@oneie/claude 0.7.0 → 0.9.0

package/scripts/verify-fast.sh

@@ -0,0 +1,445 @@
+#!/usr/bin/env bash
+# verify-fast.sh — the DEV lane. Run from a package folder (one.ie/web, channels).
+#
+# Full `bun run verify` is the REVIEW/DEPLOY gate (deploy.sh, /close, --full).
+# During a /do cycle we only need: does the code still typecheck, and do the
+# tests that actually cover what I touched still pass?
+#
+#   fast = sdk build + tsc --noEmit + vitest related(<changed>) + PINNED always-run
+#
+# Three rules learned the hard way:
+#   1. EMPTY DIFF ⇒ RUN THE FULL SUITE. Never ⇒ pass. A fast lane that goes
+#      green because it selected zero tests is worse than the slow one.
+#   2. PINS. `vitest related` follows imports; config/parity/boundary suites
+#      import nothing from what they guard (cron-wrangler-parity reads a .toml).
+#      Those are always run — ~seconds, and they are the class of gate that
+#      historically went dark.
+#   3. Everything heavy goes through gate-run.sh (machine governor + load-guard).
+#      This was ASSERTED here and false until 2026-09-07: tsc-cached.sh was called
+#      outside the governor on purpose (see below), so a typecheck escaped the
+#      slot cap entirely. It now takes its own slot internally.
+#
+# FULL_VERIFY=1 makes this an alias for `bun run verify`.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+GATE="$ROOT/.claude/scripts/gate-run.sh"
+FOLDER="$(pwd)"
+BASE_REF="${DO_BASE_REF:-main}"
+
+# The deferred-pin ledger. It must NOT live under $ROOT: inside a /do cycle $ROOT
+# is .do-worktrees/<slug>, and do-auto.sh --gc deletes that checkout -- so the
+# debt would evaporate with the worktree it was owed from, and the
+# outstanding-debt-on-main backstop would never see it. A deferral that can
+# vanish is a deleted gate wearing a different word, which is the exact thing the
+# ledger exists to prevent. Machine-keyed, like the gate locks, the recon cache
+# and the test memo, so every worktree and session reads ONE ledger.
+DEBT_FILE="${VERIFY_FAST_DEBT_FILE:-${TMPDIR:-/tmp}/one-verify-fast-debt}"
+
+# --- 0. generated-artifact drift ---------------------------------------------
+# `blocks-manifest.mjs` builds THREE COMMITTED artifacts from one registry:
+#   one.ie/web/src/lib/puck/block-manifest.json        what tooling reads
+#   channels/src/generated/block-enum.ts               what the model is told
+#   one.ie/web/src/lib/puck/block-schema.generated.ts  what the browser
+#                                                      normalises against
+# Until 2026-09-09 NOTHING ran it: `grep -c blocks-manifest verify-fast.sh
+# deploy.sh` was 0 and 0, and no test shells out to it. Three committed files
+# behind an ungated generator are three files that rot silently -- the registry
+# moves, the artifacts do not, and the first symptom is a model being told about
+# a block the browser cannot render.
+#
+# IT IS A STEP, NOT A PIN, and that distinction is the entire gate. `PINS` below
+# are vitest POSITIONAL SUBSTRING filters. Adding `blocks-manifest` there would
+# select zero test files, the other pins would still match, the pinned gate would
+# exit 0 -- and `grep -q blocks-manifest .claude/scripts/verify-fast.sh` would be
+# TRUE. A green grep over a check that never ran is worse than no gate at all.
+#
+# It runs BEFORE the FULL_VERIFY branch on purpose: every lane below has an exit
+# of its own (FULL_VERIFY exits at the top; an empty selection `exec`s the full
+# suite; a do/* branch exits 0 after deferring the pins), so anywhere lower is a
+# lane that can skip it. Repo-scoped, not folder-scoped -- one of the three
+# artifacts lives in channels/ and one in one.ie/web/, so both folders check both.
+#
+# NOT wrapped in gate-run.sh: one node process, ~2.5s of CPU. Most of its ~16s
+# wall is `bunx tsx` resolving a dependency this repo does not vendor
+# (`one.ie/web/node_modules/.bin/tsx` does not exist -- measured 2026-09-09), and
+# holding a machine-wide slot through a network round-trip is the anti-pattern
+# the tsc-cached note further down records.
+#
+# Capture-then-branch, per rule 3 at the top of this file: `set -e` would kill the
+# script with no message, and `node ... | grep` is the PIPESTATUS scar recorded at
+# the vitest call below. `--check` writes `ok (no drift)` to stdout and `drift
+# detected` to stderr; both are shown. A rc it cannot explain is still RED --
+# an unrun check is not a passing check.
+# MEMOISED since 2026-09-09. The raw --check is ~7s WARM (measured 8.19s then
+# 6.98s back-to-back on this box), and this lane runs on every edit, so a
+# doc-only or test-only cycle was paying 7s for a registry nobody touched.
+# blocks-manifest-cached.sh keys on the whole of one.ie/web/src -- a superset
+# of the check's declared inputs AND of the three artifacts it compares --
+# so any src edit still runs it. Only a PASS is stamped; drift is never
+# memoised. deploy.sh Step 0.5 deliberately keeps calling the RAW check: the
+# ship gate runs once and should not depend on a stamp. BLOCKS_MANIFEST_FORCE=1
+# bypasses the memo; --self-test proves the miss.
+_bm_out="$(mktemp)"
+set +e
+bash "$ROOT/.claude/scripts/blocks-manifest-cached.sh" > "$_bm_out" 2>&1
+_bm_rc=$?
+set -e
+cat "$_bm_out"; rm -f "$_bm_out"
+if [ "$_bm_rc" -ne 0 ]; then
+  echo "[verify-fast] block manifest DRIFT (or --check could not run) - rc=$_bm_rc" >&2
+  echo "[verify-fast] regenerate and commit all three artifacts:" >&2
+  echo "[verify-fast]   node .claude/scripts/blocks-manifest.mjs" >&2
+  exit 1
+fi
+
+if [ "${FULL_VERIFY:-0}" = "1" ]; then
+  echo "[verify-fast] FULL_VERIFY=1 — running the full gate"
+  # The close gate is where deferred pins come due. The full suite is a superset
+  # of every pin, so reaching here GREEN is the payment.
+  #
+  # Order is load-bearing, and the first version got it wrong: it cleared the
+  # ledger and THEN ran the suite, so a RED close wiped the debt on its way to
+  # failing and the deferred pins would never run again. Proven wrong by probe,
+  # not by reading: a scripted `verify` of `exit 1` cleared the ledger.
+  # The debt is settled by a PASS, never by an attempt. `exec` is gone for the
+  # same reason -- it replaces the process, leaving no line after the run to
+  # settle from. `set -e` is suspended around the run so a red suite reaches the
+  # settle logic instead of killing the script first.
+  _full_st=0
+  set +e
+  if jq -e '.scripts.verify' package.json >/dev/null 2>&1; then
+    bun run verify; _full_st=$?
+  else
+    # channels has no `verify` script; its full gate is typecheck + the whole suite.
+    bash "$ROOT/.claude/scripts/sdk-build-cached.sh" >/dev/null
+    bun run typecheck && bun run test; _full_st=$?
+  fi
+  set -e
+  if [ -f "$DEBT_FILE" ]; then
+    if [ "$_full_st" -eq 0 ]; then
+      echo "[verify-fast] full gate GREEN — clearing $(wc -l < "$DEBT_FILE" | tr -d ' ') deferred pin run(s)"
+      rm -f "$DEBT_FILE"
+    else
+      echo "[verify-fast] full gate RED — deferred pins stay owed" >&2
+    fi
+  fi
+  exit "$_full_st"
+fi
+
+# Pinned suites: run on every fast pass regardless of the diff.
+#
+# `portable` and `design-dock` were added 2026-09-05, after both went red at the
+# ship gate on a change whose fast pass was green. They belong here for the
+# reason the whole list exists — they import NOTHING from what they guard:
+#
+#   astro-portable  reads the pages DIRECTORY. Adding a root `*.astro` puts it in
+#                   neither ASTRO_PORTABLE nor ASTRO_NON_PORTABLE, and the new
+#                   page then 404s on every tenant host. No import graph reaches
+#                   a file that was just created, so `vitest related` cannot ever
+#                   select this — the one edit that trips it is invisible to it.
+#   design-dock     reads `Layout.astro` and every page as STRINGS, to hold "one
+#                   BrandingSection per document". An edit to Layout.astro selects
+#                   nothing that imports Layout.astro.
+#   render-sites    reads MessageList/ShowcaseMessageList as STRINGS to hold that
+#                   both approval states route to the approval card. Added
+#                   2026-09-06, after both sites gated on `approval-requested`
+#                   alone: the answered card — the whole celebration — was
+#                   unreachable through the wire, and the component suite covering
+#                   that state was green the entire time, because it handed the
+#                   card a state no render site ever passes it.
+#   panel-tabs      reads `PanelPanes.tsx` as a STRING to hold that every tab a
+#   person-panel    strip can emit resolves to a rendered pane. Both import only
+#                   `panels/tabs`, so editing ONLY PanelPanes -- which is where a
+#                   pane is DELETED -- selects neither. Measured 2026-09-09:
+#                   with `pane('task', …)` removed, all 79 tests passed.
+#   ad-flow-panel   reads `pages/ad/index.astro` and `AdFunnel.tsx` as STRINGS.
+#                   Same class as design-dock: nothing imports an .astro page.
+#
+# Deliberately NOT pinned: `page-chat-meta`, which imports everything it guards,
+# so `vitest related` already reaches it. A pin for a suite the import graph
+# covers is cost with no coverage.
+#
+# These three cost SECONDS, not the milliseconds the two above cost: measured
+# 2026-09-09, 2.34s for 49 tests, most of it `ad-flow-panel.test.tsx` building a
+# jsdom to render AdFlowPanel. That is the price of the only check that can see
+# a deleted pane, and it is paid on every fast lane.
+#
+# Cost measured on the run that motivated this: 7ms and 46ms. The failure they
+# catch costs an 18-minute deploy gate and a red ship.
+PINS_DEFAULT='parity|wrangler|boundary|authority|roles|signals-parity|receivers|portable|design-dock|render-sites|panel-tabs|person-panel|ad-flow-panel'
+PINS="${VERIFY_FAST_PINS:-$PINS_DEFAULT}"
+
+# --- changed files: committed-since-base UNION uncommitted -------------------
+# The BASE the committed half of the diff is measured from.
+#
+# Default `main` is right for a one-off check and wrong for a /do plan. On branch
+# do/<slug> the committed term is "everything this PLAN has landed", so cycle 5
+# re-selects cycles 1-4's files, cycle 6 re-selects five cycles' worth, and the
+# fast lane converges on the full suite exactly as the plan gets long. Measured:
+# 23 changed files after 3 commits, growing monotonically.
+#
+# Those earlier cycles were each verified green when they landed, and the plan's
+# LAST cycle takes the full lane anyway (do-engine escalates on final-batch
+# membership), so integration is still gated -- once, at the end, instead of once
+# per cycle.
+#
+# The cycle's own edits are UNCOMMITTED at W4 time (W4 verifies, then commits),
+# so the uncommitted term below already captures them exactly. Moving the base to
+# the previous cycle's commit just stops the committed term re-adding work that
+# is already proven. Derived from the commit message do-engine writes -- no
+# plumbing, no ref passed through an LLM. Override with VERIFY_FAST_SINCE.
+cycle_base=""
+if [ -n "${VERIFY_FAST_SINCE:-}" ]; then
+  cycle_base="$VERIFY_FAST_SINCE"
+elif git rev-parse --git-dir >/dev/null 2>&1; then
+  _br="$(git -C "$ROOT" branch --show-current 2>/dev/null || true)"
+  case "$_br" in
+    do/*)
+      _slug="${_br#do/}"
+      # do-engine's W4 prompt asks for `do(<slug>): C<n>`, but the agent writing
+      # the commit does not always obey it -- the two live plans wrote
+      # `do(lifecycle): C1` and `lifecycle-money C2: ...` respectively. Match
+      # either shape, and NEVER fall back to main: falling back is what re-selects
+      # the whole plan, which is the thing being fixed. With no boundary commit
+      # found, HEAD is the correct base -- every commit on this branch is already
+      # verified work, and this cycle's own edits are uncommitted at W4 time.
+      cycle_base="$(git -C "$ROOT" log -1 --format=%H \
+        --grep="^do(${_slug}): C[0-9]" --grep="^${_slug} C[0-9]" 2>/dev/null || true)"
+      [ -n "$cycle_base" ] || cycle_base="$(git -C "$ROOT" rev-parse HEAD 2>/dev/null || true)"
+      ;;
+  esac
+fi
+if [ -n "$cycle_base" ]; then
+  BASE_REF="$cycle_base"
+  echo "[verify-fast] cycle base ${cycle_base:0:9} (previous cycle) - earlier cycles were verified when they landed; the plan's last cycle takes the full lane"
+fi
+
+changed=""
+if git rev-parse --git-dir >/dev/null 2>&1; then
+  # -C "$ROOT" is load-bearing: run from a subdir, git prints paths relative to
+  # CWD, and the repo-relative prefix strip below then matches nothing — which
+  # silently drops every fast run into the full-suite fallback.
+  mb="$(git -C "$ROOT" merge-base HEAD "$BASE_REF" 2>/dev/null || true)"
+  { [ -n "$mb" ] && git -C "$ROOT" diff --name-only "$mb"...HEAD 2>/dev/null || true
+    git -C "$ROOT" diff --name-only HEAD 2>/dev/null || true
+    git -C "$ROOT" ls-files --others --exclude-standard 2>/dev/null || true
+  } > /tmp/.vf-changed.$$ || true
+  changed="$(sort -u /tmp/.vf-changed.$$ | grep -E '\.(ts|tsx|astro|js|mjs)$' || true)"
+  rm -f /tmp/.vf-changed.$$
+fi
+
+# Paths are repo-relative; vitest wants them relative to the package folder.
+rel="${FOLDER#"$ROOT"/}"
+scoped="$(printf '%s\n' "$changed" | sed -n "s#^${rel}/##p" || true)"
+
+echo "[verify-fast] $rel — $(printf '%s\n' "$scoped" | grep -c . || true) changed file(s)"
+
+# --- 1. SDK build (types for tsc) + typecheck --------------------------------
+# Generated-but-gitignored inputs tsc resolves as modules. Missing => a wall of
+# phantom TS2307s on any tree that has not run dev/build yet.
+if [ -f package.json ] && grep -q '"gen:page-modified"' package.json; then
+  bun run gen:page-modified >/dev/null || true
+fi
+# Through the fingerprint cache. The raw build is 2.0s of the 2.6s total
+# deterministic cost of a cycle -- 78% -- and on an unchanged src it reproduces
+# byte-identical dist (measured: same digest before and after). Skip it.
+bash "$ROOT/.claude/scripts/sdk-build-cached.sh" || { echo "[verify-fast] sdk build FAILED" >&2; exit 1; }
+# Typecheck through the SHARED fingerprint cache, not a fresh tsc every time.
+#
+# tsc-cached.sh keys on (folder, tree-fingerprint) using do-reconcile's exact key
+# format, so a reconcile and N cycle gates on one unchanged tree cost ONE tsc
+# between them instead of N. Measured on a warm tree: 21.6s -> 0.1s.
+#
+# It was written and proven in isolation and then not wired here, so every /do
+# cycle kept paying full price for a typecheck of a tree that had not changed
+# since the last cycle typechecked it. Proving an artifact is not the same as
+# proving it in place.
+#
+# It is NOT wrapped in gate-run here, and that is now safe rather than a hole:
+# tsc-cached.sh takes its own SLOT internally, around the compute and after the
+# cache double-check, so a HIT costs nothing and a MISS queues like every other
+# gate. Wrapping it out here instead would hold a slot through the up-to-900s
+# lock wait -- two sessions on one folder would occupy both slots while one only
+# waits for the other's answer.
+#
+# The comment this replaces said it "must NOT be nested inside another gate-run
+# slot -- that is a second lock on the same logical gate". That conflated the
+# per-folder dedupe LOCK with the machine-wide SLOT, and it is the instruction
+# that kept the typecheck outside the governor. It prints the error
+# COUNT on stdout and exits non-zero only when the check could not RUN; an unrun
+# check is not a passing check, so both a non-zero exit and a non-zero count fail.
+if [ -x "$ROOT/.claude/scripts/tsc-cached.sh" ] && [ "${VERIFY_FAST_TSC_CACHE:-1}" = "1" ]; then
+  _tsc_n=$(bash "$ROOT/.claude/scripts/tsc-cached.sh" "$rel") || {
+    echo "[verify-fast] typecheck could NOT RUN (tsc-cached) — treating as RED" >&2; exit 1; }
+  _tsc_n=$(printf '%s' "$_tsc_n" | tr -d '[:space:]')
+  if [ "${_tsc_n:-1}" != "0" ]; then
+    echo "[verify-fast] typecheck FAILED — ${_tsc_n} error(s) in $rel" >&2
+    exit 1
+  fi
+  echo "[verify-fast] typecheck: 0 errors (shared fingerprint cache)"
+else
+  bash "$GATE" typecheck -- bun run typecheck || exit 1
+fi
+
+# --- 2. tests ----------------------------------------------------------------
+# Tightening the base (above) introduces one way to select nothing that is NOT
+# the dangerous one rule 1 guards. On a do/* branch the cycle's edits are normally
+# uncommitted at W4 time -- but a W3 that commits its own work leaves both terms
+# empty, and rule 1 would then send every cycle to the FULL suite: slower than the
+# lane we replaced. The last commit IS that cycle's work, so retry with it before
+# concluding nothing changed. Rule 1 still has the final word: if even that is
+# empty, nothing was selected and the full suite runs.
+if [ -z "$scoped" ] && [ -n "$cycle_base" ]; then
+  last="$(git -C "$ROOT" diff --name-only HEAD~1 HEAD 2>/dev/null | grep -E '\.(ts|tsx|astro|js|mjs)$' || true)"
+  scoped="$(printf '%s\n' "$last" | sed -n "s#^${rel}/##p" || true)"
+  [ -n "$scoped" ] && echo "[verify-fast] cycle edits were already committed - selecting the last commit's $(printf '%s\n' "$scoped" | grep -c . || true) file(s)"
+fi
+
+if [ -z "$scoped" ]; then
+  echo "[verify-fast] no changed source files in $rel — falling back to the FULL suite"
+  exec bash "$GATE" test -- bun run test
+fi
+
+# vitest `related` resolves the importers of the changed files.
+# Through test-cached.sh: identical inputs (same selection, same file contents,
+# same working delta) reuse the recorded PASS instead of re-running. Only passes
+# are remembered -- a red gate re-runs every time until it is green.
+# shellcheck disable=SC2086
+# THE THIRD CASE. Rule 1 covers an empty DIFF. This is an empty SELECTION: the
+# diff is non-empty, but `vitest related` resolves no importers, and vitest then
+# prints "No test files found" and exits 1. That is a FALSE RED -- it fails the
+# cycle for a property of the import graph, not of the code. Measured on
+# src/lib/authority.ts, a real file a real cycle edits.
+#
+# It must not become a pass either; selecting zero tests is exactly the shape
+# rule 1 exists to refuse. So an empty selection falls back to the FULL suite,
+# the same answer an empty diff gets. Conservative in the safe direction.
+# `if cmd | tee` would test TEE's status, not the gate's -- the PIPESTATUS trap
+# this repo has a scar for. Capture first, then branch on the real exit code.
+# `set -e` is ON: a bare failing command exits the script BEFORE the next line,
+# so `cmd; rc=$?` never assigns and the fallback below never runs -- the test gate
+# then vanishes silently, which is strictly worse than the false RED being fixed.
+# Measured: the run stopped after "typecheck: 0 errors" and printed no test line
+# at all. Suspend it around the call, exactly as the FULL_VERIFY branch does.
+
+# --- memo probe: never queue for a slot you do not need ----------------------
+# Both test legs below go through test-cached.sh, which reuses a recorded PASS.
+# But the SLOT was taken first and the memo consulted second, so a hit still
+# waited in the governor queue. Measured 2026-09-09 on a saturated box: a single
+# acquisition queued 855s and 1324s -- for work that, on a hit, is a stat() of a
+# stamp file. A hit needs no memory, no forks and no slot.
+#
+# _memo_hit asks test-cached.sh itself (TEST_CACHE_PROBE=1, runs nothing, exits 0
+# on a hit) so there is exactly ONE definition of what a hit is. On a MISS we
+# fall through and take the slot exactly as before -- the gate is never skipped,
+# only the WAIT for a gate that had nothing to do.
+_memo_hit() {
+  TEST_CACHE_PROBE=1 bash "$ROOT/.claude/scripts/test-cached.sh" "$@" >/dev/null 2>&1
+}
+
+_rel_out="$(mktemp)"
+set +e
+if _memo_hit "$rel" -- related --run $(printf '%s ' $scoped); then
+  echo "[verify-fast] related: cache HIT — no slot taken"
+  _rel_rc=0
+else
+  bash "$GATE" test -- bash "$ROOT/.claude/scripts/test-cached.sh" "$rel" -- related --run $(printf '%s ' $scoped) > "$_rel_out" 2>&1
+  _rel_rc=$?
+fi
+set -e
+cat "$_rel_out"
+if [ "$_rel_rc" -eq 0 ]; then
+  :
+else
+  if grep -q 'No test files found' "$_rel_out"; then
+    # An empty SELECTION must never read as a pass, and must not silently exit 1
+    # either -- vitest prints "No test files found" and exits 1, which fails the
+    # cycle for a property of the import graph rather than of the code.
+    #
+    # HOW I MISREAD THIS, recorded so the next reader does not repeat it: I first
+    # hit the empty selection on src/lib/authority.ts and concluded the file was
+    # untested. It is not -- `vitest related` finds 338 test files for it. The
+    # empty selection was an ARGUMENT-PASSING bug in the test-cached wrapper,
+    # fixed separately (c983c45e2). So this branch is a genuine guard against a
+    # state that must not be a pass, NOT evidence that any particular file lacks
+    # coverage. Do not infer a coverage gap from reaching here without checking
+    # `bunx vitest related --run <file>` directly first.
+    #
+    # The pins still run, so the gate is not skipped, and the files are named so
+    # the condition is visible instead of silent.
+    echo "[verify-fast] vitest selected NO test files for these changed files:" >&2
+    printf '%s\n' $scoped | sed 's/^/  - /' >&2
+    echo "[verify-fast] running the pinned gates only. VERIFY the selection by hand before trusting this:" >&2
+    echo "[verify-fast]   bunx vitest related --run <file>   (an empty result here is usually a WRAPPER bug, not a coverage gap)" >&2
+    echo "[verify-fast] VERIFY_FAST_UNCOVERED_FULL=1 forces the whole suite instead." >&2
+    if [ "${VERIFY_FAST_UNCOVERED_FULL:-0}" = "1" ]; then
+      rm -f "$_rel_out"; exec bash "$GATE" test -- bun run test
+    fi
+    _rel_rc=0
+  fi
+  if [ "$_rel_rc" -ne 0 ]; then rm -f "$_rel_out"; exit 1; fi
+fi
+rm -f "$_rel_out"
+
+# Pinned gates that no import graph reaches. vitest positional filters are
+# SUBSTRINGS, not a regex — one alternation string matches nothing and exits 1
+# ("No test files found"), which reads as a failed gate. Pass one arg per pin.
+#
+# TIER-GATED, and MEMOISED. The pinned block is 44 files / 420 tests / ~20s and it
+# ran on every cycle regardless of the diff -- a six-cycle plan paid it six times
+# for a surface that never moved. Two independent cuts, neither of which checks
+# less:
+#
+#   1. tier. do-tier.sh already sizes the change. A PATCH (a doc line, a comment)
+#      cannot reach the authority/receivers/parity surface these pins guard, so it
+#      does not pay for them. FIX and above run the full pin set, unchanged.
+#      DEFAULT UP here, the opposite of do-tier's own default-down: an unknown
+#      tier runs ALL the pins. Skipping a gate on a guess is the failure this
+#      harness has the most scars from.
+#   2. memo. Identical pins over an identical tree reuse the recorded PASS.
+#
+# VERIFY_FAST_PINS_ALL=1 forces the whole set.
+#
+# THE TIMING CUT. The pins guard integration surfaces -- parity, boundary,
+# authority, receivers. Integration is a property of the FINISHED plan, not of
+# cycle 3 of 6. Running them per-cycle was testing at the wrong time: six
+# identical answers to a question only the last one can actually decide.
+#
+# So mid-plan they are DEFERRED, not deleted. The debt is written to
+# .verify-fast-debt in the repo root, and the close gate (FULL_VERIFY=1, which
+# /close and ./deploy both export) runs the whole suite and clears it. Accuracy
+# is MOVED to the moment it matters, never dropped: a plan cannot reach a ship
+# gate with the debt outstanding, because the ship gate is the full suite.
+#
+# The deferral applies ONLY on a do/<slug> branch -- a one-off check on main has
+# no later gate to defer to, so it pays now. And an outstanding debt on main means
+# a plan landed without ever reaching its close gate: pay it here, immediately.
+# A deferral that can be forgotten is a deleted gate wearing a different word.
+if [ -f "$DEBT_FILE" ] && { [ -z "${_br:-}" ] || [ "${_br#do/}" = "${_br:-}" ]; }; then
+  echo "[verify-fast] outstanding deferred pins from a merged plan — paying now (branch ${_br:-detached})"
+  VERIFY_FAST_PINS_ALL=1
+fi
+if [ "${VERIFY_FAST_PINS_ALL:-0}" != "1" ] && [ -n "${_br:-}" ] && [ "${_br#do/}" != "${_br:-}" ]; then
+  printf '%s\t%s\t%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$_br" "$rel" >> "$DEBT_FILE"
+  echo "[verify-fast] pins DEFERRED to the close gate (branch $_br) — debt recorded in .verify-fast-debt; FULL_VERIFY=1 clears it"
+  echo "[verify-fast] PASS (fast lane, pins deferred — full gate runs at /close and ./deploy)"
+  exit 0
+fi
+
+_tier="$(printf '%s\n' $scoped | sed "s#^#${rel}/#" | bash "$ROOT/.claude/scripts/do-tier.sh" 2>/dev/null | jq -r '.tier // "UNKNOWN"' 2>/dev/null || echo UNKNOWN)"
+IFS='|' read -r -a _pins <<< "$PINS"
+if [ "${VERIFY_FAST_PINS_ALL:-0}" != "1" ] && [ "$_tier" = "PATCH" ]; then
+  echo "[verify-fast] tier=PATCH — pins narrowed to the parity/boundary core (FIX+ runs all $PINS)"
+  _pins=(parity boundary)
+else
+  echo "[verify-fast] tier=$_tier — running the full pin set"
+fi
+if _memo_hit "$rel" -- run "${_pins[@]}"; then
+  echo "[verify-fast] pins: cache HIT — no slot taken"
+elif ! bash "$GATE" test -- bash "$ROOT/.claude/scripts/test-cached.sh" "$rel" -- run "${_pins[@]}"; then
+  echo "[verify-fast] pinned gate FAILED (pins: ${_pins[*]})" >&2
+  exit 1
+fi
+
+echo "[verify-fast] PASS (fast lane — full gate still runs at /close and ./deploy)"

package/scripts/vespio-sync.sh

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+# vespio-sync.sh — one-way harness sync, one-ie -> apps/vespio.
+#
+# Vespio is an AGENCY repo (clients/, site/, web/, ai/, packages/). It is not
+# the monorepo: no schema/, no pay/, no channels/, no text/ promise layer. So
+# "sync everything" is the wrong instinct — most of one-ie's harness hard-asserts
+# against a tree vespio does not have.
+#
+# THE AUTHORITY IS THE MANIFEST IN factory-repo.sh. It already classifies every
+# script portable | needs-env | monorepo-only. This script reads that manifest
+# rather than keeping a second list that could drift from it. An UNCLASSIFIED
+# script does not ship — silence is never a licence.
+#
+#   bash .claude/scripts/vespio-sync.sh --check   # what's missing/drifted (read-only)
+#   bash .claude/scripts/vespio-sync.sh           # copy, then show the diff
+#   bash .claude/scripts/vespio-sync.sh --commit  # copy + commit (never pushes)
+#
+# Never pushes. Never stages by wildcard — every path is named. The 6 modified
+# clients/*/data/lifecycles/*.toml in vespio belong to someone else's work and
+# must never ride along in a sync commit.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+VESPIO="${VESPIO_ROOT:-$ROOT/../apps/vespio}"
+MODE="${1:-}"
+
+[ -d "$VESPIO/.git" ] || { echo "no vespio repo at $VESPIO"; exit 1; }
+
+# ROOT is derived from BASH_SOURCE, so invoking this by a RELATIVE path from
+# inside vespio resolves ROOT to vespio and syncs the tree onto itself. Assert
+# the source is really one-ie before touching anything.
+[ -f "$ROOT/schema/one.tql" ] || {
+  echo "refusing: \$ROOT ($ROOT) is not the one-ie monorepo (no schema/one.tql)."
+  echo "run this from /Users/toc/Server/one-ie, or by absolute path."
+  exit 1
+}
+[ "$(cd "$ROOT" && pwd -P)" != "$(cd "$VESPIO" && pwd -P)" ] || {
+  echo "refusing: source and destination are the same tree"; exit 1
+}
+
+# --- the shippable set, read from the single manifest ------------------------
+shippable() {
+  sed -n '/^manifest() {/,/^MANIFEST/p' "$ROOT/.claude/scripts/factory-repo.sh" \
+    | grep -E '^(portable|needs-env) ' | awk '{print $2}' | sort
+}
+unclassified() {
+  bash "$ROOT/.claude/scripts/factory-repo.sh" --check-portability 2>/dev/null \
+    | sed -n 's/.*FAIL unclassified: //p' | sort
+}
+
+# Commands that make sense in an agency tree. Deliberately excluded and why:
+#   deploy.md db-sync.md release.md  -> 5-service monorepo pipeline
+#   one.md                           -> nine fleets over text/ docs vespio lacks
+#   oo-push.md rag.md                -> monorepo-specific surfaces
+COMMANDS="browser.md cc-connect.md chat.md close.md create.md do.md do-autonomous.md
+          do-improve.md do-show.md go.md improve.md kill.md notify.md restart.md
+          see.md skill-create.md sync.md"
+
+# Skills that are tree-agnostic craft. Excluded: typedb, sdk, mcp, cli, puck,
+# promise-* (need schema/, packages/, or the text/ promise layer).
+SKILLS="astro react19 shadcn writer voice docs"
+
+copied=0; missing=0
+say() { printf '  %-14s %s\n' "$1" "$2"; }
+
+ship_one() { # ship_one <relpath under .claude>
+  local rel="${1:-}"; [ -n "$rel" ] || return 0
+  local src="$ROOT/.claude/$rel" dst="$VESPIO/.claude/$rel"
+  [ -e "$src" ] || { say "ABSENT" "$rel"; missing=$((missing+1)); return; }
+  if [ "$MODE" = "--check" ]; then
+    if [ ! -e "$dst" ]; then say "MISSING" "$rel"; missing=$((missing+1))
+    elif ! diff -q "$src" "$dst" >/dev/null 2>&1; then say "DRIFTED" "$rel"; missing=$((missing+1)); fi
+    return
+  fi
+  mkdir -p "$(dirname "$dst")"
+  # A second run must be identical to the first. `cp -R src dst` NESTS when dst
+  # already exists (dst/src), so a re-sync silently built skills/writer/writer.
+  # Remove the destination first — this is a mirror, not an accumulation.
+  rm -rf "$dst"
+  # -L dereferences symlinks: .claude/skills/livekit-agents points outside the
+  # tree and would land in vespio as a dangling link.
+  cp -RL "$src" "$dst" && copied=$((copied+1))
+}
+
+echo "== vespio-sync  $ROOT -> $VESPIO"
+un="$(unclassified)"
+if [ -n "$un" ]; then
+  echo "-- NOT SHIPPING (unclassified in the manifest — classify them to ship):"
+  echo "$un" | sed 's/^/     /'
+fi
+
+echo "-- scripts (manifest: portable + needs-env)"
+while read -r f; do [ -n "$f" ] && ship_one "scripts/$f"; done <<< "$(shippable)"
+
+echo "-- rules"
+for f in api.md astro.md design.md documentation.md engine.md react.md ui.md; do ship_one "rules/$f"; done
+
+echo "-- agents"
+for f in w1-recon.md w2-decide.md w3-edit.md w4-verify.md; do ship_one "agents/$f"; done
+
+echo "-- commands"
+for f in $COMMANDS; do ship_one "commands/$f"; done
+
+# /vespio has TWO bodies: the monorepo-side one (sync + push, lives in
+# .claude/commands/vespio.md here) and the vespio-side one (start the fleet).
+# Shipping the monorepo body would tell a vespio clone to run vespio-sync.sh,
+# which is monorepo-only and not there — a command that lies from inside the
+# repo it ships to. So the REMOTE body is authored separately and mapped on.
+ship_mapped() { # ship_mapped <src rel> <dst rel>
+  local src="$ROOT/.claude/$1" dst="$VESPIO/.claude/$2"
+  [ -f "$src" ] || { say "ABSENT" "$1"; missing=$((missing+1)); return; }
+  if [ "$MODE" = "--check" ]; then
+    if [ ! -e "$dst" ]; then say "MISSING" "$2"; missing=$((missing+1))
+    elif ! diff -q "$src" "$dst" >/dev/null 2>&1; then say "DRIFTED" "$2"; missing=$((missing+1)); fi
+    return
+  fi
+  mkdir -p "$(dirname "$dst")"; rm -rf "$dst"; cp -L "$src" "$dst" && copied=$((copied+1))
+}
+ship_mapped "commands/vespio.remote.md" "commands/vespio.md"
+
+echo "-- skills"
+for s in $SKILLS; do ship_one "skills/$s"; done
+
+if [ "$MODE" = "--check" ]; then
+  echo "== $missing item(s) missing or drifted"
+  [ "$missing" -eq 0 ] && echo "   vespio is current." 
+  exit 0
+fi
+
+echo "== copied $copied item(s)"
+cd "$VESPIO"
+echo "-- vespio diff (.claude only):"
+git status --porcelain .claude | sed 's/^/     /'
+
+if [ "$MODE" = "--commit" ]; then
+  # explicit paths only — never `git add -A`. A neighbour's uncommitted
+  # clients/*/lifecycles edits must not be swept into a harness sync.
+  git add .claude
+  if git diff --cached --quiet; then echo "nothing to commit"; exit 0; fi
+  git commit -q -F - <<'MSG'
+chore(claude): sync harness from one-ie
+
+Manifest-driven — the shippable set is read from factory-repo.sh's
+portability manifest, not a second list. Unclassified scripts do not ship.
+Excluded by design: the 5-service deploy pipeline, the text/ promise layer,
+and schema/-dependent skills, none of which exist in this tree.
+MSG
+  echo "committed. Review, then push by hand: git -C $VESPIO push origin main"
+fi