Automation Audit and Change Report

• Reads the real state of every registered conversation through Chrome's DOM, with no API calls and no cost.
• Writes a verified checkpoint whenever the conversation changes, holding the tail actually observed plus the queue as it stood.
• Composes the next instruction from the queue and that checkpoint. The instruction states the last completed step, what remains, and the single next action.
• Refuses to send during a streaming response, on any state it cannot classify, when another target has already been sent to this tick, and inside the minimum gap.
• Marks a target blocked after three nudges with no progress, or at once on a platform blocker such as a conversation length limit.

The word continue appears nowhere in anything it sends.

Your MTG deck conversation had stalled at 12:29 PM on the word continue, with ChatGPT's answer cut off mid-sentence at "After twenty" and the page showing Connection interrupted.

The controller classified it as stalled, quoted the exact point of interruption back, and asked for the one outstanding step. ChatGPT worked for 2m 43s and produced Revision 21: all five decks structurally legal, none demonstrably optimized, each verified at 60 main deck and 15 sideboard with no four-copy violations, plus named gaps on Delney's redundant legendary draws and Gardenize needing black sources that green-only acceleration cannot supply.

That conversation then hit You have reached the maximum length for this conversation. Prompting cannot fix that, so the controller marked it blocked with the true reason instead of nudging a corpse.

ctl.py migrate opened a fresh chat, seeded it with the verified checkpoint and the four surviving steps, carried the finished step across with its evidence, and re-pointed the target automatically. ChatGPT's first reply in the new conversation: "I will locate the existing five-deck artifacts, correct only the Mono-White Delney ranking and filename references. I will leave the decklists and other outstanding tests untouched."

It picked up at step 2 and declined to redo step 1.

The bridge was half built and sitting idle. obsidian-local-rest-api was enabled in the vault and answering on both ports, and nothing was configured against it.

Now registered at user scope with mcp-obsidian 1.30.0, exposing 15 tools. The two that matter are obsidian_patch_content and obsidian_append_content, because the previous retrieval path could read the vault and could not write to it. Session notes, artifact rows and decision logs can now be written straight into Brandon-Vault.

obsidian_delete_file is denied in permissions.deny, so no delete call can reach the vault through it.

Forty launchd agents already run on this Mac and not one of them did this. 1,103 lines across the bridge, the store, the tick and the operator CLI, plus a skill file so it is invoked as /continuation-controller rather than by raw path.

Covered in section 5. 33 songs loaded from material already on your disk.

Section 7 explains why. Applying it broke two of your standing gates, so it is written, tuned to your real write paths, and switched off with the reason recorded in the file.

Transport. Embedded lyric frames in files you own, .lrc sidecars, JSON packs already on disk, and your own clipboard through capture_clip.py. Byte for byte, with no model in the path. Every row carries source, source_ref and rights_note, so the Joni pack's own "personal, non-commercial study only" note survived import rather than being dropped.

Intelligence. features --out emits hashes, counts, structure and quality flags with no lyric text in it. That is enough for identification, matching, indexing, deduplication and quality checking.

Loaded today from material already on your disk: 33 songs, 22 rows from JSON packs, 10 from .lrc sidecars, 1 from an embedded tag.

• 3 rows carry invisible unicode. Two Beach House lyrics hold U+2005 and one holds U+205F. These are the exact characters your voice gate hunts, and they are invisible in every editor you would open them in.
• 1 row is not a song. A Chipperish Media podcast episode at 151 characters was flagged as suspiciously short, correctly, because its lyrics tag is not a lyric.
• 0 duplicates in the current corpus. Duplicates get marked, never removed.

The repository carries 18 hooks. The part worth taking is modes.rigor, a single setting whose whole job is to expand into six knobs: modes.review_mode, modes.workflow, docs.density, qa.level, modes.story_granularity and team.size. Its own config file warns that seeding any of the six pins that value and shadows the expansion, so the dial stops changing anything.

Your honesty gate has no such dial. Six hooks fire at full strength on every turn, whether the turn is a one-line edit or a shipped chapter. A rigor setting that expanded into which gates run would cost nothing and is the one idea in that repository worth having.

The 23 October page scored the Bash sandbox 9 out of 10, and the reasoning was sound: it replaces bypass mode with a real boundary. I enabled it with your actual write paths.

It took effect immediately and turned off Apple Events. osascript to Chrome began failing with -600 with Chrome demonstrably running, which breaks the continuation controller's in-session bridge and your auto-open-deliverables gate, since open -R and launching Firefox both go through Launch Services.

A change that breaks two standing gates fails its own test. It is configured, tuned and switched off, with the reason written into the settings file. The launchd controller is unaffected because it runs outside this sandbox. For a single hardened session: claude --settings '{"sandbox":{"enabled":true}}'

It reported Automation permission: GRANTED because it inherits the grant of whatever shell invokes it. The launchd job runs as a different responsible process and holds no such grant, which is the entire reason the scheduled run hung. A health check that passes while the thing it checks is broken is worse than no check.

It now states that caveat and prints the launchd job's own last tick outcome.

Defect 8 in the table above surfaced on this pass. The first pass had concluded it was safe because the controller's prompt is a single line that starts with a bracket. That is luck rather than a guard, and a direct test proved a line beginning EVIDENCE: would close a step with my own instruction text as its evidence.

please try again is in the stall marker list and could appear in ordinary model prose. The consequence is mild, since both stalled and idle lead to the same action, and it is recorded here rather than quietly left.