Build the cron Worker that wires subagentcache.com to live Cloudflare GraphQL Analytics

workers/subagentcache/README.md documents this as the next step: a scheduled Worker (same [triggers] cron pattern as workers/cron) holding a CF_API_TOKEN secret scoped to Zone Analytics Read only, running a fixed httpRequests1dGroups query, and POSTing the result to subagentcache.com/api/cache-snapshots with source=graphql_api. Not yet built — every existing row is manual_dashboard_paste.

closes contract: ctr_cache_analytics_freshness

Expand subagentidentities.com's registry as new real identity boundaries are documented

Currently seeded with 5 real rows (macos_desktop_cowork, cloud_docker_mcp, engineering-coworker binary mediation, the shared Cloudflare account, vault/Keychain credential pattern). Add more only when a new REAL boundary is documented somewhere in this repo or the mirrored claude-tag docs — never pad with invented entries. See ctr_identity_registry's done_detail.

closes contract: ctr_identity_registry

Expand subagentbrands.com guidelines as more real voice patterns are documented

Currently seeded with 6 real rows observed from this repository's own already-shipped pages. Add more only when a new REAL pattern is observed in an actual shipped file, mirroring tsk_identity_registry_more_rows' discipline of never padding with invented rows.

closes contract: ctr_brand_voice_grounding

Document POST and PATCH usage on subagentcli.com's commands page

The script itself already supports --method and --data flags, but the /commands docs page currently only shows GET examples. Add a worked write-path example once each site's WRITE_SECRET provisioning process is documented for end users.

Resync subagentdatamodels.com sibling-site references with full 37-site family

AUDIT 2026-07-02 (scripts/resync-audit.py): cannot complete — https://subagentdatamodels.com is unreachable because the domain is UNREGISTERED (blocker tsk_b228566b-1c3, operator purchase decision). Local roster/hub checks pass; the llms.txt check needs a live domain. Re-run the audit after registration; do not hand-audit before then.

Register subagentdatamodels.com (purchase decision — operator only)

ROOT CAUSE CORRECTED 2026-07-02: the domain is UNREGISTERED — whois against whois.verisign-grs.com (the .com registry itself) returns No match. Every credential approach (wrangler OAuth scopes, docker mcp secrets, dashboard Add Site) was moot: there is no domain to add a zone for. Fix: operator registers subagentdatamodels.com (~$10/yr, Cloudflare Registrar recommended so NS wire automatically) — a financial transaction Claude will not execute, and gated by cwc-finance spend_commit anyway. Once registered: zone create (dashboard or token), [[routes]] per workers/subagentdatamodels/README.md, deploy, add to subagentapi.com FAMILY_LINKSET_EXTRAS + MCP set — all automated. Interim mitigation SHIPPED: subagentdomains.com directory now links the live workers.dev URL instead of the dead apex (version 7ba1d000), so the fleet no longer teaches agents a dead link.

SDK backlog: dedupe esc() (14 workers) and htmlHeaders (53 workers)

Duplication scan 2026-07-02: function esc( defined in 14 workers, htmlHeaders const in 53, WebMCP inline script in 5 (semi-bespoke per-site tools). Low individual value, high churn — fold opportunistically into sites already being touched for other reasons (a new kit text/html module), never as a standalone fleet sweep. Editing existing kit files makes all their dependents stale per worker-build.sh — batch with a planned fleet deploy.

BUDGET-5K #1: approve runway lock — 12mo claude.ai pre-fund ($1,200)

spend_commit gate, operator decision. Existing spend class (the $100/mo AI-workforce line), lowest-risk approval in the plan. Plan: plugins/cwc-finance/skills/startup-finance/BUDGET-5K.md

BUDGET-5K #2: approve entity formation via Stripe Atlas ($800) — on formation merits; credits at realizable value

CORRECTED 2026-07-02 after operator challenged the $100k face value — challenge verified correct against cloudflare.com/forstartups: the $100k is Tier 2 of the standard startup program (1yr window, Workers AI capped $25k at list pricing, R2 $10k, AI Gateway excluded, Registrar renewals NOT eligible). Realizable value at current fleet scale ≈ $60-600, not $100k. Atlas route stands on formation merits alone (DE+EIN+equity+83(b)+agent, fee historically $500). New standing rule in BUDGET-5K.md: vendor credits booked at realizable value, never face value; no credit number without its terms page fetched and dated. spend_commit + attorney-review gate unchanged.

BUDGET-5K #3: trademark clearance then filing ($900) — after entity

Clearance search BEFORE filing money (legal rule); entity owns the mark; USPTO fees verified live at filing time. spend_commit-gated.

BUDGET-5K #4: portfolio protection ($650) — 1yr renewals + register datamodels

Pre-fund ~50 renewals (~$550) + register subagentdatamodels.com (~$11, closes tsk_b228566b-1c3 and the 1/50 gap on four flywheel metrics). Existing spend class. spend_commit-gated.

BUDGET-5K #5+6: conditional lines — CF paid capability ($600, cancels if Launchpad credits land) + monetization pilot reserve ($350, gateway-access trigger)

Both trigger-gated per BUDGET-5K.md sequencing; #5 reallocates to trademark buffer/contingency if the $250k Startup Enterprise credits arrive. Any real x402 transaction is operator-executed.

WBR-W27 rec #1: instrument the north star (agent-UA / Crawl Control baseline)

From reports/wbr/2026-W27.md — the business's output metrics are all class-2 (measurable, not instrumented). This week: manual AI Crawl Control dashboard paste to subagentcache.com (source=manual_dashboard_paste, needs operator dashboard access); automation path is existing tsk_wire_live_cache_graphql (CF_API_TOKEN GraphQL). Predicted movement: output metrics class 2 → class 1; next WBR reads agent-UA share for the first time. Gate: engineering build gate + operator access.

Review zone bot protection vs agent-readiness: Python-urllib UAs get 403

Found 2026-07-03 by scripts/territory-score.py (differential-verified: Python-urllib/3.12 → 403, identified UAs → 200, on subagentapi.com; likely zone-wide Bot Fight Mode/managed rule). Contradiction: llms.txt + MCP invite agents while the zone layer blocks the most default agent client. Operator judgment needed (security posture): allow known-agent UAs via WAF skip, rely on AI Crawl Control instead, or accept the block and document it in llms.txt. Ties to WBR rec #1 instrumentation.

Verify remaining candidate board counts

Confirm final counts of Greenhouse/Lever/Ashby candidate boards before seeding.

Seed dim_board for reconciled + new companies

Insert reconciled and newly discovered company boards into dim_board.

Trigger live crawls for all new/reconciled GH+Lever boards

Kick off live crawl runs against the expanded Greenhouse + Lever board list.

Manually ingest OpenAI (Ashby) jobs into D1

One-off manual ingestion of OpenAI's Ashby-hosted postings into fact_job_posting.

Update cron worker source with expanded board lists + Ashby

workers/cron index.ts: add Ashby to the 3-way platform dispatch, expand board lists.

Create ETL worker source with Ashby support + dim_board upsert fix

workers/etl: Ashby crawl endpoint plus an ON CONFLICT upsert fix for dim_board.

Update board YAML docs + new migration file

Docs and a new Postgres migration reflecting the expanded board catalog.

Research Netflix analytics/data engineer openings

One-off research task on Netflix's open analytics/data-engineering roles.

Final verification + summary for user

Wrap-up verification pass and summary for the board-expansion work.

Research existing cwc-design plugin + agent-gen schema

Survey the existing cwc-design plugin and the agent-gen schema before building cwc-data.

Find Cloudflare zone for subagentetl.com

Confirm the subagentetl.com zone exists on the account before scaffolding.

Build workers/subagentetl Cloudflare Worker

Scaffold the Kimball-style ETL pipeline dashboard Worker.

Update cloudflare.toml with subagentetl entry

Register the new worker + zone in the repo's cloudflare.toml.

Build plugins/cwc-data plugin scaffold

Data-coworker plugin: warehouse analyst over subagentjobs-dwh, read-only by design.

Verify + final summary with deploy commands

Pre-deploy verification pass and a summary of the exact deploy commands.

Deploy subagentetl/etl/cron and live-verify via Desktop Commander

Real deploy of all three touched workers, verified live.

Research Managed Agents/Claude Tag/Office Agents docs

Initial research pass across Anthropic's Managed Agents, Claude Tag, and Office Agents documentation.

Write sessions/handoff-2026-07-01.json

Structured, enum-constrained session handoff document.

Append session entry to session-index.json

Add this session's entry to the running session index.

Update CLAUDE.md for handoff discoverability

Point CLAUDE.md at the new handoff file.

Verify handoff artifacts

Confirm the handoff JSON and index entries are internally consistent.

Fetch and save Claude Tag docs into docs/ mirror

Mirror Anthropic's Claude Tag documentation verbatim into docs/docs/claude.com/docs/claude-tag.

Investigate knowledge-engineering sister repo

Resolve the sister-repo identity and its relationship to subagentknowledge.com.

Confirm Cloudflare zones for both new domains

Verify subagentcowork.com and subagentcoworkers.com zones are active on the account.

Finalize content/architecture design for both sites

Scope the docs-mirror vs. original-writing split before scaffolding.

Scaffold workers/subagentcowork

Static docs Worker mirroring Cowork + Claude Tag documentation.

Scaffold workers/subagentcoworkers

Original docs Worker for the operator's own multi-agent coworkers platform.

Deploy both Workers via Desktop Commander

First live deploy of subagentcowork-web and subagentcoworkers-web.

Live-verify both domains + update cloudflare.toml/CLAUDE.md

Confirm both sites live, document them in the repo.

Research CMA + Claude Tag primitive mapping

Compare Cloudflare's Claude Managed Agents architecture against Claude Tag's own primitives.

Author cloudflare/ section for subagentcowork.com

Five original pages mapping CMA primitives against Claude Tag's, including the open-models adaptation.

Author cloudflare-primitives page for subagentcoworkers.com

Map the coworkers platform's own primitives against CMA's.

Read wc2026-bracket + web design system source

Locate the canonical shared CSS design system already in production.

Check for shared design-system doc or constants

Confirm there was no separate design-system doc to reference instead of the source.

Rewrite subagentcowork.com shell() to match design system

Port the full shared token set + progressive-enhancement techniques.

Rewrite subagentcoworkers.com shell() to match design system

Same port, green accent instead of cyan.

Deploy + verify redesigned sites on real device viewport

Live redeploy and visual verification of both redesigned sites.

Ground subagentcontracts.com in claude-tag's durable/contract vocabulary

Read claude-tag's durability + definition-of-done docs to define the Contract primitive precisely.

closes contract: ctr_ship_subagentcontracts

Fix: add SHA256 drift-detection to mirrored docs

Content-hash every mirrored page so upstream Anthropic doc changes surface as drift.

closes contract: ctr_ship_subagentcontracts

Scaffold subagentcontracts.com worker

D1-backed Worker implementing the durable Contract + contract_ledger primitive.

closes contract: ctr_ship_subagentcontracts

Wire dogfooding: cowork + coworkers sites consume Contracts API

Server-side fetch from both docs sites into the live Contracts API.

closes contract: ctr_ship_subagentcontracts

Build Figma/Canva-style design-system artifact page

Live, interactive style-guide page with a real accent picker.

closes contract: ctr_ship_subagentcontracts

Update CLAUDE.md + cloudflare.toml for subagentcontracts.com

Document the new worker, zone, and D1 database.

closes contract: ctr_ship_subagentcontracts

Deploy and live-verify all changes

Real deploy of all three touched workers, cross-site data flow verified live.

closes contract: ctr_ship_subagentcontracts

Write brief PRD for subagenttasks.com

Self-steered product scoping grounded in the literal TaskCreate/TaskUpdate/TaskList schema, without asking the user to pick.

closes contract: ctr_ship_subagenttasks

Scaffold subagenttasks.com D1 schema + worker

New Cloudflare Worker: Task + task_dependencies primitive, D1-backed, same design-system family, red accent.

closes contract: ctr_ship_subagenttasks

Seed real session data: this session's 44 tasks

Insert the actual 44 completed tasks from this session as genuine seed data, with real dependency edges and contract links.

closes contract: ctr_ship_subagenttasks

Cross-wire: contracts shows backing tasks; cowork/coworkers link to tasks

subagentcontracts.com pulls backing tasks from subagenttasks.com; cowork/coworkers get nav links + blurbs.

closes contract: ctr_ship_subagenttasks

Update CLAUDE.md + cloudflare.toml for subagenttasks.com

Document the new worker, zone, D1 database, and the four-way relationship.

closes contract: ctr_ship_subagenttasks

Deploy all touched workers + live-verify

Deploy subagenttasks (new), subagentcontracts, subagentcowork, subagentcoworkers; verify cross-site data flows.

closes contract: ctr_ship_subagenttasks

Retrofit subagentjobs.com, subagentdata.com, subagentworkers.com, subagentdb.com, subagentetl.com onto the full shared design system

CLOSED AS ALREADY-DONE 2026-07-02 (stale ledger, not missing work): the retrofit this task describes was completed 2026-07-01 per CLAUDE.md Design-system remediation + the retrofit strikethrough item. Grep-verified today: web/db/workers/etl all have @view-transition=1, rgb(from var()) relative-color (e.g. workers/web/src/index.ts:300,301,465), text-wrap>=2, display-p3>=1; wc2026-bracket has view-transition x3 + p3 x6 (it originated the techniques). Earlier audits missed relative-color because they grepped color(from — the shipped form is rgb(from.

Wire an automated evaluation pipeline instead of a one-time manual grading pass

DONE 2026-07-02: scripts/evaluate-workers.py (built by an opus subagent under a fixed JSON I/O contract, verified by lead). Deterministic: rubric fetched from subagentrubrics.com/rbc_worker_quality, site list from build-graph.json (routes+D1 metadata), 7 mechanical checks (d1_binding, grid_overflow_fix, p3_block, build_lock, mcp_live, rel_alternate, changes_or_citeas), fixed result mapping, every explanation cites check evidence + rubric fragment. 62 eval_auto_* rows POSTed live (e.g. eval_auto_wc2026-bracket); secret read at runtime from the local store, never in repo (py_compile clean, no 32+ hex literals). Rerun on any deploy: python3 scripts/evaluate-workers.py --post.

closes contract: ctr_evaluation_evidence

Fix subagentdomains.com CSS overflow on iPhone 16 Pro/Chrome

Real user-reported bug: .site-card and .card grid items had no min-width:0, and their text children (domain names, descriptions) had no overflow-wrap/word-break, so a long unbroken token forced the grid track wider than the viewport. Fixed by adding min-width:0 to the card/grid-item rules and overflow-wrap:anywhere;word-break:break-word to text-bearing children, plus flex-wrap on badge rows. Typechecked, deployed (Version ID 1966d9c5-438f-4947-a178-cda220859e52), live-verified via curl.

Fix CSS grid-overflow gap on remaining 18 terminal-aesthetic sites

After fixing subagentdomains.com, a repo-wide grep found 18 more sites sharing the exact same vulnerable "sharedCss()"/".site-card" CSS lineage with zero overflow-wrap protection: subagentapi, subagentbrands, subagentcache, subagentcitations, subagentcli, subagentcode, subagentcontracts, subagentcowork, subagentcoworkers, subagentdevices, subagentevaluations, subagentidentities, subagentmemories, subagentoutcomes, subagentprompts, subagentroles, subagentrubrics, subagentskills, subagenttasks. Fixed via 3 parallel dispatched agents (6-7 sites each), each locating its own real card/grid class names and applying the same min-width:0 + overflow-wrap pattern. All 19 sites typechecked, deployed in 3 batches, and live-verified via curl (min-width:0 count 3-5 per site).

Extend design-system-audit.sh to check for overflow-wrap/min-width grid gap

The audit script only ever checked display-p3/reduced-motion/safe-area/view-transition/text-wrap/backdrop-filter/scrollbar-width, so the grid-overflow bug class was structurally invisible to it across multiple prior "full family audit" passes. Added a third hard-gate criterion: any file whose CSS defines a repeating-card grid (via grid-template-columns) must also contain both overflow-wrap and min-width:0, or the audit fails it. Re-running the extended script immediately caught two more, previously-unknown real gaps predating this whole incident: subagentsubdomains.com's .card rule (overflow-wrap present, min-width:0 missing) and web/subagentjobs.com's .bcard/.bnm board-grid (neither present). Both fixed, typechecked, deployed, and the audit now passes clean (exit 0) across all 36 sites.

Resync subagentapi.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: CATALOG(37 domains, handoffs=yes); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentbrands.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentcache.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentcitations.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentcli.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: RESOURCES(37 domains, handoffs=yes); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentcode.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentcontracts.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentcowork.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentcoworkers.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentdb.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentdevices.com sibling-site references with full 37-site family

DONE 2026-07-02: subagenthandoffs.com live-verified shipping all 8 family-wide techniques (curl marker check: display-p3 x5, safe-area x3, view-transition x3, rgb(from x1, text-wrap x2, backdrop-filter x2, scrollbar-width x1, reduced-motion x2; the two wc2026-only techniques correctly excluded) and added to the 8 TECHNIQUES sites lists. Shipped via worker-build gate (the gate caught a missing-comma bug on first attempt — exit 1 as designed) → deploy 6d35610b → --record. Live: /adoption column <th>handoffs</th> present, /techniques/display-p3 lists the domain, resync-audit verdict now pass.

Resync subagentdomains.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: SITES(49 domains, handoffs=yes); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentevaluations.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagenthandoffs.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagenthooks.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentidentities.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentmemories.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentmodels.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentoutcomes.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentpermissions.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentprompts.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentpython.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentroles.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentrubrics.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentrust.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentsessions.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentskills.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentsubdomains.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagenttasks.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagenttools.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagenttypescript.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentvaults.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentworkers.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentjobs.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Resync subagentdata.com sibling-site references with full 37-site family

CLOSED by deterministic batch audit (scripts/resync-audit.py, 2026-07-02): llms.txt family links live-verified=True; roster arrays >=15 domains: none (hub sites are the canonical roster surface); hub link present=True (src reference or shared-kit llmsTxt, which emits the family section). Full verdicts JSON archived with the audit script; rerun anytime: python3 scripts/resync-audit.py.

Mirror Figma wireframe board in durable ledger

Architecture board https://www.figma.com/board/f3POlLrQzTL7JmDIbi7BX3 (full-system: 14 cwc-* plugins, identity directives, primitives, 50-site fleet) is recorded in plugins/cwc-design/wireframes.json; in-fleet rendering is subagentdevices.com/architecture (operates edges live 2026-07-02). This row is the durable mirror per the architecture-wireframes skill ledger rule.

Flywheel: add 13 missing sites to the RFC 9727 api-catalog

DONE 2026-07-02: linkset now 49 entries (was 37) via FAMILY_LINKSET_EXTRAS in workers/subagentapi/src/index.ts (kept separate from CATALOG so /health routes[0] probing and the primitives-count copy stay correct). subagentdatamodels.com deliberately excluded — no zone yet; a dead anchor is anti-flywheel. Deployed 74fb554c, curl-verified: .well-known/api-catalog returns 49.

Flywheel: subagentevaluations.com llms.txt missing family catalog link

DONE 2026-07-02: fixed by redeploy — the live worker predated the shared kit's llmsTxt family section; no code change needed. curl-verified: llms.txt now links subagentapi.com/api/catalog. Steady-state crosslink metric 48/50 = subagentsubdomains.com (by design, it IS the directory) + subagentdatamodels.com (no zone).

Flywheel: replicate the /mcp endpoint + server card fleet-wide

DONE 2026-07-02: workers/_shared/kit/mcp.ts factors subagentapi.com's Fable-5-reviewed handler (notifications→202, in-protocol errors over HTTP 200, parse-error id:null, GET→405, CORS, isError only for recognized-tool runtime failures) into a reusable handleMcp factory. Wired into all 24 D1 primitives (3 parallel lanes, sequential deploy+curl-verify per site — every site handshake-verified: initialize, notification 202, tools/call returning real rows). subagentapi.com catalog now advertises POST /mcp on all 24 entries and server-card describedby on 25 linkset entries (version 5d0fb34d). scripts/flywheel-metrics.sh measures 25/50 live MCP endpoints, up from 1/50 baseline.

Flywheel: link rel=alternate llms.txt in every shell() head

DONE 2026-07-02: link rel=alternate type=text/plain href=/llms.txt added to workers/_shared/kit/shell.ts head; all 63 kit workers redeployed (3 batches); 6 bespoke-shell sites (web/jobs, db, workers, etl, wc2026/data, models — models turned out bespoke, not kit) patched individually and deployed. curl-verified 49/50 homepages advertise it; only zoneless subagentdatamodels.com missing.

Flywheel: cite_as canonical URL on API rows (stage 6)

DONE 2026-07-02: citeBase added to workers/_shared/kit/d1crud.ts (list/get append cite_as: <citeBase>/<id>); 58 CRUD specs wired across 48 workers (auto-derived table→route plus an 11-site explicit map for non-derivable routes like legal_coworker_facts→/api/legal-facts); placement + table↔route pairing audited fleet-wide (0 misplaced, 0 mispaired); 51 workers deployed. Live-verified samples: roles/citations/identities/brands/news rows all carry resolvable cite_as URLs. Note: my first pass-2 insert script corrupted 3 files via stale offsets while mutating — caught by typecheck, repaired with reverse-order insertion, documented here so the pattern isn't repeated.

Flywheel: /api/changes polling feeds on contracts/tasks/memories (stage 5)

DONE 2026-07-02: GET /api/changes live on subagentcontracts.com (contract_ledger), subagenttasks.com (tasks.updated_at), subagentmemories.com (memory_versions) — thin newest-first {type, ref, at, cite_as} events, cursor+limit verified (page-2 strictly older than cursor; cursor must be URL-encoded, it contains a space). llms.txt lines added; subagentapi.com catalog advertises all three (version 838c624e); scripts/flywheel-metrics.sh now reports per-feed freshness (contracts 2026-07-01 20:55, tasks 2026-07-02 19:09, memories 2026-07-02 01:54).

Worker build system: dependency graph + kit-hash locks

DONE 2026-07-02, adversarially verified by execution: scripts/build-graph.py generates workers/build-graph.json (71 workers, 7 kit files; 259 kit_import + 55 runtime_fetch + 647 reference edges, all with file:line evidence; deterministic output, generated_at from git HEAD; scanner reads wrangler [vars] URLs — caught subagentdatamodels' env.CATALOG_URL). scripts/worker-build.sh: tsc + kit-hash drift gate vs per-worker .build-lock.json (66 locks bootstrapped = exactly the 66 kit-importing workers); exit 2 names the changed kit file; --stale fleet mode. Gate PROVEN: kit edit → --stale exit 1 naming http.ts (66 workers) / css.ts flip → worker exit 2 + 63 stale — then byte-exact revert, sha256-verified clean. --check-refs live: all 49 runtime-fetch targets HTTP 200. Real fan-out: wellknown 66, shell 63, http 57, d1crud 49, mcp 24.

Build-system skills across 4 plugins (design/pm/engineering/operations)

DONE 2026-07-02, all four registered in their plugin.json manifests and fabrication-checked against the real tools: cwc-engineering:worker-build (build sequence, lock semantics, exit codes, new-dependency protocol), cwc-operations:dependency-drift-audit (fleet staleness as blast-radius-ordered redeploy queue; weekly review updated to include it), cwc-design:dependency-graph-sync (+ scripts/arch-map-drift.py — real run found 26 drift findings between generated graph and subagentdevices.com/architecture map: 11 graph edges missing from map, 1 reversed, 14 with no ARCH node — documented as routed backlog), cwc-product-management:dependency-contracts (contracted vs uncontracted runtime deps; live check vs subagentcontracts.com's 18 rows; uncontracted-edge backlog seeded).

Dogfood pass: adopt the build system + drift tooling on the real codebase

DONE same-session 2026-07-02. Ran the dependency-drift-audit loop for real; it caught 3 scanner precision bug classes in build-graph.py (generic property-name ident flow classifying static FAMILY_LINKSET_EXTRAS as fetches; 40-line fn-body approximation making esc() fetchy and nav links into fetch edges; loose fixpoint pulling subagentdomains SITES directory in) — fixed with brace-counted bodies, enclosing-const classification, strong seeds, collection-only propagation. runtime_fetch settled at 44 edges = the documented architecture exactly. Then fixed the real map drift on subagentdevices.com/architecture (13 CATALOG-primitive nodes with grep-verified accents, datamodels→api + contracts→tasks dogfood edges, layout v3) shipped THROUGH worker-build.sh (gate → deploy 543d0b38 → --record); arch-map-drift.py now exit 0. Then worked the PM dependency-contracts backlog: rotated CONTRACTS_WRITE_SECRET and created 5 open objective_check dependency contracts (ctr_dep_domains_live_counts, ctr_dep_contracts_tasks_join, ctr_dep_datamodels_catalog, ctr_dep_devices_dogfood, ctr_dep_api_health_fanout). Both skills + wireframes.json ledger updated with the resolved baselines.

SDK: extract agent-readiness endpoints (x402/AP2/JWKS) into kit

DONE 2026-07-02: workers/_shared/kit/agentready.ts (x402Demo/ap2Doc/botAuthDirectory/agentReady router; Fable-5-reviewed semantics + illustrative-labeling rule preserved in code comments). 5 sites refactored (api b51d5863, cli 5a671798, cowork 217c8f4d, coworkers 0afa3a9f, domains 102eda73), each through worker-build.sh — the gate correctly exit-2'd on the new kit dep before every deploy, locks re-recorded after. 15 endpoint JSON before/after comparisons: 13 EQUIVALENT, 2 intended normalizations (cowork/coworkers x402 description now matches the canonical wording — single-sourcing IS the point). New-kit-file strategy confirmed: zero unrelated workers went stale.

SDK: extract /api/changes cursor-feed boilerplate into kit

DONE 2026-07-02: workers/_shared/kit/changes.ts (changesFeed with structural D1Like type so the kit typechecks without ambient workers-types). contracts/tasks/memories refactored (4a420862/badd0bbd/05e33695), locks recorded, all 3 /api/changes?limit=2 responses JSON-EQUIVALENT before/after, cursor pagination re-verified live.

ST1: verify evaluate-workers.py output (62 posted rows)

ST1 done: py_compile clean; dry-run reproduces evidence rows; spot-checks match repo (min-width:0 x2 in roles src) and live row eval_auto_wc2026-bracket.

ST2: write scripts/resync-audit.py (sonnet agent died mid-stream)

ST2 done: scripts/resync-audit.py written inline by lead after the sonnet agent died mid-stream; two audit-precision fixes applied (kit llmsTxt emits family links — src grep alone was wrong; web/wc2026_bracket worker-name map).

ST3: run resync audit, capture 36 verdicts JSON

ST3 done: 36/36 audited, 34 pass / 2 fix_needed; verdicts JSON archived in session scratchpad; rerunnable.

ST4: close passing tsk_resync_* with evidence; file precise gaps for failures

ST4 done: 34 tsk_resync_* closed with per-site evidence; datamodels annotated as blocked on domain registration (tsk_b228566b-1c3); devices annotated with the refined adoption-matrix staleness fix.

ST5: close tsk_wire_evaluations_automation + final build check

ST5 done: parent closed; worker-build.sh --stale exit 0; both new scripts py_compile clean; no worker source modified this cycle.

cwc-finance: startup-finance skill (KISS cost ledger + Launchpad prep)

DONE 2026-07-02: plugins/cwc-finance/skills/startup-finance/SKILL.md — grounded in the real anthropics finance plugin skill set (variance-analysis/financial-statements/audit-support adapted to a monthly one-pager), financial-services-plugins inventory (claude-in-office = cloud-gateway admin tooling, financial-analysis = 11 modeling skills, honestly out of scope pre-revenue), and the operator's stated reality: two-line-item ledger (Cloudflare + $100/mo claude.ai), HARD no-ANTHROPIC_API_KEY rule, Workers Launchpad finance-half prep (submission enrollment_submit-gated). FINANCE_WRITE_SECRET rotated; 3 durable rows live on subagentfinance.com (kind CHECK only allows coworker_capability|plugin_skill — used plugin_skill). Registered in plugin.json.

cwc-legal: startup-formation skill (licensing/trademark/copyright groundwork)

DONE 2026-07-02: plugins/cwc-legal/skills/startup-formation/SKILL.md — adapted from knowledge-work-plugins legal skills (compliance-check/review-contract/legal-risk-assessment), claude-for-legal corporate-legal (entity-compliance) + ip-legal (clearance/portfolio/oss-review/takedown) + managed-agent-cookbooks (renewal-watcher/reg-monitor as routines: 50-domain renewal watch, terms-change watch). Hard not-legal-advice rule preserved. subagentlegal.com was READ-ONLY — added the gated POST /api/legal-facts route (build gate -> deploy 0e88c3bc -> lock recorded), LEGAL_WRITE_SECRET rotated, 4 startup_formation rows live (license status, trademark audit scope, launchpad terms review, portfolio protection). Registered in plugin.json.

Workers Launchpad investor deck (v1) — published

v4 2026-07-02: Cowork-docs grounding round (read from the local mirror docs/docs/claude.com/docs/cowork + plugins/overview.md — the doc subagentcoworkers.com is grounded in). Slide 7 lede now quotes Anthropic's own plugin definition verbatim (bundle MCP connectors, skills, slash commands, and sub-agents into a single shareable unit) and frames the 14 coworkers as that primitive instantiated per business function. Slide 8 gained the-leverage chip naming Dispatch in Anthropic's vocabulary (high-level instructions → tasks → separate sessions) as the mechanical explanation for 60+ verified deploys/day. Slide 12 foot now states the meta-proof: the company is built inside the surface it documents (Cowork project, standing instructions, durable memory). Deployed: worker 4d8d76b8 (gate clean, lock recorded, 3/3 markers verified) + artifact v4-cowork-grounding, same URL.

Propagate Cowork-docs grounding from deck v4 into subagentcoworkers.com pages

DONE 2026-07-02: the deck v4 grounding chain now lives in the site itself, quotes verbatim from the local docs mirror with canonical links. overview.md gained a Grounded-in-Cowork-primitives section (the unit = plugins/overview.md definition, named as this site's root grounding doc; the execution = guide/dispatch.md; the container = guide/projects.md mapped to this repo+CLAUDE.md+memory). getting-started.md cites guide/plugins.md as the install mechanism. plugins.md opens with the verbatim definition and frames the 14 rows as 14 instantiations of that sentence. how-it-works.md gained How-work-actually-runs: envelope is the contract, Dispatch is the engine. Hashes regenerated (integrity clean), worker-build gate clean, deploy 5f42613a, lock recorded, all 4 pages curl-verified live.

Fleet grounding sections: llms.txt ## Grounding on 16 primitives

DONE 2026-07-02: the deck/coworkers grounding pattern propagated to the machine surface fleet-wide. Each of 16 D1 primitives' llms.txt now carries a ## Grounding section (via the kit llmsTxt extra param — zero kit changes, zero collateral staleness): one verified grounding statement + canonical .md source URL (claude-tag how-it-works/agent-identity, platform citations/memory/define-outcomes/permission-policies/vaults/session-operations/tools/webhooks, plugins/overview for skills/roles/code). Quotes only where verified this session (thread-is-durable, fetch-the-object-directly); grounded-in fact statements elsewhere — no fabricated quotes. All 16 through worker-build gates, deployed (256c630f…cddb92d6), locks recorded, 16/16 curl-verified live, --stale clean. Agents reading any primitive now get the citation trail to Anthropic canonical docs — flywheel stage-6 in both directions.

PM strategy layer: product-strategy skill + deck v5 + use-case page

DONE 2026-07-02: cwc-product-management layered into the finance+legal strategy. (1) New plugin skill plugins/cwc-product-management/skills/product-strategy/SKILL.md — four moves: user≠buyer positioning, named north star (returning agent visits: change-feed re-polls + cite_as re-entries), gate-owned now/next/later (finance spend gate, legal attorney gate, PM north-star check), durable+cited strategy artifacts incl. the no-fabricated-TAM rule. (2) Deck v5: positioning lede on slide 3, north star named on slide 5, credit-honesty line on slide 9 (realizable-value discipline as investor credibility), slide 11 roadmap reframed now/next/later gate-owned. Deployed worker 4ffaa6ae + artifact v5-pm-strategy-layer, same URL. (3) New site page subagentcoworkers.com/platform/use-cases/product-strategy — the worked three-coworker example incl. the $100k correction story. Gotcha fixed en route: gen-hashes.py only rehashes LISTED manifest entries — new pages need a manual PLATFORM_DOCS entry (page 404d until registered).

WBR-W27 rec #2: extend /api/changes cursor feeds from 3 to all 24 D1 primitives

EXECUTED 2026-07-03, same week as filed (coworker-in-the-loop: engineering build gate is a coworker gate). 3 parallel agents wired changesFeed into 21 sites (identities/citations/cache/rubrics/outcomes/evaluations/brands + code/prompts/skills/roles/models/handoffs/permissions + vaults/sessions/tools/hooks/rust/python/typescript). Independent sweep: 24/24 /api/changes live, --stale clean. Notes: models+permissions+batch-C sites cite_as → list routes (no per-id routes); 9 outlier tsconfigs aligned (noUncheckedIndexedAccess removed, relaxation-only); kit untouched.

Sales layer: agent-gtm skill, territory book, deck v7, feeds 3→24 executed

DONE 2026-07-03: cwc-sales layered onto the strategy stack, grounded in two fetched Anthropic posts (GTM engineering / 4,000-account book) + upstream sales skill set. (1) plugins/cwc-sales/skills/agent-gtm: two account classes (inventory zones vs buyer operators), gate-owned Gateway pipeline, weekly forecast into WBR, Bryant split (book ranks, human decides). (2) scripts/territory-score.py — the CLAFTS move — scored 49 zones live: 24 Tier A / 1 B / 24 C (reports/territory/2026-W27.md); building it surfaced the Python-urllib 403 bot-protection contradiction (tsk_0536fa28-a30). (3) WBR rec #2 EXECUTED same week: 3 agents, 21 sites, 24/24 feeds verified (coworker-in-the-loop per operator directive). (4) Deck v7 GTM line + /platform/use-cases/agent-gtm page live (worker 759016e7, artifact v7-sales-gtm-layer).

Marketing layer: creative-production skill, HB-01 hero band (deck v8), Higgsfield briefs ready

DONE 2026-07-03: cwc-marketing layered in, grounded in claude.com/blog/how-anthropic-uses-claude-marketing (Austin Lau one-click Figma variations, 30min→30s) + upstream marketing skill set. Agency rules: brief before pixels, palette-locked terminal-noir, no humans/logos/text-in-image, provenance tags, batch-then-select, publish gates. HB-01 executed in-medium: deterministic seeded SVG (166 nodes/325 traces, seed 20260703) live on deck slide 1 (worker 3bb19b72 + artifact v8) with foot provenance. HIGGSFIELD STATUS, honest: MCP at mcp.higgsfield.ai 401s from this session (connector OAuth is account-side, session predates it), Chrome extension disconnected, no local token cache — new OAuth grant deliberately NOT self-initiated (operator-gated class). BRIEFS.md (HB-01/OG-01/VL-01) checked in production-ready: any fresh session with the connector, or a connected Chrome with the operator logged in, executes them verbatim and A/Bs against the same checklist.

Deck layout-system fix (v9): overflow-safe centering, density layer, verified in-browser

DONE 2026-07-03 by cwc-engineering after operator bug report (sizing/overlap/wrapping). ROOT CAUSE: justify-content:center on min-height:100vh flex slides — content grown past one viewport (v3-v8 layers) overflows upward into unreachable clipped space; scroll-snap mandatory traps tall slides. FIXES: (1) auto-margin centering trick (centers short slides, top-anchors tall — never clips), (2) snap mandatory→proximity, (3) eyebrow flex-wrap + 72px slideno clearance, (4) height-responsive density layer @max-height:900px (type scale, gaps, paddings, single-row g2 grids, compact ledes, hero band 20vh cap), (5) wrap-safety (overflow-wrap:anywhere) on chips/foot/small/ul per design system, (6) safe-area insets, (7) kbd-nav rect-based. VERIFIED with real browser via Preview harness at 1280x760 + 390x844: zero clipping, zero slideno collisions, zero horizontal overflow outside scroll containers, doc scrollW = viewport on mobile; tall slides 7→2 (max +6%, graceful); mobile screenshot visually confirmed. Deployed 86294384, lock recorded, artifact v9-layout-system-fix same URL.

cwc-engineering: mac-toolchain (typed doctor) + preview-layout-verify skills

DONE 2026-07-03. (1) mac-toolchain: the darwin/zsh/Homebrew environment missing from the durable-toolchain-doctor/install family — closed-schema toolchain.json (id/kind/purpose/fixes/check/install/gate, every entry citing a real dated failure: No-Chrome-binary-for-devtools, CERTIFICATE_VERIFY_FAILED, zsh no-matches aborts, sccache bypass) + stdlib-only validate.py (NoReturn-typed failures, unknown fields rejected, --doctor runs checks verbatim). Live first run: 2/6 present (jq, rsvg-convert — doctor corrected my own wrong assumptions), 4 missing with exact gated fixes (chrome + certifi + 2 zshrc lines await operator approval — system mutations are operator-gated). Type-safety contract per operator directive: the model copies validator output verbatim, never free-recalls install strings — recorded as standing memory typed-manifests-over-recall. (2) preview-layout-verify: the Claude Preview harness workflow that verified deck v9, packaged with the three invariant measurements and all four harness gotchas (reload-in-own-eval, scrollTo instant, black-screenshot-after-scroll, inspect-over-screenshot). Both registered in the plugin README.

OG-01 executed via Higgsfield (free tier): share card live + og meta; deck v10

DONE 2026-07-03, connector live mid-session. Balance-first discipline (10 credits, free plan): recraft_v4_1 preflighted 1.25cr → 403 plan-gated (honest constraint); z_image preflighted 0.15cr → 2-variant batch (~0.3cr total). Selected variant B per OG-01 checklist (right-third cluster, quiet left overlay zone); 852 purple negative-list pixels retouched to brand green via stdlib-only PNG codec (no Pillow on this Mac — durable-mac-toolchain candidate entry if recurring); cropped 1.91:1, 109KB JPEG (under 300KB budget). Live: subagentcoworkers.com/deck-og.jpg (200) + og/twitter meta on /deck (worker f2613480) + provenance in deck foot + artifact v10 same URL. A/B verdict recorded in BRIEFS.md: seeded SVG stays as the in-page hero band (crisper vectors); generated art wins as the share card. VL-01 (8s video loop) pending operator call vs ~9.7 remaining free credits.