End-to-end determinism guard. cascade_golden.rs pins two artifacts for a real
committed body heightmap (GJ1c) in one diffable JSON golden
(server/tests/golden/cascade_layer1.json):
- Layer 0: SHA-256 of the source heightmap.png bytes (flips if the Python
heightmap generator or the file changes)
- Layer 1: the serialized Layer1Output of run_cascade on a 128x64 downsample
(flips if the Rust drainage/feature/sub-biome code changes)
JSON (not the msgpack discussed in refinement) to match the existing
golden_suite.rs convention and stay diffable — a failure shows what drifted.
UPDATE_GOLDEN=1 regenerates; wired into `make golden-update`.
Adds Serialize/Deserialize to RiverNetwork/DrainageBasin/Layer1Output and a
sha2 dev-dependency.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
server/src/atlas/cascade.rs — run_cascade(body_seed, body_id, path,
default_sea_level, up_to) loads Layer 0 (heightmap.png) and runs every layer up
to the requested CascadeLayer, returning a CascadeSnapshot. The pure core
run_cascade_from_heightmap orchestrates the layers without file I/O (testable);
run_cascade is the thin path-loading wrapper.
CascadeSnapshot is extensible — each layer's artifact is an Option that becomes
Some once it runs (Layer 0 heightmap always present, Layer 1 topography next;
#954+ append their fields). The carried SeedChain is unused by the RNG-free
Layers 0-1 and feeds the RNG-using layers later (D-224). CascadeLayer is an
append-only ordered enum.
Tests: layer-gating, same-heightmap determinism, layer ordering. The golden-seed
regression fixture (the #952 deliverable) builds on this next.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
generate_skeleton / compute_district_mix / derive_layout_mode /
organic_placements / derive_reservations now take a SeedChain instead of a
bare seed: u64. The two ad-hoc wrapping_add pre-mixing hacks are replaced with
real domain separation:
- district-type allocation draws from chain.derive(SeedDomain::Layer4Quarter, 0)
- organic block placement draws from chain.derive(SeedDomain::Block, 0)
DistrictSkeleton.seed now records chain.seed(); test call sites pass
SeedChain::root(N); stale seed-param docs updated.
Re-tuned all_district_types_can_appear: the seed-stream change exposed it as
latently fragile — every type has a clamped weight >= 1 (reachable), but 50
weighted draws can miss a low-weight type (Administrative) depending on the
sequence; the old seed got lucky. Raised the draw count to 500 so it tests
genuine reachability rather than a lucky sequence. Determinism-affecting by
design — this is the RNG-using layer D-224 flagged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New top-level seed module that owns every deterministic-RNG primitive:
- splitmix64 — the one canonical mixer (was duplicated as a private fn in
simulation/rng.rs; EntityRng now imports the shared one, no behavior change)
- AtlasRng — moved here from atlas/rng.rs (it is a generation-RNG primitive,
not atlas-specific); atlas now depends on seed, not the reverse
- SeedDomain — append-only domain tags (Body/Layer1Topography/Layer3Settlement/
Layer4Quarter/Block/Npc) for collision-proof per-domain seed separation
- SeedChain — root(world_seed) → derive(domain, id) → atlas_rng()/seed(), per
the D-224 formula splitmix64(self ^ splitmix64(domain)) ^ splitmix64(id)
Structural move only — SeedChain is not yet threaded through the cascade
callers (skeleton_gen still uses ad-hoc wrapping_add pre-mixing); that is the
next step. Unit tests cover the splitmix64 known-vector, avalanche,
determinism, domain/id separation, and chain composition.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Single typed seed-derivation chain (server/src/seed.rs) descending from the
master world seed via domain-separated splitmix64 mixing — the only sanctioned
way to derive a child seed. Promotes the existing splitmix64 (EntityRng's
mixer) to a shared pub(crate) function and removes ad-hoc wrapping_add
pre-mixing. Pins the derivation formula (load-bearing) and documents the
scope of effect: heightmaps (Python Layer 0) and Layer 1 (RNG-free) are
unaffected; only RNG-using layers (skeleton_gen, future settlement) change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The pre-push clippy invocation ran without --all-targets, so it only checked
lib + bins — test and example targets were never clippy-linted, which is how
the cfg(test)/test-target debt cleared in the previous commit accumulated
unflagged. Add --all-targets now that the debt is clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Manual clippy-1.93 fixes that the prior machine-applicable sweep couldn't auto-
apply, all in cfg(test) modules and tests/ targets (invisible to the lib-only
pre-push clippy, hence accumulated unflagged):
- disallowed_types HashSet/HashMap → BTreeSet/BTreeMap (determinism rule):
shadowcast_bench.rs (×8, (i32,i32) keys), mood.rs, sound.rs. SoundEventKind
gains a PartialOrd/Ord derive (fieldless Copy enum) so it is BTree-usable.
- field_reassign_with_default → struct-init: disclosure.rs, monologue.rs (×2),
save_io.rs (keeps `mut` for the deliberate last-write-wins overwrite).
- assertions_on_constants on the EAVESDROP_THRESHOLD invariant → compile-time
`const _: () = assert!(...)`: listening.rs, cross_room_transitions.rs. This is
stronger than the runtime assert and needs no #[allow].
- approx_constant: settings/types.rs round-trip literal 3.14 → 2.5 (the value is
arbitrary test data, never meant to be PI — change avoids both the lint and a
suppression).
- drop_non_drop: vision.rs early Mut<WalkabilityMap> release → scoped block.
- unnecessary_get_then_check → contains_key: information_boundaries.rs (×3).
- cloned_ref_to_slice_refs → std::slice::from_ref: triangle_validation.rs.
- unused_must_use: input.rs dropped the unused .id() on a spawn.
cargo clippy --all-targets -- -D warnings is clean; cargo test green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Focused Rust dependency-maintenance pass from the 2026-05-23 security/freshness
review. No CVEs; one advisory cleared and one deprecated crate replaced.
- rand 0.9.2 → 0.9.4 (lockfile): clears RUSTSEC-2026-0097 (unsound with a
custom logger using rand::rng()). Semver-compatible; rand 0.10 is a separate
major.
- Compatible-update sweep: ~90 lockfile-only patch/minor bumps (bevy 0.18.0→
0.18.1, clap 4.5→4.6, rayon 1.11→1.12, pathfinding 4.14→4.15, uuid 1.20→1.23,
zerocopy, serde_json, tracing-subscriber, etc.). cargo test green.
- serde_yaml 0.9 (deprecated/archived upstream) → serde_norway 0.9, an actively
maintained drop-in fork. In the server it is test-only (poi.rs round-trip,
trait_modifiers.rs fixture, tests/news_ticker.rs) so it moves to
dev-dependencies; line-previewer parses dialogue/monologue pool YAML at
runtime, so it keeps it as a normal dependency. API is identical (from_str/
to_string).
news_ticker.rs also picks up its share of the #967 clippy sweep (HashSet/HashMap
→ BTree, doc-list indent) since it is the same file as the serde rename.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
cargo clippy --fix on files the new clippy (1.93) flags: unused imports
(name_index, storyteller), manual_range_contains (block_irregularity),
length-comparison/is_empty (layer3, serialization). All behavior-preserving.
Surfaced because a warm target/ makes the pre-push hook actually run clippy
(it skips on cold worktrees). Remaining non-auto-fixable test-code lints
tracked in #967.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pre-push surfaced fmt + clippy (-D warnings) failures in the new code:
- rustfmt the 6 new/changed atlas files + the bench example.
- features.rs: HashMap → BTreeMap (project bans HashMap for determinism via
clippy disallowed_types; the bucket map is lookup-only either way).
- attractor_matching.rs: drop now-redundant .clone() on AttractorType (it
became Copy in #953) — clippy clone_on_copy.
- drainage.rs tests: manual range → (1..=12).contains(&n).
- features.rs test: drop .clone() on Copy AttractorType.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Clerk was net-negative on the #963 push: non-exhaustive (three distinct real
D-202 inconsistencies surfaced only on successive re-pushes, each run missing
the others — so APPROVED can't be trusted) and it re-reviews the whole range
every push (token burn, no verdict cache). Gate it behind SR_RUN_CLERK=1
(default off). Rework tracked in #965; decision-record consistency is the
author's responsibility until then.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Clerk caught it: D-202 line 928 said sea_level is 'carried alongside (not in
the PNG)' while line 930 + the implementation store it IN the PNG (tEXt chunk).
Update line 928 to match — sea_level is a tEXt chunk, with a caller default
fallback. D-202 is now internally consistent (resolution, sea_level, table-drop).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The heightmap.rs module docstring still said 'canonically 2048×1024' (the
pre-decision figure); the canonical resolution is 1024×512 (D-202 amended).
Clerk caught the contradiction. Now consistent across D-200/201/202/208 + code.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Clerk pre-push review caught that the D-202 amendment introduced cross-record
contradictions + a wrong number. Fix:
- D-202: canonical heightmap is 1024×512 (not 2048×1024 — stale figure; the
bake and D-201's canonical PNG are both 1024×512).
- D-200: atlas_body_heightmaps no longer produced (elevation is a per-body file).
- D-201: amend the Tier-3 canonical-format lock — stored heightmap is now a
16-bit grayscale 1024×512 PNG; PNG dims unchanged, Layer 1 downsamples to the
512×256 working grid (satisfies the record's own 'deviation requires amending'
gate).
- D-208: clarify 512×256 is the Layer-1 working grid (downsampled from 1024×512).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The heightmap BLOB table is dropped (canonical elevation is now the per-body
16-bit heightmap.png file). Re-stamped by import_economics.
Clerk-Skip: binary DB build artifact — no D-record/code surface
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- heightmap.rs: read sea_level from the PNG tEXt chunk (bake writes it),
default-fallback param; new test reads_sea_level_from_text_chunk.
- client atlas_viewer.gd: load reliefmap.png (color display) instead of
heightmap.png (now 16-bit grayscale elevation, cascade-only).
- drop atlas_body_heightmaps: removed from systems-schema.sql; DROP TABLE in
import_economics MIGRATION_SQL (the PNG is the store now).
- D-202 amendment: implementation-status note (consumer + producer done),
resolving the review's 'reads done but producer pending' point.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the dead atlas_body_heightmaps DB-BLOB importer (Tyre review B2 —
it asserted 256×512 and wrote a dropped table) with the canonical asset bake:
- one-time rename of the legacy color heightmap.png → reliefmap.png for ALL
bodies (incl. Sol — display-file rename only, no re-sim);
- for each non-Sol inhabited body: simulate() at 1024×512 → clean reliefmap.png
(render_heightmap, no painted features) + 16-bit grayscale heightmap.png with
sea_level in a tEXt chunk;
- no systems.db writes; uses parse_system for proper body defs; run via uv.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
From the Hoshe/Tyre review:
- drainage: assert flow_accumulation/max_accumulation determinism + clamp ≥ 1
(the D-209 strength denominator); isolated-basin merge path (no panic).
- subbiome: each derivable variant reachable + Volcanic never emitted.
- planet_simulation: new test_sim_determinism.py — same body simulates to a
bit-identical elevation array at 1024×512 (the 271-body bake can't be cheaply
re-run, so a silent drift = full re-bake). Verified PASS.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Review (Tyre) caught a determinism hole: corp-HQ→city matching iterated a
Python set (sys_body_ids), so on a name collision across bodies in the same
system, which row received corp_id depended on set order — nondeterministic
output landing in the committed DB (violates D-010 #4). Iterate sorted().
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Review (Hoshe) caught that the MAX_ATTRACTORS cap sorted by global strength,
and RiverMouth's normalized strength (accum/max_accum) is tiny — so on a
realistic body 108 river mouths produced 0 surviving RiverMouth attractors,
violating D-209 ('RiverMouth: always high-value') and starving #955 placement.
Replace the global-strength cap with group-by-type + round-robin so every
present type keeps representation (strongest-first within each type).
Deterministic. New test river_mouths_survive_cap locks it in.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- planet_simulation: GRID 512×256 → 1024×512. The elevation noise is
resolution-independent (normalized coords + absolute freqs), so the
finer grid samples the SAME terrain — features keep physical size,
generation stays deterministic. Pixel-unit constants (gaussian sigma,
crater radii, peak-filter window, erosion slope) scale by GRID_W/512.
Validated: non-Sol bodies render same-world-crisper at 1024.
- Remove compute_rivers + _rivers_to_grid + the rivers/river_grid terrain
keys: rivers are the Rust cascade's job (D8 drainage, D-208), the single
source of river truth. The old heuristic didn't even reach the sea.
- render_heightmap: stop painting rivers onto the relief (cascade/Atlas
overlay computed rivers instead).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Supersede the atlas_body_heightmaps BLOB store with a per-body 16-bit
grayscale heightmap.png (2048x1024, canonical elevation) next to a renamed
reliefmap.png (color display render). Records the rationale (binary
merge-conflict avoidance + DB size + viewable/deterministic single source),
the multi-resolution split (Layer 1 downsamples to 512x256), and the
dropped table.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace the atlas_body_heightmaps DB-BLOB loader with a per-body file
loader (D-202 amendment): heightmap.rs reads the 16-bit grayscale
heightmap.png (via the new png dep) from the body's terrain_reference
path, normalizes to f32 [0,1], and rejects RGB so a reliefmap can't be
misread as elevation. Adds BodyHeightmap::downsample (box-average,
deterministic) so Layer 1 drops the high-res stored heightmap to the
512x256 working resolution. sea_level becomes body metadata carried
alongside, not in the PNG. 4 loader tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
examples/bench_layer1 times run_layer1 on a synthetic 512x256 heightmap
with a phase breakdown (drainage / terrain analysis / feature extraction).
Post-optimization: ~106ms/body total (drainage ~45ms). Documents the
synthetic-terrain caveat (real heightmaps via #963).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wire the empty-world topography cascade (D-208/209/210):
- generator.rs: add SubBiomeVariant (11 variants, D-210) + sub_biome and
terrain_modification_cost fields on GeographicAttractor; AttractorType
is now Copy.
- features.rs (new, D-209): extract the 7 attractor tags from heightmap +
drainage. Coast/lake derived from the heightmap (D-209/D-223
reconciliation — markers are names-only now, no polygons). Deterministic
(sorted seeds, integer keys, bucket-grid thinning); strength-capped at
MAX_ATTRACTORS preserving type diversity. Shared TerrainAnalysis
(masks/slope/moisture/percentile) feeds both extraction and sub-biome.
- subbiome.rs (new, D-210): classify sub-biome + terrain_modification_cost
from elevation/slope/moisture/latitude. Volcanic stays in the enum but
is not emitted (no heightmap signal).
- layer1.rs (new): run_layer1 orchestrator + attach_feature_names (D-223
pool names to largest rivers / Alpine peaks).
- attractor_matching constructors updated for the new fields.
76 atlas tests pass; run_layer1 determinism verified.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- DrainageResult now exposes flow_accumulation + max_accumulation for
D-209 attractor-strength normalization.
- Rewrite merge_small_basins from an O(merges x n) loop (rescanned the
whole grid per merge) to an adjacency-graph + union-find pass: one grid
scan, lazy merges. Cuts D8 drainage at 512x256 from ~299ms to ~45ms,
meeting the D-208 ~50ms target (the module had never been run at
canonical resolution before — it was orphaned). Determinism preserved
(smallest by (size,id), largest neighbor by (size, lowest id)).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sol (system GJ 0) uses real Earth/Mars/Luna geography via the offline
sol_import.py and is permanently exempt from the procedural cascade. The
names-only strip had removed Sol's generated marker geometry; restore the
geometry-bearing markers.json for Earth (GJ0d), Luna (GJ0d-1), Mars (GJ0e)
and GJ0f-2 as preserved positional config. sol_import.py is left in place
for future scripted Sol integration; the source config in
tooling/planet-gen/sol_markers/ was never stripped.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The procedural server cascade (Phase 4) and the frozen names-only pool
supersede the Python atlas geometry generator and the LLM namer. Retire:
- generate_atlas.py (geometry production — cities/roads/rivers placement)
- gemma_naming.py, naming_core.py + tests (test_batch_naming,
test_register_selection, qa_naming) and run-atlas-naming.sh (the LLM
place-namer; its output is now the frozen pool)
- apply_name_fixes.py (name-field patches), fix_fewshot_bleed.py /
prune_atlas_features.py (geometry tools)
- import_city_names.py (redundant with import_economics name-pool path)
Pipeline updates: drop the generate_atlas step + atlas-generate /
test-atlas-determinism targets from the Makefile; remove generate_atlas
from the stamp registry (import_economics is the sole regen-db generator);
drop run-atlas-determinism from tests/run-all; refresh stale references in
schema_version, backfill_cultural_corridor, earth_blocklist (kept as
reference data), populate_terrain_reference, and heightmap.rs.
The Gemma prompting methodology is preserved in
docs/gemma-naming-methodology.md (separate commit).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Rework the regen-db atlas path for the names-only marker pool:
- populate_atlas_city_names now reads the names.cities pool instead of
the retired geometry-bearing cities[] records; population/kind are
deferred to placement (#955). Adds a deterministic clear-then-insert
(no UNIQUE on (body_id, name)) that fixes a latent duplicate-
accumulation bug — atlas_city_names dropped from an inflated 3276 to a
clean 329 pooled names + 134 corp-HQ rows.
- ensure_atlas_index_schema applies the canonical ATLAS INDEX block from
systems-schema.sql and empties the 8 geometry tables every regen; the
Phase 4 server cascade fills them (they start empty — the revealed gap).
- Sol (system 'GJ 0') is permanently exempt from the normal generators:
skipped in both the name-pool importer and the corp-HQ cross-ref.
- MIGRATION_SQL drops the retired generate_atlas meta stamp row so the
fail-closed stamp checker accepts older committed DBs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Move the shared atlas-DB utilities (schema application, inhabited-body
query, body-def loader, grid constants) out of the soon-to-be-retired
generate_atlas.py into a dedicated atlas_common.py with no dependency on
geometry-production code. Repoint the surviving build-time importers
(import_heightmaps, import_province_boundaries) at the new module.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Looking-ahead question from the Phase 4 markers strip. Generated mapping (rivers via
drainage, cities via econ sim + placement) is deterministic so always recomputable,
but expensive — should be computed once per body and kept, not volatile. Refines D-203
(LRU evicts) and D-200 (build-time bake vs runtime persist). Gates the atlas viewer
(#960). To resolve during the execution-model work (#952).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Part 1 of #951. Per D-223, every markers.json is reduced to a flavored name pool —
names only, no positions/geometry. 2398 files; 25,264 names preserved across
rivers/mountains/oceans/cities/pois/roads/railroads. Positions now come from the
deterministic cascade (heightmap + drainage) and economic sim; names attach from the pool.
Expected fallout (next #951 steps): the tooling/planet-gen geometry pipeline and
import_economics read markers geometry, so regen-db breaks until the importer is
reworked for the names-only format. Sol markers (tooling/planet-gen/sol_markers/) not
yet handled. No push (batch until Phase 4 done).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Resolves the open question on merging preconfigured per-planet content into the
deterministic cascade. Authored content is a flavored NAME POOL only, never pinned
geometry: markers.json reduced to names; river/mountain positions derive from the
heightmap + drainage; settlement positions from the economic sim + placement; names
attach from the pool.
The 6 hand-authored templates (Lendel, Edict, Vuurkloof, Røros, Cairnside, Estrade)
have their machinery removed — the bodies stay as ordinary named places, only the
authored positioning + reserved pinning + template special-casing go. After this
'template' is no longer a distinguishable category.
Amends D-207 (markers names-only, no reserved pinning) and D-191 §8 (markers format
superseded). Implementation tracked in #951 (Phase 4). Historical archives untouched.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The player-before-generation order kept resurfacing because it was recorded in
three places (D-166, CLAUDE.md cascade table, epics #749/#750) while the
generation-first rule was recorded nowhere. Fix all three to match the rule.
Rule: no player-control or in-world rendering work begins until the generator can
deterministically seed-generate every tile of every world via the full multilayer
cascade. The hand-made 2-floor test map is dropped — test layers come from the
generator itself once layer-drawing begins. Generation progress is viewed as
per-layer maps in the implant Atlas (the Phase 3 deliverable, already built), not
an in-world renderer. Existing in-world rendering code is left as-is until Phase 5.
Amends D-166 (Phases 4/5 swapped + amendment note), CLAUDE.md cascade table, and
epics #750 (now Phase 4) / #749 (now Phase 5).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ruff F401 — unused 'import os'. Pre-existing in the globe-coverage script; ruff
runs at pre-push (not pre-commit), so it surfaced only now and blocked the push.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Establishes the canonical sub-settlement ladder as the single source of truth:
Subtile 0.5m / Tile 1m / Chunk 64m / Block 128m / Quarter 512m / District 2048m,
fluid above. Renames the old 512m 'District' to Quarter and promotes District to a
real urban scale (2048m, 4.19 km², 4×4 quarters), grounded against real block /
superblock / district sizes.
Codifies the lore-vs-code rule: tier names are fixed generation grid cells; the same
words in narrative/UI are free-form region labels and must NOT be reconciled to a
code tier by reviewers or the clerk.
Amends D-094 (hierarchy), D-201 (tier table renumbered 6-9), D-220 (its footprint
'district' cell is the Quarter), and D-066 (sim tile -> Subtile vocabulary) to point
at D-222. Resolves the clerk finding on commit 7 (D-220 scale chain). Code/terminology
rename deferred to ticket #950.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Resolves the clerk finding on the pre-existing overlay removal. Shadow economy
is an underwater simulation modifier (shadow_economy_intensity, D-174) feeding
derived signals like collection_efficiency and signal 7 official_coverage_ratio
(D-181) — not a user-navigable data point. The atlas overlay and City Data Panel
field were correctly removed in code; D-191 was stale. Amends D-191 §7 (9 -> 8
overlays), §6 (drop city-panel field), §10 (completion criteria). D-174 simulation
layer is unaffected.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The per-commit clerk had three flaws, exposed by a 20-commit push where 6 of 7
rejections were false (incl. a CHANGELOG-only commit):
1. No-verdict / max-turns / timeout defaulted to REJECTED — an unfinished review
read as 'hard contradiction found'. Now a third outcome, INCOMPLETE, which is
non-blocking (the push proceeds with a warning); only a real REJECTED blocks.
2. Turn/time budget too tight (6 turns / 150s) for decision-heavy commits. Raised
defaults to 15 turns / 300s, and the prompt now biases to APPROVED when no
concrete contradiction is found ('unsure' means APPROVED, never REJECTED).
3. The skip valve matched its own feature commit because it scanned for the token
anywhere in the message. Moved to a trailer-line match so prose/subject mentions
no longer trip it.
Pre-push hook updated to treat INCOMPLETE as a non-blocking warning. The git-commit
skill documents the trailer form.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
A commit whose message contains the token [clerk-skip] is auto-approved by
the pre-push clerk without spawning an agent. Intended for bulk content/data
commits — e.g. shipping thousands of generated planetary description files —
where D-record review is moot and would only burn agents on noise.
Documented in the /git-commit skill with the caveat: never use it on commits
that touch decisions/, code, or ticket-bearing work.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The clerk pre-push review spawned a single claude -p over the entire combined
diff (truncated at 50k chars) with a 3-turn budget. On a large push (e.g. 754
files / 2.8M chars) it ran out of turns before emitting a verdict, which the
wrapper defaulted to REJECTED.
Rewrite to review one commit at a time — commits are the logical units, so each
clerk agent sees a self-contained change plus its commit message (enabling the
'does this match ticket #NNN?' check). Commits are reviewed by a bounded pool of
parallel clerk agents and the verdicts aggregated (REJECTED if any commit
contradicts an active D-record). Oversized commit diffs truncate to a budget.
Adds --plan (print the per-commit plan, no agents spawned) and env knobs:
SR_CLERK_COMMIT_BUDGET / SR_CLERK_WORKERS / SR_CLERK_MAX_TURNS / SR_CLERK_TIMEOUT.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The tmux teammate-mode investigation is resolved (works on 2.1.148; the
'broken regression' was a teammateMode: in-process config issue). Per the
file's own cleanup note, delete it now that the test passes.
Update the two references:
- decisions/questions-process.md: replace the stale 'partially broken'
pointer with the resolved status.
- whats-next/SKILL.md: the 'custom subagent_types lose SendMessage' caveat is
fixed (all agents now carry SendMessage + Task tools), so reword and drop
the dead team-test.md link.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Log the 2.1.148 results in team-test.md: the 'broken tmux pane' premise was
a stale config claim (teammateMode was in-process), not a regression; auto mode
spawns real panes; and custom restricted-tool subagents need coordination tools
listed explicitly to function as pane-mode teammates.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two agent-team tooling changes:
- teammateMode: in-process -> auto. Teammates now spawn in tmux split panes
when the lead runs inside tmux, with graceful in-process fallback.
- New PreToolUse hook git-centralize-guard.sh blocks .git-mutating commands
(add, commit, merge, push, pull, rebase, reset, checkout, stash,
cherry-pick, rm, mv) for teammates, keeping version control centralized to
the lead. Detection keys on the agent_type field, which a teammate's hook
input carries and the lead's does not. Read-only git is allowed.
Documented in .claude/rules/git-safety.md. Hooks load at lead startup, so a
restart is required for the hook to reach teammates.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Custom subagent types used as agent-team teammates in tmux pane mode only
receive their definition's restricted tools list — the coordination tools
are not injected (confirmed on Claude Code 2.1.148). Without SendMessage a
teammate can't message the lead and can't return a shutdown_response, so it
orphans its pane.
Add SendMessage, TaskList, TaskUpdate, and TaskGet to all 21 agents so they
work as full teammates. TaskCreate is intentionally omitted: task creation
stays centralized with the team lead.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
