@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/triage/SKILL.md

@@ -0,0 +1,402 @@
+---
+name: triage
+description: "This skill should be used when triaging legacy local todo files in todos/. For GitHub issues, use soleur:support:ticket-triage agent."
+---
+
+<!-- Inspired by mattpocock/skills/skills/engineering/triage/SKILL.md (MIT, Copyright (c) 2026 Matt Pocock). -->
+
+<!-- soleur-cloud-mode:start -->
+**Cloud Mode (Devin):** before pipeline work run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/cloud-detect.sh"`. If `CLAUDE_PLUGIN_ROOT` is unset (cloud exec shells do not export it), resolve the root by IDENTITY, never by script basename: for `d` in `"$HOME/.local/share/devin/cli/plugins/cache"` and `/opt/.devin/plugins`, skip unless `[ -d "$d" ]`, then `MANIFEST="$(find "$d" -path '*/.claude-plugin/plugin.json' -exec grep -l '"name"[[:space:]]*:[[:space:]]*"soleur"' {} + 2>/dev/null | head -1)"`, `ROOT="${MANIFEST%/.claude-plugin/plugin.json}"` — one resolution, two consumers: `$ROOT/scripts/cloud-detect.sh` and `$ROOT/scripts/precommit-guard.sh`. (Shape check, not authentication: a planted `{"name":"soleur"}` dir passes — ADR-179 A11.) `local` or `not-local:no-devin-env` proceeds normally; any other `not-local:<reason>` applies `<plugin-root>/devin/INSTRUCTIONS.md` §Cloud Mode: emit the `--banner`, fan out sequentially with `Reviewed-Coverage: sequential-fallback` disclosure (never claim an independent review ran), `message_user` ack before any secrets read or production mutation, and run `precommit-guard.sh` before any `git commit` — hooks do not fire in cloud.
+<!-- soleur-cloud-mode:end -->
+
+<!-- grok-harness-invoke:start -->
+**Grok Build (`plugins/soleur/lib/harness.ts` `invokeSkill()`):** Read this SKILL.md in this process and run it to completion. A one-segment `soleur:<name>` in this document names a SKILL — on Grok Build, Read `plugins/soleur/skills/<name>/SKILL.md` in this process; it is not a nested tool_use. A multi-segment id such as `soleur:<domain>:<name>` names an AGENT: spawn it, never Read it, and on Grok Build spawn_subagent takes the id with its colons replaced by hyphens (`agentIdToGrokSubagentType`). **Claude Code:** Skill tool for a skill (`soleur:<name>`), Task tool with `subagent_type` for an agent. Forbidden is executing a subset, not the Read.
+<!-- grok-harness-invoke:end -->
+
+- First set the /model to Haiku
+- Then read all pending todos in the todos/ directory
+
+Present all findings, decisions, or issues here one by one for triage. The goal is to go through each item and decide whether to add it to the CLI todo system.
+
+> **Note:** The `soleur:review` skill now creates GitHub issues directly for all new findings. This triage skill handles only legacy local `todos/*.md` files that predate the GitHub issue integration.
+
+**IMPORTANT: DO NOT CODE ANYTHING DURING TRIAGE!**
+
+This skill is for:
+
+- Triaging code review findings
+- Processing security audit results
+- Reviewing performance analysis
+- Handling any other categorized findings that need tracking
+
+## CodeQL alert-state precheck (security findings)
+
+Before commissioning work on any CodeQL-derived finding (issue title starts with
+`sec: CodeQL alert #N` or body cites `alert #N`), verify the alert is still open:
+
+```bash
+gh api "/repos/:owner/:repo/code-scanning/alerts/<N>" --jq '.state'
+```
+
+If the response is `dismissed` or `fixed`, the finding is an orphan — close it
+with a pointer to the dismissing PR (search via `gh pr list --search "alert #<N>" --state merged -L 200` — a *dismissing* PR has merged, and `gh pr list` otherwise defaults to open-only and would never find it, #6786)
+instead of approving for work. The `.github/workflows/codeql-to-issues.yml`
+`close-orphans` job sweeps these automatically once a day, but a triage-time
+check prevents wasted planning when the daily run is hours away. See
+`knowledge-base/project/learnings/best-practices/2026-04-19-codeql-orphan-issue-post-dismissal-sweep.md`.
+
+## Workflow
+
+### Step 1: Present Each Finding
+
+**Before presenting anything, run two read-only pre-checks on each finding.** A `todos/*.md` finding
+is an internally generated review note rather than a request from a user, which is exactly why it can
+legitimately restate something that is already built or something that has already been refused.
+Nothing about a finding is self-evidently new.
+
+1. **Already built?** Search the codebase for the behaviour the finding asks for **by domain concept
+   rather than by the finding's own wording**, and report where you looked. The procedure is
+   `plugins/soleur/skills/brainstorm/SKILL.md` `#### 1.1 Research (Context Gathering)` — cited,
+   never restated: a second copy of that sweep drifts from the first, and the drifted copy is the one
+   somebody follows. If the behaviour already exists this is a **redundancy finding** — name where
+   the implementation lives, and write nothing to the no-list.
+2. **Refused before?** Read the no-list at `knowledge-base/project/rejected/*.md`, matching on
+   concept and on each entry's `aliases` rather than on keywords, and skip any entry carrying
+   `superseded_by`. `README.md` is the convention document, not an entry.
+
+Both pre-checks **advise; neither acts.** A hit is escalated to the founder with the entry named, and
+an already-built finding outranks a no-list hit: if the capability exists, the entry is wrong and the
+entry is what gets corrected. An entry is also never the decision itself, only evidence that a refusal
+was RECORDED, so where it disagrees with a primary record — the issue's own closure, an ADR, a roadmap
+decision — the primary record wins and the entry is STALE. Order: running code, then the primary
+record, then the entry. An uncertain match **fails open** — name the candidate, say why it is
+uncertain, and leave the finding open. Report both results in the presentation block, including the
+search that found nothing: a negative carries only the scope that produced it.
+
+For each finding, present in this format:
+
+```
+---
+Issue #X: [Brief Title]
+
+Severity: P1 (CRITICAL) / P2 (IMPORTANT) / P3 (NICE-TO-HAVE)
+
+Category: [Security/Performance/Architecture/Bug/Feature/etc.]
+
+Description:
+[Detailed explanation of the issue or improvement]
+
+Location: [file_path:line_number]
+
+Problem Scenario:
+[Step by step what's wrong or could happen]
+
+Proposed Solution:
+[How to fix it]
+
+Estimated Effort: [Small (< 2 hours) / Medium (2-8 hours) / Large (> 8 hours)]
+
+Already built: [the search you ran -> found at <path> | not found]
+Prior refusal: [<entry path> (matched alias: "<alias>") | no match]
+
+---
+Do you want to add this to the todo list?
+1. yes - create todo file
+2. next - skip this item (the file stays)
+3. custom - modify before creating
+4. reject - record why, then remove the finding
+```
+
+### Step 2: Handle User Decision
+
+**When user says "yes":**
+
+1. **Update existing todo file** (if it exists) or **Create new filename:**
+
+   If todo already exists (from code review):
+
+   - Rename file from `{id}-pending-{priority}-{desc}.md` -> `{id}-ready-{priority}-{desc}.md`
+   - Update YAML frontmatter: `status: pending` -> `status: ready`
+   - Keep issue_id, priority, and description unchanged
+
+   If creating new todo:
+
+   ```
+   {next_id}-ready-{priority}-{brief-description}.md
+   ```
+
+   Priority mapping:
+
+   - P1 (CRITICAL) -> `p1`
+   - P2 (IMPORTANT) -> `p2`
+   - P3 (NICE-TO-HAVE) -> `p3`
+
+   Example: `042-ready-p1-transaction-boundaries.md`
+
+2. **Update YAML frontmatter:**
+
+   ```yaml
+   ---
+   status: ready # IMPORTANT: Change from "pending" to "ready"
+   priority: p1 # or p2, p3 based on severity
+   issue_id: "042"
+   tags: [category, relevant-tags]
+   dependencies: []
+   ---
+   ```
+
+3. **Populate or update the file:**
+
+   ```yaml
+   # [Issue Title]
+
+   ## Problem Statement
+   [Description from finding]
+
+   ## Findings
+   - [Key discoveries]
+   - Location: [file_path:line_number]
+   - [Scenario details]
+
+   ## Proposed Solutions
+
+   ### Option 1: [Primary solution]
+   - **Pros**: [Benefits]
+   - **Cons**: [Drawbacks if any]
+   - **Effort**: [Small/Medium/Large]
+   - **Risk**: [Low/Medium/High]
+
+   ## Recommended Action
+   [Filled during triage - specific action plan]
+
+   ## Technical Details
+   - **Affected Files**: [List files]
+   - **Related Components**: [Components affected]
+   - **Database Changes**: [Yes/No - describe if yes]
+
+   ## Resources
+   - Original finding: [Source of this issue]
+   - Related issues: [If any]
+
+   ## Acceptance Criteria
+   - [ ] [Specific success criteria]
+   - [ ] Tests pass
+   - [ ] Code reviewed
+
+   ## Work Log
+
+   ### {date} - Approved for Work
+   **By:** Claude Triage System
+   **Actions:**
+   - Issue approved during triage session
+   - Status changed from pending -> ready
+   - Ready to be picked up and worked on
+
+   **Learnings:**
+   - [Context and insights]
+
+   ## Notes
+   Source: Triage session on {date}
+   ```
+
+4. **Confirm approval:** "Approved: `{new_filename}` (Issue #{issue_id}) - Status: **ready** -> Ready to work on"
+
+**When user says "next":**
+
+- **Leave the todo file where it is.** Skipping is not a decision, and deleting on a skip destroys
+  the finding with no record of why — which is the opposite of what the no-list is for. `reject` is
+  the only branch that removes a finding.
+- Skip to the next item
+- Track skipped items for summary
+
+**When user says "custom":**
+
+- Ask what to modify (priority, description, details)
+- Update the information
+- Present revised version
+- Ask again: yes/next/custom/reject
+
+**When user says "reject":**
+
+This is the no-list's named write path, and **the only branch that removes a finding.**
+
+1. **Check the redundancy pre-check came back "not found."** If the behaviour is already built, stop:
+   that is a redundancy finding, and its record is the sentence naming where the implementation
+   lives. Writing a built capability into the no-list seeds every later duplicate check with a
+   refusal nobody made.
+2. **Test the reason for durability.** "Outside the product's boundary" is durable. "Nobody has time
+   this quarter" is a deferral, not a rejection — leave the finding in place and say so.
+3. **Draft the entry** at `knowledge-base/project/rejected/YYYY-MM-DD-<concept-slug>.md`, following
+   `knowledge-base/project/rejected/README.md`: every required field, the `why`/`public_note` split,
+   an `instead`, a `revisit_if` that can be observed rather than argued, and no field naming a
+   person. The write discipline is
+   `plugins/soleur/skills/kb-glossary/references/rejected-request-register.md`.
+4. **Machine gate, before the human gate:** run `bash scripts/lint-rejected-register.sh <path>` and
+   fix everything it names. There is no reason to ask the founder to confirm a malformed record.
+5. **Human gate:** ask for confirmation by having the founder **type the concept slug** — not `y`.
+   A single keystroke against a permanent refusal is a reflex; typing
+   `server-side-browser-automation` is a decision. Any other answer, including an empty one, aborts
+   and leaves both the finding and the directory untouched.
+6. **Write the entry, then delete the todo file,** in that order: if the write fails, the finding is
+   still there. Report both paths — the entry created and the finding removed.
+
+### Step 3: Continue Until All Processed
+
+- Process all items one by one
+- Track using TodoWrite for visibility
+- Don't wait for approval between items - keep moving
+
+### Step 4: Final Summary
+
+After all items processed:
+
+````markdown
+## Triage Complete
+
+**Total Items:** [X] **Todos Approved (ready):** [Y] **Skipped:** [Z] **Rejected (recorded):** [R]
+
+### Approved Todos (Ready for Work):
+
+- `042-ready-p1-transaction-boundaries.md` - Transaction boundary issue
+- `043-ready-p2-cache-optimization.md` - Cache performance improvement ...
+
+### Skipped Items (still in todos/):
+
+- Item #5: [reason] - left pending, returns in the next pass
+- Item #12: [reason] - left pending, returns in the next pass
+
+### Rejected (recorded on the no-list, finding removed):
+
+- Item #7: `knowledge-base/project/rejected/2026-04-02-<concept-slug>.md` - finding deleted after the entry was written
+
+### Summary of Changes Made:
+
+During triage, the following status updates occurred:
+
+- **Pending -> Ready:** Filenames and frontmatter updated to reflect approved status
+- **Skipped:** Todo files left in todos/ untouched — skipping removes nothing
+- **Rejected:** A no-list entry was written, and only then was the todo file removed
+- Each approved file now has `status: ready` in YAML frontmatter
+
+### Next Steps:
+
+1. View approved todos ready for work:
+   ```bash
+   ls todos/*-ready-*.md
+   ```
+````
+
+2. Start work on approved items:
+
+   ```bash
+   soleur:resolve-todo-parallel  # Work on multiple approved items efficiently
+   ```
+
+3. Or pick individual items to work on
+
+4. As you work, update todo status:
+   - Ready -> In Progress (in your local context as you work)
+   - In Progress -> Complete (rename file: ready -> complete, update frontmatter)
+
+```
+
+## Example Response Format
+
+```
+
+---
+
+Issue #5: Missing Transaction Boundaries for Multi-Step Operations
+
+Severity: P1 (CRITICAL)
+
+Category: Data Integrity / Security
+
+Description: The google_oauth2_connected callback in GoogleOauthCallbacks concern performs multiple database operations without transaction protection. If any step fails midway, the database is left in an inconsistent state.
+
+Location: app/controllers/concerns/google_oauth_callbacks.rb:13-50
+
+Problem Scenario:
+
+1. User.update succeeds (email changed)
+2. Account.save! fails (validation error)
+3. Result: User has changed email but no associated Account
+4. Next login attempt fails completely
+
+Operations Without Transaction:
+
+- User confirmation (line 13)
+- Waitlist removal (line 14)
+- User profile update (line 21-23)
+- Account creation (line 28-37)
+- Avatar attachment (line 39-45)
+- Journey creation (line 47)
+
+Proposed Solution: Wrap all operations in ApplicationRecord.transaction do ... end block
+
+Estimated Effort: Small (30 minutes)
+
+---
+
+Do you want to add this to the todo list?
+
+1. yes - create todo file
+2. next - skip this item (the file stays)
+3. custom - modify before creating
+4. reject - record why, then remove the finding
+
+```
+
+## Important Implementation Details
+
+### Status Transitions During Triage
+
+**When "yes" is selected:**
+1. Rename file: `{id}-pending-{priority}-{desc}.md` -> `{id}-ready-{priority}-{desc}.md`
+2. Update YAML frontmatter: `status: pending` -> `status: ready`
+3. Update Work Log with triage approval entry
+4. Confirm: "Approved: `{filename}` (Issue #{issue_id}) - Status: **ready**"
+
+**When "next" is selected:**
+1. Leave the todo file in todos/ -- `reject` is the only branch that removes a finding
+2. Skip to next item
+3. The file stays pending and comes back in the next triage pass
+
+**When "reject" is selected:**
+1. Write the no-list entry, after `bash scripts/lint-rejected-register.sh <path>` passes
+2. Take the founder's confirmation as the typed concept slug, never as `y`
+3. Only then delete the todo file, and report the entry path alongside the removed filename
+
+### Progress Tracking
+
+Every time you present a todo as a header, include:
+- **Progress:** X/Y completed (e.g., "3/10 completed")
+- **Estimated time remaining:** Based on how quickly you're progressing
+- **Pacing:** Monitor time per finding and adjust estimate accordingly
+
+Example:
+```
+
+Progress: 3/10 completed | Estimated time: ~2 minutes remaining
+
+```
+
+### Do Not Code During Triage
+
+- Present findings
+- Make yes/next/custom/reject decisions
+- Update todo files (rename, frontmatter, work log)
+- Do NOT implement fixes or write code
+- Do NOT add detailed implementation details
+- That's for soleur:resolve-todo-parallel phase
+```
+
+When done give these options
+
+```markdown
+What would you like to do next?
+
+1. run soleur:resolve-todo-parallel to resolve the todos
+2. commit the todos
+3. nothing, go chill
+```

package/skills/trigger-cron/SKILL.md

@@ -0,0 +1,136 @@
+---
+name: trigger-cron
+description: "This skill should be used to fire an allowlisted cron manual-trigger on demand via POST /api/internal/trigger-cron, without SSH. Reads the secret read-only from Doppler, lists allowlisted events, supports optional event data and a dry-run."
+---
+
+<!-- soleur-cloud-mode:start -->
+**Cloud Mode (Devin):** before pipeline work run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/cloud-detect.sh"`. If `CLAUDE_PLUGIN_ROOT` is unset (cloud exec shells do not export it), resolve the root by IDENTITY, never by script basename: for `d` in `"$HOME/.local/share/devin/cli/plugins/cache"` and `/opt/.devin/plugins`, skip unless `[ -d "$d" ]`, then `MANIFEST="$(find "$d" -path '*/.claude-plugin/plugin.json' -exec grep -l '"name"[[:space:]]*:[[:space:]]*"soleur"' {} + 2>/dev/null | head -1)"`, `ROOT="${MANIFEST%/.claude-plugin/plugin.json}"` — one resolution, two consumers: `$ROOT/scripts/cloud-detect.sh` and `$ROOT/scripts/precommit-guard.sh`. (Shape check, not authentication: a planted `{"name":"soleur"}` dir passes — ADR-179 A11.) `local` or `not-local:no-devin-env` proceeds normally; any other `not-local:<reason>` applies `<plugin-root>/devin/INSTRUCTIONS.md` §Cloud Mode: emit the `--banner`, fan out sequentially with `Reviewed-Coverage: sequential-fallback` disclosure (never claim an independent review ran), `message_user` ack before any secrets read or production mutation, and run `precommit-guard.sh` before any `git commit` — hooks do not fire in cloud.
+<!-- soleur-cloud-mode:end -->
+
+<!-- grok-harness-invoke:start -->
+**Grok Build (`plugins/soleur/lib/harness.ts` `invokeSkill()`):** Read this SKILL.md in this process and run it to completion. A one-segment `soleur:<name>` in this document names a SKILL — on Grok Build, Read `plugins/soleur/skills/<name>/SKILL.md` in this process; it is not a nested tool_use. A multi-segment id such as `soleur:<domain>:<name>` names an AGENT: spawn it, never Read it, and on Grok Build spawn_subagent takes the id with its colons replaced by hyphens (`agentIdToGrokSubagentType`). **Claude Code:** Skill tool for a skill (`soleur:<name>`), Task tool with `subagent_type` for an agent. Forbidden is executing a subset, not the Read.
+<!-- grok-harness-invoke:end -->
+
+# trigger-cron
+
+Fires a `cron/<name>.manual-trigger` event on demand by POSTing to the internal
+trigger route `POST /api/internal/trigger-cron` — the no-SSH replacement for the
+on-host `inngest send` loopback path (#4734, #4742). Use this instead of SSH-ing
+to the Hetzner box whenever a cron needs an on-demand run.
+
+## When to use
+
+- Re-running a probe/audit cron after fixing a secret (e.g. `cron/oauth-probe.manual-trigger`).
+- Targeting a specific issue with the bug-fixer (`cron/bug-fixer.manual-trigger`
+  with `data: { issue_number: N }`).
+- Any operator/agent "fire this cron now" need — see the runbooks
+  `knowledge-base/engineering/operations/runbooks/inngest-server.md` and
+  `oauth-probe-failure.md`.
+
+The cron CRUD set: `soleur:schedule` (Create), `soleur:cron-list` (Read),
+`soleur:cron-delete` (Delete), **`soleur:trigger-cron` (Run-now — this)**.
+
+## How it works
+
+The route authenticates a fail-closed shared secret
+(`INNGEST_MANUAL_TRIGGER_SECRET`, Doppler-provisioned) via a `Bearer` header,
+validates the event against the allowlist derived from `EXPECTED_CRON_FUNCTIONS`
+(`apps/web-platform/server/inngest/cron-manifest.ts`), and dispatches the event
+through the app's wired Inngest client. Route-controlled keys (`trigger`, `at`)
+are stamped server-side and CANNOT be overridden by caller `data`.
+
+## Usage
+
+The wrapper script is [scripts/trigger.sh](./scripts/trigger.sh):
+
+**Run this preflight first, and abort on a non-zero exit.** `trigger.sh` reads
+`INNGEST_MANUAL_TRIGGER_SECRET` from Doppler at `-c prd` and fires a real production event,
+so this is a secret gate in the sense of ADR-179 decision 2 — and until #7450 it carried no
+env-var precondition at all, which made it **cheaper to exploit than the redaction gates that
+issue was filed about**. A `:-` default resolves into the caller's working tree; on the review
+path that tree is a contributor's PR, so the defaulted form of this path would run *their*
+script with the operator's prod secret in reach. (The rejected literal is deliberately not
+reproduced here: a corpus-wide body-grep cannot tell an explanation from an occurrence, so
+quoting it would make this paragraph a residual site in the sweep that hunts it.)
+
+```bash
+[ -f "${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json" ] \
+  && grep -q '"name"[[:space:]]*:[[:space:]]*"soleur"' "${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json" \
+  || { echo "SOLEUR_TRIGGER_CRON_HALT reason=plugin-root-unverified root=[${CLAUDE_PLUGIN_ROOT}]"
+       echo "trigger-cron: cannot verify the Soleur plugin installation — stopping before any event fires." >&2
+       echo "  Resolved plugin root: [${CLAUDE_PLUGIN_ROOT}]" >&2
+       echo "  If that is EMPTY: no Soleur plugin is loaded in this session. Install it and start a NEW session — re-running here resolves the same empty root." >&2
+       echo "  If it names a path: that path is not a Soleur install (a repo checkout is not an install). Run 'claude plugin update soleur@soleur-marketplace' (or the id 'claude plugin list' prints, if you added the repository directly), then RESTART Claude Code — plugin changes apply only on restart. If you installed with --scope project or --scope local, pass the same scope. Reinstall only if that does not clear it." >&2
+       echo "  No event has been fired and no secret has been read." >&2
+       exit 2; }
+TRIGGER="${CLAUDE_PLUGIN_ROOT}/skills/trigger-cron/scripts/trigger.sh"
+[ -x "$TRIGGER" ] || { echo "SOLEUR_TRIGGER_CRON_HALT reason=producer-missing producer=scripts/trigger.sh"
+       echo "SOLEUR_TRIGGER_CRON_PRODUCER_MISSING producer=scripts/trigger.sh reason=absent-from-verified-root"
+       echo "trigger-cron: the plugin root verifies but does not carry trigger.sh — halt (fail closed)" >&2
+       echo "  Your project is not at fault: the installed Soleur payload is incomplete or stale." >&2
+       echo "  What to do: run 'claude plugin update soleur@soleur-marketplace' (or the id 'claude plugin list' prints, if you added the repository directly), then RESTART Claude Code (updates apply only on restart);" >&2
+       echo "  if you installed with --scope project or --scope local, pass the same scope. If it still persists," >&2
+       echo "  reinstall the plugin. Updating the MARKETPLACE alone does not update an INSTALLED plugin." >&2
+       echo "  Do NOT let the agent run the reinstall — it mutates the plugin root under a live run." >&2
+       exit 2; }
+```
+
+With the preflight passed, `$TRIGGER` is the verified producer:
+
+```bash
+# List the allowlisted manual-trigger events (sourced from the cron manifest).
+"${CLAUDE_PLUGIN_ROOT}/skills/trigger-cron/scripts/trigger.sh" --list
+
+# Dry-run: print the curl without firing.
+"${CLAUDE_PLUGIN_ROOT}/skills/trigger-cron/scripts/trigger.sh" \
+  --event cron/bug-fixer.manual-trigger --data '{"issue_number":4383}' --dry-run
+
+# Fire (default config: prd).
+"${CLAUDE_PLUGIN_ROOT}/skills/trigger-cron/scripts/trigger.sh" \
+  --event cron/workspace-sync-health.manual-trigger
+```
+
+### Flags
+
+| Flag | Meaning |
+|---|---|
+| `--list` | Print the allowlisted events (from `cron-manifest.ts`) and exit. |
+| `--event <name>` | The `cron/<name>.manual-trigger` event to fire (validated against the allowlist). |
+| `--data '<json>'` | Optional per-cron `event.data` (must be a JSON object). Forwarded verbatim; the route stamps `trigger`/`at` over it. |
+| `--config prd\|dev` | Doppler config to read the secret from (default `prd`). |
+| `--dry-run` | Print the curl invocation without firing. |
+
+## Sharp edges
+
+- **Run from a worktree, never the bare-repo root.** `trigger.sh` locates the allowlist via the repo's `cron-manifest.ts` and fails on a bare repo (`not inside a git repo (cannot locate cron-manifest.ts)`). From a bare-root session, `cd` into any `.worktrees/<feature>/` first (or run the script by absolute path while CWD is inside a worktree) — the firing curl is server-side-allowlist-validated, so the worktree's local manifest version does not affect correctness. See `knowledge-base/project/learnings/integration-issues/2026-06-05-cloud-task-silence-per-producer-triage-and-handler-fallback.md`.
+- **Read-only secret access.** The script reads `INNGEST_MANUAL_TRIGGER_SECRET`
+  via `doppler secrets get … --plain` only — it never writes or mutates the
+  secret, never echoes or logs it, and `unset`s the token immediately after the
+  `curl` call. The token is passed as the `curl` `Authorization` header argument
+  (same exposure profile as every other operator `curl` in the runbooks); the
+  `--dry-run` path prints the command form with `$TOKEN` unexpanded, so it never
+  mints or reveals the secret.
+- **The route is a dumb forwarder.** Per-cron field validation (e.g.
+  `issue_number` positive-integer) lives in each cron, not the route. A bad
+  `--data` shape that the route accepts (any plain object) may still be rejected
+  cron-side with a Sentry fallback.
+- **Allowlist is the blast-radius bound.** A non-allowlisted event returns 400.
+  The allowlist auto-tracks `cron-*.ts` via `EXPECTED_CRON_FUNCTIONS` — there is
+  no second hand-maintained list.
+- **The 18 Claude-spawning functions are throttled and capped (#8611).** Each carries
+  `throttle {limit 2, period 1h}` (`apps/web-platform/server/inngest/cron-budgets.ts`). A third
+  fire within the hour is **queued, not rejected** — the route still returns `202` — and runs
+  (and bills) later, so check `routine_runs_list` for up to an hour before re-firing. Every fire is
+  a new run with its own `--max-budget-usd` cap (`CLAUDE_BUDGET_USD` in the same file). A run that
+  hits its cap shows as a FAILED run with reason `budget-capped`, and as
+  `subtype=error_max_budget_usd` on its `SOLEUR_CLAUDE_COST` marker (query recipe in
+  `knowledge-base/engineering/operations/runbooks/betterstack-log-query.md`).
+- **Mutating crons spend budget / open PRs / post publicly.** `cron/bug-fixer.manual-trigger`
+  opens a PR; content/competitive/growth crons spend API budget;
+  `cron/weekly-release-digest.manual-trigger` POSTS a digest to the public
+  community `#releases` channel (no dry-run mode — every fire publishes). Use
+  `--dry-run` first; never smoke-test a mutating cron post-merge — use a
+  data-free, side-effect-light event like
+  `cron/workspace-sync-health.manual-trigger`. (The digest's one-time
+  post-merge verification fire per #5080 plan Phase 6.2 was the sanctioned
+  launch post, not a precedent.)