@oneie/claude 0.8.0 → 0.9.0

package/scripts/do-prove-selftest.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# do-prove-selftest.sh — the red proof for do-prove.sh's argument contract.
+# Invoked as `do-prove.sh --self-test`; $1 is the do-prove.sh under test.
+#
+# Asked for by .claude/improvements.queue.md:307 ("it has no --self-test, unlike
+# its sibling gates ... or this regresses silently the way it arrived").
+#
+# Every GREEN check here is paired with a RED one that GUTS the guard it depends
+# on and asserts the check then fails. A checker that stays green against gutted
+# code proves nothing.
+#
+# Needs no live server: the parser half is pure argument handling, and the base
+# half points at a closed port on purpose.
+set -uo pipefail
+
+TARGET="${1:-}"
+[ -n "$TARGET" ] && [ -f "$TARGET" ] || { echo "selftest: need the path to do-prove.sh"; exit 2; }
+
+pass=0; fail=0
+ok()  { echo "  ok   — $1"; pass=$((pass+1)); }
+no()  { echo "  FAIL — $1"; fail=$((fail+1)); }
+
+# A port nothing is listening on. Verified closed, not assumed.
+DEAD=""
+for p in 45871 45872 45873 45874; do
+  if ! curl -sf -o /dev/null --max-time 1 "http://127.0.0.1:$p/" 2>/dev/null; then DEAD="$p"; break; fi
+done
+[ -n "$DEAD" ] || { echo "selftest: could not find a closed port"; exit 2; }
+DEADBASE="http://127.0.0.1:$DEAD"
+
+# A gutted copy of do-prove.sh with one guard removed, laid out so its own
+# ROOT-from-BASH_SOURCE derivation still works.
+# A mutant must still PARSE. Deleting the body of an `if` leaves an orphaned
+# `fi`, and bash exits 2 on a syntax error — which is indistinguishable from a
+# usage error and would have let a broken mutant masquerade as a red proof.
+# Measured while writing this file: both base-half mutants "failed" that way.
+# So mutate by SUBSTITUTION (guard → `:`), and refuse a mutant that does not
+# parse rather than scoring it.
+gut() { # $1 = sed program → echoes the path of the mutant, or empty on failure
+  local d; d="$(mktemp -d)"
+  mkdir -p "$d/.claude/scripts"
+  sed "$1" "$TARGET" > "$d/.claude/scripts/do-prove.sh"
+  if ! cmp -s "$TARGET" "$d/.claude/scripts/do-prove.sh"; then :; else
+    echo "" ; return 0   # sed matched nothing — the guard moved
+  fi
+  bash -n "$d/.claude/scripts/do-prove.sh" 2>/dev/null || { echo ""; return 0; }
+  echo "$d/.claude/scripts/do-prove.sh"
+}
+
+echo "do-prove --self-test"
+echo "[1/2] parser — an unrecognised FLAG is a hard error"
+
+out="$(bash "$TARGET" --route / --bogus </dev/null 2>&1)"; rc=$?
+[ "$rc" -eq 2 ] && ok "unknown flag --bogus exits 2 (got $rc)" \
+                || no "unknown flag --bogus should exit 2, got $rc"
+case "$out" in *"unknown flag '--bogus'"*) ok "…and names the flag" ;;
+               *) no "output did not name the flag: $out" ;; esac
+
+out="$(bash "$TARGET" --base </dev/null 2>&1)"; rc=$?
+[ "$rc" -eq 2 ] && ok "--base with no value exits 2" || no "--base with no value: rc=$rc"
+out="$(bash "$TARGET" --route </dev/null 2>&1)"; rc=$?
+[ "$rc" -eq 2 ] && ok "--route with no value exits 2" || no "--route with no value: rc=$rc"
+
+# The leniency that must SURVIVE: a bare token (cycle slug) is still ignored,
+# not refused. do-w4-gates.sh:210 and do-smoke.sh:85-88 depend on this.
+out="$(bash "$TARGET" some-cycle-slug --route / --base "$DEADBASE" </dev/null 2>&1)"; rc=$?
+[ "$rc" -ne 2 ] && ok "a bare cycle slug is still tolerated (rc=$rc, not a usage error)" \
+                || no "a bare cycle slug was refused as a usage error — this breaks existing callers"
+case "$out" in *"is not a path (cycle slug?)"*) ok "…and still says so" ;;
+               *) no "the lenient note is gone" ;; esac
+
+# RED: remove the -*) branch and the flag guard must stop biting.
+m="$(gut 's|^      exit 2 ;;$|      shift ;;|')"
+if [ -z "$m" ]; then no "RED PROOF FAILED: could not build the flag-guard mutant"; else
+out="$(bash "$m" --route / --bogus --base "$DEADBASE" </dev/null 2>&1)"; rc=$?
+[ "$rc" -ne 2 ] && ok "RED PROOF: gutted flag guard no longer exits 2 (got $rc) — check 1 is live" \
+                || no "RED PROOF FAILED: mutant still exits 2; check 1 proves nothing"
+fi
+
+echo "[2/2] base — --base pins the leg, and an unrun proof is not a pass"
+
+out="$(bash "$TARGET" --route / --base "$DEADBASE" </dev/null 2>&1)"; rc=$?
+[ "$rc" -ne 0 ] && ok "explicit --base that answers nothing exits non-zero (got $rc)" \
+                || no "explicit --base answered nothing and still exited 0 — the fail-open is back"
+case "$out" in *"an unrun proof is not a pass"*) ok "…and says why" ;;
+               *) no "no unrun message: $out" ;; esac
+case "$out" in *"https://one.ie"*) no "--base did not pin the fallback — it reached for https://one.ie" ;;
+               *) ok "--base pinned the fallback (production never named)" ;; esac
+
+# RED: remove the fallback pin → the mutant must reach for https://one.ie.
+m="$(gut 's|^  PROD_URL="\$BASE_URL"$|  :|')"
+if [ -z "$m" ]; then no "RED PROOF FAILED: could not build the pin mutant"; else
+out="$(bash "$m" --route / --base "$DEADBASE" </dev/null 2>&1)"
+case "$out" in *"https://one.ie"*) ok "RED PROOF: unpinned mutant reaches production — the pin is load-bearing" ;;
+               *) no "RED PROOF FAILED: mutant did not reach production; the pin check proves nothing" ;; esac
+fi
+
+# RED: remove the unrun-is-not-a-pass block → the mutant must go back to exit 0.
+m="$(gut 's|^    exit 1$|    :|')"
+if [ -z "$m" ]; then no "RED PROOF FAILED: could not build the fail-open mutant"; else
+out="$(bash "$m" --route / --base "$DEADBASE" </dev/null 2>&1)"; rc=$?
+if [ "$rc" -eq 0 ]; then ok "RED PROOF: gutted mutant exits 0 on an unreachable base — the guard is live"
+else no "RED PROOF FAILED: mutant still exits $rc; the fail-open check proves nothing"; fi
+fi
+
+echo
+echo "do-prove --self-test: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/do-prove.sh

@@ -4,7 +4,8 @@
 # (chrome-headless-shell page check via chrome.mjs, curl fallback against prod).
 #
 # Usage:
-#   do-prove.sh [--route <path>]... [<changed-path>|<cycle-slug>]...
+#   do-prove.sh [--route <path>]... [--base <url>] [<changed-path>|<cycle-slug>]...
+#   do-prove.sh --self-test
 #   git diff --name-only | do-prove.sh
 #
 # Arg contract:
@@ -12,10 +13,36 @@
 #   - Positional args that do NOT exist on disk (e.g. a cycle slug) are ignored
 #     for surface detection; changed paths then come from `git diff --name-only HEAD`.
 #   - --route <path> (repeatable) forces frontend surface + names the route(s) to prove.
+#   - --base <url> proves against <url> instead of the default localhost base.
 #   - stdin (non-tty) supplies changed paths when no positional paths are given.
+#   - AN UNRECOGNISED FLAG IS A HARD ERROR (exit 2). It was not, until 2026-09-07,
+#     and that is how the launch promise came to prove a laptop. `text/bring-one-to-life.md`
+#     deliverable 6 read `--route /keys --base https://one.ie`; `--base` did not
+#     exist, so BOTH tokens fell through the lenient `*)` branch as "not a path
+#     (cycle slug?)" and the run silently used the localhost default. Measured that
+#     morning with a dev server up on :4321:
+#       PROVE: note — '--base' is not a path (cycle slug?); …
+#       PROVE: ok / — http=200, 0 console/js errors (dev http://localhost:4321)
+#       PROVE: pass (1 route(s) proven)          ← exit 0, prod never contacted
+#     The leniency is deliberate for BARE tokens (a cycle slug is passed
+#     legitimately — do-w4-gates.sh:210, do-smoke.sh:85-88). It is never correct
+#     for a token starting with `-`: nobody passes a flag they do not mean.
+#
+# --base semantics (matches land.sh:344-345, which pins both bases by hand and
+# says why): --base PINS THE FALLBACK TOO, unless PROVE_PROD_URL is explicitly
+# exported. Setting only the dev base would rebuild the same defect one layer
+# down — an unreachable `--base https://staging.x` would fall through to
+# PROD_URL and prove PRODUCTION while reporting it as staging.
+# And an explicit --base that ANSWERS NOTHING exits non-zero rather than
+# `PROVE: skipped` (exit 0): do-promise-settle.sh runs a promise's proof: string
+# verbatim and reads the exit code, so a skipped prod probe would settle the
+# promise KEPT with the site down. An unrun gate is not a pass. Bare invocations
+# keep the old skip-is-0 semantics — land.sh:346-350 reads the ROUTE COUNT and
+# factory-walk.sh:294 matches `PROVE: skipped` → unrun, and both rely on it.
 #
 # Env:
-#   PROVE_BASE_URL   dev base for browser check (default http://localhost:4321)
+#   PROVE_BASE_URL   dev base for browser check (default http://localhost:4321).
+#                    `--base <url>` is the flag form of exactly this, and wins.
 #   PROVE_PROD_URL   prod fallback base       (default https://one.ie)
 #   PROVE_CHECK_CMD  optional check command for non-frontend surfaces; if set and
 #                    it fails, do-prove.sh exits nonzero.
@@ -44,7 +71,10 @@
 #
 # Exit codes: 0 = pass or skipped (no reachable environment) · 1 = a reachable
 # page failed (HTTP >= 500 / 404 / status 0 / console+JS errors / landed on a
-# different path than requested) or declared check failed.
+# different path than requested), a declared check failed, or an explicit --base
+# answered nothing · 2 = usage error (unknown flag, or a flag missing its value).
+#
+# --self-test drives both halves red and green with no live server required.
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
@@ -54,11 +84,34 @@ BROWSER_CHECK="$ROOT/.claude/scripts/chrome.mjs"
 
 routes=()
 paths=()
+base_explicit=0
+self_test=0
+
+prove_usage() {
+  echo "PROVE: usage: do-prove.sh [--route <path>]... [--base <url>] [--self-test] [<changed-path>|<cycle-slug>]..."
+}
+
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --route)
-      [ "$#" -ge 2 ] || { echo "PROVE: --route requires a value"; exit 1; }
+      [ "$#" -ge 2 ] || { echo "PROVE: --route requires a value"; exit 2; }
       routes+=("$2"); shift 2 ;;
+    --base)
+      # The flag form of PROVE_BASE_URL. Trailing slash stripped so
+      # "$BASE_URL$route" never produces a double slash.
+      [ "$#" -ge 2 ] || { echo "PROVE: --base requires a value"; exit 2; }
+      BASE_URL="${2%/}"; base_explicit=1; shift 2 ;;
+    --self-test)
+      self_test=1; shift ;;
+    -h|--help)
+      prove_usage; exit 0 ;;
+    -*)
+      # THE ROOT CAUSE, closed. A token that looks like a flag and is not one is
+      # a caller asking for something this script cannot do — never a cycle slug.
+      # Silently continuing is how `--base https://one.ie` became a no-op.
+      echo "PROVE: unknown flag '$1'" >&2
+      prove_usage >&2
+      exit 2 ;;
     *)
       # A real path (exists on disk relative to root or cwd) counts as a changed
       # path; anything else (a cycle slug) is noted and ignored for detection.
@@ -71,6 +124,17 @@ while [ "$#" -gt 0 ]; do
   esac
 done
 
+# An explicit --base means "prove HERE, nowhere else". Only an explicitly
+# exported PROVE_PROD_URL may name a different fallback (land.sh does exactly
+# that, pinning both to the dev URL).
+if [ "$base_explicit" -eq 1 ] && [ -z "${PROVE_PROD_URL:-}" ]; then
+  PROD_URL="$BASE_URL"
+fi
+
+if [ "$self_test" -eq 1 ]; then
+  exec bash "$ROOT/.claude/scripts/do-prove-selftest.sh" "$ROOT/.claude/scripts/do-prove.sh"
+fi
+
 # stdin (piped) paths
 if [ "${#paths[@]}" -eq 0 ] && [ ! -t 0 ]; then
   while IFS= read -r l; do [ -n "$l" ] && paths+=("$l"); done || true
@@ -265,6 +329,11 @@ report_redirect() { # $1 = route, $2 = landed path, $3 = leg label
   esac
 }
 
+# The result line used to hardcode the word "dev" — so a production run
+# printed "(dev https://one.ie)" on the very receipt someone reads to decide
+# whether the site is live. Name the leg for what it is.
+if _prove_local_base; then LEG="dev $BASE_URL"; else LEG="base $BASE_URL"; fi
+
 fail=0
 checked=0
 for route in "${routes[@]}"; do
@@ -341,14 +410,14 @@ for route in "${routes[@]}"; do
       # the browser leg never did, so a nonexistent route proved itself green
       # whenever the page also logged no errors. 401/403 stay ok — gated, not gone.
       if [ -n "$final" ] && [ "$landed" != "$(path_of "$route")" ]; then
-        report_redirect "$route" "$landed" "dev $BASE_URL"
+        report_redirect "$route" "$landed" "$LEG"
         fail=1
       elif [ "$status" -ge 500 ] || [ "$status" -eq 404 ] || [ "$errs" -gt 0 ]; then
-        echo "PROVE: FAIL $route — http=$status console/js errors=$errs (dev $BASE_URL)"
+        echo "PROVE: FAIL $route — http=$status console/js errors=$errs ($LEG)"
         printf '%s' "$out" | jq -r "$counted[]" 2>/dev/null | head -5 | sed 's/^/PROVE:   error: /'
         fail=1
       else
-        echo "PROVE: ok $route — http=$status, 0 console/js errors (dev $BASE_URL)"
+        echo "PROVE: ok $route — http=$status, 0 console/js errors ($LEG)"
       fi
       # Never silent: an ignored error is still an error someone should see.
       ign="$(printf '%s' "$out" | jq -r "$ignored" 2>/dev/null || echo 0)"
@@ -372,11 +441,11 @@ for route in "${routes[@]}"; do
       # running a tree without the page, and that line was the 17th leg of a
       # promise's proof. 401/403 stay ok: the route answered, it is merely gated.
       if [ -n "$effective" ] && [ "$landed" != "$(path_of "$route")" ]; then
-        report_redirect "$route" "$landed" "dev $BASE_URL, curl"; fail=1
+        report_redirect "$route" "$landed" "$LEG, curl"; fail=1
       elif [ "$code" -ge 500 ] || [ "$code" -eq 404 ]; then
-        echo "PROVE: FAIL $route — http=$code (dev $BASE_URL, curl)"; fail=1
+        echo "PROVE: FAIL $route — http=$code ($LEG, curl)"; fail=1
       else
-        echo "PROVE: ok $route — http=$code (dev $BASE_URL, curl)"
+        echo "PROVE: ok $route — http=$code ($LEG, curl)"
       fi
     fi
   fi
@@ -405,6 +474,13 @@ if [ "$fail" -eq 1 ]; then
   echo "PROVE: fail"; exit 1
 fi
 if [ "$checked" -eq 0 ]; then
+  # An explicitly named base that answered nothing is an UNRUN PROOF, and
+  # do-promise-settle.sh reads this exit code verbatim. Exit 0 here would settle
+  # a promise KEPT because the site was unreachable.
+  if [ "$base_explicit" -eq 1 ]; then
+    echo "PROVE: FAIL — --base $BASE_URL answered nothing; an unrun proof is not a pass"
+    exit 1
+  fi
   echo "PROVE: skipped (no reachable environment)"; exit 0
 fi
 echo "PROVE: pass ($checked route(s) proven)"; exit 0

package/scripts/do-reconcile.sh

@@ -332,9 +332,20 @@ case "$CANON" in
           current=$(cat "$_cache" | tr -d '[:space:]')        # computed while we queued
         else
           _tsc_tmp=$(mktemp)
-          run_bounded "${RECONCILE_TSC_TIMEOUT:-600}" \
+          # THE SLOT, not just the lock — same defect as tsc-cached.sh, same fix.
+          # The gate_lock above dedupes this folder against other reconciles; it
+          # does nothing about N worktrees typechecking N different folders at
+          # once. See tsc-cached.sh for the 2026-09-07 measurement.
+          # Resolve gate-run from THIS script's own directory. An earlier
+          # version used "$ROOT/..." -- ROOT is never set in this file, and under
+          # `set -u` that is a hard "unbound variable" that killed the whole
+          # `types` canon. Caught by tests/integration/reconcile.test.ts, which is
+          # the reason that test exists.
+          _gr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+          GOVERN_GATE_TIMEOUT="${RECONCILE_TSC_TIMEOUT:-600}" \
+          bash "$_gr" "tsc-reconcile:$folder" -- \
             bash -c "cd '$folder' && bunx tsc --noEmit 2>&1 | grep -c 'error TS' > '$_tsc_tmp'" \
-            2>/dev/null || true
+            || true
           current=$(cat "$_tsc_tmp" 2>/dev/null | tr -d '[:space:]'); rm -f "$_tsc_tmp"
           current=${current:-0}
           printf '%s' "$current" > "$_cache"

package/scripts/do-signal.sh

@@ -13,6 +13,7 @@
 #   do-signal.sh [--print] --task-reap
 #   do-signal.sh [--print] --task-link   <slug> [docs=a,b,c]
 #   do-signal.sh [--print] --task-heartbeat <slug> <body>
+#   do-signal.sh [--print] --outcome <slug> tags=a,b actor=<aid> success=<bool> [weight=<n>]
 #
 # --print: write JSON to stdout without POSTing (tests + dry runs).
 # Extra key=value pairs are merged into the world:do-event payload.
@@ -117,6 +118,23 @@ _jsonesc() { printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t
 # session happened to be attested.
 CC_TASKS_WORKSPACE="${CC_TASKS_WORKSPACE:-one}"
 
+# CC_TASKS_AUTHOR — WHO the comment is from, when it is not simply "the
+# workspace". tasks:comment records an author on the message and the inbox draws
+# it (three directors on one task read as three speakers, not one anonymous
+# run), but a field no caller supplies is a field production never sets: this
+# script and the MCP door are the two writers, and both built their payload with
+# tid/workspace/body only, so every /do close and every wave heartbeat landed
+# `authorKind:"staff"`. The receiver honours the field only for an ATTESTED
+# staff caller — which is exactly what GATEWAY_API_KEY auth above makes this
+# script — and validates the slug shape; a caller that cannot be attested names
+# nobody. UNSET is the default and emits the byte-identical payload this script
+# has always sent, so nothing changes for a harness that does not set it.
+CC_TASKS_AUTHOR="${CC_TASKS_AUTHOR:-}"
+_author_json() {  # emits `,"author":"<slug>"` or nothing
+  [ -n "$CC_TASKS_AUTHOR" ] || return 0
+  printf ',"author":"%s"' "$CC_TASKS_AUTHOR"
+}
+
 # signal_tasks_create — plan arm: files an open task tagged slug:<slug>, so the
 # plan appears in tasks:everywhere the moment it's armed (C1/C2 interface contract).
 signal_tasks_create() {  # signal_tasks_create <slug> <title> [tags=a,b,c] [notes=...]
@@ -248,6 +266,65 @@ signal_tasks_reap() {  # signal_tasks_reap
 # signal_tasks_link — cycle close: records the handoff-completion back on the
 # origin task (provenance line + task-status:done), same shape lifecycle.ts's
 # tasks_link MCP tool posts.
+# signal_outcome — /close's loop-closer, and the reason it is world:outcome.
+#
+# THE NAMING GAP, measured. `/api/receivers/signals` ranks every emitted signal
+# name as declared | candidate | unhomed against packages/sdk/src/receivers.ts,
+# because 35 distinct event names were emitted in 90 days and exactly ONE
+# (`world:in`) was a declared receiver. /close was a top contributor: measured
+# 2026-09-09, `do:close` 0, `loop:feedback` 0, `world:do-event` 0 declarations —
+# three of the four names it emitted could not be answered by anything, and it
+# reported success anyway.
+#
+# `world:outcome` is not a new contract written for this. It already says exactly
+# what /close does: "whoever consumed a route reports success/failure, moving the
+# same tag->receiver paths the router reads - success marks, failure warns."
+# So the fix converges four names to one and designs nothing.
+#
+# THE VERB IS READ BACK, NEVER ASSUMED. The receiver answers
+# {ok, outcome:"marked"|"warned", ...}; a caller that prints "marked" because it
+# sent success:true is reporting its own intent, which is the class of defect the
+# whole four-outcome grammar exists to stop.
+#
+# TAGS ARE BARE WORDS. `marketing`, never `lifecycle:marketing` - a namespaced
+# tag matches zero subscribers. `slug:`/`cycle:` are provenance, not stakes, and
+# are appended separately so they can never be mistaken for a routable tag.
+signal_outcome() {  # signal_outcome <slug> tags=a,b actor=<aid> success=<bool> weight=<n> [workspace=<ws>]
+  local slug="$1"; shift
+  local tags="" actor="" success="true" weight="" ws="${CC_TASKS_WORKSPACE}"
+  local kv
+  for kv in "$@"; do
+    case "$kv" in
+      tags=*)      tags="${kv#*=}" ;;
+      actor=*)     actor="${kv#*=}" ;;
+      success=*)   success="${kv#*=}" ;;
+      weight=*)    weight="${kv#*=}" ;;
+      workspace=*) ws="${kv#*=}" ;;
+    esac
+  done
+  [ -n "$slug" ]  || { echo "signal_outcome: slug required" >&2; return 2; }
+  [ -n "$actor" ] || { echo "signal_outcome: actor= required (world:outcome moves that actor's paths)" >&2; return 2; }
+  case "$success" in true|false) ;; *) echo "signal_outcome: success must be true|false" >&2; return 2 ;; esac
+
+  # A namespaced word here would route to nobody. Refuse it loudly rather than
+  # emit a signal that matches zero subscribers and still exits 0.
+  local t
+  for t in ${tags//,/ }; do
+    case "$t" in
+      slug:*|cycle:*) ;;
+      *:*) echo "signal_outcome: '$t' is namespaced - stake tags are BARE words (see subscribe-tags-parity.test.ts)" >&2; return 2 ;;
+    esac
+  done
+
+  tags="${tags:+${tags},}slug:${slug}"
+  local tags_json
+  tags_json=$(printf '%s' "$tags" | awk -F',' '{for(i=1;i<=NF;i++){if($i!=""){printf "%s\"%s\"", (n++?",":""), $i}}}')
+
+  local payload="{\"data\":{\"tags\":[${tags_json}],\"actor\":\"$(_jsonesc "$actor")\",\"success\":${success}${weight:+,\"weight\":${weight}},\"slug\":\"$(_jsonesc "$slug")\",\"workspace\":\"$(_jsonesc "$ws")\"}}"
+  if $PRINT; then printf '%s\n' "$payload"; return 0; fi
+  _post_ask "world:outcome" "$payload"
+}
+
 signal_tasks_link() {  # signal_tasks_link <slug> [docs=a,b,c]
   # Slug-addressed like claim — the server resolves slug → the origin tid create wrote.
   local slug="$1" docs=""
@@ -269,7 +346,7 @@ signal_tasks_link() {  # signal_tasks_link <slug> [docs=a,b,c]
   if _post_ask "tasks:link" "$payload"; then return 0; fi
   [ -n "$tid" ] || return 1
   _post_ask "tasks:status" "{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"status\":\"done\"}}" >/dev/null || return 1
-  _post_ask "tasks:comment" "{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"/do close — ${slug}${docs:+ (docs: ${docs})}\"}}"
+  _post_ask "tasks:comment" "{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"/do close — ${slug}${docs:+ (docs: ${docs})}\"$(_author_json)}}"
 }
 
 # signal_tasks_heartbeat — batch/wave close: posts tasks:comment so the lease
@@ -285,9 +362,9 @@ signal_tasks_heartbeat() {  # signal_tasks_heartbeat <slug> <body>
   # accompanied, when the tid is known — otherwise the broken resolver runs anyway.
   local payload
   if [ -n "$tid" ]; then
-    payload="{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"${body_esc}\"}}"
+    payload="{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"${body_esc}\"$(_author_json)}}"
   else
-    payload="{\"data\":{\"slug\":\"${slug}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"${body_esc}\"}}"
+    payload="{\"data\":{\"slug\":\"${slug}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"${body_esc}\"$(_author_json)}}"
   fi
   if $PRINT; then printf '%s\n' "$payload"; return 0; fi
   _post_ask "tasks:comment" "$payload"
@@ -315,6 +392,7 @@ while [ "$#" -gt 0 ]; do
     --task-reap)       shift; signal_tasks_reap "$@"; exit $? ;;
     --task-link)       shift; signal_tasks_link "$@"; exit $? ;;
     --task-heartbeat)  shift; signal_tasks_heartbeat "$@"; exit $? ;;
+    --outcome)         shift; signal_outcome "$@"; exit $? ;;
     *) break ;;
   esac
 done
@@ -322,6 +400,7 @@ done
 if [ "$#" -lt 4 ]; then
   echo "usage: do-signal.sh [--print] <type> <slug> <tier> <cycle> [key=value ...]" >&2
   echo "       do-signal.sh [--print] --task-create|--task-claim|--task-link|--task-heartbeat <slug> ..." >&2
+  echo "       do-signal.sh [--print] --outcome <slug> tags=a,b actor=<aid> success=<bool> [weight=<n>]" >&2
   exit 1
 fi
 

package/scripts/do-smoke.sh

@@ -4,6 +4,23 @@
 # the seven-canon predicate (do-reconcile.sh) + navigation reachable/orphan fixtures.
 # Exits 0 only if ALL pass.
 set -uo pipefail
+
+# _GATE — route a heavy compute through the machine governor. A gate_lock only
+# dedupes IDENTICAL work; a SLOT is what bounds N worktrees each running one of
+# these at once (measured 2026-09-07: three concurrent 2.5GB typecheckers, every
+# lock uncontended, load 171). Empty when already inside a gate, so a nested call
+# inherits the outer slot rather than taking a second one.
+#
+# Resolves gate-run.sh from its OWN directory, deliberately: an earlier version
+# keyed off $ROOT and got inserted above the line that sets it, so _GATE was
+# silently empty and every call ran ungoverned -- a fail-OPEN, which is the exact
+# defect this preamble exists to close.
+_GATE=()
+if [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  _GR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+  [ -f "$_GR" ] && _GATE=( bash "$_GR" "compute:$(basename "${BASH_SOURCE[0]}")" -- )
+fi
+
 cd "$(dirname "${BASH_SOURCE[0]}")/../.." || exit 2
 S=.claude/scripts
 fail=0
@@ -61,7 +78,7 @@ echo "== C2 do-reconcile — types canon =="
 # Use a temp file to capture grep output — avoids pipefail swallowing the value when tsc
 # exits non-zero (which it does whenever there are any type errors).
 _tsc_tmp=$(mktemp)
-( cd one.ie/web 2>/dev/null && bunx tsc --noEmit 2>&1 | grep -c 'error TS' > "$_tsc_tmp" ) 2>/dev/null || true
+( cd one.ie/web 2>/dev/null && "${_GATE[@]}" bunx tsc --noEmit 2>&1 | grep -c 'error TS' > "$_tsc_tmp" ) 2>/dev/null || true
 _tsc_now=$(cat "$_tsc_tmp" 2>/dev/null | tr -d '[:space:]'); rm -f "$_tsc_tmp"
 echo "{\"tscErrors\": ${_tsc_now:-0}}" > .w0-baseline.json
 "$S/do-reconcile.sh" types >/dev/null 2>&1 && ok "types delta=0 → exit 0" || no "types should pass when no delta"

package/scripts/do-w4-gates.sh

@@ -49,6 +49,16 @@
 #                        because a skip is unrun, not pass; never set it for real.
 set -euo pipefail
 
+# _GATE — see governor-doors-check.sh "compute sites". A gate_lock dedupes
+# identical work; only a SLOT bounds N worktrees running N computes at once.
+# Empty inside an existing gate so the outer slot is inherited, never doubled.
+_GATE=()
+if [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  _GR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+  [ -f "$_GR" ] && _GATE=( bash "$_GR" "compute:$(basename "${BASH_SOURCE[0]}")" -- )
+fi
+
+
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 S="$ROOT/.claude/scripts"
 RESULTS_FILE=""
@@ -265,7 +275,7 @@ _gates() {
     if [ -z "$base" ]; then
       _add tsc-delta unrun ".w0-baseline.json has no tscErrors"
     else
-      set +e; now="$(cd "$ROOT" && bunx tsc --noEmit 2>&1 | grep -c 'error TS')"; set -e
+      set +e; now="$(cd "$ROOT" && "${_GATE[@]}" bunx tsc --noEmit 2>&1 | grep -c 'error TS')"; set -e
       if [ "$now" -le "$base" ]; then _add tsc-delta pass "baseline=$base now=$now"
       else _add tsc-delta fail "baseline=$base now=$now — new type errors"; fi
     fi