@oneie/claude 0.8.0 → 0.9.0

package/scripts/close-owner.sh

@@ -0,0 +1,268 @@
+#!/usr/bin/env bash
+# close-owner.sh — resolve WHO owns a close and WHO they report to.
+#
+# manifest: portable
+#
+# /close needs two deterministic facts before any model speaks: which agent owns
+# the work, and which agent it reports to. Both are declared in the roster
+# (one.ie/ai/agents/*/agent.md); neither is a judgment call. This script answers
+# them so the command executes a fact instead of substituting for one.
+#
+#   close-owner.sh --tags "engineering,contracts"   -> owner + superior chain
+#   close-owner.sh --owner cmo                      -> just the chain above cmo
+#   close-owner.sh --roster                         -> coverage census
+#   close-owner.sh --self-test                      -> proves it can go RED
+#
+# THE MATCH RULE, and why it is the bare words only:
+# `subscribes:` carries TWO shapes and they are different lanes (root CLAUDE.md).
+#   - signal: campaign:brief   <- workflow trigger_source, read by triggerWorkflows
+#   - marketing                <- the routing STAKE, read by matchSubscribers
+# A namespaced tag matches zero signals. Matching on it would hand work to an
+# agent the world will never actually route to.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+AGENTS="$ROOT/one.ie/ai/agents"
+
+# specialist first: ties break DOWNWARD. Sending a director to do specialist work
+# is how a director stops being available for the judgment only they can make.
+_tier_rank() {
+  case "${1:-}" in
+    specialist) echo 0 ;; director) echo 1 ;; ceo) echo 2 ;; chairman) echo 3 ;;
+    *) echo 9 ;;   # tool / undeclared — never an owner
+  esac
+}
+
+_field() { grep -m1 "^$2:" "$1" 2>/dev/null | cut -d' ' -f2- | tr -d '\r' | xargs 2>/dev/null; }
+
+# The bare stake words only — skip every `- signal:` line.
+_stakes() {
+  awk '/^subscribes:/{f=1;next} f&&/^[a-zA-Z_]+:/{f=0} f&&/^[[:space:]]*-[[:space:]]/{
+    line=$0; sub(/^[[:space:]]*-[[:space:]]*/,"",line)
+    if (line !~ /^signal:/ && line !~ /:/ && line != "") print line
+  }' "$1" 2>/dev/null | tr -d '\r' | xargs -n1 2>/dev/null
+}
+
+_superior() {           # walk the declared chain, then the tier ladder
+  local name="$1" hops=0 out=""
+  while [ -n "$name" ] && [ "$hops" -lt 8 ]; do
+    local f="$AGENTS/$name/agent.md"
+    [ -f "$f" ] || break
+    local rt; rt="$(_field "$f" reports_to)"
+    if [ -z "$rt" ]; then
+      case "$(_field "$f" tier)" in
+        specialist) rt="ceo" ;;      # no director declared for its domain
+        director)   rt="ceo" ;;
+        ceo)        rt="chairman" ;;
+        chairman)   rt="" ;;         # answers to the human
+        *)          rt="ceo" ;;      # repo law: CEO is the standing receiver
+      esac
+    fi
+    [ -z "$rt" ] && break
+    out="$out $rt"; name="$rt"; hops=$((hops+1))
+  done
+  echo "$out" | xargs 2>/dev/null
+}
+
+cmd_roster() {
+  local tot=0 rt=0 ti=0 sub=0 bare=0
+  for d in "$AGENTS"/*/; do
+    local f="$d/agent.md"; [ -f "$f" ] || continue
+    tot=$((tot+1))
+    [ -n "$(_field "$f" reports_to)" ] && rt=$((rt+1))
+    [ -n "$(_field "$f" tier)" ] && ti=$((ti+1))
+    grep -q '^subscribes:' "$f" && sub=$((sub+1))
+    [ -n "$(_stakes "$f")" ] && bare=$((bare+1))
+  done
+  echo "agents=$tot reports_to=$rt tier=$ti subscribes=$sub bare_stakes=$bare"
+  echo "note: agents WITHOUT bare stakes cannot be matched by tag — they need the ladder fallback."
+}
+
+# How many agents stake a given word. A word many agents carry cannot single one
+# out — `marketing` is on 16 of them, so one hit against it is a tie broken by
+# directory order, not a match.
+GENERIC_AT=${CLOSE_OWNER_GENERIC_AT:-3}
+
+# THE INDEX — one awk pass over the whole roster, built once, reused by every
+# lookup. It replaced a per-agent `_stakes` fork called from inside two nested
+# loops: a --self-test spawned ~1300 awk processes and took 101s. Same answers,
+# one pass. Rows are `name<TAB>tier<TAB>reports_to<TAB>stake`, one per stake.
+# The memo is a FILE, not a variable. Every `$(_index)` runs in a subshell, so a
+# variable assignment inside it is discarded the moment the subshell exits — the
+# memo silently never hit and awk re-ran on every call (measured: no improvement
+# at all, 101s -> 70s, when the whole point was one pass).
+_INDEX_FILE="${TMPDIR:-/tmp}/close-owner-index.$$"
+trap 'rm -f "$_INDEX_FILE"' EXIT
+_index() {
+  [ -s "$_INDEX_FILE" ] && { cat "$_INDEX_FILE"; return; }
+  awk '
+    FNR==1 { name=""; tier=""; rt=""; insub=0
+             n=split(FILENAME,p,"/"); dir=p[n-1] }
+    /^name:/        { sub(/^name:[[:space:]]*/,"");        name=$0 }
+    /^tier:/        { sub(/^tier:[[:space:]]*/,"");        tier=$0 }
+    /^reports_to:/  { sub(/^reports_to:[[:space:]]*/,"");  rt=$0 }
+    /^subscribes:/  { insub=1; next }
+    insub && /^[a-zA-Z_]+:/ { insub=0 }
+    insub && /^[[:space:]]*-[[:space:]]/ {
+      l=$0; sub(/^[[:space:]]*-[[:space:]]*/,"",l); gsub(/[[:space:]]+$/,"",l)
+      if (l !~ /^signal:/ && l !~ /:/ && l != "") {
+        print (name==""?dir:name) "\t" tier "\t" rt "\t" l
+      }
+    }
+  ' "$AGENTS"/*/agent.md 2>/dev/null > "$_INDEX_FILE"
+  cat "$_INDEX_FILE"
+}
+
+_tag_breadth() {
+  _index | awk -F'\t' -v T="$1" '$4==T{a[$1]=1} END{print length(a)}'
+}
+
+# Every agent whose stakes intersect the tags, tier-ranked. This is what a refusal
+# hands upward — a decision without the options is not a decision.
+_candidates() {
+  local tags="$1"; local IFS=,; read -ra want <<< "$tags"; unset IFS
+  local agent tier_w
+  while IFS=$'\t' read -r agent tier_w; do
+    [ -n "$agent" ] || continue
+    local rank; rank="$(_tier_rank "$tier_w")"
+    [ "$rank" -ge 9 ] && continue
+    local hits=0 s w
+    for s in $(_index | awk -F'\t' -v A="$agent" '$1==A{print $4}'); do
+      for w in "${want[@]}"; do [ "$(echo "$w" | xargs)" = "$s" ] && hits=$((hits+1)); done
+    done
+    [ "$hits" -gt 0 ] && echo "$rank:$agent($hits)"
+  done <<< "$(_index | awk -F'\t' '{print $1"\t"$2}' | sort -u)" | sort | cut -d: -f2
+}
+
+cmd_resolve() {
+  local tags="$1" best="" best_rank=9 best_hits=0 best_specific=0 contenders=0
+  local IFS=,; read -ra want <<< "$tags"; unset IFS
+
+  # Breadth is a property of the TAG, not of the agent being examined, and only
+  # the requested tags matter — so it is computed once here rather than inside
+  # the agent loop. Calling _tag_breadth per matching stake made this quadratic
+  # over file reads (a --self-test went from ~1s to >120s); bash 3.2 has no
+  # associative arrays, so the answers ride a parallel indexed array.
+  local -a want_breadth=()
+  local i
+  for i in "${!want[@]}"; do
+    want[$i]="$(echo "${want[$i]}" | xargs)"
+    want_breadth[$i]="$(_tag_breadth "${want[$i]}")"
+  done
+
+  # One pass over the index: agent -> its stakes, already parsed.
+  local line agent tier_w
+  while IFS=$'\t' read -r agent tier_w; do
+    [ -n "$agent" ] || continue
+    local rank; rank="$(_tier_rank "$tier_w")"
+    [ "$rank" -ge 9 ] && continue                    # tool / undeclared: not an owner
+    local hits=0 specific=0 s j
+    for s in $(_index | awk -F'\t' -v A="$agent" '$1==A{print $4}'); do
+      for j in "${!want[@]}"; do
+        if [ "${want[$j]}" = "$s" ]; then
+          hits=$((hits+1))
+          [ "${want_breadth[$j]}" -le "$GENERIC_AT" ] && specific=$((specific+1))
+        fi
+      done
+    done
+    [ "$hits" -eq 0 ] && continue
+    contenders=$((contenders+1))
+    if [ "$specific" -gt "$best_specific" ] \
+       || { [ "$specific" -eq "$best_specific" ] && [ "$hits" -gt "$best_hits" ]; } \
+       || { [ "$specific" -eq "$best_specific" ] && [ "$hits" -eq "$best_hits" ] && [ "$rank" -lt "$best_rank" ]; }; then
+      best="$agent"; best_rank="$rank"; best_hits="$hits"; best_specific="$specific"
+    fi
+  done <<< "$(_index | awk -F'\t' '{print $1"\t"$2}' | sort -u)"
+
+  if [ -z "$best" ]; then
+    # Not a failure — the documented fallback. world:route answers reason:'ceo'
+    # for a workspace with no history, and the CEO is the standing receiver.
+    echo "owner=ceo  via=fallback(no-tag-match)  hits=0  confidence=none"
+    echo "chain=$(_superior ceo)"
+    return 0
+  fi
+
+  # THE REFUSAL. Evidence that cannot separate one candidate from several is not
+  # a match — it is directory order wearing a receipt. Modelled on factory:size
+  # returning `unsized` for an empty path set (resolvers/factory.ts:206) rather
+  # than guessing a tier. Refusing routes to the ladder, which explains itself.
+  if [ "$best_specific" -eq 0 ] && [ "$contenders" -gt 1 ]; then
+    echo "owner=REFUSED  via=ambiguous  hits=$best_hits  contenders=$contenders  confidence=low"
+    echo "reason=only generic tags matched (each carried by >$GENERIC_AT agents); $contenders candidates were indistinguishable"
+    # A refusal that names nothing forces the asker to redo the search. The whole
+    # point of refusing is to hand the decision UP with the evidence attached, so
+    # the shortlist rides with it — this is the notify-a-human payload.
+    echo "candidates=$(_candidates "$tags" | tr '\n' ' ' | xargs)"
+    echo "fallback=ceo  chain=$(_superior ceo)"
+    return 0
+  fi
+
+  local conf="high"; [ "$best_specific" -eq 0 ] && conf="medium"
+  echo "owner=$best  via=subscribes  hits=$best_hits  specific=$best_specific  contenders=$contenders  confidence=$conf"
+  echo "chain=$(_superior "$best")"
+}
+
+cmd_self_test() {
+  local fails=0
+  _expect() { # name, actual, expected-substring
+    if grep -q -- "$3" <<< "$2"; then echo "  ok   $1"; else echo "  RED  $1 — got: $2"; fails=$((fails+1)); fi
+  }
+  echo "close-owner --self-test"
+
+  # The case that shipped broken: this close's own tags named one of five
+  # candidates on a single generic hit, and the tie broke on directory order.
+  _expect "the tags THIS close used are REFUSED, not confidently answered" \
+    "$(cmd_resolve 'engineering,inbox,tasks')" "owner=REFUSED"
+  _expect "a refusal still routes — it names the ladder fallback" \
+    "$(cmd_resolve 'engineering,inbox,tasks')" "fallback=ceo"
+  _expect "a bare generic tag alone is ambiguous, not a match" \
+    "$(cmd_resolve engineering)" "owner=REFUSED"
+  # CORRECTED BELIEF, not a weakened test. This assertion used to read "a
+  # marketing tag reaches a marketing agent". It does not and never did:
+  # `marketing` is staked by 16 agents, `sql` by 17. The old test passed because
+  # the resolver picked one by directory order and the assertion only checked
+  # that SOMETHING was picked. The truthful assertion is that it refuses — and
+  # that the refusal carries the shortlist, so the decision can be made upward.
+  _expect "a 16-agent tag refuses rather than picking by directory order" \
+    "$(cmd_resolve marketing)" "owner=REFUSED"
+  _expect "the refusal hands up a candidate shortlist, not just a no" \
+    "$(cmd_resolve marketing)" "candidates="
+  _expect "a specific tag (1 agent stakes it) still resolves with high confidence" \
+    "$(cmd_resolve spec)" "confidence=high"
+  _expect "an unknown tag falls back to the CEO, it does not fail" \
+    "$(cmd_resolve zzz-no-such-tag)" "owner=ceo"
+  _expect "the chain from a director ends at the chairman" \
+    "chain=$(_superior cmo)" "chairman"
+  _expect "the chain from the ceo is just the chairman" \
+    "chain=$(_superior ceo)" "chairman"
+
+  # A namespaced trigger word must NEVER match — it is the other lane.
+  local ns; ns="$(cmd_resolve 'campaign:brief')"
+  _expect "a namespaced trigger word matches NOBODY (falls back)" "$ns" "owner=ceo"
+
+  # RED PROOF: gut the mechanism the resolver ACTUALLY reads and assert the
+  # matches stop working. A checker that stays green against a gutted mechanism
+  # proves nothing — and this one caught exactly that on itself: it used to gut
+  # `_stakes`, and when the resolver was rewired onto `_index` the proof went on
+  # passing while guarding a function nothing called any more. It was repointed,
+  # never relaxed. If you move the mechanism again, move this with it.
+  echo "  -- red proof --"
+  _index() { echo ""; }
+  local gutted; gutted="$(cmd_resolve spec)"
+  if grep -q "via=fallback" <<< "$gutted"; then
+    echo "  ok   gutted index falls back — the check is load-bearing"
+  else
+    echo "  RED  gutted index STILL matched: $gutted"; fails=$((fails+1))
+  fi
+
+  echo
+  [ "$fails" -eq 0 ] && { echo "PASS"; return 0; } || { echo "FAIL ($fails)"; return 1; }
+}
+
+case "${1:---help}" in
+  --tags)      shift; cmd_resolve "${1:-}" ;;
+  --owner)     shift; echo "chain=$(_superior "${1:-}")" ;;
+  --roster)    cmd_roster ;;
+  --self-test) cmd_self_test ;;
+  *) sed -n '2,20p' "$0" | sed 's/^# \{0,1\}//' ;;
+esac

package/scripts/db-sync-lock-check.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# db-sync-lock-check.sh — the property `sync-from-prod.ts` needs to be safe under
+# N concurrent sessions.
+#
+# WHY THIS EXISTS. `hook:db-sync` (settings.json, SessionStart) fires
+# `bun run db:sync` on EVERY session start, and the script writes a SHARED path
+# (`/tmp/one-prod-sync/d1-export.sql`). On 2026-09-05, with 7 sessions open, two
+# runs were caught mid-flight by lsof holding that one file open for write —
+# two write fds, one inode, identical offset — and each would then have dropped
+# and re-imported the local `one-owners` tables underneath the other. The bug is
+# not the wasted export; it is the corrupted local mirror.
+#
+#   C1  a lone runner acquires, completes, and RELEASES
+#   C2  a second runner SKIPS (exit 0) while a live owner holds the lock
+#   C3  a dead owner's lock is reaped — the next runner proceeds
+#   C4  the TTL branch reaps too, so the pid branch is not the only one
+#   R1  RED-PROOF: with the guard removed, C2 must FAIL. A checker that stays
+#       green against a gutted implementation is not a check.
+#
+# Sandboxed via ONE_SYNC_TMP_DIR — never touches a real /tmp/one-prod-sync.
+# Runs with an empty --only scope, so no network call and no local mutation.
+#
+#   bash .claude/scripts/db-sync-lock-check.sh
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SCRIPT="$ROOT/one.ie/web/scripts/sync-from-prod.ts"
+SANDBOX="$(mktemp -d "${TMPDIR:-/tmp}/db-sync-lock-check.XXXXXX")"
+trap 'rm -rf "$SANDBOX"' EXIT
+
+fails=0
+ok()  { printf '  \033[32mPASS\033[0m  %s\n' "$1"; }
+bad() { printf '  \033[31mFAIL\033[0m  %s\n' "$1"; fails=$((fails + 1)); }
+
+# Dummy creds: the script only checks PRESENCE, and an empty --only scope makes
+# no API call. Never put real credentials in a checker.
+run_sync() { # run_sync <tmpdir> <script> -> stdout+stderr, exit code preserved
+  CLOUDFLARE_EMAIL='check@example.invalid' \
+  CLOUDFLARE_GLOBAL_API_KEY='not-a-real-key' \
+  ONE_SYNC_TMP_DIR="$1" \
+  bun "$2" --only= 2>&1
+}
+
+echo "── db-sync single-writer lock ──"
+
+# ── C1  lone runner: acquires, completes, releases ───────────────────────────
+d="$SANDBOX/c1"; mkdir -p "$d"
+out="$(run_sync "$d" "$SCRIPT")"; rc=$?
+if [ $rc -eq 0 ] && grep -q 'DONE' <<<"$out"; then
+  ok "C1 lone runner completes"
+else
+  bad "C1 lone runner completes (rc=$rc): $out"
+fi
+if [ ! -d "$d/.lock" ]; then
+  ok "C1 lock released on exit"
+else
+  bad "C1 lock LEAKED at $d/.lock"
+fi
+
+# ── C2  contention: a live owner makes the second runner skip ────────────────
+# $$ is this shell — guaranteed alive, and never needs killing.
+d="$SANDBOX/c2"; mkdir -p "$d/.lock"; printf '%s' "$$" > "$d/.lock/pid"
+out="$(run_sync "$d" "$SCRIPT")"; rc=$?
+if [ $rc -eq 0 ] && grep -q 'skipping this run' <<<"$out" && ! grep -q 'DONE' <<<"$out"; then
+  ok "C2 second runner skips under a live owner"
+else
+  bad "C2 second runner did NOT skip (rc=$rc): $out"
+fi
+if [ -f "$d/.lock/pid" ] && [ "$(cat "$d/.lock/pid")" = "$$" ]; then
+  ok "C2 skipping runner did not steal the owner's lock"
+else
+  bad "C2 owner's lock was clobbered by the skipper"
+fi
+
+# ── C3  a dead owner's lock is reaped ────────────────────────────────────────
+bash -c 'exit 0' & deadpid=$!; wait $deadpid 2>/dev/null   # pid is now dead
+d="$SANDBOX/c3"; mkdir -p "$d/.lock"; printf '%s' "$deadpid" > "$d/.lock/pid"
+out="$(run_sync "$d" "$SCRIPT")"; rc=$?
+if [ $rc -eq 0 ] && grep -q 'reaping stale lock' <<<"$out" && grep -q 'DONE' <<<"$out"; then
+  ok "C3 dead owner's lock reaped, runner proceeds"
+else
+  bad "C3 dead owner's lock NOT reaped (rc=$rc): $out"
+fi
+
+# ── C4  the TTL branch reaps as well (owner alive, lease expired) ────────────
+d="$SANDBOX/c4"; mkdir -p "$d/.lock"; printf '%s' "$$" > "$d/.lock/pid"
+touch -A -013000 "$d/.lock" 2>/dev/null || touch -d '90 minutes ago' "$d/.lock" 2>/dev/null
+out="$(run_sync "$d" "$SCRIPT")"; rc=$?
+if grep -q 'reaping stale lock' <<<"$out" && grep -q 'DONE' <<<"$out"; then
+  ok "C4 expired lease reaped even though the owner is alive"
+else
+  bad "C4 TTL branch did not fire — pid liveness is the only reaper: $out"
+fi
+
+# ── R1  RED-PROOF: gut the guard, C2 must fail ───────────────────────────────
+GUTTED="$SANDBOX/gutted.ts"
+sed 's/^if (!acquireLock()) {$/if (false) {/' "$SCRIPT" > "$GUTTED"
+if ! grep -q 'if (false) {' "$GUTTED"; then
+  bad "R1 could not gut the guard — the anchor moved, this checker is blind"
+else
+  d="$SANDBOX/r1"; mkdir -p "$d/.lock"; printf '%s' "$$" > "$d/.lock/pid"
+  out="$(run_sync "$d" "$GUTTED")"
+  if grep -q 'skipping this run' <<<"$out"; then
+    bad "R1 gutted build STILL skipped — C2 is not testing the guard"
+  else
+    ok "R1 red-proof: gutted guard stops skipping, so C2 has teeth"
+  fi
+fi
+
+echo
+if [ $fails -eq 0 ]; then
+  echo "ALL GREEN — the lock holds and the checks can go red"
+  exit 0
+fi
+echo "RED — $fails check(s) failed"
+exit 1