@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/operator-digest/SKILL.md

@@ -0,0 +1,287 @@
+---
+name: operator-digest
+description: "This skill should be used when generating the operator's weekly private comprehension digest: reading merged PRs, expenses, resolved incidents, and open action-required issues, then writing a plain-language digest.md without posting."
+---
+
+<!-- soleur-cloud-mode:start -->
+**Cloud Mode (Devin):** before pipeline work run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/cloud-detect.sh"`. If `CLAUDE_PLUGIN_ROOT` is unset (cloud exec shells do not export it), resolve the root by IDENTITY, never by script basename: for `d` in `"$HOME/.local/share/devin/cli/plugins/cache"` and `/opt/.devin/plugins`, skip unless `[ -d "$d" ]`, then `MANIFEST="$(find "$d" -path '*/.claude-plugin/plugin.json' -exec grep -l '"name"[[:space:]]*:[[:space:]]*"soleur"' {} + 2>/dev/null | head -1)"`, `ROOT="${MANIFEST%/.claude-plugin/plugin.json}"` — one resolution, two consumers: `$ROOT/scripts/cloud-detect.sh` and `$ROOT/scripts/precommit-guard.sh`. (Shape check, not authentication: a planted `{"name":"soleur"}` dir passes — ADR-179 A11.) `local` or `not-local:no-devin-env` proceeds normally; any other `not-local:<reason>` applies `<plugin-root>/devin/INSTRUCTIONS.md` §Cloud Mode: emit the `--banner`, fan out sequentially with `Reviewed-Coverage: sequential-fallback` disclosure (never claim an independent review ran), `message_user` ack before any secrets read or production mutation, and run `precommit-guard.sh` before any `git commit` — hooks do not fire in cloud.
+<!-- soleur-cloud-mode:end -->
+
+<!-- grok-harness-invoke:start -->
+**Grok Build (`plugins/soleur/lib/harness.ts` `invokeSkill()`):** Read this SKILL.md in this process and run it to completion. A one-segment `soleur:<name>` in this document names a SKILL — on Grok Build, Read `plugins/soleur/skills/<name>/SKILL.md` in this process; it is not a nested tool_use. A multi-segment id such as `soleur:<domain>:<name>` names an AGENT: spawn it, never Read it, and on Grok Build spawn_subagent takes the id with its colons replaced by hyphens (`agentIdToGrokSubagentType`). **Claude Code:** Skill tool for a skill (`soleur:<name>`), Task tool with `subagent_type` for an agent. Forbidden is executing a subset, not the Read.
+<!-- grok-harness-invoke:end -->
+
+# Operator Weekly Comprehension Digest
+
+Write a calm, plain-language weekly digest that tells the non-technical operator **what their
+company actually did this week** — what got built, what it cost, what broke (and whether it is
+fixed), and what now needs their attention. Autonomous loops ship features, move money, and resolve
+incidents faster than a solo owner can track; this digest is the antidote to that comprehension debt.
+
+This skill runs **headless inside `claude-code-action`** in the private `jikig-ai/operator-digest`
+repo, with the **public** `jikig-ai/soleur` repo checked out at `$GITHUB_WORKSPACE`. It reads five
+sources, synthesizes five sections of prose, and writes `$GITHUB_WORKSPACE/digest.md`. It then
+**STOPS**. A deterministic workflow post-step scrubs that file (fail-closed) and is the only thing
+that posts the issue — this skill itself must never post the digest (it writes the file and STOPS).
+
+## Register (how to write)
+
+Write as a trusted chief of staff briefing a busy owner — calm, candid, concrete. **Every line states
+a business consequence or an action the owner can take, or it is cut.** No vanity metrics, no PR
+numbers, no file paths, no jargon, no hype. Prefer "We made checkout faster" over "Merged #1234
+refactoring the Stripe webhook handler." Money in plain figures. Incidents in plain "what broke / is
+it fixed" terms.
+
+**In-the-moment sibling.** `soleur:operator-rephrase` applies this same register to a **single
+message, synchronously**, when something just said did not land. It is not bound by the
+business-consequence rule above — that rule is a digest rule. Use the digest weekly; use
+`soleur:operator-rephrase` in the turn.
+
+**Vocabulary (stop-list).** `knowledge-base/project/glossary.md` lists the internal words that must NOT reach the founder; each entry — or each sense of a multi-sense one — opens with the plain clause to translate into, and its path is for the agent only. The instruction is stated once in [glossary-format.md](../kb-glossary/references/glossary-format.md) §The consumer pointer.
+
+## Date window
+
+The digest covers the **last 7 days**. Anchor to the checkout root and compute the window once at the start:
+
+```bash
+cd "$GITHUB_WORKSPACE"   # the filesystem sources below (§2 git log, §3 ls) are relative to the soleur checkout
+SINCE="$(date -u -d '7 days ago' +%Y-%m-%d)"
+```
+
+Use `$SINCE` for every source below.
+
+## Read-failure handling (never render a failure as a quiet week)
+
+Each source command can FAIL — a cross-repo auth denial, a missing checkout, a transient error —
+returning a non-zero exit and/or empty output. **A failed read is NOT a quiet week.** This is the
+most important comprehension guardrail: the operator must never read "Nothing shipped" and believe a
+busy week was quiet because a `gh` call silently 403'd.
+
+For each section: if its source command exits **non-zero**, do NOT emit the section's "Nothing …"
+fallback. Instead emit a clearly-labelled warning line for that section:
+
+> ⚠️ Could not read \<source\> this week — a read FAILED (this is NOT a quiet week). See the run log.
+
+Only emit the "Nothing …" fallback when the command **succeeded** and genuinely returned no rows.
+
+## Scope guardrails (load-bearing — do not weaken)
+
+- **L1 — path scope.** Read ONLY the five named sources below. Any other file path is out of scope.
+  Do not wander the repository.
+- **L2 — summaries only (the named-PII + customer-email control).** A regex cannot catch "Jane Doe".
+  - Incidents: build the section from each post-mortem's **frontmatter, title, and status ONLY —
+    never the post-mortem body.** The body contains customer names, raw logs, and trace detail that
+    must never reach the digest. If a **title or frontmatter** itself names a person, customer, or
+    company, summarize it generically ("an incident affecting a customer") rather than echoing the
+    name — title/frontmatter is author-controlled, so the named-PII control applies to it too.
+  - Money: emit **amounts and vendor names only.** Never echo the ledger's Notes column (it carries
+    contact emails, IPs, and account detail).
+  - Never copy a raw record, email address, IP, token, or log line into the digest. Summarize.
+- **L3 — velocity metrics are aggregate-only (the shipping-cadence and cost-trend metrics below).**
+  Report **company-aggregate** figures only — one merge-pace band, one rounded run-rate figure. One
+  operator plus autonomous agents means a per-contributor or per-author breakdown is meaningless noise,
+  so **never add an `author` field to the §1 `gh pr list --json` list.** Both metrics suppress to a
+  neutral hedge on any read doubt, and both are stated as a business consequence — never a raw count, a
+  percentage, or an up/down arrow as the signal.
+
+## The five sections
+
+### 1. What your company built
+
+Source: merged pull requests in the window.
+
+```bash
+# Use the List API (NOT --search): --search routes to GitHub's Search API, which returns
+# EMPTY for a cross-repo query under the in-action App-installation token (#3403 class) — it
+# would silently render "Nothing shipped" every week. The List API works cross-repo (same path
+# as the action-required read below). Filter by mergedAt >= $SINCE in your synthesis.
+gh pr list -R jikig-ai/soleur --state merged --limit 300 \
+  --json title,labels,mergedAt,number,url
+```
+
+(`number,url` are used ONLY by §5's substantiation links — never surface a PR
+number in §1's prose; still no `author` field per L3.)
+
+Keep only PRs whose `mergedAt` is on or after `$SINCE`. Rewrite each meaningful change into its
+**business consequence** in plain language. Group related work. Drop pure chores/dependency bumps
+unless they matter to the owner. No PR numbers, no paths.
+
+**Shipping cadence (aggregate, comparison-framed).** Alongside the summary, judge how much your
+company shipped **this week** against **recent weeks (roughly the last month)** using the same
+`mergedAt` data — count only the *meaningful* merges (the same set you kept above; still drop pure
+chore/dependency bumps), a merge count and never a code-size measure. Fold one qualitative band into
+the prose — *clearly quieter than usual* / *about as much as a normal week* / *clearly busier than
+usual* — stated as a consequence ("Your company shipped about as much as a normal week."). **When in
+doubt, say "about the same."** Judge the band; never pin an exact ratio, a percentage, or an up/down
+arrow, and never use the words "velocity", "throughput", or "cadence" in the output.
+
+Degrade gracefully, and never alarm off a bad read:
+
+- With fewer than a few weeks of history, default to "about the same" (or a plain "still getting
+  started" line) — never a confident band.
+- If the §1 read FAILED (the ⚠️ warning above fired), OR the PR list hit the `--limit 300` cap across
+  the comparison window (a truncated read undercounts the prior weeks), OR this week reads suspiciously
+  empty, do **not** emit a definite band, and **never** emit the downward "quieter" band off a doubtful
+  read — render "about the same" or a one-line hedge instead. A silent undercount must never surface as
+  a confident "quieter than usual".
+
+### 2. Money & vendors
+
+Source: changes to the expense ledger in the window.
+
+```bash
+git log --since="$SINCE" -p -- knowledge-base/operations/expenses.md
+```
+
+Report **new costs, cost changes, and vendor changes** as amounts + vendor names only. "Sentry went
+from $29 to ~$40/mo." "No new vendors this week." Never reproduce the Notes column.
+
+**Cost trend (this week's direction + a coarse run-rate).** After the raw changes above, add framing:
+
+- **Direction (the primary, always-honest signal)** from the `git log -p` diff window: the real added
+  or changed *active* costs this week ("up ~$Y a month — added Resend Pro") or "no cost changes — spend
+  is holding steady." A row merely **recorded** in the diff at a non-active status (`deferred`,
+  `approved-not-billing`) is **not** a cost increase — do not report it as "cost up."
+- **Coarse run-rate anchor (only when the ledger reads cleanly).** `Read` the current
+  `knowledge-base/operations/expenses.md` and sum the **Recurring** table's Amount,
+  counting **only** rows whose `status` is `active` (and `accruing` only when it carries a real
+  actual). This is a **fail-safe allowlist, not a denylist** — the rule is the catch-all, not a list
+  to maintain: any status that is not `active`/`accruing`-with-actual (`deferred` and
+  `approved-not-billing` are the common ones, but a future/unknown status counts too) is invisible to
+  the run-rate; an unrecognized status is excluded, never summed. Normalize known non-monthly rows (a
+  2-year `.ai` registration, annual-billed rows) to a monthly figure. **Suppress the anchor entirely**
+  if any counted row's billing cadence is ambiguous — a mis-read annual row is a 12–24× error, the
+  exact false alarm this digest exists to prevent. When clean, hard-round to one coarse aggregate
+  figure: "recurring spend is roughly $X a month, mostly hosting and tooling." Emit **one aggregate
+  figure only** — never a per-row Notes value; read the **Recurring** table only (the One-Time table's
+  registration and credit rows must never enter the run-rate).
+- If the `Read` of `expenses.md` **errors** (distinct from an empty ledger), suppress the anchor behind
+  the ⚠️ warning line — a failed read is NOT "spend holding steady."
+- **First run:** an empty ledger read → "first reading — no cost trend yet," mirroring the
+  first-digest continuity pattern.
+
+### 3. What broke & whether it's fixed
+
+Source: post-mortems (incident reports) dated in the window.
+
+```bash
+ls knowledge-base/engineering/operations/post-mortems/*.md
+```
+
+For each post-mortem whose **filename date** falls in the window, read **only its frontmatter +
+title** (`title`, `date`, `status`). Emit one plain line per incident: what broke, and whether
+`status` says it is `resolved`/`closed` or still open. **Never read or quote the post-mortem body.**
+
+### 4. Action needed from you
+
+Source: open issues labelled `action-required` — but **triaged and de-polluted**, not a flat dump.
+A flat list makes a 131-day chore look identical to a P0, and buries the genuine asks under
+informational noise (#6836). Fetch age + labels so both become signals:
+
+```bash
+gh issue list -R jikig-ai/soleur --label action-required --state open \
+  --json number,title,url,createdAt,labels --limit 100
+```
+
+**Build the action list (de-pollute).** From the result, **EXCLUDE** any issue whose `labels`
+include `decision-challenge`, `content-publisher`, or (`meta/machinery` **without** `action-required`) — the first two are
+informational or structurally-dead per-piece chores that drown the genuine asks, and
+`meta/machinery` is a finding about Soleur's own verification machinery rather than about
+anything you receive. Excluding it is what makes the genuine product asks visible at all:
+a 1,000-issue sample carried 626 `domain/engineering` against 39 `domain/product`.
+**The `action-required` carve-out is load-bearing and matches the sweeper's precedence.**
+`cron-stale-deferred-scope-outs.ts` treats `action-required` as never-auto-close, so an issue
+carrying BOTH labels is preserved forever; excluding it here unconditionally would make it
+preserved *and* invisible on your only comprehension surface — a permanent silent open issue.
+The two consumers of one label must order it the same way. **Do NOT exclude the bare `content` label** — a human
+(or another workflow) can attach `content` to a genuine ops emergency (e.g. a content-*pipeline*
+outage), and excluding it would hide that emergency from your only comprehension surface while the
+SLA cron correctly keeps it open and escalates it (it classifies bare `content` as an ops ask, never
+a dead chore). **KEEP** `content-starvation` (a real standing "distribution pipeline empty" signal).
+The survivors are the true "only you can do this" asks (expiring tokens, saturating disks, TLS/cert
+state, infra capacity, stale CLA).
+
+**Sort and surface age.** Sort survivors by priority (`priority/p0-critical` > `priority/p1-high` >
+`priority/p2-medium` > `priority/p3-low` > none), then oldest-first. Compute each issue's **age in
+days** from `createdAt`. Lead with a bold "🔴 Open longest / needs your attention" line naming the
+1–3 oldest survivors with their age (e.g. "#4375 — 58 days"). Then recap each remaining survivor as
+a plain "what needs you to act" line with its age and link. **Cap the action list at 8**; if more
+remain, end with "+N more open — see the `action-required` label." Read-only recap — do **not**
+mutate, close, or comment on any issue.
+
+**Decisions flagged for your awareness (separate block, not the action list).** SEPARATELY, list
+open issues labelled `decision-challenge` under a distinct sub-heading **"Decisions flagged for
+your awareness (informational, not blocking)"** — capped at 5 with "+N more" — so they stay visible
+without diluting the action list above.
+
+**Automatic recoveries (same separate block).** Also list open issues labelled
+`infra-config-recovery-notice` there. These record a production write the system made on its own
+and then verified — no action is needed, which is exactly why they must NOT carry
+`action-required`: labelling a self-heal as an ask spends the P1 channel's credibility on a
+success. But an unattended write to the server's sole remote-repair channel is worth the founder
+knowing about, and without this line the digest — their only comprehension surface — never
+mentions it at all. One line each, naming how many times it has recurred.
+
+### 5. What got smarter this week
+
+Source: the self-improvements Soleur's compounding loop **completed** in the window — the promotion
+PRs it merged into how your agents work. **Reuse §1's already-fetched merged-PR list — do NOT run
+another `gh` call, and NEVER `--search`** (the Search API returns empty cross-repo under the
+in-action App token, exactly as noted in §1; a `--search` here would silently render "nothing got
+smarter" every week). From §1's list, keep only PRs whose `labels` contains `self-healing/auto`
+**and** whose `mergedAt` is on or after `$SINCE`. Production shape: title
+`self-healing(auto): promote cluster <hash> <date>`, label `self-healing/auto`.
+
+Render as a **platform-level outcome, framed for the operator** — the improvement is to the shared
+Soleur harness (the rules and skills every workspace runs on), not to any one workspace's data:
+"Soleur got sharper this week — N improvements shipped to the shared brain your agents run on."
+Add a compact `Details:` line linking each kept PR (its `url`) as substantiation. Do **not** invent
+a per-item description from the cluster-hash title — it carries no human summary, and reading a PR
+body to synthesize one would violate L2 (summaries only). The count plus the links is the honest
+claim; the link is the drill-in path.
+
+**Never write "your workspace got smarter"** — that phrasing implies a per-tenant benefit the loop
+does not produce (improvements are global harness edits). Because §5 reuses §1's read, a §1 read
+FAILURE (the ⚠️ warning) suppresses §5 too — do not render a "nothing" line off a failed read.
+
+## Deterministic fallback (never blank)
+
+A quiet week is itself information. **Even an all-empty week still posts.** If a source yields nothing
+in the window, write the section's labelled fallback line — **never leave a section blank**:
+
+- Section 1 → "Nothing shipped this week."
+- Section 2 → "No money or vendor changes this week."
+- Section 3 → "Nothing broke this week."
+- Section 4 → "Nothing needs your attention this week."
+- Section 5 → "Nothing was promoted to the shared harness this week."
+
+Every section must contain at least one full sentence. A blank or byte-for-byte command-dump section
+is a failure.
+
+## Prior-week continuity
+
+Find the most recent prior digest issue and reference it so a skipped week is visible:
+
+```bash
+# List API, NOT --search (same Search-API-empty-under-App-token reason as section 1): list this
+# repo's recent issues and pick the most recent whose title starts with "Digest:". A false-empty
+# from --search would break the liveness loop — every week would falsely read "first digest".
+gh issue list -R jikig-ai/operator-digest --state all \
+  --json number,title --limit 20
+```
+
+From that list, take the highest-numbered issue whose title begins with `Digest:` (ignore the
+withheld-notice issues) and add a final line to the digest: **"Last week: #N"**. If no prior digest
+issue exists, write "Last week: (this is the first digest)." A missing prior-week back-reference is
+the operator-visible signal that a week was skipped.
+
+## Output
+
+Write the assembled digest to `$GITHUB_WORKSPACE/digest.md`:
+
+- A short title line: `# Weekly digest: <ISO week or date range>`.
+- The five `##` sections above, in order, each with prose (or its fallback line).
+- The final `Last week: #N` continuity line.
+
+Then **STOP**. Do not open, post, or create any issue — the gated workflow post-step owns publishing.
+Writing `digest.md` and stopping is the entire job of this skill.

package/skills/operator-digest/assets/operator-digest.workflow.yml

@@ -0,0 +1,175 @@
+# Operator weekly comprehension digest — workflow asset (#5085).
+#
+# THIS FILE IS INERT IN soleur. It is committed here (in the PUBLIC repo) so the
+# brand-critical workflow gets multi-agent review, but it MUST NOT be placed under
+# soleur's own .github/workflows/ — that would run it in PUBLIC Actions logs and leak
+# the operator's private data. The provisioning script installs it into the PRIVATE
+# jikig-ai/operator-digest repo, where both the logs and the digest issues stay private.
+#
+# Containment boundary (do not weaken — see plan §User-Brand Impact L1-L4):
+#   - The agent reads public soleur, synthesizes prose, writes $GITHUB_WORKSPACE/digest.md, STOPS.
+#   - The agent's allowlist has NO `gh issue create` — a prompt-injection in any read source
+#     cannot make the model post. Only the deterministic post-step posts.
+#   - The scrub gate (digest-scrub.sh) runs as a GHA run: step OUTSIDE the action — an in-prompt
+#     `exit 1` is swallowed (conclusion still reads success), so the gate must live here.
+#   - On a scrub abort the post-step posts a CONTENT-FREE withheld notice (a withhold is visible,
+#     not a silent absence), then removes the plaintext digest.
+
+name: "Operator weekly digest"
+
+on:
+  schedule:
+    # Fridays 13:00 UTC. GitHub Actions cron has ~15-minute variance.
+    - cron: '0 13 * * 5'
+  workflow_dispatch: {}
+
+concurrency:
+  group: operator-digest
+  cancel-in-progress: false
+
+# Least-privilege: the data source (public soleur) needs no grant; we only write issues
+# to this private repo. id-token: write is required by claude-code-action's OIDC handshake.
+permissions:
+  contents: read
+  issues: write
+  id-token: write
+
+jobs:
+  digest:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout public soleur (data source)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          repository: jikig-ai/soleur
+          fetch-depth: 0
+          # The data source is PUBLIC — no token needed. Do not persist the workflow's
+          # own credentials into the checkout (it is not soleur's repo).
+          persist-credentials: false
+
+      # show_full_output is deliberately OFF (absent). The flag leaks ALL tool execution
+      # results — which here include private financial/incident data — into the run logs.
+      - name: Synthesize digest
+        uses: anthropics/claude-code-action@ab8b1e6471c519c585ba17e8ecaccc9d83043541 # v1.0.101
+        env:
+          # Align both token contexts so the in-action cross-repo `gh` read does not
+          # silently 403/return-empty under the App-installation token (#3403).
+          GH_TOKEN: ${{ github.token }}
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          plugin_marketplaces: 'https://github.com/jikig-ai/soleur-marketplace.git'
+          plugins: 'soleur@soleur-marketplace'
+          # The allowlist deliberately OMITS `gh issue create`: the agent CANNOT post.
+          # It may read PRs/issues and git log, and write files (digest.md) only.
+          claude_args: >-
+            --max-turns 30
+            --allowedTools Write,Read,Glob,Grep,Bash(date:*),Bash(ls:*),Bash(gh pr list:*),Bash(gh issue list:*),Bash(git log:*)
+          prompt: |
+            Run /soleur:operator-digest on the checked-out jikig-ai/soleur repository.
+            Read the five sources, synthesize the five plain-language sections, and write the
+            digest to $GITHUB_WORKSPACE/digest.md. STOP after writing the file — do not post,
+            open, or create any issue. The workflow's post-step owns publishing.
+
+      - name: Scrub gate (fail-closed) then post
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_RUN_ID: ${{ github.run_id }}
+          OPERATOR_GH_LOGIN: ${{ vars.OPERATOR_GH_LOGIN }}
+        run: |
+          set -uo pipefail
+          DIGEST="$GITHUB_WORKSPACE/digest.md"
+          SCRUB="$GITHUB_WORKSPACE/plugins/soleur/skills/operator-digest/scripts/digest-scrub.sh"
+          ISO_WEEK="$(date -u +%G-W%V)"
+
+          if [[ ! -f "$DIGEST" ]]; then
+            echo "the digest file was not produced by the synthesis step — failing the run" >&2
+            exit 1
+          fi
+
+          # Delivery, not production, was the failure mode. This workflow ran
+          # correctly for months (active cron, 7/8 successful runs, correct
+          # query, the action-required backlog surfaced >=5 consecutive weeks)
+          # and nobody saw it: the digest posts to a PRIVATE repo with ZERO
+          # subscribers, so an issue create notifies no one. That is why 130
+          # days of action-required accumulation never surfaced through the
+          # very section built to surface it.
+          #
+          # --assignee is the fix: assignment notifies unconditionally and does
+          # not depend on watch state. The repo-subscription API is NOT used —
+          # this token lacks the `notifications` scope (measured, not assumed).
+          #
+          # Fail LOUD if the variable is unset. A digest that silently posts to
+          # nobody is the exact defect being repaired; degrading quietly back
+          # into it would make this change a no-op that looks like a fix.
+          if [[ -z "${OPERATOR_GH_LOGIN:-}" ]]; then
+            echo "OPERATOR_GH_LOGIN repo variable is unset — the digest would post to nobody." >&2
+            echo "Set it with: gh variable set OPERATOR_GH_LOGIN -R jikig-ai/operator-digest --body '<login>'" >&2
+            exit 1
+          fi
+
+          # The scrub is a deterministic post-step OUTSIDE the action. A non-zero exit means a
+          # secret / foreign email / grep error was found: post a CONTENT-FREE withheld notice
+          # (zero source-derived content) so the withhold is operator-visible, not silent.
+          if bash "$SCRUB" "$DIGEST"; then
+            gh issue create -R jikig-ai/operator-digest \
+              --assignee "${OPERATOR_GH_LOGIN}" \
+              --title "Digest: ${ISO_WEEK}" \
+              --body-file "$DIGEST"
+          else
+            gh issue create -R jikig-ai/operator-digest \
+              --assignee "${OPERATOR_GH_LOGIN}" \
+              --title "Digest withheld: ${ISO_WEEK}" \
+              --body "This week's digest was withheld by the safety scrub; a value matched a safety pattern (a secret, a foreign email, or a scan error). No data is shown. See run ${GH_RUN_ID}."
+          fi
+
+          # No durable plaintext copy: remove the file regardless of which branch posted.
+          rm -f "$DIGEST"
+
+      # A SUCCESSFUL run auto-resolves any standing "digest FAILED" self-report (below),
+      # mirroring the content-starvation auto-file/auto-close pattern.
+      - name: Resolve prior failure self-report on success
+        if: success()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -uo pipefail
+          FAIL_TITLE="⚠️ Weekly digest run FAILED — you did not get a digest this week"
+          EXISTING="$(gh issue list -R jikig-ai/operator-digest --state open \
+            --json number,title --limit 30 \
+            --jq "[.[] | select(.title == \"${FAIL_TITLE}\")][0].number // empty")"
+          if [[ -n "$EXISTING" ]]; then
+            gh issue close "$EXISTING" -R jikig-ai/operator-digest \
+              --comment "The weekly digest ran successfully again — auto-resolving this failure notice."
+          fi
+
+      # A FAILED run is itself a SILENT ABSENCE: the operator simply gets no digest that week
+      # and never learns the pipeline broke (the 2026-06-26 and 2026-07-20 runs failed with
+      # nobody notified). Self-report — loud, assigned — so a broken digest is visible, exactly
+      # like the delivery fix above. Idempotent: one standing open issue, commented on re-fail.
+      - name: Self-report on digest failure
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          OPERATOR_GH_LOGIN: ${{ vars.OPERATOR_GH_LOGIN }}
+        run: |
+          set -uo pipefail
+          FAIL_TITLE="⚠️ Weekly digest run FAILED — you did not get a digest this week"
+          EXISTING="$(gh issue list -R jikig-ai/operator-digest --state open \
+            --json number,title --limit 30 \
+            --jq "[.[] | select(.title == \"${FAIL_TITLE}\")][0].number // empty")"
+          if [[ -n "$EXISTING" ]]; then
+            gh issue comment "$EXISTING" -R jikig-ai/operator-digest \
+              --body "The weekly digest run FAILED again — still no digest this week. Run: ${GH_RUN_URL}"
+          else
+            # Tolerate an unset OPERATOR_GH_LOGIN here: filing UNASSIGNED still beats a silent
+            # absence (the whole point of this step). Assign when the variable is present.
+            ASSIGN=()
+            [[ -n "${OPERATOR_GH_LOGIN:-}" ]] && ASSIGN=(--assignee "${OPERATOR_GH_LOGIN}")
+            gh issue create -R jikig-ai/operator-digest \
+              "${ASSIGN[@]}" \
+              --title "$FAIL_TITLE" \
+              --body "The Operator weekly digest workflow FAILED — no digest was produced or posted this week. This is a self-report so the failure is not a silent absence. See run ${GH_RUN_URL}. Auto-resolves on the next successful run."
+          fi

package/skills/operator-digest/scripts/digest-scrub.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# Tuned fail-closed scrub gate for the operator weekly digest (#5085, plan §L3).
+#
+# Runs as a deterministic GitHub Actions post-step on the rendered digest.md,
+# BEFORE the issue is posted. It is DISTINCT from incident/redact-sentinel.sh:
+# that gate is tuned for human-reviewed PIRs and aborts on email/UUID/IPv4 — which
+# would silently kill a business digest on benign first-party content (ops@jikigai.com
+# is in the ledger) while still missing named PII. This gate is tuned for the
+# digest's content profile: abort on true secrets, abort on a FOREIGN email
+# (the customer-email leak class), but only WARN on UUID/IPv4 (legitimate in prose).
+# Named PII ("Jane Doe") cannot be caught by a regex — that control is upstream
+# (the skill emits incident SUMMARIES from PIR frontmatter/title only, never bodies).
+#
+# Exit codes:
+#   0 = clean — no abort-class match (UUID/IPv4/first-party-email warns are allowed)
+#   1 = abort — a secret, a foreign email, OR a grep error (real fail-closed)
+#   2 = invalid arguments — missing or unreadable file
+#
+# Output is meta-redacted (never the full token), mirroring redact-sentinel.sh.
+set -uo pipefail
+
+if [[ $# -ne 1 ]]; then
+  echo "usage: digest-scrub.sh <path-to-digest.md>" >&2
+  exit 2
+fi
+FILE="$1"
+if [[ ! -r "${FILE}" ]]; then
+  echo "digest-scrub: file not readable: ${FILE}" >&2
+  exit 2
+fi
+
+# First-party email domains: a digest summarizing the operator's own ledger legitimately
+# names the operator's own contact address. A foreign domain in the digest is the
+# customer-email leak class and MUST abort.
+FIRST_PARTY_DOMAINS=(jikigai.com soleur.ai)
+
+# Secret classes — any match ABORTS. Class-name set + bodies synced with redact-engine.py
+# 2026-07-06 (#6045); NAME-level parity is CI-enforced by plugins/soleur/test/redact-class-parity.test.sh.
+# Regex-BODY parity is a named non-goal (ERE here vs Python `re` in the engine — not cheaply
+# comparable); bodies below are a superset of the engine's shared classes as of the sync date and
+# pattern edits get manual cross-review. The engine's email/UUID/IPv4 classes are handled OUTSIDE
+# this map (email via first-party domain logic below; UUID/IPv4 as WARN-only), so the parity guard
+# allowlists them.
+declare -A SECRET=(
+  [JWT]='eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'
+  [stripe_key]='\b(sk|pk|rk)_(live|test)_[A-Za-z0-9]{16,}\b'
+  [stripe_whsec]='\bwhsec_[A-Za-z0-9]{16,}\b'
+  [stripe_acct]='\bacct_[A-Za-z0-9]{16,}\b'
+  [stripe_cust_pi_seti_sub_in]='\b(cus|pi|seti|sub|in)_[A-Za-z0-9]{14,}\b'
+  [env_var]='\b(DOPPLER|SENTRY|STRIPE|SUPABASE|OPENAI|ANTHROPIC|GITHUB|VERCEL|CLOUDFLARE|HETZNER|FLAGSMITH|RESEND|TAILSCALE)_[A-Z_]+=[^[:space:]]+'
+  [github_token]='\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9._~+/=-]{30,}|\bgithub_pat_[A-Za-z0-9._~+/=-]{20,}'
+  [anthropic_key]='\bsk-ant-[A-Za-z0-9_-]{32,}\b'
+  [openai_key]='\bsk-(proj-)?[A-Za-z0-9_-]{20,}\b'
+  [supabase_pat]='\bsbp_[a-z0-9]{20,}\b|\b(sb_secret|sb_publishable)_[A-Za-z0-9]{20,}\b'
+  [pem_private_key]='-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----'
+  [doppler_token]='\bdp\.(st|pt|ct|sa|scim|audit)\.[A-Za-z0-9._-]{16,}'
+  [slack_token]='\bxox[baprsce]-[A-Za-z0-9-]{10,}'
+)
+SECRET_ORDER=(JWT stripe_key stripe_whsec stripe_acct stripe_cust_pi_seti_sub_in env_var github_token anthropic_key openai_key supabase_pat pem_private_key doppler_token slack_token)
+
+EMAIL_RE='\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b'
+UUID_RE='\b[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\b'
+IPV4_RE='\b(([0-9]{1,3})\.){3}[0-9]{1,3}\b'
+
+abort=0
+
+emit() { printf 'digest-scrub %s: %s\n' "$1" "$2" >&2; }
+
+# scan_secret <class> <pattern> — abort on any match; abort on grep error (fail-closed).
+scan_secret() {
+  local class="$1" pattern="$2" out
+  # INVARIANT: `local rc=$?` MUST be the statement immediately after the grep assignment.
+  # Anything between them (even another `local`) resets $? to that statement's exit (0) and
+  # silently defeats the grep-error fail-closed path. Do not insert code here.
+  out="$(grep -oE -e "$pattern" "$FILE")"
+  local rc=$?
+  if (( rc >= 2 )); then
+    emit ABORT "grep error (rc=$rc) scanning ${class} — fail-closed"
+    abort=1
+    return
+  fi
+  if (( rc == 0 )) && [[ -n "$out" ]]; then
+    emit ABORT "secret-class ${class} matched (post withheld)"
+    abort=1
+  fi
+}
+
+for class in "${SECRET_ORDER[@]}"; do
+  scan_secret "$class" "${SECRET[$class]}"
+done
+
+# Email: abort on a FOREIGN domain; warn (allow) on first-party.
+emails="$(grep -oE -e "$EMAIL_RE" "$FILE")"; erc=$?
+if (( erc >= 2 )); then
+  emit ABORT "grep error (rc=$erc) scanning email — fail-closed"; abort=1
+elif (( erc == 0 )); then
+  while IFS= read -r addr; do
+    [[ -z "$addr" ]] && continue
+    domain="${addr##*@}"; domain="${domain,,}"
+    first_party=0
+    for d in "${FIRST_PARTY_DOMAINS[@]}"; do [[ "$domain" == "$d" ]] && first_party=1 && break; done
+    if (( first_party )); then
+      emit WARN "first-party email (${domain}) — allowed"
+    else
+      emit ABORT "foreign email domain (${domain}) — possible customer PII"
+      abort=1
+    fi
+  done <<< "$emails"
+fi
+
+# UUID / IPv4: WARN only (legitimate in incident/build prose). grep error still aborts.
+for pair in "UUID:${UUID_RE}" "IPv4:${IPV4_RE}"; do
+  cls="${pair%%:*}"; pat="${pair#*:}"
+  out="$(grep -oE -e "$pat" "$FILE")"; rc=$?
+  if (( rc >= 2 )); then emit ABORT "grep error (rc=$rc) scanning ${cls} — fail-closed"; abort=1
+  elif (( rc == 0 )) && [[ -n "$out" ]]; then emit WARN "${cls} present in prose — allowed (not a secret)"; fi
+done
+
+exit "$abort"