@oneie/claude 0.9.0 → 0.10.0

package/scripts/deploy-emit.sh

@@ -4,7 +4,7 @@
 # manifest: monorepo-only
 #   Same classification as deploy-record.sh, and for the same reason: deploy.sh
 #   is its only caller and deploy.sh does not ship. It DOES read a credential —
-#   GATEWAY_API_KEY through ONE_ENV_FILE (default one.ie/web/.env, plus the
+#   GATEWAY_API_KEY through ONE_ENV_FILE (default one.ie/web/.dev.vars, plus the
 #   monorepo fallbacks do-signal.sh walks), honoured so that a future ship needs
 #   no change — and no credential is exit 3 BY NAME, never a quiet success and
 #   never a skipped gate that reads as a gate that ran.
@@ -59,7 +59,14 @@
 #
 # ENV  DEPLOY_EMIT_URL       default $ONE_API_URL, else https://one.ie
 #      DEPLOY_EVENT_RECEIVER default deploy:event
-#      ONE_ENV_FILE / DO_ENV_FILE   the credential file
+#      ONE_ENV_FILE / DO_ENV_FILE   the credential file. Defaults to .dev.vars
+#          and the ladder tries it FIRST, mirroring do-board.sh:54-60: BOTH
+#          files carry a GATEWAY_API_KEY and PROD REFUSES the one in .env. A
+#          refused key is exit 4 — but deploy.sh backgrounds every _emit with
+#          both streams discarded and `|| true`, so the whole run would have
+#          reported nothing while recording nothing. Reordering the ladder
+#          alone would not have fixed it: the default above lands on a file
+#          before the ladder is ever consulted.
 #      DEPLOY_EMIT_SKIP_FALLBACKS=1 ONE_ENV_FILE is the WHOLE ladder. Without it
 #          the no-credential state is unreachable from inside the monorepo, so
 #          exit 3 could not be driven red. Same reason and shape as
@@ -67,7 +74,11 @@
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-ONE_ENV_FILE="${ONE_ENV_FILE:-${DO_ENV_FILE:-one.ie/web/.env}}"
+# .dev.vars, NOT .env — prod refuses the .env key (recorded trap; do-board.sh:56
+# pins the same file for the same reason). Relative, as it has always been: from
+# a subdirectory this misses and the ladder below — which now also leads with
+# .dev.vars — picks it up by absolute path.
+ONE_ENV_FILE="${ONE_ENV_FILE:-${DO_ENV_FILE:-one.ie/web/.dev.vars}}"
 URL="${DEPLOY_EMIT_URL:-${ONE_API_URL:-https://one.ie}}"
 RECEIVER="${DEPLOY_EVENT_RECEIVER:-deploy:event}"
 TIMEOUT="${DEPLOY_EMIT_TIMEOUT:-8}"
@@ -260,7 +271,9 @@ if [ "$DRY" = 1 ]; then printf '%s\n' "$payload"; exit 0; fi
 # removed on every path. Same shape as factory-emit.sh and do-signal.sh.
 _gateway_key() {
   local f v
-  for f in "$ONE_ENV_FILE" "$ROOT/one.ie/web/.env" "$ROOT/one.ie/web/.dev.vars" "$ROOT/.env"; do
+  # .dev.vars BEFORE .env, both here and in the default above. Two changes, not
+  # one: whichever is consulted first must be the file prod accepts.
+  for f in "$ONE_ENV_FILE" "$ROOT/one.ie/web/.dev.vars" "$ROOT/one.ie/web/.env" "$ROOT/.env"; do
     [ -f "$f" ] || continue
     if [ "${DEPLOY_EMIT_SKIP_FALLBACKS:-0}" = "1" ] && [ "$f" != "$ONE_ENV_FILE" ]; then continue; fi
     v="$(grep -E '^GATEWAY_API_KEY=' "$f" 2>/dev/null | head -1 | sed 's/^[^=]*=//;s/^"//;s/"$//')"

package/scripts/deploy-gate-check.sh

@@ -83,6 +83,153 @@ else
   fi
   rm -rf "$_mc"
 fi
+# --- the memo probe: a hit must never queue for a slot ----------------------
+# deploy's vitest gate runs under gate-run.sh, so it TOOK A SLOT and only then
+# asked the memo whether there was anything to run. Measured 2026-09-13: 300s
+# queued, then both lanes reported cache HIT.
+#
+# The block is EXTRACTED VERBATIM from deploy.sh and driven against a fake root
+# and a SANDBOX cache -- a copy here would prove only that the copy works. Every
+# axis that could touch the real thing is sandboxed: TEST_CACHE_DIR (a planted
+# stamp replayed by a real deploy is the worst thing this file could do) and
+# GOVERN_DIR (the only direct evidence that no slot was taken). The last two
+# assertions are that neither real directory gained a file.
+_probe_block="$(awk '/^# >>> vitest-memo-probe/{f=1} f{print} f&&/^# <<< vitest-memo-probe/{exit}' "$DEPLOY")"
+_report_block="$(awk '/elif grep -q .SKIPPED by the memo probe./{f=1} f{print} f&&/^ *ok "\$TESTS_REPORT"$/{exit}' "$DEPLOY")"
+if [ -z "$_probe_block" ] || [ -z "$_report_block" ]; then
+  echo "FAIL: could not extract the memo-probe block(s) from deploy.sh — this checker is blind"; fails=$((fails+1))
+else
+  _sbcache="$(mktemp -d)"; _sbgov="$(mktemp -d)"; _froot="$(mktemp -d)"
+  _real_cache="${TMPDIR:-/tmp}/one-test-cache"
+  K1="$(printf 'lane-pool'   | shasum -a 256 | cut -d' ' -f1)"
+  K2="$(printf 'lane-typedb' | shasum -a 256 | cut -d' ' -f1)"
+  mkdir -p "$_froot/.claude/scripts"
+  # a stand-in for test-full.sh under TEST_CACHE_KEY_ONLY=1: two lanes, two keys,
+  # and the chatter test-lanes.sh prints around them.
+  { echo 'echo "test-lanes: pool lane (8 forks) + typedb lane (19 files, serial) — concurrent"'
+    echo "echo $K1"; echo "echo $K2"; } > "$_froot/.claude/scripts/test-full.sh"
+
+  _drive_probe() { # <SKIP_TESTS> <want_astro> <ROOT> — prints a transcript
+    local logd; logd="$(mktemp -d)"
+    SKIP_TESTS_IN="$1" WANT_IN="$2" ROOT_IN="$3" LOGD_IN="$logd" \
+    TEST_CACHE_DIR="$_sbcache" GOVERN_DIR="$_sbgov" \
+    bash -c '
+      set -uo pipefail
+      say(){ printf "SAY %s\n" "$*"; }
+      ok(){  printf "OK %s\n"  "$*"; }
+      _spine_stage(){ [ "$1" = vitest ] && echo tests; }
+      _emit(){ printf "EMIT %s\n" "$*"; }
+      # the stub records a heavy registration the way the real one does, so
+      # HEAVY=0 on the skip path is a fact and not an artefact of the stub.
+      gate_start_heavy(){ printf "GATE_STARTED %s\n" "$1"; HEAVY_IDX+=(1); }
+      ROOT="$ROOT_IN"; LOG_DIR="$LOGD_IN"; STAMP="probe"; DRY=0
+      SKIP_TESTS="$SKIP_TESTS_IN"; want_astro="$WANT_IN"
+      GATE_NAMES=(); GATE_PIDS=(); GATE_LOGS=(); GATE_RC=(); GATE_T=(); GATE_DUR=(); HEAVY_IDX=()
+      '"$_probe_block"'
+      printf "GATES=%s RC=%s HEAVY=%s\n" "${#GATE_NAMES[@]}" "${GATE_RC[0]:-none}" "${#HEAVY_IDX[@]}"
+      if [ "${#GATE_LOGS[@]}" -gt 0 ]; then sed "s/^/LOG /" "${GATE_LOGS[0]}"; fi
+      exit 0'
+    rm -rf "$logd"
+  }
+
+  # (a) every lane stamped ⇒ the gate is SKIPPED, counted, and passed
+  date -u +%Y-%m-%dT%H:%M:%SZ > "$_sbcache/one.ie_web-$K1.pass"
+  date -u +%Y-%m-%dT%H:%M:%SZ > "$_sbcache/one.ie_web-$K2.pass"
+  _p_hit="$(_drive_probe 0 1 "$_froot")"
+  case "$_p_hit" in
+    *GATE_STARTED*) echo "FAIL: every lane stamped and the gate still took a slot"; fails=$((fails+1)) ;;
+    *) echo "ok: every lane stamped — the gate is skipped, no slot taken" ;;
+  esac
+  case "$_p_hit" in
+    *"GATES=1 RC=0"*) echo "ok: the skipped gate is still COUNTED as a passed gate" ;;
+    *) echo "FAIL: a memo-skipped gate was not recorded as a passed gate: $_p_hit"; fails=$((fails+1)) ;;
+  esac
+  # The hazard a stubbed gate_start_heavy would hide: a placeholder pid in
+  # HEAVY_IDX makes the NEXT heavy gate `wait 0` (exit 127 — verified) and
+  # overwrite this gate's rc with 1. A gate with no process is not a heavy gate.
+  case "$_p_hit" in
+    *HEAVY=0*) echo "ok: the skipped gate is not in HEAVY_IDX (no wait on a non-child)" ;;
+    *) echo "FAIL: a process-less gate entered HEAVY_IDX — the next heavy gate will mark it FAILED"; fails=$((fails+1)) ;;
+  esac
+  # …and the report it produces must say REUSED, never "all pass", and carry the
+  # stamp's timestamp. Driven through deploy.sh's OWN report branch, extracted.
+  _skiplog="$(mktemp)"
+  printf '%s\n' "$_p_hit" | sed -n 's/^LOG //p' > "$_skiplog"
+  _rep="$( glog="$_skiplog" bash -c '
+             ok(){ printf "OK %s\n" "$*"; }; TESTS_REPORT=""
+             if false; then :
+             '"$_report_block"'
+             fi
+             printf "REPORT=%s\n" "$TESTS_REPORT"' )"
+  case "$_rep" in
+    *"REUSED — identical inputs already passed"*"already PASSED 20"*)
+      echo "ok: the skip reports REUSED with the stamp's timestamp" ;;
+    *) echo "FAIL: the skip did not report REUSED with a timestamp: $_rep"; fails=$((fails+1)) ;;
+  esac
+  case "$_rep" in
+    *"all pass"*) echo "FAIL: a memo hit was reported as 'all pass'"; fails=$((fails+1)) ;;
+    *) echo "ok: a reused pass is never reported as 'all pass'" ;;
+  esac
+  # (b) RED HALF — ONE lane unstamped ⇒ the gate RUNS. This is the whole reason
+  # the probe does not read test-lanes.sh's exit code: under
+  # TYPEDB_LANE_NONBLOCKING=1 that code is the POOL lane's alone, so a pool-only
+  # hit would skip a typedb lane that had never run.
+  rm -f "$_sbcache/one.ie_web-$K2.pass"
+  _p_miss="$(_drive_probe 0 1 "$_froot")"
+  case "$_p_miss" in
+    *GATE_STARTED*) echo "ok: one lane unstamped — the gate RUNS (pool-only hit cannot skip it)" ;;
+    *) echo "FAIL: a pool-only hit skipped the gate — the typedb lane would never run"; fails=$((fails+1)) ;;
+  esac
+  case "$_p_miss" in *"memo probe: MISS"*) echo "ok: the miss is named in the report" ;;
+    *) echo "FAIL: a miss ran the gate without saying why"; fails=$((fails+1)) ;; esac
+  # (c) RED HALF — a probe that cannot answer runs the gate. An unrun check is
+  # not a pass, and neither is an unanswerable one.
+  echo 'exit 1' > "$_froot/.claude/scripts/test-full.sh"
+  _p_unk="$(_drive_probe 0 1 "$_froot")"
+  case "$_p_unk" in
+    *GATE_STARTED*) echo "ok: a probe that cannot answer runs the gate" ;;
+    *) echo "FAIL: an unanswerable probe skipped the gate"; fails=$((fails+1)) ;;
+  esac
+  # (d) --skip-tests keeps its own meaning: no gate at all, even with every lane
+  # stamped. A skipped suite is not a reused one.
+  { echo "echo $K1"; } > "$_froot/.claude/scripts/test-full.sh"
+  date -u +%Y-%m-%dT%H:%M:%SZ > "$_sbcache/one.ie_web-$K1.pass"
+  _p_skip="$(_drive_probe 1 1 "$_froot")"
+  case "$_p_skip" in
+    *GATE_STARTED*|*GATES=1*) echo "FAIL: --skip-tests registered a gate"; fails=$((fails+1)) ;;
+    *) echo "ok: --skip-tests still skips distinctly (no gate, no memo report)" ;;
+  esac
+  # the real test-full.sh must actually print a key per lane, or the probe above
+  # answers `2` forever and the change buys nothing. KEY_ONLY runs no vitest.
+  if [ -d "$ROOT/one.ie/web" ]; then
+    _rkeys="$( cd "$ROOT" && TEST_CACHE_KEY_ONLY=1 TEST_CACHE_DIR="$_sbcache" \
+                 bash "$ROOT/.claude/scripts/test-full.sh" 2>/dev/null | grep -Ec '^[0-9a-f]{64}$' )"
+    if [ "${_rkeys:-0}" -ge 2 ]; then echo "ok: the real full suite prints $_rkeys lane keys (probe can answer)"
+    else echo "FAIL: the real full suite printed ${_rkeys:-0} lane key(s) — the probe cannot answer"; fails=$((fails+1)); fi
+  else
+    echo "n/a: no one.ie/web here — the real lane-key probe cannot run (NOT a pass)"
+  fi
+  # NOTHING MAY LEAK — and the assertion is by CONTENT, not by count. release.sh's
+  # self-test compares file counts either side (release.sh:304-307); here that is a
+  # FALSE RED waiting to happen, because both directories are machine-wide and
+  # every other session on the box writes to them. Measured while writing this:
+  # the real governor dir went 161 -> 162 -> 163 inside one minute under two
+  # neighbouring `gate-run.sh verify-fast` processes, with nothing here running.
+  # So ask the precise question instead: did a PLANTED stamp reach the real cache?
+  _leaked=0
+  for _k in "$K1" "$K2"; do
+    for _f in "$_real_cache"/*"$_k".pass; do [ -f "$_f" ] && _leaked=$((_leaked+1)); done
+  done
+  if [ "$_leaked" -eq 0 ]; then echo "ok: no planted stamp leaked into the real cache"
+  else echo "FAIL: $_leaked planted stamp(s) reached the REAL cache — a future deploy could replay them"; fails=$((fails+1)); fi
+  # …and the slot. GOVERN_DIR is exported into the driven block, so a gate-run
+  # underneath it would leave its lock/slot HERE. An empty sandbox is the direct
+  # evidence that the hit path took no slot — the whole point of the change.
+  if [ -z "$(ls "$_sbgov" 2>/dev/null)" ]; then echo "ok: the probe took no governor slot at all (sandbox GOVERN_DIR empty)"
+  else echo "FAIL: the probe touched its governor dir — it is taking a slot"; fails=$((fails+1)); fi
+  rm -rf "$_sbcache" "$_sbgov" "$_froot" "$_skiplog"
+fi
+
 # --- the deferred-pin ledger: driven, not grepped ---------------------------
 # Extract deploy.sh's debt block verbatim and run it with stubbed reporters. The
 # block is the last chance a deferred pin has to come due: verify-fast.sh settles
@@ -118,6 +265,14 @@ else
   if _drive_debt "pins deferred at cycle C3" 0 "Tests 10780 passed"; then
     echo "ok: a green full suite settles the debt and the deploy continues"
   else echo "FAIL: a green full suite did not settle the debt"; fails=$((fails+1)); fi
+  # …and a suite the MEMO PROBE reused pays the debt exactly as a cache HIT does.
+  # The probe skips a gate whose lanes are all green stamps, so the pins ran when
+  # those stamps were minted — but the debt block reads TESTS_REPORT, so the new
+  # wording has to keep settling it or a memo hit would refuse every deploy.
+  if _drive_debt "pins deferred at cycle C3" 0 \
+       "full suite REUSED — identical inputs already passed (memo probe, no slot taken: already PASSED 2026-09-13T00:00:00Z)"; then
+    echo "ok: a memo-probe REUSED suite settles the debt"
+  else echo "FAIL: a memo-probe REUSED suite did not settle the debt"; fails=$((fails+1)); fi
   # and an EMPTY ledger must never block anything
   if _drive_debt "" 1 "skipped"; then echo "ok: no debt, no refusal"
   else echo "FAIL: an empty ledger blocked the deploy"; fails=$((fails+1)); fi

package/scripts/deploy-schema-check.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# deploy-schema-check.sh — PARSE schema/deploy.tql with TypeDB. Not a grep.
+#
+# classification: needs-env
+#
+# WHY THIS EXISTS. The first version of this feature's acceptance check was
+# `grep -q 'fun deploy_unrun' schema/deploy.tql`, and it passed on a file TypeDB
+# REJECTED outright (TQL03: `return not { $t };` is not valid TypeQL). A grep
+# proves a string is present; only the parser proves the schema is a schema.
+#
+# THREE EXIT CODES, because red and cannot-run send a human to opposite places:
+#   0  the file loads into a scratch db carrying the live `one` schema
+#   1  RED — TypeDB rejected it; the error is printed
+#   3  CANNOT RUN — no local TypeDB (creds absent / cluster unreachable).
+#      NOT a red: nothing was learned, and a board that paints this as failure
+#      sends someone to rewrite a correct schema.
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT" || exit 3
+ENVF="${ONE_ENV_FILE:-${DO_ENV_FILE:-.claude/typedb/dev.env}}"
+[ -f "$ENVF" ] || { echo "CANNOT RUN: no $ENVF"; exit 3; }
+set -a; . "$ENVF"; set +a
+: "${TYPEDB_URL:?}" 2>/dev/null || { echo "CANNOT RUN: TYPEDB_URL unset"; exit 3; }
+curl -sf -o /dev/null --max-time 5 "$TYPEDB_URL/v1/health" 2>/dev/null \
+  || { echo "CANNOT RUN: TypeDB unreachable at $TYPEDB_URL"; exit 3; }
+
+DB="${DEPLOY_SCHEMA_CHECK_DB:-deployschemacheck}"
+bash "$ROOT/.claude/scripts/typedb-scratch.sh" "$DB" >/dev/null 2>&1 \
+  || { echo "CANNOT RUN: could not build scratch db '$DB'"; exit 3; }
+
+python3 - "$TYPEDB_URL" "$TYPEDB_USERNAME" "$TYPEDB_PASSWORD" "$DB" <<'PY'
+import sys, json, urllib.request, urllib.error
+url, user, pw, db = sys.argv[1:5]
+def post(path, body, tok=None):
+    h = {"Content-Type": "application/json"}
+    if tok: h["Authorization"] = "Bearer " + tok
+    return urllib.request.urlopen(
+        urllib.request.Request(url + path, data=json.dumps(body).encode(), headers=h),
+        timeout=90).read().decode()
+try:
+    tok = json.loads(post("/v1/signin", {"username": user, "password": pw}))["token"]
+except Exception as e:
+    print("CANNOT RUN: signin failed —", e); sys.exit(3)
+q = open("schema/deploy.tql").read()
+try:
+    post("/v1/query", {"query": q, "transactionType": "schema", "databaseName": db}, tok)
+    n = q.count("\nfun ")
+    print(f"ok — TypeDB parsed and defined schema/deploy.tql ({n} functions)")
+    sys.exit(0)
+except urllib.error.HTTPError as e:
+    try:  msg = json.loads(e.read().decode()).get("message", "")
+    except Exception: msg = "<unreadable>"
+    print("RED — TypeDB REJECTED schema/deploy.tql:")
+    print(msg[:900])
+    sys.exit(1)
+except Exception as e:
+    print("CANNOT RUN:", e); sys.exit(3)
+PY