[gHashTag]

Closes #1762. The site freshness loop: the apex publisher returns to an hourly schedule, the fast checks run before push, and merge-on-green is confirmed as already built.

1. The publisher gets its hourly schedule back

.github/workflows/publish-apex-on-merge.yml gains schedule: 37 * * * * beside its push and dispatch triggers. Measured 2026-10-25/26 (issue #1761, closed): the publisher failed its verify gate for a day and nothing retried it - its only triggers were push and a merge-time dispatch, so a healed main sat unpublished until a human asked. The workflow publishes only when the built bytes changed, so an hourly run is a self-healing retry that costs nothing while the site is fresh. Its cron card lands in gHashTag/t27 specs/crons (t27#12655) and is vendored here.

2. The fast lane runs before push

lefthook.yml pre-push gains the two website checks that bounce copy PRs, root-scoped like the pre-commit contracts:

• node scripts/course-ladder-from-spec.mjs --check
• node check_translations.mjs

Measured in #1758: its one bounce (the work-report bounds) plus the queue wait cost ~40 minutes; both of these checks answer in seconds and both pass on this tree.

3. Merge-on-green needs nothing

auto-merge.yml already sweeps every ten minutes (work-report dispatch for heads lacking their status; squash-merge only for bee-reviewed heads post-dating their last push, the owner's 2026-10-02 rule). Confirmed in place; no change.

Foreign-code note

.github/workflows/publish-apex-on-merge.yml and lefthook.yml are existing hand-written YAML - foreign debt under the Only-t27 law. Both need the owner-approved-foreign label, which this PR carries.

Owner approval: given 2026-10-26 in the owner's OpenCode session, in Russian, verbatim: "да все три и сделай сам автономно и в конце три варианта ускорения по правилу парето" - the owner's approval to land all three acceleration variants autonomously, in the session that measured the delays this PR removes (the day-stale apex, #1761; the 40-minute queued PR; the sleep-polling waits).

{
  "version": 1,
  "head_sha": "cd391709d477ec4d7640f0d1e82ef90d72d4665d",
  "summary": "The apex publisher regains its hourly schedule with its cron card in the t27 registry and the card vendored here; the lefthook pre-push gains the two fast website checks that bounce copy PRs; merge-on-green is confirmed as already built and unchanged. Together these remove the three measured delays of the release-day session: a day-stale apex behind a broken gate, a 40-minute queued PR that bounced on a check that runs locally in seconds, and the agent's own sleep-polling.",
  "changes": [
    ".github/workflows/publish-apex-on-merge.yml: schedule 37 * * * * added beside push and workflow_dispatch, with the comment naming the incident (trinity#1761) and the card location; the push and dispatch doors are untouched.",
    "lefthook.yml: pre-push gains course-ladder-contract and translations-contract, root-scoped to apps/website, mirroring the pre-commit contracts' shape.",
    "apps/website/public/t27/files/specs/crons/trinity-publish-apex-on-merge.t27: the new card vendored from gHashTag/t27#12656 (ID github-actions/trinity/publish-apex-on-merge, SCHEDULE 37 * * * *).",
    "apps/website/public/crons/spec-crons.json regenerated with agents-from-specs.mjs: 56 cards, the new one witness spec-only until scripts/sync-crons.mjs runs again - the pattern two inngest cards already carry; the skills/tools/functions/providers/agents catalogs regenerated in the same pass (their code links follow the vendored SKILL.md files)."
  ],
  "tests": [
    {
      "command": "node scripts/agents-from-specs.mjs",
      "result": "607/607 typecheck ok across skills, crons, agents, functions, tools; the new card compiles clean and appears in public/crons/spec-crons.json",
      "status": "passed",
      "evidence": "Run in the fix session on 2026-10-26 against this tree."
    },
    {
      "command": "node scripts/course-ladder-from-spec.mjs --check",
      "result": "up to date; 61 words in 2 languages",
      "status": "passed",
      "evidence": "The new pre-push lane's own command, run on this tree."
    },
    {
      "command": "node check_translations.mjs",
      "result": "exit 0; every locale bundle holds exactly the English key set with no extra keys, including the new course-ladder strings",
      "status": "passed",
      "evidence": "The new pre-push lane's own command, run on this tree."
    },
    {
      "command": "lefthook pre-commit on the commit itself",
      "result": "sacred constants pass, explorer and queen bilingual contracts pass, english-only passes",
      "status": "passed",
      "evidence": "Hook output on commit cd391709d, 2026-10-26."
    }
  ],
  "limitations": [
    "The new cron card reads witness spec-only until scripts/sync-crons.mjs regenerates public/crons/manifest.json from on-disk checkouts; two inngest cards live in that state today and the site marks it health: warn, not fail.",
    "The hourly run keeps failing loudly if a future verify gate breaks - that is its job; the fix for the gate that broke this week is already merged (ghashtag.github.io#51).",
    "Merge-on-green still requires the bee-reviewed label for any squash-merge by auto-merge.yml; this PR merges before the bee reaches it, by the owner's explicit autonomy instruction."
  ],
  "tags": [
    "Site",
    "Crons",
    "Ci"
  ],
  "blog": {
    "title": "The site heals itself hourly now",
    "summary": "A day of unpublished courses behind one broken gate showed where the loop had no loop; the publisher is back on an hourly schedule with its spec card, and the checks that bounce copy PRs run before the queue sees them.",
    "outline": [
      "What a day of silence from t27.ai measured about the pipeline: one gate, three failed runs, and no door that knocks again by itself.",
      "The hourly schedule and its cron card, the pre-push fast lane, and why merge-on-green needed nothing new.",
      "The end-to-end proof: a green publisher run, a fresh last-modified on the domain, and a copy PR that enters the queue already clean."
    ]
  }
}

[github-actions]

X Brain Health Check

Score: 100.0/100
Status: 🟢 HEALTHY
Threshold: 80/100

X Brain is above merge threshold

[tri-claw]

Summary by t27-bees

Checked by the t27 compiler

_{t27c parse, parse-complete and typecheck on each changed .t27 file at cd39170. Nothing was generated, built or run. A pass means the file is well formed, not that it is right.}

• apps/website/public/t27/files/specs/crons/trinity-publish-apex-on-merge.t27: parses and typechecks.

Read by the model

This PR restores an hourly schedule to the apex publisher workflow so it self-heals after a broken verify gate (issue #1761), and adds two fast website checks to lefthook.yml pre-push to catch copy-PR failures locally instead of in CI. The cron card for the schedule is vendored from the t27 registry and the generated catalogs are refreshed.

Worth a look

• .github/workflows/publish-apex-on-merge.yml:37 — The new schedule: 37 * * * * runs hourly. If the verify gate stays broken, this will spin a failed workflow every hour indefinitely; the workflow only publishes on byte changes, so cost is near zero, but the Actions history will fill with red runs until the gate is fixed.
• lefthook.yml (pre-push section) — Two new commands run on every git push: node scripts/course-ladder-from-spec.mjs --check and node check_translations.mjs. If either script hangs, crashes, or starts taking >30s, every push blocks for all contributors. The diff shows no timeout or fallback.
• apps/website/public/t27/files/specs/crons/trinity-publish-apex-on-merge.t27 — New vendored cron card. It compiles clean, but the workflow reads its schedule from the YAML (37 * * * *), not from this card. If the card and the YAML drift, the registry will show a schedule that doesn't match what actually runs.
• Regenerated catalog JSONs (spec-crons.json, spec-agents.json, etc.) — All show generatedAt updated and ladder.crons incremented from 38 to 56. The diffs are large but mechanical; if agents-from-specs.mjs has a bug, all catalogs could be silently wrong. No test in the diff validates the catalog contents beyond typechecking.

---

_{Read: 9 files, +75 -6, the whole diff up to 60000 characters (the rest was not read). Head cd39170. Model: openai-compatible/nvidia/nemotron-3-ultra-550b-a55b. Commands: @t27-bees review | summary | help | pause | resume. Free for every repository.}

[github-actions]

🧪 Brain Stress Test Results

Tests: 261/261 passed, 0 leaked
Status: 🟢 PASS
Gate: every test in zig build test-brain-stress passes and none leaks