@oneie/claude 0.8.0 → 0.10.0

package/commands/do.md

@@ -171,12 +171,16 @@ The pruned spine by tier:
 ```
 PATCH     AIM → BUILD → VERIFY                                                                          (edit + W4 verify gate; 0 spawns)
 FIX       AIM → SURVEY → [INVESTIGATE] → DOCS → BUILD → TEST → PROVE → LEARN
-FEATURE   AIM → PROMISE → SURVEY → DESIGN ▸clarify → DOCS → PLAN ▸analyze → TEST → BUILD → VERIFY → PROVE → TEACH → SHIP → LEARN
+FEATURE   AIM → PROMISE → SURVEY → DESIGN ▸clarify → DOCS → PLAN ▸analyze ▸board ▸meet → TEST → BUILD → VERIFY → PROVE → TEACH → SHIP → LEARN
 SCHEMA    = FEATURE + Substrate reconcile at max
 
   ▸ Docs-first order: DOCS (the full doc set = the spec) is written right after DESIGN; TEST (from those docs)
     is written before BUILD; BUILD makes docs+tests true; PROVE validates the shipped thing against the docs;
     TEACH is now reconcile-not-author (correct any doc↔reality drift so every doc ends true).
+
+  ▸ Board-then-meet: ▸board mirrors the plan's batch DAG onto the board as chained rows; ▸meet convenes
+    the heads who will claim them. BOTH run before BUILD, and in that order — a meeting called before the
+    rows are chained hands every head every cycle at once, and the fan-out is a race.
 ```
 
 `INVESTIGATE` rides any tier when the work touches code we didn't just write — it's the "understand before you change" step, not a separate tier.
@@ -199,6 +203,8 @@ For each **enabled** stop (per the pruned spine), in order: check if its artifac
 | **DOCS** | doc set exists ∧ reconciles | the **full** doc set, written as the spec — `docs` skill picks the types, `writer` drafts: always `-docs.md`; + `-tutorial`/`-how-to`/`-reference`/`-agents-docs` per condition. Written in the reader's language *before* code — this is the acceptance spec PROVE validates against. Not a draft: the real thing | sonnet · medium |
 | **PLAN** | `test -f text/<slug>-todo.md` | `/create todo` + `text/template-todo.md` — cycles + deliverables derived from the docs (each cycle ships a documented observable) | sonnet · medium |
 | ↳ *ANALYZE* | — | `do-analyze.sh text/<slug>-todo.md [--strict-promise]` — CRITICAL exit 1 blocks BUILD. Also reads `text/<slug>.md` and HIGH-warns any promise `accept:` no `C<n>` cycle carries (the todo's `outcome:` and `Correct-course` blocks are not corpus — that's where the gap hides); `--strict-promise` makes an uncovered deliverable CRITICAL | bash · none |
+| ↳ *BOARD* | `bash .claude/scripts/do-board.sh <slug> --status` shows a tid and a live status on every cycle (drift 0) | **`bash .claude/scripts/do-board.sh <slug>`** — the ONE minter of cycle rows (`do-signal.sh --task-plan` delegates to it). Reuses the plan row do-auto already filed as `anchor:`, walks the batches **in order**, one `tasks:subtask` per cycle (`parent` = anchor, `blockedBy` = the previous batch's tids, tags `slug:<slug>-c<n>` + `plan:<slug>`, notes = the cycle's goal delta + the close command), and writes `anchor:` + `cycle_rows:` back after **every batch**. Idempotent (an existing row only gets its edges re-asserted with `tasks:depend`) and resumable. `--dry-run` walks the same loop against a fake door. **The return leg already exists:** the engine's `--task-cycle <slug> C<n> done` resolves the same `slug:` tag, so closing a cycle unblocks the next batch on the board with no new wire | bash · none |
+| ↳ *MEET* *(fan-out plans only — any batch with ≥2 cycles)* | a thread id in `/u/<slug>/in` and every claimable cycle row carries a **named** assignee (`do-board.sh <slug> --status`) | the `meeting` skill — chairman convenes, heads **claim · delegate · chat · chain**, ledger read back from D1. Under the shared gateway key every head claims as the workspace (`@one`), so a head **names itself with `tasks:reassign` after `tasks:claim`** — the two calls are one act. Skipped when the plan is one head wide | opus · high |
 | **TEST** | test file in the repo folder | test-first **from the docs** — one assertion per documented observable; the docs' claims become the executable acceptance tests *before* code exists | sonnet · low |
 | **BUILD** | survey verdict = `build` (≥70% match → `expose`/`extend` instead) | the BUILD engine (Step 3) — make the docs + tests true | sonnet · low–medium |
 | **VERIFY** | rubric + ratchet pass | `do-reconcile.sh <canon>` per category + rubric composite ≥ 0.65 | haiku · medium |
@@ -207,6 +213,56 @@ For each **enabled** stop (per the pruned spine), in order: check if its artifac
 | **SHIP** | changelog / README row | `/release` + adoption signal | sonnet · low |
 | **LEARN** | learnings entry written | close: learnings + cost signal + trust write | — |
 
+### The board is the plan's other rendering — and the gate that enforces it
+
+A plan's cycles and the board's rows are **the same work, twice**. Until ▸board existed they were
+two graphs that drifted: `batches:` held the ordering in markdown, D1 held it in `blocks` edges,
+and nothing joined them.
+
+**The join is not bookkeeping. `tasks:claim` is BLOCKER-GATED and reads the very `blocks` edge
+`tasks:depend` writes.** So a plan mirrored onto the board **cannot be claimed out of order** —
+the substrate enforces the batch DAG that used to be a comment. A plan that is *not* mirrored
+hands every agent every cycle at once.
+
+```
+batches: [[C1],[C2,C3],[C4]]   ≡   C2.blockedBy=[C1] · C3.blockedBy=[C1] · C4.blockedBy=[C2,C3]
+```
+
+**If the two disagree, the BOARD is truth** — it is what the gate reads. `do-plan-json.sh` emits
+both so the drift is visible rather than silent.
+
+**Mint with `tasks:subtask`, never `tasks:create`.** Subtask writes the row, its notes, its tags,
+its `containment` edge to the anchor **and** every `blockedBy` in ONE pipeline — precisely so a
+child never appears claimable with an empty body or missing ordering. A cycle row made with
+`tasks:create` is an orphan that some head claims before it is ready.
+
+**A cycle with no row is invisible to every agent but the one running `/do`.** Measured
+2026-09-12: fifteen filed rungs returned in **zero** of `tasks:everywhere`'s reads at any limit
+(hard cap 200, weight DESC, `tag` ignored) — which, not neglect, was why every one had sat open.
+Read rungs with `tasks:list` by tag, and treat a count from a capped door as not a count.
+
+### ▸meet — the four verbs, and when the chairman convenes
+
+A meeting is **not** where heads report. It is where they take a row, hand a row, argue on the
+row, and put the rows in order:
+
+| verb | door |
+|---|---|
+| **claim** | `tasks:claim` — blocker-gated; the claimant is the **attested caller**, never a body field. Under the gateway key that caller is the *workspace* (`@one`) for every head, so a spawned head follows the claim with `tasks:reassign {assignee: <its own slug>}` or the ledger cannot say who took what |
+| **delegate** | `tasks:reassign` (moves the row in place) · `tasks:announce` (to the world by tags — returns `matched`, and **matched is not delivered**) |
+| **chat** | `tasks:comment` (same D1 store as the inbox thread) · `thread:append` for the room |
+| **chain** | `tasks:subtask` (split) · `tasks:depend` (order) |
+
+Protocol: the **`meeting` skill** (`.claude/skills/meeting/SKILL.md`); form:
+`text/template-meeting.md`. Two rules the skill enforces that `/do` depends on — **no head leaves
+without a tid**, and **size the spawn to the budget** (five heads spawned into a budget that
+carried two report nothing at all).
+
+**The lease moves to the cycle.** `blockersResolved` reads `containment` too, so once cycle rows hang off the anchor a `tasks:claim` on the plan row is refused as `blocked` for the whole run. `do-signal.sh --task-claim` and `do-fleet.sh` therefore lease the **first open cycle's row** when `cycle_rows:` is filled — the row actually in flight, gated by its own batch.
+
+**▸meet is skipped when the plan is one head wide.** A meeting with one attendee is a status
+update, and the checklist refuses it.
+
 **Docs are written first, validated last.** `text/<slug>-docs.md` (and the conditional doc set) is the **spec** — authored at DOCS, *before* BUILD, in the reader's language, so the plan and tests are drawn from a sharp description of intended behavior. It is not a draft: it is what the build must make true. At TEACH / plan close the same doc is **validated, not re-authored** — PROVE checks the shipped thing against it, and any drift is reconciled (fix the doc where reality justifiably diverged, or loop BUILD where the code fell short). Every doc ends true. *(This supersedes the old seed-at-PLAN / refine-at-TEACH pattern: the first write is the real spec, the last touch is validation.)*
 
 **Doc artifacts — all ten templates, each gated.** Every doc type in `text/docs.md` has a template (`text/templates.md` is the map). The **promise's `derives:` manifest** (`text/<slug>.md` frontmatter) declares which of these the feature spawns; the `docs` skill (`.claude/skills/docs/SKILL.md`) confirms the choice at DESIGN/DOCS — neither forces all ten. **Three are spine (automatic); seven are conditional (write only if the promise's `derives:` set them true, else skip).** All are written *before* BUILD. Copy the template, never write from scratch.
@@ -232,7 +288,7 @@ The two `↳` rows are **gates, not artifacts**: CLARIFY edits the plan in place
 - **`deliverables:`** — the **schedule of work**, enumerated and exhaustive: every item the client receives, each with its own `accept:` check. Not on the schedule = not promised (it goes in the promise's "Out of scope" section, in writing); on the schedule = ships or the whole promise settles broken. Acceptance is indivisible — no partial credit. `assumes:` alongside it lists client-side dependencies, each green at the making (a failing assumption means the contract can't be signed yet).
 - **`proof:`** — the acceptance test that settles the contract: **derived, not authored** — the `&&`-join of every deliverable's `accept:`, verbatim, so the one observable is exhaustive *by construction*. It *becomes* the todo's `outcome:`, the TEST assertion, and the PROVE oracle — named once here, never restated loosely. The schedule ⇄ proof law is enforced by `.claude/scripts/do-promise-lint.sh <slug>` (zero LLM — the PROMISE gate): every `accept:` must appear inside `proof:`, every item must carry an `accept:`, every assumption must hold; `--red` additionally requires the proof RED at PROMISE. Promises predating the schedule (no `deliverables:` block) pass grandfathered.
 - **`derives:`** — the manifest of which artifacts this promise spawns. `/do` reads it to know which conditional stops to backfill (instead of re-deciding at DESIGN); the tier prune still applies on top.
-- **`world:`** — the manifest of runtime the kept promise puts into the substrate: lifecycle moves (+ the signal that records each), workflow steps (the locked kinds), agents (+ their `subscribes:` tags), skills, task tags, tracking marks/warns, routing paths. At DESIGN/PLAN, `/do` presence-checks every entry the same way it checks an artifact — **missing agent → a `template-agent.md` cycle (+ `subscriptions:register` for its tags) · missing skill → `/skill-creator` · missing workflow/lifecycle stage → a cycle in the todo · present → skip**. PROVE reads `tracking.marks` as production observables alongside the docs; the `routing:` paths are where cycle composites and run-time outcomes land, so the ranker routes the next wave toward what worked. The fan-out builds exactly what the promise names — nothing more.
+- **`world:`** — the manifest of runtime the kept promise puts into the substrate: lifecycle moves (+ the signal that records each), workflow steps (the locked kinds), agents (+ their `subscribes:` tags), skills, the tag's own **code** surfaces, task tags, tracking marks/warns, routing paths. At DESIGN/PLAN, `/do` presence-checks every entry the same way it checks an artifact — **missing agent → a `template-agent.md` cycle (+ `subscriptions:register` for its tags) · missing skill → `/skill-creator` · missing workflow/lifecycle stage → a cycle in the todo · present → skip**. The `code:` sub-block is the one kind checked MECHANICALLY rather than by reading — it names `ts`/`astro`/`tql`/`panel`/`command` paths relative to the repo root, and `bash .claude/scripts/do-world-check.sh <slug>` answers missing/present for each under the same rule (exit 1 on a declared path that does not exist). PROVE reads `tracking.marks` as production observables alongside the docs; the `routing:` paths are where cycle composites and run-time outcomes land, so the ranker routes the next wave toward what worked. The fan-out builds exactly what the promise names — nothing more.
 
 **Contract-backed promises mint on-chain.** When the promise carries an uncommented `contract:` block (`text/template-feature.md`'s optional on-chain block), PROMISE also runs `bun pay/tools/promise-chain.ts mint <slug>` — it submits the generated `create_promise` with `terms_hash = sha256(text/<slug>.md)` and writes `object_id` + `maker` back into the frontmatter. Unarmed (no signer) → clean exit 2, the promise stays off-chain-only until minted. At close, `do-promise-settle.sh` settles **both halves** from the one proof exit code.
 

package/commands/sweep.md

@@ -0,0 +1,159 @@
+# /sweep
+
+> **Every finished branch into `dev`, one gate, one sha to promote.**
+> `/sweep` is the door before `/deploy`. It runs `bash .claude/scripts/sweep.sh`
+> — the script is the authority for the procedure; this page never carries a
+> second copy of the steps.
+>
+> ```bash
+> bash .claude/scripts/sweep.sh --dry-run    # the whole plan, nothing moved
+> bash .claude/scripts/sweep.sh              # doctor · fetch · classify · land · ONE gate · gc · close
+> bash .claude/scripts/sweep.sh --pr         # …and open/refresh the dev → main PR
+> ```
+>
+> **Run it from the MAIN tree's copy**, like every other door script — `land.sh`,
+> `release.sh` and `deploy.sh` all derive `ROOT` from `${BASH_SOURCE[0]}/../..`,
+> so a worktree's copy sweeps that worktree (`../CLAUDE.md § The dev → prod loop`).
+
+**It does not ship.** It ends by naming the sha and handing the last two doors to
+`release-manager` — see `/deploy`.
+
+---
+
+## What it costs: one gate, not N
+
+`land.sh` gates each branch **with dev merged in**. That is a different tree per
+branch, so six branches is six full computes plus the release gate. The memo does
+not help: `test-cached.sh` is content-addressed, so the same suite on the same
+tree is already free — the cost was never double-calling, it was N different trees.
+
+`/sweep` inverts the order:
+
+1. merge every **ready** branch into `dev` first,
+2. read each branch's own typecheck as a **memo lookup** (`tsc-cached.sh --probe`
+   — a read, never a compute),
+3. run **one** gate on the integrated tree.
+
+N+1 computes becomes 1. The lane is chosen deterministically from what was swept:
+`fast` by default, **`full`** whenever the merge touched `schema/`,
+`packages/sdk/` or auth — the canon's own escalation rule, applied by the script
+rather than remembered by a human.
+
+**What that trade costs, said out loud.** A batched gate cannot name which of N
+branches owns a red. So a red **resets `dev` to the pre-sweep sha** and prints the
+`land.sh` line for each branch — where the four-owner diagnosis (branch · dev ·
+seam · environment, measured 2026-09-12) still lives. You pay the N gates only in
+the case that needs them. **`land.sh`'s own default is unchanged**; use it
+directly for a single branch.
+
+---
+
+## The four classes
+
+Classification is `lib/gc-finished.sh` — the same predicate the sweep that removes
+worktrees uses, sourced, not re-implemented. It is **content identity**, never
+`rev-list --count`: a branch whose patch landed under another sha (rebase,
+squash, cherry-pick) is finished, and a merge commit carrying unique files is not.
+
+| Class | Test | What happens |
+|---|---|---|
+| `infra` | `main` · `dev` · `release` | never touched |
+| `landed` | its content is already in `dev` | left for the gc, which measures against **`origin/main`** |
+| `busy` | ahead, but its worktree has uncommitted **work** or something is running in it | skipped, and the reason is named |
+| `ready` | ahead, clean, idle | merged |
+
+Build output is not work: `one.ie/web/.astro`, `.wrangler`, `.preview`,
+`node_modules` and friends never make a branch busy.
+
+**gc measures against `origin/main`, after a fetch, and that is deliberate.** A
+branch is finished when it is *released*, not when it is integrated — a reviewer
+asking for changes must not find the branch already deleted. A stale local ref
+makes landed work look unmerged (measured 2026-09-07: local main 131 behind, 1.0 GB
+hoarded), which is why the fetch is the first git command.
+
+---
+
+## The doctor holds the box
+
+Phase 0 is `health.sh --box --json`. A sweep **starts gates**, and on a paging box
+a gate runs long — a slow gate is indistinguishable from a red one at the wall
+clock, which is how a good tree gets diagnosed as broken code.
+
+| Verdict | What sweep does |
+|---|---|
+| `HEALTHY` | go |
+| `DEGRADED` | go — it funds one concurrent gate, and a sweep needs exactly one |
+| `UNHEALTHY` | reap **only if `orphans > 0`**, re-read, then refuse (exit 3) and name the agent |
+
+On a refusal, spawn the doctor and re-run:
+
+```
+Agent({ subagent_type: "doctor", model: "opus",
+        prompt: "health.sh says: <why>. Reclaim what nothing is coming back for, then report the verdict." })
+```
+
+`--dry-run` is **never** refused for the box — a plan starts no gates, and a tool
+that refuses a plan teaches you to pass `--no-doctor` by reflex. The flag you
+reach for out of habit is the flag that stops protecting you.
+
+---
+
+## The numeric close
+
+```
+ready=2 merged=2 landed=4 busy=1 infra=3 gates=1 lane=fast box=DEGRADED dev=85250c0b6 ahead_of_main=8
+```
+
+Every number is counted, not narrated. `gates` is the one that matters: it is the
+count of real computes the sweep cost, and it is 1.
+
+Exit codes are distinct and named, because "it refused" is not a finding:
+`0` ok · `2` usage · `3` box refused · `4` integrated gate RED (dev reset) ·
+`5` a merge conflicted (dev reset) · `6` nothing to sweep and nothing to promote.
+
+---
+
+## Prove it can go red
+
+```bash
+bash .claude/scripts/sweep.sh --self-test     # 22 assertions, ~3s
+```
+
+The live estate is usually three worktrees and no feature branches, so a green
+`/sweep` proves only that a no-op is a no-op. The self-test mints throwaway
+estates instead, and covers **both halves** — the read-only classifier and the
+half that moves refs:
+
+| What it proves | How |
+|---|---|
+| every class | one branch each: landed **under a different sha**, ready, dirty, ephemeral-dirt-only, infra |
+| liveness, both ways | it must see a process under the tree (`exec -a`, because `pgrep -f` matches argv, not cwd) and must **not** match a prefix neighbour |
+| the merge | ready branches land, the dirty one does not, `gates=1` |
+| the lane | a `schema/` touch selects `full` without being asked |
+| **a red gate** | exit 4, `dev` **back at the pre-sweep sha**, and the `land.sh` line named per branch |
+| **a conflict** | exit 5, `dev` back at the pre-sweep sha — a conflict is not a red suite and does not share its code |
+| the seam itself | `SWEEP_GATE_CMD` is read **only** under `SWEEP_ROOT`, so there is no way to spell "skip the gate" in a real run |
+
+The two reset paths are the reason the merge half is tested at all: a reset
+nobody ever runs is a reset nobody knows is broken, and the ref it fails to
+restore is someone's branch. Deleting the reset line makes the suite go **RED**
+on exactly that assertion — verified, not asserted.
+
+It has already bitten its own author twice: an untracked `one.ie/` collapsing in
+`git status --porcelain` read a build-output-only branch as busy, and a `sleep`
+with no path in its argv proved nothing about `pgrep -f`.
+
+**The box refusal is proved the same way** — stub `health.sh` to `UNHEALTHY` and
+a real run exits **3** while `--dry-run` reports and proceeds.
+
+---
+
+## Then deploy
+
+```
+/sweep --pr      # dev carries everything, one gate green, PR open
+/deploy          # spawns release-manager, which promotes the named sha and ships
+```
+
+See also: `/deploy` · `.claude/skills/deploy/SKILL.md` (the run as tracked work) ·
+`../CLAUDE.md § The dev → prod loop`.

package/commands/tasks.md

@@ -0,0 +1,222 @@
+# /tasks
+
+Take what someone wants and make it claimable. One pass: size it, say it in
+human words, break it into the pieces its size implies, chain them so only the
+first is ready, and hand each to the agent that answers for it.
+
+```
+/tasks                      drain every untriaged row on the board
+/tasks "<a sentence>"       shape one captured thing
+/tasks --dry                show the writes, apply nothing
+/tasks --rewrite <tid>      re-say one existing row in human words
+```
+
+**Nothing parses those.** This file is instructions to a model, not a CLI —
+there is no `tasks.sh`, and the words above are shapes a reader types so the
+model knows which leg to run. `--dry` means *pass `dryRun: true` to the
+workflow*; `--rewrite <tid>` means *run the shape leg against one existing row
+and skip the drain*. Where a flag IS parsed the authority is a script and this
+file says so: `do-triage.sh` and `do-tier.sh` below both take real arguments and
+both have a real `--self-test`.
+
+Saying that plainly matters here more than usual. A declared interface with no
+implementation is the defect this whole command exists to catch — see the
+`tasks:bulk` note under **Don't**, which is advertised with a full schema and
+answers `unknown_receiver`.
+
+---
+
+## The one rule
+
+**A task is a Want.** Not a label, not a ticket, not a cycle number — the thing
+someone wants that is not true yet, written so a stranger knows what changes
+when it is done.
+
+`schema/story.tql` makes this the one refusal it enforces: `story_has_want()`,
+and its comment — *a story with no Want is a log*. A row that cannot state its
+Want is not small, it is **unshaped**, and it goes to `shaping:` rather than to
+an agent.
+
+That is what "human sounding" means here, and it is not cosmetic. `lifecycle-human C0`
+tells a puller nothing. *A wallet backed up twice loses its key* tells them what
+is wrong, who it hurts and when they are finished.
+
+---
+
+## The pipeline
+
+The workflow already exists — **`/tasks` does not reimplement it.**
+
+```
+Workflow({ name: "triage", args: { dryRun: <bool>, tasks: [{title}] } })
+```
+
+`.claude/workflows/triage.js`, four phases:
+
+| phase | does | cost |
+|---|---|---|
+| `Untriaged` | `do-rank.py --board-check`, then rows whose notes lack `accept:` | haiku |
+| `findPaths` | **`do-triage.sh` first — zero LLM.** A model names paths only if it comes back empty | bash, then haiku |
+| `tier` | **`do-tier.sh` on the paths.** Never re-size in JS | bash |
+| `reshape` | original words to `tasks:comment` **before** any rename; `accept:` into notes | haiku |
+
+**That order is load-bearing.** The original sentence is preserved as a comment
+before anything overwrites the title, because a rewrite that loses what the
+person actually said is not a rewrite, it is a deletion.
+
+### What `/tasks` adds
+
+`plannedWrites()` in `triage.js` today writes a comment and a note and **stops**
+— it never renames, never makes a subtask, never assigns, never chains. The
+workflow's own description says it renames; it does not. `/tasks` is that
+missing half, and it runs only on rows the tier phase actually sized:
+
+5. **say** — `tasks:rename` to the Want, in human words
+6. **split** — `tasks:subtask` per piece, by tier (below)
+7. **chain** — `blockedBy` so exactly one sibling is ready
+8. **hand over** — `assignee` from the routing table (below)
+
+A row that reaches step 5 unsized does not get steps 5–8. It gets
+`shaping:` and waits for a person.
+
+---
+
+## Sizing decides the shape
+
+`bash .claude/scripts/do-tier.sh --intent "<text>" <paths...>` is the authority.
+Never guess a tier, and never let a model pick one.
+
+| tier | subtasks | chained | who |
+|---|---|---|---|
+| `PATCH` | none — it is one piece | — | `implementer` |
+| `FIX` | 2–3, only if they are separately checkable | yes | `implementer`, refuted by `review-engineer` |
+| `FEATURE` | one per surface it touches | yes | `architect` writes the spec **first**, then `implementer` |
+| `SCHEMA` | one per migration + one to prove it | yes | `architect`, W2 on Fable |
+| `UNSIZED` | **none** | — | nobody — it goes to `shaping:` |
+
+### UNSIZED is a state, not a default
+
+`do-tier.sh` exits **3** and returns `{"tier":"UNSIZED","spine":"recon"}` when it
+is given no paths, and its own header says why:
+
+> *Absence of recon must not read as simplicity.*
+
+A new task is a sentence with no diff, so **every** fresh capture is UNSIZED
+until recon finds files. Two real mis-sizings are on record from treating that as
+PATCH (`text/learnings.md:485`, `text/remote-suspend-todo.md:5`). So the pipeline
+is **capture → recon → size → agent**, never capture → size → agent. `/tasks`
+reports UNSIZED as its own outcome and files nothing under it.
+
+---
+
+## Who answers for it
+
+Routing is by what the work *is*, not by who is free. Category comes from the
+paths `do-triage.sh` found.
+
+| paths touch | agent |
+|---|---|
+| `schema/`, a receiver, an authority walk | `architect` — spec before code |
+| a component, a route, a page | `implementer` |
+| auth, keys, money, a bounded door | `security-auditor` |
+| a gate, a ratchet, a proof | `test-engineer` |
+| `text/` only | `tech-writer` |
+| a deploy, a release, `.release/` | `release-manager` |
+| a measurement, a budget, a clock | `perf-engineer` |
+| prod is down | `incident-commander` |
+| nothing matches | `cto` — ranks it into a rung and re-routes |
+
+**Every row leaves `/tasks` with an assignee.** An unassigned row is the one that
+sits — 219 of 452 rows on this board sat at priority 0 with empty notes and no
+owner, and none of them moved. Assigning is not bureaucracy; it is the difference
+between a row and a queue.
+
+`agent` never means *autonomous*: `tool → skill → agent` is the autonomy ladder
+(root `CLAUDE.md`). A money-moving or authority-changing row gets `human` in its
+chain regardless of tier.
+
+---
+
+## Chaining: one ready sibling, not ten
+
+`tasks:subtask` writes the row, its notes, its containment edge **and** its
+`blockedBy` in one call — that is why it exists and why two calls are wrong. Its
+own contract says it: *between the two calls the child sits on the board
+claimable with an empty body and no ordering, and the factory will take it.*
+
+So: subtask N is `blockedBy` subtask N−1, unless they are genuinely independent.
+Ten unchained siblings is ten agents claiming the same ground.
+
+Where a real chain already exists, mirror it rather than inventing one —
+`lifecycle-human` is `C0 alone → C1 decides → C2 → C5/C6/C7`, with C3, C4 and C8
+parallel throughout. That shape came from the plan, not from a rule.
+
+---
+
+## Story · promise · contract — the vocabulary, and what is not wired
+
+The substrate already models this. Read it before inventing a fourth noun:
+
+| word | is | where |
+|---|---|---|
+| **task** | a Want — what is not true yet | `story_tasks($origin)` |
+| **story** | an origin plus its beats: world · cast · knock · want · way · turn · lesson | `story_members`, `story_missing` |
+| **promise** | the frozen oath: terms plus exactly one checkable proof | `story_promise($origin)`, `text/promise.md` |
+| **contract** | who may admit work here, and what facts are still missing | `contract-admissible`, `missing-facts` |
+
+The arc is `promise → progress → payoff`, read off the promise rung's status
+(`story_arc`). Tasks are the Wants between them; `story_next($origin)` picks the
+next one the ant-colony way — strongest net trail (`strength − resistance`),
+never toxic — and `story_unexplored` is what the colony explores when there is no
+trail yet. Priority does not appear anywhere in that decision.
+
+**None of it is wired, and `/tasks` must not pretend otherwise.** Measured
+2026-09-12:
+
+- `schema/story.tql` has **no migration** and nothing loads it. Its own header
+  says blocks 3–5 are *NOT YET VALIDATED: no TypeDB was reachable from the
+  session that wrote them* — 35 functions, unchecked.
+- Its only consumer is a **prompt**: `.claude/agents/storyteller.md`.
+- The SDK registry carries four story receivers — `story:chain`, `story:demo`,
+  `story:event`, `story:view`. **Not one mints an origin or binds a task to a
+  story.**
+- `story_tasks` matches `has tag $g; $g == $origin` — the binding is a **bare
+  tag**. So a renamed row keeps its story only if it still carries that tag, and
+  today no row carries one because nothing writes one.
+
+So `/tasks` uses the vocabulary and files rows a story could later adopt. It does
+**not** call a story function, and it does not claim a story exists. Wiring it
+means: a migration, a receiver that mints an origin, and the 35 functions
+validated against a reachable TypeDB — in that order, as its own plan.
+
+---
+
+## Don't
+
+- **Don't set priority.** `triage.js` refuses to, on purpose. The board ranks by
+  learned weight where it has evidence; an authored number competes with a
+  measurement and usually wins for the wrong reason. This board had 219 rows at
+  priority 0 including *the ladder cannot be climbed* and *tasks:comment silently
+  truncates*, and a panel layout tweak at 1.00.
+- **Don't rename before the original text is a comment.** `tasks:comment`
+  truncates at 4,000 bytes and returns `ok:true`, so a long capture must be split
+  and read back, not trusted.
+- **Don't clear notes by omission.** `tasks:notes` with an absent `notes` key is
+  a silent DELETE returning `{ok:true, notes:null}`. Read-modify-write, always,
+  with the full body.
+- **Don't reach for `tasks:bulk`.** It is advertised by the MCP server with a
+  full schema and answers `unknown_receiver` in production. One call per row.
+- **Don't add a second sizing path or a second triage door.** `do-triage.sh` and
+  `do-tier.sh` are the two, and both have `--self-test`.
+- **Don't size from a title.** `do-tier.sh` sizes a **diff**. "Add a null check"
+  and "add a settings page" share a verb.
+
+---
+
+## See also
+
+- `.claude/workflows/triage.js` — the pipeline this command drives
+- `.claude/scripts/do-triage.sh` · `do-tier.sh` — the two authorities, both `--self-test`
+- `text/board-review-2026-09-12.md` — where the defects quoted above were measured
+- `text/story-framework.md` · `schema/story.tql` — the vocabulary, unwired
+- `.claude/commands/do.md` — what claims a shaped task and builds it

package/hooks/scripts/dev-only.sh

@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+# DEV-ONLY — PreToolUse(Edit|Write|MultiEdit, Bash): development happens on
+# `dev`, or in a worktree cut from `dev`. Never on the shared main tree.
+#
+# THE RULE, in one line: main RECEIVES, it does not get EDITED.
+#
+# WHY THIS EXISTS — three measured failures, none of them theoretical:
+#
+#   1. WORK VANISHES. 2026-09-16: a session deleted eight root .astro pages in
+#      the shared main tree and never committed. The 12:14 reboot killed it,
+#      `git pull --ff-only` fast-forwarded main, and every deleted file came
+#      back. `git status` was CLEAN afterwards, so nothing recorded that the
+#      work had existed at all. The operator reported it as "I deleted them but
+#      they don't seem to be deleted" — which is exactly what it looks like.
+#
+#   2. THE RECEIPT CAN NEVER BIND. `test-cached.sh` keys on tree CONTENT
+#      (`git diff HEAD` + untracked + .env). A gate run on a main tree that any
+#      neighbour is editing measures a MOVING tree, so it mints a receipt for a
+#      state that never ships. 2026-09-05: four full suites, ~25 minutes, zero
+#      receipts. `./deploy` from main was simply never runnable that day.
+#
+#   3. A DEV SERVER ON MAIN SERVES THE STALE TRUNK. Every page it renders is a
+#      false reading — the same false-RED class as running a gate there.
+#      2026-09-16: localhost:4321 answered /media with 200 for hours after the
+#      page was deleted on dev, because it was booted from the main tree.
+#
+# WHAT IS ALLOWED. Any linked worktree — its git-dir sits under
+# `.git/worktrees/…`, which is the test this hook uses. That covers
+# `.claude/worktrees/dev` (the workbench), every `feat/*` tree cut from dev,
+# and `.release` (which must stay writable: it is how prod ships). Anything
+# outside the repo entirely is none of this hook's business.
+#
+# WHERE TO GO INSTEAD:
+#   small, hours   ->  .claude/worktrees/dev          (already minted and warm)
+#   large or long  ->  bash .claude/scripts/worktree-up.sh <name> --no-dev
+#                      (cuts from dev by default — worktree-up.sh:63 BASE="dev")
+#
+# Disable: ECC_DISABLED_HOOKS=hook:dev-only
+
+# shellcheck source=lib/hook.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/hook.sh"
+is_hook_disabled "hook:dev-only" && exit 0
+
+PAYLOAD="${1:-}"
+# Claude Code delivers the payload on STDIN; argv stays first so a positional
+# caller still works. Bounded read — a bare $(cat) hangs forever on a tty and
+# would freeze every Edit and every Bash call in the session.
+if [[ -z "$PAYLOAD" && ! -t 0 ]]; then
+  IFS= read -r -d '' -t 2 PAYLOAD <&0 || true
+fi
+[[ -z "$PAYLOAD" ]] && exit 0
+
+TOOL=$(printf '%s' "$PAYLOAD" | jq -r '.tool_name // empty' 2>/dev/null)
+
+# ── is this path inside the SHARED MAIN tree? ────────────────────────────────
+# A linked worktree's absolute git-dir contains /worktrees/. The primary tree's
+# does not. That single fact is the whole test, and it needs no path list that
+# could drift as worktrees come and go.
+_is_shared_main() {
+  local p="$1" d gitdir
+  [[ -z "$p" ]] && return 1
+  # A Write to a file that does not exist yet still has an existing parent.
+  d="$p"; while [[ -n "$d" && "$d" != "/" && ! -d "$d" ]]; do d=$(dirname "$d"); done
+  [[ -d "$d" ]] || return 1
+  gitdir=$(git -C "$d" rev-parse --absolute-git-dir 2>/dev/null) || return 1
+  [[ -z "$gitdir" ]] && return 1
+  case "$gitdir" in */worktrees/*) return 1 ;; esac   # linked worktree — fine
+  return 0
+}
+
+_deny() {
+  jq -nc --arg r "$1" \
+    '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":$r}}'
+  exit 0
+}
+
+WHERE="Work in the dev worktree, or a worktree cut from it:
+
+  small, hours   cd .claude/worktrees/dev
+  large or long  bash .claude/scripts/worktree-up.sh <name> --no-dev
+
+Both are cut from \`dev\`, which is the branch every feature integrates into.
+main receives \`--ff-only\` merges and a release PR; it is not an edit surface.
+
+Override, for a deliberate one-off:  ECC_DISABLED_HOOKS=hook:dev-only"
+
+case "$TOOL" in
+  Edit|Write|MultiEdit|NotebookEdit)
+    FP=$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.file_path // .tool_input.notebook_path // empty' 2>/dev/null)
+    [[ -z "$FP" ]] && exit 0
+    _is_shared_main "$FP" || exit 0
+    _deny "[dev-only] This file is in the SHARED MAIN tree. Development happens on dev.
+
+  $FP
+
+An edit here is not saved work. Main gets fast-forwarded by whichever session
+pulls next, and an uncommitted change is silently reverted — on 2026-09-16 that
+resurrected eight deleted pages and left \`git status\` clean, so nothing
+recorded that the work had ever existed.
+
+$WHERE"
+    ;;
+
+  Bash)
+    CMD=$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.command // empty' 2>/dev/null)
+    [[ -z "$CMD" ]] && exit 0
+    # Strip heredoc bodies so a command that merely NAMES a dev server in a
+    # commit message or a doc is never refused — same discipline as
+    # hook:governor-escape.
+    STRIPPED=$(printf '%s' "$CMD" | sed -E '/<<-?[A-Za-z_'"'"'"]/,/^[[:space:]]*[A-Za-z_]+[[:space:]]*$/d')
+    printf '%s' "$STRIPPED" | grep -qE '(^|[|&;[:space:]])(astro[[:space:]]+dev|(bun|npm|pnpm|yarn)[[:space:]]+run[[:space:]]+dev)([[:space:]]|$)' || exit 0
+
+    # Where would it run? An explicit `cd` wins, else the tool's cwd.
+    TARGET=$(printf '%s' "$CMD" | grep -oE "(^|&&|;|\|)[[:space:]]*cd[[:space:]]+(\"[^\"]+\"|'[^']+'|[^[:space:]]+)" | head -1 \
+             | sed -E "s/.*cd[[:space:]]+//; s/^[\"']//; s/[\"']\$//")
+    [[ -z "$TARGET" ]] && TARGET=$(printf '%s' "$PAYLOAD" | jq -r '.cwd // empty' 2>/dev/null)
+    case "$TARGET" in *'$'*) TARGET=$(printf '%s' "$PAYLOAD" | jq -r '.cwd // "."' 2>/dev/null) ;; esac
+    [[ -z "$TARGET" ]] && TARGET="."
+    _is_shared_main "$TARGET" || exit 0
+    _deny "[dev-only] A dev server started here serves the STALE TRUNK.
+
+  $TARGET
+
+Every page it renders is a false reading: main does not carry what dev has
+integrated. Measured 2026-09-16 — localhost:4321 answered /media with 200 for
+hours after that page was deleted on dev, because the server was booted from
+the main tree. One dev server, and it runs on dev.
+
+  cd .claude/worktrees/dev/one.ie/web && bun run dev
+
+$WHERE"
+    ;;
+esac
+
+exit 0