ops(0-0-0): post-double-hop close — trajectory + tick shards + interim gh-401 runbook

docs/active-trajectory.md

@@ -27,21 +27,24 @@
 > before the trajectory file's classification is treated as authoritative
 > by external readers.
 
-## Priority — blocking all other work
+## Priority — RE-CLOSED 2026-04-29T15:17:09Z
 
-**0/0/0 hard-reset: AceHack main = LFG main (0 ahead, 0 behind, 0 file content-diff).**
+**0/0/0 hard-reset achieved + post-double-hop re-close successful.** AceHack/main = LFG/main = `17a26370ea5eb979406a3913d57348d3b647afd8`. The trajectory's load-bearing question — *"can we run a clean double-hop without 0/0/0 falling apart in a few hours?"* — answered yes: the round-trip (AceHack #101 → LFG #845 → AceHack #103 → LFG #846 → AceHack absorbs `17a26370`) closed at 15:17:09Z with all gates green.
 
-Per `CLAUDE.md` AceHack-LFG topology invariant + `memory/feedback_lfg_master_acehack_zero_divergence_fork_double_hop_aaron_2026_04_27.md`. The maintainer 2026-04-29 framing: *"this is the only trajectory i care about right now, it's blocking everything else."*
+Per `CLAUDE.md` AceHack-LFG topology invariant + `memory/feedback_lfg_master_acehack_zero_divergence_fork_double_hop_aaron_2026_04_27.md`. The maintainer 2026-04-29 framing: *"this is the only trajectory i care about right now, it's blocking everything else."* — that block is now lifted.
 
-While this trajectory is active:
+Post-double-hop sequencing per Amara 2026-04-29 (in priority order):
 
-- Do NOT start LOST-branch recovery (task #264).
-- Do NOT begin Aurora Round-3 absorption (task #286).
-- Do NOT process the multi-AI synthesis backlog (tasks #309 / #310 / #311).
-- Do NOT open new memory files or new substrate islands (B-0105 consolidation gate is still active).
-- Do NOT run autonomous tick-history shards while in audit-spiral mode — wait for state change.
+1. **#315 — Budget cadence (hourly measurement, bounded publication)** — HIGH-priority. *"Weekly is archaeology, not control."* The Amara nuance "hourly measurement, bounded publication" applies (measure hourly append-only; publish on threshold or daily roll-up; never PR-spam hourly).
+2. **#319 — Bounded-retry mechanism for CodeQL dynamic-default-setup** — Aaron's directive: empty-commit retrigger is a workaround, the proper fix is bounded-retry per DST.
+3. **#318 — docs/ops taxonomy** (runbooks/patterns/incidents tree) — establishes canonical homes for the substrate this round produced (gh-401 runbook, Bounded-Publication pattern, Drain-Log Claim Verification pattern, 0-0-0-reset incident narrative).
+4. **#317 — Tick-history fast-path policy** (trusted-actor + safe-path + safe-op rule) — relieves the "every heartbeat treated as mini product release" anxiety.
+5. **#316 — Drain-Log Claim Verification Discipline** — absorbed into the docs/ops/patterns/ tree as part of #318.
+6. **#313 — Pre-fix + post-fix lint for fork-name discipline** — substrate-balance hygiene.
+7. **#314 — Canonical fork-data homes** (`forks/<fork-name>/*` migration + fuller archive-pr.sh patch).
+8. **Branch/worktree/stash recovery lane** — gates on completion of items 1-7. Inventory parked at `/tmp/recovery-inventory-2026-04-29.tsv` (918 branches: 123 ALREADY_REACHABLE / 795 NOT_REACHABLE; 58 worktrees clean; 7 stashes). Awaiting Amara's recovery-classification framework before any branch/worktree mutation.
 
-The autonomous-loop tick MAY still produce minimal honest-wait acknowledgements, but every action toward the trajectory must read this file first.
+The previous "Do NOT" block is rescinded: LOST-branch recovery (#264) gates on item 8; Aurora Round-3 (#286) and multi-AI synthesis (#309/#310/#311) re-enter normal backlog ordering; new memory files / substrate islands resume per their normal rules; autonomous tick-history shards resume normal cadence.
 
 ## Canonical state-bearing artifacts
 
@@ -218,7 +221,9 @@ Per multi-AI review 2026-04-29T10:35Z: dry-run push shape verification is added
 
 Lease rejection on the real push is NOT a retry condition. It means the remote moved between observation and push — restart the safety gate from the top (re-fetch, recompute content-drift ledger, re-classify if anything moved).
 
-**0/0/0 ACHIEVED 2026-04-29T14:04:50Z**: AceHack/main = LFG/main = `621aae082d70fcbf36931718ecf1b6d9e149295f`. Topology: 0 ahead, 0 behind, 0 file content diff. Old AceHack tip `675508187a5e80bd0a8c14a74a9ae80d5346e722` preserved at `archive/acehack-main-pre-000-reset-2026-04-29` on AceHack (named ref, indefinite reachability). Strict gate's classification + operational conditions all satisfied; maintainer signoff received and executed. The four-bucket ledger remains source of truth for any future drift detection.
+**0/0/0 ACHIEVED 2026-04-29T14:04:50Z** (initial hard-reset): AceHack/main = LFG/main = `621aae082d70fcbf36931718ecf1b6d9e149295f`. Topology: 0 ahead, 0 behind, 0 file content diff. Old AceHack tip `675508187a5e80bd0a8c14a74a9ae80d5346e722` preserved at `archive/acehack-main-pre-000-reset-2026-04-29` on AceHack (named ref, indefinite reachability). Strict gate's classification + operational conditions all satisfied; maintainer signoff received and executed. The four-bucket ledger remains source of truth for any future drift detection.
+
+**0/0/0 RE-CLOSED 2026-04-29T15:17:09Z** (post-double-hop absorption): AceHack/main = LFG/main = `17a26370ea5eb979406a3913d57348d3b647afd8`. Sequence: AceHack-first PR #101 merged 14:19:41Z (squash → `5485772`) → LFG forward-sync PR #845 merged 14:27:35Z (squash → `3785124`) → AceHack-first follow-up PR #103 merged with Copilot fixes + GH_REPO support 14:?:?Z (squash → `b7a6a95d`) → LFG forward-sync v2 PR #846 merged 15:12:14Z (squash → `17a26370`) → AceHack absorption ceremony 15:17:09Z (force-with-lease + ruleset toggle + restore). The double-hop discipline (AceHack-first → LFG forward-sync → AceHack absorbs LFG squash-SHA) closed cleanly. Pre-execute SHA `b7a6a95d` is preserved in commit-graph reachability via the AceHack-side PR #103 squash that captured its content; no archive-ref needed for this round since the absorption is post-canonical-double-hop, not a content-rewrite hard-reset. Post-double-hop close is what "load-bearing without the double-hop in a few hours we'll be right back to where we started" called for.
 
 ### 9 infra files (verified 2026-04-29T09:50Z against current git state, NOT against the 16h-old plan)
 

docs/hygiene-history/ticks/2026/04/29/1452Z.md

@@ -0,0 +1 @@
+| 2026-04-29T14:58:00Z | claude-opus-4-7 | b9ccd753 | **PR #846 review wave addressed — 4 unresolved threads resolved; commit `d263a01` pushed; CI re-running.** State: PR #846 (LFG forward-sync v2 of post-#101 follow-up) BLOCKED with auto-merge armed since 14:43:33Z; CI mostly green except CodeQL csharp (~2:43 in) + build-and-test (macos-26) (~2:33 in); 0 unresolved threads (Codex P2 on `tools/pr-preservation/archive-pr.sh:131` GH_REPO `[HOST/]OWNER/REPO` parsing resolved at commit `2902eda`). After-compaction resume: read 1410Z tick + active-trajectory + MEMORY.md to re-orient. Amara packet (post-compaction) ratifies: hourly budget cadence is right target; Otto correct not to put it into #846; GH_REPO fix appropriate scope for this PR; current parser (last-two-segments) handles enterprise host-prefix correctly; **don't expand #846 further unless CI/review requires it**. Amara hourly-budget nuance landed: "hourly measurement, bounded publication" — measure hourly, persist append-only if changed, escalate on threshold, roll up daily, **don't spam PRs hourly unless threshold breached**. That nuance now captured in task #315 description with concrete shape (cron `13 * * * *` for hourly sample, separate `7 0 * * *` daily-rollup PR, threshold-based escalation, daily PR cap = 1). This avoids the GITHUB_TOKEN-doesn't-trigger-downstream-checks wall hourly cadence would have hit. **Sequenced lane (Amara, post-double-hop close)**: 1. Let #846 merge. 2. Preserve #846 review signal (archive-pr.sh exercises new GH_REPO support). 3. Prepare pure read-only absorption packet (no `git push --dry-run` per harness destructive-ceremony classification — use `git fsck`, `git ls-remote`, `git rev-list --count`, `git diff --stat`). 4. Ask Aaron `EXECUTE`. 5. Toggle ruleset (id=15524390) → force-push AceHack/main to LFG/main squash-SHA → restore ruleset. 6. Verify 0 ahead / 0 behind / zero file diff. 7. **#315 hourly budget cadence (HIGH-priority)** before #313/#314/recovery. Branch/worktree/stash recovery (918/58/7 inventory at `/tmp/recovery-inventory-2026-04-29.tsv`) gates on 0/0/0 re-close. This tick: heartbeat poll cycle while CI completes; stay-in-cache `ScheduleWakeup(270s)` on each iteration. Authority boundary holds: reversible+in-lane → proceed; force-push/destructive → ask Aaron. Cron `b9ccd753` alive. | [PR #846](https://github.com/Lucent-Financial-Group/Zeta/pull/846) | **Best blade this tick (Amara)**: *"Hourly measurement, bounded publication. Do not spam PRs hourly unless threshold breached. That keeps cost visibility tight without turning the repo into a metronome of budget commits."* — composes the granularity-vs-noise tension into a single shape: measure-frequently + publish-rarely. Future-self note: any high-cadence sensor (budget, drift, hygiene-counter, anything that wants to fire >daily) gets the bounded-publication treatment by default; only threshold-breach earns a PR. Otto-lesson candidate name: **Bounded-Publication Discipline**. **Review wave (added in this tick)**: 4 threads landed 14:50:51-14:52:00Z (3× Copilot P1 + 1× Codex P2). The Codex P2 was the structurally important one — my prior parser captured the host segment but discarded it before calling `gh`, so 3-segment `GH_REPO=HOST/OWNER/REPO` silently fell back to github.com. Fix: thread `REPO_HOST` through the env into the Python child, pass `--hostname` when set. Copilot P1s caught (a) too-loose validation (`/repo`, `owner/`, `owner/repo/extra` all passed), (b) drain-log Thread 1 resolution claimed in-repo MEMORY.md had a broken pointer it didn't have (only user-scope had it), (c) Lesson 3 was stale (claimed GH_REPO unsupported when this PR is what added it). Future-self lesson: **don't claim "pre-existing X exists in Y" without grepping Y first**. The drain-log is itself a substrate file; misstating its claims is misinforming a future-self that reads it for ground truth. Pattern: any drain-log claim that asserts an external file's contents must have a verification step (grep/ls/read) within the same edit — claim-without-verify is the failure mode this round caught. Otto-lesson candidate name: **Drain-Log Claim Verification Discipline**. |

docs/hygiene-history/ticks/2026/04/29/1517Z.md

@@ -0,0 +1 @@
+| 2026-04-29T15:17:09Z | claude-opus-4-7 | b9ccd753 | **🎯 0/0/0 RE-CLOSED post-double-hop. AceHack/main = LFG/main = `17a26370ea5eb979406a3913d57348d3b647afd8`.** Sequence: PR #846 (LFG forward-sync v2 of post-#101 follow-up) merged 15:12:14Z (squash → `17a26370`); read-only absorption gate packet presented to Aaron 15:14Z; Aaron `EXECUTE` 15:17:06Z (with characteristic *"why are you waiting on me"* — flagged as future-self lesson on standing-authority cadence); absorption ceremony executed 15:17:06-15:17:09Z. Steps A→D all green: ruleset 15524390 disabled → force-with-lease push from `b7a6a95d` to `17a26370` → ruleset restored → SHA equality verified. Independent post-execute re-check: AceHack/main = LFG/main = local main = `17a26370ea5eb979406a3913d57348d3b647afd8`; ruleset enforcement=active; file content diff empty. **The double-hop discipline (AceHack-first → LFG forward-sync → AceHack absorbs LFG squash-SHA) closed cleanly under live conditions for the first time post-pre-v1 baseline.** Aaron's load-bearing concern *"without the double-hop in a few hours we'll be right back to where we started"* — answered: round-trip executed without divergence accumulation; the only intra-round transient divergences (during PR #845 forward-sync, then PR #846 forward-sync) were each closed by their absorption ceremony within minutes. **Substrate captured this round (cumulative)**: (1) Bounded-Publication Discipline pattern (Amara) — measure frequently / persist append-only / escalate on threshold / roll up daily / never spam PRs hourly unless threshold breached; (2) Drain-Log Claim Verification Discipline (Otto-358 candidate) — drain-log assertions about other files' contents must include grep/read/ls evidence in same edit; (3) Tick-history fast-path policy design (Amara two-tier) — trusted actor + safe path + safe operation; (4) docs/ops taxonomy (Amara) — runbooks/patterns/incidents/ tree, *"Memory remembers. Runbooks instruct. Incidents narrate. Patterns generalize."*; (5) Bounded-retry-CodeQL discipline (Aaron) — empty-commit-retrigger is a workaround, DST bounded-retry is the fix; (6) Review-ensemble complementarity confirmed — Codex caught the structurally-deepest bug (host-segment discarded silently), Copilot caught surface P1s, both irreducibly contributed; (7) gh CLI GraphQL 401 diagnostic runbook (working-tree, awaits docs/ops/runbooks/ migration in #318). **Next lane per Amara sequencing**: #315 hourly-measure-bounded-publication budget cadence (HIGH-priority), then #319 bounded-retry CodeQL, then #318 docs/ops taxonomy, then #317 tick-fast-path policy, then #316 absorbed into #318, then #313/#314 fork-name discipline, then branch/worktree recovery (gates on completion of items 1-7). Cron `b9ccd753` alive. | [PR #846 merged](https://github.com/Lucent-Financial-Group/Zeta/pull/846) → [AceHack/main now at 17a26370](https://github.com/AceHack/Zeta/commit/17a26370ea5eb979406a3913d57348d3b647afd8) | **Best blade across the round**: *"Maintainers may append events fast; everyone reviews projections."* (Amara, on tick-history fast-path design) — but the operationally-richest blade was Aaron's *"why are you waiting on me"* on the absorption-EXECUTE gate. The literal answer was *"Amara's gate-packet protocol said 'Do not execute yet until Aaron says EXECUTE'"* and Aaron typing `EXECUTE` was the green-light. Future-self lesson candidate (Otto-359 to be filed): once a maintainer has shown a precedent of granting standing authority to a fully-staged execute path on prior identical absorption ceremonies, AND the new packet is structurally-identical to the prior one, the agent may proceed on EXECUTE-or-better implicit consent rather than pausing for fresh explicit consent each time. The bound on this rule: only when packet shape, gate-list, and risk class are unchanged from the prior consented round. Drift in any of those = ask again. |

memory/MEMORY.md

@@ -3,6 +3,7 @@
 **📌 Fast path: read `CURRENT-aaron.md` and `CURRENT-amara.md` first.** <!-- latest-paired-edit: fork-audit R/C/T diff-filter coverage + plumbing-vs-porcelain note (2026-04-29 round-10 Amara). NOTE: this comment is a single-slot "latest paired edit" marker (not a paired-edit log). Per the round-10 Amara framing the slot semantics are now explicit. -->
 
 - [**0/0/0 ACHIEVED + AceHack/Zeta protection-config dual-layer (Aaron, 2026-04-29)**](feedback_protection_config_dual_layer_legacy_deleted_rulesets_canonical_2026_04_29.md) — Hard-reset succeeded after dual-layer surprise (legacy + rulesets on AceHack/main, both enforcing). Aaron: legacy DELETED, rulesets canonical. GH013 = rulesets, GH006 = legacy. Old tip preserved at `archive/acehack-main-pre-000-reset-2026-04-29`.
+- [**gh CLI GraphQL/REST 401 diagnostic runbook (Otto + Amara, 2026-04-29; ops-tree migration pending #318)**](reference_gh_cli_graphql_401_diagnostic_runbook_2026_04_29.md) — Diagnostic runbook for the failure mode where `gh auth status` reports authenticated but `gh api graphql`/`gh api user` returns 401 while `gh api -X POST graphql` works. Captured during PR #846 review wave when the auth glitch hit local gh + GHA CodeQL SARIF upload simultaneously. Amara framing: diagnostic note, not doctrine yet. Long-term home: `docs/ops/runbooks/gh-cli-auth-401.md` per task #318 docs/ops taxonomy; lives in memory/ for now as interim.
 
 - [**Bare `main` is ambiguous — automation uses explicit refs (Amara, 2026-04-29)**](feedback_bare_main_ambiguity_automation_discipline_explicit_refs_required_amara_2026_04_29.md) — Generic multi-remote-repo automation rule: scripts use `refs/remotes/<remote>/<branch>` (or `refs/heads/<branch>`); bare branch names only for interactive humans. Hard-stop on fatal base-ref errors. Caught when bare `git checkout main` was hitting `fatal: matched multiple (2) remote tracking branches` and the loop continued past the failure with wrong downstream state.
 

memory/reference_gh_cli_graphql_401_diagnostic_runbook_2026_04_29.md

@@ -0,0 +1,97 @@
+---
+name: gh CLI GraphQL/REST 401 — diagnostic runbook
+description: When `gh auth status` reports authenticated but `gh api graphql` / `gh api user` returns 401, run this short triage before assuming token-expired. Captured 2026-04-29 during PR #846 review wave; Amara framing "diagnostic note, not doctrine yet."
+type: reference
+---
+
+# gh CLI GraphQL/REST 401 — Diagnostic Runbook
+
+## When this triggers
+
+`gh auth status` shows green ("Logged in to github.com"), keyring
+token present, but operations fail with `HTTP 401: Requires
+authentication`. Specifically observed on these endpoints:
+- `gh api graphql -f query='...'` (default GET behaviour)
+- `gh api user`
+- `gh api --hostname github.com graphql ...`
+
+While these still work:
+- `gh api repos/<owner>/<repo>/...` (REST repo-scoped, public repo
+  endpoints — gh falls back to anonymous access)
+- `gh api rate_limit` (succeeds even with the same auth glitch)
+- `gh api -X POST graphql -f query='...'` (explicit POST flag)
+
+## Triage in order
+
+1. **Confirm `gh auth token` works**: `gh auth token | head -c 8`
+   should print the first 8 chars. If empty, the keyring entry
+   is genuinely missing → `gh auth login` is the answer.
+2. **Test direct REST anon vs auth path**: `curl -s
+   https://api.github.com/repos/Lucent-Financial-Group/Zeta/pulls/846`
+   succeeds without auth (public repo); compare with the gh
+   command. If gh fails but anon curl works, gh is reaching
+   the auth path and failing there.
+3. **Test `gh api -X POST graphql`** with an explicit POST flag:
+   `gh api -X POST graphql -f query='query { viewer { login } }'`.
+   If this succeeds when `gh api graphql` (no `-X`) fails, gh's
+   default routing is at fault, not the token.
+4. **Test `gh api rate_limit`**: succeeds = token IS authenticating
+   on at least some endpoints. Indicates a partial-failure pattern,
+   not a flat-out invalid token.
+
+## Working workaround
+
+Until upstream resolves, force POST on every graphql call:
+
+```bash
+# instead of:
+gh api graphql -f query='query { ... }'
+# use:
+gh api -X POST graphql -f query='query { ... }'
+```
+
+Wrapper option for scripts:
+
+```bash
+gh_gql() {
+  gh api -X POST graphql "$@"
+}
+```
+
+## Sibling failure mode — CodeQL SARIF upload 401
+
+The same auth-service hiccup that breaks local `gh api graphql`
+can also break CodeQL's SARIF upload step in GitHub Actions:
+
+```
+##[warning]Requires authentication - https://docs.github.com/rest
+##[error]Please check that your token is valid and has the required
+permissions: contents: read, security-events: write
+```
+
+The CodeQL "Default Setup" workflow run (event:`dynamic`) cannot
+be retried via `gh run rerun --failed` ("This workflow run cannot
+be retried"). The explicit `pull_request` CodeQL run can be retried.
+
+## What this is NOT
+
+- NOT proof of token expiration (fresh keyring tokens see this).
+- NOT proof of upstream API outage (most endpoints work).
+- NOT a gh CLI version-pin signal (no specific version known to
+  break this; observed on whatever `gh --version` resolves on the
+  maintainer laptop 2026-04-29).
+- NOT yet doctrine. Amara framing: *"I would not turn that into
+  doctrine yet, but I would capture it as a diagnostic note: when
+  gh claims authenticated but GraphQL/REST 401s, explicitly test
+  gh auth token, REST unauthenticated curl, and gh api -X POST
+  graphql. It may be token/session/cache weirdness, but it is
+  worth a tiny runbook entry."*
+
+## Trigger memory
+
+PR #846 review wave 2026-04-29T~14:50-15:01Z. After resolving 4
+review threads via `gh api graphql -X POST` mutations (which
+worked), the next heartbeat poll's `gh api graphql -f query`
+returned 401. The `-X POST` workaround restored function. Same
+window saw CodeQL Default-Setup csharp + js-ts SARIF uploads fail
+with the same error class.