Exercises the real runScheduled + streamEvents resume path end-to-end with a
stateful CursorStore stand-in and a replay WebSocket: a window persists its
newest cursor, the worker "disconnects" (instance flip), and the next window
reconnects FROM that persisted cursor — recovering the cap that landed in the
gap, with no loss inside the retention window. Also asserts the cursor advances
monotonically regardless of event arrival order, so a reconnect never rewinds.

Covers the reconnect/instance-flip requirement (the cursor is a wall-clock
timestamp, portable across a jetstream1/2 flip).

The scheduled indexer already resumes from the persisted CursorStore cursor
(a39679a), but the resume path never bounded that cursor against Jetstream's
retention window. A cursor older than Jetstream's ~72h backfill (long outage,
or an instance flip onto a lagging node) cannot be fully replayed: subscribing
with it silently starts playback at Jetstream's oldest retained event, so the
events between the cursor and the retention edge are dropped while the window
looks like a clean replay.

Detect that explicitly: if the resume cursor predates the retention edge, log
the gap and clamp the replay forward to the edge, recovering everything
Jetstream still retains instead of masquerading as a complete replay. Ports the
bounded-replay intent of thermals@9e0f3d2, extended with the explicit
retention-gap logging this indexer needs.

Adds unit coverage for the clamp+log path and the within-retention no-op.

@scure/bip39@2.0.1 resolves @noble/hashes@2.0.1, whose engine requires
Node >=20.19.0, so a strict install breaks on Node 20.10.x even though
engines.node is >=20.10.0. Pin @scure/bip39 to 1.6.0, whose @noble/hashes
~1.8.0 dedupes with the existing top-level @noble/hashes@1.8.0, and switch
the wordlist import to the v1 subpath (@scure/bip39/wordlists/english).

The BIP39 English wordlist is byte-identical between the two versions, so
cap-ref output is unchanged. Regenerate both lockfiles and bump to 0.6.1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- move org.v-it.cap record assembly + putRecord out of shipCap into new pure src/lib/cap.js (publishCap)
- expose it publicly via package.json exports as `vit/cap.js`; supports optional reply strong refs, app.bsky.embed.external, and caller-supplied rkey/swapCid for idempotent refreshes
- shipCap now builds+writes through publishCap; CLI contract (flags, help, output, caps.jsonl, verbose dump, error guidance) unchanged
- add unit tests (fake agent, exact-write + failure paths), an offline tarball resolve test, and a traversal invariant test

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

# Conflicts:
# explore/src/jetstream.js

The one-minute cron previously live-tailed Jetstream with no cursor, dropping any org.v-it.* commit that landed between cron windows.

scheduled() now reads the cursor from the CursorStore Durable Object, starts from that cursor or a bounded 45-minute startup reconcile when unset, and persists the next cursor only after a fully successful stream window. The stored value advances to the latest observed event cursor, or to the window-open time when the window is quiet.

Cursor read/write failures, malformed cursors, WebSocket and stream errors, and per-event D1 write failures now reject the run and leave the cursor untouched. There is no silent cursorless tailing fallback.

Unit tests cover the scheduler with local fakes and verify replay idempotency with a bun:sqlite D1 shim over the real schema. They avoid live Jetstream, D1, and Cloudflare services.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Polish from the CIO AGENTS.md audit (2026-06-22) — fills the two coding
principles a hopper lode most often re-derives without.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The shipped CLI runs on Node (bin/vit.js); Bun is the dev toolchain only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Vendor the using-vit skill copy into vit itself (Node built-ins, no npx, no network) and self-install it from the commands people and agents actually run, so it no longer depends on package-manager lifecycle hooks.

- add src/lib/skill-install.js: best-effort ensureSkill() that copies the bundled skill into ~/.claude/skills/using-vit and ~/.agents/skills/using-vit, overwrite-refresh, per-target structured results, never throws
- doctor/setup/login/postinstall all call ensureSkill() and report outcome
- add `vit setup` as an exact alias of `vit doctor`
- doctor detects the skill in either ~/.claude or ~/.agents; removes the stale "reinstall vit" guidance; --json stdout stays pure (install log to stderr)
- doctor --json gains a skillInstall key (existing keys unchanged)
- login ensures the skill on every invocation and prints a readiness line
- postinstall drops npx/spawn for the vendored copy; stays best-effort, exits 0
- fix `vit --version` to read package.json (was hardcoded 0.1.0), works under node and bun

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Both postinstall.js (npm install hook) and cmd/learn.js (vit learn)
spawn `npx skills add` via spawnSync. The trailing -y goes to the
skills CLI, not to npx, so on a fresh machine without cached
skills@X.Y.Z, npx halts with an interactive "Ok to proceed?" —
blocking npm install and any coding-agent-driven skill learn.

Pass --yes to npx directly (suppresses the prompt) and set CI=true in
env as belt-and-suspenders against any other TTY-gated checks in the
npm lifecycle. Matches the pattern applied in solstone Makefile.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Replace the generic five-bullet list with four Alex-oriented bullets
covering the concrete failure modes we actually see: Bluesky's "data is
invalid" page (browser session conflict), "Failed to resolve identity"
(DoH blocked, fall back to --app-password), CLI hang on a remote
machine (--remote), and DID-vs-handle guidance. Point to verbose mode
for cause chains.

Add a shared error formatter that unwraps cause chains for both text and
JSON output, route the CLI command catches through it, tighten the login
failure path with a SIGINT cancel helper and common-issues footer, make
network errors name the exact URL they failed against, replace the
approved hidden catches with warnings, and document login troubleshooting
in the getting-started guide.

Files touched:
- helpers: src/lib/error-format.js, src/lib/json-output.js
- commands: src/cmd/adopt.js, src/cmd/beacon.js, src/cmd/config.js,
src/cmd/doctor.js, src/cmd/explore.js, src/cmd/firehose.js,
src/cmd/follow.js, src/cmd/hack.js, src/cmd/inbox.js,
src/cmd/init.js, src/cmd/learn.js, src/cmd/link.js,
src/cmd/login.js, src/cmd/remix.js, src/cmd/scan.js,
src/cmd/ship.js, src/cmd/skim.js, src/cmd/vet.js,
src/cmd/vouch.js
- libs: src/lib/config.js, src/lib/oauth.js, src/lib/pds.js,
src/lib/vit-dir.js
- docs/tests: docs/start/index.html, test/error-format.test.js,
test/explore.test.js, test/json-output.test.js,
test/login.test.js, test/pds.test.js

Silent-catch ledger:
- src/lib/config.js: warn on unreadable vit.json; warn on unreadable
local .vit/login.json.
- src/lib/vit-dir.js: warn on unreadable .vit/config.json; warn on
malformed JSONL lines; warn on unreadable JSONL logs; warn on
unreadable following.json.
- src/lib/oauth.js: warn on unreadable session.json in the session
store, checkSession, and restoreAgent paths; warn on unreadable local
app-password sessions in checkSession and restoreAgent.
- src/lib/pds.js: warn when DID-document handle resolution fails, then
fall back to the DID.
- src/cmd/doctor.js: warn on unreadable SKILL.md files, unreadable
skill directories, install-path inspect failure, unreadable
local/global session files, and unexpected Bluesky session validation
failures.
- src/cmd/beacon.js: warn on invalid target .vit/config.json content.
- src/cmd/hack.js: warn when git remote add upstream fails.
- src/cmd/learn.js: warn when temp-dir cleanup fails.
- src/cmd/login.js: keep the .gitignore probe silent; warn on
unreadable local/global session files during login probes.
- src/cmd/firehose.js: warn and skip malformed JSON messages.
- src/cmd/scan.js: warn and skip malformed Jetstream events.
- src/cmd/init.js: keep the git work-tree probe and optional remote URL
probe chain silent; warn on git remote failure and unreadable remote
URLs.
- src/lib/compat.js: keep the executable lookup probe silent.

Test changes:
- added test/error-format.test.js for flat errors, nested causes,
non-Error throwables, non-Error causes, circular causes, the 10-level
cap, and verbose stack indentation
- added login coverage for cancelLogin() and printLoginFailure()
- added json-output throwable-input coverage for nested and flat errors
- updated explore and pds expectations for URL-specific error messages

Not done / founder steps:
- make ship BUMP=patch (-> 0.4.3): founder's step.
- make deploy-site: founder's step. Required because
docs/start/index.html changed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- link: override HOME to temp dir instead of writing to ~/.local/bin
- beacon: mock isomorphic-git in-process instead of live GitHub clones
- explore: route 12 tests through local Bun.serve() mock server
- doctor: isolate with HOME + XDG_CONFIG_HOME env overrides
- trust-gate, vit-dir: add optional dir param to vitDir() and
dependents, eliminating process.chdir() from tests
- CLAUDE.md: add Testing Standards section (5 rules)

342/342 tests pass. No external HTTP, no real home access,
no process.chdir() in tests.

Restructures the getting started page so users who only want skills
can follow steps 1-3, hit a path fork, and jump straight to a
self-contained skills section — no git repo or beacon needed.

Three edits:
- Prerequisites now note git is only needed for caps
- Path fork after step 3 routes skills-only users to #skills
- Skills section rewritten as standalone entry point (browse → vet → learn)

Note: run `make deploy-site` to publish these changes.

Global WebSocket (used by vit scan and vit firehose) is only available
in Node 20.10+. Raise the engine floor so npm/bun enforce the
requirement at install time rather than failing at runtime.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md is now the primary file with all dev guidelines.
AGENTS.md is a symlink to CLAUDE.md so both filenames work.
Incorporated the vocabulary alignment rule from AGENTS.md into
CLAUDE.md's Development Principles section.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Ship the using-vit skill inside the npm package with a postinstall
script that runs `npx skills add` globally. Delegate `vit learn`
to `npx skills add` via temp dir instead of direct file writes.
Remove `vit setup` command entirely — new onboarding is just
`npm install -g vit` → `vit login` → open agent.

The .agents/skills symlink is already tracked, so .agents/ ignore
rule won't affect it. No need for negation pattern magic.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.claude/skills and .agents/skills now symlink directly to skills/
instead of holding manual copies. Updated .gitignore to track the
.agents/skills symlink while still ignoring other .agents/ contents.
New skills added to skills/ are automatically visible to all agent
harnesses.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Adds the inbound contribution channel for vit:

CLI:
- vit ship --kind request: beacon required (--beacon flag or project config),
text optional, ref auto-generated from title via slugify+hash fallback,
outputs "anyone can implement this. share the ref to build demand."
- vit vouch --kind want/endorse: want-vouches skip trusted gate and beacon
requirement; endorse keeps existing behavior; kind field written to record
- vit skim --kind <kind>: client-side filter on cap kind after beacon filter
- vit explore caps --kind <kind>: passes ?kind= to explore API
- vit inbox: new command — reads readBeaconSet(), queries explore API for
caps addressed to project beacon(s), renders with want-vouch count and age;
supports --kind, --sort want-vouches, --json; graceful degradation

Lexicons:
- org.v-it.cap: adds "request" to kind.knownValues
- org.v-it.vouch: adds optional kind field (endorse|want); omitted = endorse

Explore API:
- /api/caps: adds ?kind= filter and want_vouch_count per cap
- /api/caps: adds ?sort=want-vouches (by want_vouch_count DESC)
- jetstream: stores kind column for caps and vouches
- schema: adds kind column + index to caps and vouches tables
- migrate-cap-requests.sql: migration for existing deployed DB

Vet:
- vit vet <request-ref>: suppresses --trust for kind:request caps,
shows note to vouch --kind want instead

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Update 4 additional vit-mark instances (0 0 32 32 → 3.375 2.5 25.25 25.25)
on slides 4-7 of atmosphere-2026 that were missed in the first pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Update all brand SVGs from the extro master (tight viewBoxes replacing
0 0 32 32 / 0 0 56 34). Update inline SVG viewBoxes in all HTML files:
wordmarks 0 0 56 34 → 3.75 3 49 25.75, marks 0 0 32 32 → 3.375 2.5 25.25 25.25.
Reduce header wordmark height 28→24 and README wordmark height 48→40 to
compensate for ~15% visual size increase from tight viewBox.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Redundant with the new workflow contrast slide that already shows
the skim/vet/remix/ship concepts through the person-vs-agent pipeline.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add slide 2b contrasting human (person→doc→person→code via git) vs
agent (robot→doc→robot→code via vit) workflows. Update existing slides:
rename two forks to clones with inverted arrows, enlarge social loop,
clean up typography (remove periods, center text, consistent green
headers), update CTA to npm install -g, and swap explore URL for
org.v-it.cap lexicon.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Increase the upstream node size in the published ATmosphere 2026 deck and realign the wait badge and incoming connector lines so the labels no longer overlap.

decks are served from docs/decks/ via CF Workers — the top-level
copy was identical and unreferenced.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Fix undefined beacon variable in vouch.js cap vouch record (ship-blocker).
Enrich all empty-state messages with contextual guidance and next steps.
Replace "user" with "operator" in all agent-facing console output.
Only show skim hint/separator when there are actual results.
Add not-found hints with follow/explore guidance in vet, remix, vouch, learn.

Implements cpo/specs/in-flight/vit-cli-surface-polish.md — all 15 acceptance
criteria passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md still said GitHub Pages auto-deploys — corrected to document
the Cloudflare Workers deployment (site/ and explore/ directories).
Root Makefile now has deploy-site and deploy-explore targets that
delegate to the respective wrangler.toml configs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Fix CTA: npx vit login now shows handle placeholder
- Fix slide 6: identity/social-graph/agent/algorithm claims
corrected for ATProto technical accuracy
- Simplify slide 2 SVG: larger labels, better contrast,
removed invisible fine detail (stale forks, capability dots)
- Boost dim text contrast across deck (#888→#AAA)
- Fix slide 5 bottom text sizes for projector readability
- Trim slide 4 density, add concrete examples, bump bridge
sentence to read as punchline not footnote

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

text: 3000/300 → 50000/15000, description: 3000/300 → 10000/1024.
Backwards-compatible constraint relaxation — matches org.v-it.skill limits.
Original limits were inherited from app.bsky.feed.post, not an intentional
product choice. Structured caps need room for intent, scope, risk assessment,
and implementation guidance.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add --app-password flag to authenticate via ATProto createSession,
bypassing browser-based OAuth. Add --local flag to store session
in .vit/login.json instead of global config, scoping identity to
the project directory.

Update requireDid() precedence: --did flag > .vit/login.json > global
config. Update restoreAgent() and checkSession() to handle both OAuth
and app-password session types transparently. Update vit doctor to
surface identity source and auth type.