@oneie/claude 0.7.0 → 0.9.0

package/scripts/sdk-build-cached.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# sdk-build-cached.sh — build @oneie/sdk, or skip when its sources have not moved.
+#
+# manifest: needs-env
+#
+# WHY. `cd packages/sdk && bun run build` ran on EVERY verify-fast pass, and it is
+# 2.0s of the 2.6s total deterministic gate cost of a /do cycle -- 78%. Measured
+# 2026-09-01: hashing dist before and after a rebuild on an unchanged tree gives
+# the SAME digest. The build is deterministic, so on an unchanged src it is two
+# seconds spent reproducing bytes that were already there.
+#
+# dist is a pure function of src (the same reasoning tsc-cached.sh uses to key on
+# src rather than on dist mtimes, which every rebuild churns). So: fingerprint
+# src, skip when it matches the fingerprint the current dist was built from.
+#
+# SAFETY. The stamp lives INSIDE dist. If dist is deleted, cleaned, or was never
+# built, the stamp goes with it and the build runs -- there is no path where a
+# missing dist reads as cached. A stale-but-present dist cannot survive an src
+# edit either, because the fingerprint covers every tracked file under src.
+#
+# SDK_BUILD_FORCE=1 rebuilds unconditionally. --self-test runs the fixtures.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SDK="$ROOT/packages/sdk"
+
+_fp() {
+  { git -C "$ROOT" ls-files -s packages/sdk/src packages/sdk/package.json 2>/dev/null
+    # uncommitted edits must move the key too -- ls-files -s shows the INDEX,
+    # which does not change when a tracked file is edited in the working tree.
+    git -C "$ROOT" diff -- packages/sdk/src packages/sdk/package.json 2>/dev/null
+    git -C "$ROOT" ls-files --others --exclude-standard packages/sdk/src 2>/dev/null \
+      | while IFS= read -r u; do shasum -a 256 "$ROOT/$u" 2>/dev/null; done
+  } | shasum -a 256 | cut -d' ' -f1
+}
+
+if [ "${1:-}" = "--self-test" ]; then
+  fails=0
+  b1=$(bash "$0"); b2=$(bash "$0")
+  case "$b2" in *"cached"*) echo "ok: second build on an unchanged tree is CACHED";;
+    *) echo "FAIL: unchanged tree rebuilt: $b2"; fails=$((fails+1));; esac
+  # RED PROOF 1 -- an src edit must force a rebuild
+  probe="$SDK/src/.__cache_probe.ts"; echo 'export const __p = 1' > "$probe"
+  b3=$(bash "$0")
+  case "$b3" in *"cached"*) echo "FAIL: an src edit did NOT invalidate"; fails=$((fails+1));;
+    *) echo "ok: an src edit forces a rebuild";; esac
+  rm -f "$probe"
+  # RED PROOF 2 -- a missing dist must force a rebuild, never read as cached
+  rm -f "$SDK/dist/.build-fingerprint"
+  b4=$(bash "$0")
+  case "$b4" in *"cached"*) echo "FAIL: missing stamp read as cached"; fails=$((fails+1));;
+    *) echo "ok: a missing stamp forces a rebuild";; esac
+  [ "$fails" -eq 0 ] && { echo "sdk-build-cached: self-test PASS"; exit 0; }
+  echo "sdk-build-cached: self-test FAILED ($fails)"; exit 1
+fi
+
+STAMP="$SDK/dist/.build-fingerprint"
+want="$(_fp)"
+if [ "${SDK_BUILD_FORCE:-0}" != "1" ] && [ -f "$STAMP" ] && [ "$(cat "$STAMP")" = "$want" ]; then
+  echo "[sdk] cached — src unchanged (${want:0:12})"
+  exit 0
+fi
+( cd "$SDK" && bun run build >/dev/null ) || { echo "[sdk] BUILD FAILED" >&2; exit 1; }
+printf '%s' "$want" > "$STAMP"
+echo "[sdk] built (${want:0:12})"

package/scripts/signal-watch.sh

@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+# signal-watch.sh — watch signals travel through the factory's gates, live,
+# with a budget per door and a ledger that tracks speed over time.
+#
+# manifest: needs-env   (reads GATEWAY_API_KEY from the shell or one.ie/web/.env;
+#                        the local lane reads one.ie/web/.dev.vars)
+#
+# USAGE
+#   bash .claude/scripts/signal-watch.sh                 both lanes, once
+#   bash .claude/scripts/signal-watch.sh --prod|--local  one lane
+#   bash .claude/scripts/signal-watch.sh --watch 30      redraw every 30s
+#   bash .claude/scripts/signal-watch.sh --json          one JSON line per door
+#   bash .claude/scripts/signal-watch.sh --self-test     the red proofs
+#
+# THE DOORS are the five HTTP hops the factory's own path makes (text/factory-do.md
+# § THE ONE PATH: classify · size · board · claim · close) plus the world door the
+# hooks and do-signal.sh post to, plus the stream the listeners sit on:
+#
+#   health            GET  /api/health                       the worker answers
+#   world:announce    POST a canary tagged [signal-watch-wire] on the
+#                     MARKETPLACE board — intake's door.
+#                     The wire, and only the wire: zero subscribers matched, so
+#                     the number is the door's own cost with no fan-out in it.
+#                     It used to be sent on the caller's own board and the header
+#                     claimed it "matches nobody by design" — it matched `ceo`,
+#                     which subscribes to EVERY tag by canon (root CLAUDE.md: the
+#                     CEO is the default receiver, always listening). Measured
+#                     2026-09-08 on prod server-timing, same door, one variable:
+#                     matched=0 -> data 259/332/401 ms; matched=1 -> data
+#                     1535..2066 ms. So ~1.3s per matched subscriber was being
+#                     read as "the wire". The probe now ASSERTS matched=0 and
+#                     goes UNRUN if it ever matches — a wire probe that fanned
+#                     out did not measure the wire, and an unrun door is not a
+#                     pass. The fan-out's own cost is a separate finding
+#                     (text/announce-fanout-plan.md), not a budget to widen.
+#                     BOTH halves are load-bearing and both were measured
+#                     wrong before: the BOARD (own board -> `ceo`, who
+#                     follows every tag) and the TAG (`cc` on the marketplace
+#                     board -> the live `cc-proof-listener`, found 2026-09-08
+#                     by this very assertion on its first run). Hence a
+#                     RESERVED tag nobody stakes, on the shared board. If
+#                     someone ever stakes `signal-watch-wire`, the row goes
+#                     unrun and says so, rather than quietly reporting a
+#                     fan-out as the wire.
+#   tasks:everywhere  POST {workspace:factory-do}             the board read
+#   factory:size      POST {paths:[this file]}                the size hop
+#   stream            GET  channels.one.ie/stream/space:vespio  time to first byte
+#
+# EVERY ROW CARRIES the server-timing phases the worker itself reports
+# (auth · data · det) and cf-placement, so "slow" is never a single number:
+# you can read WHICH leg paid. Measured 2026-09-05: D1 `one-owners` runs in
+# APAC, TypeDB Cloud in Virginia, and Smart Placement runs one-prod at ORD about
+# one call in three — so every substrate call pays one Pacific leg somewhere.
+#
+# VERDICTS, four states, the same vocabulary as do-w4-gates.sh:
+#   pass   200, the receiver answered `outcome:result`, wall <= budget
+#   fail   dropped (no response inside 15s) · non-200 · a refusal · over budget
+#   n/a    the door is not on this box (no local server, no listener config)
+#   unrun  the door could not be TRIED (no key) — never read as a pass
+# Exit 0 = every door pass or n/a · 1 = any fail · 3 = any unrun and no fail.
+#
+# LEDGER: one JSON line per door per run appended to .claude/.signal-watch.jsonl
+# (gitignored). `--no-ledger` skips it. Speed is tracked, never remembered.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+PROD_URL="${SIGNAL_WATCH_PROD:-https://one.ie}"
+LOCAL_URL="${SIGNAL_WATCH_LOCAL:-http://localhost:4321}"
+STREAM_URL="${SIGNAL_WATCH_STREAM:-https://channels.one.ie/stream/space:vespio}"
+LEDGER="${SIGNAL_WATCH_LEDGER:-$ROOT/.claude/.signal-watch.jsonl}"
+CURL_MAX="${SIGNAL_WATCH_MAX:-15}"
+BUDGET_SCALE="${SIGNAL_WATCH_BUDGET_SCALE:-1}"   # self-test shrinks budgets with this
+
+LANES="prod local"; WATCH=0; JSON=0; LEDGER_ON=1
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --prod) LANES="prod" ;; --local) LANES="local" ;;
+    --watch) WATCH="${2:-30}"; shift ;;
+    --json) JSON=1 ;; --no-ledger) LEDGER_ON=0 ;;
+    --self-test) SELF_TEST=1 ;;
+    -h|--help) sed -n 2,45p "$0"; exit 0 ;;
+    *) echo "signal-watch: unknown arg $1" >&2; exit 2 ;;
+  esac; shift
+done
+
+PASS=0; FAIL=0; NA=0; UNRUN=0
+_key() { # $1 = env file; the shell wins; the value is never printed
+  local f="$1" v="${GATEWAY_API_KEY:-}"
+  [ -n "$v" ] && { printf '%s' "$v"; return; }
+  [ -f "$f" ] && grep -E '^GATEWAY_API_KEY=' "$f" | head -1 | cut -d= -f2- | tr -d '"'
+}
+_budget() { awk -v b="$1" -v s="$BUDGET_SCALE" 'BEGIN{printf "%d", b*s}'; }
+_row() { # lane door verdict wall budget placement phases note
+  if [ "$JSON" = 1 ]; then
+    printf '{"ts":"%s","lane":"%s","door":"%s","verdict":"%s","wall_ms":%s,"budget_ms":%s,"placement":"%s","phases":"%s","note":"%s"}\n' \
+      "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" "$2" "$3" "${4:-null}" "$5" "$6" "$7" "$8"
+  else
+    printf '  %-6s %-18s %-5s %7s ms  budget %5s  %-11s %-34s %s\n' "$1" "$2" "$3" "${4:--}" "$5" "${6:--}" "${7:--}" "$8"
+  fi
+  if [ "$LEDGER_ON" = 1 ]; then
+    printf '{"ts":"%s","lane":"%s","door":"%s","verdict":"%s","wall_ms":%s,"budget_ms":%s,"placement":"%s","phases":"%s"}\n' \
+      "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" "$2" "$3" "${4:-null}" "$5" "$6" "$7" >> "$LEDGER" 2>/dev/null || true
+  fi
+  case "$3" in pass) PASS=$((PASS+1));; fail) FAIL=$((FAIL+1));; n/a) NA=$((NA+1));; unrun) UNRUN=$((UNRUN+1));; esac
+}
+
+# door <lane> <name> <method> <url> <payload|-> <budget_ms> <key|-> [expect|-]
+# `expect` is a fixed string the RESPONSE BODY must contain for the number to
+# mean what the door claims to measure. Absent it, a door can keep answering 200
+# fast while measuring something else entirely — which is exactly how the
+# announce canary reported "the wire" while paying a full fan-out. A miss is
+# UNRUN, never fail and never pass: the door ran, but not the door we named.
+door() {
+  local lane="$1" name="$2" method="$3" url="$4" payload="$5" budget key="$7" expect="${8:--}" hdr body out code wall placement phases verdict note=""
+  budget=$(_budget "$6")
+  hdr=$(mktemp); body=$(mktemp)
+  if [ "$method" = POST ] && [ "$key" = "-" ]; then
+    _row "$lane" "$name" unrun "" "$budget" "" "" "no GATEWAY_API_KEY — not tried"; rm -f "$hdr" "$body"; return
+  fi
+  # bash 3.2 + set -u: an EMPTY array expands as unbound. The ${a[@]+"${a[@]}"} idiom is the only portable form.
+  local cfg=""; [ "$key" != "-" ] && { cfg=$(mktemp); chmod 600 "$cfg"; printf 'header = "Authorization: Bearer %s"\n' "$key" > "$cfg"; }
+  local -a auth=(); [ -n "$cfg" ] && auth=(--config "$cfg")
+  if [ "$method" = POST ]; then
+    out=$(curl -s -D "$hdr" -o "$body" --max-time "$CURL_MAX" -X POST "$url" -H 'content-type: application/json' ${auth[@]+"${auth[@]}"} -d "$payload" -w '%{http_code} %{time_total}' 2>/dev/null)
+  else
+    out=$(curl -s -D "$hdr" -o "$body" --max-time "$CURL_MAX" "$url" ${auth[@]+"${auth[@]}"} -w '%{http_code} %{time_total}' 2>/dev/null)
+  fi
+  [ -n "$cfg" ] && rm -f "$cfg"
+  code="${out%% *}"; wall=$(awk -v t="${out##* }" 'BEGIN{printf "%d", t*1000}')
+  placement=$(grep -i '^cf-placement:' "$hdr" | head -1 | cut -d' ' -f2- | tr -d '\r')
+  phases=$(grep -i '^server-timing:' "$hdr" | head -1 | grep -oE '(auth|data|det);dur=[0-9]+' | sed -E 's/;dur=/=/' | paste -sd' ' -)
+  if [ "$code" = "000" ] || [ -z "$code" ]; then verdict=fail; note="DROPPED — no response inside ${CURL_MAX}s"
+  elif [ "$code" != "200" ]; then verdict=fail; note="http $code $(head -c 80 "$body" | tr -d '\n')"
+  elif [ "$method" = POST ] && ! grep -q '"outcome":"result"' "$body"; then verdict=fail; note="refused: $(head -c 100 "$body" | tr -d '\n')"
+  elif [ "$method" = POST ] && grep -q '"ok":false' "$body"; then verdict=unrun; note="refused before the work: $(grep -oE '"error":"[^"]{0,80}' "$body" | head -1 | cut -d'"' -f4)"
+  elif [ "$expect" != "-" ] && ! grep -qF "$expect" "$body"; then verdict=unrun; note="not the door we named: body lacks $expect — $(head -c 60 "$body" | tr -d '\n')"
+  elif [ "$wall" -gt "$budget" ]; then verdict=fail; note="over budget by $((wall-budget)) ms"
+  else verdict=pass; fi
+  _row "$lane" "$name" "$verdict" "$wall" "$budget" "${placement:-}" "${phases:-}" "$note"
+  rm -f "$hdr" "$body"
+}
+
+stream_door() {
+  local budget cfg="$HOME/.cc-connect/.auth.conf" out code ttfb wall verdict note=""
+  budget=$(_budget 600)
+  [ -f "$cfg" ] || { _row prod stream n/a "" "$budget" "" "" "no ~/.cc-connect/.auth.conf on this box"; return; }
+  out=$(curl -s -N -o /dev/null --max-time 4 --config "$cfg" "$STREAM_URL?since=$(date +%s)000" -w '%{http_code} %{time_starttransfer}' 2>/dev/null)
+  code="${out%% *}"; ttfb=$(awk -v t="${out##* }" 'BEGIN{printf "%d", t*1000}')
+  if [ "$code" != "200" ]; then verdict=fail; note="http ${code:-000}"
+  elif [ "$ttfb" -gt "$budget" ]; then verdict=fail; note="first byte over budget"
+  else verdict=pass; note="first byte"; fi
+  _row prod stream "$verdict" "$ttfb" "$budget" "" "" "$note"
+}
+
+listeners() {
+  command -v launchctl >/dev/null 2>&1 || { _row prod listeners n/a "" 0 "" "" "no launchctl"; return; }
+  local alive; alive=$(launchctl list 2>/dev/null | awk '/ie\.one\.(cc-vespio|cc-oo|tg-listen)$/ && $1 ~ /^[0-9]+$/ {n++} END{print n+0}')
+  if [ "$alive" -gt 0 ]; then _row prod listeners pass "" 0 "" "" "$alive listener(s) alive (cc-vespio · cc-oo · tg-listen)"
+  else _row prod listeners fail "" 0 "" "" "no ie.one.* listener has a pid"; fi
+}
+
+lane() { # prod|local
+  local l="$1" base key
+  # The prod credential file honours ONE_ENV_FILE / DO_ENV_FILE, like every other
+  # credential read in the harness (factory-repo.sh --check-env-indirection).
+  # A relative path is taken from $ROOT; the shell's GATEWAY_API_KEY still wins.
+  local env_file="${ONE_ENV_FILE:-${DO_ENV_FILE:-one.ie/web/.env}}"
+  case "$env_file" in /*) ;; *) env_file="$ROOT/$env_file" ;; esac
+  if [ "$l" = prod ]; then base="$PROD_URL"; key=$(_key "$env_file")
+  else
+    base="$LOCAL_URL"; key=$(_key "$ROOT/one.ie/web/.dev.vars")
+    if ! curl -s -o /dev/null --max-time 3 "$base/api/health"; then
+      _row local health n/a "" 0 "" "" "no dev server at $base"; return
+    fi
+  fi
+  [ -z "$key" ] && key="-"
+  # Budgets are a RATCHET: set at the measured p90 the day the door was first
+  # watched (2026-09-05 — announce 1.3-1.8s, board/size 0.8-1.5s), lowered only
+  # after a measured improvement ships. Never raised to make a red row green.
+  # announce: 2000 → 800 after the parallel-read ship (2026-09-05, measured 149-379 ms).
+  # UNCHANGED 2026-09-08 on purpose. The door it describes is now the WIRE door
+  # (board=marketplace, matched=0), whose data phase measures 259-401 ms — the
+  # same range 800 was set against. The wall it is compared to also carries the
+  # CLIENT's egress, which is not the worker's: `health` does det=0 ms of server
+  # work and has walked 134 → 72 → 437 → 463 ms across the ledger purely on where
+  # the laptop was sitting. So a marginal announce/health miss can be this box's
+  # network, not the door. Whether these budgets should be worker-phase budgets
+  # rather than wall budgets is a RECALIBRATION — a human decision, deliberately
+  # not taken here. A budget moved to fit an observation stops meaning anything.
+  local b1 b2 b3; if [ "$l" = prod ]; then b1=400; b2=1500; b3=800; else b1=150; b2=300; b3=300; fi
+  door "$l" health GET "$base/api/health" - "$b1" -
+  # SIGNAL_WATCH_WIRE_OWN_BOARD=1 exists for --self-test case 4 ONLY: DROPPING
+  # the board key sends the canary to the caller's own board, where `ceo` matches
+  # every tag by canon — the durable red half of the assertion below. (Setting
+  # `board` to an arbitrary slug does NOT work: the receiver's Zod schema rejects
+  # it with a 400, which is a different failure and proves nothing.) Never set
+  # this in a real run.
+  local wire_board='"board":"marketplace",'
+  if [ "${SIGNAL_WATCH_WIRE_OWN_BOARD:-0}" = 1 ]; then wire_board=''; fi
+  door "$l" world:announce POST "$base/api/ask/world:announce" \
+    "{\"data\":{\"tags\":[\"signal-watch-wire\"],${wire_board}\"type\":\"signal:canary\",\"text\":\"signal-watch $(date -u +%H:%M:%SZ)\",\"priority\":\"fyi\",\"slug\":\"one\"}}" "$b3" "$key" '"matched":0'
+  door "$l" tasks:everywhere POST "$base/api/ask/tasks:everywhere" '{"data":{"workspace":"factory-do","limit":200}}' "$b2" "$key"
+  door "$l" factory:size POST "$base/api/ask/factory:size" '{"data":{"paths":[".claude/scripts/signal-watch.sh"]}}' "$b2" "$key"
+}
+
+run_once() {
+  PASS=0; FAIL=0; NA=0; UNRUN=0
+  [ "$JSON" = 1 ] || { echo "signal-watch · $(date '+%Y-%m-%d %H:%M:%S') · prod=$PROD_URL local=$LOCAL_URL"; echo; }
+  for l in $LANES; do lane "$l"; done
+  case " $LANES " in *" prod "*) stream_door; listeners ;; esac
+  [ "$JSON" = 1 ] || { echo; echo "SIGNAL-WATCH: pass=$PASS fail=$FAIL n/a=$NA unrun=$UNRUN$([ "$LEDGER_ON" = 1 ] && printf ' · ledger %s' "$LEDGER")"; }
+  [ "$FAIL" -gt 0 ] && return 1; [ "$UNRUN" -gt 0 ] && return 3; return 0
+}
+
+if [ "${SELF_TEST:-0}" = 1 ]; then
+  fails=0
+  echo "== 1. a dropped door is a fail, and the exit says so"
+  out=$(SIGNAL_WATCH_PROD=http://127.0.0.1:1 SIGNAL_WATCH_MAX=2 bash "$0" --prod --no-ledger 2>&1); rc=$?
+  [ "$rc" -eq 1 ] && grep -q "DROPPED" <<<"$out" && echo "  ok   exit 1, DROPPED named" || { echo "  FAIL rc=$rc"; echo "$out" | tail -4; fails=$((fails+1)); }
+  echo "== 2. a door over budget is a fail, never a slow pass"
+  out=$(SIGNAL_WATCH_BUDGET_SCALE=0.0001 bash "$0" --prod --no-ledger 2>&1); rc=$?
+  [ "$rc" -eq 1 ] && grep -q "over budget" <<<"$out" && echo "  ok   exit 1, over budget named" || { echo "  FAIL rc=$rc"; echo "$out" | tail -4; fails=$((fails+1)); }
+  echo "== 3. no key is UNRUN (exit 3), not a pass — the door was never tried"
+  # the .env key resolves on a configured box, so prove the branch from a stub root with no .env
+  tmp=$(mktemp -d); mkdir -p "$tmp/.claude/scripts" "$tmp/one.ie/web"; cp "$0" "$tmp/.claude/scripts/"
+  out=$(GATEWAY_API_KEY= SIGNAL_WATCH_BUDGET_SCALE=100 bash "$tmp/.claude/scripts/signal-watch.sh" --prod --no-ledger 2>&1); rc=$?
+  [ "$rc" -eq 3 ] && grep -q "unrun" <<<"$out" && echo "  ok   exit 3, unrun rows" || { echo "  FAIL rc=$rc"; echo "$out" | tail -4; fails=$((fails+1)); }
+  rm -rf "$tmp"
+  echo "== 4. a wire probe that MATCHED somebody is unrun (exit 3), not a fast pass"
+  # Red half: point the canary back at the caller's own board, where `ceo`
+  # subscribes to every tag. The door still answers 200 with outcome=result —
+  # only the assertion catches it.
+  out=$(SIGNAL_WATCH_WIRE_OWN_BOARD=1 SIGNAL_WATCH_BUDGET_SCALE=100 bash "$0" --prod --no-ledger 2>&1); rc=$?
+  [ "$rc" -eq 3 ] && grep -q 'not the door we named' <<<"$out" && echo "  ok   exit 3, fan-out named as not-the-wire" || { echo "  FAIL rc=$rc"; echo "$out" | tail -4; fails=$((fails+1)); }
+  echo "signal-watch --self-test: $fails failed"
+  exit "$fails"
+fi
+
+if [ "$WATCH" -gt 0 ] 2>/dev/null; then
+  while :; do clear; run_once; sleep "$WATCH"; done
+fi
+run_once

package/scripts/skills-publish.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# Publish the harness skills in .claude/skills/ into the substrate catalog, so the
+# skills /do actually uses are reachable through `skill:run` and `skills:list`
+# instead of only as local files an agent must already be on this disk to read.
+#
+# The two on-disk shapes map 1:1 onto the two shapes db/skills.ts already reads:
+#   .claude/skills/<name>/SKILL.md  ->  R2  <slug>/skills/<name>/SKILL.md
+#   .claude/skills/<name>.md        ->  R2  <slug>/skills/<name>.md
+# So this is a copy, not a conversion — nothing here reformats a skill body.
+#
+# The SECOND source is the shared skill library in one.ie/ai/skills/, which is what
+# an executor actually runs — `foundation:deep` loads each elevate-foundation-*
+# SKILL.md through getSkillOrRef, so a skill that is on disk but not in R2 makes the
+# run fail closed (`skill_not_found:<name>`). Same copy, same key shape:
+#   one.ie/ai/skills/<name>/SKILL.md -> R2  <slug>/skills/<name>/SKILL.md
+#
+# That dir holds 140+ skills, so it is filtered by --ai-pattern rather than published
+# wholesale: a routine run of this script must not silently push the whole library to
+# prod R2. The default covers exactly the 10 skills in deep-sequence.ts SKILL_ORDER.
+#
+# Usage:
+#   skills-publish.sh [--slug one] [--dry-run] [--bucket one-content]
+#                     [--ai-pattern 'elevate-foundation-*'] [--no-ai]
+#
+# Re-running is safe: an R2 put is a full overwrite of one key, and the catalog is
+# keyed by name, so a republished skill replaces itself rather than accumulating.
+# Deletions are NOT mirrored — a skill removed from disk stays in the catalog until
+# it is deleted deliberately, because unpublishing is a decision, not a side effect.
+set -euo pipefail
+
+SLUG="one"
+BUCKET="one-content"
+DRY=false
+AI_PATTERN='elevate-foundation-*'
+AI=true
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --slug)   SLUG="$2"; shift 2 ;;
+    --bucket) BUCKET="$2"; shift 2 ;;
+    --ai-pattern) AI_PATTERN="$2"; shift 2 ;;
+    --no-ai)  AI=false; shift ;;
+    --dry-run) DRY=true; shift ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+SKILLS="$_ROOT/.claude/skills"
+AI_SKILLS="$_ROOT/one.ie/ai/skills"
+[ -d "$SKILLS" ] || { echo "no skills dir at $SKILLS" >&2; exit 1; }
+
+# wrangler resolves its account from one.ie/web's config; run from there.
+cd "$_ROOT/one.ie/web"
+
+ok=0; fail=0; failed=""
+
+_put() { # <r2-key> <local-file>
+  if [ "$DRY" = true ]; then echo "DRY  $1"; ok=$((ok + 1)); return 0; fi
+  # Output captured, then matched — never `| grep -q`. In a pipefail script a
+  # matching grep exits first and the producer takes SIGPIPE, which reads as a
+  # failure on success (see .claude/CLAUDE.md § TRAP).
+  local out
+  if out=$(npx wrangler r2 object put "$BUCKET/$1" --file="$2" --remote 2>&1); then
+    ok=$((ok + 1))
+  else
+    fail=$((fail + 1)); failed="$failed $1"
+    printf '%s\n' "$out" | tail -2 >&2
+  fi
+}
+
+for d in "$SKILLS"/*/; do
+  [ -f "$d/SKILL.md" ] || continue
+  _put "$SLUG/skills/$(basename "$d")/SKILL.md" "$d/SKILL.md"
+done
+
+for f in "$SKILLS"/*.md; do
+  [ -f "$f" ] || continue
+  _put "$SLUG/skills/$(basename "$f")" "$f"
+done
+
+ai=0
+if [ "$AI" = true ] && [ -d "$AI_SKILLS" ]; then
+  for d in "$AI_SKILLS"/$AI_PATTERN/; do
+    [ -f "$d/SKILL.md" ] || continue
+    _put "$SLUG/skills/$(basename "$d")/SKILL.md" "$d/SKILL.md"
+    ai=$((ai + 1))
+  done
+  if [ "$ai" -eq 0 ]; then
+    echo "skills-publish: WARNING no ai/skills matched --ai-pattern '$AI_PATTERN'" >&2
+  fi
+fi
+
+echo "skills-publish: $ok published ($ai from ai/skills), $fail failed (slug=$SLUG bucket=$BUCKET)"
+[ "$fail" -eq 0 ] || { echo "failed:$failed" >&2; exit 1; }

package/scripts/speed-cache-check.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+# speed-cache-check.sh — proves domain-memo.ts's cross-isolate (L2) cache is a
+# real behaviour, not a presence grep.
+#
+# WHY THIS EXISTS: an earlier draft of "prove the cache works" matched the
+# word "CACHED" inside a docblock and passed on nothing — a presence grep
+# proves a SHAPE, never a BEHAVIOUR (text/learnings.md, project_fail_open_aggregate_runners).
+# This check instead runs the real vitest suite twice against two different
+# trees of the SAME file (working tree vs `git show HEAD:<path>`, the shape
+# before this cycle's L2 fix landed) and asserts the exit code differs in the
+# expected direction:
+#
+#   RED  (pre-fix domain-memo.ts): "a cold isolate ... still skips D1 via L2"
+#        fails — a per-isolate Map has no cross-isolate reach, so a fresh
+#        `vi.resetModules()` import always re-pays D1.
+#   GREEN (this cycle's domain-memo.ts): the same test passes — a fresh
+#        module import still finds the row in the shared `caches.default`
+#        store the "warm" isolate wrote, and never touches D1.
+#
+# The GREEN half is what a normal CI run enforces (`bun run verify` already
+# runs tests/unit/domain-memo.test.ts). This script exists for the RED half —
+# proving the test can fail, and fails for the SPECIFIC reason claimed (a cold
+# isolate re-pays D1), not some unrelated breakage.
+#
+# Usage: bash .claude/scripts/speed-cache-check.sh
+#   Exits 0 only if: RED run fails on the cold-isolate test AND GREEN run
+#   (the current working tree) passes the whole file.
+
+set -euo pipefail
+
+# _GATE — see governor-doors-check.sh "compute sites". A gate_lock dedupes
+# identical work; only a SLOT bounds N worktrees running N computes at once.
+# Empty inside an existing gate so the outer slot is inherited, never doubled.
+_GATE=()
+if [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  _GR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+  [ -f "$_GR" ] && _GATE=( bash "$_GR" "compute:$(basename "${BASH_SOURCE[0]}")" -- )
+fi
+
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WEB="$ROOT/one.ie/web"
+REL_MEMO="one.ie/web/src/lib/domain-memo.ts"
+REL_TEST="one.ie/web/tests/unit/domain-memo.test.ts"
+TEST_FILE="tests/unit/domain-memo.test.ts"
+COLD_TEST_NAME="a cold isolate"
+
+cd "$ROOT"
+
+if [ ! -f "$REL_MEMO" ]; then
+	echo "[speed-cache-check] missing $REL_MEMO — nothing to check" >&2
+	exit 2
+fi
+
+if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+	echo "[speed-cache-check] not a git repo — cannot diff RED vs GREEN" >&2
+	exit 2
+fi
+
+# The RED half needs a tree where domain-memo.ts has NO L2 (Cache API) layer.
+# If HEAD already has the fix (this cycle already committed), fall back to a
+# hand-written broken copy so the check still proves something rather than
+# silently degrading to "n/a".
+HEAD_HAS_L2=0
+if git show HEAD:"$REL_MEMO" 2>/dev/null | grep -q "caches\.default"; then
+	HEAD_HAS_L2=1
+fi
+
+TMP_BROKEN=""
+cleanup() {
+	if [ -n "$TMP_BROKEN" ] && [ -f "$TMP_BROKEN" ]; then
+		rm -f "$TMP_BROKEN"
+	fi
+	if [ "${STASHED:-0}" = "1" ]; then
+		git stash pop --quiet
+	fi
+}
+trap cleanup EXIT
+
+STASHED=0
+RED_SOURCE_DESC=""
+
+if [ "$HEAD_HAS_L2" = "0" ]; then
+	RED_SOURCE_DESC="git HEAD:$REL_MEMO (pre-fix shape)"
+	# Stash ONLY this file's working-tree changes (never a blanket stash —
+	# .claude/CLAUDE.md's git-add-guard rule, and just good hygiene: this repo
+	# has other unrelated modified files in play from sibling /do cycles).
+	if ! git diff --quiet -- "$REL_MEMO"; then
+		git stash push --quiet -- "$REL_MEMO"
+		STASHED=1
+	fi
+else
+	# HEAD already carries the L2 fix (e.g. re-run after commit) — synthesize
+	# the pre-fix shape by stripping the L2 read/write calls out of a scratch
+	# copy, then swap it in the same way (stash, write broken, test, restore).
+	RED_SOURCE_DESC="synthesized pre-L2 copy (HEAD already has the fix)"
+	TMP_BROKEN="$(mktemp)"
+	python3 - "$REL_MEMO" "$TMP_BROKEN" <<'PY'
+import re, sys
+src_path, out_path = sys.argv[1], sys.argv[2]
+with open(src_path) as f:
+    src = f.read()
+# Remove the L2 read/write calls from readDomainRowMemo so it behaves exactly
+# like the original per-isolate-only implementation.
+src = src.replace(
+    """\tconst edgeRow = await readEdgeCache(host);
+\tif (edgeRow !== undefined) {
+\t\tif (_cache.size >= MAX_ENTRIES) _cache.clear();
+\t\t_cache.set(host, { row: edgeRow, at: Date.now() });
+\t\treturn edgeRow;
+\t}
+
+""",
+    "",
+)
+src = src.replace("\twriteEdgeCache(host, row);\n", "")
+with open(out_path, "w") as f:
+    f.write(src)
+PY
+	cp "$REL_MEMO" "${REL_MEMO}.speed-cache-check.bak"
+	cp "$TMP_BROKEN" "$REL_MEMO"
+	STASHED=2
+	cleanup() {
+		mv "${REL_MEMO}.speed-cache-check.bak" "$REL_MEMO"
+		rm -f "$TMP_BROKEN"
+	}
+	trap cleanup EXIT
+fi
+
+echo "[speed-cache-check] RED run — $RED_SOURCE_DESC"
+cd "$WEB"
+set +e
+RED_OUT="$("${_GATE[@]}" bunx vitest run "$TEST_FILE" -t "$COLD_TEST_NAME" 2>&1)"
+RED_STATUS=$?
+set -e
+cd "$ROOT"
+
+if [ $RED_STATUS -eq 0 ]; then
+	echo "[speed-cache-check] FAIL: the cold-isolate test PASSED against the pre-fix shape." >&2
+	echo "  That means the test isn't proving cross-isolate behaviour — it would pass on nothing." >&2
+	echo "$RED_OUT" | tail -40 >&2
+	exit 1
+fi
+if ! printf '%s' "$RED_OUT" | grep -q "$COLD_TEST_NAME"; then
+	echo "[speed-cache-check] FAIL: RED run failed but not on the named test — some other breakage." >&2
+	echo "$RED_OUT" | tail -60 >&2
+	exit 1
+fi
+echo "[speed-cache-check] RED confirmed — cold-isolate test fails without L2 (as expected)."
+
+# Restore the fixed file before the GREEN run.
+trap - EXIT
+cleanup
+STASHED=0
+TMP_BROKEN=""
+
+echo "[speed-cache-check] GREEN run — working tree $REL_MEMO"
+cd "$WEB"
+set +e
+GREEN_OUT="$("${_GATE[@]}" bunx vitest run "$TEST_FILE" 2>&1)"
+GREEN_STATUS=$?
+set -e
+cd "$ROOT"
+
+if [ $GREEN_STATUS -ne 0 ]; then
+	echo "[speed-cache-check] FAIL: the full domain-memo suite does not pass on the fixed file." >&2
+	echo "$GREEN_OUT" | tail -60 >&2
+	exit 1
+fi
+
+echo "[speed-cache-check] GREEN confirmed — full domain-memo.test.ts passes with L2 wired."
+echo "[speed-cache-check] OK — the cross-isolate cache is proven by behaviour, not by grep."
+exit 0