feat(skills, babysit): the babysit skill, skill lessons, agent wait fixes, and the CI and shell guards

.claude/rules/tests.md

@@ -27,6 +27,11 @@ This exists because inside a **git worktree** any `bunx` call creates a partial
 
 ## Test traps
 
+- **Never start an executable the test just made and then rename or delete it.** macOS checks every new executable in
+  `syspolicyd` after it starts; a check that found the file gone crashed `syspolicyd` five times in ten minutes on
+  2026-10-14 and froze the whole Mac (WindowServer watchdog). Make a test program once with `persistentFixture` from
+  `src/utils/test/persistent-fixture.ts` (kept, never renamed or deleted), and after the first run of such a test check
+  that `pgrep -x syspolicyd` still prints the same pid.
 - **Rewriting untested code: a characterization test first.** Pin the current behaviour, prove the test passes on the old code, then rewrite. When the test fails after the rewrite, assume the rewrite is wrong. Change a test only for an intended behaviour change, and say in the commit what changed and why.
 - **Red today, green yesterday, no relevant commit: check the calendar.** A dated fixture crosses a window when one input still resolves against the real clock: `--since=N days ago` for git, `find -mtime`, `date -v-7d`. Derive every cutoff from the injected `now`.
 - **`bun test --timeout` bounds a test body only.** A hang at module scope (an import that never settles) blocks forever. The signal is the wrapper's `[test] suite complete` line missing. Do not grep bun's own "Ran N tests across M files": it prints once per process, and `bun run test` runs two.

.claude/skills/babysit/references/brief-self-fetch.md

@@ -0,0 +1,107 @@
+# Review round {{ROUND}} of PR #{{PR}}: fix the open review threads in one commit, and draft the replies
+
+You are a worker in a review loop. You fix the findings; the lead (a Claude session) judges your commit afterwards,
+reruns your checks, and pushes. Quality is judged, not speed.
+
+## Where you are
+
+- Worktree: `{{CWD}}`, detached at the head of PR #{{PR}}'s branch `{{BRANCH}}` (base `{{BASE}}`). Stay on this
+  commit: no branches, no checkout of other commits. It is a throwaway worktree; `node_modules` is installed.
+- Read `CLAUDE.md` first, then the area rule files it names for every file you touch (`.claude/rules/*.md`).
+- PR #{{PR}}: "{{TITLE}}".
+- Change every file the fix needs in this PR, including files outside the original diff and their tests. Explain
+  the added files in the reply. Apply the derived round policy below to decide which valid findings require changes.
+- Git reads that can run a configured converter take the off switches, or each one waits for the lead's approval:
+  `git diff|show|log --no-textconv --no-ext-diff …`, `git blame|grep --no-textconv …`.
+- Commit subject: `fix({{SCOPES}}): #{{PR}} followup - <what the round fixes, short>`. The commit-msg hook checks the
+  scopes; if it prints a corrected subject, commit with that.
+
+## 1. Read the open threads (read-only)
+
+- The lead fetched them for you, because a sandboxed worker has no network: `.claude/work/babysit/{{PR}}-r{{ROUND}}-threads.md`
+  (every unresolved thread, listed with its Thread ID and then expanded), `{{PR}}-r{{ROUND}}-review-bodies.md` and
+  `{{PR}}-r{{ROUND}}-pr-comments.md` in the same folder. Work from those files and do not call GitHub. Only when the
+  files are missing and your shell has network, fetch them yourself as below.
+- `tools github review {{PR}} --llm -u -s bs-{{PR}}-r{{ROUND}}` lists every unresolved thread from every reviewer
+  (eve-bot-lovinka, coderabbitai, humans). Never filter by reviewer.
+- Expand EVERY listed thread: `tools github review expand t1,t2,… -s bs-{{PR}}-r{{ROUND}}` (no PR number in this
+  form; the L1 table can name the wrong file, the expanded text is the truth). Keep each thread's Thread ID.
+- Also read review bodies and PR comments that the command prints under "PR comments" / review summaries: CodeRabbit
+  hides "outside diff range" and nitpick findings there. Treat each as a finding without a thread (no threadId).
+- {{ROUND_POLICY}}
+
+## 2. Fix
+
+1. For each finding, read the current source at the cited lines BEFORE you judge it. A finding is a claim with a
+   timestamp. One verdict per finding: `fixed`, `rejected` (cite the file:line that disproves it), `already-done`
+   (name the commit), or `no-change` (only when a cited file:line proves the finding wrong). For valid findings deferred
+   by the derived policy, use `belongs-elsewhere` (the reply schema's deferral verdict), explain the policy, and keep
+   the thread OPEN. Do not add fields the installed reply schema does not support.
+2. Fix the valid findings selected by the derived round policy at the root. Respect each module's documented contracts and its callers. Add or extend a test
+   that fails without the fix, in an existing test file next to the code. Do not create a new test file unless the
+   code has none.
+3. Verify, and keep the real output of each command. Prefix every check with `timeout 600`, and never run
+   `bun install` (the worktree is installed; its native binaries are linked to trusted copies). A check that hangs
+   with 0 CPU time is a machine problem: record it as NOT RUN with the reason, and carry on with the round.
+{{VERIFY}}
+4. Commit exactly ONCE, only your own changes, as two separate commands (never chained with `&&`):
+   `git add -- <each changed file, exact path>`, then `git commit -m "<subject>" -- <the same paths>`.
+   Never `git add -A`/`.`/`-a`; never stash, reset, restore, rebase, pull, amend, push, or touch another worktree or
+   branch. If nothing needs a change (every finding rejected or already done), do not commit; say so.
+
+## 3. Reply file (no posting)
+
+Write `{{CWD}}/.claude/work/babysit/{{PR}}-r{{ROUND}}-replies.json` (create the folder; git ignores it), one item per
+finding, including rejected ones:
+
+```json
+{
+  "pr": {{PR}},
+  "round": {{ROUND}},
+  "model": "{{MODEL_LABEL}}",
+  "intro": "Round {{ROUND}}. N open threads (eve X, CodeRabbit Y). A fixed, B rejected with evidence, C already done.",
+  "items": [
+    {
+      "ref": "t1",
+      "threadId": "<Thread ID from expand; omit only for a finding without a thread>",
+      "reviewer": "<eve-bot-lovinka | coderabbitai | login>",
+      "where": "<file>:<line>",
+      "title": "<one-line title of the defect>",
+      "context": "<what was flagged and why it matters>",
+      "verdict": "fixed",
+      "commits": ["<your commit, 9-char short SHA>"],
+      "codeBefore": { "lang": "ts", "code": "<1 to 8 lines>" },
+      "codeAfter": { "lang": "ts", "code": "<1 to 8 lines>" },
+      "howFixed": "<what the change does, and the test that proves it>",
+      "confidence": 90,
+      "reply": "<text for the thread: plain sentences, bare SHAs, never the characters ://>"
+    }
+  ]
+}
+```
+
+`fixed`/`partly-fixed` need `commits` and `howFixed`; `codeBefore`/`codeAfter` go together, only when code changed.
+Then check it renders: `bun ~/.claude/skills/review-loop/scripts/round-summary.ts <reply file> --repo {{REPO}} --out {{CWD}}/.claude/work/babysit/{{PR}}-r{{ROUND}}-summary.md`
+(exit 2 = invalid JSON: fix and render again).
+
+Post NOTHING to GitHub: no `gh pr comment`, no `gh api` writes, no `tools github review ... respond|resolve|reply`.
+
+## Stop and report
+
+- Do steps 1 to 3, then STOP with your final report. Do not start another PR.
+- A failing test, a compile error or a lint hit that your own change caused is part of the work, not a reason to
+  stop: fix it and rerun until the checks pass. Stop early only when you cannot make progress, and give the
+  concrete blocker. (On 2026-10-15 three Grok workers ended their turns at the first compile error with the fix
+  already named in their OPEN line, and each needed a second steer.)
+- A fix that needs a file outside the PR's original diff changes that file in this PR, and the reply explains why.
+  The same applies to necessary new files, dependencies and public-interface changes: update the callers and tests
+  the fix needs. Scope never excuses a required fix. Only the derived round policy permits a deferral; valid security
+  findings and findings from a dedicated user review are always fixed in this PR.
+- Do NOT spawn subagents or delegate.
+- Do NOT build, install, launch, relaunch or quit the user's apps. Never run `tools macos permissions build`,
+  `src/macos/index.ts`, `scripts/native/*` or anything else that writes `~/Applications/*.app` or restarts a running
+  app: it replaces the user's installed app with this PR's code and relaunches its windows (on 2026-10-14 a worker
+  did exactly that). Swift is checked with `swift build` and `swift test` inside the package folder only.
+- Final report, in order: the thread count you found per reviewer, one line per finding (ref, verdict, where), your
+  commit SHA with `git show --stat <sha>`, every verify command with its real exit code and the last lines of its
+  output, then the RESULT / AT / CHANGED / VERIFY / OPEN lines.

.claude/skills/babysit/references/brief-template.md

@@ -19,8 +19,11 @@ afterwards. Work carefully; quality is judged, not speed.
   - unified mode: the main checkout on `feat/<date>-enhancements-unified`. Other sessions edit and commit here at the
     same time: files you did not change are theirs. {{LATER_CHANGES_NOTE}}
 - Read `CLAUDE.md` first, then the area rules it names for the files you touch.
-- PR #{{PR}}, "{{TITLE}}", `{{BRANCH}}` into `{{BASE}}`. You may change ONLY these files:
+- PR #{{PR}}, "{{TITLE}}", `{{BRANCH}}` into `{{BASE}}`. Start with these files:
 {{SCOPE}}
+- {{ROUND_POLICY}}
+- Use the policy generated by `fill-brief.ts` (shared rule: `scripts/policy.ts`); do not invent a separate round rule.
+  Change every file a required fix needs, including files outside the original diff, and explain added files in the reply.
 - Commit subject: `{{SUBJECT}}`
 
 ## Verify
@@ -51,8 +54,10 @@ Codex variant:
 
 1. For each finding, read the current source at the cited lines BEFORE you judge it. A finding is a claim with a
    timestamp, not a fact. One verdict per finding: `fixed`, `rejected` (cite the file:line that disproves it),
-   `already-done`, or `no-change` (real, but not worth a change; say why).
-2. Fix the valid ones at the root, and respect the module's documented contracts (what a function promises to throw
+   `already-done`, or `no-change` (only when a cited file:line proves the finding wrong). A valid finding deferred
+   by the derived policy uses `belongs-elsewhere` (the reply schema's deferral verdict), an explained reply, and an
+   OPEN thread. Do not add fields the installed reply schema does not support.
+2. Fix the valid findings selected by the derived round policy at the root, and respect the module's documented contracts (what a function promises to throw
    or return) and its callers. Add or extend a test that fails without the fix, in the test files listed above. Do
    NOT create a new test file.
 3. Verify with the commands above and keep their real output.
@@ -102,8 +107,9 @@ Codex variant:
 ## Stop and report
 
 - This turn: steps 1 to 6, then STOP with your final report.
-- STOP early and report if a fix needs a file outside the list, a new file other than the reply file and summary, a
-  new dependency, or a change to a public interface other code uses.
+- If a valid fix needs another file, a new dependency or a public-interface change, include it in this PR, update
+  the affected callers and tests, and explain the added files in the reply. Scope never excuses a required fix.
+  Only the derived round policy permits deferral; security findings and dedicated user reviews are always fixed.
 - Do NOT spawn subagents or delegate to another agent.
 - Final report, in this order: the rendered summary, each thread's ready-to-post reply (ref, then text), your commit
   SHA with `git show --stat <sha>`, every verify command with its real output, then the RESULT / AT / CHANGED /

.claude/skills/babysit/references/integrate.md

@@ -26,9 +26,25 @@ bash scripts/ci/placeholder-check.sh
 git push origin HEAD:refs/heads/<pr-branch>        # a rejected push: fetch, rebase onto origin/<pr-branch>, re-gate
 ```
 
-Then in the main checkout (unified branch): `git cherry-pick <worker sha> <correction sha>`, exact paths only if a
-conflict needs hand-editing. A version-only conflict in `.claude-plugin/marketplace.json` or
-`plugins/genesis-tools/.claude-plugin/plugin.json` keeps the higher version.
+The hooks are the gates (Biome, tsgo, the subject rules, the personal-data probe): workers commit and the lead pushes
+WITH them. The one exception is a stuck syspolicyd (one core at 100%), when the first launch of any new executable
+hangs: a hook copy, a worktree's own `biome`, a fresh Swift test bundle. Prove it first with a brand-new two-line
+`#!/bin/sh` script that does not return (`newExecutablesStall()` in `versions.ts` does exactly that). Only then: run
+Biome from the main checkout's `node_modules/.bin/biome` on the worktree files, authorize the worker's commit with
+`git -c hook.pre-commit.enabled=false -c hook.commit-msg.enabled=false commit`, check its subject with
+`check-commits.ts`, and push with `integrate.ts … --no-push-hooks`. The scripts honour that flag only while the probe
+still stalls, so the switch ends by itself when syspolicyd recovers. Swift tests wait: record them as NOT RUN, but
+`bun .claude/skills/babysit/scripts/swift-typecheck.ts --package <dir>` still proves the Swift code compiles (every
+target through `swiftc` alone, no binary launched; GenesisKit takes about two minutes). Use it also when another
+session holds the one Swift build slot. Hooks set in config ignore `core.hooksPath`: a by-hand replay (rebase,
+cherry-pick, worktree add, which run no gate hook) uses `-c hook.<event>.enabled=false` per event, as `HOOKS_OFF` does.
+
+Then in the main checkout (unified branch):
+`bun .claude/skills/babysit/scripts/pick-unified.ts --branch <unified> <worker sha> <correction sha>`. It skips a
+commit already there, resolves a version-only conflict in `.claude-plugin/marketplace.json` or
+`plugins/genesis-tools/.claude-plugin/plugin.json` to the higher version, and aborts and lists any other conflict.
+Give the listed ones to a free worker in a scratch worktree detached at the unified head (resolve keeping both sides,
+`cherry-pick -x` each), check its tests and Biome, then fast-forward unified to it if unified has not moved.
 
 ## Unified mode
 
@@ -47,6 +63,11 @@ resolved it: it goes into the report (#511's import line, 2026-10-14).
 
 ## After the push
 
+The worker's scope and reply disposition come from `scripts/policy.ts`, as rendered by `fill-brief.ts`.
+A deferred ordinary later-round Medium/Low item carries the supported reply verdict `"belongs-elsewhere"` and
+an explanation of the policy deferral: it stays in the summary, but `integrate.ts` posts it in a separate `--no-resolve` batch.
+Only acted-on items enter the resolving batch. Security findings and dedicated user reviews are always fixed.
+
 - `git log --oneline origin/<pr-branch>..HEAD` must be empty, and the push line names the old and new head.
 - Fetch new threads before you post anything (review-loop: `new-threads.ts`), because the bots answer the push.
 - The vault copy of the reply file names the PR-branch SHAs; render the summary with `--range <old>..<new>