Introduces three new weekly agents that form a triage→plan→build pipeline:
- proposal-triage-agent: evaluates proposals, dead ends, and coverage gaps;
produces prioritized backlog in src/backlog/BACKLOG.md
- plan-agent: creates concrete implementation plans from top backlog items
in src/plans/PLAN-*.md
- builder-agent: executes approved plans, makes code changes, verifies
acceptance criteria
Also includes:
- Architecture proposal document in docs/proposals/
- Seeded initial backlog with 11 items from diagnosed dead ends
- Updated roster.json and weekly-scheduler.md (24 weekly agents)
- All three validators pass (prompt-contract, scheduler-roster, flow-parity)
https://claude.ai/code/session_01FLP7ibXd5QPG517g1kYCHL
- README.md: add "Prompt Governance & Versioning CLI" and "State Backup
CLI" sections under Usage with full command examples and link to
docs/prompt-versioning.md
- TORCH.md: add "Prompt Versioning & State Backup" section with
proposal→apply→rollback cycle, backup command reference, and link to
docs/prompt-versioning.md
https://claude.ai/code/session_01Ndq2D72Kp77BYo4owD63uY
.torch/ is created at runtime by torch-lock backup and proposal apply.
It holds prompt version archives and state snapshots — operational data
that should not be tracked in source control.
https://claude.ai/code/session_01Ndq2D72Kp77BYo4owD63uY
- governance/index.js: archive filenames now include ISO timestamp for
deterministic sorting (<base>_<ts>_<hash>.md); write .meta.json sidecar
on every archive with proposalId, author, reason, and archivedAt
- governance/index.js: add listPromptVersions(target) — returns archived
versions for a prompt sorted newest-first with sidecar metadata surfaced
- cmd-rollback.mjs: add --list flag to list available versions without
restoring (delegates to listPromptVersions)
- cli-parser.mjs: add --list and --output flags
- lib.mjs: pass list flag to cmdRollback; add backup command dispatch
- cmd-backup.mjs: new torch-lock backup command — snapshots
.scheduler-memory/memory-store.json and scheduler run state to
.torch/backups/<timestamp>/; supports --output override and --list
- docs/prompt-versioning.md: comprehensive guide to the full
proposal → apply → list-versions → rollback workflow, state backup
and restore procedure, and storage location reference
- test/governance.test.mjs: 7 scenario-based tests (SCN-proposal-create,
SCN-proposal-list, SCN-proposal-reject, SCN-archive-naming,
SCN-version-list, SCN-rollback-latest, SCN-rollback-hash)
https://claude.ai/code/session_01Ndq2D72Kp77BYo4owD63uY
Users who installed TORCH via `npm install <tarball> && npx torch-lock init`
had no built-in way to cleanly remove it. This adds a `remove` command that
detects and removes all TORCH artifacts: the torch/ directory, config files,
runtime directories (.torch/, .scheduler-memory/, task-logs/), governance
proposals, host package.json scripts, and the npm package itself.
- Add cmdRemove() in src/ops.mjs with detection, preview, confirmation, and cleanup
- Wire up `remove` command in CLI dispatcher (src/lib.mjs)
- Add TORCH_HOST_SCRIPTS constant in constants.mjs for shared script key list
- Add docs/removal.md with full manual removal instructions
- Add removal section to README.md
- Add 7 scenario tests in test/ops-remove.test.mjs
https://claude.ai/code/session_011Snrxu3iZGLtJ9pnFSajpM
- Add --test-timeout=30000 to prevent test suite hanging
- Skip build_verification.test.mjs when dist/ is absent
- Replace setTimeout with mocked Date.now in memory-cache expiry test
- Replace wait(30) with setImmediate flush in scheduler smoke test
- Remove unused @playwright/test devDependency
https://claude.ai/code/session_01GfwUNbgeMgXreFDbsNQMsS
- Fix timingSafeCompare to pad buffers to equal length before comparing,
closing the content timing side-channel on length mismatch
- Replace innerHTML with textContent for error messages to prevent XSS
- Extract inline script from dashboard/index.html into dashboard/app.js
- Remove 'unsafe-inline' from script-src CSP directive
- Update security test to match new CSP policy
https://claude.ai/code/session_01GfwUNbgeMgXreFDbsNQMsS
The Claude Code remote sandbox strips `Upgrade: websocket` at the proxy
L7 layer, making all outbound WebSocket connections (including Nostr
relays used by torch-lock) unreachable. A local relay workaround was
investigated but rejected because it breaks cross-agent lock visibility
with Jules, which uses the public relay set.
Workaround: run all scheduler/lock operations exclusively from Jules
or any environment with unrestricted outbound WebSocket access.
Refs: anthropics/claude-code #490, #2059, #17333https://claude.ai/code/session_019g8yqKQMiq9u41n3GxUpFH
Lock backend error: all Nostr relays returned permanent_validation_error
(no WebSocket connectivity). perf-optimization-agent was selected as next
agent after perf-deepdive-agent (round-robin index 7). Prompt not executed;
lock:complete not published per scheduler strict_lock policy.
https://claude.ai/code/session_019g8yqKQMiq9u41n3GxUpFH
The `files` array in package.json was missing 7 source modules and the
entire `src/services/` directory tree that `src/lib.mjs` imports at
runtime. Installing TORCH via `npm install` would crash immediately with
ERR_MODULE_NOT_FOUND on any CLI command.
Missing files added: cli-parser.mjs, errors.mjs, utils.mjs, lock-utils.mjs,
cmd-proposal.mjs, cmd-rollback.mjs, src/services/ (memory + governance),
and migrations/ for DB schema setup.
Also adds: engines (node >=22), license (MIT), repository, keywords,
exports map, LICENSE file — so the landing page install flow
(`npm install ... && npx torch-lock init`) works out of the box.
https://claude.ai/code/session_01CJFvLoy2BA8n9qk3z5BQQA
Claude