Receipt banking is live and witnessed on the first repos. This page decides how it reaches all ~60: one command that opens a ready-to-merge PR for every service repo, an upgrade for every repo still on the old hollow wiring, and one factory-template fix so every future client site is born wired.
Draft for Robert’s annotation · not approved · no building yet
Consistent with everything already ratified — red-pen any of them, but the build assumes these.
Delivery
PRs only, never direct pushes
Same shape as the six-repo re-stamp you already approved. Every change is one repo’s own ready-to-merge PR — owners keep their hands.
Honesty
Fail closed, per repo
A repo the sweep can’t confidently wire is skipped with a named reason in the summary — never guessed at, never silently dropped.
Sequencing
Blind-spot fix ships first
Today the tool calls an old-form repo “nothing to do” — a false green on at least three repos. That fix lands before any sweep runs.
Proof
Real receipts are the only DONE
Green unit tests don’t count — the runner.temp bug hid from 60 tests and two engines; only real CI exposed it. DONE = a bot receipt banked on real CI.
02
The journey — from six wired repos to the whole fleet
Follow one org through the command, top to bottom.
Pile the fleet.~60 repos, two orgs, three piles: ~15 service repos get the sweep · ~40 factory-built client sites get the template fix instead (sweeping them one-by-one is pointless — the factory rebuilds and wipes them) · ~20 already wired get verified, and the ones on old hollow wiring get upgraded.↘ go deeper — how repos are classified
Enumerate via gh repo list <org>. Then, in order: (1) archived or empty → skip, reason recorded; (2) factory-generated site → skip to the template lane — the exact detection rule is unverified and gets fixed during build, diffed against the known ~40 list, with that diff shipped in the PR for review; (3) wired and current → verify only; (4) wired but old/stale form → upgrade; (5) everything else → wire fresh.
Fix the blind spot first — the load-bearing step.The tool currently looks at a repo wired the old way and says “nothing to do.” Run the sweep before that fix and it reports the fleet healthier than it is — the exact false green this whole system exists to kill.↘ go deeper — the fixture that proves it
A test repo carrying the old inline mint line (plato deposit … || echo skipped) MUST route to the upgrade path — never “nothing to do.” The fix is already chipped as its own task; it blocks the sweep build (P1 before P2). Known old-form repos: arby, de-brain, sandbox-hub.
Run the sweep.One command per org. Each service repo: fresh isolated clone → wire or upgrade → a ready-to-merge PR on its own branch. The tool never pushes to a default branch and never merges — and rerunning is safe: an already-current repo just verifies clean.↘ go deeper — the command contract
quanta sweep --org <org> [--repo <name>…] [--apply --pr] [--dry-run]. Default is dry-run: prints the classification table and per-repo plan, writes nothing (asserted by test). Apply mode wraps quanta onboard --apply --pr per repo under the owner’s-hand contract, branch chore/quanta-level-2. The sweep holds no state between runs.
Receipts prove it.After PRs merge, each repo’s next CI run on its home branch must bank a bot receipt readable from a bare clone — the same witnessed bar as the fleet’s first receipt. Until receipts exist, nothing is “done,” whatever the tests say.↘ go deeper — how DONE is measured
Post-wave, check each merged repo’s home branch for the bot’s banking commit via the GitHub API, from raw — the lead recomputes the results table rather than trusting any worker’s summary. Repos whose CI home branch is production bank on next production deploy; the table says so instead of calling them late.
Kill the 40-repo pile at the source.Banking goes into the assembly-line template once, in your neuron repo, so every future client site is born wired. The PR waits at your pull point — never your live checkout.↘ go deeper — coordination + tokens
Client-site repos live in the Digital-Empathy org, so the existing QUANTA_INSTALL_TOKEN org secret already covers their banking — no new token work. The template change is a normal PR against neuron worked from a clone; your live tree is never touched (the concurrent-writer scar).
The rule: zero silent skips. Every repo in the org appears in the final table with exactly what happened — wired, upgraded, verified, or skipped with a named reason.
03
Your calls — the red-pen targets
1 ★
Go / no-go on the build.
This page is the whole decision. On “go,” the full sequence runs: independent review of the build spec before code, receipts before “done.”
2
Merge policy.
Owners click every PR (like the re-stamp), or I merge the repos you personally own once their checks are green? Rec: owners click team repos; I merge yours.
3
Scope order.
Digital-Empathy org now; your personal org as soon as you do the one-time token step (your hands only — a token pasted into chat is burned). Rec: don’t wait on the token.
4
Factory template.
I prepare the neuron-side template PR right behind the sweep and leave it at your pull point. Rec: yes — it’s the move that kills the 40-repo pile.
04
Honest hard problems
Every repo’s CI is a new case
Home-branch and CI-shape detection was right on all six re-stamp repos — but 15 new repos is 15 new shapes. Mitigation: fail-closed skips with named reasons; receipts-only DONE.
PR wave load
~15 PRs land on the team at once. One wave, owners merge at leisure — the announcement you sent already primed them.
Personal-org banking waits on the token
Those repos can be wired now, but won’t bank until your one-time token step. Eve has no CI and needs nothing.
The kill criterion
If more than a third of the service pile lands in “skipped — needs hand-holding,” the one-command premise is wrong for this fleet. Stop, report the shapes met, decide together: teach the tool or hand-finish.
05
Phasing
P1
Blind-spot fix
Teach the tool to recognize and upgrade old hollow wiring. Blocks everything — without it the sweep lies about the arby-class repos.
P2
The sweep command
Enumerate, classify, wire/upgrade per repo, open PRs, print the zero-silent-skips table.
P3 · parallel
Factory template
Born-wired client sites — the deep fix for the biggest pile. Different repo, your pull point.
06
How we’ll know it works
The sweep prints one summary table — every repo in the org, its pile, and what happened. Zero silent skips. Then the real proof, same bar as the fleet’s witnessed first receipt: after PRs merge, each repo’s next CI run on its home branch produces a bot receipt commit readable from a bare clone. The step-back, answered: the sweep is a one-time catch-up; the factory template is the deep fix — after both, wiring costs nothing, forever.