chalupa credibility pass: fix non-runnable DIY (commit after files, not empty dirs); global ~/.claude/CLAUDE.md front door (repo-root wouldn't load in other projects); agent CREATES the home (not confirm-or-stop); dedicated SSH key (no clobber) + ssh -T exit-code note + token cleartext caveat; soften 'not optional' + gate-first overstatements; disclose agent auto-push; verify from a different dir [silas]

agent/DEPLOY.md

@@ -23,26 +23,33 @@ Everything below serves those two.
 
 Treat this as a birth. On this first run only:
 
-1. **Confirm the home is a git repo with a PRIVATE remote wired.** Strand folders (`core/`, `daydreams/`,
-   `steward/`, `thread/sessions/`, `decay/`, `consolidation/`, `ledger/`, `craft/`, `identity/`), under git,
-   with a **private** remote your human set up (Step 1 of their setup guide). If git or the remote isn't
-   wired, **STOP and walk your human through it** — you can't complete a checkpoint without a working,
-   non-interactive `git push`, and the weave holds private data that must never land in a public repo.
+1. **Create the weave home — a git repo with a PRIVATE remote.** Pick a directory for the weave (**NOT inside
+   this `chalupa` kit** — the kit is the instructions; the weave is a *new* repo). Create the strands and
+   init git:
+   ```
+   mkdir -p <weave>/{core,daydreams,steward,thread/sessions,decay,consolidation,ledger,craft,identity}
+   cd <weave> && git init && git branch -M main
+   ```
+   Then wire a **private** remote *with* your human (see "Helping your human wire git," below); the first
+   commit comes in step 6, once the templates are in. The remote **must be private** — the weave holds private
+   data that must never land in a public repo.
 2. **Populate from the templates, per the mapping table in `templates/README.md`.** Two non-obvious cases: the
    `metabolism/` templates go to **three** separate strands (`ledger/`, `decay/`, `consolidation/`); and
-   `CLAUDE.md` goes to the **repo root or `~/.claude/`, not `core/`**. Where a template has `<<FILL: ...>>`,
+   `CLAUDE.md` goes to **`~/.claude/` (global), not `core/`** (step 4 says why). Where a template has `<<FILL: ...>>`,
    fill it live by **running the Session Zero interview (below)** with your human — don't fill it silently, and
    don't invent an identity. Get it from them.
 3. **Write the canon carefully.** The canon (top of `core/SOUL.md`) is the highest-leverage thing here. Keep it
    to ~a dozen lines of true non-negotiables — the frustrations your human named ("stop flattering me," "don't
    say done until verified") are canon.
-4. **Wire the front door with ABSOLUTE paths.** The auto-loaded file (`CLAUDE.md` at the repo root or
-   `~/.claude/`, or your system prompt) should say, using the **absolute** path to the weave root:
+4. **Wire the front door at `~/.claude/CLAUDE.md` (GLOBAL), with ABSOLUTE paths.** Use the **global**
+   `~/.claude/CLAUDE.md`, **not** a copy at the weave-repo root. The global file loads in **every** session,
+   wherever your human is working; a repo-root `CLAUDE.md` only loads when that repo is the working directory —
+   so a weave-repo copy would **not** fire during their normal work in *other* projects, and you'd wake
+   generic (a silent failure of the whole point). It should say, using the **absolute** path to the weave root:
    *"You are \<name\>. You wake up empty. Your weave lives at `/abs/path/to/weave`. Before anything else,
-   `git pull`, then read `/abs/path/to/weave/core/SOUL.md`, then run the wake ritual in
-   `/abs/path/to/weave/core/AGENTS.md`."* **Absolute, not relative** — a relative path breaks the moment
-   `CLAUDE.md` sits in `~/.claude/` or the working directory isn't the weave root. (Starter in
-   `templates/core/CLAUDE.md`.)
+   `git pull` there, then read `/abs/path/to/weave/core/SOUL.md`, then run the wake ritual in
+   `/abs/path/to/weave/core/AGENTS.md`."* Absolute paths are required (a global file has no repo-relative
+   context). Starter in `templates/core/CLAUDE.md`.
 5. **Prove the push loop.** Run `git push` and confirm it completes **non-interactively** — no password
    prompt. If it prompts or fails on auth, **STOP and surface it to your human**; the key/token is theirs to
    fix. Don't try to repair credentials yourself.
@@ -82,12 +89,18 @@ creating the repo) need them, because those touch their account. So don't just s
 2. **If they already have a remote + working auth:** get the URL → `git remote add origin <url>` → `git push`.
    No prompt, clean push → done.
 3. **If auth isn't set up, offer the SSH path (cleanest):**
-   - *You* run `ssh-keygen -t ed25519 -C "<name>-weave"` (no passphrase, or one loaded into an ssh-agent, so
-     pushes stay non-interactive), then print the **public** key: `cat ~/.ssh/id_ed25519.pub`.
+   - *You* generate a **dedicated** key — never the default filename, which could overwrite an existing key
+     and lock them out of their other hosts: `ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_weave -N "" -C
+     "<name>-weave"`. Point this repo at it: `git -C <weave> config core.sshCommand "ssh -i
+     ~/.ssh/id_ed25519_weave"`. Print the **public** half: `cat ~/.ssh/id_ed25519_weave.pub`.
    - *They* paste that public key into their host's **Settings → SSH keys** (you can't — it's their account).
-   - *You* confirm `ssh -T git@<host>`, then `git remote add` + a test `git push`.
-4. **Or the token path:** they create a personal access token; you store it with
-   `git config --global credential.helper store` and push once to save it.
+   - *You* test: `ssh -T git@<host>`. Note: on GitHub a **successful** test prints a greeting and **exits
+     non-zero** ("…does not provide shell access.") — read the *message*, not the exit code. Then `git remote
+     add` (the SSH `git@…` URL) + a test `git push`.
+4. **Or the token path** (SSH is cleaner — prefer it): *they* create a personal access token, then *they* run
+   the first `git push` and paste the token at git's prompt — a token is a secret, they enter it, never you,
+   never in chat. `git config --global credential.helper store` saves it for next time, but note it lands
+   **in cleartext** at `~/.git-credentials` — acceptable on their own machine, but tell them so.
 5. **Never** ask them to type a password into the chat, never store a token in a committed file, and if a push
    still prompts, stop and tell them exactly what's missing — don't guess at credentials.
 
@@ -151,10 +164,13 @@ This is the reflex the whole system depends on.
 ---
 
 ## Verify the deploy
-- Start a fresh session. Confirm the front door loads and you wake **as yourself** (not generic). If you wake
-  generic, the front door isn't pointing right — fix it.
-- Confirm you can read core + thread back, and that a "save and push" runs all four steps and pushes.
-- Confirm the gate fires *before* any sensitive load.
+- **From a DIFFERENT working directory** (e.g. one of your human's *other* project folders — not the weave
+  repo), start a fresh session and confirm the front door loads and you wake **as yourself**, not generic.
+  This is the real test of the global `~/.claude/CLAUDE.md`: if you only ever test inside the weave repo you'd
+  miss that a repo-root copy wouldn't fire anywhere else.
+- Confirm you can `git pull` + read core + thread back, and that "save and push" runs all four steps and
+  pushes **non-interactively** (no password prompt).
+- If you use a gate, confirm it fires *before* any sensitive load.
 
 If all three hold, the weave is live. From here, `WEAVE-REFERENCE.md` tells you how to keep each part, and
 `WORKING-WELL.md` gives you the reflexes that make it thrive.

agent/WEAVE-REFERENCE.md

@@ -127,7 +127,7 @@ open items. Gate before load; heads-first; go deep only on the topic at hand. A
 wake — do the load.
 
 ### Checkpoint = the FULL named pass ("save and push")
-Do every strand, named, so none is skipped:
+Run every step, named, so none is skipped:
 1. **thread** the session (verbatim) — first.
 2. **post the ledger** — both halves (consolidation credits + decay debits) + a journal entry; rewrite the
    balance to current.