one-shot

Run these steps in order. Do not do anything else.

<!-- one-shot-anti-bypass-protocol:start -->

Anti-bypass protocol (load-bearing — especially Grok Build)

You are the pipeline runner for this skill. Whether entered via /go → /one-shot or direct /one-shot:

• FORBIDDEN: Cherry-picking steps (e.g. 0b worktree + inline implementation + push, then stopping).
• FORBIDDEN: Using Write/Edit/Shell on product code before Steps 1–2 (plan) complete — unless Step 1 recovered an on-disk plan and Step 3 (/work) is next.
• FORBIDDEN: Treating a draft PR or pushed branch as done. Deliverable = merged PR + <promise>DONE</promise> (Step 8).
• REQUIRED (Grok Build): Invoke child skills via slash commands — /plan, /deepen-plan, /work, /review, /qa, /compound, /ship (ship chains /postmerge). Do not read their SKILL.md and improvise.
• REQUIRED before git push (Grok Build): Run bash plugins/soleur/scripts/grok-pre-push-gate.sh from repo root — local CI parity (test-all.sh + fast required checks + grok-fidelity) — this now includes infra-validation's suites, because the gate calls test-all.sh with no TEST_GROUP and it runs run-registered-suites.sh as a nested suite when the diff touches apps/web-platform/infra/. Do NOT run that runner concurrently alongside the gate (shared TMPDIR=/var/tmp → false RED); read the epilogue and run it separately only if it reports is NOT covered above. Abort push on non-zero exit; inspect EXIT=$rc explicitly (no | tail).
• Merge → deploy: YOU poll merge/release/deploy — never ask the operator to watch CI. Grok: AwaitShell + pattern; Claude: Monitor tool. See harness.ts pollInstructions().
• Continuation gates: ## Work Phase Complete, ## Code Review Complete, and similar exit summaries mean proceed to the next step in this same turn — never hand off to the operator.

See plugins/soleur/lib/workflow-fidelity.ts (IMPLEMENTATION_TAIL, ONE_SHOT_CHILD_SKILLS) and go.md Step 2.1 (go-post-route block).

Harness adapter (Steps 1–8 child skills): Use plugins/soleur/lib/harness.ts — Grok Build invokes /plan, /work, /review, /ship, etc.; Claude Code uses the Skill tool (soleur:plan, soleur:work, …). Never substitute ad-hoc Write/Edit/Shell loops for a registered child skill. <!-- one-shot-anti-bypass-protocol:end -->

Token discipline (load-bearing — this pipeline is the biggest single consumer)

Soleur bills its operators for these tokens. This does NOT license skipping a step. Every step in the anti-bypass protocol above runs, /deepen-plan included — PLAN_PIPELINE_PREFIX in workflow-fidelity.ts is the contract and it is not negotiable here. What follows is how to run those steps without waste.

The measured cost driver is not the panel size — it is rework and restatement. On PR #7325 the classifier was CORRECT to pick the full panel (103 added source lines across 23 files); the cost came from three habits below, each of which multiplies.

1. Do not restate. Prose is review surface priced per token, and copies drift. Write the

rationale once at the artifact that owns the decision, then point at it with a content anchor (work/SKILL.md §single-source). On #7325 ~300 lines across 7 files was the bulk of the review surface, and two copies of one probe table CONTRADICTED each other before any reviewer saw them.

1. Verify a measurement before it propagates, at the granularity you will claim it

(work/SKILL.md). One false fact reached 4 files, 2 issue comments, and a review agent's top finding; the re-probe that falsified it took 15 seconds.

1. Spawn the agent set ONCE, complete (review/SKILL.md). A late gap-closer costs a whole

extra fix → CI → correction round.

1. Re-run a suite only when its inputs changed. A green full-suite run against commit A

still covers commit B when B touches only docs — verify the delta with targeted suites and say which commit the full run covered. On RESUME, this heuristic inverts: a verification claim you inherited (a handoff, a prior session's summary, session-state.md) is a statement about a tree that may no longer exist — re-run it before relying on it. #7397 resumed on "bun shard rc=0 (2419/0)"; that shard was RED, reddened by a commit made after the claim. See knowledge-base/project/learnings/2026-08-10-a-guard-that-cannot-be-driven-red-is-vacuous-four-rounds-four-instances.md.

1. Bound every command's output. git grep over a tree containing generated JSON returns

megabytes on one "line": use ':!*.json', --name-only, | cut -c1-200.

1. Delegate wide reads to a subagent (cm-delegate-verbose-exploration…) — keep the

conclusion, not the file dumps.

1. Poll with a bounded, anchored pattern — on the marker's SHAPE, plus the rc file. Match

^=== [0-9]+/[0-9]+ suites passed ===$ and read the rc file, never a bare token that also appears in a PASS line, and never pgrep a pattern your own poll command contains. Polling the green spelling N/N only is safe against a false green but not against a false dismissal: a run with a terminated suite is N<M, so the poll never matches, the Monitor runs out its clock, and {no marker, clock timeout} is byte-for-byte the harness-reap signature that work/SKILL.md says to walk away from. Since ADR-181, N/N is not even the ordinary LOCAL spelling — a diff touching neither heavy battery nor apps/web-platform/infra/ declines three suites, so a healthy local run reads N-3/N. Poll the marker's SHAPE and read the rc file. The four cases: marker + rc 0 = green; marker + rc 3 = a suite was terminated (UNRESOLVED — coverage not obtained, re-run that suite in isolation); no marker + rc 4 = REFUSED before anything ran — either SOLEUR_SUBAGENT=1 was exported (a convention; the harness does NOT set it, so this does not fire merely because you are a spawned agent), or a sibling full-gate run is already in flight (#7553, the case that actually fires). The message names which. Either way: run your own targeted suites, not the gate; no marker + no rc file = harness reap, not your diff.

Report cost honestly. If a run was disproportionate, say so and name the cause — the operator paid for it and cannot see the breakdown.

Step 0 (pre): Workspace readiness gate. Before anything else, confirm a usable git repository exists — one-shot can be invoked directly (not only via /soleur:go), so it must self-guard. Run git rev-parse --is-bare-repository 2>/dev/null || true; git rev-parse --is-inside-work-tree 2>/dev/null || true. If neither prints true, the workspace has no git checkout (in the Soleur web / Concierge env, a connected repo still cloning in the background or a failed setup leaves a repo-less /workspaces/<id>). STOP immediately — do NOT run the collision checks, do NOT create a worktree, do NOT spawn the planning subagent. Reply with the honest, no-wait message: "Your workspace isn't ready yet — its repository is still being set up, or its setup didn't finish. Please try again in a moment. If this keeps happening, reconnect your repository in Settings → Repository." This prevents the missing-repo flail where the agent improvised dozens of exploration commands.

<decision_gate> API budget. This skill runs the full autonomous engineering pipeline: plan → work → review → resolve-pr-parallel → ship. Typical wall-clock 30–90 min; per-run Anthropic credit cost is non-trivial and scales with plan complexity, review-cycle count, and PR comment volume. The pipeline runs autonomously once Step 0a/0a.5 collision checks pass — there are no per-phase approval gates after that. Soleur does not bill or proxy these calls — Anthropic does, against the key in your session. The Soleur LICENSE (BSL 1.1) disclaims warranty for runtime cost; you operate this loop against you