@oneie/claude 0.8.0 → 0.9.0

package/commands/deploy.md

@@ -57,6 +57,11 @@ retyping its steps.
 | Crons | stripped | shipped |
 | Who ships it | agents, finishing a loop | a human, promoting |
 
+**`./deploy dev` ships whatever tree it is invoked from — which is `main`.** To
+put a *branch* on dev.one.ie, and to open the PR that proposes it, use
+`bash .claude/scripts/land.sh <branch> --pr --deploy` — one command for
+gate → dev → probe → PR. See "Branch → dev → PR → main" below.
+
 `./deploy dev` exits into `deploy-dev.sh` immediately rather than threading a
 flag through the production pipeline — a different destination with a different
 gate is a different procedure, and `deploy-dev.sh` stays its authority. The one
@@ -337,43 +342,51 @@ hit and `--env production` has no block to resolve against. Passing it anyway
 silently targets the `one-prod-production` decoy — see the trap note at the top
 of this file.
 
-## Commit, PR, merge — the human half
+## Branch → dev → PR → main — `land.sh`, not this doc
 
-The script does not do this. Run it before `./deploy` (its first gate refuses a
-dirty tree), or after a `--allow-dirty` run.
+**`.claude/scripts/land.sh` is the authority for this procedure**, the same way
+`deploy.sh` is the authority for the pipeline. It replaced the hand-rolled
+`git worktree add` + `gh pr create` recipe that used to sit here; that recipe
+was a second copy of a procedure and it rotted — it still told you to
+`git switch main` in the shared tree, which `hook:branch-pin` refuses.
 
-Tests are green at this point, so it is safe to commit. The shared tree is pinned to `main` (`hook:branch-pin`) — never `git checkout`/`switch` there. Do the commit + branch + PR in a scratch worktree instead, then merge via `gh` and fast-forward the shared tree.
 ```bash
-# 1. From the shared tree (still on main): stage by explicit path, never -A
-git status --porcelain   # review scope
-git diff --stat
-
-# 2. Cut a worktree for the deploy branch
-slug="deploy-$(git rev-parse --short HEAD)"
-git worktree add -b "deploy/$slug" ".do-worktrees/$slug" main
-
-# 3. In the worktree: bring over the same paths, commit, push
-cd ".do-worktrees/$slug"
-git add <explicit paths from step 2>
-git commit -m "$(cat <<'EOF'
-deploy: ship <summary of staged changes>
-EOF
-)"
-git push -u origin "deploy/$slug"
-
-# 4. Open PR, wait for CodeRabbit + any checks, merge
-gh pr create --base main --head "deploy/$slug" --title "deploy: <summary>" --body "Automated deploy PR — see /deploy pipeline"
-gh pr merge "deploy/$slug" --squash --auto --delete-branch
-
-# 5. Back in the shared tree: fast-forward and clean up the worktree
-cd /Users/toc/Server/one-ie
-git switch main   # only allowed HEAD move in the shared tree
-git pull origin main
-git worktree remove ".do-worktrees/$slug"
+bash .claude/scripts/land.sh feat/x --pr --deploy --probe / --probe /pricing
 ```
-Generate the commit message and PR title from the diff — conventional commit format (`feat:`, `fix:`, `chore:`, etc.). If there is nothing to commit (`git status --porcelain` is empty), skip this whole step silently — proceed to Step 3 on the tree as-is.
 
-`gh pr merge --auto` queues the merge and returns immediately if required checks (e.g. CodeRabbit review) are still running; poll `gh pr view "deploy/$slug" --json state,mergedAt` before Step 5's `git pull` if the merge hasn't landed yet — don't build off an unmerged branch.
+One command, four steps, in this order:
+
+| # | Step | What it proves |
+|---|---|---|
+| 1 | **gate** — `verify:fast` in the branch's own worktree | the branch is green ON ITS OWN. Not that it survives the trunk — `--pr` deliberately does not merge main in, so the reviewer sees what the branch added and GitHub computes the merge |
+| 2 | **dev** — `$wt/.claude/scripts/deploy-dev.sh` | the branch RUNS. It ships the *worktree's* tree, because `deploy-dev.sh` derives its own ROOT from its own path — `$ROOT`'s copy would ship main and call it the branch |
+| 3 | **probe** — `do-prove.sh`, both bases pinned to dev | the routes answer on dev, under the LANDING RULE. Not `curl / → 200`, which a redirect to `/signin` satisfies |
+| 4 | **PR** — `pr-body.sh` → `gh pr create`/`edit` | a reviewer gets the diff, the trunk drift, the mergeability, the gate label and the dev URL. Re-running UPDATES the open PR, never duplicates it |
+
+Then a human merges the PR, and **promotion to `one.ie` is still `./deploy`** —
+the full gate, from `.release/`. Nothing above touches production.
+
+Four things that are load-bearing, each of which read as a pass before it was fixed:
+
+- **dev.one.ie is one slot, and it writes production's rows.** `--pr --deploy`
+  takes exactly one branch; with two, the second overwrites the first while the
+  first is being probed. Ship code there freely; treat its DATA as production.
+- **Both probe bases are pinned to dev.** `do-prove.sh` falls back to
+  `PROVE_PROD_URL` (default `https://one.ie`) when its dev base is silent — an
+  unreachable dev would otherwise prove *production* and report it as the branch
+  passing.
+- **The probe's route COUNT is read, not its exit code.** `PROVE: skipped (no
+  reachable environment)` exits 0. An unrun probe is not a pass.
+- **The gate is paid once, except under `--quick`.** Step 2 passes
+  `DEV_SKIP_GATE=1` because step 1 just ran `verify:fast` in that same tree.
+  Under `--quick` step 1 was tsc only — not the fast lane — so `deploy-dev.sh`
+  runs its own gate before anything reaches dev.
+
+`land.sh` still has its other two doors: bare (merge main in → gate → `--ff-only`
+main → optionally one dev deploy for the batch) and `--pr` alone (gate → PR, no
+dev). The commit itself stays human — a commit message needs judgment, and
+`deploy.sh`'s first gate refuses a dirty tree so the deploy and the history
+cannot disagree.
 
 ---
 

package/commands/tasks.md

@@ -0,0 +1,222 @@
+# /tasks
+
+Take what someone wants and make it claimable. One pass: size it, say it in
+human words, break it into the pieces its size implies, chain them so only the
+first is ready, and hand each to the agent that answers for it.
+
+```
+/tasks                      drain every untriaged row on the board
+/tasks "<a sentence>"       shape one captured thing
+/tasks --dry                show the writes, apply nothing
+/tasks --rewrite <tid>      re-say one existing row in human words
+```
+
+**Nothing parses those.** This file is instructions to a model, not a CLI —
+there is no `tasks.sh`, and the words above are shapes a reader types so the
+model knows which leg to run. `--dry` means *pass `dryRun: true` to the
+workflow*; `--rewrite <tid>` means *run the shape leg against one existing row
+and skip the drain*. Where a flag IS parsed the authority is a script and this
+file says so: `do-triage.sh` and `do-tier.sh` below both take real arguments and
+both have a real `--self-test`.
+
+Saying that plainly matters here more than usual. A declared interface with no
+implementation is the defect this whole command exists to catch — see the
+`tasks:bulk` note under **Don't**, which is advertised with a full schema and
+answers `unknown_receiver`.
+
+---
+
+## The one rule
+
+**A task is a Want.** Not a label, not a ticket, not a cycle number — the thing
+someone wants that is not true yet, written so a stranger knows what changes
+when it is done.
+
+`schema/story.tql` makes this the one refusal it enforces: `story_has_want()`,
+and its comment — *a story with no Want is a log*. A row that cannot state its
+Want is not small, it is **unshaped**, and it goes to `shaping:` rather than to
+an agent.
+
+That is what "human sounding" means here, and it is not cosmetic. `lifecycle-human C0`
+tells a puller nothing. *A wallet backed up twice loses its key* tells them what
+is wrong, who it hurts and when they are finished.
+
+---
+
+## The pipeline
+
+The workflow already exists — **`/tasks` does not reimplement it.**
+
+```
+Workflow({ name: "triage", args: { dryRun: <bool>, tasks: [{title}] } })
+```
+
+`.claude/workflows/triage.js`, four phases:
+
+| phase | does | cost |
+|---|---|---|
+| `Untriaged` | `do-rank.py --board-check`, then rows whose notes lack `accept:` | haiku |
+| `findPaths` | **`do-triage.sh` first — zero LLM.** A model names paths only if it comes back empty | bash, then haiku |
+| `tier` | **`do-tier.sh` on the paths.** Never re-size in JS | bash |
+| `reshape` | original words to `tasks:comment` **before** any rename; `accept:` into notes | haiku |
+
+**That order is load-bearing.** The original sentence is preserved as a comment
+before anything overwrites the title, because a rewrite that loses what the
+person actually said is not a rewrite, it is a deletion.
+
+### What `/tasks` adds
+
+`plannedWrites()` in `triage.js` today writes a comment and a note and **stops**
+— it never renames, never makes a subtask, never assigns, never chains. The
+workflow's own description says it renames; it does not. `/tasks` is that
+missing half, and it runs only on rows the tier phase actually sized:
+
+5. **say** — `tasks:rename` to the Want, in human words
+6. **split** — `tasks:subtask` per piece, by tier (below)
+7. **chain** — `blockedBy` so exactly one sibling is ready
+8. **hand over** — `assignee` from the routing table (below)
+
+A row that reaches step 5 unsized does not get steps 5–8. It gets
+`shaping:` and waits for a person.
+
+---
+
+## Sizing decides the shape
+
+`bash .claude/scripts/do-tier.sh --intent "<text>" <paths...>` is the authority.
+Never guess a tier, and never let a model pick one.
+
+| tier | subtasks | chained | who |
+|---|---|---|---|
+| `PATCH` | none — it is one piece | — | `implementer` |
+| `FIX` | 2–3, only if they are separately checkable | yes | `implementer`, refuted by `review-engineer` |
+| `FEATURE` | one per surface it touches | yes | `architect` writes the spec **first**, then `implementer` |
+| `SCHEMA` | one per migration + one to prove it | yes | `architect`, W2 on Fable |
+| `UNSIZED` | **none** | — | nobody — it goes to `shaping:` |
+
+### UNSIZED is a state, not a default
+
+`do-tier.sh` exits **3** and returns `{"tier":"UNSIZED","spine":"recon"}` when it
+is given no paths, and its own header says why:
+
+> *Absence of recon must not read as simplicity.*
+
+A new task is a sentence with no diff, so **every** fresh capture is UNSIZED
+until recon finds files. Two real mis-sizings are on record from treating that as
+PATCH (`text/learnings.md:485`, `text/remote-suspend-todo.md:5`). So the pipeline
+is **capture → recon → size → agent**, never capture → size → agent. `/tasks`
+reports UNSIZED as its own outcome and files nothing under it.
+
+---
+
+## Who answers for it
+
+Routing is by what the work *is*, not by who is free. Category comes from the
+paths `do-triage.sh` found.
+
+| paths touch | agent |
+|---|---|
+| `schema/`, a receiver, an authority walk | `architect` — spec before code |
+| a component, a route, a page | `implementer` |
+| auth, keys, money, a bounded door | `security-auditor` |
+| a gate, a ratchet, a proof | `test-engineer` |
+| `text/` only | `tech-writer` |
+| a deploy, a release, `.release/` | `release-manager` |
+| a measurement, a budget, a clock | `perf-engineer` |
+| prod is down | `incident-commander` |
+| nothing matches | `cto` — ranks it into a rung and re-routes |
+
+**Every row leaves `/tasks` with an assignee.** An unassigned row is the one that
+sits — 219 of 452 rows on this board sat at priority 0 with empty notes and no
+owner, and none of them moved. Assigning is not bureaucracy; it is the difference
+between a row and a queue.
+
+`agent` never means *autonomous*: `tool → skill → agent` is the autonomy ladder
+(root `CLAUDE.md`). A money-moving or authority-changing row gets `human` in its
+chain regardless of tier.
+
+---
+
+## Chaining: one ready sibling, not ten
+
+`tasks:subtask` writes the row, its notes, its containment edge **and** its
+`blockedBy` in one call — that is why it exists and why two calls are wrong. Its
+own contract says it: *between the two calls the child sits on the board
+claimable with an empty body and no ordering, and the factory will take it.*
+
+So: subtask N is `blockedBy` subtask N−1, unless they are genuinely independent.
+Ten unchained siblings is ten agents claiming the same ground.
+
+Where a real chain already exists, mirror it rather than inventing one —
+`lifecycle-human` is `C0 alone → C1 decides → C2 → C5/C6/C7`, with C3, C4 and C8
+parallel throughout. That shape came from the plan, not from a rule.
+
+---
+
+## Story · promise · contract — the vocabulary, and what is not wired
+
+The substrate already models this. Read it before inventing a fourth noun:
+
+| word | is | where |
+|---|---|---|
+| **task** | a Want — what is not true yet | `story_tasks($origin)` |
+| **story** | an origin plus its beats: world · cast · knock · want · way · turn · lesson | `story_members`, `story_missing` |
+| **promise** | the frozen oath: terms plus exactly one checkable proof | `story_promise($origin)`, `text/promise.md` |
+| **contract** | who may admit work here, and what facts are still missing | `contract-admissible`, `missing-facts` |
+
+The arc is `promise → progress → payoff`, read off the promise rung's status
+(`story_arc`). Tasks are the Wants between them; `story_next($origin)` picks the
+next one the ant-colony way — strongest net trail (`strength − resistance`),
+never toxic — and `story_unexplored` is what the colony explores when there is no
+trail yet. Priority does not appear anywhere in that decision.
+
+**None of it is wired, and `/tasks` must not pretend otherwise.** Measured
+2026-09-12:
+
+- `schema/story.tql` has **no migration** and nothing loads it. Its own header
+  says blocks 3–5 are *NOT YET VALIDATED: no TypeDB was reachable from the
+  session that wrote them* — 35 functions, unchecked.
+- Its only consumer is a **prompt**: `.claude/agents/storyteller.md`.
+- The SDK registry carries four story receivers — `story:chain`, `story:demo`,
+  `story:event`, `story:view`. **Not one mints an origin or binds a task to a
+  story.**
+- `story_tasks` matches `has tag $g; $g == $origin` — the binding is a **bare
+  tag**. So a renamed row keeps its story only if it still carries that tag, and
+  today no row carries one because nothing writes one.
+
+So `/tasks` uses the vocabulary and files rows a story could later adopt. It does
+**not** call a story function, and it does not claim a story exists. Wiring it
+means: a migration, a receiver that mints an origin, and the 35 functions
+validated against a reachable TypeDB — in that order, as its own plan.
+
+---
+
+## Don't
+
+- **Don't set priority.** `triage.js` refuses to, on purpose. The board ranks by
+  learned weight where it has evidence; an authored number competes with a
+  measurement and usually wins for the wrong reason. This board had 219 rows at
+  priority 0 including *the ladder cannot be climbed* and *tasks:comment silently
+  truncates*, and a panel layout tweak at 1.00.
+- **Don't rename before the original text is a comment.** `tasks:comment`
+  truncates at 4,000 bytes and returns `ok:true`, so a long capture must be split
+  and read back, not trusted.
+- **Don't clear notes by omission.** `tasks:notes` with an absent `notes` key is
+  a silent DELETE returning `{ok:true, notes:null}`. Read-modify-write, always,
+  with the full body.
+- **Don't reach for `tasks:bulk`.** It is advertised by the MCP server with a
+  full schema and answers `unknown_receiver` in production. One call per row.
+- **Don't add a second sizing path or a second triage door.** `do-triage.sh` and
+  `do-tier.sh` are the two, and both have `--self-test`.
+- **Don't size from a title.** `do-tier.sh` sizes a **diff**. "Add a null check"
+  and "add a settings page" share a verb.
+
+---
+
+## See also
+
+- `.claude/workflows/triage.js` — the pipeline this command drives
+- `.claude/scripts/do-triage.sh` · `do-tier.sh` — the two authorities, both `--self-test`
+- `text/board-review-2026-09-12.md` — where the defects quoted above were measured
+- `text/story-framework.md` · `schema/story.tql` — the vocabulary, unwired
+- `.claude/commands/do.md` — what claims a shaped task and builds it

package/hooks/scripts/git-add-guard.sh

@@ -54,7 +54,18 @@ _is_blanket() {
   fi
   return 1
 }
-_is_blanket "$CMD" || exit 0
+# Any commit on the shared main tree — main receives PRs, never development.
+# QUOTE-STRIPPED and POSITION-ANCHORED, so a command that merely NAMES a commit
+# — a grep for "git commit", a commit message quoting it, a doc being written —
+# is never refused. Measured 2026-09-07: the unanchored form denied
+# `grep -rn "git commit" text/`.
+_is_commit() {
+  local bare
+  bare=$(printf '%s' "$1" | sed -E "s/'[^']*'//g; s/\"[^\"]*\"//g")
+  printf '%s' "$bare" | grep -qE '(^|[;&|][[:space:]]*)git[^;&|]*[[:space:]]commit([[:space:]]|$)'
+}
+
+_is_blanket "$CMD" || _is_commit "$CMD" || exit 0
 
 # Carve-out: deploy/release publishes the whole tree on purpose.
 printf '%s' "$CMD" | grep -qE '\bgit\b[^|&;]*\bpush\b' && exit 0
@@ -78,7 +89,31 @@ GITDIR=$(git -C "$TARGET" rev-parse --absolute-git-dir 2>/dev/null)
 [[ -z "$GITDIR" ]] && exit 0                       # not a git repo — let git handle it
 case "$GITDIR" in */worktrees/*) exit 0 ;; esac    # isolated linked worktree — blanket is safe
 
-# Main tree → deny.
+# Main tree → deny. A plain commit gets the dev-only rule; a blanket action gets
+# the sweep warning. Both refuse; the reason must name the right one.
+if ! _is_blanket "$CMD"; then
+  CMSG="[git-add-guard] Development on the shared main tree is blocked — we develop on dev.
+
+main receives a PULL REQUEST from dev and nothing else. It is never edited,
+never committed to directly, and production only ever ships from a sha that
+arrived on main that way.
+
+Do this instead:
+  bash .claude/scripts/worktree-up.sh <name> --no-dev   # cut from dev
+  ...edit, then...
+  bash .claude/scripts/land.sh feat/<name>              # lands on DEV
+  gh pr create --base main --head dev                   # the only door to main
+
+Why: on 2026-09-07 four commits went straight onto main while seven sessions
+shared this tree, and an hour-cold ad conversion map plus its test sat
+uncommitted in it — invisible to every branch, and one blanket stage away from
+landing in a stranger's commit.
+
+Override once, for a deliberate rescue:  ECC_DISABLED_HOOKS=hook:git-add-guard"
+  jq -nc --arg r "$CMSG" '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":$r}}'
+  exit 0
+fi
+
 MSG="[git-add-guard] Blanket staging/stashing on the shared main tree is blocked.
 
 Multiple windows share this working tree. A blanket add (-A, bare dot, commit -a)

package/hooks/scripts/session-start.sh

@@ -25,11 +25,24 @@ if [ -f "$CLAUDE_PROJECT_DIR/.claude/scripts/lib/govern.sh" ]; then
   CLAIMS_SWEPT=$(claim_sweep 2>/dev/null || echo 0)
 fi
 
+# An `astro dev` / `wrangler dev` that dies leaves its workerd child reparented
+# to launchd, holding ~40MB until the box reboots. gate-reaper.sh has known that
+# shape since 2026-09-05 but nothing ever RAN it: on 2026-09-05 nineteen of them
+# had accumulated over 13 hours and the box sat at 20.5G of 21.5G swap with
+# 997MB free. Reaping them returned swap to 7.8G used / 8.6G free in three
+# seconds. The reaper is 60ms, silent when there is nothing to do, and gated on
+# ppid==1 + a gate shape + a 15-minute age floor, so it can never touch live work.
+REAPED=0
+if [ -x "$CLAUDE_PROJECT_DIR/.claude/scripts/gate-reaper.sh" ]; then
+  REAPED=$(bash "$CLAUDE_PROJECT_DIR/.claude/scripts/gate-reaper.sh" --once 2>/dev/null | grep -c '^\[gate-reaper\] reaped' || true)
+fi
+
 OUT=""
+[ "${REAPED:-0}" -gt 0 ] 2>/dev/null && OUT+="🧹 reaped ${REAPED} abandoned gate(s)/workerd orphan(s) burning the box\n"
 [ "${SWEPT:-0}" -gt 0 ] 2>/dev/null && OUT+="🧹 reclaimed ${SWEPT} stale build slot(s) from a dead session\n"
 [ "${CLAIMS_SWEPT:-0}" -gt 0 ] 2>/dev/null && OUT+="🧹 reclaimed ${CLAIMS_SWEPT} region claim(s) from a dead worker\n"
 [ -n "$OUT" ] && { echo ""; printf "%b" "$OUT"; echo ""; }
 
-emit_signal "hook:session-start:ok" 1 "swept=${SWEPT:-0} claims=${CLAIMS_SWEPT:-0}"
-emit_world "session:start" "fyi" "session,start" "session started" "swept=${SWEPT:-0}" "claims=${CLAIMS_SWEPT:-0}"
+emit_signal "hook:session-start:ok" 1 "swept=${SWEPT:-0} claims=${CLAIMS_SWEPT:-0} reaped=${REAPED:-0}"
+emit_world "session:start" "fyi" "session,start" "session started" "swept=${SWEPT:-0}" "claims=${CLAIMS_SWEPT:-0}" "reaped=${REAPED:-0}"
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneie/claude",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "ONE Claude Code plugin — /do lifecycle, W0-W4 BUILD engine, 7-canon reconcile, ONE substrate via MCP, signals, and rules",
   "files": [
     ".claude-plugin",