crewly 1.20.453 → 1.20.455

package/config/skills/agent/checkup-end/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: Check-up End
+description: End a small-business check-up. Deletes every file the check-up produced on this machine (ingested exports, the analysis with its list of people, the report and daily documents, the intake answers, the time log, the App page copy, and optionally the raw CSV exports) and writes a receipt the owner can keep that says what was deleted, what was kept and what is still to do (unpublish the App, revoke any access). --dry-run lists without deleting.
+version: 1.0.0
+category: productivity
+skillType: claude-skill
+assignableRoles:
+  - "*"
+triggers:
+  - end the check-up
+  - check-up is over
+  - delete check-up data
+  - wipe the check-up
+  - check-up receipt
+tags:
+  - check-up
+  - small-business
+  - privacy
+  - cleanup
+execution:
+  type: script
+  script:
+    file: execute.sh
+    interpreter: bash
+    timeoutMs: 60000
+---
+
+# Check-up End
+
+The last step of the small-business check-up (crewly#1055). The check-up
+leaves rows of people on this machine: the ingested exports, `breaks.json`
+with every person behind every break, the report document, the intake
+answers. When the check-up is over (the 7 daily lines are posted, or the
+owner says stop), delete all of it and give the owner a receipt.
+
+```bash
+bash execute.sh --dir . --business "Oak Pottery" --app <appId>        # from the project the team worked in
+bash execute.sh --dir . --exports ~/Downloads/oak-exports              # also the raw CSVs the owner handed over
+bash execute.sh --dir . --dry-run                                      # list what would go, delete nothing
+```
+
+## What it deletes
+
+Only the files the check-up skills are known to write, in the folders the
+team template uses under `--dir` (override any with a flag):
+
+| Folder / file | Flag | Files |
+|---|---|---|
+| `ingest/` | `--ingest` | `*.json` from `ingest-exports` (rows of people), `summary.json`, `unknown-report.json` |
+| `analysis/` | `--analysis` | `breaks.json`, `report.md` from `checkup-analyse` |
+| `checkup-data/` (or `data/`) | `--data` | `report-doc.json`, `daily-YYYY-MM-DD.json`, `timelog.json` from `checkup-report` |
+| `checkup-app/` | `--app-dir` | `index.html` (the App page copy) |
+| `intake.json` | `--intake` | the answers read with `app-data --get intake answers` |
+| raw exports | `--exports <dir>` | `*.csv` in that folder, not recursive; only when you pass it |
+
+Anything else in those folders (a stray file, a sub-folder, a symbolic link)
+is **left alone and listed in the receipt as a leftover**. A folder that ends
+up empty is removed. If none of `ingest/summary.json`, `analysis/breaks.json`,
+`report-doc.json`, `timelog.json` or `intake.json` exists the skill refuses
+(exit 2) and deletes nothing, so it cannot be pointed at the wrong folder.
+
+Run `--dry-run` first when you are not sure what is there; it writes the same
+receipt marked as a dry run.
+
+## The receipt
+
+`checkup-end-receipt.json` and `checkup-end-receipt.md` in `--dir` (or
+`--receipt <dir>`): the business, when, every file deleted with its kind,
+size and whether it held people data, whether names were hashed at ingest,
+the leftovers, and **Still to do**. Send the owner the `.md` or say the same
+in plain words: what was deleted, that nothing about their customers stays on
+this machine, and what you are doing next.
+
+## Still to do — the two things this skill cannot do itself
+
+1. **Unpublish the App.** The report, the intake answers and the daily lines
+   live in the App until it is deleted. Run `publish-app --app <appId> --delete`
+   (pass `--app` here so the receipt carries the exact command). A public App
+   needs `--private` first.
+2. **Revoke access.** Crewly stored no key or login for the apps named in the
+   intake (this check-up runs on exports); if the owner handed you a key, a
+   login or a read-only share, tell them to revoke it in that app. The receipt
+   lists the apps from the intake answers.
+
+Never delete before the owner has the report: the 7 daily lines come first,
+or the owner's word that the check-up is over.

package/config/skills/agent/checkup-end/end.mjs

@@ -0,0 +1,339 @@
+#!/usr/bin/env node
+// =============================================================================
+// checkup-end — the last step of the small-business check-up (crewly#1055):
+// delete every file the check-up produced on this machine (ingested exports,
+// the analysis with its list of people, the report and daily documents, the
+// intake answers, the time log, the copied App page, and optionally the raw
+// CSV exports the owner handed over) and write a receipt that says what was
+// deleted, what was kept, and what the lead still has to do (unpublish the
+// App, revoke any access the owner granted).
+//
+//   node end.mjs --dir <project> [--business "Oak Pottery"] [--app <appId>] [--exports <csv dir>] [--dry-run]
+//   node end.mjs --dir . --ingest ./ingest --analysis ./analysis --data ./checkup-data --app-dir ./checkup-app --intake ./intake.json
+//
+// Only the files the check-up skills are known to write are deleted; anything
+// else found in those folders is listed in the receipt as a leftover and left
+// alone. Symbolic links are never followed. Exit 0 = done (or dry run),
+// 2 = the folder does not look like a check-up, 1 = usage.
+// =============================================================================
+import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, lstatSync, unlinkSync, rmdirSync } from 'node:fs';
+import { join, resolve, relative, basename } from 'node:path';
+
+/** Where the check-up team writes each kind of file, relative to the project (`--dir`). */
+export const DEFAULT_LAYOUT = {
+  ingest: ['ingest'],
+  analysis: ['analysis'],
+  data: ['checkup-data', 'data'],
+  appDir: ['checkup-app'],
+  intake: ['intake.json'],
+};
+
+const RECEIPT_JSON = 'checkup-end-receipt.json';
+const RECEIPT_MD = 'checkup-end-receipt.md';
+
+/**
+ * What each check-up skill writes, by folder: file-name test and what the
+ * receipt calls it. Only these are deleted.
+ */
+const KNOWN = {
+  ingest: [
+    { test: (f) => f === 'summary.json', kind: 'ingest summary', people: false },
+    { test: (f) => f === 'unknown-report.json', kind: 'ingest note (unmapped file)', people: true },
+    { test: (f) => f.endsWith('.json'), kind: 'ingested export (rows of people)', people: true },
+  ],
+  analysis: [
+    { test: (f) => f === 'breaks.json', kind: 'analysis (every break with its people)', people: true },
+    { test: (f) => f === 'report.md', kind: 'analysis report', people: true },
+  ],
+  data: [
+    { test: (f) => f === 'report-doc.json', kind: 'App report document', people: true },
+    { test: (f) => /^daily-\d{4}-\d{2}-\d{2}\.json$/.test(f), kind: 'daily summary', people: false },
+    { test: (f) => f === 'timelog.json', kind: 'time log', people: false },
+  ],
+  appDir: [
+    { test: (f) => f === 'index.html', kind: 'App page copy', people: false },
+  ],
+  exports: [
+    { test: (f) => /\.csv$/i.test(f), kind: 'raw export (owner-provided CSV)', people: true },
+  ],
+};
+
+/** Files that mark a folder as a check-up; at least one must exist or nothing is touched. */
+const MARKERS = [
+  ['ingest', 'summary.json'],
+  ['analysis', 'breaks.json'],
+  ['data', 'report-doc.json'],
+  ['data', 'timelog.json'],
+  ['intake', null],
+];
+
+/** Resolve a folder/file for one slot: the explicit flag, else the first default that exists under `--dir`. */
+function resolveSlot(o, slot) {
+  if (o[slot]) return resolve(o[slot]);
+  for (const candidate of DEFAULT_LAYOUT[slot]) {
+    const p = resolve(o.dir, candidate);
+    if (existsSync(p)) return p;
+  }
+  return resolve(o.dir, DEFAULT_LAYOUT[slot][0]);
+}
+
+/** True when the path exists and is not a symbolic link (links are never followed). */
+function isRealFile(p) {
+  try {
+    const st = lstatSync(p);
+    return st.isFile();
+  } catch {
+    return false;
+  }
+}
+
+function isRealDir(p) {
+  try {
+    return lstatSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Walk one folder (not recursive) and split its entries into the files the
+ * check-up wrote (to delete) and everything else (to leave and report).
+ */
+function inventoryDir(dir, rules, root) {
+  const toDelete = [];
+  const leftovers = [];
+  if (!isRealDir(dir)) return { toDelete, leftovers, present: false };
+  for (const name of readdirSync(dir).sort()) {
+    const p = join(dir, name);
+    const st = lstatSync(p);
+    const rel = relative(root, p) || name;
+    if (st.isSymbolicLink()) { leftovers.push({ path: rel, note: 'symbolic link, not followed' }); continue; }
+    if (st.isDirectory()) { leftovers.push({ path: rel, note: 'folder, not entered' }); continue; }
+    const rule = rules.find((r) => r.test(name));
+    if (rule) toDelete.push({ path: rel, abs: p, bytes: st.size, kind: rule.kind, people: rule.people });
+    else leftovers.push({ path: rel, note: 'not written by a check-up skill' });
+  }
+  return { toDelete, leftovers, present: true };
+}
+
+/** Read the intake answers (plain document or app-data's `{ success, data }`) for the apps to revoke; missing → null. */
+function readIntakeApps(path) {
+  if (!isRealFile(path)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    const doc = raw && raw.data && typeof raw.data === 'object' && !Array.isArray(raw.data) ? raw.data : raw;
+    return Array.isArray(doc.apps) ? doc.apps.filter((a) => typeof a === 'string' && a.trim()).map((a) => a.trim()) : [];
+  } catch {
+    return [];
+  }
+}
+
+/** Whether ingest-exports hashed the names (then the stored rows held no name, email or phone). */
+function readNamesHashed(ingestDir) {
+  const p = join(ingestDir, 'summary.json');
+  if (!isRealFile(p)) return null;
+  try {
+    return Boolean(JSON.parse(readFileSync(p, 'utf8')).namesHashed);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Build the end-of-check-up plan: every file to delete, the leftovers, the
+ * App and access the lead still has to deal with. Deletes nothing.
+ */
+export function planEnd(o) {
+  const root = resolve(o.dir);
+  const slots = {
+    ingest: resolveSlot(o, 'ingest'),
+    analysis: resolveSlot(o, 'analysis'),
+    data: resolveSlot(o, 'data'),
+    appDir: resolveSlot(o, 'appDir'),
+    intake: resolveSlot(o, 'intake'),
+  };
+  const looksLikeCheckup = MARKERS.some(([slot, file]) => (file ? isRealFile(join(slots[slot], file)) : isRealFile(slots[slot])));
+  const toDelete = [];
+  const leftovers = [];
+  const folders = [];
+  for (const slot of ['ingest', 'analysis', 'data', 'appDir']) {
+    const inv = inventoryDir(slots[slot], KNOWN[slot], root);
+    toDelete.push(...inv.toDelete);
+    leftovers.push(...inv.leftovers);
+    if (inv.present) folders.push(slots[slot]);
+  }
+  if (o.exports) {
+    const dir = resolve(o.exports);
+    const inv = inventoryDir(dir, KNOWN.exports, root);
+    toDelete.push(...inv.toDelete);
+    leftovers.push(...inv.leftovers);
+    if (inv.present) folders.push(dir);
+  }
+  if (isRealFile(slots.intake)) {
+    toDelete.push({ path: relative(root, slots.intake) || basename(slots.intake), abs: slots.intake, bytes: lstatSync(slots.intake).size, kind: 'intake answers', people: false });
+  }
+  const apps = readIntakeApps(slots.intake);
+  const namesHashed = readNamesHashed(slots.ingest);
+  return { root, slots, looksLikeCheckup, toDelete, leftovers, folders, apps, namesHashed };
+}
+
+/** The steps this skill cannot do itself, in the order the lead should take them. */
+function todoFor(o, plan) {
+  const todo = [];
+  if (o.app) {
+    todo.push({
+      step: 'unpublish the App',
+      why: 'the report, the intake answers and the daily lines live in the App until it is deleted',
+      command: `publish-app --app ${o.app} --delete`,
+    });
+  } else {
+    todo.push({
+      step: 'unpublish the App',
+      why: 'the report, the intake answers and the daily lines live in the App until it is deleted (pass --app <appId> to put the exact command here)',
+      command: 'publish-app --app <appId> --delete',
+    });
+  }
+  const apps = plan.apps && plan.apps.length ? plan.apps : [];
+  todo.push({
+    step: 'revoke access',
+    why: apps.length
+      ? `the owner named ${apps.join(', ')}; Crewly stored no key or login for them in this check-up (exports only), so any key, login or read-only share the owner handed over is revoked in that app`
+      : 'any key, login or read-only share the owner handed over for the check-up is revoked in that app; Crewly stored none',
+    apps,
+  });
+  return todo;
+}
+
+/** The receipt as Markdown the lead can paste to the owner. */
+function receiptMarkdown(r) {
+  const lines = [];
+  lines.push(`# Check-up ended${r.business ? ` — ${r.business}` : ''}`);
+  lines.push('');
+  lines.push(`Ended at ${r.endedAt}${r.dryRun ? ' (dry run: nothing was deleted)' : ''}.`);
+  lines.push('');
+  lines.push(`## Deleted (${r.deleted.length} file${r.deleted.length === 1 ? '' : 's'}, ${r.bytes.toLocaleString('en-US')} bytes)`);
+  lines.push('');
+  if (!r.deleted.length) lines.push('- nothing: no check-up files were found');
+  for (const f of r.deleted) lines.push(`- \`${f.path}\` — ${f.kind}${f.people ? ' (held people data)' : ''}`);
+  lines.push('');
+  if (r.namesHashed === true) lines.push('Names, emails and phones were hashed when the exports were ingested; the stored rows held none.');
+  else if (r.namesHashed === false) lines.push('The ingested rows held names as exported; they are gone with the files above.');
+  lines.push('');
+  lines.push('## Kept');
+  lines.push('');
+  lines.push(`- this receipt (\`${r.receipt.json}\`, \`${r.receipt.md}\`)`);
+  for (const l of r.leftovers) lines.push(`- \`${l.path}\` — ${l.note}`);
+  lines.push('');
+  lines.push('## Still to do');
+  lines.push('');
+  for (const t of r.todo) {
+    lines.push(`- **${t.step}**: ${t.why}${t.command ? ` — \`${t.command}\`` : ''}`);
+  }
+  lines.push('');
+  return lines.join('\n');
+}
+
+/** Delete the planned files, then remove any check-up folder left empty. Returns what was actually removed. */
+function applyPlan(plan) {
+  const deleted = [];
+  const failed = [];
+  for (const f of plan.toDelete) {
+    try {
+      unlinkSync(f.abs);
+      deleted.push(f);
+    } catch (e) {
+      failed.push({ path: f.path, error: e.message });
+    }
+  }
+  const removedFolders = [];
+  for (const dir of plan.folders) {
+    try {
+      if (isRealDir(dir) && readdirSync(dir).length === 0) {
+        rmdirSync(dir);
+        removedFolders.push(relative(plan.root, dir) || dir);
+      }
+    } catch {
+      /* a folder that will not go is simply kept */
+    }
+  }
+  return { deleted, failed, removedFolders };
+}
+
+function out(obj, code) {
+  process.stdout.write(JSON.stringify(obj) + '\n');
+  process.exit(code);
+}
+
+function usage() {
+  out({ success: false, error: 'usage: end.mjs --dir <project> [--business <name>] [--app <appId>] [--exports <csv dir>] [--ingest <dir>] [--analysis <dir>] [--data <dir>] [--app-dir <dir>] [--intake <file>] [--receipt <dir>] [--dry-run]' }, 1);
+}
+
+function main(argv) {
+  const o = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    const next = () => { i += 1; if (i >= argv.length) usage(); return argv[i]; };
+    if (a === '--dir') o.dir = next();
+    else if (a === '--business') o.business = next();
+    else if (a === '--app') o.app = next();
+    else if (a === '--exports') o.exports = next();
+    else if (a === '--ingest') o.ingest = next();
+    else if (a === '--analysis') o.analysis = next();
+    else if (a === '--data') o.data = next();
+    else if (a === '--app-dir') o.appDir = next();
+    else if (a === '--intake') o.intake = next();
+    else if (a === '--receipt') o.receipt = next();
+    else if (a === '--dry-run') o.dryRun = true;
+    else usage();
+  }
+  if (!o.dir) usage();
+  if (!isRealDir(o.dir)) out({ success: false, error: `${o.dir}: not a folder` }, 2);
+  if (o.exports && !isRealDir(o.exports)) out({ success: false, error: `${o.exports}: not a folder` }, 2);
+
+  const plan = planEnd(o);
+  if (!plan.looksLikeCheckup) {
+    out({
+      success: false,
+      error: `${plan.root} does not look like a check-up folder (no ingest/summary.json, analysis/breaks.json, report-doc.json, timelog.json or intake.json); nothing deleted`,
+    }, 2);
+  }
+
+  const endedAt = new Date().toISOString();
+  const receiptDir = resolve(o.receipt || plan.root);
+  const receipt = { json: join(receiptDir, RECEIPT_JSON), md: join(receiptDir, RECEIPT_MD) };
+  const result = o.dryRun ? { deleted: plan.toDelete, failed: [], removedFolders: [] } : applyPlan(plan);
+  const bytes = result.deleted.reduce((n, f) => n + f.bytes, 0);
+  const r = {
+    schemaVersion: '1.0',
+    business: o.business || null,
+    endedAt,
+    dryRun: Boolean(o.dryRun),
+    root: plan.root,
+    deleted: result.deleted.map(({ path, bytes: b, kind, people }) => ({ path, bytes: b, kind, people })),
+    bytes,
+    failed: result.failed,
+    removedFolders: result.removedFolders,
+    leftovers: plan.leftovers,
+    namesHashed: plan.namesHashed,
+    todo: todoFor(o, plan),
+    receipt,
+  };
+  mkdirSync(receiptDir, { recursive: true });
+  writeFileSync(receipt.json, JSON.stringify(r, null, 2));
+  writeFileSync(receipt.md, receiptMarkdown(r));
+
+  out({
+    success: result.failed.length === 0,
+    dryRun: r.dryRun,
+    deleted: r.deleted.length,
+    bytes,
+    peopleFiles: r.deleted.filter((f) => f.people).length,
+    leftovers: r.leftovers.length,
+    failed: result.failed,
+    receipt,
+    next: r.todo.map((t) => t.command || `${t.step}: ${t.why}`),
+  }, result.failed.length ? 2 : 0);
+}
+
+const isMain = process.argv[1] && resolve(process.argv[1]) === resolve(new URL(import.meta.url).pathname);
+if (isMain) main(process.argv.slice(2));

package/config/skills/agent/checkup-end/execute.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# =============================================================================
+# checkup-end — end a small-business check-up (crewly#1055): delete every
+# file the check-up produced on this machine and write a receipt that says
+# what was deleted, what was kept and what the lead still has to do
+# (unpublish the App, revoke any access the owner granted).
+#
+# Usage:
+#   bash execute.sh --dir . --business "Oak Pottery" --app <appId>            # the project the team worked in
+#   bash execute.sh --dir . --exports ~/Downloads/oak-exports                  # also the raw CSVs the owner handed over
+#   bash execute.sh --dir . --dry-run                                          # list what would go, delete nothing
+#   bash execute.sh '{"dir":".","business":"Oak Pottery","app":"28au74d9cj","dryRun":true}'
+#
+# Output: one JSON line (files deleted, bytes, leftovers, receipt paths, the
+# commands still to run). Exit 0 = done, 2 = not a check-up folder or a file
+# would not delete, 1 = usage.
+# =============================================================================
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+END="${SCRIPT_DIR}/end.mjs"
+
+command -v node >/dev/null 2>&1 || { printf '{"success":false,"error":"node is required but not on PATH"}\n'; exit 1; }
+
+ARGS=()
+if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
+  command -v jq >/dev/null 2>&1 || { printf '{"success":false,"error":"jq is required to read JSON input"}\n'; exit 1; }
+  for key in dir business app exports ingest analysis data appDir intake receipt; do
+    v=$(printf '%s' "$1" | jq -r --arg k "$key" '.[$k] // empty')
+    if [ -n "$v" ]; then
+      case "$key" in appDir) flag=--app-dir ;; *) flag="--$key" ;; esac
+      ARGS+=("$flag" "$v")
+    fi
+  done
+  [ "$(printf '%s' "$1" | jq -r '.dryRun // false')" = "true" ] && ARGS+=(--dry-run)
+  shift
+fi
+ARGS+=("$@")
+
+exec node "$END" ${ARGS[@]+"${ARGS[@]}"}

package/config/skills/agent/checkup-end/execute.test.sh

@@ -0,0 +1,134 @@
+#!/bin/bash
+# Tests for checkup-end — run with: bash execute.test.sh
+# Offline: builds a check-up folder with ingest-exports + checkup-analyse + checkup-report first. Needs node and jq.
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EXEC="$HERE/execute.sh"
+INGEST="$HERE/../ingest-exports/execute.sh"
+ANALYSE="$HERE/../checkup-analyse/execute.sh"
+REPORT="$HERE/../checkup-report/execute.sh"
+FX="$HERE/../ingest-exports/fixtures"
+PASS=0; FAIL=0
+check() {
+  local name="$1"; local got="$2"; local want="$3"
+  if [ "$got" = "$want" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $name"; echo "  want: $want"; echo "  got:  $got"; fi
+}
+T="$(mktemp -d)"; trap 'rm -rf "$T"' EXIT
+
+# A check-up laid out the way the team template works: project P with ingest/, analysis/, checkup-data/, checkup-app/, intake.json
+build_checkup() {
+  local P="$1"; local hash="${2:-}"
+  mkdir -p "$P"
+  if [ -n "$hash" ]; then bash "$INGEST" --in "$FX" --out "$P/ingest" --hash-names >/dev/null; else bash "$INGEST" --in "$FX" --out "$P/ingest" >/dev/null; fi
+  bash "$ANALYSE" --in "$P/ingest" --as-of 2026-10-26 --out "$P/analysis" >/dev/null
+  cat > "$P/intake.json" <<'EOF'
+{"apps":["Square","Jotform","Jackrabbit"],"slowestTask":"copying sign-ups","fears":[],"appsPerCustomer":"3","firstNumber":"Money owed to me","savedAt":"2026-10-26T10:00:00.000Z"}
+EOF
+  bash "$REPORT" --log-step intake --start --out "$P/checkup-data" >/dev/null
+  bash "$REPORT" --log-step intake --end --out "$P/checkup-data" >/dev/null
+  bash "$REPORT" --breaks "$P/analysis/breaks.json" --business "Oak Pottery" --intake "$P/intake.json" --out "$P/checkup-data" >/dev/null
+  bash "$REPORT" --daily "Replied to 3 inquiries." --date 2026-10-27 --out "$P/checkup-data" >/dev/null
+  bash "$REPORT" --app-dir "$P/checkup-app" >/dev/null
+}
+
+# 1. Dry run: lists everything, deletes nothing, receipt marked dryRun
+build_checkup "$T/p1"
+BEFORE=$(find "$T/p1" -type f | wc -l | tr -d ' ')
+OUT="$(bash "$EXEC" --dir "$T/p1" --business "Oak Pottery" --app 28au74d9cj --dry-run)"; RC=$?
+check "dry run exits 0" "$RC" "0"
+check "dry run success" "$(printf '%s' "$OUT" | jq -r '.success')" "true"
+check "dry run flagged" "$(printf '%s' "$OUT" | jq -r '.dryRun')" "true"
+check "dry run counts the files" "$(printf '%s' "$OUT" | jq -r '.deleted >= 12')" "true"
+AFTER=$(find "$T/p1" -type f -not -name 'checkup-end-receipt.*' | wc -l | tr -d ' ')
+check "dry run deleted nothing" "$AFTER" "$BEFORE"
+check "dry run still has breaks.json" "$([ -f "$T/p1/analysis/breaks.json" ] && echo yes || echo no)" "yes"
+R="$T/p1/checkup-end-receipt.json"
+check "receipt json written" "$([ -f "$R" ] && echo yes || echo no)" "yes"
+check "receipt md written" "$([ -f "$T/p1/checkup-end-receipt.md" ] && echo yes || echo no)" "yes"
+check "receipt dryRun" "$(jq -r '.dryRun' "$R")" "true"
+check "receipt business" "$(jq -r '.business' "$R")" "Oak Pottery"
+check "receipt next = unpublish with the app id" "$(printf '%s' "$OUT" | jq -r '.next[0]')" "publish-app --app 28au74d9cj --delete"
+check "receipt lists the apps to revoke" "$(jq -c '.todo[1].apps' "$R")" '["Square","Jotform","Jackrabbit"]'
+check "receipt says names were not hashed" "$(jq -r '.namesHashed' "$R")" "false"
+check "md mentions dry run" "$(grep -c 'dry run' "$T/p1/checkup-end-receipt.md")" "1"
+
+# 2. Real run: known files gone, empty folders removed, leftovers kept and listed
+build_checkup "$T/p2" hash
+echo "owner note" > "$T/p2/analysis/notes.txt"          # not written by a check-up skill → leftover
+mkdir -p "$T/p2/ingest/raw"                              # a sub-folder → leftover
+ln -s "$T/p2/intake.json" "$T/p2/checkup-data/link.json" # a symlink → never followed
+OUT="$(bash "$EXEC" --dir "$T/p2" --business "Oak Pottery")"; RC=$?
+check "end exits 0" "$RC" "0"
+check "end success" "$(printf '%s' "$OUT" | jq -r '.success')" "true"
+check "end not a dry run" "$(printf '%s' "$OUT" | jq -r '.dryRun')" "false"
+check "breaks.json gone" "$([ -e "$T/p2/analysis/breaks.json" ] && echo still || echo gone)" "gone"
+check "ingested rows gone" "$(ls "$T/p2/ingest" 2>/dev/null | grep -c '\.json$')" "0"
+check "report-doc gone" "$([ -e "$T/p2/checkup-data/report-doc.json" ] && echo still || echo gone)" "gone"
+check "daily gone" "$([ -e "$T/p2/checkup-data/daily-2026-10-27.json" ] && echo still || echo gone)" "gone"
+check "timelog gone" "$([ -e "$T/p2/checkup-data/timelog.json" ] && echo still || echo gone)" "gone"
+check "intake gone" "$([ -e "$T/p2/intake.json" ] && echo still || echo gone)" "gone"
+check "app page copy gone" "$([ -e "$T/p2/checkup-app/index.html" ] && echo still || echo gone)" "gone"
+check "empty checkup-app folder removed" "$([ -d "$T/p2/checkup-app" ] && echo still || echo gone)" "gone"
+check "leftover note kept" "$([ -f "$T/p2/analysis/notes.txt" ] && echo yes || echo no)" "yes"
+check "leftover folder kept" "$([ -d "$T/p2/ingest/raw" ] && echo yes || echo no)" "yes"
+check "symlink kept (not followed)" "$([ -L "$T/p2/checkup-data/link.json" ] && echo yes || echo no)" "yes"
+check "non-empty folders kept" "$([ -d "$T/p2/analysis" ] && [ -d "$T/p2/ingest" ] && echo yes || echo no)" "yes"
+R="$T/p2/checkup-end-receipt.json"
+check "receipt leftovers = 3" "$(jq -r '.leftovers | length' "$R")" "3"
+check "receipt leftover note reason" "$(jq -r '.leftovers[] | select(.path=="analysis/notes.txt") | .note' "$R")" "not written by a check-up skill"
+check "receipt symlink reason" "$(jq -r '.leftovers[] | select(.path=="checkup-data/link.json") | .note' "$R")" "symbolic link, not followed"
+check "receipt names hashed" "$(jq -r '.namesHashed' "$R")" "true"
+check "receipt people files counted" "$(printf '%s' "$OUT" | jq -r '.peopleFiles >= 8')" "true"
+check "receipt bytes > 0" "$(jq -r '.bytes > 0' "$R")" "true"
+check "receipt removed folders lists checkup-app" "$(jq -r '.removedFolders | index("checkup-app") != null' "$R")" "true"
+check "receipt next without --app shows placeholder" "$(printf '%s' "$OUT" | jq -r '.next[0]')" "publish-app --app <appId> --delete"
+check "md lists deleted kinds" "$(grep -c 'held people data' "$T/p2/checkup-end-receipt.md" | awk '{print ($1>=5)?"yes":"no"}')" "yes"
+check "md hashed note" "$(grep -c 'were hashed' "$T/p2/checkup-end-receipt.md")" "1"
+
+# 3. Raw exports folder: only *.csv in it, not recursive
+build_checkup "$T/p3"
+mkdir -p "$T/exports/sub"
+cp "$FX"/*.csv "$T/exports/"
+echo "x" > "$T/exports/readme.txt"
+cp "$FX/square-transactions.csv" "$T/exports/sub/"
+N_CSV=$(ls "$T/exports"/*.csv | wc -l | tr -d ' ')
+OUT="$(bash "$EXEC" --dir "$T/p3" --exports "$T/exports")"; RC=$?
+check "exports exits 0" "$RC" "0"
+check "csv exports gone" "$(ls "$T/exports" | grep -c '\.csv$')" "0"
+check "readme kept" "$([ -f "$T/exports/readme.txt" ] && echo yes || echo no)" "yes"
+check "sub-folder csv kept" "$([ -f "$T/exports/sub/square-transactions.csv" ] && echo yes || echo no)" "yes"
+check "receipt counts the csvs" "$(jq -r --argjson n "$N_CSV" '[.deleted[] | select(.kind | startswith("raw export"))] | length == $n' "$T/p3/checkup-end-receipt.json")" "true"
+
+# 4. Refuses a folder that is not a check-up, deletes nothing
+mkdir -p "$T/notme/analysis"; echo "keep" > "$T/notme/analysis/report.md"; echo "keep" > "$T/notme/other.txt"
+OUT="$(bash "$EXEC" --dir "$T/notme")"; RC=$?
+check "not a check-up exits 2" "$RC" "2"
+check "not a check-up error" "$(printf '%s' "$OUT" | jq -r '.error' | grep -c 'does not look like a check-up')" "1"
+check "not a check-up kept report.md" "$([ -f "$T/notme/analysis/report.md" ] && echo yes || echo no)" "yes"
+check "not a check-up wrote no receipt" "$([ -e "$T/notme/checkup-end-receipt.json" ] && echo yes || echo no)" "no"
+
+# 5. Missing folder, usage, JSON input, explicit slot flags and --receipt
+OUT="$(bash "$EXEC" --dir "$T/nope")"; RC=$?
+check "missing dir exits 2" "$RC" "2"
+OUT="$(bash "$EXEC")"; RC=$?
+check "no args exits 1" "$RC" "1"
+OUT="$(bash "$EXEC" --dir "$T/p3" --bogus)"; RC=$?
+check "unknown flag exits 1" "$RC" "1"
+build_checkup "$T/p5"
+mv "$T/p5/checkup-data" "$T/p5/elsewhere"
+OUT="$(bash "$EXEC" "{\"dir\":\"$T/p5\",\"data\":\"$T/p5/elsewhere\",\"business\":\"Oak Pottery\",\"app\":\"abc123\",\"receipt\":\"$T/p5-receipt\",\"dryRun\":true}")"; RC=$?
+check "json exits 0" "$RC" "0"
+check "json dry run" "$(printf '%s' "$OUT" | jq -r '.dryRun')" "true"
+check "json app in next" "$(printf '%s' "$OUT" | jq -r '.next[0]')" "publish-app --app abc123 --delete"
+check "json --data slot found the moved folder" "$(jq -r '[.deleted[] | select(.path=="elsewhere/report-doc.json")] | length' "$T/p5-receipt/checkup-end-receipt.json")" "1"
+check "json receipt in --receipt dir" "$([ -f "$T/p5-receipt/checkup-end-receipt.md" ] && echo yes || echo no)" "yes"
+check "json receipt not in project" "$([ -e "$T/p5/checkup-end-receipt.json" ] && echo yes || echo no)" "no"
+
+# 6. Ending twice: the second run finds nothing and says so
+build_checkup "$T/p6"
+bash "$EXEC" --dir "$T/p6" >/dev/null
+OUT="$(bash "$EXEC" --dir "$T/p6")"; RC=$?
+check "second end refuses (nothing left to mark a check-up)" "$RC" "2"
+
+echo "checkup-end: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/config/skills/agent/checkup-report/SKILL.md

@@ -106,6 +106,14 @@ and any step still open). A second `--start` on an open step restarts it;
 `--end` with no open entry fails (exit 2) so a forgotten start is noticed.
 `--at <iso>` back-fills a time you know. One `daily` entry per day is fine.
 
+## End — when the 7 days are over
+
+Run `checkup-end --dir . --business "<Business>" --app <appId>`: it deletes
+every file the check-up left on this machine (ingested rows, `breaks.json`,
+the report and daily documents, the intake answers, the time log, the App
+page copy) and writes a receipt. Then `publish-app --app <appId> --delete`
+and send the owner the receipt. See that skill.
+
 ## Report back
 
 Tell the owner in plain words: the App is ready (the card has the link), the

package/config/skills/agent/ingest-exports/SKILL.md

@@ -88,8 +88,8 @@ Children's names, parents' emails and phone numbers are in most of these
 exports. Run with `--hash-names` unless the analysis truly needs the names:
 `name`, `email`, `phone` and every original column that looks personal become
 a short stable hash (`h:3f1a…`), so the same person still counts once across
-files but nobody's name is stored. Report counts, not names, and delete the
-`--out` folder when the check-up ends.
+files but nobody's name is stored. Report counts, not names, and run
+`checkup-end` when the check-up is over so the `--out` folder goes with a receipt.
 
 ## Report back
 

package/config/templates/small-business-checkup.json

@@ -6,7 +6,7 @@
     {
       "name": "Checkup Lead",
       "role": "product-manager",
-      "systemPrompt": "You run the small-business check-up end to end for one business owner. The four steps are intake, connect, analyse, report; log the start and end of each one with the 'checkup-report' skill (--log-step <step> --start / --end --out ./checkup-data) so the owner can see how long the check-up really took. Intake: run 'checkup-report --app-dir ./checkup-app', then 'publish-app' so the owner gets the App on their phone, and wait for the five answers (app-data --get intake answers). Connect and analyse: hand the Data Analyst the list of apps from the answers and the exports or connector access the owner provides; the analyst returns the path to breaks.json. Report: build the report document with 'checkup-report --breaks ... --business ... --intake ... --out ./checkup-data'. If a Reviewer is on the team, send them the report-doc.json path and wait for 'approved' or a list of fixes before publishing; if there is no Reviewer, check the document yourself and publish. Publish with 'app-data --set report current' and share the App link. Then post one daily summary for 7 days with 'checkup-report --daily'. Tell the owner the top 3 in plain words with count and estimate, say that the dollars are estimates from listed assumptions, and name the one thing you would start on. Never paste the whole list of people into chat or the App, and never send anything to a third party without the owner's say-so."
+      "systemPrompt": "You run the small-business check-up end to end for one business owner. The four steps are intake, connect, analyse, report; log the start and end of each one with the 'checkup-report' skill (--log-step <step> --start / --end --out ./checkup-data) so the owner can see how long the check-up really took. Intake: run 'checkup-report --app-dir ./checkup-app', then 'publish-app' so the owner gets the App on their phone, and wait for the five answers (app-data --get intake answers). Connect and analyse: hand the Data Analyst the list of apps from the answers and the exports or connector access the owner provides; the analyst returns the path to breaks.json. Report: build the report document with 'checkup-report --breaks ... --business ... --intake ... --out ./checkup-data'. If a Reviewer is on the team, send them the report-doc.json path and wait for 'approved' or a list of fixes before publishing; if there is no Reviewer, check the document yourself and publish. Publish with 'app-data --set report current' and share the App link. Then post one daily summary for 7 days with 'checkup-report --daily'. End: after the seventh daily line, or when the owner says the check-up is over, run 'checkup-end --dir . --business <name> --app <appId>' (--dry-run first if unsure; add --exports <dir> when the owner handed over CSV files) so every ingested row, the analysis and the report leave this machine, then 'publish-app --app <appId> --delete', and send the owner the receipt it wrote in plain words. Tell the owner the top 3 in plain words with count and estimate, say that the dollars are estimates from listed assumptions, and name the one thing you would start on. Never paste the whole list of people into chat or the App, and never send anything to a third party without the owner's say-so."
     },
     {
       "name": "Data Analyst",