Daily Orchestration

# Verify 1Password is unlocked (needed for secret resolution in analyze phase)
op whoami --account=my.1password.com 2>&1

If this fails with "not signed in" or "authorization prompt":

1. Tell the user: "Touch ID needed — 1Password is locked. Scan once and I'll handle the rest."
2. Wait for confirmation. Do NOT proceed until op whoami succeeds.
3. This is the ONE AND ONLY auth prompt for the entire orchestration run.

SSH auth uses the native macOS agent (no Touch ID needed). The ~/.ssh/config routes only $INFRA_VPS_HOST and $INFRA_MAC_MINI_HOST through 1Password's agent.

After Phase 0 succeeds, no further auth prompts. If auth fails mid-run (e.g., 1Password auto-locked), do NOT re-prompt — report the failure and stop.

Phase 1: Pull

for repo in "${REPOS[@]}"; do
  DIR="$DEV/$repo"
  [ ! -d "$DIR/.git" ] && echo "SKIP $repo (not a git repo)" && continue
  BRANCH=$(git -C "$DIR" symbolic-ref --short HEAD 2>/dev/null)
  git -C "$DIR" pull --ff-only origin "${BRANCH:-main}" 2>&1 || echo "PULL_FAIL $repo"
done

Auth error handling: If a pull fails with auth errors after Phase 0 passed, something changed (lid close, 1Password auto-lock). Stop and report — don't re-prompt.

Phase 2: Analyze (parallel subagents)

Spawn one Agent per repo (subagent_type: general-purpose). Each agent:

Council analysis (primary path)

export OPENAI_API_KEY=$(sed -n 's/^OPENAI_API_KEY=//p' ~/.secrets)
timeout 120 devloop analyze --council --council-mode standard --repo $DEV/<repo>

If devloop binary is missing or council times out (exit 124), fall back.

Fallback analysis

Rust repos:

cd $DEV/<repo>
cargo clippy --all-targets 2>&1 | tail -30
cargo nextest run --no-fail-fast 2>&1 | tail -40

Go repos:

cd $DEV/<repo>
go vet ./... 2>&1 | tail -30
go test ./... -count=1 2>&1 | tail -40

Python repos:

cd $DEV/<repo>
uv run ruff check . 2>&1 | tail -30
uv run pytest --tb=short 2>&1 | tail -40

Other repos (no build system): Just report git log --oneline -10.

Each subagent returns structured output

REPO: <name>
STATUS: healthy | warnings | p0_issues
COUNCIL_HEALTH: <score or "skipped">
P0_ISSUES: [list of critical items, or "none"]
WARNINGS: [list]
FALLBACK_USED: true | false

Phase 3: Fix P0s (subagents with commit verification)

For each repo with STATUS: p0_issues, spawn a separate Agent (subagent_type: general-purpose). Each fix-agent:

1. Read the P0 issue description
2. Attempt the fix
3. Run the relevant test suite to verify
4. MUST check git status before reporting success:
   • If uncommitted changes exist → auto-commit:

     git add -A && git commit -m "fix: <description of P0 fix>
     
     Co-Authored-By: Claude Opus 4.6 <[email protected]>"
     

   • If commit fails (1Password lock) → pause and prompt user ONCE, same as Phase 1
5. Report: FIX_APPLIED: <repo> — <description> or FIX_FAILED: <repo> — <reason>

Self-repair on broken symlinks / missing tools

If a fix-agent encounters:

• Broken symlink: Log the path, attempt ln -sf <target> <link> if target is discoverable
• Missing tool (e.g., cargo-nextest, bacon, ruff): Attempt install:
  • Rust: cargo install <tool> or cargo binstall <tool>
  • Python: uv tool install <tool>
  • Go: go install <pkg>@latest
• After self-repair: Retry the original operation exactly ONCE
• If retry fails: Log SELF_REPAIR_FAILED: <repo> — <tool/symlink> — <error> and move on

Phase 4: Synthesize to Obsidian Daily Note

VAULT="/Users/joe/Documents/Obsidian Vault"
TODAY=$(date +%Y-%m-%d)
DAILY="$VAULT/01_Daily/$TODAY.md"

If daily note doesn't exist, create from template at $VAULT/08_Templates/Template - Daily.md with frontmatter:

---