This file said there was no way to create a second account. There is, and has
been since 69a31051 — POST /api/users, owner-gated, with a form under Settings.
platform/CLAUDE.md and docs/roles-and-teams.md carried the same stale claim and
were corrected in the platform repo; this one was missed because I said it was
not in a git repository. It is, through the symlink.
Also records roles as a table with foreign keys onto roles.name, USER_ROLES
gone, and UserRole as a plain string guarded at the write path instead of by the
compiler.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043
Fourteen while Minesweeper was installed, thirteen once it was removed, with no
platform change either way — a plugin that declares a sidecar writes it into the
generated ecosystem file. Says so now, so the next reader does not treat a
change here as a platform change or expect two machines to agree.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043
This file said "NEVER run pm2 yourself — tell the owner the exact command." The
owner granted the opposite on this machine on 2026-08-19, so the document and
the instruction disagreed for a day, and user/CLAUDE.md already flagged it as a
local rule to follow "while it says so".
It now says to run the restart and report it. The scope is unchanged and is the
part that mattered: only the process the change needs, never the whole
ecosystem.config.cjs.
Added the caveat the grant did not remove — check who else is live first. The
owner edits the platform using the platform, several sessions share one
checkout, and a restart is the moment a half-applied change from someone else's
work in progress would ship.
A manifest declares repo path -> target, and the script walks it. Symlinks, not
copies, so an installed file edits the repo and one commit reaches every other
machine. Idempotent — a correct link is a no-op, safe after every pull. A real
file where a link should go is moved to .bak-<timestamp> and reported, because
on a new machine that may be the only copy of something written by hand.
Conditional targets are what make it portable: officer.dev/CLAUDE.md and the
officer-chat-events hook both name ~/officer-dev/platform, so a laptop with no
Officer install gets neither instead of getting a document that lies.
mask-secret is a command now rather than a path only true on this machine, and
user/CLAUDE.md says so. It is a generated wrapper, not a symlink, and that is
forced: mask-secret.py resolves its own path to find mask-hooks.d, so a symlink
would reach back into the repo and run every machine's hooks. The wrapper sets
MASK_HOOKS_DIR to the ones this machine installed and still runs the script from
the repo, so no code is copied.
Verified against a scratch HOME: re-run is all ok, the hand-written file
survives as .bak, and a machine without Officer skips both conditional lines.
Asked three times on 2026-08-19 to see a generated icon and answered with a
Preview window, a hunt for terminal image tools, and a hyperlink before an image
appeared. Nothing said he reads through a markdown client, or that the file has
to be public before a tag can reach it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
pastilhasandClaude Opus 5