Plant it. It proves itself.

Decisions locked

Consistent with everything already ratified — red-pen any of them, but the build assumes these.

The journey — from a witnessed seed to a fleet that reports itself

Follow one repo from planting to proof.

1. The seed already works — witnessed yesterday, on clean soil. Planted in a repo, it sizes the repo up from the inside: finds the repo’s own checks (never invents any), adds exactly the missing wiring on a branch, runs the repo’s own verification once, opens a ready-to-merge PR. Owner merges — and that’s the last attention the repo ever needs. From that moment every agent session opened there is born into a wired world: the map, blast-radius answers, receipts on every green. Install, forget, and the agents simply have that environment. Brand-discovery sprouted exactly this way.
   ↘ go deeper — the seed, concretely

   Install once per machine: curl -fsSL https://get-quanta.robert-767.workers.dev/install.sh | bash (self-checking, plain-English errors, re-run to upgrade). Plant once per repo: quanta onboard --apply --pr — assess → identify the repo’s own verification entry → prepare exactly the missing pieces on chore/quanta-level-2 → run the entry once → open the PR. A small optional wrapper (install.sh --onboard) collapses install+plant into one paste.
2. Fix the soil it lies on — the load-bearing step. Four burrs, all found in the field: repos wired the OLD hollow way get told “nothing to do” (a false green on arby, de-brain, sandbox-hub) · the seed refuses when its branch already exists even if you’re standing on it · the health check shows one false ✗ · and repos whose CI merely calls a check script never get the CI banking job at all — found by dry-running the seed on quanta itself, which looked wired and would have stayed silent forever. Until these land, planting lies on some repos.
   ↘ go deeper — the fixtures that prove the fixes

   (a) A fixture carrying the old inline mint line (plato deposit … || echo skipped) MUST route to the upgrade path — can never read “nothing to do.” (b) On-the-branch planting resumes instead of refusing. (c) The doctor false-✗ reproduced, then fixed. All three are already chipped as tasks; every fix becomes a permanent test (the 6-refute-cycle discipline).
3. It tells you when it’s proven — the new piece. Today the receipt lands and nobody says so. This build adds the sprout verdict: READY (wired, self-check passes) then PROVEN (the actual bot receipt exists on the repo’s home branch). And the fleet view gets a receipts column — the whole fleet’s proof state on one screen, without opening a single repo.
   ↘ go deeper — how PROVEN stays honest

   PROVEN is mechanical: the home branch carries a github-actions[bot] banking commit whose currency pin equals the attested SHA. Anti-vacuity gate: a fixture with the receipt stripped MUST flip PROVEN off — a verdict that can’t go red is no verdict. The fleet view’s column reads the same check and renders CANNOT-SEE when a source is unreachable — never a false green.
4. Plant the fleet. No central machine. Each of the ~15 service repos gets the seed planted — by its owner pasting one line, or by me in an isolated clone (your call below). Output is one table: planted · upgraded · already-current · refused: reason. Then everyone watches the receipts column, not the repos.
   ↘ go deeper — the planting round

   An operation, not a build: fresh isolated clone per repo → plant → PR. Re-planting is idempotent (already-current → verify only, no new PR). Rollback is per-repo: close or revert one PR. Post-merge DONE is read from the fleet receipts column, recomputed from raw via the GitHub API — never from a worker’s summary.
5. Born planted — the strongest form. The assembly-line template gets the seed once, in your neuron repo, so every future client site comes out already wired — the ~40-site pile never needs planting at all. PR waits at your pull point; never your live checkout.
   ↘ go deeper — coordination + tokens

   Client-site repos live in the Digital-Empathy org, so the existing QUANTA_INSTALL_TOKEN org secret already covers their banking — no new token work. Template change is a normal PR against neuron worked from a clone (the concurrent-writer scar stays respected).

Your calls — DECIDED (your go, 2026-07-16)

Honest hard problems

The org world model — later, preserved now

Your rider, kept whole: eventually pour everything the seeds shed into one database and see the seams between the repos — which are connected, which talk to each other, which carry similar ideas or potential synergies. The entire org’s world model. Not this build. This build’s guarantee is the raw material: receipts durable in each member repo’s own history · one writer, so one uniform shape across the fleet · every receipt pinned to its exact commit · the registry enumerating the members. The world model becomes a straight read later, never a migration — and the fleet receipts column below is deliberately the first tiny version of exactly that kind of read.

Phasing

The planting round itself is an operation, not a phase — after P1–P2 land. Both lanes: team members paste the line; I plant service repos in parallel.

How we’ll know it works

Three receipts, all mechanical: (1) planting any of the three old-form repos routes to UPGRADE — never “nothing to do”; (2) quanta doctor in a sprouted repo answers PROVEN by pointing at the actual bot receipt on the home branch — and refuses to say it when the receipt is stripped; (3) after the planting round, the fleet view shows every planted repo’s receipt state without anyone opening those repos. The step-back, answered: the seed is the product; the factory template plants it at birth; after both, wiring costs nothing, forever.