$pj" ] || continue
+    node -e '
+      const fs=require("fs"), path=require("path");
+      const pj=process.argv[1], dir=path.dirname(pj);
+      let j; try{ j=JSON.parse(fs.readFileSync(pj,"utf8")); }catch(e){ process.exit(0); }
+      const heavy=/vitest|tsc\s+--noEmit|astro\s+check|playwright\s+test|(^|[^\w-])bun\s+test([^\w:-]|$)/;
+      const scripts=j.scripts||{};
+      for(const [k,v] of Object.entries(scripts)){
+        let reaches=heavy.test(v), via="", hopGoverned=false;
+        // ONE HOP: `bash scripts/test.sh` hides its runners in its own file.
+        // Two traps, both hit on the FIRST run of this checker:
+        //  - install-hooks.sh only NAMES tsc, in a comment and an echo. A bare
+        //    mention is not an invocation, so the hop is position-anchored the
+        //    same way hook:governor-escape is. It is the same scar
+        //    this repo already carries under "a hook greps the whole
+        //    command"; reproducing it here made the checker cry wolf
+        //    on six innocent scripts.
+        //  - verify-fast.sh IS governed: it routes everything through
+        //    gate-run.sh internally. Governance can live in the HOPPED file,
+        //    so it has to be read there too, not only in package.json.
+        if(!reaches){
+          // Take EVERY `bash <x>.sh` in the value and skip gate-run.sh itself:
+          // once a one-hop script is wrapped, the first .sh in the string is the
+          // wrapper, and matching only that made channels and the three demos
+          // vanish from this audit the moment they were fixed. A guard that goes
+          // blind on the thing it just repaired cannot detect a later regression.
+          const all=[...v.matchAll(/bash\s+([^\s;&|]+\.sh)/g)].map(function(x){return x[1];});
+          const wrapped=all.some(function(x){return /gate-run\.sh$/.test(x);});
+          const m=all.filter(function(x){return !/gate-run\.sh$/.test(x);}).map(function(x){return [null,x];})[0];
+          if(m){
+            const hp=path.join(dir,m[1]);
+            try{
+              // Comments are prose, never invocations. install-hooks.sh
+              // line 2 reads "(astro check + tsc)" -- the bare paren made
+              // it look like a command position. Strip comments first.
+              const body=fs.readFileSync(hp,"utf8")
+                .split("\n").filter(function(l){return !/^\s*#/.test(l);}).join("\n");
+              const invoked=new RegExp(
+                "(^|[;&|(]|&&|\\|\\|)[ \\t]*([A-Za-z_][A-Za-z0-9_]*=[^ \\t]*[ \\t]+)*"+
+                "((bunx|npx|bun|npm|xargs)[ \\t]+)*"+
+                "(vitest|tsc[ \\t]+--noEmit|astro[ \\t]+check|playwright[ \\t]+test|bun[ \\t]+test)","m");
+              if(invoked.test(body)){
+                reaches=true; via=" [via "+m[1]+"]";
+                // governed either by the wrapper in package.json, or because the
+                // hopped file routes through gate-run.sh internally (verify-fast).
+                if(wrapped || /gate-run\.sh/.test(body)) hopGoverned=true;
+              }
+            }catch(e){}
+          }
+        }
+        if(!reaches) continue;
+        const governed=/gate-run\.sh/.test(v) || hopGoverned;
+        console.log((governed?"GOVERNED":"OPEN")+"\t"+dir+"\t"+k+"\t"+v+via);
+      }
+    ' "$pj"
+  done < <(_list_package_jsons)
+}
+
+bad=0
+ok()   { printf '  ok    %s\n' "$*"; }
+nope() { printf '  FAIL  %s\n' "$*"; bad=$((bad + 1)); }
+
+audit() {
+  echo "== doors — every heavy package script is governed, or skipped for a stated reason"
+  local state pkg name cmd n_gov=0 n_skip=0
+  while IFS=$'\t' read -r state pkg name cmd; do
+    [ -z "${state:-}" ] && continue
+    if [ "$state" = "GOVERNED" ]; then n_gov=$((n_gov+1)); continue; fi
+    if is_skipped "$pkg" "$name"; then n_skip=$((n_skip+1)); continue; fi
+    nope "UNGOVERNED heavy script: (cd $pkg && bun run $name)  ->  $cmd"
+    printf '        fix: wrap it — bash <rel>/.claude/scripts/gate-run.sh %s -- %s\n' "$name" "$cmd"
+  done < <(enumerate)
+  [ "$bad" -eq 0 ] && ok "$n_gov governed, $n_skip skipped with a reason, 0 open"
+}
+
+# ── the wrapped paths must actually resolve ────────────────────────────────
+# Every wrap names gate-run.sh RELATIVELY, resolved from the package dir that
+# `bun run` cd's into. A wrong `../` count is the one way wrapping can break a
+# script, and it would surface only when somebody ran it -- months later, as a
+# "test command is broken" that nobody connects to this change. Derived from the
+# enumeration, never from a list, so a package wrapped tomorrow is checked too.
+paths() {
+  echo "== wrapped paths — every relative gate-run.sh resolves from its package dir"
+  local state pkg name cmd rel n=0
+  while IFS=$'\t' read -r state pkg name cmd; do
+    [ "${state:-}" = "GOVERNED" ] || continue
+    rel=$(printf '%s' "$cmd" | sed -nE 's|.*bash ([^ ]*gate-run\.sh) .*|\1|p' | head -1)
+    [ -n "$rel" ] || continue
+    case "$rel" in /*) [ -f "$rel" ] && { n=$((n+1)); continue; } ;; esac
+    if [ -f "$pkg/$rel" ]; then
+      n=$((n+1))
+    else
+      nope "$pkg :: $name names $rel, which does NOT resolve from $pkg"
+    fi
+  done < <(enumerate)
+  [ "$bad" -eq 0 ] && ok "$n wrapped scripts, every relative path resolves"
+}
+
+# ── re-entrancy: the one way wrapping could make things WORSE ───────────────
+# gate-run is re-entrant by design (GOVERN_IN_GATE), so a wrapped `test` called
+# from a wrapped `verify` must inherit the outer slot rather than queue behind
+# it. With the cap at 1 a non-re-entrant nest DEADLOCKS -- which is exactly what
+# the red half below forces, so this check is not taking re-entrancy on trust.
+reentrancy() {
+  echo "== re-entrancy — a wrapped gate nested in a wrapped gate must not deadlock"
+  local sandbox G o e
+  sandbox="$(mktemp -d)"
+  G="$ROOT/.claude/scripts/gate-run.sh"
+  o="$sandbox/out"; e="$sandbox/err"
+  local T=30   # bound the whole experiment; the commands under test are echoes
+
+  # NEVER capture a gate with `out=$(gate-run ... 2>&1)`. run_bounded
+  # (govern.sh:130-134) forks a watchdog holding `sleep $GOVERN_GATE_TIMEOUT`,
+  # deliberately detached from STDOUT on 2026-09-01 so a command substitution
+  # would not block on it -- but `2>&1` reattaches it to the captured pipe, and
+  # the substitution then hangs for the FULL timeout after the command has
+  # already finished. Measured here: 1800s of nothing, killed at 144.
+  # Redirect to files and read the files.
+
+  # GREEN: the nested gate inherits the outer slot even with the cap at 1.
+  GOVERN_DIR="$sandbox" GOVERN_MAX_GATES=1 GOVERN_QUEUE_WAIT=8 GOVERN_GATE_TIMEOUT=$T \
+    bash "$G" outer -- bash -c \
+    "GOVERN_DIR='$sandbox' GOVERN_MAX_GATES=1 GOVERN_QUEUE_WAIT=8 GOVERN_GATE_TIMEOUT=$T bash '$G' inner -- echo NESTED_OK" \
+    >"$o" 2>"$e"
+  if grep -q NESTED_OK "$o"; then
+    ok "nested gate inherited the outer slot at cap 1 (no deadlock)"
+  else
+    nope "nested gate did NOT complete at cap 1 — deadlock. out=[$(cat "$o")] err=[$(cat "$e")]"
+  fi
+
+  # RED: clear GOVERN_IN_GATE inside, so the nest asks for a SECOND slot at cap
+  # 1. It must starve -- proving the green above was re-entrancy doing the work
+  # and not merely a cap that never bound.
+  : > "$o"; : > "$e"
+  GOVERN_DIR="$sandbox" GOVERN_MAX_GATES=1 GOVERN_QUEUE_WAIT=4 GOVERN_GATE_TIMEOUT=$T \
+    bash "$G" outer2 -- bash -c \
+    "unset GOVERN_IN_GATE; GOVERN_DIR='$sandbox' GOVERN_MAX_GATES=1 GOVERN_QUEUE_WAIT=4 GOVERN_GATE_TIMEOUT=$T bash '$G' inner2 -- echo SHOULD_NOT_RUN" \
+    >"$o" 2>"$e"
+  if grep -q SHOULD_NOT_RUN "$o"; then
+    nope "a second slot was granted at cap 1 — the cap does not bind, so the green proves nothing"
+  elif grep -q "no slot after" "$e"; then
+    ok "without re-entrancy the same nest starves at cap 1 (the cap really binds)"
+  else
+    nope "unexpected red-half output. out=[$(cat "$o")] err=[$(cat "$e")]"
+  fi
+  rm -rf "$sandbox"
+}
+
+# ── red proof ───────────────────────────────────────────────────────────────
+self_test() {
+  echo "== self-test — plant an open door, the REAL audit must go RED"
+  local sandbox out rc
+  sandbox="$(mktemp -d)"
+  mkdir -p "$sandbox/planted"
+  cat > "$sandbox/planted/package.json" <<'PKG'
+{ "name": "planted", "scripts": { "test": "vitest run" } }
+PKG
+  # Drive audit() itself, in a sandbox tree, through the same enumerate().
+  out=$(GOV_DOORS_ROOT="$sandbox" GOV_DOORS_INNER=1 bash "${BASH_SOURCE[0]}" 2>&1); rc=$?
+  if [ $rc -ne 0 ] && printf '%s' "$out" | grep -q 'UNGOVERNED heavy script'; then
+    ok "a planted ungoverned test makes the real audit go RED"
+  else
+    nope "planted open door did not turn the audit red (rc=$rc): $out"
+  fi
+
+  # And the inverse: wrapping the SAME script must clear the SAME audit.
+  cat > "$sandbox/planted/package.json" <<'PKG'
+{ "name": "planted", "scripts": { "test": "bash ../.claude/scripts/gate-run.sh t -- vitest run" } }
+PKG
+  out=$(GOV_DOORS_ROOT="$sandbox" GOV_DOORS_INNER=1 bash "${BASH_SOURCE[0]}" 2>&1); rc=$?
+  if [ $rc -eq 0 ]; then
+    ok "wrapping the same script clears the same audit"
+  else
+    nope "wrapped script still reads open: $out"
+  fi
+  rm -rf "$sandbox"
+}
+
+case "${1:-}" in
+  --list)      enumerate | sort | column -t -s$'\t' 2>/dev/null || enumerate | sort; exit 0 ;;
+  --self-test) self_test ;;
+  *)           if [ -n "${GOV_DOORS_INNER:-}" ]; then audit
+               else audit; echo; paths; echo; reentrancy; echo; self_test; fi ;;
+esac
+
+echo
+if [ "$bad" -eq 0 ]; then echo "RESULT: PASS — no ungoverned heavy door, and nesting does not deadlock"
+else echo "RESULT: RED — $bad failure(s)"; exit 1; fi

package/scripts/governor-escape-check.sh

@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+# governor-escape-check.sh — proof for hook:governor-escape, both directions.
+#
+#   bash .claude/scripts/governor-escape-check.sh
+#
+# Three parts, and the third is the one that makes the first two mean anything:
+#
+#   A  the matcher's case table — every escape BLOCKS, and every innocent
+#      command that merely NAMES an escape is ALLOWED. A guard with false
+#      positives gets switched off, which is worse than no guard at all.
+#   B  the REAL hook, driven end to end with a real payload on stdin. A
+#      matcher-only table stays green while the hook is broken (a wrong jq
+#      path, a missing tool_name guard, malformed deny JSON), so at least one
+#      BLOCK and one allow go through the actual file.
+#   C  the RED PROOF. Gut the matcher and assert A goes red; neuter the hook
+#      (ECC_DISABLED_HOOKS) and assert B goes red. A checker that stays green
+#      against a gutted subject proves nothing — the same argument
+#      govern-claims-check.sh makes when it stubs _gv_alive.
+#
+# Exits non-zero on any failure. Touches nothing outside a temp dir.
+# Test-case strings deliberately avoid absolute monorepo paths: this script is
+# classified `portable` in factory-repo.sh's manifest, and --check-portability
+# greps the file CONTENTS for them.
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+MATCH="${GOV_MATCH_FILE:-$ROOT/.claude/hooks/lib/governor-escape-match.sh}"
+HOOK="$ROOT/.claude/hooks/governor-escape.sh"
+# shellcheck source=/dev/null
+. "$MATCH"
+
+# A stray ECC_DISABLED_HOOKS in the operator's environment would neuter part B
+# and read as a red. Clear it for the real run; part C sets it explicitly on the
+# child it wants neutered.
+[ -z "${GOV_CHECK_INNER:-}" ] && unset ECC_DISABLED_HOOKS
+
+bad=0
+ok()   { printf '  ok    %s\n' "$*"; }
+nope() { printf '  FAIL  %s\n' "$*"; bad=$((bad + 1)); }
+
+# ---------------------------------------------------------------------------
+# A — the matcher
+# ---------------------------------------------------------------------------
+m_check() { # m_check <BLOCK|allow> <label> <command>
+  local want="$1" label="$2" cmd="$3" kind
+  kind="$(gov_escape_kind "$cmd")"
+  local got="allow"; [ -n "$kind" ] && got="BLOCK"
+  if [ "$got" = "$want" ]; then ok "$want  $label${kind:+  [$kind]}"
+  else nope "$want expected, got $got  —  $label"; fi
+}
+
+part_a() {
+  echo "== A. matcher — escapes must BLOCK"
+  m_check BLOCK 'bun run test:raw'            'cd web && bun run test:raw'
+  m_check BLOCK 'bun run verify:raw'          'bun run verify:raw'
+  m_check BLOCK 'bunx vitest run <file>'      'bunx vitest run tests/unit/foo.test.ts'
+  m_check BLOCK 'npx vitest'                  'npx vitest'
+  m_check BLOCK 'bare vitest run'             'vitest run'
+  m_check BLOCK 'path-invoked vitest'         'node_modules/.bin/vitest run'
+  m_check BLOCK 'vitest after an operator'    'echo starting; bunx vitest run'
+  m_check BLOCK 'GOVERN_DISABLE in front'     'GOVERN_DISABLE=1 bun run verify'
+  m_check BLOCK 'CI=1 in front'               'CI=1 bunx vitest run'
+  m_check BLOCK 'env bypass beats gate-run'   'GOVERN_DISABLE=1 bash .claude/scripts/gate-run.sh verify -- bun run verify'
+
+  echo "== A. matcher — merely NAMING an escape must be allowed"
+  m_check allow 'the governed form'           'bash .claude/scripts/gate-run.sh test -- bunx vitest run tests/unit/foo.test.ts'
+  m_check allow 'governed package script'     'cd web && bun run verify'
+  m_check allow 'the dev lane'                'cd web && bun run verify:fast'
+  m_check allow 'a commit message'            "git commit -m 'fix: bun run test:raw is the escape hatch'"
+  m_check allow 'grepping for it'             'grep -rn "verify:raw" web/package.json'
+  m_check allow 'reading package.json'        "sed -n '47,48p' web/package.json"
+  m_check allow 'reading the vitest config'   'cat web/vitest.config.ts'
+  m_check allow 'echoing the override'        'echo "GOVERN_DISABLE=1 bun run verify is the override"'
+  m_check allow 'env bypass, but no gate'     'GOVERN_DISABLE=1 ls -la'
+  m_check allow 'CI=1 on a non-gate'          'CI=1 bun run build'
+  m_check allow 'reading the hook itself'     'cat .claude/hooks/governor-escape.sh'
+  m_check allow 'tsc is out of scope'         'bunx tsc --noEmit'
+  # THE FALSE POSITIVE THAT ALREADY BIT SOMEONE. hook:load-guard REFUSES this
+  # command: the `|` INSIDE the quoted regex is a shell-operator position as
+  # far as a position-anchored pattern is concerned, and what follows it is
+  # `tsc --noEmit'` -- which load-guard.sh:57 matches as a bare alternative.
+  # Reading `ps` is not running a gate. This guard cannot reproduce it: the
+  # vitest rule needs the literal word `vitest` at that position, and tsc is
+  # deliberately out of scope -- so the scope decision is load-bearing, not
+  # incidental.
+  m_check allow 'ps piped into grep'          "ps -Ao rss,command | grep -E 'vitest|tsc --noEmit'"
+  m_check allow 'ps grep, vitest first'       "ps -Ao command | grep -E 'vitest|astro check'"
+  m_check allow 'pgrep for a runner'          'pgrep -fl vitest'
+  # The heredoc case. `grep -E` anchors ^ per LINE, so a doc BODY quoting an
+  # escape would match without _gov_strip_heredocs. Writing about the escape is
+  # the most innocent act there is.
+  m_check allow 'heredoc body quoting it'     "$(printf '%s\n' \
+    "cat > notes.md <<'EOF'" \
+    'bun run test:raw is the ungoverned lane' \
+    'GOVERN_DISABLE=1 bun run verify bypasses the cap' \
+    'EOF')"
+}
+
+# ---------------------------------------------------------------------------
+# B — the real hook, end to end
+# ---------------------------------------------------------------------------
+h_deny() { # h_deny <command>  -> prints "deny" or "allow"
+  local payload out
+  payload="$(jq -nc --arg c "$1" --arg d "$ROOT" \
+    '{tool_name:"Bash",cwd:$d,tool_input:{command:$c}}')"
+  out="$(printf '%s' "$payload" | CLAUDE_PROJECT_DIR="$ROOT" bash "$HOOK" 2>&1)"
+  case "$out" in *'"permissionDecision":"deny"'*) printf 'deny' ;; *) printf 'allow' ;; esac
+}
+
+part_b() {
+  echo "== B. the hook itself, driven with a real payload"
+  local got
+  got="$(h_deny 'cd web && bun run test:raw')"
+  [ "$got" = "deny" ] && ok "hook DENIES  bun run test:raw" \
+                      || nope "hook did not deny  bun run test:raw  (got $got)"
+  got="$(h_deny 'GOVERN_DISABLE=1 bun run verify')"
+  [ "$got" = "deny" ] && ok "hook DENIES  GOVERN_DISABLE=1 bun run verify" \
+                      || nope "hook did not deny the env bypass  (got $got)"
+  got="$(h_deny "git commit -m 'fix: bun run test:raw is the escape hatch'")"
+  [ "$got" = "allow" ] && ok "hook ALLOWS a commit message that quotes it" \
+                       || nope "hook denied an innocent commit message — FALSE POSITIVE"
+  got="$(h_deny 'bash .claude/scripts/gate-run.sh test -- bunx vitest run tests/unit/foo.test.ts')"
+  [ "$got" = "allow" ] && ok "hook ALLOWS the governed form" \
+                       || nope "hook denied the governed form (got $got)"
+
+  # The documented human override must actually work, or nobody can get past it.
+  local payload out
+  payload="$(jq -nc --arg c 'bun run test:raw' --arg d "$ROOT" \
+    '{tool_name:"Bash",cwd:$d,tool_input:{command:$c}}')"
+  out="$(printf '%s' "$payload" | CLAUDE_PROJECT_DIR="$ROOT" \
+        ECC_DISABLED_HOOKS=hook:governor-escape bash "$HOOK" 2>&1)"
+  case "$out" in
+    *'"permissionDecision":"deny"'*) nope "ECC_DISABLED_HOOKS=hook:governor-escape did NOT disable it" ;;
+    *) ok "ECC_DISABLED_HOOKS=hook:governor-escape releases it (the human override)" ;;
+  esac
+}
+
+# ---------------------------------------------------------------------------
+# C — the red proof
+# ---------------------------------------------------------------------------
+part_c() {
+  echo "== C. red proof — gut the subject, the checks must go RED"
+  local tmp; tmp="$(mktemp -d)"
+  trap 'rm -rf "$tmp"' EXIT
+
+  # C1 — a matcher that never matches. If part A still passes, part A is theatre.
+  { cat "$MATCH"; printf '\ngov_escape_kind() { return 1; }\n'; } > "$tmp/stub.sh"
+  if GOV_CHECK_INNER=matcher GOV_MATCH_FILE="$tmp/stub.sh" \
+       bash "${BASH_SOURCE[0]}" >"$tmp/a.log" 2>&1; then
+    nope "matcher gutted to always-allow and part A STILL PASSED"
+  else
+    ok "matcher gutted -> part A goes red ($(grep -c '^  FAIL' "$tmp/a.log") failures)"
+  fi
+
+  # C2 — a hook that cannot deny. If part B still passes, part B is theatre.
+  if GOV_CHECK_INNER=hook ECC_DISABLED_HOOKS=hook:governor-escape \
+       bash "${BASH_SOURCE[0]}" >"$tmp/b.log" 2>&1; then
+    nope "hook disabled and part B STILL PASSED"
+  else
+    ok "hook disabled -> part B goes red ($(grep -c '^  FAIL' "$tmp/b.log") failures)"
+  fi
+}
+
+case "${GOV_CHECK_INNER:-}" in
+  matcher) part_a ;;
+  hook)    part_b ;;
+  *)       part_a; echo; part_b; echo; part_c ;;
+esac
+
+echo
+if [ "$bad" -eq 0 ]; then echo "RESULT: PASS — the guard bites, and it does not bite the innocent"
+else echo "RESULT: RED — $bad failure(s)"; exit 1; fi

package/scripts/land.sh

@@ -0,0 +1,193 @@
+#!/usr/bin/env bash
+# land.sh — a finished fleet branch to dev.one.ie in one command.
+#
+#   bash .claude/scripts/land.sh feat/campaign-one
+#   bash .claude/scripts/land.sh feat/campaign-one --deploy   # also ship dev
+#   bash .claude/scripts/land.sh feat/x --quick               # tsc only, for a saturated box
+#   bash .claude/scripts/land.sh feat/x feat/y --deploy        # several, in order
+#
+# WHY THIS EXISTS: a fleet finishing is not the same as work landing. The branch
+# still has to survive the trunk — a branch that was 12/12 green on its own can
+# go red the moment it meets main, because main moved. That merge-then-gate step
+# was being done by hand, once per fleet, and it is the slow part.
+#
+# THE ORDER IS THE POINT:
+#   1  merge main INTO the branch, in the branch's own worktree     (cheap, isolated)
+#   2  run the FAST gate there                                      (the dev-tier gate)
+#   3  only then fast-forward main                                  (main never breaks)
+#   4  optionally ./deploy dev                                      (fast lane again)
+# Merging main into the branch first means a conflict or a red gate is discovered
+# on the BRANCH, where it costs nothing, instead of on main, where every other
+# fleet inherits it.
+#
+# What it will NOT do: touch production. Promotion to one.ie is `./deploy`, a
+# full gate and a human decision. A fast pass is never reported as a full pass.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT" || exit 1
+
+DEPLOY=0 DRY=0 QUICK=0 BRANCHES=()
+for a in "$@"; do
+  case "$a" in
+    --deploy) DEPLOY=1 ;;
+    --quick) QUICK=1 ;;
+    -n|--dry-run) DRY=1 ;;
+    -h|--help) sed -n '2,30p' "${BASH_SOURCE[0]}"; exit 0 ;;
+    -*) echo "land.sh: unknown flag '$a'" >&2; exit 2 ;;
+    *) BRANCHES+=("$a") ;;
+  esac
+done
+(( ${#BRANCHES[@]} )) || { echo "land.sh: name at least one branch" >&2; exit 2; }
+
+GRN=$'\033[32m'; RED=$'\033[31m'; YEL=$'\033[33m'; DIM=$'\033[2m'; OFF=$'\033[0m'
+[[ -t 1 ]] || { GRN=""; RED=""; YEL=""; DIM=""; OFF=""; }
+say()  { printf '%s\n' "$*"; }
+step() { printf '\n%s══ %s%s\n' "$DIM" "$*" "$OFF"; }
+ok()   { printf '%s  ✓%s %s\n' "$GRN" "$OFF" "$*"; }
+bad()  { printf '%s  ✗%s %s\n' "$RED" "$OFF" "$*"; }
+warn() { printf '%s  !%s %s\n' "$YEL" "$OFF" "$*"; }
+
+# The worktree that holds a branch — a fleet branch lives in one, and gating
+# there keeps the shared main tree free for the next fleet.
+worktree_of() {
+  git worktree list --porcelain \
+    | awk -v b="refs/heads/$1" '/^worktree /{w=$2} /^branch /{if ($2==b) print w}' \
+    | head -1
+}
+
+LANDED=() FAILED=() LANDED_QUICK=0
+
+for br in "${BRANCHES[@]}"; do
+  step "land $br"
+
+  git show-ref --verify --quiet "refs/heads/$br" || { bad "no such branch"; FAILED+=("$br: missing"); continue; }
+
+  wt="$(worktree_of "$br")"
+  if [[ -z "$wt" ]]; then
+    wt="$ROOT/.land-worktrees/${br//\//-}"
+    if (( DRY )); then say "  [dry] git worktree add $wt $br"
+    else
+      git worktree add "$wt" "$br" >/dev/null 2>&1 || { bad "could not check out $br"; FAILED+=("$br: checkout"); continue; }
+    fi
+  fi
+  say "  worktree: $wt"
+
+  # 1 — main INTO the branch. A conflict surfaces here, not on main.
+  if (( DRY )); then say "  [dry] (cd $wt && git merge main)"
+  else
+    if ! ( cd "$wt" && git merge --no-edit main >/dev/null 2>&1 ); then
+      bad "merge conflict with main — resolve in $wt"
+      ( cd "$wt" && git merge --abort >/dev/null 2>&1 )
+      FAILED+=("$br: conflict"); continue
+    fi
+    ok "merged main into $br"
+  fi
+
+  # 1.5 — the worktree SDK trap. A fleet worktree has no packages/sdk/node_modules,
+  # so `verify:fast`'s first step (sdk build) dies on missing @noble/@scure types —
+  # reported as a RED gate when nothing is wrong with the code. `bun install` here
+  # is NOT the fix: it re-points main's one.ie/web/node_modules/@oneie/sdk at this
+  # worktree's dist-less SDK and breaks the shared tree. A symlink to main's
+  # already-installed deps is read-only reuse and costs nothing.
+  if [[ -d "$wt/packages/sdk" && ! -e "$wt/packages/sdk/node_modules" && -d "$ROOT/packages/sdk/node_modules" ]]; then
+    if (( DRY )); then say "  [dry] ln -s $ROOT/packages/sdk/node_modules $wt/packages/sdk/node_modules"
+    else ln -s "$ROOT/packages/sdk/node_modules" "$wt/packages/sdk/node_modules" && ok "linked sdk node_modules (no bun install — that clobbers main)"
+    fi
+  fi
+
+  # 1.55 — web node_modules. A fresh land worktree has none; tsc then fails
+  # `File 'astro/tsconfigs/strict' not found`. Same rule as sdk: symlink main.
+  if [[ -d "$ROOT/one.ie/web/node_modules/astro/tsconfigs" ]]; then
+    webnm="$wt/one.ie/web/node_modules"
+    if [[ ! -e "$webnm" ]]; then
+      if (( DRY )); then say "  [dry] ln -s $ROOT/one.ie/web/node_modules $webnm"
+      else ln -s "$ROOT/one.ie/web/node_modules" "$webnm" && ok "linked web node_modules"
+      fi
+    elif [[ ! -e "$webnm/astro/tsconfigs/strict.json" ]]; then
+      if (( DRY )); then say "  [dry] replace incomplete $webnm with main's"
+      else
+        rm -rf "$webnm"
+        ln -s "$ROOT/one.ie/web/node_modules" "$webnm" && ok "replaced incomplete web node_modules with main's"
+      fi
+    fi
+  fi
+
+  # 1.56 — fleets.json is gitignored generated output. tsc imports it; a worktree
+  # that never ran `gen:fleets` fails TS2307 and the land reads as a red gate.
+  if [[ -f "$ROOT/one.ie/web/src/data/fleets.json" && ! -e "$wt/one.ie/web/src/data/fleets.json" ]]; then
+    if (( DRY )); then say "  [dry] ln fleets.json"
+    else ln -s "$ROOT/one.ie/web/src/data/fleets.json" "$wt/one.ie/web/src/data/fleets.json" && ok "linked fleets.json"
+    fi
+  fi
+
+  # 1.6 — the same gap, one layer up: a worktree has no one.ie/web/.env, so
+  # GATEWAY_API_KEY is unset and every real-substrate suite SKIPS. A skipped suite
+  # is NOT a passing suite — the gate would go green having never run the substrate
+  # paths, which is worse than red. Link main's .env so the gate means what it says.
+  for envf in one.ie/web/.env channels/.env; do
+    if [[ -f "$ROOT/$envf" && ! -e "$wt/$envf" ]]; then
+      if (( DRY )); then say "  [dry] ln -s $ROOT/$envf $wt/$envf"
+      else ln -s "$ROOT/$envf" "$wt/$envf" && ok "linked $envf (else substrate suites silently skip)"
+      fi
+    fi
+  done
+
+  # 2 — the fast gate, in the branch's worktree, through the governor.
+  if (( DRY )); then
+    (( QUICK )) && say "  [dry] (cd $wt/one.ie/web && npx tsc --noEmit)   # --quick" \
+                || say "  [dry] (cd $wt/one.ie/web && bun run verify:fast)"
+  else
+    if (( QUICK )); then
+      # --quick: tsc only. It catches type breaks, renames and dead imports —
+      # which is most of what a fleet gets wrong — and nothing else. It does NOT
+      # catch a logic regression, and it is NOT the fast lane: verify:fast also
+      # runs the tests related to the diff plus the pinned config/parity gates
+      # that import nothing from what they guard. Use it to move a queue when the
+      # box is saturated; never as the last gate before production.
+      warn "gate: TYPECHECK ONLY (--quick) — weaker than the fast lane, never a full pass"
+      if ! ( cd "$wt/one.ie/web" && bash "$ROOT/.claude/scripts/gate-run.sh" quicktsc -- npx tsc --noEmit ); then
+        bad "typecheck RED on $br — not landing it"
+        FAILED+=("$br: tsc red"); continue
+      fi
+      ok "typecheck green (tests NOT run)"
+      LANDED_QUICK=1
+    else
+    say "  gate: FAST LANE (not a full pass)"
+    if ! ( cd "$wt/one.ie/web" && bun run verify:fast ); then
+      bad "fast gate RED on $br — not landing it"
+      FAILED+=("$br: gate red"); continue
+    fi
+    ok "fast gate green"
+    fi
+  fi
+
+  # 3 — fast-forward main only. A non-ff means main moved under us: re-run.
+  if (( DRY )); then say "  [dry] git merge --ff-only $br"
+  else
+    if ! git merge --ff-only "$br" >/dev/null 2>&1; then
+      warn "main moved — re-run land.sh for $br"
+      FAILED+=("$br: main moved"); continue
+    fi
+    ok "main fast-forwarded to $br"
+  fi
+
+  LANDED+=("$br")
+done
+
+# 4 — one dev deploy for the whole batch, not one per branch.
+if (( DEPLOY )) && (( ${#LANDED[@]} )); then
+  step "deploy dev"
+  if (( DRY )); then say "  [dry] bash .claude/scripts/deploy.sh dev"
+  else
+    bash "$ROOT/.claude/scripts/deploy.sh" dev || { bad "dev deploy failed"; FAILED+=("deploy"); }
+  fi
+fi
+
+step "report"
+(( ${#LANDED[@]} )) && ok "landed: ${LANDED[*]}"
+(( LANDED_QUICK )) && warn "typecheck-only gate was used — run the full suite before ./deploy to production"
+(( ${#FAILED[@]} )) && bad "failed: ${FAILED[*]}"
+(( ${#FAILED[@]} )) && exit 1
+say ""
+say "  dev only. Promote to production with: ./deploy   (full gate, human decision)"
+exit 0