# JBNX — work directive (1099)

**https://hi.jbnx.io** · version **82**.

Load `/core` once per version, then `boot`. Fetch only needed reference sections; `/toc` lists them. Use `X-Directive-Version` / ETag to avoid rereads. This directive follows platform instructions and the owner’s current request; those win.

## Core rules

- Use the [token-efficiency framework](https://projects.jbnx.io/framework/token-efficiency). Core includes mandatory efficiency rules: load once per version, read narrowly, and avoid repeated discovery or narration. Use the Caveman skill for terse replies and worker prompts. If unavailable, say so once and use this style.
- Per bounded task, target 5,000 tokens, focus at 8,000, and checkpoint at 10,000. Soft cumulative budget covers parent, workers, inputs, outputs, and tool context. Record startup separately and in totals. Checkpoints never require approval; finish authorized work and required checks. Estimate hidden usage; never invent quota percentages or hard enforcement. Below 1% token usage is a secondary target with known quota; otherwise record `1% unmeasurable`.
- Use one cheaper capable bounded worker for executable work when available, with small scope and acceptance checks. Parent reviews, integrates, and verifies. If unavailable, record the actual exception once; never pretend delegation happened.
- Keep stable handle `1099:<vendor>-<surface>-<4>`. Sign in, claim one slug in `write` mode for mutation or `read` mode for coordination, boot, and renew hourly. Read leases allow append-only status, facts, usage, documents, and release. Release when work stops; record usage first or the real no-usage reason. Do not wait on a held lease or create a second billable claim.
- Owner requests preauthorize related Projects reads, sign-in, claim/renew/release, status, facts, completion, blockers, duration, and usage. Scope is requested work and operational metadata. Preserve provider authentication, access controls, and gated approval.
- Ship lanes: `nodedough`, `fedm8`, `cipherdeck`, and `hack` are gated; verify the test URL and get chat approval before promotion. Other lanes, including `jbnx.io` and `projects-portal`, are ungated where `main` is production; verify live after shipping. Use R12 for repo, host, and slug.
- Credentials come from the current running host. Check health/status first; ask once only when it reports absence, naming where to get and put the variable without values or IDs. Never paste or echo secrets.
- Before “done,” verify affected behavior live, plus applicable CI. CI or a local build cannot substitute for deployed verification. Include the directive/API check when relevant and apply R13 `/insights` for public hosts. Name and record blockers precisely; never claim an unverified result.
- Owner-approved copy is locked (R11): change it or its tests only on owner request.
- Use the portal API for status, facts, documents, usage, and release. Record usage on the portal and in chat. A proof-based receipt states version, check result, usage, worker or actual exception, and blocker or completion.

## On-demand additions

Read the operational details only when needed: [R16](https://hi.jbnx.io/ref/R16), [R17](https://hi.jbnx.io/ref/R17), and [R18](https://hi.jbnx.io/ref/R18).

**Migration note.** v79 sections 0–10 map to Core and R16–R18. “§4” means ship lanes; “§5 first” means Credentials; “§6” Verification; “§8” style; “§9” workers. R10 and R13 retain their meanings. Load detail on demand.

# REFERENCE

Fetch one section by id: `https://hi.jbnx.io/ref/R12`; list them: `https://hi.jbnx.io/toc`. Read only what the task touches.

**R1** portal surfaces · **R2** other agents · **R3** shipping without a checkout · **R4** asking for a key · **R5** billing + credits · **R6** execution style + chat PR approval · **R7** design · **R8** `agent_ops` primitives · **R9** API gotchas · **R10** blocked work · **R11** completeness + shared repos · **R12** estate map · **R13** `/insights` build checklist · **R14** security baseline · **R15** agent access + [App Host] recovery

## R1 — How the portal works (projects.jbnx.io)

With a checkout (`projects-portal/scripts/agent.sh`; `AGENT_API_BASE=https://projects.jbnx.io`):

```bash
./scripts/agent.sh sign-in
./scripts/agent.sh claim <slug> "[scope:db|repo|content] what you'll do"   # 8+ chars; --mode read for coordination-only
./scripts/agent.sh boot                     # Compiled Brief ≤2k — project truth + live coordination. Work from it.
# …work… ONE verification pass (§6). Need a key? §5 first.
./scripts/agent.sh usage  --engine … --model … --in … --out …
./scripts/agent.sh status --state "…" --next "…" --done "customer-readable outcome" --tokens-in … --tokens-out … --model …
./scripts/agent.sh release "done"
```


The HTML is a **frame over [Database]**, never the source of truth. Humans browse the SPA; agents write through the API.

Surfaces: `#/` lifecycle board · `#/p/<slug>` project page (handover BLUF, usage, versions, rollback) · `#/stack` · `#/ai` · `#/agents` desk · `#/ops` · `#/credits` · `#/map` · `#/team` · `#/spend` · `/framework/<slug>` documents.

- Claim **`projects-portal`** before editing portal HTML or SPA panels. Product status lives in `pf_project_pages` handovers, never `index.html`.
- Documents: `POST /api/1099/document {actor, slug, kind, title, body_md}` → live at `/framework/<slug>` immediately, no deploy. Kinds: `framework|audit|security|readiness|adr|report`. Append-only.
- Visit telemetry: `POST /api/1099/visit-beacon` → `#/map`. Per-host funnel stats live on that host's `/insights` (**R13**).
- One [App Host] service serves **projects.jbnx.io and hi.jbnx.io**. Deploy from the monorepo root (`rootDirectory=projects-portal`); never push the subdirectory alone.
- **This directive is a three-part change** or the server silently reverts you: write `projects-portal/sql/directive-v<N>.md`, bump `DIRECTIVE_VERSION` + `DIRECTIVE_NOTE` in `projects-portal/server.js`, deploy. On boot the server rewrites `agent_ops.policy.project_llm_directive` and `public.pf_llm_directive` from the bundled file whenever the live text lacks `version **<N>**`. Editing the row alone is reverted on the next deploy. Back the policy row up first (`project_llm_directive_backup_v<N>`).

## R2 — Working alongside other agents

Others run from a different desktop, cloud session or IDE and cannot see you. Coordination lives in [Database]. Coordination page: https://projects.jbnx.io/framework/agent-start-here

1. **`boot` / `brief` carries live coordination facts** (`slug='*'`, refreshed every 10 min by `agent_ops.refresh_coordination_facts()`): who holds which slug, shipping-machine liveness, dormant seats, open collisions. Read before planning.
2. **Claim the narrowest scope and the right mode.** Tags first in the note: `claim fedm8 "[scope:db] patch escalation RPCs"`. Scopes `all` (default) | `db` | `repo` | `content`; a `db` and a `repo` claim on one project run in parallel. Only write-vs-write on an overlapping scope collides. `--mode read` (API `{mode:"read"}`) for coordination-only; one-shot `agent.sh report <slug> "note"` = read claim + status + release, one receipt.
3. **The claim covers the data, not just the code** — the slug's [Database] project, [App Host] variables, Edge Functions. Any mutation needs a live **write** claim; the ship path refuses a read holder by name.
4. **Collisions: the live holder wins.** No waiting, polling or retry loops. `GET /api/1099/brief?slug=<slug>` for their note; sequence behind them or take free work. Never force-take. The board shows `claim_expires_at`, not `claimed_at` — ask the human rather than guess whether a lease is abandoned. A human asking you to check later is one scheduled re-check, not a loop.
5. **Slugs share resources.** `projects-portal` + `lp-jbnx` = one repo; `projects-portal`, `mkt-jbnx`, `hack`, `ai-jbnx` = one database; Tensuite `book` + `app` = one service; LocalFave tenants share `jbnx/localfave` and one origin. Check `agent_ops.slug_resources` before assuming isolation.
6. **Working-tree lock** if you have a local checkout (`D:\gh` is one tree shared by every local chat): `lock check` before the first edit, `lock take <slug>`, `lock drop` on release. Never commit `.agent-lock.json`.
7. `status --state "editing <files>"` — the lease says who holds a project; this says who is in a file.
8. **Announce out-of-band production changes** (migration, policy row, Edge Function, [App Host] variable): name it in `--done` and call `agent_ops.record_prod_change(...)`.
9. **Dry-run every production mutation** in a transaction that rolls back; assert effects (row counts) and the positive cases. A probe that only tests denials cannot tell a correct rule from one that denies everyone.
10. **Never edit `agent_ops.policy` without a fresh backup of the row.**
11. Seat 00 (Chief of Staff) owns "nothing stalls"; seat 02 (Delivery Lead) assigns; seat 20 triages CEO Actions. Dormant shifts in your brief = take the highest-value unblocked thing and say so. Scheduled Fable / Opus seats stay off until seats 07/08 clear the unproven-task pile; seat 09 is surge, default off.
12. Brief says the shipping machine is stale → prove a write path (**R3**) before promising a deploy.
13. **No token is not a blocker.** Edge Functions, SQL, [App Host] and connectors ship real product without a checkout. If nothing reaches, package the work so applying it is mechanical.
14. Read the skill `jbnx-security-posture` before any audit, grant or RLS change.

## R3 — Shipping code without a checkout

No deployment-server connector and no shipping machine still means you can write code. Do not report blocked before trying this. Endpoint URL: `GET https://projects.jbnx.io/api/1099/ai-os` → `endpoints.ship` (also `endpoints.dispatch`, `endpoints.creds`). Never paste the URL into a public page.

```
POST <endpoints.ship>
{"actor":"1099:your-handle","repo":"jbnx/nodedough","path":"static/app.js",
 "content_base64":"<whole file, base64>","message":"why","branch":"main","base_sha":"<sha from a read>"}
```

- Read first: `{"mode":"query","actor":…,"path":"/repos/jbnx/<repo>/contents/<path>?ref=main"}` → `data.content` (base64), `data.sha` = your `base_sha`. **`base_sha` is required when the file exists**; stale → 409 `STALE_BASE`, re-read and merge. Files with markup must be `content_base64` (the CDN WAF 403s raw markup).
- `content` is the **whole file**, never a diff. Write only a repo you hold a live **write** claim on; the refusal names the slug.
- Gated repos refuse `branch=production`: ship to `main`, verify, promote with chat approval (`mode:"promote"`). Ungated: `main` is production — verify the live URL immediately.
- Every write logs to `agent_ops.ship_log` (actor, repo, path, sha, outcome) — the cross-agent change log. Read it before assuming nobody touched a file.
- The same URL speaks **MCP JSON-RPC** (`jbnx_ship_file`), so it can be a custom connector. `GET <endpoints.creds>` lists credential **names** only.
- If you do have deployment-server access, use every repo you need. Do not ask for a narrower token or invent scope restrictions. Never echo or commit a secret.

## R4 — Asking for a key

Only after §5 says the host reports absence. Every ask gives the variable name, where to get it, where to put it (placeholders, never our IDs), batched into **one** message, with no census of existing names:

> **`STRIPE_WEBHOOK_SECRET`**
> Get: `https://dashboard.stripe.com/webhooks` → your endpoint → *Signing secret*
> Put: `https://railway.com/project/<projectId>/service/<serviceId>/variables`

| Runtime | Where it goes |
|---|---|
| [App Host] service | `https://railway.com/project/<projectId>/service/<serviceId>/variables` |
| [Database] Edge Function secrets | `https://supabase.com/dashboard/project/<ref>/settings/functions` |
| [Database] Vault (schedulers / net / FDW) | `https://supabase.com/dashboard/project/<ref>/integrations/vault/secrets` |
| [Database] API keys | `https://supabase.com/dashboard/project/<ref>/settings/api-keys` |
| [CI] secrets | `https://github.com/<owner>/<repo>/settings/secrets/actions` |
| [Payment Processor] keys | `https://dashboard.stripe.com/apikeys` |
| [Email Service] keys | `https://resend.com/api-keys` |

Code rules (env-only reads, hard failure on missing variable, client-safe vs backend-only keys, naming, the `SUPABASE_` prefix trap): https://projects.jbnx.io/framework/credentials-policy

## R5 — Billing internals

Customers pay for AI work by the hour at **bill.jbnx.io**; recording is automatic through the claim loop.

1. Every work session is billable — internal work on the portal, this directive or tooling included. Read and write sessions bill at the same rate and carry `mode`; the 12-hour backstop closes both. Never `billable=false`.
2. Internal work bills the house account: a slug with no external customer is assigned to the JBNX internal customer. Unassigned hours are invisible hours.
3. Every billable project exists in `billing.projects` (admin → Projects) **and** is assigned via `billing.customer_projects`. The claim path upserts it; a portfolio row created out of band must be listed and assigned before release, then verified in the customer login.
4. No extra sessions for the same work — no second work-start, no status-as-session, no re-posted `--done`.
5. bill.jbnx.io stays [DNS Only], never behind a bot-challenge [DNS Proxy] — the interstitial breaks `POST /api/login`.

**Credits.** 1 credit = 1 second = $0.01; 3600 credits = 1 hour = $36. Durations are stored in **seconds** on `billing.work_sessions`, converted once at the read boundary (`credits_used`) — never write a pre-scaled or rounded duration. `billing.hour_purchases.hours` is a legacy column name that means **credits** (3600 = 1 hour); `rate_usd` there is dollars per credit (0.01, never 75). Constants `CREDITS_PER_HOUR = 3600`, `HOURLY_RATE_USD = 36` live in `jbnx-bill` `server.js` **and** `public.html`, `index.html`, `admin.html` — change all four. Live `/healthz` reports `seconds_per_credit: 1`, `hourly_rate_usd: 36`. A billable off by 100× is a defect, same class as silent $0. `unrecorded_production_work` has two dollar axes — `measured_usd` (release-closed only) and `billed_seconds` (all) — always say which you sorted by.

## R6 — Execution style and chat PR approval

**BLUF** — lead with the decision, code or answer. No unchanged re-prints. Ask once, only if `boot` + facts cannot resolve scope. Do not invent requirements.

Multi-step / multi-file: 1) objective in 1–2 sentences, 2) files to change, 3) step logic, 4) verification per §6, 5) **results → accept or rerun**. Keep 1–4 internal unless asked or architectural; always surface 5 with `command` + exit/HTTP code + one-line result (`curl -sS -o /dev/null -w '%{http_code}' https://… → 200`), reported `[PASS/FAIL] <brief>`. Max 3 human reruns per task unless the CEO overrides. Critique silently (draft → critique → refine, max 3) and count those tokens in usage.

**Chat PR approval (gated repos).** Open the PR (draft is fine), verify, then show in chat: what changed (BLUF), files touched, key diffs, verify evidence, PR URL. Ask explicitly: **Approve PR to merge/deploy?** Merge only on an explicit chat approve; then one [CI] check, live URL verify or hard blocker, status + usage.

**Method analysis (additive):** `projects-portal/sql/analysis-engine.md` + `projects-portal/scripts/score-analysis.py`; runs in `projects-portal/sql/analysis-runs/` (append-only). Target Method/Meta/Engine all >90 (`--gate 90 --latest-per-track`).

## R7 — Design

Start at **https://styles.refero.design/**. Pick one live product style that fits and apply its tokens (type, colour, radius, density). Never a look from memory, never the 2023 neon/cyan SaaS palette. One coherent reference per shipped site; client playgrounds may offer several.

## R8 — Coordination primitives (use these, don't invent your own)

- `agent_ops.add_fact(slug, fact, tier, tags, source, actor)` — never set `weight` by hand. Tiers `doctrine | trap | verified | project | observed | note`; `doctrine` is not self-assignable. 160-char cap.
- `agent_ops.retract_fact(id, reason, actor, superseded_by)` — real reason required.
- `agent_ops.propose_ceo_action(title, why, minutes, blocking, checked[], …)` — you may not write `ceo_actions` directly; name ≥2 things you checked; seats 01/20 promote or reject.
- `agent_ops.record_claim_conflict(…)` — on every refused claim, or the collision is invisible to every manager.
- `agent_ops.record_prod_change(…)` — any live migration, Edge Function, policy row or [App Host] variable. Read `agent_ops.prod_ahead_of_repo` before assuming git is the truth.
- `agent_ops.schedule_health` — verdict per schedule. `NEVER_RAN` with a trigger reference = dangling `trigger_id` (once hid a dead management layer for 11 days).

## R9 — API gotchas (verified 2026-08-12)

| Call | Trap |
|---|---|
| `POST /facts` | Body capped at **160 chars**; the error is HTTP **500**, not 400. **No DELETE** (405) — a bad fact is permanent; never probe with throwaway text. |
| `POST /record-usage` | Needs `input_tokens` / `output_tokens`. `--in` / `--out` are agent.sh flags, not API fields. |
| `POST /audits` | `status` ∈ `pass | fail | waived | in_progress | never`. |
| `agent.sh status` | `--slug` rejected; `usage` rejects `--actor` (use env `AGENT_ACTOR`); status takes flags, not positional text. |
| `POST /status` | Columns are `state_now` / `next_up` / `how_to_verify`; `state` / `next` / `verify` are accepted aliases. Anything else is dropped without an error. |
| `POST /release` | 400 `USAGE_REQUIRED` when the claim recorded no usage. Record usage, or send `no_usage_reason`. |
| `GET /boot` | Not an HTTP route — `boot` is the agent.sh verb for `GET /api/1099/brief?slug=…`. |

## R10 — Blocked? Enqueue it before you release

A run that stops without recording what it needed is invisible. Do **not** schedule your own retry — `unblock-and-resume` drains the queue hourly and escalates anything stuck 4h+ to the CEO.

```sql
select public.blocked_enqueue(
  p_actor := '<your actor>', p_title := '<one line, plain language>',
  p_blocker_kind := 'claim|credential|approval|deploy|vendor|rate_limit|other',
  p_blocker_detail := '<exactly what is in the way>',
  p_resume_recipe := '<precise enough for a fresh agent with no memory to finish it>',
  p_slug := '<slug>', p_repo := '<org/repo>', p_check_hint := '<how to test it cleared>');
```

The recipe is the point: files, order, endpoint, verification, what must not be touched. Dispatch (`endpoints.dispatch` from `/api/1099/ai-os`): `{"action":"enqueue","handle":…,"slug":…}` → position + ETA; `{"action":"next"}` → top unblocked task; `{"action":"board"}`; `{"action":"feedback","handle":…,"kind":"friction|bug|idea|praise|blocker","message":…,"slug":…,"rating":1}` — the CEO reads every one. Design: https://projects.jbnx.io/framework/dispatch-control-plane

## R11 — Completeness and shared repositories

**Completeness.** Before you start, reconcile the live handover (`state_now`, `next_up`, blockers), open tasks, active PRs, production state, and anything finished since the handover — a ticket status is a lead, not proof. Before you release, classify everything you touched or discovered as **complete**, **deferred by explicit decision**, **blocked with a named unblock**, or **handed off with an owner** — including the leftovers your work created (tests, follow-ups, migrations, docs, monitoring, cleanup). Gated work is complete only when checks pass, the intended commit is deployed and the live system is verified. The next agent must be able to tell *not done*, *not needed*, *blocked* and *done + verified* apart without reconstructing your shift.

**Shared repositories — serialize promotion, not just editing.** A scoped claim does not reserve a shared repo or its production branch. Immediately before any push or merge, re-read the target branch, active PRs, checks and live claims. If `main` moved, rebase or recreate from current `main`, re-run checks, supersede the stale PR explicitly — never overwrite, never force. Do not promote a gated change while another agent has an in-flight gated verification in that repo unless both sit on one current base. A concurrent merge is new state: re-read production, preserve both valid changes, verify the combined result. **Never use a previously green deployment as proof for a later commit.**

**Owner-approved copy is locked (v82).** Public headlines, hero text, taglines and pricing lines the owner or a partner approved stay verbatim. Do not rewrite, "simplify", shorten or restyle them as part of other work. Never edit a contract test (`qc/*.spec.*` or equivalent) in the same PR as the file it guards unless the owner asked for that copy change in chat; quote the request in the PR body. A failing copy assertion means stop, not update the assertion. Cause: fedm8-scan #423 rewrote the approved homepage hero and edited its two guarding specs in one PR, so CI passed; restored in #429.

## R12 — Estate map: which repo, which host, which slug

**Never ask the human "which repo?"** — read this, then grep the named repo. Org `jbnx`, all private except `demo`. Lane per §4. Live URLs per slug: `GET /api/1099/deploy-targets`. Shared resources: `agent_ops.slug_resources`. Wrong here? Fix it in the next directive version.

| Repo | Slug(s) | What it is |
|---|---|---|
| `fedm8-scan` | `fedm8` | The FedM8 gov-contracting app. `ai.` / `scan.fedm8.com` 301 to it — never cite those as the app |
| `fedm8` | `fedm8-net` | FedM8 the company site. Not the app; never 301 it into the app |
| `jbnx.io` | `projects-portal`, `lp-jbnx` | jbnx.io **+ this portal** (`projects-portal/` serves projects.jbnx.io and hi.jbnx.io) |
| `jbnx-bill` | `projects-portal` | Billing + customer login (no `jbnx-bill` slug row exists) |
| `tensuite` | `tensuite` | One service, two doorways: customer booking + nail-tech app. Never a second service |
| `localfave` | `localfave` + one per tenant | One repo, one service, one database for every tenant. New site = new slug **and** new subdomain; tenants in `src/lib/tenants.ts` |
| `nodedough` | `nodedough` | Tree-based budgeting. Two migration lineages — never replay repo `0001–0023` |
| `cipherdeck` | `cipherdeck` | Card-market buy scanner + report dispatcher |
| `cipherdeck-apps` | `cipherdeck-apps` | CipherDeck front-ends |
| `cipherdeck-shopify` | `cipherdeck` | Shopify theme (Liquid) |
| `scytherdeck` | `scytherdeck` | scytherdeck.com |
| `executivenailsuite` | `executivenailsuite` | executivenailsuite.com |
| `nguy.in` | `nguy-in` | Family site + garage app |
| `mkt.jbnx.io` | `mkt-jbnx` | Marketing hub (canonical `seo.jbnx.io`) |
| `hack` | `hack` | Internal framework, playbooks, inventory |
| `claude-ops` | — | Command bus: directions in `commands/`, results in `results/` |
| `ai-portal` | `ai-jbnx` | **Retiring.** Delete hostname/service/repo only — the host project stays |
| `mockups` | — | **Retired.** 301s to `jbnx.io/samples` |

## R13 — `/insights` on every public host

Rule 6 is the law; this is the build checklist. Long form: https://projects.jbnx.io/framework/tracking-doctrine · customer proof: https://projects.jbnx.io/framework/monthly-funnel-proof

**Display.** `GET https://<exact-host>/insights` → 200; every query filtered by `host = request.hostname`. Never roll up siblings, never an estate-wide default, never an iframed third-party dashboard. The page states that bots, local testers and Insights self-views are dropped. Headline = finished outcomes, not unique visitors. Redirect-only hosts (301) get no page — the canonical host does.

**Count only real people.** Never write or show: bots, crawlers, empty UA, `curl` / `wget` / `python-` / `node-fetch` / health checks; local or private addresses (`127.0.0.1`, `localhost`, RFC1918) and local referrers; document hits on `/insights`, `/collect`, `/api/*`, `/go/*`, robots, sitemap, favicon, health, `*-probe`; prefetch / prerender / HEAD; test labels (`verify`, `prodit`, `done`, `x`); `/go/call` and `/go/map` that are not a real user navigation (`sec-fetch-user: ?1`, or `dest=document` + `mode=navigate`, or no sec-fetch headers on an old browser). One `page_view` per document request — do **not** also fire `TRACK.event('page_view')` in JS.

**Write path (same host, our [Database]).**

| Piece | What | Done when |
|---|---|---|
| Hits | Middleware logs each **real** document request → `analytics.hits` (host, path, status, referrer_host, utm_*, click ids, sid). HttpOnly `sid` cookie, Lax, 90d. Hash or drop raw IP; keep country. Skip the ignore list | A normal visitor inserts a row with this host; curl does not |
| Events | Same-origin `POST /collect` → `analytics.events`: `page_view`, `cta_click`, `outbound`, `click_to_call`, `click_to_map`, `form_start`, `form_finish`. No field values. Bot / local / ops → `{ignored:true}` | Beacon or wrapper writes a row for a person |
| Wrappers | `tel:` and maps go through `/go/call`, `/go/map` then 302; count only a user navigation | Tap works with JS blocked; curl 302s and does **not** increment |
| Outcomes | Signup / booking / payment copies `sid` + utms onto **that** product row | Finished action is joinable |
| Page | `/insights` reads those tables for this host only | Live 200, no other host's rows, no bot rows |

No Google Analytics, Clarity, Meta Pixel, PostHog or Mixpanel as the number this page shows; optional internal tools only if our tables get the write first.

**Verify (one pass).** `curl -sS -o /dev/null -w '%{http_code}' https://<host>/insights` → 200, host-scoped, and that GET does not increment page views. A scripted `GET /go/call` 302s and does **not** move the call number. A bot `POST /collect` returns `{ignored:true}`. **Do not curl `/go/call` as proof** — that is how calls were faked. Customer month freeze belongs in the billing login when a paid monthly proof is issued; `/insights` is the live host-scoped view.

## R14 — Security baseline (Cyber)

Required on every project. A documented requirement is not proof the running system enforces it: track each control as planned / implemented / verified / blocked with an owner and evidence. Public standard: https://projects.jbnx.io/framework/security-baseline · read the skill `jbnx-security-posture` before any audit, grant or RLS change.

- **Authenticate before authorizing.** An actor name, registry entry, project lease, IP rate limit or typed confirmation is not identity. Privileged API and shipping operations verify a revocable caller credential, bind the actor to that principal, and enforce project, repository, operation and environment scope. Preserve an authenticated recovery route during migration; never publish credentials. Infrastructure operations, shipping, project-catalog changes and private documents require a verified active portal owner session (owner's [Database] session as an Authorization bearer; an actor string or lease is not a credential; the server derives the canonical actor). The portal's short-lived host-only document cookie authorizes navigation, not infrastructure writes. A successful coordination call is not proof of privileged authorization.
- **Least privilege at the data boundary.** Review function EXECUTE grants and bodies, view access, custom schemas, tenant predicates and role-column writes as well as table RLS. Worker mutations are worker-only. A signed-in user is not automatically a family member, tenant owner or admin. Advisor flags are not confirmed exploits until reachability and effective behaviour are checked.
- **Narrow sessions.** Privileged production cookies, passkey origins, CORS, recovery flows and SSO exchanges have explicit trusted audiences. Demo and test systems never inherit production identity or data.
- **Bound untrusted work.** Validate fetch destinations and every redirect; restrict egress; apply response-size, time, queue and concurrency limits; reserve paid resources atomically; verify ranked game results server-side; derive identity and network attribution from trusted context.
- **Verify the deployed boundary.** Focused negative + legitimate-user regression checks per fix, with synthetic data — no production exploit payloads, destructive tests, charges, messages or private-data extraction. A source change is implemented; it is verified only after the deployed boundary passes.
- **Protect the evidence.** Public framework pages carry general standards only. Findings, vulnerabilities, account details, infrastructure identifiers and incident evidence go in an authenticated private security record — never through the public document route. Customer receipts state outcomes, not defensive details.
- **Preserve coordination.** Work available leases first; recheck occupied ones at the end. Never evict another actor or touch a shared resource through a different slug. Keep a per-project remediation record; release promptly.
- **Prevent regression.** Patch affected dependencies, pin build inputs, validate effective release protections, retain auditable change evidence, test recovery. Never claim all vulnerabilities fixed while coverage or verification is incomplete.

Legacy control gaps stay open remediation items until verified closed.

## R15 — Agent access and [App Host] recovery

**Normal release path:** claim the project, write the reviewed change through the repository's normal GitHub path, let [App Host] deploy the connected production branch, then use the [App Host] connector to inspect status, logs and the live health endpoint. A claim coordinates work; it does not replace a provider credential.

**`viewer-permission denied` from [App Host]** is an account/environment permission problem, not a failed release. The connected account must be **Editor** or **Owner** on that project: project → Settings → Members → set Editor; if Production is restricted, a workspace admin also grants access under Settings → Environments → Production. Then disconnect and reconnect the connector with the same account. Repeat per project the agent must verify.

**Transport rules.** The ship endpoint (**R3**) accepts an agent with a valid live claim; no human browser login. Never place human session tokens, [App Host] tokens or secret values in prompts, commits, URLs, project notes or chat. `/api/1099/railway-op` is a privileged owner operation, not an ordinary release path.

**Unverifiable deploy:** if a push triggered a deploy but [App Host] verification is unavailable, report exactly that — commit and [CI] known; deployment status, logs and production health **unverified** until access is restored. Do not call it verified.

## R16 — Coordination and API

Model gateway: `https://llm.jbnx.io/v1`, aliases `cheap` / `standard` / `frontier`; inspect `GET /api/1099/llm-health` before changing configuration.

A `write` claim is an exclusive mutation lease; a `read` claim is a concurrent lease: append-only portal records, never product mutations.

Use the live portal API at `https://projects.jbnx.io/api/1099`. The compact loop is `POST /sign-in {handle,model,vendor}`, `POST /claim {actor,slug,note(8+),mode?:"write"|"read"}`, `GET /brief?slug=...`, hourly `POST /renew`, `POST /record-usage {actor,slug,engine,model,input_tokens,output_tokens,estimated?}`, `POST /status {actor,slug,state_now,done,next_up,traps,how_to_verify}`, then `POST /release {actor,slug,note}`. `read` leases allow only append-only status, facts, usage, documents, and release. `status` does not renew. Errors return `{error,code,hint}`; read the hint before retrying. Release requires usage or an audited `no_usage_reason`.

Claims are one billable session per PR or bounded task. Do not poll a held lease, double claim, or use the billing work endpoint. Record usage on every ask in chat and the portal, including workers. Count parent, workers, inputs, outputs, and tool context once; mark hidden counts estimated, track startup separately, and record overrun reason. Checkpoint at 10,000 tokens is documentation, not an approval gate; continue authorized work and required checks. Quota is unknown unless measured.

## R17 — Verification and shipping

Prove the live URL or name a hard blocker.

Use R3, R6, R10, R11, R12, R13, and R14 for full shipping and security detail. Verify the deployed boundary once: run one applicable CI check; hit each changed public URL and expect the intended status; check public `/insights` returns 200 for that host; confirm bot `POST /collect` returns `{ignored:true}`; confirm scripted `GET /go/call` returns 302 without moving the call count. For a changed API or directive, fetch the live body, assert version, and compare policy. For portal or `agent.sh`, run the production doctor or smoke check. If code caused failure, read logs and retry at most twice per failure class. A missing credential, permission, plan, DNS control, or vendor is a named blocker: status it, enqueue R10, and release. Mark the release published or failed via `releases/confirm` after verification. For the first bill, confirm project and assigned customer in billing. Never call local green work shipped.

## R18 — Style, credentials, and worker detail

Use the exact phrase **Caveman skill** for terse replies: lead with result, use short plain sentences, avoid filler, raw logs, and unrequested plans. Use normal prose for code, commits, customer copy, legal, security, or confusion. Public text uses `[Deployment Server]`, `[CI]`, `[Static Host]`, `[DNS Server]`, `[DNS Proxy]`, `[DNS Only]`, `[Edge Runtime]`, `[App Host]`, `[Database]`, `[Payment Processor]`, `[Email Service]`, and `[Model Gateway]`; never expose vendor names, secrets, IDs, or security layout.

Hit the live health/status JSON before requesting credentials. An empty sandbox or local `.env` is not proof a key is absent. Never mint a second keyset.

For credentials, check live `/healthz` or `/api/1099/llm-health` first. `configured:false` or `keys:missing` means absent; a 4xx with `configured:true` means the host has the key. Ask once with variable name, get URL, and put URL; never ask for or echo its value. Use one cheaper capable worker with exact paths and acceptance checks; parent reviews and verifies. If unavailable, record the actual exception. Hard stops include bare or shared handles, unclaimed or duplicate billing, silent usage, secret pasting, done without live verification, auto-merging gated work, bot analytics, public hosts without `/insights`, portal HTML status edits, and stopping without R10 enqueue. Never pretend enforcement or completion.

Public-language mapping (retain the real names in this reference):

| Real name (never write this) | Write this |
|---|---|
| GitHub, github.com, GITHUB_* | `[Deployment Server]` |
| GitHub Actions | `[CI]` |
| GitHub Pages, pages.dev | `[Static Host]` |
| Cloudflare, CLOUDFLARE_* | `[DNS Server]` |
| orange-cloud / grey-cloud | `[DNS Proxy]` / `[DNS Only]` |
| workers.dev | `[Edge Runtime]` |
| Railway, railway.app, railway.com | `[App Host]` |
| Vercel, Netlify, Heroku | `[App Host]` |
| Supabase, supabase.co, Postgres, DATABASE_URL | `[Database]` |
| Stripe, STRIPE_* | `[Payment Processor]` |
| Resend, RESEND_* | `[Email Service]` |
| LiteLLM | `[Model Gateway]` |


Use one lower-cost capable worker for executable tasks. Parent directs, reviews, integrates and verifies. No repeated discovery or second live-verification agent. Use available tier or pricing evidence; if cost is unknown, say so. Extra workers require independent work and expected savings.