Mdex Software Factory

Skill: the MULTI/DEX software factory

Several Claude sessions work one shared task queue continuously: TaskConsumers (typically 3-5, each a CLI executor session in its own git worktree with its OWN local venue - the worker doctrine below) claim and execute tasks; one TaskPrioritizer reorders the queue and keeps the board; TaskProducers (ad hoc) turn instructions, audits, and community issues into tasks; and one standing operator seat hosts operator-directed work. The operator (Dominic) boots sessions and is the escalation path. There is no message bus and no coordinator process: the queue directory IS the coordination, and every mutation is an atomic same-filesystem rename, so races have exactly one winner and losers retry. The operator's control channel to a running seat is a FILE too - tasks/signal/ (Operator signals, below) - not a chat message.

Three things make this factory different from a generic one, and they are all load-bearing:

1. This machine hosts live systems. Long-lived bot fleets drive the LIVE subnet at multidex.ai and the cloud engine, and the primary checkout's :8000 local network is the operator's standing demo venue. Seat isolation (own worktree, own ICP_HOME, own OS-assigned port) and the mdex-process-safety skill are how the factory coexists with all of that.
2. Nothing is ever pushed. Merges land on the primary checkout's main LOCALLY. Pushing to origin or the public mirror is the operator's act, on explicit instruction only, sequenced by the outward-batch policy - the factory has no push step anywhere.
3. Task production stays as it is today. docs/tasks/ (tracked) remains the authored task corpus - W-style briefs, done/, the README queue table. The factory adds a RUNTIME queue (tasks/, gitignored) that carries execution state: claims, priorities, dependencies, the board.

scripts/factory.sh is the ONLY way to touch the queue. It works from the primary checkout or any worktree (it resolves the queue root to the PRIMARY checkout's tasks/ either way - git worktree list puts the primary first). Run scripts/factory.sh help for the command table; scripts/factory-selftest.sh exercises it against a throwaway queue.

The queue on disk

tasks/queue/     pending tasks, one md file each:  PPPPPPPPPP-IIIIIIIIII.md
tasks/claimed/<worker>/   in-flight tasks, one subdir per consumer
tasks/archive/   terminal tasks: <id>.md  (status stamped inside)
tasks/factory/   coordination surface: index.md (the board), merge.lock/,
                 .ids/ (the append-only id allocator - never touch, never clean)
tasks/handoff/   one <worktree-basename>.md per seat waiting for a successor
                 session: the boot prompt, on disk, where an app restart
                 cannot reach it (`factory.sh handoff-list`)
tasks/signal/    operator ORDERS to a seat: <worker>.md, plus all.md (the
                 broadcast). Wakes every `watch`, blocks that seat's next
                 `claim` until acknowledged (Operator signals, below)

All six are gitignored runtime state. The tracked corpus in docs/tasks/ is unaffected and keeps its current conventions exactly. One further piece of runtime state lives outside tasks/: each seat's <worktree>/.factory-worker (gitignored too), the one-line identity pin factory.sh reads instead of guessing a worker from the cwd's branch - see the TaskConsumer setup.

Naming. P (10 digits) is the priority key; I (10 digits) is the immutable id. Both start as the UTC epoch seconds of creation, so an untouched queue lists in FIFO order and ls tasks/queue IS the execution order (ascending). The prioritizer renames ONLY the P half. The id is the task's identity forever - in after: dependencies, in archive filenames, in board notes - and the allocator guarantees it is never minted twice.

Lifecycle. queue/ -> claimed/<worker>/ -> archive/ - claim and archive are mvs performed by factory.sh; there are no other states. A task in queue/ is claimable by definition; if it must not run yet, that is expressed by after: dependencies or a 90-band parking, not by side agreements.

The two layers. A queue task either inlines its whole brief (small, self-contained work), or names a tracked brief with docfile: docs/tasks/<file>.md plus a one-paragraph gist. The brief rides git, so every worktree sees it and law 6 (self-containedness) is satisfied transitively. Closing a docfile: task INCLUDES the corpus bookkeeping, on your branch so it rides your merge: move the brief to docs/tasks/done/ with the **done <date>**: ... completion note in the current style, and strike its row in docs/tasks/README.md (~~[W..]~~ ... — **done <date>**: ...). factory.sh done refuses to archive while the brief still sits at its original path - the bookkeeping law, mechanical so forgetting is impossible. Each seat edits only its OWN task's README row; rows are one line each precisely so parallel strikes merge clean.

The operator lane. lane: operator in a task's front matter means the task is WAITING ON THE OPERATOR and no consumer seat may claim it. It holds two shapes of work: operator-EXECUTED tasks (engine/subnet rollouts, pushes, anything needing human-held auth - law 8), which the operator resolves with done; and operator-INPUT tasks (a decision, credential, or clarification a consumer needs), which pass THROUGH the lane - the answer is embedded in the task file and it is released back to the consumer queue (the OperatorTasks role below). factory.sh claim skips lane tasks entirely, including as a last-resort fallback, so a seat gets an itemized EMPTY rather than forbidden work; factory.sh claim --operator claims only them. list --operator / list --consumer filter, and the board gives them their own section - being SEEN at rollout time is the point of the lane, not being worked. This is a different axis from priority: band 90 only DELAYS a claim, and on a contended queue "nothing else remains" arrives routinely; a task no consumer may run must be unclaimable, not merely parked.

The laws (every role)

1. Only factory.sh mutates queue state. Never mv/rm/Write task files by hand, and never operate on a worktree's own tasks/ copy.
2. The id half of a filename never changes. Only the prioritizer renames the priority half, only via reprioritize, only for QUEUED tasks.
3. A claimed task belongs to its worker: nobody else edits or moves it. The prioritizer flags stale claims on the board but never requeues them itself - that is the operator's call (or the owning session's, via requeue).
4. The prioritizer never edits task content, never claims, and never touches git history or refs (no commits, merges, checkouts). Its only git contact is the janitor's read-only liveness look at a stale claim's worktree.
5. Nobody DEVELOPS in the primary checkout. It hosts four things only: the runtime queue, the canonical :8000 local venue (the operator's - see "The operator seat"), the untracked rollout config (scripts/.subnet.conf, scripts/.cloud-engine.conf, the API-key files), and merges performed under the merge lock. Consumers' only writes there are through factory.sh and that final merge; operator-directed development happens on the operator seat, not in the primary.
6. Every task is self-contained: a session with no memory of the conversation that produced it can act on it (a docfile: brief counts - it is tracked in every worktree). If it is not, it is not a task yet.
7. Follow-up work any session discovers is filed as a queue task - never a suggested-task chip, never a note in some doc.
8. Consumer seats never touch a remote target and never push. Concretely out of bounds: scripts/deploy.sh engine|subnet, deploy_to_engine.sh, deploy_to_subnet.sh, start_bots_*/stop_bots_* for engine or subnet, topup*.sh against remote targets, anything that reads scripts/.subnet.conf or scripts/.cloud-engine.conf, and git push to ANY remote (origin and the public mirror are operator acts under the outward-batch policy). Live verification happens on the seat's OWN local venue. Remote rollout is a different trajectory with its own human-held auth - icp reauth is a web flow that WEDGES in a non-interactive session (piped output swallows its URL and the command parks forever), so a consumer that tries either blocks for hours or, worse, an expired delegation fakes success. When a task's remote part matters: do the local part, note the remote part as DEFERRED in the completion note, and file a follow-up task carrying lane: operator. Sole exception: the task text itself explicitly makes a remote deploy the deliverable - and such a task is operator-lane by construction.
9. Nobody edits a QUEUED task file in place - not even its producer. To change task content, own it first: consumers edit only their claimed files; the operator takes a specific task with claim --operator --id <id>, edits, and requeues. An in-place Write racing a claim recreates the moved file as a ghost duplicate of a task someone else now owns.
10. mdex-process-safety is binding in every role. No pattern kills (pkill -f took down the live subnet fleet three times), no pgrep-based waits (they match the waiting shell itself), kill only PIDs you captured or via the repo's stop_bots_* machinery, never leave an icp network status poll unattended without a kill-after watchdog, and EVERY icp invocation carries --identity <name> - never icp identity default, whose global state other sessions and connectors mutate mid-run. Read that skill before your first process or icp operation; it is short and it is the machine's #1 hazard list.
11. The posture law. A branch merges into main only on the committed defaults: src/backend/main.mo AND src/bridge/main.mo resolve to #play (read by mdx_posture_of, the one comment-aware reader), and icp.yaml carries no port: 0 line. factory.sh merge-lock acquire <branch> enforces it mechanically. The seat-local #dev flip and the port-0 gateway edit are legitimate WORKING-TREE state (that is how a seat's venue runs); the law is what lets them exist without ever reaching main.

Task file format

---
producer: <who filed it: branch, "dominic", "audit-2026-08-17", ...>
class: security-high | security-medium | architecture | prerequisite |
       feature | hygiene | docs | parked   (advisory - the prioritizer's input)
touches: backend, tests            (see the vocabulary below; "suite" = repo-wide)
docfile: docs/tasks/W4-23-clamp-amm-half-spread.md   (the tracked brief, when one exists)
after: 1785709403, 1785709404      (ids that must archive first)
split_from: 1785709400             (lineage, when split)
lane: operator                     (waiting on the operator - execution OR input)
---
# <imperative title - what will have happened when this is done>

Goal, context, and exact pointers: paths, file:line, the shape of the change,
and HOW TO VERIFY (which suites, which gates, what to look at). Out-of-scope
notes if the edges are temptingly fuzzy. With a docfile: a one-paragraph gist
plus anything the brief lacks (the brief carries the details).

## Factory log        <- appended by factory.sh; never write this yourself

Only the # title line is mandatory (factory.sh refuses drafts without one); class and touches should almost always be present, docfile whenever a tracked brief exists, after whenever order matters, and lane: operator whenever law 8 puts the work out of a consumer's reach. Fields are greppable plain lines - keep them single-line, comma lists.

touches: vocabulary (the affinity and overlap currency - use these, not ad hoc strings): backend (src/backend), bridge (src/bridge), arb (src/arb), archive (ArchiveCanister + archive design), frontend (src/frontend), verifier (scripts/verify_ledger.mjs + its fixtures), deploy (scripts/), tests (tests/), docs (docs/), candid, and suite for repo-wide waves.

Priority bands

The prioritizer expresses policy by renaming into bands: new priority = BB * 10^8 + (id mod 10^8) - factory.sh reprioritize <id> <BB> computes this - which preserves FIFO order among tasks in the same band.

Rationale in one breath: security before features so it is baked in, not bolted on; the tape and the verifier are REQUIREMENTS under the transparency doctrine, not features - rank them accordingly; architecture before the work it would rework; prerequisites before their dependents; everything else FIFO.

Band 90 is not a way to say "never": it delays a claim, it does not refuse one. Work a consumer must NOT run belongs in the operator lane (lane: operator), a separate axis - a task can be band 01 and operator-lane at once.

Role: TaskProducer

1. Collect the work: the operator's instruction, an audit round, community issues, or existing findings. One task per independently completable item.
2. Dedupe first: scripts/factory.sh list, the board (tasks/factory/index.md), a grep of tasks/archive/, AND the corpus - docs/tasks/README.md's queue table plus docs/tasks/done/. Extend or skip rather than duplicate; the "Already resolved - do not redo" table in the README exists because reporters re-report fixed things.
3. Author to the current corpus standard. Substantial work gets a W-style brief in docs/tasks/ exactly as today (verified against the working tree by symbol lookup, citations, the how-to-verify section, pushback recorded where a reporter is wrong) and a THIN queue task pointing at it via docfile:. Small self-contained items inline everything in the queue task. Either way the self-containedness bar is law 6, and sources are cited (file:line, issue numbers, commit shas).
4. scripts/factory.sh new <draft> - it allocates the id and prints the queue path. Draft in your scratchpad; the draft file stays where it was, inert. (New briefs in docs/tasks/ are ordinary tracked edits - commit them through the normal branch flow, not by writing into the primary.) File in dependency order: an after: id must be one new has ALREADY printed (every filing prints its id) - never a guessed or predicted one. new refuses a draft whose after: names an id that was never minted, because a nonexistent gate gates nothing: claim treats unknown ids as satisfied (live-ids-only, deliberately - in the open-saas factory five guessed-id gates once let four "sequential" tasks run concurrently). File prerequisites first, then the dependents citing the printed ids.
5. Report the filed ids/titles. Do not set priorities - that is the prioritizer's job; your class: field is its input. (Genuine emergencies: say so to the operator rather than guessing a band.)

Set lane: operator on anything a consumer seat is forbidden to execute - engine/subnet rollouts, pushes, anything needing human-held auth or a decision only Dominic can make. That is a statement of fact about the work, not a priority call, so it IS yours to set. Leaving it off does not merely mis-sort the task: seats will claim it, discover they must not act, and requeue it, indefinitely.

Seeding the queue from the corpus: the standing instruction "work the docs/tasks queue" translates to one thin docfile: task per open row of docs/tasks/README.md, skipping rows marked IN FLIGHT in another session, with after: wiring where a brief names an ordering. Do this once at factory boot and again whenever a new triage round lands in the corpus.

Role: TaskPrioritizer (exactly one session)

Loop forever: wake -> triage -> reorder -> board -> janitor -> re-arm - and keep this skill fresh MECHANICALLY, not by feel: every pass, stat the primary copy (stat -f %m <primary>/.claude/skills/mdex-software-factory/SKILL.md - one token-free shell call, foldable into the same Bash call as your watch); RE-READ the file whenever that mtime moved past your last read, and in any case at least once an hour. The mtime gate means a protocol change reaches you within one pass; the hourly floor exists because even an unchanged skill needs occasional re-reading - summarization quietly erodes the copy in your context.

• Wake: scripts/factory.sh watch 500 blocks until queue/claimed/archive/signal change (prints CHANGED) or times out (TIMEOUT) - act on either, then re-arm. In a harness with background tasks, run watch 3600 via a background Bash call and you will be re-invoked on completion; otherwise call it in the foreground repeatedly. Either way each pass costs nothing when idle.
• Triage: factory.sh list; read (factory.sh show <id>) tasks you have not seen before (the board is your memory of what you have triaged). Judge class and content per the band table - and check after: chains: a dependent must sort behind its prerequisites (band 04 the prerequisites forward rather than parking the dependent, when both matter).
• Reorder: factory.sh reprioritize <id> <band>. If it errors, the task was claimed mid-rename - that is fine, drop it. Do not churn: rename only when the current position is actually wrong.
• Rank bands, not tasks - keep the head band BROAD. A band is a statement that its members are equally important, and that interchangeability is what consumer affinity (claim --affinity) converts into warm-context throughput: a seat may take any same-band task it knows the ground for, never anything past the band. A head band holding one task disables affinity exactly where most claims happen. So when you promote several tasks of comparable urgency, put them in the SAME band (within-band FIFO is preserved by the formula); split finer only when one genuinely must precede another - and a true must-precede is usually an after: dependency, not a band distinction.
• Board: factory.sh index regenerates tasks/factory/index.md - the operator's one-glance view. Refresh it every pass. Its Seats awaiting successor section lists tasks/handoff/ - seats that handed off and are sitting unmanned. Call any entry older than an hour out in your pass summary: a shrinking fleet is invisible otherwise (a CLI seat's self-spawn can fail; a desktop chip can die with an app restart). Its Operator signals section lists unacknowledged orders - each line is a seat that CANNOT claim until it acknowledges, so an old entry means a stopped or dead seat: call those out too.
• Janitor: the index marks claims idle >4h as STALE. Investigate liveness read-only (is the worktree still there? recent commits? git -C <worktree> log --oneline main..), REPORT on the board via your pass summary, but do not requeue (law 3). ONE exception the operator has standing approval to act on, and which you should therefore state plainly rather than merely flag: a claim whose seat has been silent for HOURS and whose worktree hosts no live session (no recent writes, no successor Terminal, no handoff file being worked) is requeue-eligible even mid-band - an app quit kills desktop sessions MID-TURN and such claims strand their tasks for many hours. Say which claims qualify and why; the requeue itself is still the operator's call, and its note must say what partial work sits on the seat's branch so the next claimant does not redo it. Also factory.sh merge-lock status: a wedged lock older than 30 min will be broken by the next acquirer automatically; mention it. And title hygiene: retitle any fleet session whose title has drifted from this skill's conventions (a consumer still wearing a boot auto-title, a spare never cross-titled) - you may rename every session except your own (cross-titling, in the warm-spare pool section), and this sweep is what keeps the resume fan-out's title match honest.
• Resume fan-out: when the operator reports a harness restart, nudge every fleet session (titles matching MULTI/DEX worker — *, plus the legacy MULTI/DEX — worker started * until the fleet rolls over) via the session-management tools (list_sessions + send_message, where the harness offers them): "Harness restarted - re-read the skill and follow its restart checklist, then continue." Report any session you could not reach so the operator nudges it by hand; then resume your own loop. (CLI executor seats survive app restarts and usually need no nudge - their dead watchers re-invoke them; the fan-out is the safety net.)
• You never edit task files, never claim, never merge, never touch git beyond the janitor's read-only look (law 4).

Role: OperatorTasks (the operator's console; run with the operator present)

One session, on demand, on the OPERATOR SEAT or in the primary checkout (--operator claims are allowed from both). It turns the operator lane into an interactive inbox: what is waiting on the operator, answered in conversation, resolved in the queue. It ends when the inbox is clear - a standing session adds nothing, since every resolution needs the operator anyway.

1. Inbox: scripts/factory.sh list --operator, then show <id> each. Present a numbered digest - per task: what it is, the EXACT question or action needed, and what it unblocks (grep the queue for after: citing its id; more dependents = present it earlier).
2. Discuss: the operator answers, decides, or performs auth steps in chat. Push back on ambiguity: once embedded, the answer must meet the self-containedness bar (law 6) - the eventual consumer has no access to this conversation.
3. Resolve, per shape:
   • INPUT task (needs an answer): factory.sh claim --operator --id <id>, then edit the file you now own - replace ## Needs from operator with ## Operator answer (<date>) recording the decision verbatim, and DELETE the lane: operator line. factory.sh requeue <id> [band] returns it to the consumer queue with the answer riding in the file.
   • EXECUTION task (engine/subnet rollout, a push): keep the lane; execute it here and now with the operator present for auth - from the PRIMARY checkout on merged main, foregrounded so the icp reauth URL is visible - then factory.sh done <id> done "<what ran, where>".
   • Obsolete / answered elsewhere: claim --operator --id <id> then done <id> superseded "why".
4. Law 9 always: never edit a queued file in place - claim-edit-requeue is the only safe edit. Never touch consumer ordering beyond the requeue band hint; the prioritizer owns the queue order. New work the discussion surfaces is filed via the producer procedure, not bolted onto existing tasks.

Role: TaskConsumer

The worker doctrine (adopted 2026-08-20 from the open-saas factory's 2026-08-19 operator decision): workers are CLI sessions running EXECUTOR MODE - always. Boot workers with the claude CLI in a Terminal (never as desktop-app sessions - the desktop is the OPERATOR's surface), and always in executor mode (below; no longer a variant). Why: CLI seats survive desktop-app restarts (upstream lost its whole fleet twice to app restarts killing desktop workers mid-turn), the whole lifecycle is scriptable (boot loop, spawn-successor, signal files - no chips, no clicks, no message-delivery uncertainty), and executor seats stay clean for hundreds of cycles. Session names carry the PROJECT PREFIX: <prefix>-executor-<seat> (non-executor boots: <prefix>-worker-<seat>), where <prefix> is FACTORY_PROJECT if set, else the primary checkout's directory basename with any -ng/-main suffix dropped - here multidex -> multidex, so multidex-executor-<seat>. Derived, never hardcoded, so forks inherit correct names for free; several projects run this factory pattern on one machine (open-saas among them), and the prefix is what keeps claude --resume pickers and process listings unambiguous. spawn-successor mints it automatically; operator hand-boots pass the same --name shape. Existing sessions are never force-renamed - they converge at their next handoff. Chips and message-activated warm spares are desktop-era mechanisms: RETIRED for workers (the sections below remain for the operator's desktop surfaces and the transition).

Setup once: work in your own git worktree on a claude/<name> branch - never in the primary checkout (law 5). If you were started in the primary checkout, create/enter a worktree first (EnterWorktree, or git worktree add .claude/worktrees/<name> -b claude/<name> from the primary). Your worker identity is your branch name with / flattened to -.

PIN IT ONCE, as your first act on the seat:

cd <your-worktree> && scripts/factory.sh worker-pin

That writes <worktree-root>/.factory-worker (one line, the flattened branch; gitignored runtime state). Every later claim/requeue/done run from ANYWHERE inside that tree - executor subagents included, since they run inside it by construction - then resolves the seat's own name instead of deriving one from whatever branch the cwd happens to sit on. Derivation from the cwd is what mints wrong-worker claims (upstream: twice in one hour on 2026-08-04; again on 2026-08-19 from a drifted executor subagent), each costing a requeue + re-claim bounce, and leaving the board and tasks/claimed/ lying about who holds what in between. Belt and braces for commands that may run OUTSIDE your worktree (harness-BACKGROUNDED ones inherit the harness's DEFAULT cwd, which can be another seat entirely): pass the worker explicitly (factory.sh claim <worker>) or export FACTORY_WORKER=<worker> on the command. Precedence is explicit arg > FACTORY_WORKER > the .factory-worker pin > cwd branch; claim prints the effective worker on stderr (factory: worker: <name>) - check it in every claim's output - and WARNS whenever the pin and the name actually used disagree, which is drift caught in the act. factory.sh worker prints what the current directory resolves to and why. (requeue/done locate your claimed file by id across all workers, so they are cwd-proof; with a pin present they also warn if the claim you are closing belongs to another seat.) If your harness offers session titling (set_session_title), title this session MULTI/DEX worker — <seat> — <UTC datetime> where <seat> is your worktree's basename (seat-1, seat-2, ...; legacy adjective-named worktrees use that basename) and the timestamp is date -u '+%Y-%m-%d %H:%M'. Seat-first titles make the operator's session list scannable by seat, and successive sessions on one seat share a prefix - honest start times tell them apart. Handoff successors overwrite any staged chip title this way too. Some harnesses REFUSE to rename the calling session (Claude Desktop does): when self-titling errors, read your own id from $CLAUDE_CODE_HOST_SESSION_ID and have another fleet session apply the exact title for you - the cross-titling procedure, in "The warm-spare pool" below. Never block on a title: keep working and let the fleet converge on it. (CLI seats booted with --name already list unambiguously; the title is the desktop-facing half.)

Seat venue - bring-up (once per seat)

Your worktree runs its OWN local venue, fully isolated from the primary's :8000 venue, from other seats, and from the machine's global icp identity store. The recipe, in order, from the worktree root:

1. Isolated icp store: export ICP_HOME="$PWD/.icp-home" - and export it in EVERY shell that runs icp or any script (children inherit it; a call without it acts on the GLOBAL store, whose ~300 identities also risk the CMC mint-cap abort at network start). Create the identities the suites use: icp identity new alice --storage plaintext (and bob, charlie when a task's suites need them). The fresh store contains only anonymous, which locally IS a controller - that is expected.
2. Own gateway port: in the worktree's icp.yaml, give the local network gateway: { port: 0 } (the OS picks a free port). This edit stays UNCOMMITTED for the seat's whole life - commit by explicit paths (never git add . / -a), and the posture law refuses the merge if it ever reaches a commit. Never point at :8000: that port is machine-global, first-come, and is normally the primary's live venue. The signature "Error: the local network for this project is not running" while curl 127.0.0.1:8000/api/v2/status succeeds means :8000 is SOMEONE ELSE'S gateway and your own master is dead or never started - never "fix" strays there.
3. Build prerequisites: mops install, then mops generate candid backend - src/backend/backend.did is a gitignored intermediate, absent in a fresh worktree, and icp deploy fails its Candid compatibility check without it.
4. Start the network: overlapping icp network starts wedge on a loaded machine, so before your FIRST start (or any start after a stop) check pgrep -f "icp network start" and wait for in-flight starts to clear (healthy starts take ~20s) - this is the ONE machine-wide wait in the whole protocol. Then icp network start --background and watchdog your own start: no port descriptor within ~90s means wedged - kill both halves of YOUR start (captured PIDs, never a pattern), remove your worktree's network lock, retry.
5. Deploy + seed on #dev: flip DEPLOY_MODE to #dev in src/backend/main.mo, run bash scripts/cold_start.sh --mode full --no-simulate, then RESTORE #play in the tree immediately (see the posture rhythm below). --no-simulate is non-negotiable on a seat: sim bots crash the local pocket-ic master silently within minutes, and N seats running fleets would flatten the machine besides. cold_start's stray-master reaper resolves ownership via icp network status (worktree-safe by construction since W1-06); if it nonetheless kills your OWN master, stop and re-verify rather than editing the reaper.
6. Trust, then verify the controllers: cold_start's "✓ alice promoted" line can lie (the settings update is ||-swallowed). Before running anything, confirm icp canister status backend --identity anonymous | grep Controllers lists 2vxsx-fae. If not: icp canister settings update backend --add-controller 2vxsx-fae --force --identity alice.

The posture rhythm - the venue runs #dev, the tree stays #play: the integration suite requires #dev-gated hooks (setAmmRefPrice and friends trap on #play by design), so every DEPLOY to your venue happens with the flip in place - flip #play -> #dev, bash scripts/deploy.sh local (or the cold_start above), restore #play in the tree the moment the deploy finishes. Never let the flip sit in the tree between deploys: a lingering flip turns git merge main into a conflict magnet on main.mo and a slip away from committing #dev - which the merge gate would refuse, at the cost of a redo. A wall of red on suites whose fixtures fail at setup is the posture signature: check echo y | icp canister call backend getDeployMode '()' --query --identity anonymous before blaming your change.

Never stop your replica while you idle. icp network stop/start does NOT resume state - a restart comes up freshly seeded with no canisters, and the only restore is a full cold_start + reseed (minutes). The cheap idle is the replica you never stopped. Stop it only when RETIRING the seat (wind-up) or when the operator asks for machine headroom - and budget the re-bring-up.

Loop - and every cycle STARTS by re-reading this skill from the PRIMARY checkout (<primary>/.claude/skills/mdex-software-factory/SKILL.md; primary = git worktree list --porcelain | sed -n 's/^worktree //p' | head -1). The protocol evolves while sessions run; your boot-time copy and your worktree's checked-out copy both go stale, and the primary's copy is authoritative. One Read per task is cheap; obeying a superseded protocol is not.

Every cycle also verifies the model. Consumer seats run on Fable 5, and the platform sometimes flips a session (fast mode, usage fallback). Check your CURRENT system prompt's environment section - it names the model actually powering you now; trust it over anything earlier in the conversation. A session cannot flip itself back, so if it does not say Fable 5, make the first line of your next message:

!!! MODEL - running on <model>, flip me to Fable 5 !!!

then continue working normally - never block or park over model drift, and repeat the banner once per claim cycle while it persists (the flip back is the operator's, via the app's model picker).

1. Claim: scripts/factory.sh claim <your-worker> --affinity <a,b,c> - always name your worker (or export FACTORY_WORKER); a backgrounded claim without it, from a seat that never ran worker-pin, derives the worker from the harness cwd's branch and can mint another seat's identity (see Setup). The affinity list is the touches: of your last task or two - your warm context. Affinity reorders WITHIN the head priority band only: among equal-priority work you get the task you already know the ground for (and same-area work serializes onto one seat instead of ping-ponging), but higher-priority work can never be skipped past. Omit --affinity on a fresh seat. Beyond that, claim picks the best eligible task - skipping tasks whose after: ids are still live, soft-skipping tasks whose touches: overlap another session's active claim (to keep merge conflicts rare; if everything overlaps it takes the head anyway) - moves it to tasks/claimed/<you>/ and prints the path. Announce it immediately (the === CLAIMED TASK === banner below) before starting work. EMPTY means idle - and it arrives itemized: EMPTY (queue N: X dep-gated, Y operator-lane, Z overlap-deferred), or EMPTY (queue 0) when queue/ is literally empty. RELAY the breakdown in your idle report - "idle: 16 dep-gated (behind 1785898191), 4 operator-lane" tells the operator the truth, and naming the gating prerequisite beats the bare count. Say "queue is empty" ONLY on a literal EMPTY (queue 0). A claim that REFUSES with an operator signal is waiting for '<you>' is not an error either: the operator has given you an order, printed right there in the refusal - carry it out, acknowledge it with factory.sh signal-clear <you>, then claim again (Operator signals, below). On idle: factory.sh watch (background it on this harness) and claim again on wake - a signal wakes that watch too. If you instead wake to a "background task stopped - no completion record" notice for your watcher, the HARNESS RESTARTED: that notice is your resume signal, not an anomaly - announce "restart detected - resuming", follow the restart seat checklist (Operator guide), and never end your turn having only narrated the dead task. And KEEP your replica running while you idle (above).
2. Sync, then sanity-check. First git merge main into your branch: other seats land work continuously, and an after: dependency being archived only promises the prerequisite's code is on MAIN - a lagging branch can be missing exactly what your task depends on. (Clean tree first: the posture rhythm means no lingering main.mo flip.) If the task needs the live venue, redeploy your venue per the posture rhythm. Then sanity-check the task against current reality: cited files/lines still exist? Already fixed by someone else? The corpus README's "Already resolved - do not redo" table? If stale: factory.sh done <id> superseded "why" and claim again.
3. Split when splitting beats doing: work discovered to be multi-session sized, separable, or blocked on a missing prerequisite becomes NEW tasks (producer procedure: draft + new, with after:/split_from: wiring), then factory.sh done <id> split "-> <new ids>". When mid-task work is partially done and coherent, integrate what stands (below), then split the remainder.
4. Execute in your worktree. The execution rules that are multidex physics, not style:
   • Deploys go to your worktree's OWN venue only (law 8). ICP_HOME exported, --identity on every icp call (law 10) - tests/_lib.sh and scripts/seed.sh already enforce the pin at the helper layer; match them in ad hoc calls.
   • The harness shell cwd is treacherous: after ANY foreground Bash call is timeout-moved to the background, the NEXT call's working directory RESETS to the session's default cwd - which can be a DIFFERENT worktree. Prefix EVERY deploy/icp/mops/test invocation with an explicit absolute cd <your-worktree> && ..., and re-check pwd before trusting any relative path after a backgrounding event (a stray relative deploy once seeded a whole venue into the wrong worktree).
   • Deploys against your RUNNING replica contend with nothing of other seats': never wait for machine-wide quiet, never poll for other sessions' deploys, never build wedge detectors - deploy immediately. The one start-line exception is bring-up step 4.
   • Mid-task discoveries you will not do now: file them (law 7). Doctrine questions (posture, transparency, disclosure) are operator-INPUT tasks - park into the lane rather than deciding unilaterally.
   • Never edit a running script in place (a live fleet's bash re-parses mid-run); atomic-rename or stop-first. Restore accidentally clobbered files from copies, never git checkout over uncommitted work.
   • Commit at verified checkpoints, by explicit paths (the seat's uncommitted icp.yaml port edit must never ride along).
5. Verify what the task's "how to verify" says, plus the narrowest honest gate set for what you touched:
   • Unit (no venue): mops test for the Motoko suites in tests/*.test.mo.
   • Static (no venue): bash tests/test_deploy_hygiene.sh and the other source-reading suites - run hygiene whenever you touched scripts/, deploy paths, or anything a hygiene section pins.
   • Integration (your #dev venue): the specific tests/test_*.sh the task names, or bash tests/run_all.sh [--filter X] - from the worktree, ICP_HOME exported. Suite physics: it is NOT idempotent across runs (test_state_reset wipes the venue near the end), and a FAILING run can strand global state that reds OTHER suites - so reseed (cold_start --mode full --no-simulate, posture rhythm) between full runs and before re-diagnosing a surprising red. Cheap wipe check first: echo y | icp canister call backend getAmmPools '()' --query --identity anonymous returning (vec {}) means you are reading noise, reseed. On a freshly seeded seat venue, feed/anchor-leaning suites (the archive tr

…(truncated)