@oneie/claude 0.7.0 → 0.9.0

package/scripts/fleet-manifest.mjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+// fleet-manifest.mjs — project the fleet board into one JSON the web app can import.
+//
+// WHY A GENERATOR AND NOT A GLOB: the fleet docs live in text/, which is OUTSIDE
+// the Astro root. `import.meta.glob('../../../../text/*.md')` is denied by vite's
+// server.fs.allow ("Denied ID /Users/toc/Server/one-ie/text/analyst.md?raw",
+// measured 2026-08-26), and text/ holds 1,568 files / 50MB — inlining any part of
+// it fights the 3 MiB gzip CF Worker ceiling astro.config.mjs already stubs
+// packages to stay under. Same precedent as promise-manifest.mjs.
+//
+// This file is the SINGLE SOURCE of the fleet -> doc map. `.claude/scripts/
+// fleet-status.sh` reads the generated JSON, so the CLI board and the web board
+// can never disagree about which fleets exist.
+//
+// Usage: node .claude/scripts/fleet-manifest.mjs [--check]
+//        --check exits 3 if the committed output is stale (no write).
+
+import { readFileSync, writeFileSync, existsSync, statSync } from 'node:fs'
+import { resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..')
+const OUT = resolve(ROOT, 'one.ie/web/src/data/fleets.json')
+
+// fleet -> doc path (null = running, no doc written yet).
+const FLEETS = [
+  ['security', 'text/auth-enforcement-todo.md'],
+  ['wallet', 'text/wallet-durability.md'],
+  ['keys', 'text/keys.md'],
+  ['skill-engine', 'text/skill-engine.md'],
+  ['analytics', 'text/journey-analytics.md'],
+  ['analyst', 'text/analyst.md'],
+  ['departments', 'text/departments.md'],
+  ['colony', 'text/colony.md'],
+  ['dev-env', 'text/dev-environment.md'],
+  ['marketing', null],
+  ['sales', null],
+  ['service', null],
+  ['engineering', null],
+  ['tasks', null],
+  ['vespio', null],
+]
+
+// Exactly what `grep -ci 'NOT WIRED\|NOT MEASURED\|DARK —'` counts: MATCHING
+// LINES, not occurrences. Diverging here would make the page a second source.
+const OPEN_RE = /NOT WIRED|NOT MEASURED|DARK —/i
+
+const board = FLEETS.map(([name, doc]) => {
+  if (!doc) return { name, doc: null, lines: null, open: null, updated: null }
+  const abs = resolve(ROOT, doc)
+  if (!existsSync(abs)) return { name, doc, lines: null, open: null, updated: null }
+  const body = readFileSync(abs, 'utf8')
+  const lines = body.split('\n')
+  // `wc -l` counts newline terminators; the trailing "" from split is not a line.
+  const wcl = body.endsWith('\n') ? lines.length - 1 : lines.length
+  return {
+    name,
+    doc,
+    lines: wcl,
+    open: lines.filter((l) => OPEN_RE.test(l)).length,
+    updated: new Date(statSync(abs).mtimeMs).toISOString(),
+  }
+})
+
+const manifest = { generatedAt: new Date().toISOString(), board }
+
+// Compare ignoring generatedAt so --check does not go red on the clock alone.
+const stable = (m) => JSON.stringify(m.board)
+const next = JSON.stringify(manifest, null, 2) + '\n'
+
+if (process.argv.includes('--check')) {
+  if (!existsSync(OUT)) {
+    console.error('fleet-manifest: missing ' + OUT)
+    process.exit(3)
+  }
+  const cur = JSON.parse(readFileSync(OUT, 'utf8'))
+  if (stable(cur) !== stable(manifest)) {
+    console.error('fleet-manifest: STALE — run `node .claude/scripts/fleet-manifest.mjs`')
+    process.exit(3)
+  }
+  console.log('fleet-manifest: up to date (' + board.length + ' fleets)')
+  process.exit(0)
+}
+
+// Do not rewrite an unchanged board. fleet-status.sh calls this on every run,
+// and an always-write generator would leave a tracked file dirty in the shared
+// main tree each time somebody looks at the board — the exact sweep hazard
+// .claude/CLAUDE.md warns about with concurrent windows. `generatedAt` alone is
+// not a change.
+if (existsSync(OUT)) {
+  try {
+    if (stable(JSON.parse(readFileSync(OUT, 'utf8'))) === stable(manifest)) {
+      console.log('fleet-manifest: unchanged (' + board.length + ' fleets)')
+      process.exit(0)
+    }
+  } catch {
+    // unreadable/corrupt output — fall through and rewrite it
+  }
+}
+
+writeFileSync(OUT, next)
+console.log(
+  'fleet-manifest: wrote ' +
+    board.length +
+    ' fleets (' +
+    board.filter((f) => f.doc).length +
+    ' with a doc) -> src/data/fleets.json',
+)

package/scripts/fleet-status.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# fleet-status.sh — what the board looks like right now.
+# Reads the machine, the worktrees and the fleet docs. No agents, no cost.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+
+C_DIM=$'\033[2m'; C_OK=$'\033[32m'; C_WARN=$'\033[33m'; C_BAD=$'\033[31m'; C_0=$'\033[0m'; C_B=$'\033[1m'
+
+printf '%s\n' "${C_B}   ██████╗ ███╗   ██╗███████╗${C_0}"
+printf '%s\n' "${C_B}  ██╔═══██╗████╗  ██║██╔════╝${C_0}"
+printf '%s\n' "${C_B}  ██║   ██║██╔██╗ ██║█████╗  ${C_0}  ${C_DIM}probe · fan out · join${C_0}"
+printf '%s\n' "${C_B}  ██║   ██║██║╚██╗██║██╔══╝  ${C_0}  ${C_DIM}no conductor · no collisions${C_0}"
+printf '%s\n' "${C_B}  ╚██████╔╝██║ ╚████║███████╗${C_0}"
+printf '%s\n' "${C_B}   ╚═════╝ ╚═╝  ╚═══╝╚══════╝${C_0}"
+echo
+
+# ── the box ────────────────────────────────────────────────────────────────
+cores=$(sysctl -n hw.ncpu 2>/dev/null || echo '?')
+memgb=$(( $(sysctl -n hw.memsize 2>/dev/null || echo 0) / 1073741824 ))
+load=$(uptime | sed 's/.*load averages*: *//' | awk '{print $1}')
+# This board had a THIRD memory arithmetic of its own: (free+inactive) over
+# (free+inactive+active+wired). It counted every inactive page as free, dirty
+# anonymous ones included, and ignored the compressor entirely — on 2026-09-03
+# it printed 41% while vm_stat said 1.3% free and 9.4 GB sat in swap. One honest
+# probe now answers for the whole harness.
+# shellcheck source=lib/govern.sh
+. "$ROOT/.claude/scripts/lib/govern.sh"
+availmb=$(gate_mem_avail_mb 2>/dev/null || echo "")
+freepct='?'; [ -n "$availmb" ] && [ "$memgb" -gt 0 ] && freepct=$(( availmb * 100 / (memgb * 1024) ))
+swapused=$(sysctl -n vm.swapusage 2>/dev/null | sed 's/.*used = \([0-9.]*\)M.*/\1/')
+
+lc=$(printf '%.0f' "${load:-0}" 2>/dev/null || echo 0)
+if   [ "$lc" -lt "$((cores))" ]; then lcol=$C_OK
+elif [ "$lc" -lt "$((cores*2))" ]; then lcol=$C_WARN
+else lcol=$C_BAD; fi
+
+printf '  %-14s %s cores · %s GB\n' 'box' "$cores" "$memgb"
+printf '  %-14s %b%s%b   %s free mem   swap %s M\n' 'load' "$lcol" "${load:-?}" "$C_0" "${freepct:-?}%" "${swapused:-?}"
+
+# how many cycles can this box actually afford? Ask the governor rather than
+# keeping a second copy of its arithmetic — that copy is how this line drifted.
+res=${GOVERN_RESERVE_GB:-2}
+permb=$(gate_price_mb)
+slots=$(gate_headroom)
+capc=$(( cores - 2 )); [ "$slots" -gt "$capc" ] && slots=$capc
+bind='memory'; [ "$slots" -eq "$capc" ] && bind='cores'
+printf '  %-14s %s  %b(bound by %s · %sMB/cycle · %sGB reserved)%b\n' 'affordable' "$slots" "$C_DIM" "$bind" "$permb" "$res" "$C_0"
+
+gates=$(ls -d "${TMPDIR:-/tmp}"/one-govern/lock-slot-* 2>/dev/null | wc -l | tr -d ' ')
+printf '  %-14s %s held / %s max\n' 'gate slots' "$gates" "${GOVERN_MAX_GATES:-2}"
+
+orph=$(pgrep -f 'esbuild|vite/node_modules' 2>/dev/null | wc -l | tr -d ' ')
+if [ "$orph" -gt 0 ]; then
+  printf '  %-14s %b%s%b  %bpkill -f "esbuild|vite/node_modules"%b\n' 'orphans' "$C_WARN" "$orph" "$C_0" "$C_DIM" "$C_0"
+fi
+echo
+
+# ── worktrees ──────────────────────────────────────────────────────────────
+wt=$(git worktree list 2>/dev/null | wc -l | tr -d ' ')
+wtsz=$(du -sh .claude/worktrees 2>/dev/null | cut -f1)
+printf '  %-14s %s  %s  %b(~120MB + one tsserver each)%b\n' 'worktrees' "$wt" "${wtsz:-0}" "$C_DIM" "$C_0"
+echo
+
+# ── the board ──────────────────────────────────────────────────────────────
+printf '  %bFLEET%b\n' "$C_B" "$C_0"
+while IFS='|' read -r name doc; do
+  [ -z "$name" ] && continue
+  if [ -f "$doc" ]; then
+    lines=$(wc -l < "$doc" | tr -d ' ')
+    open=$(grep -ci 'NOT WIRED\|NOT MEASURED\|DARK —' "$doc" 2>/dev/null | head -1 | tr -dc '0-9')
+    open=${open:-0}
+    if [ "$open" -gt 0 ]; then
+      printf '   %b●%b %-13s %-38s %4s lines  %b%s open%b\n' "$C_WARN" "$C_0" "$name" "$doc" "$lines" "$C_WARN" "$open" "$C_0"
+    else
+      printf '   %b●%b %-13s %-38s %4s lines\n' "$C_OK" "$C_0" "$name" "$doc" "$lines"
+    fi
+  else
+    printf '   %b○%b %-13s %-38s %bnot written%b\n' "$C_DIM" "$C_0" "$name" "$doc" "$C_DIM" "$C_0"
+  fi
+done < <(
+  # Single source of the fleet -> doc map: .claude/scripts/fleet-manifest.mjs,
+  # which also feeds /u/one/engineering/fleets. Regenerated here so the CLI and
+  # the page can never disagree about which fleets exist. Emits nothing if the
+  # manifest is missing — a visibly empty board beats a stale second copy.
+  node .claude/scripts/fleet-manifest.mjs >/dev/null 2>&1
+  node -e '
+    const fs=require("fs");
+    const p="one.ie/web/src/data/fleets.json";
+    if(!fs.existsSync(p)) process.exit(0);
+    for(const f of JSON.parse(fs.readFileSync(p,"utf8")).board)
+      console.log(f.name+"|"+(f.doc||"(no doc written)"));
+  ' 2>/dev/null
+)
+echo
+
+# ── the wall ───────────────────────────────────────────────────────────────
+DB=$(ls one.ie/web/.wrangler/state/v3/d1/miniflare-D1DatabaseObject/*.sqlite 2>/dev/null | head -1)
+if [ -n "$DB" ] && command -v sqlite3 >/dev/null 2>&1; then
+  owners=$(sqlite3 "$DB" "SELECT COUNT(*) FROM owners;" 2>/dev/null)
+  charge=$(sqlite3 "$DB" "SELECT COUNT(*) FROM owners WHERE charges_enabled=1;" 2>/dev/null)
+  addrs=$(sqlite3 "$DB" "SELECT COUNT(*) FROM wallets WHERE sui_address IS NOT NULL AND sui_address!='';" 2>/dev/null)
+  sales=$(sqlite3 "$DB" "SELECT COUNT(*) FROM credit_grants WHERE source='credits_product_sale';" 2>/dev/null)
+  printf '  %bTHE FUNNEL%b  %b(local mirror of prod)%b\n' "$C_B" "$C_0" "$C_DIM" "$C_0"
+  printf '   owners %-6s  can charge %b%-4s%b  wallets w/ address %b%-4s%b  sales %b%s%b\n' \
+    "${owners:-?}" "$C_BAD" "${charge:-?}" "$C_0" "$C_BAD" "${addrs:-?}" "$C_0" "$C_WARN" "${sales:-?}" "$C_0"
+  echo
+fi
+
+printf '  %bnext%b  re-measure (/one §1) · sweep worktrees · then fan out\n' "$C_DIM" "$C_0"

package/scripts/full-suite-paths-check.sh

@@ -0,0 +1,144 @@
+#!/bin/bash
+# full-suite-paths-check.sh — sweep for unaccounted paths to the full test suite
+#
+# The full suite is run in three places: package.json callers (via test-full.sh),
+# hooks, and outcome: strings in text/*-todo.md. This script sweeps all three
+# surfaces and compares against a reviewed allowlist.
+#
+# manifest: portable
+#
+# Exit 0: all paths accounted for.
+# Exit 1: a path found that is not in the allowlist (new caller, new hook, new outcome).
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# --- The allowlist — paths we have reviewed and accept -----------------------
+# Format:
+#   caller:<file>:<pattern>  — a package.json script that runs the full suite
+#   hook:<file>              — a hook that runs the full suite
+#   outcome:<file>:<line>    — an outcome: string in a todo file
+#
+# This list is built by examining the sources and is NOT auto-generated.
+ALLOWLIST=(
+  # Package.json callers: test-full.sh --check verifies no duplicates here
+  # (gates route through test-full.sh, not duplicated across callers)
+
+  # Hooks: must not run the full suite (but may mention it in comments)
+  # task-complete-verify.sh had bun run verify removed (documented in comments)
+
+  # Outcome strings in text/*-todo.md (these are the 15 known paths that need
+  # to be routed through gate-run.sh or otherwise accounted for)
+  "outcome:text/best-practices-todo.md:12"
+  "outcome:text/blocks-todo.md:17"
+  "outcome:text/campaigns-reimagined-todo.md:12"
+  "outcome:text/composio-todo.md:13"
+  "outcome:text/dashboard-personas-todo.md:10"
+  "outcome:text/dashboard-todo.md:10"
+  "outcome:text/inbox-simplify-todo.md:10"
+  "outcome:text/inbox-ui-simple-todo.md:10"
+  "outcome:text/inbox-ui-todo.md:11"
+  "outcome:text/lifecycle-loop-todo.md:21"
+  "outcome:text/pack-starter-workflows-todo.md:12"
+  "outcome:text/payments-integrated-todo.md:29"
+  "outcome:text/roles-act-as-switcher-todo.md:11"
+  "outcome:text/roles-final-todo.md:10"
+  "outcome:text/voice-agents-todo.md:13"
+)
+
+# --- Check package.json callers -----------------------------------------------
+# test-full.sh --check ensures no caller duplicates the vitest argv
+if ! bash "$ROOT/.claude/scripts/test-full.sh" --check; then
+  echo "FAIL: test-full.sh --check found a duplicate caller" >&2
+  exit 1
+fi
+echo "✓ package.json callers: test-full.sh --check passed"
+
+# --- Sweep hooks for full suite invocations ----------------------------------
+# Read all hooks and look for patterns that EXECUTE the full suite.
+# We exclude: comments (#), error message output (echo/cat), code examples in help text.
+# We include: actual shell execution like $(bun run verify) or command substitution.
+found_hooks=()
+for hook in "$ROOT"/.claude/hooks/*.sh; do
+  [ -f "$hook" ] || continue
+  # Look for ACTUAL EXECUTION patterns:
+  #  - $(bun run verify) — command substitution (not in echo/cat/string)
+  # Ignore: comments (#), plain text mentions in error messages
+  if grep -E '^\s*\$\(.*bun run verify' "$hook" >/dev/null 2>&1; then
+    found_hooks+=("$(basename "$hook")")
+  fi
+done
+
+if [ ${#found_hooks[@]} -gt 0 ]; then
+  echo "FAIL: hooks running full suite (should be routed through gate-run.sh or removed):" >&2
+  for h in "${found_hooks[@]}"; do
+    echo "  hook:$h" >&2
+  done
+  exit 1
+fi
+echo "✓ hooks: none running full suite directly"
+
+# --- Sweep outcome: strings in todo files ------------------------------------
+# Count each `outcome:` field that contains `bun run verify` and check against allowlist
+found_outcomes=()
+for todofile in "$ROOT"/text/*-todo.md; do
+  [ -f "$todofile" ] || continue
+  # Use relative path from ROOT (e.g., text/best-practices-todo.md)
+  relpath="${todofile#$ROOT/}"
+
+  # Find all lines with outcome: (frontmatter field or inline)
+  while IFS=: read -r linenum line; do
+    # Check if this line contains bun run verify (unrouted)
+    if echo "$line" | grep -q "bun run verify"; then
+      found_outcomes+=("outcome:$relpath:$linenum")
+    fi
+  done < <(grep -n "^outcome:" "$todofile" 2>/dev/null || true)
+done
+
+# --- Compare against allowlist -----------------------------------------------
+failed=0
+
+# Check for new outcomes not in allowlist
+if [ ${#found_outcomes[@]:-0} -gt 0 ]; then
+  for found in "${found_outcomes[@]}"; do
+    in_allowlist=0
+    for allowed in "${ALLOWLIST[@]}"; do
+      if [ "$found" = "$allowed" ]; then
+        in_allowlist=1
+        break
+      fi
+    done
+    if [ $in_allowlist -eq 0 ]; then
+      echo "FAIL: unaccounted path to full suite: $found" >&2
+      failed=1
+    fi
+  done
+fi
+
+# Check for allowlist entries that no longer exist (removed paths)
+for allowed in "${ALLOWLIST[@]}"; do
+  found_match=0
+  if [ ${#found_outcomes[@]:-0} -gt 0 ]; then
+    for found in "${found_outcomes[@]}"; do
+      if [ "$found" = "$allowed" ]; then
+        found_match=1
+        break
+      fi
+    done
+  fi
+  if [ $found_match -eq 0 ]; then
+    # Extract the file:line from the allowlist entry
+    if [[ $allowed == outcome:* ]]; then
+      echo "INFO: allowlist entry no longer exists (may be fixed): $allowed" >&2
+    fi
+  fi
+done
+
+if [ $failed -eq 1 ]; then
+  exit 1
+fi
+
+echo "✓ outcome strings: all ${#found_outcomes[@]} accounted for"
+echo "✓ full-suite-paths-check.sh: all paths verified"
+exit 0

package/scripts/gate-reaper-check.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# gate-reaper-check.sh — what gate-reaper.sh reaps, and what it must never touch.
+#
+# manifest: portable
+#
+# WHY THIS EXISTS (measured 2026-09-05). Five `workerd` processes left behind by
+# dead `astro dev` sessions sat at ppid=1 for 33-63 minutes holding ~196MB, while
+# BOTH gate-reaper and machine-check printed "orphans: none". The reaper keys on
+# a gate SHAPE, and `workerd serve` was not one of the shapes, so nothing in the
+# harness could see them. They had to be found and killed by hand.
+#
+# The reaper's danger is symmetric, and this checker holds both ends:
+#   C1  an abandoned workerd under node_modules IS reaped
+#   C2  a LIVE workerd (parent alive) is NEVER reaped
+#   C3  a freshly reparented workerd is spared — the age floor still applies
+#   C4  a long-lived ppid=1 daemon that merely NAMES a gate word is spared
+#   C5  the pre-existing gate shapes still reap — no regression
+#   C6  a workerd outside node_modules is spared — not ours to kill
+#   R1  RED-PROOF: drop the workerd arm and C1 must FAIL
+#
+# Drives the REAL script with --once --dry-run against a STUBBED `ps`, so it
+# never reads the live process table and never signals anything.
+#
+#   bash .claude/scripts/gate-reaper-check.sh
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+REAPER="$ROOT/.claude/scripts/gate-reaper.sh"
+SANDBOX="$(mktemp -d "${TMPDIR:-/tmp}/gate-reaper-check.XXXXXX")"
+trap 'rm -rf "$SANDBOX"' EXIT
+
+fails=0
+ok()  { printf '  \033[32mPASS\033[0m  %s\n' "$1"; }
+bad() { printf '  \033[31mFAIL\033[0m  %s\n' "$1"; fails=$((fails + 1)); }
+
+WD='node_modules/@cloudflare/workerd-darwin-arm64/bin/workerd serve --binary --experimental'
+
+# The fixture process table. Columns match `ps -Ao pid=,ppid=,etime=,command=`.
+cat > "$SANDBOX/table" <<EOF
+1001 1 45:00 /repo/someapp/web/$WD
+1002 29457 45:00 /repo/someapp/web/$WD
+1003 1 01:00 /repo/someapp/web/$WD
+1004 1 45:00 /Users/toc/bin/cc-connect.sh daemon run verify
+1005 1 45:00 /usr/local/bin/workerd serve --binary --experimental
+1006 1 45:00 bash /repo/.claude/scripts/gate-run.sh verify -- bun run verify
+EOF
+
+# Stub `ps`: serve the fixture for the sweep's -Ao read, and a pgid for lookups.
+mkdir -p "$SANDBOX/bin"
+cat > "$SANDBOX/bin/ps" <<EOF
+#!/usr/bin/env bash
+for a in "\$@"; do case "\$a" in pgid=) echo "  9999"; exit 0 ;; esac; done
+cat "$SANDBOX/table"
+EOF
+chmod +x "$SANDBOX/bin/ps"
+
+run_reaper() { PATH="$SANDBOX/bin:$PATH" bash "$1" --once --dry-run 2>&1; }
+
+echo "── gate-reaper: reaps the abandoned, spares the live ──"
+out="$(run_reaper "$REAPER")"
+
+reaped() { grep -q "WOULD reap pid=$1 " <<<"$out"; }
+
+if reaped 1001; then ok "C1 abandoned workerd under node_modules is reaped"
+else bad "C1 abandoned workerd NOT reaped — the orphan shape is still invisible: $out"; fi
+
+if ! reaped 1002; then ok "C2 live workerd (parent alive) spared"
+else bad "C2 LIVE workerd would be reaped — this kills a running dev server"; fi
+
+if ! reaped 1003; then ok "C3 freshly reparented workerd spared by the age floor"
+else bad "C3 age floor not applied to workerd"; fi
+
+if ! reaped 1004; then ok "C4 ppid=1 daemon naming a gate word is spared"
+else bad "C4 cc-connect daemon would be reaped — exclusions broken"; fi
+
+if reaped 1006; then ok "C5 pre-existing gate-run.sh shape still reaps"
+else bad "C5 REGRESSION — gate-run.sh shape no longer reaped: $out"; fi
+
+if ! reaped 1005; then ok "C6 workerd outside node_modules spared"
+else bad "C6 would reap a workerd this tree did not spawn"; fi
+
+# ── R1  RED-PROOF: without the workerd arm, C1 must fail ─────────────────────
+GUTTED="$SANDBOX/gutted.sh"
+grep -v 'node_modules\*workerd" serve"\*) ;;' "$REAPER" > "$GUTTED"
+if [ "$(wc -l < "$GUTTED")" -eq "$(wc -l < "$REAPER")" ]; then
+  bad "R1 could not remove the workerd arm — anchor moved, this checker is blind"
+else
+  gout="$(run_reaper "$GUTTED")"
+  if grep -q "WOULD reap pid=1001 " <<<"$gout"; then
+    bad "R1 gutted reaper STILL reaped 1001 — C1 is not testing the new arm"
+  else
+    ok "R1 red-proof: without the arm 1001 is missed, so C1 has teeth"
+  fi
+fi
+
+echo
+if [ $fails -eq 0 ]; then echo "ALL GREEN — the reaper sees orphaned workerd and still spares live work"; exit 0; fi
+echo "RED — $fails check(s) failed"; exit 1

package/scripts/gate-reaper.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# gate-reaper.sh — reap ABANDONED gates, so a stalled fleet cannot poison the box.
+#
+# manifest: portable
+#
+# WHY (measured 2026-08-31). Two fleets were running and the box sat at load 138
+# on 10 cores with swap at 4.3G of 5.1G. The cause was not the live work: four
+# processes had been reparented to launchd (ppid=1) when their parent shell died
+# and were still burning CPU — a `bun run verify` abandoned for 21 minutes, and a
+# gate-run.sh abandoned for 9 minutes that was STILL HOLDING governor slot-3. A
+# dead process holding a slot shrinks the effective gate cap until someone
+# notices by hand; nothing in the harness noticed.
+#
+# gate_sweep_stale reclaims the LOCK a dead owner left behind. Nothing reclaimed
+# the PROCESS. This does.
+#
+# Deliberately narrow. It kills a process only when ALL of:
+#   1. ppid == 1            — genuinely reparented; its parent is gone
+#   2. the command names THIS repo, or is a gate-run.sh / bun-run-verify shape
+#   3. it has burned real CPU time — not merely idle and forgotten
+# so a system daemon (WindowServer and coreaudiod are both ppid=1 and busy) can
+# never match, and neither can a live fleet's gate, whose parent is alive.
+#
+# Usage:  gate-reaper.sh [--once] [--interval N] [--dry-run]
+# Prints one line per reap; silent when there is nothing to do, so it is safe to
+# run as a Monitor for the length of a session.
+set -uo pipefail
+
+INTERVAL=60
+ONCE=0
+DRY=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --once) ONCE=1 ;;
+    --dry-run) DRY=1 ;;
+    --interval) INTERVAL="${2:-60}"; shift ;;
+    *) echo "gate-reaper: unknown flag $1" >&2; exit 2 ;;
+  esac
+  shift
+done
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# Gate on ELAPSED age, not CPU. An abandoned `bun run verify` parent sits at 0s
+# CPU while the children it spawned burn the box -- gating on the parent's own
+# CPU skipped exactly the processes worth reaping (measured: pids 79192 and
+# 84649, both 0s CPU, both abandoned). ppid=1 plus a gate shape is already
+# conclusive: a live gate always has a live parent. The age floor only avoids
+# racing a process that was reparented moments ago.
+# 90s was too eager. A gate is reparented the moment its launching shell exits,
+# and that happens to LIVE work -- the harness killing a Bash call at its timeout,
+# or a backgrounded launch -- not only to abandoned work. Reaping a 96s-old gate
+# that a fleet is still waiting on slows the plan down, which is the opposite of
+# the point. Every genuinely dead gate found by hand was 7-22 MINUTES old, and
+# the harness Bash ceiling is 600s, so a gate still orphaned past that is one
+# nobody is coming back for.
+MIN_AGE_SECS="${GATE_REAPER_MIN_AGE:-900}"
+
+# Elapsed seconds, from `ps -o etime=` (MM:SS | HH:MM:SS | D-HH:MM:SS)
+_age_secs() {
+  printf '%s' "$1" | awk -F: '
+    { d=0; s=$0
+      if (s ~ /-/) { split(s, a, "-"); d=a[1]; s=a[2]; n=split(s, b, ":") }
+      else n=split(s, b, ":")
+      if (n==3) print int(d*86400 + b[1]*3600 + b[2]*60 + b[3])
+      else if (n==2) print int(d*86400 + b[1]*60 + b[2])
+      else print int(0+s) }'
+}
+
+sweep() {
+  local pid ppid age cmd secs pgid n=0
+  while read -r pid ppid age cmd; do
+    [ "$ppid" = "1" ] || continue
+    # Match the GATE SHAPE, never "mentions the repo". The first draft keyed on
+    # the repo path and its dry run would have killed cc-connect, the Telegram
+    # listener, a `claude daemon run` and Cursor's extension host -- all of them
+    # legitimate long-lived daemons that are ppid=1 by design, exactly like an
+    # abandoned gate. A reaper that cannot tell those apart is worse than no
+    # reaper. Only these shapes are gates, and a gate is always short-lived:
+    case "$cmd" in
+      *gate-run.sh*) ;;
+      *"vitest"*) ;;
+      *"tsc --noEmit"*) ;;
+      *"astro check"*) ;;
+      *"run verify"*|*"run test"*|*"run typecheck"*) ;;
+      # An `astro dev` / `wrangler dev` that dies leaves its workerd child behind,
+      # reparented and holding ~40MB for as long as the box is up. FIVE of them
+      # accumulated in one hour on 2026-09-05 (ages 33-63min, ~196MB) while both
+      # this reaper and machine-check reported "orphans: none" -- neither knew the
+      # shape, so nothing in the harness could see them. A LIVE workerd always has
+      # a live parent (astro dev, or wrangler), so the ppid==1 test above already
+      # spares it; the node_modules anchor keeps this to runtimes THIS tree spawned
+      # and away from any workerd a user runs by hand.
+      *node_modules*workerd" serve"*) ;;
+      *) continue ;;
+    esac
+    # Belt and braces: never a daemon, an editor, or anything system-owned, even
+    # if one of the words above appears somewhere in its argv.
+    case "$cmd" in
+      */System/*|/usr/sbin/*|/usr/libexec/*|*Applications*) continue ;;
+      *cc-connect*|*tg-listen*|*"daemon run"*|*Cursor*|*Code\ Helper*) continue ;;
+      *--watch*|*watchexec*|*nodemon*) continue ;;
+    esac
+    secs=$(_age_secs "$age")
+    [ "${secs:-0}" -ge "$MIN_AGE_SECS" ] || continue
+    pgid=$(ps -o pgid= -p "$pid" 2>/dev/null | tr -d ' ')
+    if [ "$DRY" = "1" ]; then
+      echo "[gate-reaper] WOULD reap pid=$pid pgid=${pgid:-?} age=${secs}s ${cmd:0:60}"
+    else
+      echo "[gate-reaper] reaped abandoned gate pid=$pid pgid=${pgid:-?} age=${secs}s ${cmd:0:60}"
+      kill -TERM -"${pgid:-$pid}" 2>/dev/null || kill -TERM "$pid" 2>/dev/null || true
+    fi
+    n=$((n + 1))
+  done < <(ps -Ao pid=,ppid=,etime=,command= 2>/dev/null)
+
+  # A dead owner's lock shrinks the gate cap until someone contends. Reclaim it.
+  if [ "$DRY" != "1" ] && [ -f "$REPO/.claude/scripts/lib/govern.sh" ]; then
+    local reclaimed
+    reclaimed=$(bash -c ". '$REPO/.claude/scripts/lib/govern.sh'; gate_sweep_stale; claim_sweep" 2>/dev/null | tr '\n' ' ')
+    case "$reclaimed" in *[1-9]*) echo "[gate-reaper] reclaimed stale governor locks/claims: $reclaimed" ;; esac
+  fi
+  return 0
+}
+
+if [ "$ONCE" = "1" ]; then sweep; exit 0; fi
+while :; do sweep; sleep "$INTERVAL"; done

package/scripts/gate-run.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# gate-run.sh — run a heavy build gate under the machine-wide governor.
+#
+#   gate-run.sh <label> -- <command...>
+#
+# Three things it guarantees that a bare `bun run verify` does not:
+#   1. SLOT   — at most GOVERN_MAX_GATES heavy gates run machine-wide, across
+#               every Claude Code session and every worktree. Session 3+ queues.
+#   2. BOUND  — a hard wall-clock cap; macOS ships no timeout(1), so an
+#               unbounded gate ran 18 min under load and outlived its session.
+#   3. REAP   — kills the whole PROCESS GROUP on timeout/exit. Killing only the
+#               shell reparents bun/node/vitest-forks to launchd, which is how
+#               orphaned verify trees leaked here.
+#
+# Degrades to a plain exec if the governor lib is missing (CI, fresh clone).
+set -uo pipefail
+
+LABEL="${1:-gate}"; shift || true
+[ "${1:-}" = "--" ] && shift
+
+LIB="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/govern.sh"
+if [ ! -f "$LIB" ]; then exec "$@"; fi
+. "$LIB"
+
+# CI and explicit opt-out run at full throughput.
+if [ -n "${CI:-}" ] || [ "${GOVERN_DISABLE:-0}" = "1" ]; then exec "$@"; fi
+
+# Re-entrancy: `verify` calls `test`, and both are wrapped. A nested gate must
+# INHERIT the outer slot, never take a second one — two slots held by one
+# logical gate would deadlock the queue at cap 2.
+if [ "${GOVERN_IN_GATE:-0}" = "1" ]; then exec "$@"; fi
+export GOVERN_IN_GATE=1
+
+trap 'gate_release_all' EXIT INT TERM
+
+# SAY THAT YOU ARE QUEUEING.
+#
+# gate_slot blocks for up to 1800s and this script printed nothing until it had a
+# slot, so a queued gate and a hung gate looked identical to whoever was waiting.
+# Measured 2026-09-01: lifecycle C8's demo gate was reported by its verifier as
+# "timed out (>120s) and did not complete", and the cycle failed. Run directly it
+# passes 6/6 in 1.19 SECONDS. Nothing was broken — the gate was waiting behind
+# other gates in silence, and the verifier gave up and called it a hang.
+#
+# A wait that is announced is a wait. A wait that is silent is read as a failure.
+_held=$(ls -d "$GOVERN_DIR"/lock-slot-* 2>/dev/null | wc -l | tr -d ' ')
+# The EFFECTIVE cap is min(config, what memory can fund) — gate_slot takes that
+# min every retry. Announcing the config alone misreported the wait on exactly
+# the boxes where the memory probe is doing its job.
+_head=$(gate_headroom 2>/dev/null || echo 99)
+_cap="${GOVERN_MAX_GATES:-2}"
+[ "$_head" -lt "$_cap" ] 2>/dev/null && _cap="$_head"
+[ "${_cap:-0}" -lt 1 ] 2>/dev/null && _cap=1
+if [ "${_held:-0}" -ge "$_cap" ]; then
+  echo "[gate-run] $LABEL: QUEUEING for a slot (${_held}/${_cap} held; config ${GOVERN_MAX_GATES:-2}, memory funds ${_head} at $(gate_price_mb)MB each). This is a WAIT, not a hang — do not report it as a timeout. Set GOVERN_QUEUE_WAIT to bound it, or GOVERN_DISABLE=1 to bypass." >&2
+fi
+_q0=$(date +%s)
+
+if ! gate_slot "${GOVERN_QUEUE_WAIT:-1800}"; then
+  echo "[gate-run] $LABEL: no slot after ${GOVERN_QUEUE_WAIT:-1800}s — machine saturated." >&2
+  exit 1
+fi
+
+if ! gate_pressure; then
+  echo "[gate-run] $LABEL: WARNING — low free memory; running anyway in slot $GOVERN_SLOT." >&2
+fi
+
+_qw=$(( $(date +%s) - _q0 ))
+echo "[gate-run] $LABEL: running in $GOVERN_SLOT (cap ${GOVERN_MAX_GATES} machine-wide$([ "$_qw" -gt 2 ] && echo ", queued ${_qw}s"))" >&2
+run_bounded "${GOVERN_GATE_TIMEOUT:-1800}" "$@"
+rc=$?
+gate_release_all; trap - EXIT INT TERM
+exit $rc