fix(practs): bump to latest best practices

.agent/repo=.this/role=any/skills/use.apikeys.sh

@@ -12,14 +12,12 @@
 #   - falls back to .env.local (gitignored) in repo root
 ######################################################################
 
-# fail if not sourced (check if $0 matches this file)
-case "$0" in
-  *use.apikeys.sh)
-    echo "error: this file must be sourced, not executed"
-    echo "usage: source $0"
-    exit 1
-    ;;
-esac
+# fail if not sourced (return only succeeds when sourced)
+(return 0 2>/dev/null) || {
+  echo "error: this file must be sourced, not executed"
+  echo "usage: . $0"
+  exit 1
+}
 
 # alias source to `.` for posix compat
 source() { . "$@"; }

.claude/settings.json

@@ -33,6 +33,12 @@
             "command": "./node_modules/.bin/rhachet run --repo bhuild --role behaver --init claude.hooks/sessionstart.boot-behavior",
             "timeout": 10,
             "author": "repo=bhuild/role=behaver"
+          },
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet roles boot --repo ehmpathy --role architect",
+            "timeout": 60,
+            "author": "repo=ehmpathy/role=architect"
           }
         ]
       }
@@ -52,6 +58,12 @@
             "command": "./node_modules/.bin/rhachet run --repo ehmpathy --role mechanic --init claude.hooks/pretooluse.check-permissions",
             "timeout": 5,
             "author": "repo=ehmpathy/role=mechanic"
+          },
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet run --repo ehmpathy --role mechanic --init claude.hooks/pretooluse.forbid-suspicious-shell-syntax",
+            "timeout": 5,
+            "author": "repo=ehmpathy/role=mechanic"
           }
         ]
       },
@@ -125,6 +137,8 @@
     "allow": [
       "Write(.agent/.notes/**)",
       "Edit(.agent/.notes/**)",
+      "Write(**/.test/**)",
+      "Edit(**/.test/**)",
       "mcp__ide__getDiagnostics",
       "WebSearch",
       "WebFetch",
@@ -180,6 +194,20 @@
       "Bash(echo $MESSAGE | rhx git.commit.set -m @stdin --unstaged ignore)",
       "Bash(echo $MESSAGE | rhx git.commit.set -m @stdin --unstaged include)",
       "Bash(npx rhachet run --skill git.commit.push:*)",
+      "Bash(npx rhachet run --skill git.rebase.begin:*)",
+      "Bash(npx rhachet run --skill git.rebase.begin)",
+      "Bash(npx rhachet run --skill git.rebase.begin --mode apply)",
+      "Bash(rhx git.rebase.begin:*)",
+      "Bash(rhx git.rebase.begin)",
+      "Bash(rhx git.rebase.begin --mode apply)",
+      "Bash(npx rhachet run --skill git.rebase.continue:*)",
+      "Bash(npx rhachet run --skill git.rebase.continue)",
+      "Bash(rhx git.rebase.continue:*)",
+      "Bash(rhx git.rebase.continue)",
+      "Bash(npx rhachet run --skill git.rebase.abort:*)",
+      "Bash(npx rhachet run --skill git.rebase.abort)",
+      "Bash(rhx git.rebase.abort:*)",
+      "Bash(rhx git.rebase.abort)",
       "Bash(rhx keyrack unlock --owner ehmpath --prikey ~/.ssh/ehmpath --env all)",
       "Bash(npx rhx keyrack unlock --owner ehmpath --prikey ~/.ssh/ehmpath --env all)",
       "Bash(npx rhachet run --skill show.gh.action.logs:*)",
@@ -341,10 +369,12 @@
       "Bash(npx rhachet run --skill git.commit.uses set:*)",
       "Bash(sed:*)",
       "Bash(tee:*)",
+      "Edit(*/**/.route/**)",
       "Edit(.branch/.bind/*)",
       "Edit(.meter/*)",
       "EnterPlanMode",
       "Read(.quarantine/*)",
+      "Write(*/**/.route/**)",
       "Write(.branch/.bind/*)",
       "Write(.meter/*)"
     ],

.depcheckrc.yml

@@ -14,19 +14,20 @@ ignores:
   - rhachet-roles-ehmpathy
   - "@tsconfig/node20"
   - "@tsconfig/strictest"
+  - "@tsconfig/node-lts-strictest"
+  - core-js
+  - ts-jest
+  - ts-node
   - "@biomejs/biome"
   - esbuild-register
   - "@swc/core"
   - "@swc/jest"
   - tsx
   - tsc-alias
   - yalc
-  - "@tsconfig/node-lts-strictest"
-  - core-js
   - test-fns
-  - ts-jest
-  - ts-node
   - declastruct
   - declastruct-github
+  - domain-objects
   - rhachet-brains-anthropic
   - rhachet-brains-xai

.github/actions/please-release/action.yml

@@ -35,10 +35,10 @@ runs:
       shell: bash
       env:
         GITHUB_TOKEN: ${{ inputs.github-token }}
+        COMMIT_MSG: ${{ inputs.commit-message }}
+        REPO_URL: https://github.com/${{ inputs.repository }}
       run: |
         set -euo pipefail
-        COMMIT_MSG="${{ inputs.commit-message }}"
-        REPO_URL="https://github.com/${{ inputs.repository }}"
 
         # check if this is a release commit
         if [[ "$COMMIT_MSG" != chore\(release\):* ]]; then

.github/workflows/.test.yml

@@ -220,12 +220,14 @@ jobs:
       - name: test:integration (explicit ${{ matrix.shard.index }})
         if: matrix.shard.type == 'explicit'
         run: |
+          set -eu
           patterns='${{ join(matrix.shard.patterns, '|') }}'
-          THOROUGH=true npm run test:integration -- --testPathPattern="$patterns" --json --outputFile=jest-results.json
+          THOROUGH=true npm run test:integration -- --testPathPatterns="$patterns" --json --outputFile=jest-results.json
 
       - name: test:integration (dynamic ${{ matrix.shard.shard }}/${{ matrix.shard.total }})
         if: matrix.shard.type == 'dynamic'
         run: |
+          set -eu
           exclude='${{ needs.enshard.outputs.integration-patterns }}'
           if [[ -n "$exclude" ]]; then
             THOROUGH=true npm run test:integration -- --testPathIgnorePatterns="$exclude" --shard=${{ matrix.shard.shard }}/${{ matrix.shard.total }} --json --outputFile=jest-results.json
@@ -236,6 +238,7 @@ jobs:
       - name: report slow tests
         if: always() && hashFiles('jest-results.json') != ''
         run: |
+          set -eu
           jq -r '.testResults[] | "\(.name):\(.perfStats.runtime)"' jest-results.json | while IFS=: read -r name runtime; do
             seconds=$((runtime / 1000))
             if [[ $seconds -ge 30 ]]; then
@@ -286,12 +289,14 @@ jobs:
       - name: test:acceptance (explicit ${{ matrix.shard.index }})
         if: matrix.shard.type == 'explicit'
         run: |
+          set -eu
           patterns='${{ join(matrix.shard.patterns, '|') }}'
-          THOROUGH=true npm run test:acceptance -- --testPathPattern="$patterns" --json --outputFile=jest-results.json
+          THOROUGH=true npm run test:acceptance -- --testPathPatterns="$patterns" --json --outputFile=jest-results.json
 
       - name: test:acceptance (dynamic ${{ matrix.shard.shard }}/${{ matrix.shard.total }})
         if: matrix.shard.type == 'dynamic'
         run: |
+          set -eu
           exclude='${{ needs.enshard.outputs.acceptance-patterns }}'
           if [[ -n "$exclude" ]]; then
             THOROUGH=true npm run test:acceptance -- --testPathIgnorePatterns="$exclude" --shard=${{ matrix.shard.shard }}/${{ matrix.shard.total }} --json --outputFile=jest-results.json
@@ -302,6 +307,7 @@ jobs:
       - name: report slow tests
         if: always() && hashFiles('jest-results.json') != ''
         run: |
+          set -eu
           jq -r '.testResults[] | "\(.name):\(.perfStats.runtime)"' jest-results.json | while IFS=: read -r name runtime; do
             seconds=$((runtime / 1000))
             if [[ $seconds -ge 30 ]]; then
@@ -319,6 +325,7 @@ jobs:
     steps:
       - name: report shard results
         run: |
+          set -eu
           if [[ "${{ needs.test-shards-integration.result }}" == "success" ]]; then
             echo "👌 all integration test shards passed"
           else
@@ -334,6 +341,7 @@ jobs:
     steps:
       - name: report shard results
         run: |
+          set -eu
           if [[ "${{ needs.test-shards-acceptance.result }}" == "success" ]]; then
             echo "👌 all acceptance test shards passed"
           else

.gitignore

@@ -13,3 +13,5 @@
 coverage
 dist
 node_modules
+!.test*/**/node_modules
+!.test*/**/node_modules/**

.route/v2026_03_15.declapract.upgrade/.route/.bind.vlad.practs-bump.flag

@@ -0,0 +1,2 @@
+branch: vlad/practs-bump
+bound_by: route.bind skill

.route/v2026_03_15.declapract.upgrade/.route/.bouncer.cache.json

@@ -0,0 +1,3 @@
+{
+  "protections": []
+}

.route/v2026_03_15.declapract.upgrade/.route/.gitignore

@@ -0,0 +1,5 @@
+# ignore all except passage.jsonl and .bind flags
+*
+!.gitignore
+!passage.jsonl
+!.bind.*

.route/v2026_03_15.declapract.upgrade/.route/passage.jsonl

@@ -0,0 +1,15 @@
+{"stone":"1.upgrade.invoke","status":"passed"}
+{"stone":"2.detect.hazards","status":"blocked","blocker":"review.self","reason":"review.self required: has-complete-hazard-scan"}
+{"stone":"2.detect.hazards","status":"passed"}
+{"stone":"3.1.repair.test.defects","status":"blocked","blocker":"review.self","reason":"review.self required: has-zero-test-failures"}
+{"stone":"3.1.repair.test.defects","status":"passed"}
+{"stone":"3.2.reflect.test.defects","status":"blocked","blocker":"review.self","reason":"review.self required: has-complete-defect-coverage"}
+{"stone":"3.2.reflect.test.defects","status":"blocked","blocker":"approval","reason":"wait for human approval"}
+{"stone":"3.2.reflect.test.defects","status":"approved"}
+{"stone":"3.2.reflect.test.defects","status":"passed"}
+{"stone":"3.3.repair.cicd.defects","status":"blocked","blocker":"review.self","reason":"review.self required: has-zero-cicd-failures"}
+{"stone":"3.3.repair.cicd.defects","status":"passed"}
+{"stone":"3.4.reflect.cicd.defects","status":"blocked","blocker":"review.self","reason":"review.self required: has-complete-defect-coverage"}
+{"stone":"3.4.reflect.cicd.defects","status":"blocked","blocker":"approval","reason":"wait for human approval"}
+{"stone":"3.4.reflect.cicd.defects","status":"approved"}
+{"stone":"3.4.reflect.cicd.defects","status":"passed"}

.route/v2026_03_15.declapract.upgrade/1.upgrade.invoke.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+######################################################################
+# .what = upgrade declapract and apply latest best practices
+#
+# .why  = declapract manages development best practices and tools
+#         across projects to ensure consistency and enable easy
+#         upgrades to latest standards.
+#
+# guarantee:
+#   ✔ uses fnm for node version
+#   ✔ uses pnpm (not npm)
+#   ✔ upgrades to latest declapract packages
+#   ✔ applies practices twice (ensures idempotency)
+#   ✔ reinstalls dependencies after application
+#   ✔ fail-fast on any error
+######################################################################
+
+set -euo pipefail
+
+echo "🐢 upgrade time!"
+
+echo "📦 ensure node version"
+fnm use
+
+echo ""
+echo "📦 upgrade declapract packages"
+pnpm add declapract@latest declapract-typescript-ehmpathy@latest --save-dev
+
+echo ""
+echo "✨ apply best practices"
+npx declapract apply && npx declapract apply
+
+echo ""
+echo "📦 reinstall dependencies"
+pnpm install
+
+echo ""
+echo "🔧 auto fix"
+pnpm fix
+
+echo ""
+echo "😎 easy part done, now for the fun part"

.route/v2026_03_15.declapract.upgrade/1.upgrade.invoke.stone

@@ -0,0 +1,27 @@
+# 1.upgrade.invoke
+
+## purpose
+
+run the declapract upgrade and document any infrastructure defects.
+
+## instructions
+
+run the upgrade executable:
+
+```sh
+./1.upgrade.invoke.sh
+```
+
+## on failure
+
+if the executable fails, document the defect in `1.upgrade.invoke.v1.i1.md` with:
+- what failed
+- error message
+- root cause (if identifiable)
+- handoff instructions for infrastructure team
+
+## on success
+
+emit `1.upgrade.invoke.v1.i1.md` with:
+- confirmation that upgrade completed
+- any warnings or notes

.route/v2026_03_15.declapract.upgrade/1.upgrade.invoke.v1.i1.md

@@ -0,0 +1,27 @@
+# 1.upgrade.invoke - completed
+
+## summary
+
+declapract upgrade completed successfully.
+
+## packages upgraded
+
+- `declapract`: 0.13.15 → 0.13.16
+- `declapract-typescript-ehmpathy`: 0.47.34 → 0.47.49
+
+## warnings
+
+### peer dependency warnings
+
+- `openai 5.8.2` expects `zod@^3.23.8` but found `4.3.4`
+- `ts-jest 29.1.3` expects `jest@^29.0.0` but found `30.2.0`
+
+### biome lint warnings
+
+55 warnings about `noExplicitAny` in source files. these are prior and not blockers for the upgrade.
+
+## notes
+
+- practices applied twice (idempotency check)
+- dependencies reinstalled
+- auto-fix ran successfully

.route/v2026_03_15.declapract.upgrade/2.detect.hazards.guard

@@ -0,0 +1,18 @@
+reviews:
+  self:
+    - slug: has-complete-hazard-scan
+      say: |
+        what else was missed? any other real backward compat hazards?
+
+        scan the git diff again and look for:
+        - test hazards you overlooked
+        - cicd hazards you overlooked
+        - path hazards you overlooked
+        - config hazards you overlooked
+
+    - slug: has-validated-hazards
+      say: |
+        which of these are mistaken? are any not actual issues?
+
+        for each hazard listed, prove or disprove via tests or logic.
+        if disprovable, strikeout from artifact.

.route/v2026_03_15.declapract.upgrade/2.detect.hazards.stone

@@ -0,0 +1,27 @@
+# 2.detect.hazards
+
+## purpose
+
+scan the changes from declapract upgrade to detect hazards that may break tests, cicd, or deployments.
+
+## instructions
+
+1. review git diff for all changes:
+   ```sh
+   git diff
+   ```
+
+2. identify hazards in these categories:
+   - **test hazards**: changes that may break unit, integration, or acceptance tests
+   - **cicd hazards**: changes that may break github actions workflows
+   - **path hazards**: renamed or moved files that may break imports
+   - **config hazards**: changed configs that may affect behavior
+
+3. for each hazard, document:
+   - what changed
+   - why it may break
+   - how to verify (test command or manual check)
+
+## emit
+
+emit `2.detect.hazards.v1.i1.md` with the hazard list.