ci(commands): give /plan-fleet the corrected cost model (CLOUD-367)

[wenzowski]

Follow-up to #297, which landed /plan-fleet and the memory beside it in an inconsistent state.

What was wrong

#297 corrected the fan-out cost model in mem:workflow/agent-fanout but left the same claim standing in .claude/commands/plan-fleet.md. The command shipped saying:

the honest signal that you are past it is a rising re-verify rate, not a stall

and pointing at mem:workflow/agent-fanout for "the current cap" — which that memory no longer states in those terms, because the same PR replaced the cap with a cost table.

So the two authorities disagreed about one fact, in the change whose §1 was explicitly "one authority each, no duplication between them". The direction is what makes it worth a follow-up rather than a note: the command is the reachable surface — someone invoking /plan-fleet reads it and may never open the memory — so the superseded model was the one on the path of travel.

The fix

## What bounds the fleet now carries the same cost table the memory holds:

Cost	Control
a rebase conflict (needs a human)	file-domain partitioning — step 3
CI minutes on a run main voids	draft until plausibly next (CLOUD-369, unbuilt)
tokens	bundles, and land lapping without a model turn

Re-verifying is free: land laps unattended, so a moved base spends CPU and wall-clock — both free in this sandbox — and zero tokens. Throttling a fleet to avoid it optimises against a cost that does not exist.

The objective is restated as pace of landed work per token, with the saturated-queue target and the CSMA/CD framing: coordination between sessions is impossible by construction, so collisions are designed for rather than prevented.

The CI-minutes row names CLOUD-369 as unbuilt, rather than implying a control exists where none does.

Gate

Unchanged from #297 — memories-check selects tracked markdown via git ls-files '*.md', which reaches .claude/commands/, so the mem: reference stays bound by the existing conjunct.

Refs: CLOUD-367

---

Generated by Claude Code

[linear-code]

CLOUD-367 The planner-fleet dispatch pattern lives only in chat: re-typed every time, and its caps are re-derived or ignored

Why

Dispatching N planning-only sibling sessions over the ready queue is a repeatable procedure that exists nowhere durable. Measured 2026-08-11: seven planners were dispatched over CLOUD-333, 224, 218, 249, 328, 46 and 171, and every step — compute the frontier, subtract what open PRs and non-archived sessions already hold, partition by file domain, write a standalone prompt per child — was reconstructed from scratch in chat. The user's words: "so I don't have to keep typing the same thing."

Chat is the one destination that stores nothing. A procedure that survives only in a transcript is re-derived on each use, and the parts most likely to be dropped on a re-derivation are the ones that are not obvious:

• The cost model is not intuitive, and the obvious reading is wrong. ~~mem:workflow/agent-fanout~~~~ records build WIP cap 2, and past ~2–3 implementers the binding constraint is land contention.~~ Corrected while landing this issue: that framing optimises against a cost that does not exist. land laps unattended — a fast-forward refusal rebases and re-verifies with no model turn — so a moved base spends CPU and wall-clock, both free in this sandbox, and zero tokens. Re-verifying is the loop working, not a symptom of too much parallelism. What actually costs is narrower: a rebase conflict (needs a human, controlled by file-domain partitioning), CI minutes on a run main voids, and tokens spent when a session returns to the model. The objective is pace of landed work per token, not collision avoidance — coordination between sessions is impossible by construction, so collisions are designed for in the CSMA/CD sense. The unrationed cost this leaves is the transition out of draft, filed as CLOUD-369.
• One harness limit is invisible until it bites, and one supposed limit is not real. A child's final chat message is never read by the parent, so a child whose output is a conclusion rather than an artifact (research and decision tickets) must be told where to write it. ~~permission_mode: "plan"~~~~ stalls a child indefinitely on an approval prompt nobody is watching.~~ Measured false: children dispatched without it came up PERMISSION_MODE_PLAN anyway — it is this environment's default — and parked at "Waiting on permission: ExitPlanMode". That park is the mechanism, not the failure: the child plans, a human approves, and it works on. It is a defect only for work nobody intends to approve.
• The partition is only real if it reads PR file lists. Two issues that read as unrelated but both edit mise-tasks/land are one issue for dispatch purposes. Titles do not reveal that; git diff --name-only origin/main...origin/<head> does.

Acceptance

• The procedure is invokable rather than re-typed, and one invocation carries the frontier computation, the subtraction, the partition, and the per-child prompt contract.
• The cost model and the harness facts are stated where the dispatcher will read them, not left to rediscovery.
• A child is dispatched a bundle — an ordered chain in one file domain — rather than a single ticket, so approving its plan keeps it working instead of ending it.
• Every mem: reference the artifact makes resolves.

---

Refinement — Ready (the dispatch procedure becomes an invokable artifact; its model stays in the memory that already owns fan-out)

Refinement gate: Definition of Ready & Done. This body carries only specializations.

• Source of truth (§1). Split by kind, one authority each, no duplication between them. The model — the cost table, the measurement behind it, and why planning and landing scale differently — stays in mem:workflow/agent-fanout, which already owns fan-out and already carries the measurement. The procedure becomes .claude/commands/plan-fleet.md, a new surface: an invokable slash command that points at the memory rather than restating it. The command is the reachable entry point; the memory is the reasoning.
• Computable predicate (§2). No new gate. The artifact is markdown carrying mem: references, so the existing memory gate's reference-resolution conjunct is the predicate that binds it — confirm the gate's glob actually reaches .claude/commands/, and widen it if it does not. That check is the whole mechanism: a command pointing at a memory that does not exist is the one failure mode with teeth, since the command deliberately does not restate what the memory holds.
• Effect (§3). No command-surface change, no effect-table row. .claude/commands/ is agent-facing configuration, not a batten verb.
• Output & exit (§5). Unchanged — the gate that binds this is an existing conjunct with its existing pointer-only output.
• Commit / bump (§6). ci → no bump. Nothing under crates/, so release-plz releases nothing and In Review is the truthful column until a later release sweeps it.
• Test obligation (§7). The memory gate's existing suite, extended only if its glob had to widen to reach .claude/commands/: a command file whose mem: reference does not resolve is reported; a fully-resolving tree exits 0.
• Blockers (§8). None. relatedTo CLOUD-291 — mem:workflow/agent-fanout is itself one of the memories missing from the always-loaded index, so the model half of this change lands in a memory with no trigger. That is CLOUD-291's gap, not this issue's, and CLOUD-288 (which adds the missing rows) is in flight in another session; the row is deliberately left to that owner rather than raced here. The command is the mitigation in the meantime — it is reachable by name and points at the memory. relatedTo CLOUD-284 — the unbudgeted, uncheckpointed fan-out this procedure's caps exist to prevent.

Stated assumption

.claude/commands/ is a new directory in this repo. No gate enumerates it today (checked: nothing in mise-tasks/ or hk.pkl globs it), so introducing it adds no gate conflict. Flag if the convention is unwanted and the procedure should live as a skill or a mise task instead — a mise task cannot be the home, since dispatch calls an MCP tool rather than a shell command.

Review in Linear

[wenzowski]

/fast-forward

[wenzowski]

Triggered from #325 (comment) by @​wenzowski.

Trying to fast forward main (040fa56) to claude/ready-issues-handoff-qnra4q (a0c22b5).

Target branch (main):

commit 040fa566b81b0c89387ac7bdb833e0e43d028e1c (HEAD -> main, origin/main)
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:24:16 2026 +0000

    docs(resolve): mark §5's max_effect as specified, not implemented
    
    Two module headers asserted `max_effect` as an invariant already in the tree:
    `resolve.rs` said the raise-only override rule "extends §5's `max_effect`
    invariant to the config layer", and `verbs.rs` said sharing the effect
    vocabulary keeps "the raise-only `max_effect` rule" meaning one thing across
    the tool. Neither is true today. `max_effect` is per-flag effect annotations
    plus a monotone maximum over them; `Effect` is declared per command and carries
    no ordering, so there is nothing to take a maximum of.
    
    That is the CLOUD-198 class, and `resolve.rs` was the costly instance: it
    presented this layer's raise-only rule as a corollary of a mechanism that
    exists, so a reader checking whether config-layer monotonicity was load-bearing
    on its own found a sentence telling them it was not.
    
    Both now name the invariant as specified-not-implemented and point at CLOUD-27,
    which is where the implementation rides. No test: the Ready block puts the test
    obligation on the implementation path, and a doc comment stating a gap has
    nothing to assert until the gap closes.
    
    Refs: CLOUD-217

Pull request (claude/ready-issues-handoff-qnra4q):

commit a0c22b548f5375d5f9531ed5b60e2683d26f83d8 (pull_request/claude/ready-issues-handoff-qnra4q)
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:38:42 2026 +0000

    ci(commands): give /plan-fleet the corrected cost model
    
    The command shipped with the framing the memory beside it had already
    dropped: "the honest signal that you are past it is a rising re-verify rate",
    plus a pointer to `mem:workflow/agent-fanout` for "the current cap", which
    that memory no longer states in those terms.
    
    Two authorities disagreeing about the same fact, in the file whose §1 was
    "one authority each, no duplication" — and the command is the reachable one,
    so a dispatcher invoking `/plan-fleet` got the superseded model while the
    memory it points at carried the current one.
    
    Replaced with the cost table the memory already holds: re-verifying is free
    because `land` laps without a model turn, and what actually costs is a rebase
    conflict, CI minutes on a voided run, and tokens. Objective restated as pace
    of landed work per token, with the saturated-queue target and the CSMA/CD
    framing, and the CI-minutes row now names CLOUD-369 as unbuilt rather than
    implying a control exists.
    
    Refs: CLOUD-367

Can't fast forward main (040fa56) to claude/ready-issues-handoff-qnra4q (a0c22b5). main (040fa56) is not a direct ancestor of claude/ready-issues-handoff-qnra4q (a0c22b5). Branches appear to have diverged at 42ef663:

* a0c22b548f5375d5f9531ed5b60e2683d26f83d8 ci(commands): give /plan-fleet the corrected cost model
| * 040fa566b81b0c89387ac7bdb833e0e43d028e1c docs(resolve): mark §5's max_effect as specified, not implemented
|/  
* 42ef66342352cf2219fd94ab2503dc228e1dd8b5 test(session): compare the whole store across a restart, not a subset

commit 42ef66342352cf2219fd94ab2503dc228e1dd8b5
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:09:46 2026 +0000

    test(session): compare the whole store across a restart, not a subset
    
    The predicate is that a kill-and-restart preserves the findings store
    byte-for-byte, and the assertion was over the fields the test helper
    happens to parse — fingerprint, rule and instance counts. It would not
    have noticed the tier, the presentation or a disposition changing across
    the restart, which are exactly the fields no verb can vary yet and so the
    ones nothing else is watching.
    
    Refs: CLOUD-83

Rebase locally, and then force push to claude/ready-issues-handoff-qnra4q.

[wenzowski]

/fast-forward

[wenzowski]

Triggered from #325 (comment) by @​wenzowski.

Trying to fast forward main (3fde7a8) to claude/ready-issues-handoff-qnra4q (7114482).

Target branch (main):

commit 3fde7a81593c6a60d838b6006f8db6a638b4738f (HEAD -> main, origin/main)
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:30:27 2026 +0000

    fix(bench): keep the workflow's summary block off shellcheck's SC2016
    
    A backtick pair inside single quotes reads as legacy command substitution
    to shellcheck, which actionlint runs over every `run:` block, so the
    summary line failed the gate. Double-quoted with escaped backticks keeps
    the markdown code span and says nothing shellcheck has to guess at.
    
    Prettier's table realignment in README rides along — hk staged it.
    
    Refs: CLOUD-207

Pull request (claude/ready-issues-handoff-qnra4q):

commit 711448266ae35e411dfbe13454a382f80314fb42 (pull_request/claude/ready-issues-handoff-qnra4q)
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:38:42 2026 +0000

    ci(commands): give /plan-fleet the corrected cost model
    
    The command shipped with the framing the memory beside it had already
    dropped: "the honest signal that you are past it is a rising re-verify rate",
    plus a pointer to `mem:workflow/agent-fanout` for "the current cap", which
    that memory no longer states in those terms.
    
    Two authorities disagreeing about the same fact, in the file whose §1 was
    "one authority each, no duplication" — and the command is the reachable one,
    so a dispatcher invoking `/plan-fleet` got the superseded model while the
    memory it points at carried the current one.
    
    Replaced with the cost table the memory already holds: re-verifying is free
    because `land` laps without a model turn, and what actually costs is a rebase
    conflict, CI minutes on a voided run, and tokens. Objective restated as pace
    of landed work per token, with the saturated-queue target and the CSMA/CD
    framing, and the CI-minutes row now names CLOUD-369 as unbuilt rather than
    implying a control exists.
    
    Refs: CLOUD-367

Can't fast forward main (3fde7a8) to claude/ready-issues-handoff-qnra4q (7114482). main (3fde7a8) is not a direct ancestor of claude/ready-issues-handoff-qnra4q (7114482). Branches appear to have diverged at 040fa56:

* 711448266ae35e411dfbe13454a382f80314fb42 ci(commands): give /plan-fleet the corrected cost model
| * 3fde7a81593c6a60d838b6006f8db6a638b4738f fix(bench): keep the workflow's summary block off shellcheck's SC2016
| * 8854916d55b1126fcae162c601404edfc5cc6f9e feat(bench): measure the invocation cost, publish it, and gate it
|/  
* 040fa566b81b0c89387ac7bdb833e0e43d028e1c docs(resolve): mark §5's max_effect as specified, not implemented

commit 040fa566b81b0c89387ac7bdb833e0e43d028e1c
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:24:16 2026 +0000

    docs(resolve): mark §5's max_effect as specified, not implemented
    
    Two module headers asserted `max_effect` as an invariant already in the tree:
    `resolve.rs` said the raise-only override rule "extends §5's `max_effect`
    invariant to the config layer", and `verbs.rs` said sharing the effect
    vocabulary keeps "the raise-only `max_effect` rule" meaning one thing across
    the tool. Neither is true today. `max_effect` is per-flag effect annotations
    plus a monotone maximum over them; `Effect` is declared per command and carries
    no ordering, so there is nothing to take a maximum of.
    
    That is the CLOUD-198 class, and `resolve.rs` was the costly instance: it
    presented this layer's raise-only rule as a corollary of a mechanism that
    exists, so a reader checking whether config-layer monotonicity was load-bearing
    on its own found a sentence telling them it was not.
    
    Both now name the invariant as specified-not-implemented and point at CLOUD-27,
    which is where the implementation rides. No test: the Ready block puts the test
    obligation on the implementation path, and a doc comment stating a gap has
    nothing to assert until the gap closes.
    
    Refs: CLOUD-217

Rebase locally, and then force push to claude/ready-issues-handoff-qnra4q.

[wenzowski]

/fast-forward

[wenzowski]

Triggered from #325 (comment) by @​wenzowski.

Trying to fast forward main (a2ed37d) to claude/ready-issues-handoff-qnra4q (4ce69f0).

Target branch (main):

commit a2ed37d212a129bfc423cf34a378d890ce19a0d2 (HEAD -> main, origin/main)
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:23:26 2026 +0000

    fix(lint): add the lint rows to the two committed surface lists, and fix the census's clippy denial
    
    `verify` found three things local iteration had not:
    
    - `spec.rs` pins the emitted row set and the derived read-only allowlist as two
      committed lists. Both are hand-maintained on purpose — a verb added, renamed
      or re-parented has to be stated — so `lint`/`lint brief` join them, the noun
      with its kind because the whole subtree is `read`.
    - The census's positional lookup used `map(..).unwrap_or_else(panic!)`, which is
      `clippy::map_unwrap_or`; a `let ... else` says the same thing.
    - rustfmt over the new module, the surface row and the tests.
    
    Refs: CLOUD-84

Pull request (claude/ready-issues-handoff-qnra4q):

commit 4ce69f02249fff25f1c866afa373032a289e8fd3 (pull_request/claude/ready-issues-handoff-qnra4q)
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:38:42 2026 +0000

    ci(commands): give /plan-fleet the corrected cost model
    
    The command shipped with the framing the memory beside it had already
    dropped: "the honest signal that you are past it is a rising re-verify rate",
    plus a pointer to `mem:workflow/agent-fanout` for "the current cap", which
    that memory no longer states in those terms.
    
    Two authorities disagreeing about the same fact, in the file whose §1 was
    "one authority each, no duplication" — and the command is the reachable one,
    so a dispatcher invoking `/plan-fleet` got the superseded model while the
    memory it points at carried the current one.
    
    Replaced with the cost table the memory already holds: re-verifying is free
    because `land` laps without a model turn, and what actually costs is a rebase
    conflict, CI minutes on a voided run, and tokens. Objective restated as pace
    of landed work per token, with the saturated-queue target and the CSMA/CD
    framing, and the CI-minutes row now names CLOUD-369 as unbuilt rather than
    implying a control exists.
    
    Refs: CLOUD-367

Can't fast forward main (a2ed37d) to claude/ready-issues-handoff-qnra4q (4ce69f0). main (a2ed37d) is not a direct ancestor of claude/ready-issues-handoff-qnra4q (4ce69f0). Branches appear to have diverged at 3fde7a8:

* 4ce69f02249fff25f1c866afa373032a289e8fd3 ci(commands): give /plan-fleet the corrected cost model
| * a2ed37d212a129bfc423cf34a378d890ce19a0d2 fix(lint): add the lint rows to the two committed surface lists, and fix the census's clippy denial
| * bb83902973a8652f1db3dbcc68820996559d5310 feat(lint): gate a delegation brief on the facts that do not inherit
|/  
* 3fde7a81593c6a60d838b6006f8db6a638b4738f fix(bench): keep the workflow's summary block off shellcheck's SC2016

commit 3fde7a81593c6a60d838b6006f8db6a638b4738f
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:30:27 2026 +0000

    fix(bench): keep the workflow's summary block off shellcheck's SC2016
    
    A backtick pair inside single quotes reads as legacy command substitution
    to shellcheck, which actionlint runs over every `run:` block, so the
    summary line failed the gate. Double-quoted with escaped backticks keeps
    the markdown code span and says nothing shellcheck has to guess at.
    
    Prettier's table realignment in README rides along — hk staged it.
    
    Refs: CLOUD-207

Rebase locally, and then force push to claude/ready-issues-handoff-qnra4q.

[wenzowski]

/fast-forward

[wenzowski]

Triggered from #325 (comment) by @​wenzowski.

Trying to fast forward main (6569aeb) to claude/ready-issues-handoff-qnra4q (ce692d5).

Target branch (main):

commit 6569aeb303e942642dd22feab96f221c67f7027e (HEAD -> main, origin/main)
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:02:59 2026 +0000

    feat(rules)!: rename the command kind's `run` column to `check`, reserve `fix`
    
    House style §9 specifies the `command` rule kind as a check/fix duality: an
    inspection-only `check` is the gate — the only side enforcement ever runs — and
    an optional mutating `fix` repairs what it condemned. The shipped `Rule` carried
    one `run` column, which does not express the split.
    
    §2 declares no back-compatibility surface and no deprecation aliases, so every
    config written against `run` becomes a breaking migration later. Today the key
    appears in no shipped config at all — only fixtures, tests and the README — so
    the rename costs nothing. It will not stay that way.
    
    `fix` parses and is executed by nothing: serialised fix execution is a
    capability this engine does not have. `enforce` refuses a row declaring one
    rather than running the check side and silently ignoring the repair, which would
    report green over work nobody did. Reserving the key now means an author who
    writes it is writing the final spelling.
    
    `run` survives as a refusal-only field, the shape `OverrideConfig::
    min_batten_version` already uses: "unknown field `run`" reads as a typo, where
    this is a rename with one specific fix, and the refusal has to carry it
    (CLOUD-122). It is deliberately outside `Rule::columns` — that census classifies
    the columns a kind may carry, and no kind carries this one.
    
    Both refusals are exit 1, not the exit 2 the issue's §5/§7 asked for. §7 makes 2
    the policy verdict — a violation found in the repository, or a mediated call
    denied — while a config naming a key or a capability this build does not have is
    the config-or-usage class. §5 spells the structurally identical sibling refusal
    (a rule the read-only half cannot honestly run) as exit 1, and `run_static` has
    implemented it that way since CLOUD-170; the issue's §3 describes that same
    landed refusal as exit 2, which is falsified by the code it describes. Emitting
    2 here would also make an engine gap read to a harness as a policy deny, which
    is what the structural fail-open exists to prevent.
    
    Refs: CLOUD-215

Pull request (claude/ready-issues-handoff-qnra4q):

commit ce692d5e71e28d481184643beba271cd370ddc99 (pull_request/claude/ready-issues-handoff-qnra4q)
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:38:42 2026 +0000

    ci(commands): give /plan-fleet the corrected cost model
    
    The command shipped with the framing the memory beside it had already
    dropped: "the honest signal that you are past it is a rising re-verify rate",
    plus a pointer to `mem:workflow/agent-fanout` for "the current cap", which
    that memory no longer states in those terms.
    
    Two authorities disagreeing about the same fact, in the file whose §1 was
    "one authority each, no duplication" — and the command is the reachable one,
    so a dispatcher invoking `/plan-fleet` got the superseded model while the
    memory it points at carried the current one.
    
    Replaced with the cost table the memory already holds: re-verifying is free
    because `land` laps without a model turn, and what actually costs is a rebase
    conflict, CI minutes on a voided run, and tokens. Objective restated as pace
    of landed work per token, with the saturated-queue target and the CSMA/CD
    framing, and the CI-minutes row now names CLOUD-369 as unbuilt rather than
    implying a control exists.
    
    Refs: CLOUD-367

Can't fast forward main (6569aeb) to claude/ready-issues-handoff-qnra4q (ce692d5). main (6569aeb) is not a direct ancestor of claude/ready-issues-handoff-qnra4q (ce692d5). Branches appear to have diverged at 18bb416:

* ce692d5e71e28d481184643beba271cd370ddc99 ci(commands): give /plan-fleet the corrected cost model
| * 6569aeb303e942642dd22feab96f221c67f7027e feat(rules)!: rename the command kind's `run` column to `check`, reserve `fix`
|/  
* 18bb41610d628560c9babe07224ae6c30478c81c ci(hooks): remind once when the instruction surface moves under a running session

commit 18bb41610d628560c9babe07224ae6c30478c81c
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:29:23 2026 +0000

    ci(hooks): remind once when the instruction surface moves under a running session
    
    A session loads its hook wiring and reads its instruction files once, at start.
    When the contract then changes on `main`, the running session keeps executing the
    old one with no signal that it drifted: `issue-guard` landed mid-session and a
    live session readied a PR whose branch and commits carried no `CLOUD-<n>` key,
    because that hook was never in that session's wiring.
    
    `contract-drift` hashes the tracked contract surface (`AGENTS.md`,
    `.claude/rules`, `.claude/settings.json`, `hk.pkl`, `mise-tasks`) in one
    `git hash-object` pass — 63 files, 8ms — keyed per session under `.git/`, and
    names the paths that moved. Silence is the default; a change-set is reported once,
    because reporting overwrites the snapshot. Pointer-only: paths and a count, never
    a byte of the file, since a reminder carrying the new text is a mirror and a
    mirror is cleared by reading the hook instead of the file.
    
    Not `PreToolUse`, which the Ready block specified: that event's only model-facing
    channel is exit 2, which blocks the call, and CLOUD-97 and CLOUD-219 each ruled a
    deny out independently. `PostToolBatch` documents `additionalContext` firing
    "before the next model request", which is the same instant as "before the next
    lifecycle step"; `SessionStart` seeds the snapshot before any tool runs, since an
    autonomous session's first batch is routinely fetch+rebase and a snapshot written
    after it would record the drift as its baseline.
    
    Measured while building it: the `PostToolBatch` entry took effect within the
    session that added it, so the channel works and the premise is narrower than the
    title reads. The reminder therefore tells the agent to check whether a new hook is
    loaded rather than asserting it cannot be.
    
    Refs: CLOUD-187

Rebase locally, and then force push to claude/ready-issues-handoff-qnra4q.

[wenzowski]

/fast-forward

[wenzowski]

Triggered from #325 (comment) by @​wenzowski.

Trying to fast forward main (6947232) to claude/ready-issues-handoff-qnra4q (c711d65).

Target branch (main):

commit 6947232b13bc17174986a0e3bfe528d848617519 (HEAD -> main, origin/main)
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:57:59 2026 +0000

    perf(hk): glob batten-check and macos-link-check, and gate the glob's honesty
    
    `hk check` ran three steps unconditionally, because a step with no `glob` is
    never skipped. `batten-check` is `cargo run -p batten -- check`, so every
    commit paid a debug build whatever it touched: 9.47s cold from a fresh clone
    (CLOUD-212 run 1, D8) against 0.16s for the cheapest gate in the same run, and
    133-141ms warm, forever.
    
    The glob is the union of what `batten check` ACTUALLY reads, which is not the
    two things the obvious reading gives. Read at run_check_with in
    crates/batten/src/lib.rs, it evaluates every `[[rule]]` over that rule's own
    glob — and those reach outside crates/, to mise.toml, .github/workflows/*.yml
    and tests/*.bats — plus `budget::measure_all`, because a declared budget is a
    gate under `check` and not only under `policy budget` (CLOUD-50). That last one
    makes AGENTS.md and .serena/project.yml genuine inputs, so "a Markdown-only
    change cannot change this verdict" is false for the most-edited Markdown file
    in the repo, and a glob written from the obvious reading would have switched
    the gate off for it. Cargo.toml and Cargo.lock are in because the task uses
    `cargo run` deliberately, to judge the engine and the config as the pair that
    ships.
    
    `macos-link-check` globs the manifests alone: its predicate is `cargo metadata
    --filter-platform` over the resolved graph, and nothing else can move that
    graph. `no-docs-tree` deliberately keeps no glob — its input is the whole
    index, including a docs/ path an earlier commit left behind, and at ~95ms that
    is affordable.
    
    Deriving batten-check's list from batten.toml by hand makes hk.pkl a second
    authority over a set the config already defines, and a second authority narrows
    silently: add a rule whose glob names a new path and the step stops running for
    commits that touch only it, with nothing going red. So the glob ships with its
    mechanism (non-negotiable 2). `mise run batten-glob-check` is a pure function
    of the two committed files — every rule glob and every declared budget path
    must be covered verbatim or subsumed by a `P/**` entry, and a config it can
    parse nothing out of is exit 2 rather than a vacuous pass.
    
    Selection is asserted as data, never as a timing: `hk check --plan --json`
    prints each step's status without running it, and tests/hk-selection.bats pins
    both directions over the repository's own hk.pkl — README.md skips
    batten-check, AGENTS.md does not.
    
    Refs: CLOUD-224

Pull request (claude/ready-issues-handoff-qnra4q):

commit c711d654344bf34dac1320a950eb82b4fcd355f8 (pull_request/claude/ready-issues-handoff-qnra4q)
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:38:42 2026 +0000

    ci(commands): give /plan-fleet the corrected cost model
    
    The command shipped with the framing the memory beside it had already
    dropped: "the honest signal that you are past it is a rising re-verify rate",
    plus a pointer to `mem:workflow/agent-fanout` for "the current cap", which
    that memory no longer states in those terms.
    
    Two authorities disagreeing about the same fact, in the file whose §1 was
    "one authority each, no duplication" — and the command is the reachable one,
    so a dispatcher invoking `/plan-fleet` got the superseded model while the
    memory it points at carried the current one.
    
    Replaced with the cost table the memory already holds: re-verifying is free
    because `land` laps without a model turn, and what actually costs is a rebase
    conflict, CI minutes on a voided run, and tokens. Objective restated as pace
    of landed work per token, with the saturated-queue target and the CSMA/CD
    framing, and the CI-minutes row now names CLOUD-369 as unbuilt rather than
    implying a control exists.
    
    Refs: CLOUD-367

Can't fast forward main (6947232) to claude/ready-issues-handoff-qnra4q (c711d65). main (6947232) is not a direct ancestor of claude/ready-issues-handoff-qnra4q (c711d65). Branches appear to have diverged at 6569aeb:

* c711d654344bf34dac1320a950eb82b4fcd355f8 ci(commands): give /plan-fleet the corrected cost model
| * 6947232b13bc17174986a0e3bfe528d848617519 perf(hk): glob batten-check and macos-link-check, and gate the glob's honesty
|/  
* 6569aeb303e942642dd22feab96f221c67f7027e feat(rules)!: rename the command kind's `run` column to `check`, reserve `fix`

commit 6569aeb303e942642dd22feab96f221c67f7027e
Author: Claude <noreply@anthropic.com>
Date:   Tue Aug 11 19:02:59 2026 +0000

    feat(rules)!: rename the command kind's `run` column to `check`, reserve `fix`
    
    House style §9 specifies the `command` rule kind as a check/fix duality: an
    inspection-only `check` is the gate — the only side enforcement ever runs — and
    an optional mutating `fix` repairs what it condemned. The shipped `Rule` carried
    one `run` column, which does not express the split.
    
    §2 declares no back-compatibility surface and no deprecation aliases, so every
    config written against `run` becomes a breaking migration later. Today the key
    appears in no shipped config at all — only fixtures, tests and the README — so
    the rename costs nothing. It will not stay that way.
    
    `fix` parses and is executed by nothing: serialised fix execution is a
    capability this engine does not have. `enforce` refuses a row declaring one
    rather than running the check side and silently ignoring the repair, which would
    report green over work nobody did. Reserving the key now means an author who
    writes it is writing the final spelling.
    
    `run` survives as a refusal-only field, the shape `OverrideConfig::
    min_batten_version` already uses: "unknown field `run`" reads as a typo, where
    this is a rename with one specific fix, and the refusal has to carry it
    (CLOUD-122). It is deliberately outside `Rule::columns` — that census classifies
    the columns a kind may carry, and no kind carries this one.
    
    Both refusals are exit 1, not the exit 2 the issue's §5/§7 asked for. §7 makes 2
    the policy verdict — a violation found in the repository, or a mediated call
    denied — while a config naming a key or a capability this build does not have is
    the config-or-usage class. §5 spells the structurally identical sibling refusal
    (a rule the read-only half cannot honestly run) as exit 1, and `run_static` has
    implemented it that way since CLOUD-170; the issue's §3 describes that same
    landed refusal as exit 2, which is falsified by the code it describes. Emitting
    2 here would also make an engine gap read to a harness as a policy deny, which
    is what the structural fail-open exists to prevent.
    
    Refs: CLOUD-215

Rebase locally, and then force push to claude/ready-issues-handoff-qnra4q.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud