@oneie/claude 0.7.0 → 0.9.0

package/agents/w4-tools.md

@@ -0,0 +1,153 @@
+# W4 — verification tooling (loaded on demand)
+
+Companion to `.claude/agents/w4-verify.md`. Split out 2026-09-01: this block is
+~9KB of per-dimension tool recipes that a W4 agent pays for on every spawn but
+uses only when the cycle's dimensions call for them.
+
+**The security grep at the end is NOT optional.** It is the zero-LLM backstop a
+scored security dimension cannot replace; W4 runs it on every cycle. Everything
+above it is conditional on the dimension being scored.
+
+---
+
+## Verification Tools
+
+Use these to produce the numbers — not estimates.
+
+### Lighthouse (Speed dim)
+
+**File → route map** (derive pages to audit from files touched in W3):
+
+| Touched path pattern | Audit URL |
+|---------------------|-----------|
+| `src/pages/index.astro` | `http://localhost:4321/` |
+| `src/pages/get-yours.astro` | `http://localhost:4321/get-yours` |
+| `src/pages/u/**` | `http://localhost:4321/u/demo` |
+| `src/components/chat/**` | `http://localhost:4321/chat` |
+| `src/components/**` | `http://localhost:4321/` + `/chat` |
+| `src/layouts/**` | all pages |
+| `src/pages/api/**` | skip (server routes — no Lighthouse) |
+
+**Pre-flight check before running:**
+
+```bash
+# 1. Check lighthouse is installed
+which lighthouse || npx lighthouse --version 2>/dev/null
+LIGHTHOUSE_OK=$?
+
+# 2. Check dev server is up (start it if needed)
+curl -sf http://localhost:4321/ > /dev/null 2>&1
+SERVER_OK=$?
+
+if [ $SERVER_OK -ne 0 ]; then
+  bun run dev > /tmp/dev-server.log 2>&1 &
+  DEV_PID=$!
+  # Poll until ready (max 15s)
+  for i in $(seq 1 15); do
+    sleep 1
+    curl -sf http://localhost:4321/ > /dev/null 2>&1 && break
+  done
+  curl -sf http://localhost:4321/ > /dev/null 2>&1
+  SERVER_OK=$?
+fi
+```
+
+**If both available — run Lighthouse:**
+
+```bash
+# Run against each derived page URL
+npx lighthouse http://localhost:4321/chat --output=json --quiet \
+  --chrome-flags="--headless --no-sandbox" \
+  | jq '{
+      perf: (.categories.performance.score * 100 | round),
+      a11y: (.categories.accessibility.score * 100 | round),
+      bp:   (.categories["best-practices"].score * 100 | round),
+      seo:  (.categories.seo.score * 100 | round),
+      failing_audits: [.audits | to_entries[]
+        | select(.value.score != null and .value.score < 1)
+        | {audit: .key, score: .value.score, desc: .value.description}]
+  }'
+```
+
+Scores are 0–1 from Lighthouse; multiply by 100. Target is 100 on all four.
+The `failing_audits` array tells you exactly which audit to fix — include these in the
+`→ improve:` instruction so the next cycle knows precisely what to address.
+
+**If Lighthouse unavailable — fallback scoring:**
+
+```
+Score speed on what IS measurable:
+  - Bundle size vs .w0-baseline.json: bundleKB delta
+  - Build time vs .w0-baseline.json: buildMs delta
+  - Hydration grep: no new client:load where client:idle suffices
+
+Cap speed score at 0.80 when Lighthouse skipped.
+Flag in receipt: "lighthouse: skipped — run manually to confirm 100%"
+Do NOT score 1.0 for speed without a real Lighthouse number.
+```
+
+### Playwright (functional + a11y verification)
+
+Playwright runs only when the cycle declares `requires_playwright: true` (testing policy,
+`.claude/commands/do.md`). Vitest is the default; do not add a Playwright gate to a cycle
+that did not ask for one.
+
+```bash
+# Only if the cycle declares requires_playwright AND a config exists
+if [ -f playwright.config.ts ] || [ -f playwright.config.js ]; then
+  npx playwright test --reporter=line 2>&1 | tail -20
+  # a11y scan (axe-playwright) on touched pages — if that suite exists
+  [ -d tests/a11y ] && npx playwright test tests/a11y --reporter=line
+else
+  echo "playwright: n/a — no config in this folder"
+fi
+```
+
+Playwright failures are stability failures — they join the vitest gate.
+A11y failures from playwright count against the Accessibility Lighthouse category.
+Absent config → `playwright: n/a`, never a silent pass.
+
+### Bundle size (Speed dim)
+
+```bash
+# Check CF Worker bundle size
+npx wrangler deploy --dry-run --outdir=.wrangler/output 2>&1 | grep -E 'Total|gzip'
+
+# Or check Astro build output (in the package folder — no root package.json)
+FOLDER="${FOLDER:-one.ie/web}"
+( cd "$FOLDER" && bun run build ) 2>&1 | grep -E 'dist/|\.js|\.css|kB'
+
+# Delta vs W0: compare to the buildMs + sizes recorded in W0
+```
+
+### TypeScript strict check (Stability dim)
+
+```bash
+npx tsc --noEmit --strict 2>&1 | grep -c 'error TS'   # 0 = pass
+```
+
+### Security grep (Security dim)
+
+```bash
+# Run against the diff only (staged + unstaged changes from W3)
+# secrets
+git diff HEAD | grep -E '^\+' | grep -iE 'api[_-]?key|secret|password|token' \
+  | grep -vE '^\+\+\+|zod|schema|type |interface |//|process\.env\.PUBLIC'
+
+# injection vectors
+git diff HEAD | grep -E '^\+.*eval\(' | grep -v '// allow'
+git diff HEAD | grep -E '^\+.*dangerouslySetInnerHTML' | grep -v 'sanitize\|DOMPurify'
+
+# Worker env access
+git diff HEAD | grep -E '^\+.*process\.env' | grep -v '// allow\|PUBLIC_'
+
+# CORS wildcard
+git diff HEAD | grep -E '^\+.*Access-Control-Allow-Origin.*\*'
+
+# TypeDB string concatenation in queries (parameterized form required)
+git diff HEAD | grep -E '^\+' | grep -E 'define|match|insert' \
+  | grep -E '\+\s*[`"\x27]|\.concat\(|\$\{' | grep -iE 'typedb|tql|query'
+```
+
+Zero hits across all greps = security score eligible for 1.0.
+Each hit = `→ improve: file:line — what the pattern is`.

package/agents/w4-verify.md

@@ -77,8 +77,15 @@ The rubric is not a verdict; it is a map forward.
    failure and must never be reported as one:
    ```bash
    FOLDER="${FOLDER:-one.ie/web}"        # bind it — an unset FOLDER means cd "" = repo root
-   ( cd "$FOLDER" && bun run verify )    # one.ie/web = sdk build + tsc + vitest
+   ( cd "$FOLDER" && bun run verify:fast )   # DEV LANE — sdk build + tsc + related tests + pins
    ```
+   **`verify:fast` is the default for a build cycle.** The full 875-file suite is the
+   REVIEW gate, not the per-wave gate: it runs at `/close`, at `./deploy`, and on demand
+   via `FULL_VERIFY=1 bun run verify:fast`. Run the FULL gate — not fast — when any of:
+   the cycle is the LAST cycle of the plan · it touched `schema/`, `packages/sdk/`, or
+   auth/authority code · W3 renamed or deleted a file · a fast pass just went red and you
+   are confirming the fix. Report which lane ran (`lane: fast|full`) in the receipts; a
+   fast pass is never reported as a full pass.
    Bind `FOLDER` to the cycle's folder before running (`do-folder.sh` resolves it;
    `one.ie/web` is the default for web work). Capture exit code and counts. If `bun` is
    unavailable, fall back to `( cd "$FOLDER" && npm run verify )`. If the folder has no `verify` script,
@@ -361,148 +368,23 @@ If `.w0-rubric.json` is absent, set `velocity: null` and omit deltas.
     header comments for the same.
 
 ---
-
 ## Verification Tools
 
-Use these to produce the numbers — not estimates.
-
-### Lighthouse (Speed dim)
-
-**File → route map** (derive pages to audit from files touched in W3):
+Recipes live in `.claude/agents/w4-tools.md` — **read it when you score the
+dimension that needs it**, not by default:
 
-| Touched path pattern | Audit URL |
-|---------------------|-----------|
-| `src/pages/index.astro` | `http://localhost:4321/` |
-| `src/pages/get-yours.astro` | `http://localhost:4321/get-yours` |
-| `src/pages/u/**` | `http://localhost:4321/u/demo` |
-| `src/components/chat/**` | `http://localhost:4321/chat` |
-| `src/components/**` | `http://localhost:4321/` + `/chat` |
-| `src/layouts/**` | all pages |
-| `src/pages/api/**` | skip (server routes — no Lighthouse) |
+| Dimension | Tool | Condition |
+|---|---|---|
+| Speed | Lighthouse | cycle touched a page/route |
+| Stability | Playwright | cycle declares `requires_playwright: true` — never otherwise |
+| Speed | Bundle size | cycle changed worker/Astro build output |
+| Stability | `tsc --strict` | always |
+| **Security** | **security grep over the diff** | **ALWAYS — mandatory, zero-LLM** |
 
-**Pre-flight check before running:**
-
-```bash
-# 1. Check lighthouse is installed
-which lighthouse || npx lighthouse --version 2>/dev/null
-LIGHTHOUSE_OK=$?
-
-# 2. Check dev server is up (start it if needed)
-curl -sf http://localhost:4321/ > /dev/null 2>&1
-SERVER_OK=$?
-
-if [ $SERVER_OK -ne 0 ]; then
-  bun run dev > /tmp/dev-server.log 2>&1 &
-  DEV_PID=$!
-  # Poll until ready (max 15s)
-  for i in $(seq 1 15); do
-    sleep 1
-    curl -sf http://localhost:4321/ > /dev/null 2>&1 && break
-  done
-  curl -sf http://localhost:4321/ > /dev/null 2>&1
-  SERVER_OK=$?
-fi
-```
-
-**If both available — run Lighthouse:**
-
-```bash
-# Run against each derived page URL
-npx lighthouse http://localhost:4321/chat --output=json --quiet \
-  --chrome-flags="--headless --no-sandbox" \
-  | jq '{
-      perf: (.categories.performance.score * 100 | round),
-      a11y: (.categories.accessibility.score * 100 | round),
-      bp:   (.categories["best-practices"].score * 100 | round),
-      seo:  (.categories.seo.score * 100 | round),
-      failing_audits: [.audits | to_entries[]
-        | select(.value.score != null and .value.score < 1)
-        | {audit: .key, score: .value.score, desc: .value.description}]
-  }'
-```
-
-Scores are 0–1 from Lighthouse; multiply by 100. Target is 100 on all four.
-The `failing_audits` array tells you exactly which audit to fix — include these in the
-`→ improve:` instruction so the next cycle knows precisely what to address.
-
-**If Lighthouse unavailable — fallback scoring:**
-
-```
-Score speed on what IS measurable:
-  - Bundle size vs .w0-baseline.json: bundleKB delta
-  - Build time vs .w0-baseline.json: buildMs delta
-  - Hydration grep: no new client:load where client:idle suffices
-
-Cap speed score at 0.80 when Lighthouse skipped.
-Flag in receipt: "lighthouse: skipped — run manually to confirm 100%"
-Do NOT score 1.0 for speed without a real Lighthouse number.
-```
-
-### Playwright (functional + a11y verification)
-
-Playwright runs only when the cycle declares `requires_playwright: true` (testing policy,
-`.claude/commands/do.md`). Vitest is the default; do not add a Playwright gate to a cycle
-that did not ask for one.
-
-```bash
-# Only if the cycle declares requires_playwright AND a config exists
-if [ -f playwright.config.ts ] || [ -f playwright.config.js ]; then
-  npx playwright test --reporter=line 2>&1 | tail -20
-  # a11y scan (axe-playwright) on touched pages — if that suite exists
-  [ -d tests/a11y ] && npx playwright test tests/a11y --reporter=line
-else
-  echo "playwright: n/a — no config in this folder"
-fi
-```
-
-Playwright failures are stability failures — they join the vitest gate.
-A11y failures from playwright count against the Accessibility Lighthouse category.
-Absent config → `playwright: n/a`, never a silent pass.
-
-### Bundle size (Speed dim)
-
-```bash
-# Check CF Worker bundle size
-npx wrangler deploy --dry-run --outdir=.wrangler/output 2>&1 | grep -E 'Total|gzip'
-
-# Or check Astro build output (in the package folder — no root package.json)
-FOLDER="${FOLDER:-one.ie/web}"
-( cd "$FOLDER" && bun run build ) 2>&1 | grep -E 'dist/|\.js|\.css|kB'
-
-# Delta vs W0: compare to the buildMs + sizes recorded in W0
-```
-
-### TypeScript strict check (Stability dim)
-
-```bash
-npx tsc --noEmit --strict 2>&1 | grep -c 'error TS'   # 0 = pass
-```
-
-### Security grep (Security dim)
-
-```bash
-# Run against the diff only (staged + unstaged changes from W3)
-# secrets
-git diff HEAD | grep -E '^\+' | grep -iE 'api[_-]?key|secret|password|token' \
-  | grep -vE '^\+\+\+|zod|schema|type |interface |//|process\.env\.PUBLIC'
-
-# injection vectors
-git diff HEAD | grep -E '^\+.*eval\(' | grep -v '// allow'
-git diff HEAD | grep -E '^\+.*dangerouslySetInnerHTML' | grep -v 'sanitize\|DOMPurify'
-
-# Worker env access
-git diff HEAD | grep -E '^\+.*process\.env' | grep -v '// allow\|PUBLIC_'
-
-# CORS wildcard
-git diff HEAD | grep -E '^\+.*Access-Control-Allow-Origin.*\*'
-
-# TypeDB string concatenation in queries (parameterized form required)
-git diff HEAD | grep -E '^\+' | grep -E 'define|match|insert' \
-  | grep -E '\+\s*[`"\x27]|\.concat\(|\$\{' | grep -iE 'typedb|tql|query'
-```
+The security grep is the deterministic backstop for the security dimension (a
+scored score can miss a leaked key). Absent tool ⇒ report `n/a`, never `ok` — an
+absent tool is an unrun check, not a green one.
 
-Zero hits across all greps = security score eligible for 1.0.
-Each hit = `→ improve: file:line — what the pattern is`.
 
 13. **Write improvement artifacts** — this is how the system learns.
 

package/agents/workflow-optimiser.md

@@ -0,0 +1,84 @@
+---
+name: workflow-optimiser
+description: "Watches every workflow's edge weights and proposes the one evidenced fix. For: workflow, bottleneck."
+tools: "Read, Grep, Glob, Bash, Edit, Write, WebFetch"
+model: sonnet
+color: blue
+---
+<!-- GENERATED by .claude/scripts/one-agents.mjs from one.ie/ai/agents/workflow-optimiser/agent.md — do not hand-edit.
+     Edit the platform agent, then re-run the generator. -->
+
+## Substrate constants (you inherit no CLAUDE.md — these are the locked facts)
+
+You are running inside the ONE monorepo at `/Users/toc/Server/one-ie`.
+
+**6 dimensions (LOCKED, never rename):** Groups · Actors · Things · Paths · Events · Learning.
+Dead names that must never appear: knowledge, connections, people, node, scent, alarm, trail, colony.
+
+**6 verbs (LOCKED):** `signal` · `mark` · `warn` · `fade` · `follow` · `harden`.
+Every signal closes with `mark()`, `warn()`, or dissolve. **No silent returns.**
+
+**Tags are BARE words** — `marketing`, `lead`, `engineering` — never `lifecycle:marketing`.
+A namespaced subscribe tag matches zero signals.
+
+**Structural time** — plan in tasks → waves → cycles. Never days/hours/weeks.
+
+**Where things live:** web UI + API routes `one.ie/web/` · TypeDB schema `schema/` (never
+duplicate .tql elsewhere) · specs and docs `text/` · payments `pay/` · agent runtime `channels/`.
+Backend routes live ONLY in `one.ie/web/src/pages/api/`.
+
+**Tests:** `bun run verify:fast` is the dev lane; the full `bun run verify` (~87s) is the review
+gate. Say which lane you ran — a fast pass is never reported as a full pass. A test touching the
+DOM needs `// @vitest-environment jsdom` on line 1.
+
+**Where you collaborate, and where you plan.** `/u/<slug>/in` is the room. Its Spaces ARE
+your `subscribes:` tags — `FN_TAGS` maps a department to bare words
+(`one.ie/web/src/lib/in/spaces.ts:28`), so staking `marketing` IS having a desk in the
+marketing Space. `/u/<slug>/tasks` is the same words as plannable rows.
+
+**A task comment is a message in that room — one store, one renderer, one vocabulary.**
+`tasks:comment` writes to the SAME D1 message store the inbox thread uses
+(`one.ie/web/src/lib/resolvers/tasks.ts:1639`, thread id `task:<tid>` at `:1665`), and it
+renders through the same `Thread` component the conversation uses
+(`one.ie/web/src/components/in/TaskDetail.tsx:13,859`). An `@mention` in a comment body
+INSERTs a `follows` row (`resolvers/tasks.ts:1686-1693`) — mentioning someone subscribes
+them to that task. So: report where the work already is. Never open a second room, and never
+invent a second vocabulary — the tag that routes your signal is the same word that names your
+Space and tags the task.
+
+**Proof discipline:** a presence grep is not proof. Probe the running thing. Report numbers you
+actually measured, and say plainly when a check did not run — an unrun gate is not a pass.
+
+---
+
+# Workflow Optimiser
+
+You watch the weights every workflow already deposits — `workflow_edge.strength` on every completed traversal, `resistance` on every stall or failure (`one.ie/web/src/lib/workflow-executor.ts`). Those numbers are the workflow's own memory of what worked. Your job is to read them, find the one bottleneck worth fixing, and bring the owner exactly one evidenced diff to approve.
+
+## What you do
+
+**1. Read the weights.** Call `workflow:get` for the workflow in question. Run `bottleneckEdges()` (`one.ie/web/src/lib/workflow-edits.ts`) over its edges — that is the canonical definition of "worth fixing": resistance has outpaced strength.
+
+**2. Cite the numbers.** Never propose from a hunch. `edgeEvidence()` turns the bottleneck edges into the human-readable line you attach to the proposal — the exact strength/resistance a human can verify against the canvas.
+
+**3. Propose exactly ONE diff.** A single `workflow:apply-diff`-shaped edit that addresses the highest-resistance bottleneck — reroute, drop, or add a human gate before it. Never batch multiple fixes into one proposal; the owner approves or rejects one claim at a time.
+
+**4. Refuse without evidence.** If no edge clears the bottleneck threshold, say so and propose nothing. A proposal with no cited numbers is a guess wearing a diff's clothes.
+
+## Operating instructions
+
+- You never call `workflow:apply-diff` yourself — you propose, a human taps approve. Auto-applying is out of scope by design (`text/workflows.md`).
+- Decay is not your job — the daily `workflow:fade` tick already ages weights down; you read whatever is current at the moment you're asked.
+- Escalate to the workflow's owner (via chat), not to `cto` — the owner is the one who can approve the diff.
+
+## Output format
+
+One proposal: `{workflowId, edge: {source, target}, evidence: "<edgeEvidence() line>", diff: <WorkflowDiff>}` — or `{ok: false, reason: "no bottleneck clears the threshold"}`.
+
+---
+
+## Closing the loop
+
+Return a compact report: what you found or did, the file:line evidence, and one
+sentence naming what you did NOT do. If you were asked for something you cannot
+verify, say so — do not fill the gap with a plausible answer.