@oneie/claude 0.6.0 → 0.8.0

package/scripts/orphan-modules.mjs

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+/**
+ * orphan-modules.mjs — every module under src/ must be reachable from something
+ * that is not a test.
+ *
+ * WHY THIS EXISTS. On 2026-08-26 an audit found that `693ba76b4` ("land nine
+ * fleets' work") took 35 of 70 files — keeping 12/19 tests but only 10/40
+ * source. Two failure modes came out of it:
+ *
+ *   dropped CALLEE  -> red test          visible, three suites caught it
+ *   dropped CALLER  -> green test, dead  INVISIBLE to every gate that existed
+ *
+ * The second is what this catches. `foundation/derive.ts`, `executor.ts` and
+ * `execute-skill.ts` all landed, all have passing tests, and NOTHING in src/
+ * imports any of them — their only caller was dropped. The suite went green
+ * over a dead feature. Measured: the test suite caught roughly a TENTH of the
+ * 28 missing files.
+ *
+ * The tempting check is test-import-integrity. The data refutes it: it misses
+ * the wallet case (master-wiring reads source as TEXT, so there are no imports
+ * to resolve) and it misses the foundation case (those imports resolve fine).
+ * Reachability is the property that actually distinguishes live from dead.
+ *
+ * SUBSTRING MATCHING IS NOT ENOUGH and was the first thing tried — grepping for
+ * `derive` matched 216 files. This resolves real import specifiers.
+ *
+ *   node .claude/scripts/orphan-modules.mjs            # report orphans
+ *   node .claude/scripts/orphan-modules.mjs --check     # exit 1 if any
+ *   node .claude/scripts/orphan-modules.mjs --check-red # prove it can fail
+ */
+import { readFileSync, readdirSync, statSync, existsSync, writeFileSync, mkdtempSync, rmSync, mkdirSync } from 'node:fs'
+import { join, resolve, dirname, relative, extname } from 'node:path'
+import { tmpdir } from 'node:os'
+
+const MODE = process.argv[2] ?? ''
+
+// Entry points are reached by the FRAMEWORK, not by an import, so an
+// un-imported one is correct rather than orphaned. Getting this list wrong in
+// the permissive direction hides real orphans; wrong in the strict direction
+// produces noise nobody will read. Keep it narrow and justified.
+const ENTRY = [
+  /^src\/pages\//,          // Astro routes + API routes
+  /^src\/middleware\.ts$/,  // Astro middleware
+  /^src\/workers\//,        // CF worker entry points
+  /^src\/env\.d\.ts$/,
+  /^src\/types\//,          // ambient/type-only, erased at runtime
+  /^src\/content\//,        // content collections
+  /^src\/styles\//,
+]
+const SRC_EXT = new Set(['.ts', '.tsx', '.astro', '.mjs'])
+
+function walk(dir, out = []) {
+  for (const e of readdirSync(dir)) {
+    if (e === 'node_modules' || e === 'dist' || e.startsWith('.')) continue
+    const p = join(dir, e)
+    if (statSync(p).isDirectory()) walk(p, out)
+    else if (SRC_EXT.has(extname(e))) out.push(p)
+  }
+  return out
+}
+
+// Import specifiers: static imports, `export ... from`, dynamic import(), and
+// Astro frontmatter (which is just TS between the fences).
+const SPEC_RE = /(?:import|export)\s[^;]*?from\s*['"]([^'"]+)['"]|import\s*\(\s*['"]([^'"]+)['"]\s*\)|import\s*['"]([^'"]+)['"]/g
+
+function specifiersOf(file) {
+  const src = readFileSync(file, 'utf8')
+  const out = []
+  for (const m of src.matchAll(SPEC_RE)) out.push(m[1] ?? m[2] ?? m[3])
+  return out.filter(Boolean)
+}
+
+/** Resolve a specifier to a real file, honouring the `@/` alias and extensionless imports. */
+function resolveSpec(spec, fromFile, root) {
+  let base
+  if (spec.startsWith('@/')) base = join(root, 'src', spec.slice(2))
+  else if (spec.startsWith('.')) base = resolve(dirname(fromFile), spec)
+  else return null // bare package
+  // TS lets you write .js for a .ts file
+  const stripped = base.replace(/\.js$/, '')
+  for (const c of [base, stripped,
+                   ...['.ts', '.tsx', '.astro', '.mjs'].flatMap(e => [stripped + e, join(stripped, 'index' + e)])]) {
+    if (existsSync(c) && statSync(c).isFile()) return c
+  }
+  return null
+}
+
+function analyse(root) {
+  const files = walk(join(root, 'src'))
+  const rel = f => relative(root, f).split('\\').join('/')
+  const isTest = f => /\.(test|spec)\.[tj]sx?$/.test(f) || rel(f).includes('/tests/')
+  const isEntry = f => ENTRY.some(re => re.test(rel(f)))
+
+  // Reached by a NON-TEST file. A module imported only by its own test is
+  // exactly the dead-feature shape, so tests must not count as reachability.
+  const reached = new Set()
+  for (const f of files) {
+    if (isTest(f)) continue
+    for (const s of specifiersOf(f)) {
+      const t = resolveSpec(s, f, root)
+      if (t && t !== f) reached.add(t)
+    }
+  }
+  const orphans = files.filter(f => !isTest(f) && !isEntry(f) && !reached.has(f)).map(rel).sort()
+  return { total: files.length, orphans }
+}
+
+// ── --check-red: prove the checker can fail ──────────────────────────────────
+// A checker you have only ever seen pass is not evidence (doctrine: prove RED).
+if (MODE === '--check-red') {
+  const tmp = mkdtempSync(join(tmpdir(), 'orphan-red-'))
+  try {
+    const s = join(tmp, 'src')
+    for (const d of ['lib', 'pages']) mkdirSync(join(s, d), { recursive: true })
+    writeFileSync(join(s, 'lib', 'used.ts'), 'export const a = 1\n')
+    writeFileSync(join(s, 'lib', 'orphan.ts'), 'export const b = 2\n')
+    writeFileSync(join(s, 'pages', 'index.astro'), '---\nimport { a } from "@/lib/used"\n---\n<p>{a}</p>\n')
+    let fails = 0
+    const r1 = analyse(tmp)
+    if (r1.orphans.includes('src/lib/orphan.ts')) console.log('  arm orphan present     caught')
+    else { console.log('  arm orphan present     MISSED'); fails++ }
+    if (!r1.orphans.includes('src/lib/used.ts')) console.log('  arm used module        not flagged (correct)')
+    else { console.log('  arm used module        FALSE POSITIVE'); fails++ }
+    if (!r1.orphans.includes('src/pages/index.astro')) console.log('  arm entry point        exempt (correct)')
+    else { console.log('  arm entry point        FALSE POSITIVE'); fails++ }
+    // a module imported ONLY by a test is still an orphan — the whole point
+    writeFileSync(join(s, 'lib', 'testonly.ts'), 'export const c = 3\n')
+    mkdirSync(join(tmp, 'tests'), { recursive: true })
+    writeFileSync(join(tmp, 'tests', 'x.test.ts'), 'import { c } from "@/lib/testonly"\n')
+    const r2 = analyse(tmp)
+    if (r2.orphans.includes('src/lib/testonly.ts')) console.log('  arm test-only import   caught (the dead-feature shape)')
+    else { console.log('  arm test-only import   MISSED — this is the shape it exists for'); fails++ }
+    console.log(fails === 0
+      ? 'check-red: all four arms behaved — the checker CAN go red, and does not cry wolf'
+      : `check-red: ${fails} assertion(s) failed`)
+    process.exit(fails === 0 ? 0 : 1)
+  } finally { rmSync(tmp, { recursive: true, force: true }) }
+}
+
+const root = resolve(process.argv.includes('--root')
+  ? process.argv[process.argv.indexOf('--root') + 1]
+  : join(dirname(new URL(import.meta.url).pathname), '..', '..', 'one.ie', 'web'))
+
+if (!existsSync(join(root, 'src'))) {
+  console.error(`orphan-modules: no src/ at ${root} — this is UNMEASURED, not ok`)
+  process.exit(2)
+}
+
+const { total, orphans } = analyse(root)
+console.log(`orphan-modules: ${total} files scanned, ${orphans.length} orphan(s)`)
+for (const o of orphans) console.log(`  ${o}`)
+// A RATCHET, not a hard gate. 178 orphans exist today and some are reached in
+// ways this resolver cannot see (a registry map, a Puck block table, a string
+// key). Gating on zero would cry wolf on day one and be muted by day three.
+// Gating on "no NEW orphan" is the same monotonic shape /do already runs: the
+// count can only fall. That is what catches the next dropped caller.
+const BASELINE = join(dirname(new URL(import.meta.url).pathname), 'orphan-baseline.json')
+if (MODE === '--check') {
+  let base = { count: Infinity, files: [] }
+  if (existsSync(BASELINE)) base = JSON.parse(readFileSync(BASELINE, 'utf8'))
+  const known = new Set(base.files ?? [])
+  const fresh = orphans.filter(o => !known.has(o))
+  if (fresh.length) {
+    console.log(`\nRED — ${fresh.length} NEW orphan(s) since the baseline:`)
+    for (const f of fresh) console.log(`  + ${f}`)
+    console.log('\nA new orphan means a module landed with no caller — the shape that')
+    console.log('dropped 28 files on 2026-08-26 and showed GREEN the whole time.')
+    console.log('Wire it, delete it, or add it to ENTRY with a reason.')
+    process.exit(1)
+  }
+  if (orphans.length < base.count) {
+    console.log(`ratchet ROSE: ${base.count} -> ${orphans.length}. Re-baseline with --baseline.`)
+  }
+  console.log(`ok — no new orphans (baseline ${base.count})`)
+}
+if (MODE === '--baseline') {
+  writeFileSync(BASELINE, JSON.stringify({ count: orphans.length, files: orphans, at: new Date().toISOString().slice(0,10) }, null, 2) + '\n')
+  console.log(`baseline written: ${orphans.length} orphan(s)`)
+}

package/scripts/outcome-pull.ts

@@ -0,0 +1,279 @@
+#!/usr/bin/env bun
+/**
+ * outcome-pull.ts — pull production path weights into text/task-paths.json's `prod`
+ * field, provenance-tagged, never touching the local `strength`/`resistance`/`closed`
+ * fields `--mark`/`--sync-closes` own (do-rank.py). Part of text/self-improving-outcome.md.
+ *
+ * Reads LOCAL D1 only (`one-owners`, mirrored from prod by `bun run db:sync` — see
+ * hook:db-sync in .claude/settings.json, which runs this script right after). Never
+ * touches the network directly — do-rank.py's zero-network invariant is preserved by
+ * construction: this script is the only one that shells out, and only to local wrangler.
+ *
+ * Three prod sources, three mappers (text/self-improving-outcome-plan.md § Evidence):
+ *   1. a settled promise         — claw_paths  source="promise:<slug>" target="proof"
+ *   2. a /do cycle that closed   — entity_tags  tags ⊇ ["do:learn","slug:<slug>"]
+ *   3. a graded delivery         — claw_paths  source="tag:<board>:slug:<slug>"
+ * `shape→model` do-event marks are deliberately NOT mapped — verified slug-free.
+ *
+ * Usage:
+ *   bun .claude/scripts/outcome-pull.ts             # pull local D1 → text/task-paths.json
+ *   bun .claude/scripts/outcome-pull.ts --selftest   # offline fixture proof, no D1/network
+ */
+import { readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+
+const ROOT = join(dirname(new URL(import.meta.url).pathname), '..', '..')
+const WEB_DIR = join(ROOT, 'one.ie', 'web')
+const TASK_PATHS = join(ROOT, 'text', 'task-paths.json')
+const D1_BIN = process.env.D1_BIN ?? 'one-owners'
+
+export interface ClawPathRow {
+  source: string
+  target: string
+  strength: number
+  resistance: number
+  traversals: number
+}
+
+export interface EntityTagRow {
+  entity_id: string
+  tags: string // JSON array string, e.g. '["do:learn","slug:foo"]'
+}
+
+export interface MappedOutcome {
+  slug: string
+  strength: number
+  resistance: number
+  traversals: number
+  source: string
+}
+
+// ─── the three pure mappers (fixture-tested by --selftest) ─────────────────
+
+export function mapPromiseProof(row: ClawPathRow): MappedOutcome | null {
+  const m = /^promise:(.+)$/.exec(row.source)
+  if (!m || row.target !== 'proof') return null
+  return { slug: m[1]!, strength: row.strength, resistance: row.resistance, traversals: row.traversals, source: 'promise:proof' }
+}
+
+export function mapDoEventLearn(row: EntityTagRow): MappedOutcome | null {
+  let tags: unknown
+  try {
+    tags = JSON.parse(row.tags)
+  } catch {
+    return null
+  }
+  if (!Array.isArray(tags)) return null
+  const has = (t: string) => tags.includes(t)
+  if (!has('do:learn')) return null
+  const slugTag = tags.find((t): t is string => typeof t === 'string' && t.startsWith('slug:'))
+  if (!slugTag) return null
+  // Presence of a prod-recorded close is the signal — the composite score embedded in
+  // doEventTitle's display text is UI prose, not a stable machine field (plan § Decisions).
+  return { slug: slugTag.slice('slug:'.length), strength: 0.5, resistance: 0, traversals: 1, source: 'do:learn' }
+}
+
+export function mapWorldOutcome(row: ClawPathRow): MappedOutcome | null {
+  const m = /^tag:[^:]+:slug:(.+)$/.exec(row.source)
+  if (!m) return null
+  return { slug: m[1]!, strength: row.strength, resistance: row.resistance, traversals: row.traversals, source: 'world:outcome' }
+}
+
+// ─── the merge law: `prod` is a full overwrite per pull, local fields untouched ────
+
+type TaskPaths = Record<string, Record<string, unknown>>
+
+export function mergeIntoTaskPaths(existing: TaskPaths, mapped: MappedOutcome[], pulledAt: string): TaskPaths {
+  const out: TaskPaths = JSON.parse(JSON.stringify(existing))
+  const bySlug = new Map<string, { strength: number; resistance: number; traversals: number; sources: Set<string> }>()
+  for (const m of mapped) {
+    const acc = bySlug.get(m.slug) ?? { strength: 0, resistance: 0, traversals: 0, sources: new Set<string>() }
+    acc.strength += m.strength
+    acc.resistance += m.resistance
+    acc.traversals += m.traversals
+    acc.sources.add(m.source)
+    bySlug.set(m.slug, acc)
+  }
+  for (const [slug, acc] of bySlug) {
+    const key = `task:${slug}`
+    const entry = out[key] ?? { closed: 0, strength: 0, resistance: 0, traversals: 0 }
+    entry.prod = {
+      strength: round3(acc.strength),
+      resistance: round3(acc.resistance),
+      traversals: acc.traversals,
+      sources: [...acc.sources].sort(),
+      pulled_at: pulledAt,
+    }
+    out[key] = entry
+  }
+  return out
+}
+
+function round3(n: number): number {
+  return Math.round(n * 1000) / 1000
+}
+
+// ─── local D1 read (never network — reads the mirror db:sync already wrote) ────
+
+async function d1Query(sql: string): Promise<Array<Record<string, unknown>>> {
+  const proc = Bun.spawn(
+    ['bunx', 'wrangler', 'd1', 'execute', D1_BIN, '--local', '--json', '--command', sql],
+    { cwd: WEB_DIR, stdout: 'pipe', stderr: 'pipe' },
+  )
+  const out = await new Response(proc.stdout).text()
+  if ((await proc.exited) !== 0) throw new Error(`d1 execute failed: ${await new Response(proc.stderr).text()}`)
+  const parsed = JSON.parse(out)
+  return (parsed?.[0]?.results ?? []) as Array<Record<string, unknown>>
+}
+
+async function pull(): Promise<void> {
+  let mapped: MappedOutcome[] = []
+  try {
+    const promiseRows = (await d1Query(
+      `SELECT source, target, strength, resistance, traversals FROM claw_paths WHERE source LIKE 'promise:%' AND target = 'proof'`,
+    )) as unknown as ClawPathRow[]
+    const outcomeRows = (await d1Query(
+      `SELECT source, target, strength, resistance, traversals FROM claw_paths WHERE source LIKE 'tag:%:slug:%'`,
+    )) as unknown as ClawPathRow[]
+    const learnRows = (await d1Query(
+      `SELECT entity_id, tags FROM entity_tags WHERE tags LIKE '%"do:learn"%' AND tags LIKE '%"slug:%'`,
+    )) as unknown as EntityTagRow[]
+    mapped = [
+      ...promiseRows.map(mapPromiseProof),
+      ...outcomeRows.map(mapWorldOutcome),
+      ...learnRows.map(mapDoEventLearn),
+    ].filter((m): m is MappedOutcome => m !== null)
+  } catch (err) {
+    // Best-effort — matches hook:db-sync's own posture (session start must never block
+    // on an offline/unreachable local D1). No crash, no partial write.
+    console.error(`[outcome-pull] local D1 unreachable, skipping: ${(err as Error).message}`)
+    return
+  }
+  const existing: TaskPaths = existsSync(TASK_PATHS) ? JSON.parse(readFileSync(TASK_PATHS, 'utf8')) : {}
+  const merged = mergeIntoTaskPaths(existing, mapped, new Date().toISOString())
+  writeFileSync(TASK_PATHS, JSON.stringify(sortKeys(merged), null, 2) + '\n')
+  console.log(`[outcome-pull] merged prod outcomes for ${new Set(mapped.map((m) => m.slug)).size} slug(s) from ${mapped.length} row(s)`)
+}
+
+// Recursive — matches do-rank.py's `json.dumps(sort_keys=True)`, which sorts every nested
+// level. A top-level-only sort would make the two writers emit different byte order for
+// the same data (nested `prod`/etc. keys), causing spurious diffs on every session.
+function sortKeys<T>(value: T): T {
+  if (Array.isArray(value)) return value.map(sortKeys) as unknown as T
+  if (value !== null && typeof value === 'object') {
+    const out: Record<string, unknown> = {}
+    for (const k of Object.keys(value as Record<string, unknown>).sort()) {
+      out[k] = sortKeys((value as Record<string, unknown>)[k])
+    }
+    return out as T
+  }
+  return value
+}
+
+// ─── offline selftest — the only mode the promise's proof: runs ────────────
+
+function selftest(): void {
+  let pass = 0
+  let fail = 0
+  const check = (name: string, cond: boolean) => {
+    if (cond) {
+      pass++
+    } else {
+      fail++
+      console.error(`FAIL: ${name}`)
+    }
+  }
+
+  // 1. mapPromiseProof — direct slug extraction, rejects non-proof targets.
+  check(
+    'mapPromiseProof: extracts slug from promise:<slug>→proof',
+    mapPromiseProof({ source: 'promise:self-improving-outcome', target: 'proof', strength: 4, resistance: 0, traversals: 1 })?.slug === 'self-improving-outcome',
+  )
+  check(
+    'mapPromiseProof: rejects non-proof target',
+    mapPromiseProof({ source: 'promise:foo', target: 'other', strength: 1, resistance: 0, traversals: 1 }) === null,
+  )
+  check(
+    'mapPromiseProof: rejects non-promise source',
+    mapPromiseProof({ source: 'shape:foo', target: 'proof', strength: 1, resistance: 0, traversals: 1 }) === null,
+  )
+
+  // 2. mapDoEventLearn — requires BOTH do:learn and a slug: tag; ignores other stages.
+  check(
+    'mapDoEventLearn: extracts slug from a learn-tagged row',
+    mapDoEventLearn({ entity_id: 'conv:do-foo-c1', tags: JSON.stringify(['do:learn', 'do:cycle', 'tier:feature', 'slug:foo', 's:security']) })?.slug === 'foo',
+  )
+  check(
+    'mapDoEventLearn: rejects a non-learn stage (do:wave)',
+    mapDoEventLearn({ entity_id: 'conv:do-foo-c1', tags: JSON.stringify(['do:wave', 'slug:foo']) }) === null,
+  )
+  check(
+    'mapDoEventLearn: rejects a learn row with no slug tag',
+    mapDoEventLearn({ entity_id: 'conv:x', tags: JSON.stringify(['do:learn']) }) === null,
+  )
+  check(
+    'mapDoEventLearn: tolerates malformed tags JSON',
+    mapDoEventLearn({ entity_id: 'conv:x', tags: 'not-json' }) === null,
+  )
+
+  // 3. mapWorldOutcome — tag-node source, world:outcome's tagNode() shape.
+  check(
+    'mapWorldOutcome: extracts slug from tag:<board>:slug:<slug>',
+    mapWorldOutcome({ source: 'tag:acme:slug:foo', target: 'model:sonnet', strength: 1, resistance: 0, traversals: 1 })?.slug === 'foo',
+  )
+  check(
+    'mapWorldOutcome: rejects a shape→model row (verified slug-free, plan § Evidence)',
+    mapWorldOutcome({ source: 'shape:do:feature', target: 'model:sonnet', strength: 1, resistance: 0, traversals: 1 }) === null,
+  )
+  check(
+    'mapWorldOutcome: rejects a non-slug tag',
+    mapWorldOutcome({ source: 'tag:acme:vip', target: 'actor:x', strength: 1, resistance: 0, traversals: 1 }) === null,
+  )
+
+  // 4. mergeIntoTaskPaths — the merge law: outcome-weight (marked contributes, warned
+  //    contributes to resistance), provenance (sources tagged), idempotent re-pull,
+  //    and — the load-bearing one — LOCAL fields are never touched by a pull.
+  const local: TaskPaths = {
+    'task:foo': { closed: 1.2, strength: 0.4, resistance: 0.1, traversals: 3 },
+  }
+  const mapped: MappedOutcome[] = [
+    { slug: 'foo', strength: 2, resistance: 0, traversals: 1, source: 'promise:proof' },
+    { slug: 'foo', strength: 0.5, resistance: 0, traversals: 1, source: 'do:learn' },
+  ]
+  const merged = mergeIntoTaskPaths(local, mapped, '2026-07-08T00:00:00.000Z')
+  check('merge: prod.strength sums same-slug rows within one pull', (merged['task:foo'] as any).prod.strength === 2.5)
+  check('merge: prod.sources carries provenance for both mappers', JSON.stringify((merged['task:foo'] as any).prod.sources) === JSON.stringify(['do:learn', 'promise:proof']))
+  check('merge: LOCAL strength untouched by the pull', (merged['task:foo'] as any).strength === 0.4)
+  check('merge: LOCAL resistance untouched by the pull', (merged['task:foo'] as any).resistance === 0.1)
+  check('merge: LOCAL closed untouched by the pull', (merged['task:foo'] as any).closed === 1.2)
+
+  // merge law, other direction: a re-pull with different rows OVERWRITES prod, never adds.
+  const rePulled = mergeIntoTaskPaths(merged, [{ slug: 'foo', strength: 1, resistance: 0, traversals: 1, source: 'promise:proof' }], '2026-07-09T00:00:00.000Z')
+  check('merge: re-pull overwrites prod.strength, does not accumulate across pulls', (rePulled['task:foo'] as any).prod.strength === 1)
+  check(
+    'merge: two identical pulls are idempotent (byte-identical prod block)',
+    JSON.stringify(mergeIntoTaskPaths(local, mapped, 'T')['task:foo']) === JSON.stringify(mergeIntoTaskPaths(local, mapped, 'T')['task:foo']),
+  )
+
+  // warned outcome (resistance-only) — the "warned lowers rank" half of outcome-weight.
+  const warned = mergeIntoTaskPaths({}, [{ slug: 'bar', strength: 0, resistance: 2, traversals: 1, source: 'promise:proof' }], 'T')
+  check('merge: a warned outcome lands entirely in prod.resistance, not prod.strength', (warned['task:bar'] as any).prod.resistance === 2 && (warned['task:bar'] as any).prod.strength === 0)
+
+  // outcome-weight: a slug the world marked outranks an identical one the world warned —
+  // proven here at the merge layer (do-rank.py's own selftest proves it again at the
+  // path_momentum layer — two independent proofs of the same law, per plan § Pre-mortem).
+  const markedNet = ((merged['task:foo'] as any).closed) + ((merged['task:foo'] as any).strength) + ((merged['task:foo'] as any).prod.strength) - ((merged['task:foo'] as any).resistance) - ((merged['task:foo'] as any).prod.resistance)
+  const warnedNet = ((warned['task:bar'] as any).closed ?? 0) + ((warned['task:bar'] as any).strength ?? 0) + ((warned['task:bar'] as any).prod.strength) - ((warned['task:bar'] as any).resistance ?? 0) - ((warned['task:bar'] as any).prod.resistance)
+  check('outcome-weight: a marked prod outcome nets strictly above a warned one', markedNet > warnedNet)
+
+  console.log(`SELFTEST: ${pass}/${pass + fail} pass (mapPromiseProof · mapDoEventLearn · mapWorldOutcome · merge-law · provenance · outcome-weight)`)
+  if (fail > 0) process.exit(1)
+}
+
+// ─── entry ───────────────────────────────────────────────────────────────
+
+if (process.argv.includes('--selftest')) {
+  selftest()
+} else {
+  await pull()
+}

package/scripts/promise-manifest.mjs

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+// promise-manifest.mjs — project text/<slug>.md promise frontmatter into the two
+// JSON reads the Promise view needs (text/factory-promise-view.md §6).
+//
+// The promise files live in git and the web app is a CF Worker with no filesystem,
+// so the contract has to be projected at build time. Same shape as the precedent
+// at src/data/factory-check.json, which /factory imports.
+//
+// Two outputs, split so the bundle cost is bounded:
+//   src/data/promises-index.json   slug · title · counts. imported by the route.
+//   src/data/promises.json         full detail. imported ONLY by the API route.
+//
+// NOT written to public/ — a public JSON carrying accept: bodies would make the
+// shared lens's redaction (§4) cosmetic, and would be unauthenticated for every
+// workspace forever the moment a tenant writes a promise.
+//
+// Usage: node .claude/scripts/promise-manifest.mjs [--check]
+//        --check exits 3 if the committed output is stale (no write).
+
+import { readFileSync, readdirSync, writeFileSync, existsSync } from 'node:fs'
+import { resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { parse as parseYaml } from '../../one.ie/web/node_modules/yaml/dist/index.js'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..')
+const TEXT = resolve(ROOT, 'text')
+const OUT = resolve(ROOT, 'one.ie/web/src/data')
+
+// A promise is the bare slug — text/<feature>.md. Every suffixed sibling is derived
+// from it (text/CLAUDE.md § File naming) and carries its own frontmatter that is NOT
+// a contract; a -todo.md's `outcome:` is the promise's proof, not a second promise.
+const DERIVED = /-(plan|todo|docs|ui|features|tutorial|how-to|reference|agents|agents-docs|humans|lifecycle)\.md$/
+
+function splitFrontmatter(src) {
+  if (!src.startsWith('---\n')) return null
+  const end = src.indexOf('\n---', 4)
+  if (end === -1) return null
+  return { fm: src.slice(4, end), body: src.slice(end + 4) }
+}
+
+// The one-sentence claim — the largest thing on the rendered page, so a wrong pick
+// is loud. Prefer the section written to BE the claim (`## The promise`, or a
+// `## Who this is for` where the promise family uses that heading); otherwise the
+// first prose paragraph anywhere after the H1. Headings are skipped, not bailed on:
+// 56 of 79 promises open with a section heading immediately under the H1, so
+// stopping at the first heading returned an empty lead for most of the corpus.
+function firstProse(lines, from) {
+  for (let i = from; i < lines.length; i++) {
+    const l = lines[i].trim()
+    if (!l) continue
+    if (/^(#{1,6}\s|>\s|[-*+]\s|\d+\.\s|```|\||---|\*\*Status|<)/.test(l)) continue
+    // A one-line paragraph is the shape we want; join a wrapped one up to its break.
+    const buf = [l]
+    for (let j = i + 1; j < lines.length && lines[j].trim(); j++) {
+      const nxt = lines[j].trim()
+      if (/^(#{1,6}\s|>\s|[-*+]\s|\d+\.\s|```|\|)/.test(nxt)) break
+      buf.push(nxt)
+    }
+    return buf.join(' ')
+  }
+  return ''
+}
+
+// Only from a section written to BE the claim. Measured over the 79-file corpus:
+// falling back to "first prose after the H1" returned a lead for all 79, but the
+// leads were wrong — `affiliate-escrow-multichain` yielded "`resolveAffiliateLeg`
+// in pay/backend/src/routes/escrow.ts computes an AffiliateSplit…", which is
+// implementation detail presented as the headline claim. A confident wrong sentence
+// at the top of a contract is worse than no sentence, so the fallback is gone: the
+// TITLE carries the claim (they are written that way — "Affiliate escrow, every
+// chain — EVM and Solana pay the referral for real") and this is the optional
+// second line under it.
+function leadSentence(body) {
+  const lines = body.split('\n')
+  // `## The promise` ONLY. `## Who this is for` was tried and dropped: it is an
+  // audience section, and its opening prose is routinely implementation detail
+  // (affiliate-escrow-multichain opens it with a function name and a file path).
+  const at = lines.findIndex((l) => /^##+\s+The promise\b/i.test(l.trim()))
+  if (at === -1) return ''
+  const lead = firstProse(lines, at + 1)
+  // One sentence, not the whole section.
+  return lead ? (lead.match(/^.*?[.!?](?=\s|$)/)?.[0] ?? lead).slice(0, 320) : ''
+}
+
+// "Out of scope — not promised, by law" — the block the doc says gets equal weight
+// and must survive to the Delivery state. Bullets only; prose in the section is
+// context for us, not a scope line for the reader.
+function outOfScope(body) {
+  const m = body.match(/^##+\s+Out of scope[^\n]*\n([\s\S]*?)(?=\n##\s|\n---\s*\n|$)/m)
+  if (!m) return []
+  return m[1].split('\n')
+    .map((l) => l.trim())
+    .filter((l) => /^[-*+]\s+/.test(l))
+    .map((l) => l.replace(/^[-*+]\s+/, '').replace(/^\*\*(.+?)\*\*\s*/, '$1 — ').trim())
+    .filter(Boolean)
+}
+
+function toList(v) {
+  if (!v) return []
+  return Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []
+}
+
+const promises = []
+const broken = []
+for (const file of readdirSync(TEXT).sort()) {
+  if (!file.endsWith('.md') || DERIVED.test(file)) continue
+  if (file.startsWith('template-')) continue
+  const src = readFileSync(resolve(TEXT, file), 'utf8')
+  const split = splitFrontmatter(src)
+  if (!split) continue
+
+  let fm
+  try {
+    fm = parseYaml(split.fm)
+  } catch (err) {
+    // An unparseable head is not a contract — UNLESS it was meant to be one. A file
+    // that declares `deliverables:` and then fails to parse is a promise the site
+    // would drop on the floor, silently, forever (text/urls.md vanished this way:
+    // an unescaped `"` inside a double-quoted accept:). Loud, not skipped.
+    if (/^deliverables:/m.test(split.fm)) {
+      broken.push({ file, message: String(err.message || err).split('\n')[0] })
+    }
+    continue
+  }
+  if (!fm || typeof fm !== 'object') continue
+  const rows = Array.isArray(fm.deliverables) ? fm.deliverables : []
+  if (rows.length === 0) continue                        // no schedule = not a promise
+
+  const slug = typeof fm.slug === 'string' && fm.slug ? fm.slug : file.replace(/\.md$/, '')
+  promises.push({
+    slug,
+    title: typeof fm.title === 'string' ? fm.title : slug,
+    status: typeof fm.status === 'string' ? fm.status.split('\n')[0].trim() : '',
+    lead: leadSentence(split.body),
+    deliverables: rows
+      .filter((r) => r && typeof r.item === 'string')
+      .map((r) => ({ item: r.item, accept: typeof r.accept === 'string' ? r.accept : '' })),
+    assumes: toList(fm.assumes),
+    // `proof:` is deliberately NOT carried. By the schedule ⊆ proof law it is the
+    // verbatim `&&`-join of every accept: above (do-promise-lint.sh enforces the
+    // inclusion), so shipping it doubles the payload to say nothing new — it cost
+    // 190 KB of the first cut. The view renders verdicts, never the command.
+    outOfScope: outOfScope(split.body),
+  })
+}
+
+if (broken.length) {
+  console.error(
+    `[promise-manifest] ${broken.length} promise file(s) declare deliverables: but their\n` +
+      `frontmatter does not parse — each would be MISSING from the site, silently:\n` +
+      broken.map((b) => `  text/${b.file} — ${b.message}`).join('\n') +
+      `\nFix the YAML (usually an unescaped " or \\ inside a double-quoted accept:,\n` +
+      `or an unquoted title: containing ": "). Nothing was written.`,
+  )
+  process.exit(4)
+}
+
+// The index carries the claim and the count and nothing else — it is imported by
+// the Astro route, so every field costs worker bundle on every tasks request.
+const index = promises.map((p) => ({
+  slug: p.slug,
+  title: p.title,
+  count: p.deliverables.length,
+}))
+
+const detail = Object.fromEntries(promises.map((p) => [p.slug, p]))
+
+const files = [
+  [resolve(OUT, 'promises-index.json'), index],
+  [resolve(OUT, 'promises.json'), detail],
+]
+
+if (process.argv.includes('--check')) {
+  for (const [path, data] of files) {
+    const want = JSON.stringify(data, null, 2) + '\n'
+    const have = existsSync(path) ? readFileSync(path, 'utf8') : ''
+    if (want !== have) {
+      console.error(`[promise-manifest] STALE: ${path.replace(ROOT + '/', '')} — run node .claude/scripts/promise-manifest.mjs`)
+      process.exit(3)
+    }
+  }
+  console.log(`[promise-manifest] fresh — ${promises.length} promises`)
+  process.exit(0)
+}
+
+for (const [path, data] of files) {
+  writeFileSync(path, JSON.stringify(data, null, 2) + '\n')
+  console.log(`[promise-manifest] ${path.replace(ROOT + '/', '')} — ${(JSON.stringify(data).length / 1024).toFixed(1)} KB`)
+}
+console.log(`[promise-manifest] ${promises.length} promises · ${promises.reduce((n, p) => n + p.deliverables.length, 0)} deliverables`)

package/scripts/reconcile-allow.txt

@@ -23,3 +23,8 @@ knowledge supplies
 # runs one), not the substrate "node". text/tokens.md, text/tokens-plan.md.
 lightning node
 node to run
+
+# playbook-node — a real one.tql attribute (ELEVATE playbook position marker),
+# a kebab-case compound where grep -w treats the hyphen as a word boundary and
+# false-positives on "node". Not the substrate dead name. schema/one.tql:385.
+playbook-node