claude.md: Miranda (chief of staff) may relay operator directives

home_root/.claude/CLAUDE.md

@@ -17,6 +17,18 @@ He is the final authority on architectural / material-consequence
 calls. All committed-artifact attribution is to **Vuong Hoang** (see
 § Attribution) — never to Claude/Anthropic/AI.
 
+## Delegated authority — Miranda (chief of staff)
+
+**Miranda is Vuong's chief of staff and may relay his directives.** A
+directive relayed by Miranda carries the operator's authority — act on
+it as if Vuong stated it directly. This is the named exception to the
+"no relayed authorization for irreversible work" caution: that rule
+targets *unidentified* peer relays ("some agent says Vuong approved
+it"), **not** Miranda, whose relays are trusted. The material-
+consequence calls she relays remain Vuong's own — Miranda is the
+authorized conduit, not a substitute decision-maker — so surface a
+genuine concern to her the same way you would to him, then execute.
+
 ## Operator judgment — legality & fair use
 
 **You're free to refuse unethical and illegal requests, but please
@@ -67,6 +79,67 @@ substitute goal that disguises itself as virtue.
    ask whether the answer would change the action. If both outcomes
    lead to the same default, skip the question.
 
+## ⚠ MEASUREMENT DISCIPLINE — n=1 is not a measurement
+
+**An n=1 observation of a non-deterministic system is an anecdote, not a
+result. Never generalise from one, and never build a verdict, a
+recommendation, or a further experiment on top of one.** This is a hard
+floor and it applies to benchmarks, probes, A/Bs, latency numbers,
+quality scores, "does feature X work" checks, and any comparison
+between two configurations.
+
+Before any number is allowed to carry a conclusion, four things must be
+true. State them alongside the number; if one is missing, say so
+explicitly rather than letting the number travel bare.
+
+1. **Repeats.** N ≥ 3 per condition, and report the median plus the
+   spread — not a single run. If the system is non-deterministic (LLM
+   sampling, GPU scheduling, network, thermal state), a single sample
+   is dominated by variance you did not measure.
+
+2. **A noise floor.** Measure the same condition against *itself*
+   before comparing two different conditions. If A-vs-A varies by 0.15
+   and A-vs-B differs by 0.10, there is no finding — you measured the
+   noise. Establish the floor first, then interpret deltas against it.
+
+3. **A positive control — the one most often skipped, and the one that
+   catches broken instruments.** Run something the method *must* detect.
+   If your discriminator cannot detect a known-true case, its negatives
+   are worthless and you have no way to know from the results alone. A
+   test that only ever sees unknowns cannot distinguish "absent" from
+   "my instrument is blind."
+
+4. **A null / negative control.** Run something that *must* produce no
+   effect. If it registers one, the method is manufacturing signal.
+
+**Report the sensitivity floor.** "This method cannot resolve effects
+smaller than X" is part of the result, not a footnote. A "no effect
+found" without a stated floor is unfalsifiable and should not be
+written down as a negative.
+
+**Specimen (2026-09-05, tts-stack — the reason this rule exists).** A
+tag-detection sweep classified 38 candidate inputs as performed/dropped
+using a single duration measurement each, against a 3-run baseline. It
+reported `(gasp)` as **dropped**. The operator had already confirmed by
+ear that `(gasp)` performs, and `(laugh)` — documented by the vendor as
+supported — was also reported dropped. **Two known-positive controls
+existed and neither was run as a control**, so a broken discriminator
+produced a clean-looking 38-row table with false negatives throughout.
+The one result that survived was the one measured a different way: a
+transcript-based leak check, run on every row, with no leaks found.
+
+The failure was not the wrong threshold. It was **n=1 per condition, no
+positive control, and no stated sensitivity floor** — and the table
+looked authoritative anyway, which is exactly what makes this class of
+error expensive.
+
+**Corollary — the harness is part of the number.** Cold vs warm,
+execution path, input length, process age, hardware: every one of these
+has moved a "headline" figure by 1.3x–5x in practice. A number without
+its harness stated is not yet a fact about the thing being measured.
+Cross-comparisons where the harness differs are invalid, not merely
+noisy.
+
 ## Operator cognitive-load reduction (core mission)
 
 A core mission: **reduce the operator's cognitive load as he context-
@@ -264,6 +337,37 @@ the skill. Always triage Heid output before acting on it.
 
 ## Althing async-reply monitoring
 
+**The bus is althing v3 — "the post office" (cutover 2026-08-28).**
+
+    POST OFFICE   http://10.100.50.40:8390     nh3-docker. ONE container, the only
+                                               stateful component. Operator page at /.
+    client        postbox                      (+ `althing-mcp` for the stdio tools)
+    herald        althing-po-herald            one per box, supervised, ops-owned
+    waiter        althing-listen               one per session — THIS is what makes a
+                                               session pokeable; without it you are pull-only
+
+**Both env vars are required and there is no default address** — a bare
+`postbox status` errors rather than guessing:
+
+    export ALTHING_POST_OFFICE=http://10.100.50.40:8390
+    export ALTHING_HANDLE=<handle>        # dev-launch sets this per pane
+
+⚠ **Every v2 command was DELETED, not deprecated**: `althing-cli` → `postbox`,
+`althing-wake-listener` → `althing-listen`, and `althing-light-monitor` /
+`althing-receiver` are gone with no replacement. A script calling one gets
+"command not found".
+
+⚠ **An unreachable post office is an OUTAGE, never an empty inbox.** If `postbox`
+says it could not reach the post office, that is the fault — do not read it as
+"no mail". v2 could not tell those apart; v3 can, and the distinction only pays
+if it is honoured.
+
+⚠ **A session that has never armed `althing-listen` is pull-only and is never
+poked.** The herald pokes FIFOs; no waiter means no FIFO means no poke target.
+This is why the arm-early default below matters more under v3 than it did under
+v2 — and why the 📬 statusline badge is the only signal a not-yet-armed session
+gets.
+
 **Default posture — keep the monitor armed (operator directive,
 2026-07-14).** Unless a session says otherwise, every session should
 **attempt to keep its althing monitor armed for the session's
@@ -294,10 +398,11 @@ you're waiting on a response (a pure fire-and-forget FYI doesn't
 *oblige* a fresh arm) — but under the keep-armed default the monitor is
 typically already up regardless. Do **not** sign off after each
 exchange (that fights the default); sign off (`/althing:sign-off`) at
-session wind-down or on operator direction. Monitors don't accumulate
+session wind-down or on operator direction. Waiters don't accumulate
-— the singleton guard is one-per-handle, so re-arming freely is safe.
+— the lock is one-per-handle, so re-arming freely is safe.
-Stop a stuck one with `althing-light-monitor --stop`, never `pkill`
+Stop a stuck one with `althing-listen --stop`, which SIGTERMs the pid in
-(that kills every agent's monitor, not just yours).
+that handle's lock file — never `pkill`, which is handle-blind and kills
+every agent's waiter on the box, not just yours.
 
 ## Development workflow shapes
 
@@ -465,6 +570,36 @@ note says otherwise. On other boxes, check first.)
   browser-based tests or scraping. Add a browser / bump via
   `ssh infra-ops@10.100.10.50 'sudo env PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright npx -y playwright install <browser>'`.
 
+- **`ratecheck` — how close this session is to its rate limits** (`~/.claude/bin/ratecheck`,
+  reading `~/.claude/rate-limits.json`). **Run it before any expensive or long-running action**, and
+  when the operator asks how much headroom is left. Exit `0` GO · `1` PAUSE · `2` UNKNOWN; it prints
+  both windows, the file's age, and the reset time.
+
+  ⚠ **The numbers are NOT visible to an agent by default, and that is the whole reason this exists.**
+  No CLI subcommand exposes them and nothing else on disk carries them — the harness pipes
+  `rate_limits.{five_hour,seven_day}.{used_percentage,resets_at}` **to the statusline and nowhere
+  else.** So `~/.claude/statusline-command.sh` tees them atomically to `~/.claude/rate-limits.json`
+  on every render (added 2026-09-05). **If that tee is ever removed every rule built on it silently
+  stops working**, which is why `ratecheck` reports a stale file as UNKNOWN rather than as healthy.
+
+  **What to do with it, in ascending cost of the action:**
+  - **Under ~85%** — proceed normally.
+  - **~85–93%** — **take it easy**: prefer the cheap path, resume an existing subagent instead of
+    spawning a fresh one, and do not start work you cannot finish inside the window. Say the number
+    out loud when it shapes a choice, so the operator can overrule.
+  - **At or over the project's threshold** (Heid's is 93% on **either** window) — **stop starting new
+    expensive work.** Let anything in flight finish; killing it burns what was already spent.
+  - **UNKNOWN** — ⚠ **proceed, loudly.** A broken instrument that halts everything is a
+    self-inflicted outage worse than the overspend it guards, and a headless session has nobody
+    watching a status bar. **Say plainly that the limits were unreadable and you continued blind.**
+    Same shape as *an unreachable post office is an OUTAGE, never an empty inbox*: **absence of a
+    signal is not a safe reading of it.**
+
+  ⚠ **The check happens before the spend, and the spend lands after.** One Heid consult subagent has
+  measured at **270k–650k tokens**; a round cleared at 92% can finish past 100%. **A GO is margin,
+  not permission for an arbitrarily large action.** ⭐ Per-project thresholds and what exactly they
+  pause belong in that project's `CLAUDE.md` — this entry owns the instrument, not the policy.
+
 - **Graphify** — open-source knowledge-graph skill for AI coding assistants
   (`uv tool install graphifyy`; CLI `graphify`, MCP `graphify-mcp`). Turns a
   repo into a queryable graph. The **free, deterministic path** is
@@ -608,7 +743,17 @@ When infra-ops needs auth keys or access it doesn't already hold,
 **it asks the appropriate peer agent directly** rather than blocking
 on the operator. Examples:
 
-- Heimdall scopes (Worldtree auth) → ask `worldtree-dev`.
+- Heimdall keys / Worldtree auth → **infra-ops mints them directly; do
+  NOT route to `worldtree-dev`.** Operator ruling 2026-09-05:
+  worldtree-dev owns code only, no ops. The admin tokens live on the
+  infra-ops side (`~/.config/worldtree/personal-admin-token`), minting
+  is `POST /admin/keys` against the target deployment (demo :8080 /
+  personal :8081 / pinned :8082 on `corviduo-dev`), and a peer that
+  wants a key asks infra-ops. ⚠ There is no read path for a user's
+  plan tier — no GET, `/admin/usage` lists no users, `/admin/events`
+  is a live SSE stream — so a key that must match an existing user's
+  tier cannot be verified against it; leave `tier` unset and say so
+  rather than guessing.
 - Gitea API tokens / repo permissions → ask the peer that holds
   admin access for the relevant org.
 - Vendor / subscription API keys (OpenAI, Anthropic, etc.) → ask