@oneie/claude 0.7.0 → 0.9.0

package/scripts/test-lanes.sh

@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+# test-lanes.sh — the full suite as TWO concurrent lanes, because it has two
+# different binding constraints and one pool cannot serve both.
+#
+# manifest: needs-env
+#
+# THE MEASUREMENT THAT FORCED THIS (2026-09-03). Four full-suite runs on an
+# UNCHANGED tree produced four DIFFERENT failure sets — 8, 12, 13, 8 failures.
+# Every failing file in all four runs was one of the 19 suites marked
+# `real TypeDB`; not one of the other ~1126 files ever failed. Per run the log
+# carried 41-72 `typedbQuery upstream 503` and 25-38 `upstream 500` warnings,
+# and those are emitted only AFTER the retry budget is spent (substrate.ts:208).
+#
+# The cause is capacity, not code: `substrate.ts:56-60` records that the shared
+# TypeDB Cloud gateway 503s in bursts lasting SECONDS, while the retry cover is
+# 500ms + 1000ms. Eight vitest forks hammering one external singleton turn that
+# into a coin flip, and a coin-flip gate costs far more than it saves — the
+# 2026-09-03 deploy spent hours on re-runs and root-cause agents for failures
+# that were never in the diff.
+#
+# WHY TWO LANES BEAT ONE. The lanes have opposite constraints, so they overlap
+# almost for free:
+#   pool  — ~1126 files, CPU-bound, 8 forks, touches no gateway
+#   typedb — 19 files, NETWORK-bound, serial, one gateway conversation at a time
+# Lane `typedb` spends its life waiting on a socket, so it costs little CPU while
+# `pool` saturates the cores. Wall clock is max(pool, typedb), not pool+typedb.
+#
+# WHAT THIS IS NOT. It is not `--no-file-parallelism` over the whole suite (that
+# serialises 1126 innocent files to fix 19), and it is not a retry that swallows
+# a 503. Serialising ONLY the suites that share the external singleton removes
+# the contention at its source while leaving the real gate intact: every test
+# still runs, no assertion is weakened, nothing is skipped.
+#
+# The selector is the `real TypeDB` marker the suites already carry — read from
+# the tree at run time, never a hardcoded list that would rot silently.
+#
+#   bash .claude/scripts/test-lanes.sh            # both lanes, concurrent
+#   bash .claude/scripts/test-lanes.sh --list     # show the split, run nothing
+#   bash .claude/scripts/test-lanes.sh --self-test
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+FOLDER="${TEST_FULL_FOLDER:-one.ie/web}"
+DIR="$ROOT/$FOLDER"
+
+# Timeouts match test-full.sh's single definition — see that file's comment on
+# why every caller must present identical argv to test-cached.sh.
+# test-full.sh owns the ONE definition of these flags and hands them over in
+# TEST_FULL_ARGS. The literal here is only the standalone-invocation fallback —
+# if the two ever drift, the memo key splits and a warm tree silently pays the
+# suite twice, which is the exact bug test-full.sh was created to kill.
+if [ -n "${TEST_FULL_ARGS:-}" ]; then
+  COMMON=(); for _a in $TEST_FULL_ARGS; do COMMON+=("$_a"); done
+else
+  COMMON=(--testTimeout=15000 --hookTimeout=15000 --teardownTimeout=15000 --reporter=dot)
+fi
+
+# The 19. Read from the tree so adding a real-TypeDB suite puts it in the serial
+# lane automatically; a hardcoded list is how this rots back into flakiness.
+typedb_files() { (cd "$DIR" && grep -rl 'real TypeDB' tests --include='*.test.ts' 2>/dev/null | sort); }
+
+if [ "${1:-}" = "--list" ]; then
+  n=$(typedb_files | wc -l | tr -d ' ')
+  total=$(cd "$DIR" && find tests -name '*.test.ts*' | wc -l | tr -d ' ')
+  echo "typedb lane (serial, network-bound): $n files"
+  typedb_files | sed 's/^/  /'
+  echo "pool lane (8 forks, CPU-bound): $(( total - n )) files"
+  exit 0
+fi
+
+# --self-test: the selector must actually select, and must not select everything.
+if [ "${1:-}" = "--self-test" ]; then
+  fails=0
+  n=$(typedb_files | wc -l | tr -d ' ')
+  total=$(cd "$DIR" && find tests -name '*.test.ts*' | wc -l | tr -d ' ')
+  if [ "$n" -gt 0 ]; then echo "  ok   selector found $n real-TypeDB suites"
+  else echo "  FAIL selector found ZERO files — the marker moved, lane is empty"; fails=$((fails+1)); fi
+  if [ "$n" -lt "$total" ]; then echo "  ok   selector is a strict subset ($n of $total)"
+  else echo "  FAIL selector matched everything — no split happened"; fails=$((fails+1)); fi
+  # Every selected file must exist (guards a stale/quoted path)
+  miss=0; while read -r f; do [ -n "$f" ] && [ -f "$DIR/$f" ] || miss=$((miss+1)); done < <(typedb_files)
+  if [ "$miss" -eq 0 ]; then echo "  ok   every selected path exists"
+  else echo "  FAIL $miss selected path(s) do not exist"; fails=$((fails+1)); fi
+  [ "$fails" -eq 0 ] && { echo "test-lanes: self-test PASS"; exit 0; }
+  echo "test-lanes: self-test FAILED ($fails)"; exit 1
+fi
+
+# bash 3.2 (what macOS ships) has no `mapfile` — read the list the portable way.
+TDB=()
+while IFS= read -r _f; do [ -n "$_f" ] && TDB+=("$_f"); done < <(typedb_files)
+if [ "${#TDB[@]}" -eq 0 ]; then
+  echo "test-lanes: no 'real TypeDB' suites found — falling back to the single full run"
+  exec bash "$ROOT/.claude/scripts/test-cached.sh" "$FOLDER" -- "${COMMON[@]}"
+fi
+
+EXCL=(); for f in "${TDB[@]}"; do EXCL+=(--exclude "$f"); done
+
+LOG_A="$(mktemp)"; LOG_B="$(mktemp)"
+echo "test-lanes: pool lane (8 forks) + typedb lane (${#TDB[@]} files, serial) — concurrent"
+
+# Lane A: everything except the gateway suites. Full fan-out, no external dep.
+#
+# ...unless something else CPU-heavy is running beside us. Measured on the
+# 2026-09-03 production deploy: the astro build (8 GiB heap) and this lane ran
+# concurrently on a 10-core box and BOTH took 256s — the lane alone is 104s and
+# the build alone is 133s, so the overlap bought nothing and cost 2x each. Eight
+# forks plus a build is oversubscription, not parallelism.
+#
+# BUT CAPPING THE POOL DOES NOT FIX IT — measured, same box, same tree:
+#   8 forks (baseline)   gates wall-clock 256s   build 133s
+#   5 forks (VERIFY_POOL_FORKS=5)          272s   build 209s
+# Starving the pool did not feed the build; both got worse. Parallel, serial and
+# capped all land at 250-270s, so that is simply the floor for build+suite on a
+# 10-core box as currently shaped. The knob is left here, UNSET by default and
+# wired to nothing, purely so the next person can re-measure cheaply instead of
+# re-deriving the idea. Nothing in deploy.sh sets it.
+POOL_FORKS="${VERIFY_POOL_FORKS:-}"
+POOL_ARGS=(); [ -n "$POOL_FORKS" ] && POOL_ARGS=(--maxWorkers="$POOL_FORKS")
+# ${A[@]+"${A[@]}"} is not defensive noise -- it is REQUIRED here. macOS ships
+# bash 3.2.57, where expanding an EMPTY array under `set -u` (line 40) is an
+# "unbound variable" error, not an empty expansion. POOL_ARGS is empty by
+# default because VERIFY_POOL_FORKS is deliberately unset, so the bare
+# "${POOL_ARGS[@]}" killed the pool lane before vitest was ever invoked:
+#
+#   test-lanes.sh: line 119: POOL_ARGS[@]: unbound variable
+#   ----- pool lane (rc=1) -----      0 of ~1126 files run
+#
+# The gate reported FAILED, which is correct and is the only reason this was
+# caught rather than shipped as a pass -- but the FULL SUITE COULD NOT RUN on
+# main from the commit that added the knob until this one. EXCL and TDB get the
+# same guard: both are empty if the `real TypeDB` marker ever matches nothing,
+# which would break BOTH lanes the same way, silently, on a rename.
+( TEST_CACHE_PTY=1 bash "$ROOT/.claude/scripts/test-cached.sh" "$FOLDER" -- \
+    "${COMMON[@]}" ${POOL_ARGS[@]+"${POOL_ARGS[@]}"} ${EXCL[@]+"${EXCL[@]}"} >"$LOG_A" 2>&1 ) & PID_A=$!
+
+# Lane B: the gateway suites, ONE at a time. --no-file-parallelism is the whole
+# point — it is what stops 8 forks bursting a singleton that 503s under load.
+( TEST_CACHE_PTY=1 bash "$ROOT/.claude/scripts/test-cached.sh" "$FOLDER" -- \
+    "${COMMON[@]}" --no-file-parallelism --maxWorkers=1 ${TDB[@]+"${TDB[@]}"} >"$LOG_B" 2>&1 ) & PID_B=$!
+
+wait "$PID_A"; RC_A=$?
+wait "$PID_B"; RC_B=$?
+
+echo "───── pool lane (rc=$RC_A) ─────";   cat "$LOG_A"
+echo "───── typedb lane (rc=$RC_B) ─────"; cat "$LOG_B"
+rm -f "$LOG_A" "$LOG_B"
+
+# TYPEDB_LANE_NONBLOCKING: the typedb lane still runs (signal is preserved) but
+# its exit code is never a gate. Set in deploy.sh because the deploy must not
+# block on the shared TypeDB Cloud cluster — the request path goes through
+# Cloudflare (BrainDO / KV), TypeDB is writes + sync only (§ The brain and the edge).
+if [[ "${TYPEDB_LANE_NONBLOCKING:-0}" == "1" ]]; then
+  if [ "$RC_B" -ne 0 ]; then
+    echo "test-lanes: typedb lane FAILED (rc=$RC_B) — non-blocking, gate is pool lane only"
+  fi
+  if [ "$RC_A" -eq 0 ]; then
+    echo "test-lanes: pool lane green — PASS (typedb lane non-blocking)"; exit 0
+  fi
+  echo "test-lanes: FAILED (pool=$RC_A typedb=$RC_B, typedb non-blocking)"; exit 1
+fi
+
+# Both must pass. A lane that could not run is a failure, never a pass.
+if [ "$RC_A" -eq 0 ] && [ "$RC_B" -eq 0 ]; then
+  echo "test-lanes: BOTH lanes green"; exit 0
+fi
+echo "test-lanes: FAILED (pool=$RC_A typedb=$RC_B)"; exit 1

package/scripts/test-speed.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# test-speed.sh — the ms ledger for the test suite.
+#
+# WHY: "the suite is slow" is not actionable; "two files are 93% of the slice"
+# is. This runs vitest with the JSON reporter, aggregates per-FILE milliseconds,
+# and writes a ranked ledger so the next cycle has a target instead of a mood.
+#
+# It measures, it never gates. Exit status mirrors vitest's so a red suite still
+# reads as red, but nothing here fails a build for being slow.
+#
+#   bash .claude/scripts/test-speed.sh                  # whole suite
+#   bash .claude/scripts/test-speed.sh tests/unit        # a subtree
+#   bash .claude/scripts/test-speed.sh --report-only     # re-rank the last run
+#
+# Output: one.ie/web/tests/.speed-ledger.json  (committed — a prerendered page
+# can read it at build time; it cannot query live timings).
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WEB="$ROOT/one.ie/web"
+LEDGER="$WEB/tests/.speed-ledger.json"
+RAW="${TEST_SPEED_RAW:-$WEB/tests/.speed-raw.json}"
+
+report_only=0
+args=()
+for a in "$@"; do
+  case "$a" in
+    --report-only) report_only=1 ;;
+    *) args+=("$a") ;;
+  esac
+done
+
+st=0
+if [ "$report_only" -eq 0 ]; then
+  cd "$WEB" || exit 1
+  # The governor owns concurrency; a raw vitest here would bypass it and trip
+  # hook:load-guard. Same gate label the other lanes use.
+  bash "$ROOT/.claude/scripts/gate-run.sh" test-speed -- \
+    npx vitest run --reporter=json --outputFile="$RAW" "${args[@]+"${args[@]}"}"
+  st=$?
+fi
+
+[ -f "$RAW" ] || { echo "[test-speed] no run data at $RAW" >&2; exit 1; }
+
+LEDGER="$LEDGER" RAW="$RAW" python3 <<'PY'
+import json, os, collections, datetime
+
+raw, ledger = os.environ['RAW'], os.environ['LEDGER']
+d = json.load(open(raw))
+
+files = collections.Counter()
+counts = collections.Counter()
+for t in d.get('testResults', []):
+    name = t['name'].split('one.ie/web/')[-1]
+    # assertionResults carry per-TEST ms. A file's wall time also includes
+    # import+transform, which the JSON reporter does not attribute per file --
+    # so this is the FLOOR of a file's cost, never an overstatement.
+    files[name] += sum(a.get('duration') or 0 for a in t.get('assertionResults', []))
+    counts[name] += len(t.get('assertionResults', []))
+
+total = sum(files.values())
+rows = [
+    {'file': f, 'ms': round(ms), 'tests': counts[f],
+     'share': round(ms / total, 4) if total else 0.0}
+    for f, ms in files.most_common()
+]
+
+# The headline: how few files hold the suite hostage.
+cum, p80 = 0.0, 0
+for r in rows:
+    cum += r['ms']
+    p80 += 1
+    if total and cum >= 0.8 * total:
+        break
+
+out = {
+    'generated': datetime.datetime.now(datetime.timezone.utc)
+                 .strftime('%Y-%m-%dT%H:%M:%SZ'),
+    'files': len(rows),
+    'tests': sum(counts.values()),
+    'total_ms': round(total),
+    'files_for_80pct': p80,
+    'slowest': rows[:50],
+}
+json.dump(out, open(ledger, 'w'), indent=2)
+
+print(f"\n[test-speed] {out['files']} files · {out['tests']} tests · {out['total_ms']}ms in test bodies")
+print(f"[test-speed] {p80} file(s) carry 80% of it\n")
+for r in rows[:15]:
+    print(f"  {r['ms']:>8}ms  {r['share']*100:5.1f}%  {r['tests']:>4}t  {r['file']}")
+print(f"\n[test-speed] ledger -> {ledger}")
+PY
+
+exit $st

package/scripts/triage-shape-check.sh

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+# triage-shape-check.sh — prove the `shape` half of .claude/workflows/triage.js
+# writes a sane, non-destructive plan. Same idiom as do-tier.sh --self-test and
+# do-triage.sh --self-test: one command, exits non-zero on failure, and carries
+# a RED PROOF so a checker that stays green against gutted code is caught.
+#
+# manifest: monorepo-only
+#
+# WHY THIS EXISTS. The shape phase emits a LIST of board writes, and the list is
+# where the damage lives, not the words. Two of these invariants were broken in
+# the first version and neither would have failed a syntax check:
+#   · TWO tasks:notes writes. tasks:notes SETS the body, it does not append, so
+#     the second silently destroyed the first — and the survivor said
+#     "accept: see above" pointing at the line it had just deleted. Exactly the
+#     defect the board already carries one layer down (an absent notes key is a
+#     silent DELETE returning ok:true).
+#   · tasks:assign, which is not in the receiver registry and would dissolve as
+#     unknown_receiver.
+# Both are invisible to the eye and obvious to this file.
+#
+# Usage:  bash .claude/scripts/triage-shape-check.sh [--red]
+#         --red   gut the guard and assert this checker goes RED
+
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WF="$ROOT/.claude/workflows/triage.js"
+SDK="$ROOT/packages/sdk/src/receivers.ts"
+RED=0
+[ "${1:-}" = "--red" ] && RED=1
+
+[ -f "$WF" ] || { echo "FAIL: no $WF"; exit 2; }
+
+run_cases() { # <workflow file>
+  node - "$1" "$SDK" <<'NODE'
+// eval() IS DELIBERATE AND BOUNDED HERE, and JSON.parse cannot replace it: the
+// tables it lifts contain REGEX LITERALS (ROUTES) and unquoted keys (SPLIT),
+// neither of which is JSON. The input is not untrusted — it is a tracked file
+// in this repo, read by path, and the whole point of the checker is to test the
+// SHIPPING definitions rather than a copy that can drift. A copy is the failure
+// mode this file exists to prevent: two definitions of one rule is how the
+// routing table and its fixtures disagree silently. Never point this at a path
+// a caller supplies.
+const fs = require('fs')
+const src = fs.readFileSync(process.argv[2], 'utf8')
+const sdk = fs.existsSync(process.argv[3]) ? fs.readFileSync(process.argv[3], 'utf8') : ''
+const grab = (re) => { const m = src.match(re); if (!m) { console.log('FAIL: could not find ' + re); process.exit(3) } return m[0] }
+const ROUTES = eval('(' + grab(/const ROUTES = \[[\s\S]*?\n\]/).replace('const ROUTES = ', '') + ')')
+const SPLIT  = eval('(' + grab(/const SPLIT = \{[\s\S]*?\n\}/).replace('const SPLIT = ', '') + ')')
+eval(grab(/function routeFor[\s\S]*?\n\}/))
+eval(grab(/function plannedWrites[\s\S]*?\n  return writes\n\}/))
+
+let bad = 0
+const fail = (m) => { console.log('  FAIL  ' + m); bad++ }
+const ok   = (m) => console.log('  ok    ' + m)
+
+// ── 1. routing: what a file IS beats what it is ABOUT ───────────────────────
+// The first draft put the money nouns first and sent a wallet COMPONENT and a
+// wallet TEST to security-auditor. These fixtures are that bug, frozen.
+for (const [p, want] of [
+  ['one.ie/web/src/components/wallet/AllWallets.tsx', 'implementer'],
+  ['one.ie/web/tests/unit/wallet/x.test.ts', 'test-engineer'],
+  ['one.ie/web/src/lib/auth/passkey-webauthn.ts', 'security-auditor'],
+  ['pay/backend/src/signing-key.ts', 'security-auditor'],
+  ['schema/one.tql', 'architect'],
+  ['one.ie/web/src/lib/resolvers/tasks.ts', 'architect'],
+  ['text/story.md', 'tech-writer'],
+  ['one.ie/web/wrangler.toml', 'release-manager'],
+  ['one.ie/web/src/pages/about.astro', 'implementer'],
+  ['somewhere/random.go', 'cto'],
+]) {
+  const got = routeFor([p])
+  got === want ? ok(`route ${want.padEnd(17)}${p}`) : fail(`route ${p} → ${got}, want ${want}`)
+}
+
+// ── 2. the write plan ───────────────────────────────────────────────────────
+const C = {
+  FIX: { title: 'send button does nothing', triage: { verdict: 'sizeable', paths: ['one.ie/web/src/components/wallet/AllWallets.tsx'] }, size: { tier: 'FIX' },
+    shape: { want: 'Stop the Send button pretending it moved money', why: 'It emits telemetry and signs nothing.', subtasks: ['a', 'b', 'c'], chain: true, assignee: 'implementer' } },
+  UNSIZED: { title: 'make chat nicer', triage: { verdict: 'idea', paths: [] }, size: { tier: 'UNSIZED' }, shape: null },
+  PATCH: { title: 'typo', triage: { verdict: 'sizeable', paths: ['text/readme.md'] }, size: { tier: 'PATCH' },
+    shape: { want: 'Fix the misspelled word', why: '', subtasks: [], chain: false, assignee: 'tech-writer' } },
+}
+const plans = Object.fromEntries(Object.entries(C).map(([k, t]) => [k, plannedWrites(t)]))
+
+for (const [k, w] of Object.entries(plans)) {
+  const ops = w.map((x) => x.op)
+  // EXACTLY ONE notes write. Two means the second clobbers the first.
+  const notes = w.filter((x) => x.op === 'tasks:notes')
+  notes.length <= 1 ? ok(`${k}: one notes write`) : fail(`${k}: ${notes.length} notes writes — the later SETS over the earlier`)
+  if (notes[0] && /accept:\s*see above/i.test(notes[0].text)) fail(`${k}: notes back-reference a line this plan deletes`)
+  // The capture lands FIRST, before anything can overwrite the title.
+  ops[0] === 'tasks:comment' ? ok(`${k}: capture first`) : fail(`${k}: first write is ${ops[0]}, not tasks:comment`)
+  // Every emitted receiver must exist.
+  if (sdk) for (const op of new Set(ops)) {
+    if (!sdk.includes('"' + op + '"')) fail(`${k}: ${op} is not in the receiver registry — would dissolve as unknown_receiver`)
+  }
+}
+// UNSIZED is shaped by nobody.
+{
+  const ops = plans.UNSIZED.map((x) => x.op)
+  ops.some((o) => ['tasks:rename', 'tasks:reassign', 'tasks:subtask'].includes(o))
+    ? fail('UNSIZED row was renamed/assigned/split — absence of recon must not read as simplicity')
+    : ok('UNSIZED: no title, no owner, no children')
+}
+// PATCH is one piece.
+plans.PATCH.some((x) => x.op === 'tasks:subtask') ? fail('PATCH got children') : ok('PATCH: no children')
+// The chain leaves exactly one sibling ready.
+{
+  const subs = plans.FIX.filter((x) => x.op === 'tasks:subtask')
+  subs.length === 3 ? ok('FIX: 3 children') : fail(`FIX: ${subs.length} children, want 3`)
+  subs[0] && subs[0].blockedBy ? fail('first sibling is blocked — nothing would be ready') : ok('FIX: first sibling ready')
+  subs.slice(1).every((s) => s.blockedBy) ? ok('FIX: later siblings chained') : fail('FIX: a later sibling is unchained — siblings race')
+}
+process.exit(bad ? 1 : 0)
+NODE
+}
+
+if [ "$RED" -eq 0 ]; then
+  echo "triage-shape-check — invariants"
+  run_cases "$WF"; rc=$?
+  [ $rc -eq 0 ] && echo "triage-shape: self-test green" || echo "triage-shape: self-test FAILED"
+  exit $rc
+fi
+
+# ── RED PROOF ────────────────────────────────────────────────────────────────
+# A checker that stays green against gutted code proves nothing. Re-introduce
+# the two defects that were actually shipped and assert this file catches both.
+tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT
+gut="$tmp/triage.js"
+
+echo "RED PROOF 1 — second notes write restored (the clobber)"
+sed 's|if (body) writes.splice(1, 0, { op: .tasks:notes., text: body })|if (body) writes.splice(1, 0, { op: "tasks:notes", text: body }); if (task.shape \&\& task.shape.why) writes.push({ op: "tasks:notes", text: task.shape.why + "\\n\\naccept: see above" })|' "$WF" > "$gut"
+if run_cases "$gut" >/dev/null 2>&1; then echo "  FAIL: checker stayed GREEN against a double notes write"; exit 1
+else echo "  ok   checker went RED"; fi
+
+echo "RED PROOF 2 — tasks:assign restored (the absent receiver)"
+sed "s|op: 'tasks:reassign'|op: 'tasks:assign'|" "$WF" > "$gut"
+if run_cases "$gut" >/dev/null 2>&1; then echo "  FAIL: checker stayed GREEN against an unwired receiver"; exit 1
+else echo "  ok   checker went RED"; fi
+
+echo "RED PROOF 3 — money rule moved back to the front (the mis-route)"
+node -e '
+const fs=require("fs");let s=fs.readFileSync(process.argv[1],"utf8");
+s=s.replace(/const ROUTES = \[[\s\S]*?\n\]/,`const ROUTES = [\n  [/(^|\\\\/)(auth|passkey|vault|signer|wallet|escrow|payment|credits)/i, "security-auditor"],\n  [/\\\\.(astro|tsx|jsx|css)$|components?\\\\/|pages?\\\\//i, "implementer"],\n]`);
+fs.writeFileSync(process.argv[2],s)' "$WF" "$gut"
+if run_cases "$gut" >/dev/null 2>&1; then echo "  FAIL: checker stayed GREEN against a greedy money rule"; exit 1
+else echo "  ok   checker went RED"; fi
+
+echo "triage-shape: red proofs green (all three defects caught)"

package/scripts/tsc-cached.sh

@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+# tsc-cached.sh <folder> — run `tsc --noEmit` for <folder>, or reuse the answer
+# someone else already computed for this exact tree. Prints the error COUNT.
+#
+# manifest: needs-env
+#
+# WHY. do-reconcile.sh solved this in 2026-08: one tsc per (folder,
+# tree-fingerprint), everyone else reuses it, so six identical runs collapse to
+# one compute and five cache hits. verify-fast.sh never used that cache, so every
+# /do cycle paid full price for a typecheck of a tree that had not changed since
+# the last cycle typechecked it. The cache KEY FORMAT here is byte-identical to
+# do-reconcile's on purpose: they share entries, so a reconcile and N cycle gates
+# on one tree cost exactly one tsc between them.
+#
+# CRITICAL, inherited from do-reconcile: the fingerprint must cover everything
+# tsc READS, not just the folder being checked. one.ie/web resolves @oneie/sdk
+# types out of packages/sdk/dist, and its tests cross into channels/. A
+# fingerprint scoped to the folder alone would miss an SDK edit and hand back a
+# cached PASS for a tree that no longer type-checks -- a green gate over a red
+# tree, which is the one thing this harness exists to prevent.
+#
+# TSC_CACHE_DISABLE=1 forces a real run (and still records the result).
+set -uo pipefail
+
+# --self-test — the RED half. A cache that has never been seen to refuse is not
+# known to refuse. Builds a throwaway package with a real type error and proves:
+# a red count is never memoised, a red tree never replays as a HIT, and a tsc that
+# could not finish exits non-zero instead of reporting "0 errors".
+if [ "${1:-}" = "--self-test" ]; then
+  _ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+  _P="$_ROOT/.tsc-cache-probe"
+  fails=0
+  export GOVERN_DIR="$(mktemp -d)"
+  rm -rf "$_P"; mkdir -p "$_P/src"
+  cat > "$_P/tsconfig.json" <<'EOF'
+{ "compilerOptions": { "strict": true, "noEmit": true, "skipLibCheck": true }, "include": ["src"] }
+EOF
+  echo 'export const x: number = "not a number";' > "$_P/src/a.ts"
+  n1=$(bash "$0" .tsc-cache-probe 2>/dev/null)
+  if [ "${n1:-0}" -gt 0 ] 2>/dev/null; then echo "ok: a type error is reported ($n1)"
+  else echo "FAIL: type error not reported (got '$n1')"; fails=$((fails+1)); fi
+  out2=$(bash "$0" .tsc-cache-probe 2>&1 >/dev/null)
+  case "$out2" in *"cache HIT"*) echo "FAIL: a RED count replayed as a cache HIT"; fails=$((fails+1));;
+    *) echo "ok: a red tree is re-run, never replayed";; esac
+  if ls "$GOVERN_DIR"/tsc-_tsc-cache-probe.* >/dev/null 2>&1; then
+    echo "FAIL: a red count was written to the cache"; fails=$((fails+1))
+  else echo "ok: no cache entry written for a red tree"; fi
+  # green half — a pass IS memoised
+  echo 'export const x: number = 1;' > "$_P/src/a.ts"
+  n3=$(bash "$0" .tsc-cache-probe 2>/dev/null)
+  [ "$n3" = "0" ] && echo "ok: clean tree reports 0" || { echo "FAIL: clean tree reported '$n3'"; fails=$((fails+1)); }
+  out4=$(bash "$0" .tsc-cache-probe 2>&1 >/dev/null)
+  case "$out4" in *"cache HIT"*) echo "ok: a PASS is memoised";;
+    *) echo "FAIL: identical clean tree did not HIT"; fails=$((fails+1));; esac
+  # THE KEY IS CONTENT, NOT MTIME — both halves, because a constant key would
+  # pass every check above (red is never cached, so red-then-green-then-HIT
+  # proves nothing about the key moving). Measured 2026-09-04: the first cut of
+  # the content key hashed EMPTY input under zsh word-splitting and every check
+  # above stayed green. A checker that cannot go red has no demonstrated power.
+  touch "$_P/src/a.ts"                                   # mtime moves, bytes do not
+  out5=$(bash "$0" .tsc-cache-probe 2>&1 >/dev/null)
+  case "$out5" in *"cache HIT"*) echo "ok: an mtime-only change still HITs (key is content)";;
+    *) echo "FAIL: a touch invalidated the memo — the key is reading mtime"; fails=$((fails+1));; esac
+  echo '{"wave":"W2"}' > "$_P/.w2-spec.json"             # a cycle receipt, not a tsc input
+  out5b=$(bash "$0" .tsc-cache-probe 2>&1 >/dev/null)
+  case "$out5b" in *"cache HIT"*) echo "ok: a dot-file receipt does not move the key";;
+    *) echo "FAIL: .w2-spec.json invalidated the memo — the key reads cycle receipts"; fails=$((fails+1));; esac
+  echo 'export const x: number = 2;' > "$_P/src/a.ts"   # bytes move, still green
+  out6=$(bash "$0" .tsc-cache-probe 2>&1 >/dev/null)
+  case "$out6" in *"cache HIT"*) echo "FAIL: a content change replayed as a HIT — the key does not read the bytes"; fails=$((fails+1));;
+    *) echo "ok: a content change MISSes (key covers the bytes)";; esac
+  # RED PROOF — an unrun tsc must NOT read as 0 errors. A child that cannot
+  # finish inside the bound is killed by run_bounded, leaving the count file
+  # EMPTY -- exactly the shape a real 600s timeout produces. The old
+  # `n=${n:-0}` turned that empty file into "0 errors" AND cached it, so a
+  # typecheck that never ran was replayed forever as a PASS.
+  rm -rf "$GOVERN_DIR"; export GOVERN_DIR="$(mktemp -d)"
+  if TSC_CACHE_TIMEOUT=1 TSC_CACHE_CMD='sleep 30' bash "$0" .tsc-cache-probe >/dev/null 2>&1; then
+    echo "FAIL: a timed-out tsc exited 0 — an unrun gate read as a pass"; fails=$((fails+1))
+  else echo "ok: a tsc that could not finish exits non-zero"; fi
+  rm -rf "$_P" "$GOVERN_DIR"
+  [ "$fails" -eq 0 ] && { echo "tsc-cached: self-test PASS"; exit 0; }
+  echo "tsc-cached: self-test FAILED ($fails)"; exit 1
+fi
+
+folder="${1:-}"
+[ -n "$folder" ] || { echo "usage: tsc-cached.sh <folder>" >&2; exit 2; }
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT" || exit 2
+[ -d "$folder" ] || { echo "tsc-cached: no such folder: $folder" >&2; exit 2; }
+
+# shellcheck source=lib/govern.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib/govern.sh"
+
+# The key is tsc_tree_fingerprint (lib/govern.sh) — CONTENT, never mtime, over
+# everything tsc reads. It used to live here as an mtime stat over src/tests +
+# packages/sdk/src, and that key could not share across worktrees: two checkouts
+# of one commit have identical bytes and different mtimes, so the 28 stamps on
+# disk on 2026-09-03 were N worktrees each paying full price. do-reconcile.sh
+# `types` calls the SAME function, so a reconcile and N cycle gates on one tree
+# still cost exactly one tsc between them.
+# one.ie/web and channels resolve @oneie/sdk types out of packages/sdk/dist.
+_fp_extra=""
+case "$folder" in one.ie/web|channels) _fp_extra="packages/sdk/src" ;; esac
+_fp=$(tsc_tree_fingerprint "$folder" $_fp_extra)
+[ -n "$_fp" ] || { echo "tsc-cached: could not fingerprint $folder" >&2; exit 1; }
+_key="tsc-$(printf '%s' "$folder" | tr '/' '_')"
+_cache="$GOVERN_DIR/${_key}.${_fp}"
+
+# ONLY A ZERO IS REUSABLE. do-reconcile.sh writes its own counts into this same
+# key namespace on purpose (shared entries, one tsc per tree), and it records
+# NON-zero counts too because it wants a delta, not a verdict. This script is a
+# GATE, so it obeys the gate rule: only a pass may be memoised. A cached "17" is
+# re-run from scratch rather than replayed -- a red gate keeps biting until the
+# tree is actually green.
+_cache_ok() { # <file> — 0 when it holds a reusable PASS
+  [ -s "$1" ] || return 1
+  [ "$(tr -d '[:space:]' < "$1")" = "0" ]
+}
+if [ "${TSC_CACHE_DISABLE:-0}" != "1" ] && _cache_ok "$_cache"; then
+  echo "[tsc-cached] $folder — cache HIT (tree unchanged since it was checked)" >&2
+  echo 0
+  exit 0
+fi
+
+if gate_lock "$_key" "${TSC_CACHE_WAIT:-900}"; then
+  trap 'gate_release_all' EXIT INT TERM
+  # Someone may have computed it while we queued for the lock.
+  if [ "${TSC_CACHE_DISABLE:-0}" != "1" ] && _cache_ok "$_cache"; then
+    echo "[tsc-cached] $folder — cache HIT (computed while queued)" >&2
+    echo 0
+    gate_release_all; trap - EXIT INT TERM; exit 0
+  fi
+  echo "[tsc-cached] $folder — cache MISS, running tsc" >&2
+  _tmp=$(mktemp)
+  # TSC_CACHE_CMD exists for --self-test only (the `__probe__` idiom from
+  # test-cached.sh): it substitutes a child that cannot finish inside the bound,
+  # so the timeout branch below can be driven deterministically instead of raced.
+  # THE SLOT, not just the lock. gate_lock above dedupes by FOLDER: it stops two
+  # sessions computing the SAME answer twice. It does not cap concurrency across
+  # DIFFERENT folders, and N worktrees are N folders. Measured 2026-09-07: three
+  # worktrees each ran a 2.5GB tsc at once, every lock uncontended and doing its
+  # job, load hit 171 and localhost served a page in 8.4s. A lock DEDUPES; only a
+  # SLOT BOUNDS THE MACHINE. Route the compute through gate-run.sh so it queues
+  # behind GOVERN_MAX_GATES like every other heavy gate.
+  #
+  # gate-run.sh, never a bare gate_slot: its GOVERN_IN_GATE guard makes a nested
+  # gate INHERIT the outer slot rather than take a second one, and a second slot
+  # held by one logical gate is what deadlocks the queue at cap 2.
+  #
+  # stderr is deliberately NOT sent to /dev/null: gate-run announces "QUEUEING",
+  # and a wait that is silent gets read as a hang and then as a failure.
+  GOVERN_GATE_TIMEOUT="${TSC_CACHE_TIMEOUT:-600}" \
+  bash "$ROOT/.claude/scripts/gate-run.sh" "tsc-cache:$folder" -- \
+    bash -c "cd '$folder' && ${TSC_CACHE_CMD:-bunx tsc --noEmit} 2>&1 | grep -c 'error TS' > '$_tmp'" \
+    || true
+  n=$(cat "$_tmp" 2>/dev/null | tr -d '[:space:]'); rm -f "$_tmp"
+  gate_release_all; trap - EXIT INT TERM
+  # AN EMPTY COUNT IS NOT ZERO. run_bounded kills tsc at the bound and its `|| true`
+  # swallows the status, so $_tmp is empty on a timeout. The old line was
+  # `n=${n:-0}` -- an unrun typecheck was written to the cache as "0 errors" and
+  # every later reader replayed that as a PASS. An uncomputable result is a
+  # could-not-run, and a could-not-run is RED.
+  case "$n" in
+    ''|*[!0-9]*)
+      echo "[tsc-cached] $folder — tsc produced no error count (timeout or crash); check did NOT run" >&2
+      exit 1 ;;
+  esac
+  # Only a pass is recorded. See _cache_ok.
+  [ "$n" = "0" ] && printf '%s' "$n" > "$_cache"
+  echo "$n"
+  exit 0
+fi
+
+# Could not get the lock within the wait. An UNRUN check is not a passing check:
+# say so and fail, rather than emitting 0 and reading as green.
+echo "[tsc-cached] $folder — could not acquire the tsc lock; check did NOT run" >&2
+exit 1