# 🤖 TodoMVC Bakeoff Implementation Plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Nine TodoMVC apps (server-rendered, progressively enhanced) built by Opus 5.5 in nine language setups, deployed to Carloku account `bfj`, measured by one shared harness, and compared on a static report page on the same account.

**Architecture:** This session (the orchestrator) first builds everything that must be identical for all contestants: the brief, the TodoMVC assets, a pinned HTTP and markup contract, a Playwright behaviour suite, and a Go measurement harness. Both are proven against a small reference fixture app that builders never see. Then headless `claude` builder sessions (one per language, each in its own sparse git worktree) build and deploy. Astra reviews through `codex exec`, the same builder session fixes, and Fable scores readability blind. Finally the harness measures the live apps and renders the report.

**Tech Stack:** Go 1.26 (harness, reference fixture, report generator; stdlib only), Node 24 + `@playwright/test` (behaviour suite), `oha` (load generator), `qemu-aarch64-static` (local arm64 smoke runs), `carlos` CLI v0.28, `claude` CLI (Opus 5.5 builders, Fable 5.1 scorer), `codex` CLI (Astra reviewer), `amadan` CLI (platform requests).

**Spec:** `docs/superpowers/specs/2026-10-23-todomvc-bakeoff-design.md`

## Global Constraints

- Contestant slugs, in report order: `go`, `go-rastrillo`, `rust`, `zig`, `ocaml`, `haskell`, `swift`, `nim`, `spinel` (`nim` replaced `mojo` on 2026-10-24).
- Carloku account `bfj`. App names `todo-<slug>`. Hosts `todo-<slug>.bfj.oncarlos.com`. Report app `bakeoff` at `bakeoff.bfj.oncarlos.com`.
- Process contract: `<bin> --socket <path> --db <path>`; `GET /healthz` → 200; `GET /api/version` → body is the build version; reads `CARLOS_HOST`, never parses the socket path; SQLite in WAL mode; additive migrations; clean exit on SIGTERM; built for `linux-arm64`, static or libc-only; `carlos vet --boot` passes before the first deploy; the app is created with `--build-probe /api/version`.
- For local tests every binary also accepts `--listen 127.0.0.1:<port>` instead of `--socket`.
- Builders set no resource, tier or memory fields; every app runs at the platform default.
- Markup and CSS: TodoMVC `todomvc-app-template` markup with `todomvc-common/base.css` and `todomvc-app-css/index.css`, vendored once in `shared/`. Each app serves those two files byte-identical from `/static/base.css` and `/static/index.css`.
- No client framework and no JS build step. Plain ES modules; vendored VanJS allowed.
- One builder model: `claude-opus-5-5`. Reviewer: Astra through `codex exec`. Readability scorer: `claude-fable-5-1`.
- Effort limit: 4 hours of wall-clock time per builder (`timeout 4h`), then `BLOCKED`.
- One review-and-fix round per app; a second round only for security findings, counted separately.
- Machine rules: servers bind `127.0.0.1` only; scratch in `$TMPDIR`; don't override `GOCACHE`; no `sudo`; stop every process and delete scratch at the end.
- Never work around Carloku. A missing platform capability becomes an `amadan discuss new carlos/platform` Feature Request, and the report names it.
- Commits end with `Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>`.

## The pinned contract (`CONTRACT.md`, written in Task 1)

The suite and harness drive every app the same way, so these are fixed for every builder:

| Request | Without JS (no special headers) |
|---|---|
| `GET /`, `/active`, `/completed` | Full page, filtered; `a.selected` on the matching filter link (`href="/"`, `/active`, `/completed`) |
| `GET /<filter>?edit=<id>` | Same page with that `li` given class `editing` and its `input.edit` inside a form posting to `/todos/<id>/edit` |
| `POST /todos` (`title`) | Trimmed; empty → no item. 303 → current filter |
| `POST /todos/<id>/toggle` | 303 |
| `POST /todos/<id>/edit` (`title`) | Trimmed; empty → delete. 303 |
| `POST /todos/<id>/destroy` | 303 |
| `POST /todos/toggle-all` | All complete, or all active if all were complete. 303 |
| `POST /todos/clear-completed` | 303 |

- Every POST form carries `<input type="hidden" name="filter" value="all|active|completed">`, and the 303 goes to `/`, `/active` or `/completed` to match. Anything else falls back to `/`.
- Every `li` in `ul.todo-list` carries `data-id="<id>"`.
- Controls for use without JS: the toggle is a submit control `[data-action="toggle"]` inside the item's toggle form. Editing is a link `a[data-action="edit"]` to `?edit=<id>`. `button.destroy`, `button.clear-completed` and `[data-action="toggle-all"]` are submit buttons in their forms. `input.new-todo` sits in a form that submits on Enter. With JS on, the page must match the reference visually. With JS off, extra controls may show if they're styled to fit.
- Lists: an anonymous random cookie, `HttpOnly; SameSite=Lax; Path=/`, at least 128 bits of randomness. An unknown or garbled cookie value gets a fresh empty list, never an error.
- Cross-site protection: SameSite plus an Origin check. A POST whose `Origin` is present and isn't `https://$CARLOS_HOST` (or the `--listen` origin locally) gets a 403. There's no CSRF token, so the harness can POST.
- A POST naming an id that isn't in the caller's list gets a 404, never a 500 and never a change to someone else's list.
- The JS may call the same endpoints with any request header it likes, to get fragments or JSON back. The no-header behaviour above must not change.
- The footer reads `<p>Created by <a href="https://bakeoff.bfj.oncarlos.com">the CARLOS bakeoff</a> · <LANGUAGE></p>` in place of the template's "Created by you" line.

## Review Focus

1. **Titles with HTML in them** (`<img src=x onerror=alert(1)> & "q"`) must show as text and run nothing. Test: `escapes HTML in titles` (Task 3).
2. **Non-ASCII titles** (`naïve 🚀 日本語`) round-trip intact, and `Content-Length` equals the bytes sent. Spinel/tep truncated multi-byte responses before. Test: `round-trips UTF-8 and sends correct Content-Length` (Task 3).
3. **Whitespace-only and 10,000-character titles:** the first creates nothing, and the second is stored and shown without a 500. Test: `rejects blank and accepts very long titles` (Task 3).
4. **Separate visitors are separate:** two browser contexts see separate lists, and a garbled cookie gets an empty list. Test: `isolates lists per visitor and survives a garbled cookie` (Task 3).
5. **Hostile POSTs:** a foreign `Origin` gets a 403, and an id from another list gets a 404 with that list unchanged. Test: `rejects cross-site and cross-list posts` (Task 3).

---

### Task 1: Repo, brief, contract and shared assets

**Files:**
- Create: `.gitignore` (`.worktrees/`, `node_modules/`, `dist/`, `tests/behaviour/test-results/`, `*.db*`)
- Create: `AGENTS.md`: the bakeoff repo's rules (fairness rules from the spec's anti-goals, machine rules, layout below)
- Create: `BRIEF.md`: the builder brief. It's the spec's "What every app must do" section, the Global Constraints that apply to apps, the per-app `Makefile` targets below, the `STATUS.md` protocol, and a pointer to `CONTRACT.md`.
- Create: `CONTRACT.md`: the pinned contract above, verbatim
- Create: `shared/base.css`, `shared/index.css` (from npm `todomvc-common` and `todomvc-app-css`, latest)
- Create: `shared/reference.html`: the template markup with real-path filters and the contract's no-JS controls, showing three items in the visual fixture state: "Buy milk" completed, "Walk the dog", "Write the report", filter All, `2 items left`, Clear completed visible
- Create: `vendor/carlos-skills/`: copy of `carlosframework/skills/skills/{getting-started,building-carlos-apps}` at the current commit, with the commit SHA in `vendor/carlos-skills/SOURCE`
- Create: `apps/.keep`, `results/.keep`

**Interfaces:**
- Produces: the per-app `Makefile` targets every later task relies on. `make build` builds the host binary to `dist/app`. `make build-arm64` builds `dist/app-linux-arm64`. `make test` runs the app's own tests. `make clean` removes build output only, never the dependency caches. `make clean-deps` also removes every compiled third-party artifact but keeps downloaded sources, so the next `make build-arm64` is a cold build. Where a toolchain keeps compiled libraries in a shared per-user store (cabal, opam, zig, swiftpm), the Makefile points that store inside `apps/<slug>/.cache/` so `clean-deps` can delete it without touching anything else. Go is the exception: never change `GOCACHE`; instead `make build-arm64 COLD=1` passes `-a`, and the report notes that this also recompiles Go's standard library. `make bump` changes the text of one string constant in the file holding the `GET /` handler (so the next build must recompile it), and `make unbump` reverts it. `make deploy` runs `carlos deploy --account bfj --app todo-<slug> --target linux-arm64 ...` and needs no prompts.
- Produces: `apps/<slug>/STATUS.md`, whose first line is exactly `LIVE https://todo-<slug>.bfj.oncarlos.com <version>` or `BLOCKED <one-line reason>`. A blocked app adds a section headed `## Where it got stuck`. The reason `needs-arm64-host` is reserved for "builds and passes on x86-64 but can't produce linux-arm64 on docs-t1".
- Produces: `apps/<slug>/DEPS`, one direct third-party dependency per line (empty file if none).

- [ ] **Step 1:** `git init -b main`, then write the files above.
- [ ] **Step 2:** Check that `shared/reference.html` opened in Chromium looks like the TodoMVC template screenshot (`todomvc-app-css/screenshot.png`), apart from the item text. Run: `npx playwright screenshot --browser chromium file://$PWD/shared/reference.html $TMPDIR/ref.png` and look at it.
- [ ] **Step 3:** Commit: `chore: bakeoff repo, brief, contract and shared TodoMVC assets`.

### Task 2: Reference fixture app (never shown to builders)

A minimal Go implementation of `CONTRACT.md`, used only to prove the suite and harness work before any builder starts. It keeps data in memory, has no SQLite and isn't a contestant.

**Files:**
- Create: `harness/go.mod` (module `bakeoff/harness`, go 1.26, stdlib only)
- Create: `harness/refapp/main.go`, `harness/refapp/app.js`, `harness/refapp/page.html.tmpl`
- Test: `harness/refapp/refapp_test.go`

**Interfaces:**
- Produces: `go run ./refapp --listen 127.0.0.1:<port>`, a server that fully meets `CONTRACT.md` with JS on and off, serving `shared/*.css` from `/static/`.

- [ ] **Step 1: Write the failing tests** in `refapp_test.go` with `httptest`. `TestAddRedirectsToFilter`: POST `/todos` with `title=" a "` and `filter=active` → 303 `Location: /active`, and the page then has one `li[data-id]` labelled `a`. `TestForeignOriginForbidden`: `Origin: https://evil.example` → 403. `TestOtherListIDNotFound`: B toggles A's id → 404, and A's item is unchanged. `TestGarbledCookieGetsEmptyList`: cookie `todo=%%%` → 200 with no `li`.
- [ ] **Step 2:** Run `cd harness && go test ./refapp/ -run . -v`. Expected: FAIL (package doesn't build yet).
- [ ] **Step 3:** Implement the handlers and the page template from `shared/reference.html`. `app.js` (≤300 lines) adds double-click to edit, Enter/Escape/blur, and fetch-based toggle/add/destroy that swaps the `section.todoapp` HTML it gets back.
- [ ] **Step 4:** Run `go test ./refapp/ -v`. Expected: PASS.
- [ ] **Step 5:** Commit: `test: reference fixture app implementing the contract`.

### Task 3: Behaviour suite (Playwright, JS on and JS off)

**Files:**
- Create: `tests/behaviour/package.json` (pin `@playwright/test` to the version matching the cached `chromium-1234`, otherwise latest plus `npx playwright install chromium`)
- Create: `tests/behaviour/playwright.config.ts`: two projects, `js-on` and `js-off` (`javaScriptEnabled: false`); `baseURL` from `BASE_URL`; `workers: 4`; JSON reporter to `$RESULTS_FILE` when set
- Create: `tests/behaviour/todomvc.spec.ts`: ported from `tastejs/todomvc/cypress/e2e/spec.cy.js`
- Create: `tests/behaviour/robustness.spec.ts`: the five Review Focus tests
- Create: `tests/behaviour/visual.spec.ts`, plus its golden `visual.spec.ts-snapshots/` generated from `shared/reference.html`
- Create: `tests/behaviour/actions.ts`: `addTodo(page, title)`, `toggle(page, i)`, `edit(page, i, title)`, `destroy(page, i)`, `toggleAll(page)`, `clearCompleted(page)`, `gotoFilter(page, f)`. Each checks `testInfo.project.name` and performs the action the JS way (dblclick, checkbox click) or the no-JS way (the contract's submit controls and edit link).
- Create: `scripts/test-app.sh <base-url> <results-file>`

**Interfaces:**
- Consumes: Task 2's refapp, used as the target during development.
- Produces: `scripts/test-app.sh URL OUT.json`, which runs both projects and writes Playwright JSON. It exits 0 only when everything passes.

Porting rules. Every Cypress `it` becomes a test in both projects, with these exceptions in `js-off`: `should save edits on blur` and `should cancel edits on escape` are skipped (they're JS-only). `should hide other controls when editing` uses `?edit=<id>`. Persistence checks reload the page instead of reading `localStorage`. Routing uses the real paths. Each test runs in a fresh browser context, which means a fresh cookie and an empty list, so there's no cleanup.

- [ ] **Step 1: Write `robustness.spec.ts`** (both projects):
  - `escapes HTML in titles`: add `<img src=x onerror=alert(1)> & "q"`; `li label` text equals it exactly; `page.on('dialog')` never fires.
  - `round-trips UTF-8 and sends correct Content-Length`: add `naïve 🚀 日本語`; the label equals it after a reload; `request.get('/')` has `content-length` (when present) equal to `body().length`.
  - `rejects blank and accepts very long titles`: `'   '` → zero items; `'x'.repeat(10000)` → one item whose label length is 10000.
  - `isolates lists per visitor and survives a garbled cookie`: context A adds `a` and context B sees zero items; a third context holding every cookie name A received, each set to the value `%%%`, gets 200 and zero items.
  - `rejects cross-site and cross-list posts`: `request.post('/todos', {headers:{Origin:'https://evil.example'}})` → 403; B posts `/todos/<A's id>/toggle` → 404, and A's item is still active.
- [ ] **Step 2:** Write `todomvc.spec.ts` (the 28 ported tests) and `visual.spec.ts`. The visual test seeds the fixture state in the `js-on` project only, then runs `expect(page).toHaveScreenshot({ mask: [page.locator('footer.info')], maxDiffPixelRatio: 0.02 })` against the golden made from `reference.html`.
- [ ] **Step 3:** Run `scripts/test-app.sh http://127.0.0.1:<port> $TMPDIR/ref.json` against the refapp. Expected: all pass; record the counts (passed/skipped per project) in `tests/behaviour/README.md`.
- [ ] **Step 4:** Prove it can fail. Break one rule at a time in the refapp (send a 500 on a foreign id; drop HTML escaping; render `#/` filter links), run the suite, see the matching test fail, and revert.
- [ ] **Step 5:** Commit: `test: TodoMVC behaviour suite, JS on and off, plus robustness and visual checks`.

### Task 4: Measurement harness

**Files (all in `harness/`, package `bakeoff`, plus `cmd/bakeoff/main.go` dispatch):**
- `session.go`: `type Session`; `NewSession(base string) (*Session, error)` (cookie jar, doesn't follow redirects, sets `Origin` to base); `(*Session) Add(title string) error`; `(*Session) IDs(path string) ([]string, error)` (parses `li[data-id]`); `(*Session) Toggle(id string) error`; `(*Session) CookieHeader() string`; `Seed(s *Session, n int) ([]string, error)` adds `item 1..n` and toggles every second one
- `ttfb.go`: `type Stats struct{ N int; P50, P95, P99, Min, Max float64 }` (milliseconds); `MeasureTTFB(s *Session, path string, warmup, n int) (Stats, error)`, measured to the first response byte, with a fresh connection for each request
- `wake.go`: `IsAsleep(app, host string) (bool, error)` (runs `carlos instances list --account bfj --app <app> --health asleep` and reports whether `host` is listed); `MeasureWake(s *Session, path string) (float64, error)`, the TTFB of one request
- `load.go`: `type LoadResult struct{ Scenario string; Concurrency int; RPS, P50Ms, P95Ms, P99Ms, ErrorRate float64 }`; `ParseOha(b []byte) (LoadResult, error)`; `RunLoad(s *Session, scenario string, concurrency int, d time.Duration) (LoadResult, error)`. Scenario `read` = `GET /`. Scenario `toggle` = `POST /todos/<first id>/toggle` with `filter=all`, sent with `--redirect 0`, where a 303 counts as success. Both send the session cookie and `Origin`. For `ErrorRate`, anything other than 200 (read) or 303 (toggle), and any transport error, counts as an error.
- `pageweight.go`: `type Weight struct{ HTMLBytes, JSBytes int }`; `PageWeight(s *Session, path string) (Weight, error)` sums the HTML plus every same-origin `<script src>`
- `codestats.go`: `type CodeStats struct{ Server, Templates, JS, Tests, Deps int }`; `CountCode(dir string) (CodeStats, error)` counts non-blank lines. JS is `*.js`/`*.mjs` except `van*.js`. Templates are `*.html`, `*.tmpl`, `*.erb`, `*.mustache`, plus anything under `templates/` or `views/`. Tests are files under `test/` or `tests/`, or named `*_test.*`, `*.test.*`, `*_spec.*`. Server is every other source file. `dist/`, `vendor/`, lockfiles, `*.css` and `*.md` are skipped. Deps is the line count of `DEPS`.
- `buildstats.go`: `type Build struct{ ColdSeconds, WarmSeconds, EditSeconds float64; Bytes int64; Host string }`; `BuildStats(dir string, runs int) (Build, error)`. It runs each mode `runs` times and takes the median. Cold is `make clean clean-deps` then a timed `make build-arm64` (with `COLD=1` for the Go slugs). Warm is `make clean` then a timed `make build-arm64`. Edit is a build, then `make bump`, a timed `make build-arm64`, and `make unbump`. It also records the size of `dist/app-linux-arm64`.
- `tokens.go`: `type Tokens struct{ Input, Output, CacheRead, CacheWrite int64; Turns int; Seconds float64; CostUSD float64 }`; `ParseClaudeLog(r io.Reader) (Tokens, error)` (the final `"type":"result"` event of `--output-format stream-json`: `usage.*`, `num_turns`, `duration_ms`, `total_cost_usd`); `ParseCodexLog(r io.Reader) (Tokens, error)` (sums the usage on `turn.completed` events from `codex exec --json`)
- `results.go`: `type AppResult` holding the slug, language, status, URL, version, stack summary, behaviour pass/fail/skip per project, `TTFBEmpty`/`TTFB50 Stats`, `Wake []float64`, `Load []LoadResult`, `Weight`, `Code CodeStats`, `Build`, `TokensBuild`, `TokensFix`, `TokensSecurity`, `TokensReview Tokens`, `Readability` (scores and notes), `ReviewFindings []string`, `Notes []string`; `Update(slug string, f func(*AppResult)) error` reads and writes `results/<slug>.json` with indented JSON
- `cmd/bakeoff`: subcommands `ttfb|wake|load|weight|code|build|tokens|report`, each taking `--slug` and writing into `results/<slug>.json` through `Update`. `tokens` also takes `--phase build|fix|security|review`, reads `builders/logs/<slug>.<phase>*.jsonl` (with `ParseCodexLog` for `review`, `ParseClaudeLog` otherwise) and sums them into `TokensBuild`, `TokensFix`, `TokensSecurity` or `TokensReview`.
- Tests: `*_test.go` next to each file. Fixtures go in `testdata/`: a real `oha` JSON output, a real `claude` stream-json log and a real `codex --json` log, captured in Step 1.

**Interfaces:**
- Consumes: CONTRACT routes; Task 2's refapp for testing.
- Produces: `bakeoff <subcommand> --slug <s> [--url U]` → `results/<s>.json`; `type AppResult` (Task 10 renders it).

- [ ] **Step 1:** Install `oha` from its GitHub release binary into `~/.local/bin`. Capture fixtures: run `oha --output-format json -z 2s` against the refapp; run `claude -p --model claude-opus-5-5 --output-format stream-json --verbose "say ok"`; run `codex exec --json "say ok"`. Save them under `testdata/`.
- [ ] **Step 2: Write the failing tests.** `TestSeed` (refapp: 50 ids, 25 completed from `IDs("/completed")`); `TestParseOha` (fixture → RPS > 0, P99 ≥ P50); `TestParseClaudeLog` / `TestParseCodexLog` (fixtures → Output > 0); `TestCountCode` (a `testdata/codetree` with one file per category and a `vendor/` file that must be ignored → exact counts); `TestPageWeight` (refapp → JSBytes equals the size of `app.js`); `TestBuildStats` (a `testdata/buildtree` Makefile whose targets `sleep` known amounts → Cold > Warm > Edit > 0, and `unbump` was called); `TestMeasureTTFB` (refapp, n=5 → `N==5`, `Min ≤ P50 ≤ Max`).
- [ ] **Step 3:** Run `go test ./... -short`. Expected: FAIL.
- [ ] **Step 4:** Implement the files listed above.
- [ ] **Step 5:** Run `go test ./... -short`. Expected: PASS. Then run `bakeoff load --slug refapp --url http://127.0.0.1:<port>` and check that `results/refapp.json` has 6 load rows (2 scenarios × concurrency 1, 16, 64, 30 s each with a 60 s rest), then delete `results/refapp.json`.
- [ ] **Step 6:** Commit: `feat: measurement harness`.

### Task 5: Toolchains and arm64 smoke builds

**Files:**
- Create: `scripts/toolchains.sh`: idempotent; installs under `~` only; prints each tool's version
- Create: `scripts/smoke/<slug>/`: hello-world HTTP-over-unix-socket in each language, plus `scripts/smoke.sh <slug>`
- Create: `docs/toolchains.md`: versions installed and the arm64 route for each language

**Interfaces:**
- Produces: on `PATH` (through `~/.local/bin` or `source scripts/env.sh`): Go 1.26, `rustup` stable with `aarch64-unknown-linux-musl`, `zig` (latest stable), `opam` + OCaml 5.x, `ghcup` + GHC + cabal, Swift 6.2 + the Static Linux SDK, Mojo through `pixi`, Spinel + tep + spinelkit at the pins in `paulca/lpay/spinel`, `qemu-aarch64-static` (extracted with `apt-get download qemu-user-static && dpkg-deb -x`), and `oha`. Builders don't install compilers; they only add libraries.

- [ ] **Step 1:** Write `toolchains.sh` and run it. GHC and Mojo downloads are approved (spec). Check `df -h ~` first.
- [ ] **Step 2:** For each slug, `scripts/smoke.sh <slug>` builds a linux-arm64 hello binary that serves `GET /healthz` on `--socket`, checks `file` says `ARM aarch64` and `statically linked` (or libc-only), then runs it under `qemu-aarch64-static` and curls `/healthz` over the socket. Expected: `ok` for each slug.
- [ ] **Step 3:** Any slug that fails gets the reason and the tito-studio fallback written in `docs/toolchains.md`. That slug's builder is told up front (Task 6 prompt `{ARM64_NOTE}`).
- [ ] **Step 4:** Commit: `chore: toolchains and arm64 smoke builds`.

### Task 6: Builder pipeline and the Go pilot

**Files:**
- Create: `builders/prompts/build.md`: template with `{SLUG}`, `{LANGUAGE}`, `{EXTRA}`, `{ARM64_NOTE}`
- Create: `builders/extra/<slug>.md`, one per slug: `go` "Don't use Rastrillo"; `go-rastrillo` "Use Rastrillo v0.28 (`amadan.net/rastrillo/rastrillo`); read `~/amadan.net/rastrillo/rastrillo/SKILL.md`; use the TodoMVC CSS, not Rastrillo's UI"; `spinel` "Start from `paulca/lpay` `spinel/` (README, BUILD-arm64.md, patches/tep-carlos.patch)"; `mojo` "A single file is required; if Mojo can't produce one, stop with `BLOCKED single-binary`"; the others are empty
- Create: `builders/worktree.sh <slug>`: `git worktree add .worktrees/<slug> -b app/<slug>` with sparse checkout `/*`, `!/harness/refapp/`, `!/apps/`, `/apps/<slug>/`
- Create: `builders/run-build.sh <slug>`: `cd .worktrees/<slug> && timeout 4h claude -p --model claude-opus-5-5 --permission-mode bypassPermissions --output-format stream-json --verbose "$(render prompt)" > ../../builders/logs/<slug>.build.jsonl`. It records `session_id` from the first event into `builders/logs/<slug>.session`.

The prompt tells the builder to: read `BRIEF.md`, `CONTRACT.md`, `vendor/carlos-skills/*/SKILL.md` and `references/platform.md`; work only in `apps/{SLUG}/`; not read other apps or the harness source; choose its stack and say why in `README.md`; write `AGENTS.md` first; get `make test` and `scripts/test-app.sh` passing locally against `--listen`; `carlos apps create --account bfj --app todo-{SLUG} --build-probe /api/version`, `carlos vet --boot`, `make deploy`; run `scripts/test-app.sh https://todo-{SLUG}.bfj.oncarlos.com`; commit on its branch; and finish by writing `STATUS.md`. If it hits a Carloku gap, it stops and writes `BLOCKED platform: <what's missing>` instead of working around it.

**Interfaces:**
- Consumes: Tasks 1, 3 and 5.
- Produces: `builders/logs/<slug>.{build.jsonl,session}`; branch `app/<slug>` with `apps/<slug>/` and `STATUS.md`.

- [ ] **Step 1:** Write the files. Run `builders/run-build.sh go` in the background.
- [ ] **Step 2:** When it exits, check: `head -1 .worktrees/go/apps/go/STATUS.md` starts with `LIVE`; `curl -sI https://todo-go.bfj.oncarlos.com | grep -i x-carlos-version` matches the version; `scripts/test-app.sh https://todo-go.bfj.oncarlos.com $TMPDIR/go.json` passes; `bakeoff tokens --slug go --phase build` writes nonzero tokens.
- [ ] **Step 3:** Fix any pipeline problem the pilot exposed, in the scripts or the brief only. Never fix the app by hand. If the brief changed, delete `todo-go` (`carlos apps delete`) and the branch, and rerun the pilot so all nine builders get the same brief.
- [ ] **Step 4:** Commit: `feat: builder pipeline; Go pilot`.
- [ ] **Step 5: Checkpoint with Paul.** Show him the pilot's live URL, its tokens and wall-clock time, and the estimated total for eight more. Wait for his go-ahead.

### Task 7: The other eight builders

- [ ] **Step 1:** For each of `go-rastrillo rust zig ocaml haskell swift mojo spinel`: `builders/worktree.sh <slug>`, then `builders/run-build.sh <slug>` in the background. All eight run in parallel.
- [ ] **Step 2:** As each exits, read `STATUS.md`. For `BLOCKED needs-arm64-host`, ask Paul for tito-studio access, then continue in the same session (`claude -p --resume <session> "An arm64 host is available: <how>. Continue."`, appending to a separate `<slug>.build2.jsonl` that counts toward build tokens). Count that time against the same 4-hour limit. Any other `BLOCKED` stays blocked.
- [ ] **Step 3:** For every `LIVE` app, run the same checks as Task 6 Step 2.
- [ ] **Step 4:** Merge each `app/<slug>` branch into `main` (`git merge --no-ff`) and commit: `feat: <slug> builder output`.

### Task 8: Astra review, one fix round, security round

**Files:**
- Create: `builders/prompts/review.md`: review `apps/{SLUG}/` against `BRIEF.md`, `CONTRACT.md` and the TodoMVC spec. Correctness, spec compliance and security only, with no performance tuning. Output is a numbered list, each item tagged `[security]`, `[correctness]` or `[spec]`, written to `builders/reviews/<slug>.md`.
- Create: `builders/run-review.sh <slug> <n>`: `codex exec -s read-only --json -o builders/reviews/<slug>.<n>.md "$(render)" > builders/logs/<slug>.review<n>.jsonl` (`n` is 1 for the first review, 2 for the re-review)
- Create: `builders/run-fix.sh <slug> <phase>`: `claude -p --resume $(cat <slug>.session) --output-format stream-json --verbose "Fix these review findings, redeploy, re-run the suite, update STATUS.md: $(cat review)" > builders/logs/<slug>.<phase>.jsonl`

- [ ] **Step 1:** For each LIVE app: `run-review.sh <slug> 1`, then `run-fix.sh <slug> fix` with `builders/reviews/<slug>.1.md`.
- [ ] **Step 2:** Run `run-review.sh <slug> 2`. If it has any `[security]` items, run the fix with phase `security` using only those items. There's no third round.
- [ ] **Step 3:** Store the `[security]`/`[correctness]`/`[spec]` items that remain in `results/<slug>.json` `ReviewFindings`, and the tokens from every phase.
- [ ] **Step 4:** Commit: `chore: review and fix round`.

### Task 9: Blind readability scoring

**Files:**
- Create: `builders/prompts/readability.md`: rubric. Score 1–5 each on naming, structure, following one request end to end, error handling, and comments. Give an overall score of 1–10 and a justification of at most 120 words. Output only JSON `{"naming":n,"structure":n,"traceability":n,"errors":n,"comments":n,"overall":n,"notes":"..."}`.
- Create: `builders/run-readability.sh <slug>`: concatenates `apps/<slug>/` source as `CountCode` defines it (server, templates, JS; no tests, vendor or docs) with relative paths, removes the strings `todo-<slug>` and `<slug>` from paths, names only the language, then runs `claude -p --model claude-fable-5-1 --output-format json` three times and stores the per-field median

- [ ] **Step 1:** Run it for each LIVE app and write the scores to `results/<slug>.json`.
- [ ] **Step 2:** Commit: `chore: readability scores`.

### Task 10: Measurement on live apps

Run one app at a time, in slug order, from docs-t1.

- [ ] **Step 1:** Behaviour: `scripts/test-app.sh <live url> results/<slug>.behaviour.json` → pass/fail/skip into `AppResult`.
- [ ] **Step 2:** `bakeoff ttfb` (empty list and 50 items; warmup 3, n 30), `bakeoff weight`, `bakeoff code`, `bakeoff build --runs 3` (on the host recorded in `docs/toolchains.md`), `bakeoff load` (6 runs).
- [ ] **Step 3:** Wake: once all load runs are done, leave every app idle. Every 5 minutes, check `IsAsleep` for each app. As soon as an app is asleep, `bakeoff wake` records one sample. Repeat until each app has 3 samples (each sample needs another idle period of at least 15 minutes).
- [ ] **Step 4:** Memory: check `carlos instances list --account bfj --app todo-go` and the console's instance view for memory figures. If there are none, search `amadan discuss list carlos/platform` for an existing request. Then file or reply: `amadan discuss new carlos/platform -title "Member-visible memory use per instance" -body -` (type `Feature Request`), explaining the bakeoff use. Record the discussion id in every `AppResult.Notes`. If wake measurement needed anything the platform lacks (for example, a member-side "sleep now"), file that the same way.
- [ ] **Step 5:** Commit: `chore: live measurements`.

### Task 11: Report page

**Files:**
- Create: `harness/report/report.go`: `Render(results []AppResult, w io.Writer) error` (html/template plus inline SVG charts, no JS, no external assets)
- Create: `harness/report/report.html.tmpl`, `harness/report/copy.md` (all prose on the page, as one file for copy review)
- Test: `harness/report/report_test.go`: `TestRenderAllApps` (a fixture with one LIVE and one BLOCKED result → output contains both slugs, the BLOCKED reason, and no `NaN` or `<no value>`)
- Output: `report/site/index.html`

Page sections: summary table (one row per slug, a column per measure, blocked apps shown with their reason), one chart per performance measure, a section per app (stack, notable choices, Astra's remaining findings, Fable's notes, live link, source link), "How we measured", and "What this does and doesn't show" (network included; Spinel's concurrency model; build hosts; blocked apps; memory status).

- [ ] **Step 1:** Load the `dataviz` skill before writing any chart code. Write the failing test, run `go test ./report/`, and see it fail.
- [ ] **Step 2:** Implement `Render`, then run the test and see it pass.
- [ ] **Step 3:** Draft `copy.md`, then run the `copy-review` skill on it and apply Paul's edits verbatim.
- [ ] **Step 4:** Source links: ask Paul where the repo should be published (amadan or GitHub, public). Publish, then put the links in the results.
- [ ] **Step 5:** `bakeoff report > report/site/index.html`, then `carlos deploy --account bfj --app bakeoff --kind static --host bakeoff.bfj.oncarlos.com report/site`. Verify: `curl -sI https://bakeoff.bfj.oncarlos.com | grep -i x-carlos-version`, and open it in Chromium.
- [ ] **Step 6:** Commit: `feat: bakeoff report page`.

### Task 12: Clean up and hand off

- [ ] **Step 1:** Stop every background process this work started (builders, refapp, local app servers, oha). Remove `.worktrees/` (`git worktree remove`) and `$TMPDIR/recon` and other scratch. Keep `builders/logs/`, because they're the token evidence.
- [ ] **Step 2:** Confirm that `ss -ltnp` shows no listener from this work, and that `carlos apps list --account bfj` shows the nine `todo-*` apps (or fewer, matching the BLOCKED list) plus `bakeoff`.
- [ ] **Step 3:** Run the `handoff` skill.