@oneie/claude 0.6.0 → 0.8.0

package/scripts/vespio-sync.sh

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+# vespio-sync.sh — one-way harness sync, one-ie -> apps/vespio.
+#
+# Vespio is an AGENCY repo (clients/, site/, web/, ai/, packages/). It is not
+# the monorepo: no schema/, no pay/, no channels/, no text/ promise layer. So
+# "sync everything" is the wrong instinct — most of one-ie's harness hard-asserts
+# against a tree vespio does not have.
+#
+# THE AUTHORITY IS THE MANIFEST IN factory-repo.sh. It already classifies every
+# script portable | needs-env | monorepo-only. This script reads that manifest
+# rather than keeping a second list that could drift from it. An UNCLASSIFIED
+# script does not ship — silence is never a licence.
+#
+#   bash .claude/scripts/vespio-sync.sh --check   # what's missing/drifted (read-only)
+#   bash .claude/scripts/vespio-sync.sh           # copy, then show the diff
+#   bash .claude/scripts/vespio-sync.sh --commit  # copy + commit (never pushes)
+#
+# Never pushes. Never stages by wildcard — every path is named. The 6 modified
+# clients/*/data/lifecycles/*.toml in vespio belong to someone else's work and
+# must never ride along in a sync commit.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+VESPIO="${VESPIO_ROOT:-$ROOT/../apps/vespio}"
+MODE="${1:-}"
+
+[ -d "$VESPIO/.git" ] || { echo "no vespio repo at $VESPIO"; exit 1; }
+
+# ROOT is derived from BASH_SOURCE, so invoking this by a RELATIVE path from
+# inside vespio resolves ROOT to vespio and syncs the tree onto itself. Assert
+# the source is really one-ie before touching anything.
+[ -f "$ROOT/schema/one.tql" ] || {
+  echo "refusing: \$ROOT ($ROOT) is not the one-ie monorepo (no schema/one.tql)."
+  echo "run this from /Users/toc/Server/one-ie, or by absolute path."
+  exit 1
+}
+[ "$(cd "$ROOT" && pwd -P)" != "$(cd "$VESPIO" && pwd -P)" ] || {
+  echo "refusing: source and destination are the same tree"; exit 1
+}
+
+# --- the shippable set, read from the single manifest ------------------------
+shippable() {
+  sed -n '/^manifest() {/,/^MANIFEST/p' "$ROOT/.claude/scripts/factory-repo.sh" \
+    | grep -E '^(portable|needs-env) ' | awk '{print $2}' | sort
+}
+unclassified() {
+  bash "$ROOT/.claude/scripts/factory-repo.sh" --check-portability 2>/dev/null \
+    | sed -n 's/.*FAIL unclassified: //p' | sort
+}
+
+# Commands that make sense in an agency tree. Deliberately excluded and why:
+#   deploy.md db-sync.md release.md  -> 5-service monorepo pipeline
+#   one.md                           -> nine fleets over text/ docs vespio lacks
+#   oo-push.md rag.md                -> monorepo-specific surfaces
+COMMANDS="browser.md cc-connect.md chat.md close.md create.md do.md do-autonomous.md
+          do-improve.md do-show.md go.md improve.md kill.md notify.md restart.md
+          see.md skill-create.md sync.md"
+
+# Skills that are tree-agnostic craft. Excluded: typedb, sdk, mcp, cli, puck,
+# promise-* (need schema/, packages/, or the text/ promise layer).
+SKILLS="astro react19 shadcn writer voice docs"
+
+copied=0; missing=0
+say() { printf '  %-14s %s\n' "$1" "$2"; }
+
+ship_one() { # ship_one <relpath under .claude>
+  local rel="${1:-}"; [ -n "$rel" ] || return 0
+  local src="$ROOT/.claude/$rel" dst="$VESPIO/.claude/$rel"
+  [ -e "$src" ] || { say "ABSENT" "$rel"; missing=$((missing+1)); return; }
+  if [ "$MODE" = "--check" ]; then
+    if [ ! -e "$dst" ]; then say "MISSING" "$rel"; missing=$((missing+1))
+    elif ! diff -q "$src" "$dst" >/dev/null 2>&1; then say "DRIFTED" "$rel"; missing=$((missing+1)); fi
+    return
+  fi
+  mkdir -p "$(dirname "$dst")"
+  # A second run must be identical to the first. `cp -R src dst` NESTS when dst
+  # already exists (dst/src), so a re-sync silently built skills/writer/writer.
+  # Remove the destination first — this is a mirror, not an accumulation.
+  rm -rf "$dst"
+  # -L dereferences symlinks: .claude/skills/livekit-agents points outside the
+  # tree and would land in vespio as a dangling link.
+  cp -RL "$src" "$dst" && copied=$((copied+1))
+}
+
+echo "== vespio-sync  $ROOT -> $VESPIO"
+un="$(unclassified)"
+if [ -n "$un" ]; then
+  echo "-- NOT SHIPPING (unclassified in the manifest — classify them to ship):"
+  echo "$un" | sed 's/^/     /'
+fi
+
+echo "-- scripts (manifest: portable + needs-env)"
+while read -r f; do [ -n "$f" ] && ship_one "scripts/$f"; done <<< "$(shippable)"
+
+echo "-- rules"
+for f in api.md astro.md design.md documentation.md engine.md react.md ui.md; do ship_one "rules/$f"; done
+
+echo "-- agents"
+for f in w1-recon.md w2-decide.md w3-edit.md w4-verify.md; do ship_one "agents/$f"; done
+
+echo "-- commands"
+for f in $COMMANDS; do ship_one "commands/$f"; done
+
+# /vespio has TWO bodies: the monorepo-side one (sync + push, lives in
+# .claude/commands/vespio.md here) and the vespio-side one (start the fleet).
+# Shipping the monorepo body would tell a vespio clone to run vespio-sync.sh,
+# which is monorepo-only and not there — a command that lies from inside the
+# repo it ships to. So the REMOTE body is authored separately and mapped on.
+ship_mapped() { # ship_mapped <src rel> <dst rel>
+  local src="$ROOT/.claude/$1" dst="$VESPIO/.claude/$2"
+  [ -f "$src" ] || { say "ABSENT" "$1"; missing=$((missing+1)); return; }
+  if [ "$MODE" = "--check" ]; then
+    if [ ! -e "$dst" ]; then say "MISSING" "$2"; missing=$((missing+1))
+    elif ! diff -q "$src" "$dst" >/dev/null 2>&1; then say "DRIFTED" "$2"; missing=$((missing+1)); fi
+    return
+  fi
+  mkdir -p "$(dirname "$dst")"; rm -rf "$dst"; cp -L "$src" "$dst" && copied=$((copied+1))
+}
+ship_mapped "commands/vespio.remote.md" "commands/vespio.md"
+
+echo "-- skills"
+for s in $SKILLS; do ship_one "skills/$s"; done
+
+if [ "$MODE" = "--check" ]; then
+  echo "== $missing item(s) missing or drifted"
+  [ "$missing" -eq 0 ] && echo "   vespio is current." 
+  exit 0
+fi
+
+echo "== copied $copied item(s)"
+cd "$VESPIO"
+echo "-- vespio diff (.claude only):"
+git status --porcelain .claude | sed 's/^/     /'
+
+if [ "$MODE" = "--commit" ]; then
+  # explicit paths only — never `git add -A`. A neighbour's uncommitted
+  # clients/*/lifecycles edits must not be swept into a harness sync.
+  git add .claude
+  if git diff --cached --quiet; then echo "nothing to commit"; exit 0; fi
+  git commit -q -F - <<'MSG'
+chore(claude): sync harness from one-ie
+
+Manifest-driven — the shippable set is read from factory-repo.sh's
+portability manifest, not a second list. Unclassified scripts do not ship.
+Excluded by design: the 5-service deploy pipeline, the text/ promise layer,
+and schema/-dependent skills, none of which exist in this tree.
+MSG
+  echo "committed. Review, then push by hand: git -C $VESPIO push origin main"
+fi

package/scripts/w4-rubric.ts

@@ -1,5 +1,15 @@
 #!/usr/bin/env bun
-// w4-rubric.ts — real rubric judge for /do W4.
+// w4-rubric.ts — the TASK rubric judge (5 axes, no goal-fit).
+//
+// This computes the `task` rubric, NOT the in-cycle W4 cycle gate. The two are
+// different by design: a diff handed to this script carries no plan context, so
+// goal-fit cannot be scored here. The cycle gate adds goal-fit at 0.30 and gates
+// on it at >= 0.50 — see .claude/commands/do.md § W4. Its output is labelled
+// `task-composite` so it can never be read as a cycle verdict.
+//
+// Weights and axis definitions come from rubric-weights.json — the single
+// source. Do not restate them here.
+//
 // Usage: w4-rubric.ts [edge] [--self-test] [--gate 0.65]
 // Reads diff from stdin. Exits 0=pass, 1=fail, 2=defer-to-agent.
 import { readFileSync, existsSync } from 'fs'
@@ -7,30 +17,76 @@ import { readFileSync, existsSync } from 'fs'
 const args = process.argv.slice(2)
 const selfTest = args.includes('--self-test')
 const edge = args.find(a => !a.startsWith('--')) ?? (process.env.DO_SLUG ? `do/${process.env.DO_SLUG}` : 'do/unknown')
-const gate = parseFloat(args.find(a => a.startsWith('--gate='))?.slice(7) ?? '0.65')
+
+// The weights file sits beside this script. A missing or malformed file is a
+// hard failure, never a fallback to inlined numbers — a silent divergence
+// between the file and a hardcoded copy is the exact drift this file removes.
+const WEIGHTS_PATH = new URL('./rubric-weights.json', import.meta.url).pathname
+type Rubric = {
+  gate: number
+  task: { weights: Record<string, number> }
+  definitions: Record<string, string>
+}
+function loadRubric(): Rubric {
+  try {
+    return JSON.parse(readFileSync(WEIGHTS_PATH, 'utf8')) as Rubric
+  } catch (e) {
+    process.stderr.write(`[w4-rubric] cannot read ${WEIGHTS_PATH}: ${(e as Error).message}\n`)
+    process.exit(1)
+    throw e // unreachable — process.exit never returns; satisfies the checker without @types/node
+  }
+}
+const RUBRIC = loadRubric()
+const W = RUBRIC.task.weights
+const AXES = Object.keys(W)
+const wSum = AXES.reduce((n, k) => n + W[k], 0)
+if (Math.abs(wSum - 1) > 1e-9) {
+  process.stderr.write(`[w4-rubric] task weights sum to ${wSum}, not 1.00 — refusing to score\n`)
+  process.exit(1)
+}
+
+const gate = parseFloat(args.find(a => a.startsWith('--gate='))?.slice(7) ?? String(RUBRIC.gate))
 // integration is deterministic when the caller knows it (W4 computes it from
 // .w2-surface-checklist.json + do-reconcile.sh sdk|navigation|docs and passes
 // --integration=0.NN); only when absent does the LLM score it from the diff.
 const integrationArg = args.find(a => a.startsWith('--integration='))?.slice(14)
-const W = { security: 0.30, stability: 0.25, simplicity: 0.20, integration: 0.15, speed: 0.10 }
 
 function composite(s: Record<string,number>) {
-  return s.security*W.security + s.stability*W.stability + s.simplicity*W.simplicity + s.integration*W.integration + s.speed*W.speed
+  return AXES.reduce((n, k) => n + s[k] * W[k], 0)
 }
 
+// --self-test vectors. `pass` is the historical fixture; `fail` exists so the
+// gate can be shown going RED. A gate that has only ever been observed passing
+// is indistinguishable from a gate that cannot fail.
+const SELF_TEST_SCORES: Record<string, number> =
+  { security: 0.90, stability: 1.00, simplicity: 0.80, integration: 0.85, speed: 0.75 }
+const SELF_TEST_FAIL: Record<string, number> =
+  { security: 0.40, stability: 0.40, simplicity: 0.40, integration: 0.40, speed: 0.40 }
+
 async function judge(diff: string): Promise<Record<string,number>> {
-  const envFile = process.env.DO_ENV_FILE ?? 'one.ie/web/.env'
+  const envFile = process.env.ONE_ENV_FILE ?? process.env.DO_ENV_FILE ?? 'one.ie/web/.env'
   let key = process.env.OPENROUTER_API_KEY ?? ''
   if (!key && existsSync(envFile)) {
     const m = readFileSync(envFile,'utf8').split('\n').find(l => l.startsWith('OPENROUTER_API_KEY='))
     if (m) key = m.slice(m.indexOf('=')+1).replace(/^["']|["']$/g,'')
   }
   if (!key) { process.stderr.write('[w4-rubric] no OPENROUTER_API_KEY — deferring\n'); process.exit(2) }
-  const res = await fetch('https://openrouter.ai/api/v1/chat/completions', {
+  const gwAccount = process.env.CF_AI_GATEWAY_ACCOUNT_ID
+  const gwId = process.env.CF_AI_GATEWAY_ID
+  const orBase = gwAccount && gwId
+    ? `https://gateway.ai.cloudflare.com/v1/${gwAccount}/${gwId}/openrouter`
+    : 'https://openrouter.ai/api/v1'
+  const res = await fetch(`${orBase}/chat/completions`, {
     method:'POST', headers:{'Authorization':`Bearer ${key}`,'Content-Type':'application/json'},
     body:JSON.stringify({ model:'anthropic/claude-haiku-4-5', max_tokens:80,
       messages:[
-        {role:'system',content:'Score this diff on security/stability/simplicity/integration/speed (0-1). integration = the change is wired into its surroundings (imports/exports used, routes registered, links added, docs synced), not orphaned. JSON only: {"security":0.9,"stability":0.8,"simplicity":0.7,"integration":0.8,"speed":0.8}'},
+        // Every axis carries its definition from rubric-weights.json. An axis
+        // scored without one is scored against whatever the model invents that
+        // run — `stability` carried 0.25 weight undefined until 2026-08-02.
+        {role:'system',content:
+          `Score this diff on ${AXES.join('/')} (0-1). Definitions:\n`
+          + AXES.map(k => `- ${k}: ${RUBRIC.definitions[k] ?? '(UNDEFINED — score 0 and say so)'}`).join('\n')
+          + `\nJSON only, exactly these keys: {${AXES.map(k => `"${k}":0.8`).join(',')}}`},
         {role:'user',content:diff.slice(0,3000)}
       ]})
   })
@@ -39,21 +95,49 @@ async function judge(diff: string): Promise<Record<string,number>> {
   if (!m2) { process.stderr.write('[w4-rubric] bad LLM response — deferring\n'); process.exit(2) }
   const d = JSON.parse(m2[0]) as Record<string,unknown>
   const c = (v:unknown) => Math.max(0, Math.min(1, Number(v)||0))
-  return { security:c(d.security), stability:c(d.stability), simplicity:c(d.simplicity), integration:c(d.integration), speed:c(d.speed) }
+  // An axis the model omitted must not silently become 0 inside a weighted sum —
+  // that reads as "scored badly" when it means "not scored at all".
+  const missing = AXES.filter(k => d[k] === undefined)
+  if (missing.length) {
+    process.stderr.write(`[w4-rubric] LLM omitted ${missing.join(',')} — deferring\n`)
+    process.exit(2)
+  }
+  return Object.fromEntries(AXES.map(k => [k, c(d[k])])) as Record<string, number>
 }
 
 async function main() {
-  const scores = selfTest
-    ? { security:0.90, stability:1.00, simplicity:0.80, integration:0.85, speed:0.75 }
+  const failFixture = args.includes('--self-test-fail')
+  const scores: Record<string, number> = (selfTest || failFixture)
+    ? Object.fromEntries(AXES.map(k => [k, (failFixture ? SELF_TEST_FAIL : SELF_TEST_SCORES)[k] ?? 0.80]))
     : await judge(await new Promise<string>(r => { let s=''; process.stdin.on('data',c=>s+=c); process.stdin.on('end',()=>r(s)) }))
   // deterministic override wins: the surface checklist is truth, not vibes
   if (integrationArg !== undefined) scores.integration = Math.max(0, Math.min(1, parseFloat(integrationArg)||0))
   const comp = composite(scores)
   const baseUrl = process.env.DO_SIGNAL_URL ?? 'https://one.ie'
   if (!selfTest && edge !== 'do/unknown') {
-    await fetch(`${baseUrl}/api/mark-dims`, {method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({edge,dims:scores})}).catch(()=>{})
+    // /api/mark-dims is gate()-guarded (security-gates #5) — it authenticates a service
+    // caller by Bearer === GATEWAY_API_KEY. Resolve it the same way judge() resolves the
+    // OpenRouter key (process.env → DO_ENV_FILE). Without it the marks silently 401 and
+    // the /do rubric-learning signal stops landing — a break the #5 gate introduced.
+    const envFile = process.env.ONE_ENV_FILE ?? process.env.DO_ENV_FILE ?? 'one.ie/web/.env'
+    let gwKey = process.env.GATEWAY_API_KEY ?? ''
+    if (!gwKey && existsSync(envFile)) {
+      const m = readFileSync(envFile,'utf8').split('\n').find(l => l.startsWith('GATEWAY_API_KEY='))
+      if (m) gwKey = m.slice(m.indexOf('=')+1).replace(/^["']|["']$/g,'')
+    }
+    await fetch(`${baseUrl}/api/mark-dims`, {
+      method:'POST',
+      headers:{'Content-Type':'application/json', ...(gwKey ? {'Authorization':`Bearer ${gwKey}`} : {})},
+      body:JSON.stringify({edge,dims:scores}),
+    }).catch(()=>{})
   }
-  process.stdout.write(`[w4-rubric] composite=${comp.toFixed(2)} security=${scores.security.toFixed(2)} stability=${scores.stability.toFixed(2)} simplicity=${scores.simplicity.toFixed(2)} integration=${scores.integration.toFixed(2)} speed=${scores.speed.toFixed(2)} gate=${gate} ${comp>=gate?'PASS':'FAIL'}\n`)
+  // `task-composite`, never bare `composite` — the cycle gate carries goal-fit
+  // at 0.30 and this number does not. Anything that logs, compares, or ratchets
+  // on it is comparing a task score, and the label has to say so.
+  const dims = AXES.map(k => `${k}=${scores[k].toFixed(2)}`).join(' ')
+  process.stdout.write(
+    `[w4-rubric] task-composite=${comp.toFixed(2)} ${dims} gate=${gate} ${comp>=gate?'PASS':'FAIL'}`
+    + ` (task rubric — no goal-fit; NOT the in-cycle W4 verdict)\n`)
   process.exit(comp >= gate ? 0 : 1)
 }
 

package/scripts/wf-check.mjs

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+// wf-check — syntax-check dynamic workflow scripts the way the RUNTIME parses them.
+//
+// Why this exists: a syntax error in a workflow script doesn't fail loudly, it stops
+// the workflow from launching at all. do-engine.js already carries a scar comment
+// about one such case (a second top-level `export` is illegal in a workflow body).
+//
+// Why the obvious checkers are wrong for this file shape:
+//   node --check <f>.js   → silently exits 0 for ANY file starting with `export`
+//                           (verified on node v24.15.0 — the ESM path is a no-op).
+//   node --check <f>.mjs  → real ESM parse, but rejects the top-level `return` and
+//                           `await` that every workflow body legitimately uses.
+// The runtime wraps the body in an async function, so that is what we parse it as.
+//
+// Usage:  node .claude/scripts/wf-check.mjs [file ...]
+//         (no args → every .js under .claude/workflows/)
+// Exit 0 = all green. Exit 1 = at least one script would fail to launch.
+
+import { readFileSync, readdirSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+const WF_DIR = '.claude/workflows'
+const AsyncFunction = Object.getPrototypeOf(async function () {}).constructor
+const HOOKS = ['args', 'budget', 'agent', 'parallel', 'pipeline', 'log', 'phase', 'workflow']
+
+function check(file) {
+  let src
+  try {
+    src = readFileSync(file, 'utf8')
+  } catch (e) {
+    return { file, ok: false, msg: `unreadable: ${e.message}` }
+  }
+
+  // The loader permits exactly one top-level export: the leading `export const meta`.
+  const exports = src.match(/^export\s/gm) ?? []
+  if (exports.length > 1) {
+    return { file, ok: false, msg: `${exports.length} top-level exports — only the leading \`export const meta\` is permitted` }
+  }
+  if (!/^export\s+const\s+meta\s*=/m.test(src)) {
+    return { file, ok: false, msg: 'missing the required leading `export const meta = {...}`' }
+  }
+
+  try {
+    new AsyncFunction(...HOOKS, src.replace(/^export\s+const\s+meta/m, 'const meta'))
+  } catch (e) {
+    return { file, ok: false, msg: e.message }
+  }
+
+  // Syntax is only half of "would this launch and behave". The seam checks below
+  // catch the read/write divergences that launch fine and then quietly corrupt
+  // the run — see the block above them for the three that actually happened.
+  const seam = seamChecks(file, src)
+  if (seam.length) return { file, ok: false, msg: `${seam.length} seam violation(s):\n        - ${seam.join('\n        - ')}` }
+  return { file, ok: true }
+}
+
+
+// ── Seam checks ───────────────────────────────────────────────────────────
+// Three of the five engine bugs fixed on 2026-08-31 were ONE defect: a fact the
+// engine depends on lived in two places and only one of them was real.
+//   · the tick   — done-ness lived in W4's verdict AND the todo checkbox; nothing
+//                  copied one to the other, so proven work was rebuilt forever.
+//   · the census — the model lived in Q.w1[0] AND in a 'haiku' string literal;
+//                  they diverged under quality:'max', teaching world:pick-model
+//                  that the cheap model had done the expensive model's work.
+//   · the clobber— an append instruction lived in the prompt text AND in the
+//                  agent's tool grant; W2 has no Bash, so it read-modify-wrote
+//                  the census and clobbered every parallel sibling.
+// The repo's own rule (CLAUDE.md): two instances of one defect shape ⇒ fix the
+// SEAM, never the sites. These are that seam, asserted at edit time by the
+// post-edit hook. Prove they can go RED with `--self-test`.
+
+// Read the balanced argument list of the call that starts at `open` (index of '(').
+function balancedArgs(src, open) {
+  let depth = 0
+  for (let i = open; i < src.length; i++) {
+    const c = src[i]
+    if (c === '(' || c === '[' || c === '{') depth++
+    else if (c === ')' || c === ']' || c === '}') {
+      depth--
+      if (depth === 0) return src.slice(open + 1, i)
+    } else if (c === '`' || c === "'" || c === '"') {
+      // skip the string body so its brackets never move the depth
+      const q = c
+      i++
+      while (i < src.length && src[i] !== q) i += src[i] === '\\' ? 2 : 1
+    }
+  }
+  return null
+}
+
+// SEAM 1 — the recorded model must BE the model, never a copy of it.
+// censusAppend(cid, [['W1', <model>], ...]) — every <model> slot must be an
+// identifier expression (Q.w1[0], w2Model). A quoted literal is a second source
+// of truth for a fact the router LEARNS from, and it silently rots.
+function checkCensusLiterals(src) {
+  const out = []
+  const re = /censusAppend\s*\(/g
+  let m
+  while ((m = re.exec(src))) {
+    const argsSrc = balancedArgs(src, re.lastIndex - 1)
+    if (!argsSrc) continue
+    for (const pair of argsSrc.match(/\[\s*(['"`])W\d+\1\s*,[^\]]*\]/g) ?? []) {
+      const model = pair.split(',').slice(1).join(',').replace(/\]\s*$/, '').trim()
+      if (/^(['"`]).*\1$/.test(model)) {
+        out.push(`census records a HARDCODED model ${model} in ${pair.trim()} — it must be the same expression that SPAWNS the agent (e.g. Q.w1[0]), or the census teaches world:pick-model a model that never ran`)
+      }
+    }
+  }
+  return out
+}
+
+// SEAM 2 — never ask an agent to run what its grant forbids.
+// If a prompt tells the agent to run a shell command, the agentType receiving it
+// must hold Bash in .claude/agents/<type>.md. W2 (Read/Grep/Glob/Write) was told
+// to `printf >> census`; unable to run it, it rewrote the whole file instead.
+const SHELL_INSTRUCTION = /(?:^|\W)(?:run (?:this|these) (?:exact|one) |printf |>>\s*\$?\{?\w|bash \.claude\/scripts\/|cd \$\{WT\})/
+function grantOf(type) {
+  const f = `.claude/agents/${type}.md`
+  if (!existsSync(f)) return null
+  const m = readFileSync(f, 'utf8').match(/^tools:\s*"?([^"\n]+)"?/m)
+  return m ? m[1].split(',').map((t) => t.trim()) : null
+}
+function checkInstructionGrant(src) {
+  const out = []
+  const re = /\bagent\s*\(/g
+  let m
+  while ((m = re.exec(src))) {
+    const argsSrc = balancedArgs(src, re.lastIndex - 1)
+    if (!argsSrc) continue
+    const type = argsSrc.match(/agentType:\s*['"`]([\w-]+)['"`]/)?.[1]
+    if (!type) continue
+    const prompt = argsSrc.slice(0, argsSrc.indexOf('agentType:'))
+    if (!SHELL_INSTRUCTION.test(prompt)) continue
+    const tools = grantOf(type)
+    if (!tools) {
+      out.push(`agent(agentType:'${type}') is handed a shell instruction but .claude/agents/${type}.md has no readable tools: line — the grant cannot be checked`)
+    } else if (!tools.includes('Bash')) {
+      out.push(`agent(agentType:'${type}') is told to RUN a command, but its grant is [${tools.join(', ')}] — no Bash. It cannot comply and will do something else instead (W2 read-modify-wrote the census and clobbered its siblings). Move the command to an agent that has Bash.`)
+    }
+  }
+  return out
+}
+
+// SEAM 3 — behavioural parity of the cycle-line shape across its four
+// implementations is proven by a separate runner, because it spans three
+// languages and two files this checker does not parse:
+//     bash .claude/scripts/do-cycle-shape-check.sh
+function seamChecks(file, src) {
+  if (!/\bagent\s*\(/.test(src)) return []
+  return [...checkCensusLiterals(src), ...checkInstructionGrant(src)]
+}
+
+const args = process.argv.slice(2)
+const files = args.length
+  ? args
+  : existsSync(WF_DIR)
+    ? readdirSync(WF_DIR).filter((f) => f.endsWith('.js')).map((f) => join(WF_DIR, f))
+    : []
+
+if (!files.length) {
+  console.log('wf-check: no workflow scripts found')
+  process.exit(0)
+}
+
+let failed = 0
+for (const f of files) {
+  const r = check(f)
+  if (r.ok) {
+    console.log(`  ok    ${r.file}`)
+  } else {
+    failed++
+    console.log(`  FAIL  ${r.file}: ${r.msg}`)
+  }
+}
+
+console.log(`wf-check: ${files.length - failed}/${files.length} green`)
+process.exit(failed ? 1 : 0)