@oneie/claude 0.7.0 → 0.8.0

package/commands/vespio.remote.md

@@ -0,0 +1,227 @@
+# /vespio — start the fleet
+
+```
+  ██╗   ██╗███████╗███████╗██████╗ ██╗ ██████╗
+  ██║   ██║██╔════╝██╔════╝██╔══██╗██║██╔═══██╗
+  ██║   ██║█████╗  ███████╗██████╔╝██║██║   ██║   probe · fan out · join
+  ╚██╗ ██╔╝██╔══╝  ╚════██║██╔═══╝ ██║██║   ██║   no conductor · no collisions
+   ╚████╔╝ ███████╗███████║██║     ██║╚██████╔╝
+    ╚═══╝  ╚══════╝╚══════╝╚═╝     ╚═╝ ╚═════╝
+```
+
+One word to start work on this repo. `/vespio` prices the box, shows the board,
+and names the one next move.
+
+**This is the vespio-side command.** The harness here is generated output, synced
+one-way from the `one-ie` monorepo. You cannot sync from inside this clone, and
+you are not meant to — see § 4.
+
+---
+
+## 0 · First run, once per clone
+
+```bash
+bun install
+mkdir -p text                                   # the loop's working directory
+cp data/docs/templates/template-todo.md text/   # the frontmatter contract
+```
+
+**`text/` is not optional.** `/do` reads and writes `text/<slug>-todo.md` — the
+command names that path 38 times. A fresh clone has no `text/`, so the loop exits
+before it starts. This is the step nobody guesses, which is why it is step one.
+
+---
+
+## 1 · Price the box BEFORE you fan out
+
+The binding constraint is **memory, not cores**. A cycle costs roughly 2GB
+(vitest driver + forks + tsc + node). On a 10-core/24GB box, `cores - 2` would
+authorise 8 concurrent worktrees — about 16GB of gates before your editor, your
+session and the OS get a byte.
+
+```bash
+bash .claude/scripts/machine-check.sh --watch    # load · swap DIRECTION · orphans
+```
+
+**Read swap direction, not the swapin counter.** Swapins spike during recovery
+too. Thrash is pages going *out* while free memory shrinks.
+
+Everything heavy goes through the governor:
+
+```bash
+bash .claude/scripts/gate-run.sh <label> -- <cmd>
+```
+
+A raw `vitest` bypasses it and `hook:load-guard` blocks it. macOS ships neither
+`flock(1)` nor `timeout(1)` — `lib/govern.sh` rebuilds both out of `mkdir(2)`
+atomicity and bash job control. That absence is the whole reason the wrapper
+exists.
+
+---
+
+## 2 · Run a cycle
+
+```bash
+bash .claude/scripts/do-tier.sh    # what tier is this REALLY? run it first
+/do <client-or-feature>            # the spine, tier-pruned
+```
+
+Run `do-tier.sh` against the real file list **before** writing a plan. It is the
+repo's own sizer, and it will often tell you that a job you were about to give
+nine cycles is a FIX. Believe it.
+
+**Every branch lives in a worktree cut from `main`:**
+
+```bash
+bash .claude/scripts/do-auto.sh <slug> --setup-only
+```
+
+Never switch HEAD in the shared tree — `hook:branch-pin` blocks it, and
+concurrent sessions would otherwise pull each other onto the wrong branch.
+
+---
+
+## 2b · The fleet — fan out, but only after you measure
+
+**Explicit opt-in.** A fleet spawns many agents and costs real tokens. Never
+infer it. Say `ultracode`, or ask for a fleet in your own words, or run
+`/vespio fleet` — otherwise work solo.
+
+### Measure first, or nine fleets agree on a wrong premise
+
+Fleets given identical facts cannot drift. Fleets given only a task description
+will. So build ONE measurement pack before you launch anything, and paste it
+**verbatim** into every fleet prompt.
+
+```bash
+bash .claude/scripts/machine-check.sh            # what the box can afford
+bash .claude/scripts/do-tier.sh                  # what tier the work really is
+node .claude/scripts/chrome.mjs <url> --text     # what a page ACTUALLY renders
+```
+
+A pack is live probes, never file reads. **Declared is not wired is not
+configured is not reachable is not working from where the code runs.** Every
+launch-blocking finding worth having comes from a probe; none would have been
+caught by reading source.
+
+### The board
+
+One fleet per client node, plus the shared surfaces. Each owns its own tree, so
+they cannot collide on a write:
+
+```
+  clients/alice           clients/mover          site/
+  clients/elitemoversca   clients/moverchat      ai/agents/
+  clients/family-rentals  clients/movers-demo    packages/
+  clients/maestromovers   clients/servicio-express
+  clients/themoverlist    clients/therooferlist
+```
+
+**Writers get a worktree; read-only and doc-only fleets do not need one.**
+
+```bash
+bash .claude/scripts/do-fleet.sh          # rank + launch, memory-priced
+bash .claude/scripts/do-auto.sh <slug> --setup-only   # one worktree by hand
+```
+
+`do-fleet.sh` prices concurrency in **memory, not cores**, and names the binding
+constraint on its ranking line. It only ever lowers the count.
+
+### Claim before you forage
+
+Two fleets picking the same job is the failure worktrees do **not** prevent —
+worktrees stop write races, nothing stops duplicated *selection*. Read the
+claims first. A claim is an evaporating lease, not a mutex: a dead worker's
+claim expires, where a mutex would deadlock.
+
+```
+  ant                    radio                  here
+  ───                    ─────                  ────
+  deposit  ──────────▶   transmit   ─────────▶  claim the region
+  read the trail ────▶   carrier sense ──────▶  read claims first
+  evaporate ─────────▶   timeout    ─────────▶  the lease expires
+  alarm    ──────────▶   jam        ─────────▶  warn the path
+```
+
+**Exclusion for files and machine gates; stigmergy for task selection.** For
+machine resources use `gate_lock` — `mkdir(2)` is atomic; a read-then-write is
+not.
+
+### Four prompt rules, each bought with a real mistake
+
+- **Never spend a client's money to prove a point.** One audit billed real API
+  credit demonstrating a hole it had already proven from code. Once the door is
+  open, reason from source — and say in the prompt that you did.
+- **Never simulate a run and report it as one.** Say so and STOP. A fabricated
+  run report poisons every decision downstream of it.
+- **Give a legitimate "no change needed" exit**, or a fleet will punch a hole in
+  something that worked to make a page prettier.
+- **Name the forbidden sentence.** Have each fleet quote verbatim the
+  client-facing sentences that would be FALSE, so nobody ships one by accident.
+
+### Then join
+
+**One fleet folds the others' findings back into a single doc.** Nine fleets
+that never reconcile are nine opinions. Kill any fleet the moment its premise
+dies — a fleet still building against a design you changed is worse than no
+fleet.
+
+---
+
+## 3 · The law
+
+1. **Probe before you read.** A file that exists is not a page that renders, and
+   a route that returns 200 is not a route that landed — a signed-out
+   `/u/<slug>/*` redirects to `/signin`, which renders 200 with no console
+   errors. A route counts as proven only if the run **ended** on the path you
+   asked for.
+2. **Default REFUTED.** No quoted stopping line means not proven. Say "not
+   proven" rather than "probably fine".
+3. **Two instances of one defect shape means fix the seam, never the sites.**
+4. **Never simulate a run and report it as one.** If you cannot execute for real,
+   say so and stop.
+5. **"No change needed" is a legitimate exit.** Say it rather than inventing work.
+6. **Name the forbidden sentence.** For anything a client will read, quote
+   verbatim the sentences that would be false, so nobody ships one by accident.
+
+---
+
+## 4 · Where the harness comes from
+
+`.claude/` in this repo is **generated output**, synced one-way from the `one-ie`
+monorepo by `vespio-sync.sh` — which is classified `monorepo-only` and
+deliberately does **not** ship here. So:
+
+- **Never hand-edit `.claude/`.** The next sync overwrites it. If something is
+  wrong or missing, say so in `space:vespio`; it gets fixed upstream and
+  re-synced.
+- **A manifest decides what ships**, not taste. Every upstream script is
+  classified `portable`, `needs-env`, or `monorepo-only`, and an *unclassified*
+  script does not ship — silence is not a licence.
+- **What is deliberately absent:** the five-service deploy pipeline, the `text/`
+  promise layer, and the `schema/`-dependent skills (`typedb`, `sdk`, `mcp`,
+  `cli`, `puck`, `promise-*`). None of them have a tree to assert against here.
+  Their absence is a decision, not a gap.
+
+---
+
+## 5 · Talk to the other side
+
+```bash
+.claude/scripts/cc-connect.sh listen    # once per session
+/chat                                   # read
+/chat "message"                         # send
+```
+
+Inbox on the web: **one.ie/u/vespio/in**
+
+---
+
+## Don't
+
+- Don't hand-edit `.claude/` — it is generated. Change it upstream.
+- Don't run a raw `vitest`. Use `gate-run.sh`, or the governor cannot see you.
+- Don't blanket-stage. Concurrent sessions mean a neighbour's uncommitted work
+  gets swept into your commit. Stage by explicit path, always.
+- Don't switch HEAD in the shared tree. Branch work goes in a worktree.
+- Don't plan in days or weeks. Tasks, then waves, then cycles.

package/hooks/hooks.json

@@ -37,6 +37,27 @@
           "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/git-add-guard.sh\"",
           "timeout": 5000,
           "blocking": true
+        },
+        {
+          "id": "hook:branch-pin",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/branch-pin.sh\"",
+          "timeout": 5000,
+          "blocking": true
+        },
+        {
+          "id": "hook:load-guard",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/load-guard.sh\"",
+          "timeout": 5000,
+          "blocking": true
+        },
+        {
+          "id": "hook:governor-escape",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/governor-escape.sh\"",
+          "timeout": 5000,
+          "blocking": true
         }
       ]
     },
@@ -55,42 +76,17 @@
     {
       "matcher": "Edit|Write|MultiEdit",
       "hooks": [
-        {
-          "id": "hook:gate-guard",
-          "type": "command",
-          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/gate-guard.sh\"",
-          "timeout": 5000,
-          "blocking": true
-        },
         {
           "id": "hook:config-protect",
           "type": "command",
           "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/config-protect.sh\"",
           "timeout": 5000,
           "blocking": true
-        },
-        {
-          "id": "hook:compact-hint",
-          "type": "command",
-          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/compact-hint.sh\"",
-          "timeout": 3000,
-          "blocking": false
         }
       ]
     }
   ],
   "PostToolUse": [
-    {
-      "matcher": "Read",
-      "hooks": [
-        {
-          "id": "hook:read-tracker",
-          "type": "command",
-          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/read-tracker.sh\"",
-          "timeout": 3000
-        }
-      ]
-    },
     {
       "matcher": "Write|Edit",
       "hooks": [
@@ -99,24 +95,6 @@
           "type": "command",
           "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/post-edit-check.sh\"",
           "timeout": 15000
-        },
-        {
-          "id": "hook:priority-todo",
-          "type": "command",
-          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/sync-priority-todo.sh\"",
-          "timeout": 10000,
-          "blocking": false
-        }
-      ]
-    },
-    {
-      "matcher": "Write|Edit|MultiEdit",
-      "hooks": [
-        {
-          "id": "hook:sync-todo-docs",
-          "type": "command",
-          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/sync-todo-docs.sh\"",
-          "timeout": 5000
         }
       ]
     },
@@ -155,17 +133,6 @@
           "blocking": true
         }
       ]
-    },
-    {
-      "matcher": "*",
-      "hooks": [
-        {
-          "id": "hook:tool-signal",
-          "type": "command",
-          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/tool-signal.sh\"",
-          "timeout": 3000
-        }
-      ]
     }
   ],
   "TaskCompleted": [
@@ -187,18 +154,11 @@
       "matcher": "*",
       "hooks": [
         {
-          "id": "hook:session-end",
-          "type": "command",
-          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/session-end-verify.sh\"",
-          "timeout": 30000,
-          "blocking": false
-        },
-        {
-          "id": "hook:stop-reflect",
+          "id": "hook:auto-continue",
           "type": "command",
-          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/stop-reflect.sh\"",
-          "timeout": 10000,
-          "blocking": false
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/auto-continue.sh\"",
+          "timeout": 5000,
+          "blocking": true
         },
         {
           "id": "hook:staff-cleanup",
@@ -206,13 +166,6 @@
           "command": "bun \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/cleanup.ts\"",
           "timeout": 3000,
           "blocking": false
-        },
-        {
-          "id": "hook:priority-todo-stop",
-          "type": "command",
-          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/sync-priority-todo.sh\"",
-          "timeout": 10000,
-          "blocking": false
         }
       ]
     }
@@ -227,13 +180,6 @@
           "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/session-start.sh\"",
           "timeout": 5000,
           "blocking": false
-        },
-        {
-          "id": "hook:priority-todo-start",
-          "type": "command",
-          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/sync-priority-todo.sh\"",
-          "timeout": 10000,
-          "blocking": false
         }
       ]
     }

package/hooks/lib/governor-escape-match.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# governor-escape-match.sh — ONE definition of "this command escapes the governor".
+#
+# Sourced by BOTH .claude/hooks/governor-escape.sh (the enforcement) and
+# .claude/scripts/governor-escape-check.sh (the proof). load-guard.sh and
+# load-guard-check.sh keep two copies of their regex; that is a drift bug
+# waiting to happen and this file exists so this guard never has one.
+#
+# SCOPE — deliberately the four ESCAPE HATCHES, not every heavy command.
+#
+#   1. `bun run verify:raw`   web/package.json — the ungoverned verify
+#   2. `bun run test:raw`     web/package.json — a bare `vitest run`
+#   3. a directly-typed `vitest` / `npx vitest` / `bunx vitest`
+#   4. `GOVERN_DISABLE=1` or `CI=1` in front of a gate
+#      (gate-run.sh:26 execs straight through on either)
+#
+# A bare `tsc --noEmit` or `astro check` is NOT here on purpose. Those are
+# ordinary heavy commands with legitimate uses; hook:load-guard already denies
+# them once the box is saturated. Denying them unconditionally would be the
+# false positive that gets this hook switched off, which is worse than not
+# having it. Do not "fix" that.
+#
+# Contract:
+#   gov_escape_kind "<command string>"
+#     prints  env|raw|vitest  and returns 0  -> this command escapes the governor
+#     prints  nothing         and returns 1  -> it does not
+
+# Command POSITION: start of a line, or just after a shell operator, allowing a
+# run of leading VAR=value assignments. Anchoring here is what stops the guard
+# firing on a command that merely NAMES an escape -- a `git commit -m` whose
+# message quotes it, a `grep` looking for it, a `sed` reading package.json.
+GOV_POS='(^|[;&|(]|&&|\|\|)[[:space:]]*'
+GOV_ENV='([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+)*'
+
+# 4. an env bypass sitting at command position...
+GOV_RE_ENVPOS="${GOV_POS}${GOV_ENV}(GOVERN_DISABLE|CI)="
+# ...in front of something that is actually a gate. Both halves must hold, so
+# `GOVERN_DISABLE=1 ls` and `CI=1 bun run build` are left alone.
+GOV_RE_GATETOKEN='(vitest|gate-run\.sh|tsc[[:space:]]+--noEmit|astro[[:space:]]+check|playwright[[:space:]]+test|(bun|npm|pnpm|yarn)[[:space:]]+run[[:space:]]+(verify|test|typecheck|check))'
+
+# 1+2. any `:raw` package script -- their entire purpose is bypassing the cap.
+GOV_RE_RAW="${GOV_POS}${GOV_ENV}(bun|npm|pnpm|yarn)[[:space:]]+run[[:space:]]+[A-Za-z0-9:_.-]*:raw([[:space:]]|\$)"
+
+# 3. vitest invoked directly, however it is reached.
+GOV_RE_VITEST="${GOV_POS}${GOV_ENV}((bunx|npx|pnpm[[:space:]]+dlx|bun[[:space:]]+x|yarn[[:space:]]+dlx)[[:space:]]+)?([A-Za-z0-9_./-]*/)?vitest([[:space:]]|\$)"
+
+# A heredoc BODY is data, not commands, and `grep -E '^...'` anchors per LINE --
+# so `cat > f <<'EOF'` whose body has a line starting with an escape would match
+# on `^`. Writing a doc or a script that quotes an escape is exactly the innocent
+# act this guard must not refuse. Drop heredoc bodies before matching.
+_gov_strip_heredocs() {
+  awk '
+    term != "" { if ($0 == term) term = ""; next }
+    {
+      if (match($0, /<<-?[[:space:]]*("[^"]+"|\047[^\047]+\047|[A-Za-z_][A-Za-z0-9_]*)/)) {
+        t = substr($0, RSTART, RLENGTH)
+        sub(/^<<-?[[:space:]]*/, "", t)
+        gsub(/["\047]/, "", t)
+        term = t
+      }
+      print
+    }
+  '
+}
+
+gov_escape_kind() {
+  local cmd
+  cmd="$(printf '%s' "${1:-}" | _gov_strip_heredocs)"
+  [ -n "$cmd" ] || return 1
+
+  # ORDER MATTERS. The env bypass is checked FIRST, because
+  # `GOVERN_DISABLE=1 bash gate-run.sh verify -- …` turns the governor itself
+  # into a plain exec -- it is an escape even though it names gate-run.sh.
+  if printf '%s' "$cmd" | grep -qE "$GOV_RE_ENVPOS" \
+     && printf '%s' "$cmd" | grep -qE "$GOV_RE_GATETOKEN"; then
+    printf 'env'; return 0
+  fi
+
+  # Governed -- gate-run.sh takes the slot, bounds the wall clock and reaps the
+  # process group, so whatever it wraps is not an escape.
+  # Known limit: this is a whole-command carve-out (the same one load-guard.sh:39
+  # makes), so `vitest run x && bash gate-run.sh …` reads as governed.
+  printf '%s' "$cmd" | grep -q 'gate-run\.sh' && return 1
+
+  printf '%s' "$cmd" | grep -qE "$GOV_RE_RAW"    && { printf 'raw';    return 0; }
+  printf '%s' "$cmd" | grep -qE "$GOV_RE_VITEST" && { printf 'vitest'; return 0; }
+  return 1
+}

package/hooks/lib/hook.sh

@@ -7,14 +7,13 @@
 
 # ── Runtime toggles ──────────────────────────────────────────────────────────
 #
-# ECC_DISABLED_HOOKS=hook:gate-guard,hook:stop-reflect
+# ECC_DISABLED_HOOKS=hook:git-add-guard,hook:post-edit
 #   Comma-separated hook IDs to skip. Useful in CI or setup scripts.
 #
 # ECC_HOOK_PROFILE=minimal|standard (default: standard)
-#   minimal  — skips signal emissions, reflect, session-end, post-edit lint
+#   minimal  — skips the post-edit lint
 #   standard — all hooks active
-#
-# Per-hook disable: ECC_GATEGUARD=off  (alias for hook:gate-guard)
+
 
 is_hook_disabled() {
   local id="$1"
@@ -35,19 +34,11 @@ is_hook_disabled() {
   case "$profile" in
     minimal)
       case "$id" in
-        hook:tool-signal|hook:stop-reflect|hook:session-end|hook:post-edit) return 0 ;;
+        hook:post-edit) return 0 ;;
       esac
       ;;
   esac
 
-  # Per-hook env aliases
-  case "$id" in
-    hook:gate-guard)
-      local v="${ECC_GATEGUARD:-}"
-      [[ "$v" =~ ^(0|off|false|disabled|disable)$ ]] && return 0
-      ;;
-  esac
-
   return 1  # not disabled — run
 }
 

package/hooks/lib/signal.sh

@@ -15,7 +15,14 @@
 # Contract: one.ie/web/src/lib/resolvers/subscriptions.ts (world:announce · subscriptions:register)
 # Point ONE_API_URL at https://one.ie to broadcast into the live world instead of local dev.
 
-_one_world_url() { printf '%s' "${ONE_API_URL:-http://localhost:4321}/api/ask/world:announce"; }
+# The world is https://one.ie — the same door the factory executor and
+# do-signal.sh post to. Until 2026-09-05 this defaulted to localhost:4321, so
+# every session:start / session:intent signal landed in the operator's local
+# dev D1 (matched 0) or nowhere when no dev server was up. ONE_API_URL still
+# overrides for local work. Measured the same day: the prod door answers in
+# 1.3-2.0s (D1 in APAC, TypeDB in Virginia — text/factory-do.md § GATES ›
+# Signals), so the cap below is 8s, not the 2s that dropped every post.
+_one_world_url() { printf '%s' "${ONE_API_URL:-https://one.ie}/api/ask/world:announce"; }
 
 # Where the service credential lives — hooks don't reliably inherit a login shell's
 # exports, so read straight out of the web env file (same pattern do-signal.sh
@@ -90,7 +97,7 @@ emit_world() {
     hdr+=(--config "$authcfg")
   fi
 
-  ( curl -sS -o /dev/null --max-time 2 -X POST "$(_one_world_url)" \
+  ( curl -sS -o /dev/null --max-time "${ONE_WORLD_TIMEOUT:-8}" -X POST "$(_one_world_url)" \
       "${hdr[@]}" -d "$payload" >/dev/null 2>&1
     [ -n "$authcfg" ] && rm -f "$authcfg" ) &
   return 0

package/hooks/scripts/branch-pin.sh

@@ -22,6 +22,12 @@ source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/hook.sh"
 is_hook_disabled "hook:branch-pin" && exit 0
 
 PAYLOAD="${1:-}"
+# Claude Code delivers the hook payload on STDIN; argv stays first so any
+# caller that passes it positionally still works. Bounded read: a bare $(cat)
+# would hang forever on a tty or an idle pipe, freezing every Bash call.
+if [[ -z "$PAYLOAD" && ! -t 0 ]]; then
+  IFS= read -r -d '' -t 2 PAYLOAD <&0 || true
+fi
 [[ -z "$PAYLOAD" ]] && exit 0
 
 TOOL=$(printf '%s' "$PAYLOAD" | jq -r '.tool_name // empty' 2>/dev/null)

package/hooks/scripts/config-protect.sh

@@ -15,6 +15,12 @@ source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/hook.sh"
 is_hook_disabled "hook:config-protect" && exit 0
 
 PAYLOAD="${1:-}"
+# Claude Code delivers the hook payload on STDIN; argv stays first so any
+# caller that passes it positionally still works. Bounded read: a bare $(cat)
+# would hang forever on a tty or an idle pipe, freezing every Bash call.
+if [[ -z "$PAYLOAD" && ! -t 0 ]]; then
+  IFS= read -r -d '' -t 2 PAYLOAD <&0 || true
+fi
 [[ -z "$PAYLOAD" ]] && exit 0
 
 TOOL=$(printf '%s' "$PAYLOAD" | jq -r '.tool_name // empty' 2>/dev/null)

package/hooks/scripts/do-outcome-gate.sh

@@ -120,8 +120,25 @@ if ! printf '%s' "$OUTCOME" | grep -qE '^[-a-zA-Z0-9 /._&=|]+$'; then
 fi
 
 echo "do-outcome-gate: running plan kill-switch for $SLUG..." >&2
-bash -c "$OUTCOME" 2>&1
-EXIT=$?
+# THROUGH THE GOVERNOR. Fifteen text/*-todo.md carry `bun run verify` in
+# outcome:, and one of them was already ticked — so an edit to that file fired a
+# FULL suite plus an ungoverned bare vitest from a PostToolUse hook, with nothing
+# asking for a slot (text/factory-do.md § Deploy is the ship gate, measured
+# 2026-09-03). The hook is the N-agents-N-full-suites shape exactly when twelve
+# sessions each tick a box. gate-run.sh queues it behind the machine-wide cap
+# and prices it against real free memory; the wait is bounded so a hook never
+# holds an editor for the governor's default 30 minutes. No slot inside the
+# bound is NOT a pass — the box is the claim, and the box is not ticked: exit 1
+# says so and names the fix. `bun run verify` inside the string is itself
+# wrapped, and gate-run is re-entrant, so this is one slot, not two.
+GATE="$CLAUDE_PROJECT_DIR/.claude/scripts/gate-run.sh"
+if [ -f "$GATE" ]; then
+  GOVERN_QUEUE_WAIT="${DO_OUTCOME_GATE_WAIT:-120}" bash "$GATE" outcome-gate -- bash -c "$OUTCOME" 2>&1
+  EXIT=$?
+else
+  bash -c "$OUTCOME" 2>&1
+  EXIT=$?
+fi
 
 if [ $EXIT -eq 0 ]; then
   emit_signal "hook:do-outcome-gate:ok" 1 "slug=$SLUG"

package/hooks/scripts/git-add-guard.sh

@@ -22,6 +22,12 @@ source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/hook.sh"
 is_hook_disabled "hook:git-add-guard" && exit 0
 
 PAYLOAD="${1:-}"
+# Claude Code delivers the hook payload on STDIN; argv stays first so any
+# caller that passes it positionally still works. Bounded read: a bare $(cat)
+# would hang forever on a tty or an idle pipe, freezing every Bash call.
+if [[ -z "$PAYLOAD" && ! -t 0 ]]; then
+  IFS= read -r -d '' -t 2 PAYLOAD <&0 || true
+fi
 [[ -z "$PAYLOAD" ]] && exit 0
 
 TOOL=$(printf '%s' "$PAYLOAD" | jq -r '.tool_name // empty' 2>/dev/null)