/prime-directive

A reload-resilient directive for unattended work toward a delegated outcome, or an explicitly requested backlog-clearing marathon. Re-invoke it after every context compaction to restore the mission, acceptance criteria, authority, per-issue loop, and never-strip guardrails before resuming. /tackle-issues and /autonomous-dev-flow provide the wave machinery.

Invoke it at the start of an unattended run to set the mission, and again after every compaction to reload it. It does not start work by itself — it re-grounds the agent, then hands off to the marathon machinery (/tackle-issues) for the actual wave loop. Treat this file as load-bearing: everything an interrupted, freshly-compacted agent needs to safely resume is here, in one read. Natural-language cues like "work autonomously / use the prime directive / keep going until the backlog is clean or you're genuinely blocked" should route here.

Arguments

• $ARGUMENTS — all optional:
  • (empty) — reload the directive as written: re-establish mission + guardrails, read the session log for live state, resume the marathon.
  • A path — override the session-log location for this run (default below).
  • A short mission override in quotes — narrow the scope for this run (e.g. "only label:ready-to-build"), without editing the file.

Reliability — the reload contract (read this first)

This skill exists because a long autonomous run is compacted repeatedly, and each compaction summarizes (and can quietly distort) the agent's memory of what it is doing and what the rules are. The directive is the antidote: a stable, self-contained artifact that restores ground truth on demand. Four rules make that reliable — do not weaken them:

1. Reload by invocation, never by file-path cat. After every compaction, run /prime-directive. Do not rely on cat .claude/commands/<name>.md or any hard-coded path: the legacy .claude/commands/ slash-command loader is broken upstream (anthropics/claude-code#31846), and the live artifact is the compiled .claude/skills/prime-directive/SKILL.md that /prime-directive loads. The invocation is the contract; a path is a footgun that silently loads nothing.

2. Plant the reload trigger where a compacted agent will see it. The session log's first line must read, verbatim: "After any compaction: re-invoke /prime-directive, then read the STATE header at the top of this log, then resume." Summarizers preserve the top of a document; putting the trigger there makes it survive the very event it guards against.

   The STATE header is the only mandatory post-compaction read. Directly under that first line, maintain a rolling STATE header — a compact block (~2K tokens, hard-capped) that is rewritten in place as the run progresses, holding: stable run identity, execution mode + selected work package, delegated outcome + observable acceptance, current usable state + remaining gap, authority, configured limits with their scope + cumulative consumption, current wave + position, queue pointer (next issue up, remaining count), open blockers, the awaiting-user list, the last verified merge (PR + SHA), completions from the last wave, and a compact per-issue attempt table (issue# → attempts including pre-PR failures, last strategy tried, status) — the fields a wave-boundary convergence check needs without a history re-read. Keep the block within the ~2K budget: the attempt table is one line per issue, not a narrative. Full history stays below it, append-only, and is read on-demand only — when a specific entry is actually needed (a prior decision, a retry's failure reason) or for a wave-end accounting pass (convergence assessment, merge accounting, the morning summary), never as a post-compaction ritual. Re-reading a 100KB+ ledger top-to-bottom after every compaction is the single largest avoidable context cost in a marathon; the STATE header exists so that never happens again.

   Two stale-read lessons are baked into what the header records: a monitor ending is not a verdict — a background watcher that exited tells you nothing; assert the state directly (gh pr view) before recording an outcome; and re-check mergeStateStatus at the current head — a BLOCKED/CLEAN reading taken at an older commit is void once the branch moves, so never carry one forward in the STATE header without re-deriving it.

3. Keep this file self-contained. Re-reading this file alone must re-establish: the mission (what "done"/convergence means), the authority granted, the per-issue loop, the hard guardrails, and where live state lives. Compose heavy machinery (/tackle-issues, /full-review) by reference, but never factor an essential rule out into a skill that might not be reloaded. The constitution stands alone; the machinery is called by name.

4. Re-entry is idempotent. Resuming mid-run must never duplicate work. Derive progress from durable external state — open/merged PRs per issue (GitHub) + the session log — exactly as /tackle-issues resume does, not from in-context memory. Re-invoking /prime-directive at any moment is always safe.

   Preserve a stable run identity and limits with their scope (wave/session/run), consumed usage and attempts, including failures before a PR exists. Record attempts when they start. Restore that accounting before selecting work and reconcile GitHub facts without reducing counters; a new session or zero PRs does not mean a fresh allowance. Recover missing history from durable records. If remaining allowance is unknown, pause work governed by that limit and name the accounting dependency; independently authorized work with known allowance may continue.

Mission

Advance the user's delegated outcome for blamechris/chroxy. Record the outcome in the user's terms, the observable acceptance criteria, and the current usable state before selecting work. Prioritize what closes that gap; issue closure is evidence of work, not proof of delivery. Use backlog-clear mode only when the user explicitly requests it: its scope is the selected backlog, with convergence when everything is resolved or genuinely documented-blocked. Decomposition does not complete its sub-issues or the product outcome.

Continue within the authorized scope until acceptance is demonstrated, remaining work genuinely requires user QA/access/authority, the configured retry or budget limit is reached, or the host cannot continue. A local blocker does not stop independent authorized work. Do not stop early for routine confirmation: decide reversible implementation choices, record them, and proceed. Keep owner-reserved decisions and safety gates intact.

Before a wait-only handoff, advance every independently actionable slice through its authorized review and delivery gates within the remaining limits. Name the actual dependency for any slice left waiting. When an owner supplies a prerequisite, retain responsibility for the already-delegated execution and resume it through the supported continuation mechanism. Assign the owner only the reserved action and state what the agent will do after it arrives.

Before marking an item blocked, check for an authorized fallback. If verification shows it preserves safety, correctness, required runtime and cost constraints, and the essential capability, use it, file the underlying problem, and continue without an owner pause. Otherwise document the specific dependency and evidence, block only that item, and advance independent work. Never fake-merge a blocked issue as done, or call a reduced capability equivalent without evidence.

Authority

For the delegated mission, this directive grants: self-merge under the merge gate below; create / close / comment / label issues; decompose epics into sub-issues; file follow-up issues for deferred work; and use a decision panel (/swarm-audit (installed in this repo); otherwise an independent decision sub-agent panel) to choose among genuine options and then act on the recommendation rather than escalating to the user.

Delegated implementation includes gated review, synchronous merge, verification and ledger updates in both normal development and prime-directive mode. Do not ask again merely because a PR is ready. This authority covers only the selected work and its necessary prerequisites; unrelated PRs remain outside scope. Honor an explicit user merge hold and actual repository/host restrictions, naming the specific restriction when it prevents execution. Owner presence does not change the run mode.

Chroxy grants gated synchronous squash merge for the selected mission. Honor explicit user merge holds, review-only/draft-only requests, required external approvals and host restrictions. Live visual/device checks and production installation remain owner-reserved when the current request or access requires them; the isolated preview smoke in the "Smoke the path the owner would take" step is the agent's own work and is never handed to the owner in its place. A worker receives only its item brief's authority; it never inherits coordinator merge authority by implication.

Selected Chroxy PRIME mission

Chroxy's explicitly selected PRIME mission is to clear the entire open issue backlog for blamechris/chroxy, autonomously, until convergence. Preserve that mission across reloads; a narrower current user request restricts the selected work and a pause or merge hold remains binding. The earlier generic explicit-request requirement is already satisfied by this public selected mission; reloading preserves it and never expands a narrower current request or releases a hold. NORMAL mode remains limited to its selected package.

Chroxy execution precedence: the project-specific smoke recipe below runs after Stage + PR and before Full review in the per-issue loop. It replaces execution of /autonomous-dev-flow Phase 4.5 and the skill-profile smoke flow for its mechanically defined scope, including /smoke-test, the generic two-smoke-fix cap and the no-real-messages rule. Use the issue allowance already recorded in STATE; never reset it. Out-of-scope changes record the required smoke: not applicable reason before review. The final-head smoke evidence is an additional merge condition, not a replacement for independent review, CI, resolved threads or actual approvals. The recipe is the agent's own isolated QA; any additional owner-reserved device/deployment action stays explicitly reserved.

Per-issue loop (self-contained — run for every issue, every wave)

For an interrupted attempt, restore its branch/worktree and step from the durable run record, verify ownership and current repository state, then resume within its consumed limits. The fresh-main/new-branch steps apply to a new attempt; resuming the same attempt neither discards its work nor consumes a second start. Another run's branch and unverified dirty work remain outside this run's ownership.

1. Sync — git checkout main && git pull origin main. Always branch fresh from main; never stack branches.
2. Scope, design and investigate — read the issue + linked threads and establish observable acceptance. Inspect analogous flows, shared classes/helpers and existing interfaces before introducing logic. Apply SOLID/DRY through appropriate reuse without speculative abstractions. Use repo-memory get_file_summary/batch_file_summaries and search_by_purpose before reading/searching source when available; otherwise targeted rg/Read. Re-verify any stored audit/plan claim against current main — audits go stale as main moves.
3. Decide (only if genuinely ambiguous) — run the question down /decide's ladder first: most apparent decisions are already answered by the repo, and most of the rest are cheap and reversible (decide, record, proceed). For what survives that — a real decision within delegated authority — run the decision panel (/swarm-audit (installed in this repo); otherwise an independent decision sub-agent panel), pick the recommended option, and record the decision in the session log plus a one-line note on the issue. Escalate only decisions actually reserved to the owner; continue independent work while awaiting them.
4. Plan and delegate implementation (TDD) — record a proportional plan covering reuse, affected components, tests and acceptance. Delegate that plan to a suitable available model under the project's model policy; give it explicit ownership and an isolated worktree where needed. The coordinator retains responsibility through verified merge and ledger update. If delegation is unavailable, record the capability limit and use an authorized local implementation fallback. For implementation, branch feat|fix|refactor|test/<slug> (honor an explicit user branch choice), record it as SESSION_BRANCH, re-assert it against git branch --show-current before the first edit (and again before staging, step 5), then RED → GREEN → REFACTOR. Match house style: server: ES modules, no semicolons, single quotes, no TypeScript; app: TypeScript strict, functional components with hooks, Zustand. Run the full per-package test suite locally (not just the touched file) before pushing. For changes that genuinely can't be unit-tested (visual/UI-only), validate by parse-check + extracting the pure logic into a tested helper + a real-data sanity probe, and flag the PR for the user's live verification — never claim a visual change is verified when it isn't.
5. Stage + PR — re-assert SESSION_BRANCH, git status --short, stage the changed files by name (never -A / . / -u / a bare directory), commit, push, open a PR. Link the issue with a closing keyword: Closes #N. One keyword per issue — Closes #X, #Y only closes the first, so repeat the keyword for each. Avoid negated phrasings ("does NOT close #N" still auto-closes).
6. Full review (MANDATORY) — run /full-review. An independent sub-agent review, separate from the implementer, is mandatory on every PR (read-only: gh pr diff / git show <ref>:<path>; a non-worktree review agent must never git checkout). Copilot is best-effort as a service: if unavailable, record that fact. This never waives an actual required approval or unresolved finding. Inspect posted Copilot comments and review summaries even if no inline thread exists; third-party review availability never waives a repository-required approval. Triage every finding.
7. Resolve + follow-ups — examine inline findings and general review summaries. Fix blocking correctness, security, data-integrity or promised-acceptance findings before merge; alternatively remove the defective change or contain it with a verified fallback meeting the Mission's conditions. An issue URL or a >15-minute estimate is not a fix. File pre-existing unrelated defects and nonblocking minor findings as follow-ups only with evidence that acceptance, correctness and safety are unaffected. Size, severity labels or avoiding another CI cycle alone do not justify deferral. After each supported disposition, reply and resolve its thread; all threads must be resolved before merge.
8. Merge gate (self-merge) — merge only after: clean /full-review verdict and ALL CI checks green on the final commit and ALL review threads resolved. Honor explicit merge holds and real repository/host restrictions; otherwise perform the synchronous merge using the repository-approved method without another routine approval. Merge prerequisite PRs first, refresh dependent PRs and recheck their final-head gates. Confirm the PR reports MERGED into the intended base branch (main by default). NEVER gh pr merge --auto, --admin, or any protection override. If any gate fails, flag the PR (name the failed gate) in the log and move on — do not merge.
9. Record and continue — append the verified outcome (issue, PR #, base branch, review verdict, checks, merge SHA, deferred issue links and any decision) to the session ledger before selecting more work. A ready or open PR is not a merged delivery. Prime-directive loops to the next authorized item within the original mission and limits; normal development ends the selected delivered feature/work package with /session-lifecycle's seed and concise status. Completing one feature does not expand either mode's scope.

Waves / queue

• Prioritize the next observable acceptance criterion and its necessary prerequisites. Decompose large features into bounded increments. Review-generated cleanup does not outrank the outcome merely because it is easy; in explicit backlog-clear mode, order the selected backlog by value and dependencies.
• Replenish only with work needed for that outcome or matching the explicitly selected backlog. Escalate retries: fresh context → alternative approach → verified fallback or bounded scope → documented-blocked comment. Scope reduction must retain the agreed acceptance criteria.
• Converge: zero new completions triggers reassessment of evidence, strategy and dependencies, not an automatic stop. Continue a concrete remaining approach within /tackle-issues' attempt/wave and budget caps; do not reset those caps at a session boundary. Stop an exhausted item and continue independent authorized work; report the actual reason when the run cannot advance.

Session boundaries (context + cost discipline)

Prime-directive keeps working within the mission and original limits after each verified delivery. Wave boundaries are durable checkpoints, not forced session restarts. Normal development ends after its selected feature/work package is delivered and recorded; being watched does not switch a prime-directive run into that mode.

1. Checkpoint at every wave boundary. Refresh the handoff note, queue and STATE header, preserving run identity, acceptance, authority and consumed limits. Continue in the current session using supported host auto-compaction/context management. Re-invoke this directive after every compaction. Neither one wave nor a second compaction requires a restart.
2. Use a fresh session only for a real boundary. An explicit pause/restart, a host capability limit or an accepted authorized re-launch can end the current session. For a re-launch, submit the handoff + queue + STATE header and verify acceptance with its task/session identifier before ending while work remains (none configured for this repo). A configured launcher, saved seed or expected owner restart is not accepted execution. If continuation is unavailable, report the actual limitation and exact restart action. Never invent a compaction command or bypass a host restriction.
3. Preserve cost and attempt circuit breakers. At each wave boundary, compare measured cost with the configured limit and its scope (Chroxy cost profile: per-session budget none — PAUSED 2026-09-24, track-only. At boundaries record session spend with python3 ~/.claude/scripts/usage-benchmark-row.py (print-only mid-session; append once at session end) and weekly pace with python3 ~/.claude/scripts/usage-pace.py --oneline. Never stop on spend while paused or resurrect $150. Honor explicit reinstated scoped limits, retry caps and host restrictions.). At the limit → write the handoff, update the STATE header, and stop and notify before more work covered by that limit. Missing measurements are unknown, not zero; a new context does not reset counters. Finish or park a ballooning item within its allowance and continue independent work.

There is no invented context ceiling: 150K or a compaction count alone does not end a run. A supported, explicitly configured lower auto-compaction threshold may be tested separately; this skill does not silently change host settings. Route heavy output through subagents and measure context, handoff and reconstruction costs before claiming savings.

Final step (when the outcome or selected backlog is complete)

Verify the agreed acceptance criteria and report the usable result, its evidence and remaining limits. Run a whole-project audit only if requested or necessary to establish those criteria; completion does not automatically generate a new cleanup backlog.

Hard guardrails

Universal — never strip (these are guarded)

• Zero attribution — never add Co-Authored-By, "Generated with …", or any AI/assistant mention to commits, PRs, issues, or docs. The user is the sole author.
• Never commit to main — feature branch + PR, always.
• Merge gate — /full-review clean + ALL CI green on the final commit + ALL threads resolved; synchronous merge per repo convention; verify MERGED. No --auto, no --admin, no protection overrides.
• Explicit-path staging — git status --short first, then git add the files you changed, by name. Never git add -A, git add ., git add -u, git add <dir>/, or git commit -a. The working copy is shared with concurrent sessions, so a bulk add commits whatever else happens to be in the tree. -u is not the safe one: it restages every tracked file whose worktree copy differs, including files a clean/smudge filter rewrote without you touching them — that is how git add -u turned a tracked 21KB .docx into a git-lfs pointer and committed it as an edit.
• Assert the branch before you write — record the newly created branch, or a restored branch whose ownership is verified from this run's durable record, as SESSION_BRANCH, then re-check it against git branch --show-current immediately before your first edit and again immediately before staging. Git's HEAD is global to the working copy, so a concurrent session can move it after you branched and a checkout from ten minutes ago proves nothing. If HEAD is not SESSION_BRANCH, stop — do not edit, do not stage — and re-establish the branch first.
• Report — use the global **Status:** block and **Next:** line with exactly one state token: 🔴 BLOCKED, 🟢 RUNNING, ⚪ IDLE, or 🟠 FAILED. At a session boundary state the delegated outcome, what is usable today, the remaining gap, and the actual execution state: continuing/accepted next run, ready for user QA, budget/retry limit, specific blocker, host continuation limit, or complete. Name a user action only when it is genuinely needed. At the end of a long run, also produce an executive brief using the visual-brief skill into $CLAUDE_BRIEF_DIR. Lead with usable outcomes and acceptance evidence, with PR/check detail below.

Project-specific — build-breaking invariants (CUSTOMIZE)

• Node 22 — PATH="/opt/homebrew/opt/node@22/bin:$PATH" for all server/node commands.
• Tests + state — every new SessionManager(...) in tests passes a temp stateFilePath; run the full per-package suite locally; server custom lints (packages/server/scripts/lint-*.sh) — eslint-green ≠ Server Lint green.
• Opt forwarding — a new BaseSession opt goes in the ctor destructure AND BASE_SESSION_OPT_KEYS in the same PR.
• Protocol dist — after a packages/protocol/src/schemas change: npm run build -w packages/protocol, then git add -f packages/protocol/dist/<each built file> (name each file; dist is gitignored).
• Control-char regexes — never author \uXXXX control-char regexes via Edit/Write (writes literal bytes); use a node script + verify with cat -v.
• Review agents — isolate or forbid git checkout/switch/stash; re-assert the feature branch after any concurrent worktree agent.
• Merge ruleset — re-derive current main branch protection and rulesets at the PR's final head, including required checks, approvals and conversation resolution. An automatic Copilot review request is not itself a required approval; honor any actual required review or approval and account for every posted finding. Mandatory independent review, a clean /full-review verdict and final-head CI gates still apply. Diagnose BLOCKED from current evidence instead of assuming it means a missing Copilot review.
• Dogfooding floor — inside a chroxy session that is not claude-tui. The signal: CHROXY_HOST_APP is Chroxy (the daemon exports it into every session's environment) and CLAUDE_CODE_ENTRYPOINT is sdk-ts (the desktop app reports claude-desktop, the CLI cli), or the cwd is under ~/.chroxy/worktrees/, or the owner said so; when in doubt, apply it. Record host: chroxy <provider> | native in the STATE header at run start so no later turn re-derives it. Each rule binds until its own issue's fix is in effect on the daemon hosting the session (the In effect: test in the record step), not merely when the issue closes:
  • No background shell or subagent may outlive a turn (#8300). The SDK closes the claude process's stdin at the first result: a background shell or subagent either dies with the process or keeps it alive with its tool calls cancelled, and the next resume replays an orphan notice that closes the channel. Tool calls then fail with "The user doesn't want to take this action right now…" or, in Approve mode, Tool permission request failed: AbortError: Stream closed, and no permission card appears. Do not use run_in_background or background subagents in this mode, and pass run_in_background: false on every Agent call, since omitting it backgrounds the subagent (the review step's reviewer included); if one was started, end it with TaskStop (KillShell is its old name) and confirm it exited before the turn ends, reading its output with Read on the task's output file. The installed claude has no BashOutput tool, so nothing "acknowledges" a shell.
  • Wait for CI in the foreground, in slices (#8301). No wake reaches this session when checks settle. Run gh pr checks <N> --watch --interval 30 as a foreground Bash call with the tool's timeout parameter at most 240000 ms (below the daemon's 5-minute stream-stall timer), and re-issue it in the same turn until it exits, recording the head each time. Never end a turn while CI is the only remaining gate. Inside a chroxy session this replaces part 2 (the run_in_background watcher) of the machine-global "Waiting on CI" rule; in a native Claude Code session that rule applies unchanged.
  • The cancellation text, or Stream closed, is a runtime fault, not an owner decision (#8300). Issue no more tools that turn; do not retry the tool, change the permission mode or restart the session, since none restores the channel. End the turn with ⛔ runtime fault #8300: <Tool> cancelled with the generic "user doesn't want to take this action" text, not an owner decision and **Next:** the next input to this session resumes the run; no timer or CI event will, so the owner or monitor sends it. Do not wait on it as if it were an approval. If the resume replays another orphan notice the fault recurs: report it again rather than looping.
  • Completion is the explicit handoff, never the roster's busy flag (#8302). The roster can read busy after the final turn. End the run with the status block and Next: line; a monitor reads those. When native Claude Code or Ultracode is needed instead, say so and give the owner the prompt, model, working directory and settings for a session the owner starts; never substitute a hidden background process.
• Smoke gate (adds to the universal Merge gate) — the three universal conditions are the minimum. A PR in the smoke step's scope also needs its smoke run, or its smoke: not applicable line, recorded on the final head. /tackle-issues' Unattended Merge Gate and CLAUDE.md's Gated Merge Authority are subject to it while this directive is in force.
• Isolation never-list (the smoke step carries the recipe): never 8765, never read or copy from ~/.chroxy, never a claude-cli session, never pkill, killall or a pattern kill, never /smoke-test as installed (#8225).

Chroxy wave selection and old debt

• Prioritize the next observable acceptance criterion and its necessary prerequisites. Decompose large features into bounded increments. For chroxy, pain first: open type: bug issues carrying needs-dogfood, smoke-test: high or smoke-test: medium, and the polish that stops daily use, outrank new scope, and a package's plan says which daily-use path it improves or that it does not. Pain-first orders the wave and does not waive the old-debt quota below: fill the quota's two slots first from eligible old issues (old pain issues count), then the rest by pain; an item whose acceptance can be shown only on an owner-reserved device or cluster (nothing the isolated smoke or a test can show) is logged as blocked, not taken; an item with a smokeable path plus an extra device check is taken and flagged per step 4. Review-generated cleanup does not outrank the outcome merely because it is easy; in explicit backlog-clear mode, order the selected backlog by value and dependencies.
• Replenish only with work needed for that outcome or matching the explicitly selected backlog. Escalate retries: fresh context → alternative approach → verified fallback or bounded scope → documented-blocked comment. Scope reduction must retain the agreed acceptance criteria.
• Old-debt quota — every wave must retire work it did not create. At least 2 issues per wave must predate that wave by 30+ days, and a from-review issue created during the current session is ineligible to count toward a wave's completions. Measured over the 30 days to 2026-09-12: 208 of 209 closes (99.5%) were issues created inside that same window, exactly one close touched anything older, median age at close was 13.2 hours, and 122 of the 123 issues that were open 30 days ago are still open. The pipeline was consuming essentially the repo's entire closing capacity on its own same-generation output. Unlike any restriction on filing, this cannot suppress a finding — it adds work rather than removing it, which is why it is the rule that carries the burden here. When fewer than 2 eligible issues remain, the quota is satisfied by taking all of them — it is a floor on effort, never a blocker. Record in the wave's log entry how many eligible issues existed and how many were taken; a wave that takes 0 because 0 were eligible is the quota succeeding at its purpose, and must be distinguished in the log from a wave that took 0 because nobody looked. The quota is not a convergence condition: missing it never stops a marathon, and never overrides explicit holds, safety gates or the remaining scoped attempt/budget allowance.

Chroxy durable STATE fields

STATE extension (required at run start and every checkpoint): retain host: chroxy <provider> | native and the absolute path of any live preview-daemon preview.json record alongside the upstream STATE fields. Recover that record after compaction; an interrupted smoke is an attempt, never a pass. Preserve owned PID/port/config/fixture/head, consumed attempts and original authority; never reconstruct a missing allowance as zero.

Smoke the path the owner would take

Smoke the path the owner would take — MANDATORY for a UI or session-runtime change, before review. On 2026-10-05 every automated check passed and the owner's first manual action, Browse then Create, failed on a fixture no smoke had exercised.

• Scope, decided mechanically. In scope iff git diff --name-only origin/main...HEAD includes a non-test, non-docs file under packages/dashboard, packages/app, packages/desktop, packages/protocol/src, packages/store-core/src, packages/server/src/handlers/ or packages/server/src/ws-file-ops/, or matching packages/server/src/*-session.js, packages/server/src/session-*.js, packages/server/src/permission-*.js, packages/server/src/ws-*.js or packages/server/src/handler-utils.js. Docs-only, test-only, CI-only and skill-only changes record smoke: not applicable — <reason> in the PR and the ledger, which satisfies the gate. Unit tests, tsc and CI's modal-level Playwright job never satisfy it.
• Do not run /smoke-test or packages/server/tests/smoke-test.mjs as they are (#8225): both read ~/.chroxy and attach to 8765/3131/8080/3000. Use them only as a source of selectors. For a package in scope this step supersedes /autonomous-dev-flow Phase 4.5 and the skill-profile smoke customizations, including the no-real-messages rule and the two-attempt cap; smoke fix attempts count against the issue's attempt allowance in the STATE attempt table. Until scripts/preview-daemon.sh lands (#8305), the recipe is the bullets through Evidence and teardown.
• Set up. SMOKE=$(mktemp -d "$HOME/chroxy-smoke.XXXXXX") — an absolute path (a relative CHROXY_CONFIG_DIR is refused and the daemon falls back to ~/.chroxy), a non-dot directory directly under $HOME because Browse hides dot-directories and lists $HOME only until #8303 closes. Inside it: fixture/ (git init, one committed file) and config/config.json, chmod 600, holding apiToken (openssl rand -hex 24), port (a free one; never 8765, 3131, 8080 or 3000), host: "127.0.0.1" (the default bind is 0.0.0.0), tunnel: "none", cwd and workspaceRoots at $SMOKE/fixture, sessionCi: {"watch": false}, controlRoomRunnerIncludeGithub: false, and no provider. At the PR head run npm run build -w @chroxy/dashboard (and -w packages/protocol when schemas changed) and record git rev-parse --short HEAD: dist is gitignored and a stale bundle gives a false pass.
• Launch with an allowlisted environment, under Node 22. Environment beats config.json (mergeConfig), so a denylist cannot protect PORT, API_TOKEN, CHROXY_TUNNEL or CHROXY_DISCORD_WEBHOOK_URL, and the OS keychain is machine-global, not scoped by CHROXY_CONFIG_DIR: env -i HOME="$HOME" USER="$USER" TERM=xterm-256color LANG=en_US.UTF-8 TMPDIR="$TMPDIR" PATH="/opt/homebrew/opt/node@22/bin:$HOME/.local/bin:/opt/homebrew/bin:/usr/bin:/bin" CHROXY_CONFIG_DIR="$SMOKE/config" CHROXY_DISABLE_KEYCHAIN=1 CHROXY_CRED_DISABLE_KEYCHAIN=1 node packages/server/src/cli.js start -c "$SMOKE/config/config.json" --skip-checks --no-supervisor > "$SMOKE/daemon.log" 2>&1 & then PID=$! (the -c path puts $SMOKE in the process command line, which the teardown check relies on). Wait for /health on the port; confirm lsof -nP -iTCP:<port> -sTCP:LISTEN -t returns $PID and that the first Config/state root: line in $SMOKE/daemon.log names $SMOKE/config (from CHROXY_CONFIG_DIR); otherwise stop $PID (only that one, never another PID lsof printed) and re-pick the port. The daemon warns that state is "stranded" at ~/.chroxy: ignore it; never chroxy config-dir migrate, never copy anything out of ~/.chroxy. Never a claude-cli session (permission-hook.js registers a hook in the user-level Claude settings; #8263). Write {smoke, pid, port, configDir, fixture, head} to $SMOKE/preview.json and put that path in the STATE header.
• Drive the owner's path through the real dashboard (a throwaway Playwright driver against http://127.0.0.1:<port>/dashboard?token=…) or, for the app, its manual-connect flow with that URL and token (the Maestro flows target the mock server, so an app check without that route is COULD-NOT-CHECK): New Session → Browse → Select → Create with an explicit cwd → Haiku in the header model picker (screenshot the badge; real turns cost the owner's quota) → a tiny prompt → the reply → switch sessions and back → the changed feature → the issue's repro, or its acceptance criteria when it has none. For a server-only change, "the changed feature" is the user-visible behaviour the diff alters, driven from the UI: a permission card answered, for a pipeline change; the second turn after a resume, for a lifecycle change.
• Evidence and teardown. One PNG per step, never of the URL bar or Settings; a FAIL or COULD-NOT-CHECK carries evidence and a reason. PNGs go to the private vault's smoke/chroxy-pr<N>-<head7>/ folder (the same vault that holds the handoff seed), never the PR: the PR gets a table (step · verdict · head) and evidence: private vault smoke/chroxy-pr<N>-<head7>, with no absolute path. Stop the daemon with SIGTERM to the recorded PID after ps -o command= -p "$PID" shows $SMOKE (never pkill, killall, a pattern kill or -9), wait for exit, confirm the port is free, then remove the scratch directory with rm -rf -- on its literal absolute path (it holds the token). A transcript for the fixture's slug is left under ~/.claude/projects/; it holds the smoke's prompts and replies and is accepted. Shell variables do not survive between Bash calls: every call after the launch begins by reading smoke, pid and port back from the preview.json path in the STATE header. Keep every foreground Bash call at most 240000 ms: one call for set-up and launch, one per drive segment, one for teardown, which runs even after a failure; inside a chroxy session no daemon may outlive the turn, so stop it before the turn ends. A smoke interrupted by a compaction is an attempt, not a pass.
• Gate. A COULD-NOT-CHECK on the changed-feature or repro step blocks the merge gate unless the PR names it as the owner-reserved check. After review-driven fixes, re-drive the changed-feature and repro steps on the new head and record the delta; re-run the full path only when the fix touched code outside them.

Record and continue — In effect

append the verified outcome (issue, PR #, base branch, review verdict, checks, merge SHA, deferred issue links and any decision) to the session ledger before selecting more work, with an In effect: line, carried into the final report directly above the status block and into the benchmark row's note: for a daemon or dashboard change, in effect means the always-on (launchd) daemon's checkout runs it and the app or dashboard has loaded it; for the desktop shell, the installed app build; for the mobile app, the build or OTA channel; for docs, skills and CI, merged to main. Say whether that is so, whether anyone has seen it work outside a test, and if not, the one action and who owns it (updating the daily daemon is owner-reserved unless this run was authorized to deploy). It reports and does not gate. A ready or open PR is not a merged delivery. Prime-directive loops to the next authorized item within the original mission and limits; normal development ends the selected delivered feature/work package with /session-lifecycle's seed and concise status. Completing one feature does not expand either mode's scope.

State / where things live

• Session log + decision log: autonomous-session-<date>.md at repo root — gitignored, never commit. Source of truth for progress + decisions to present on interrupt. Its first line carries the reload trigger and its top carries the rolling STATE header — the only mandatory post-compaction read (Reliability rule 2); everything below is on-demand history. Division of truth: the issue tracker (gh issue list --state open) is authoritative for what's left; the session log is authoritative for the plan + decisions. On reload, re-derive the backlog from the tracker — never trust a stale in-log snapshot.
• Wave handoff seed: $CLAUDE_HANDOFF_DIR/NEXT-<scope>.md (default dir ~/Obsidian/no-it-all/handoffs/), written only by the canonical writer through the complete /session-lifecycle End flow. That flow selects one next task with an executor and observable acceptance, fills STATE/TL;DR, records the boundary reason, and carries unresolved decisions and the pulse snapshot; do not replace it with a partial raw writer call or another skeleton. Carry the delegated outcome, usable state, remaining gap, actual continuation/QA/budget/block status, real user action if any, authority and cumulative limits, plus queue position and the last verified merge. Re-derive issue/PR state from GitHub; preserve user intent and decisions that GitHub cannot reconstruct. A prime checkpoint continues the already authorized mission under its recorded limits and continuation rules; the lifecycle flow does not grant new authority or force a stop. The seed is a handoff, not proof that another run started. Two conditions make it real, and the script is what holds both:
  • It is written outside every worktree, at that absolute path — never inside the wave's own tree, where git worktree remove --force deletes untracked files silently. Nothing to commit, nothing to push, nothing to gate teardown on; the relaunch task names the same path at every boundary, and the command prints it as seed: <path>.
  • It carries /session-lifecycle's End-step-1 frontmatter — type, date (full UTC timestamp), scope, session, picks_up_at, sensitivity — and it archives rather than overwrites: an existing seed carrying a different session: is renamed to NEXT-<scope>.<UTC>-<sid>.md before this one is written. A REFUSE never destroys the incumbent — a failed archive aborts before the write — but it does not mean nothing happened: the write ends by proving itself, so a REFUSE from the proof arrives after the seed is on disk. Read the archived: and seed: lines, not the exit code alone. Do not hand-write the seed at a wave boundary: the script is the only implementation, and a wave that rolls its own is the drift this consolidated away.
• Queue: scratchpad/autonomous-queue.json. The durable wave queue the next session is seeded from.
• This directive: invoke /prime-directive (compiled live artifact: .claude/skills/prime-directive/SKILL.md). Do not depend on the .claude/commands/ path resolving (Reliability rule 1).
• Issue list: gh issue list --state open.