chore: commit after each task and run graphify update at session end

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/hooks/README.md

@@ -4,7 +4,7 @@ Two hooks, both small, both readable in a minute, both safe to delete. They exis
 
 | Hook | Event | What it does |
 | --- | --- | --- |
-| `session-context.mjs` | `sessionStart` | Injects the session's starting facts: whether the model lanes are bound (and whether the picker drifted from the recorded lead), the handoff's next action, and any of the four capped context files currently over its cap. |
+| `session-context.mjs` | `sessionStart` | Injects the session's starting facts: whether the model lanes are bound (and whether the picker drifted from the recorded lead), the handoff's next action, any of the four capped context files currently over its cap, and the standing workflow (commit after each task; `graphify update .` at session end). |
 | `guard-destructive.mjs` | `beforeShellExecution` | Returns `ask` — never `deny` — for force pushes, `rm -rf`, migrations, deploys, infra changes, pipe-to-shell, and friends, with the reason named and the gate quoted back to the agent. Routine `git push` is deliberately not on the list. |
 
 ## Why these two

.cursor/hooks/session-context.mjs

@@ -132,6 +132,10 @@ function main(payload) {
     notes.push(`Context caps EXCEEDED: ${over.join(" · ")}. Run /memory-sync before adding anything.`);
   }
 
+  notes.push(
+    "Workflow: commit after each landed task (no secrets). Session end: graphify update .",
+  );
+
   return notes.length
     ? { additional_context: `Project state (from .cursor/hooks/session-context.mjs):\n- ${notes.join("\n- ")}` }
     : {};

.cursor/rules/graphify.mdc

@@ -0,0 +1,22 @@
+---
+description: graphify knowledge graph context
+alwaysApply: true
+---
+
+This project has a graphify knowledge graph at graphify-out/.
+
+**MANDATORY: Before using Read, Grep, Glob, or Bash to explore the codebase, you MUST run graphify first:**
+- `graphify query "<question>"` — scoped subgraph for any codebase or architecture question
+- `graphify path "<A>" "<B>"` — dependency path between two symbols
+- `graphify explain "<concept>"` — all nodes related to a concept
+
+This applies to YOU and to every subagent you spawn. Include this rule explicitly in every subagent prompt that involves code exploration. Do not skip graphify because files are "already known" or because you are executing a plan — the graph surfaces cross-file dependencies and INFERRED edges that grep and Read cannot find.
+
+Only use Read/Grep/Glob directly when:
+1. graphify has already oriented you and you need to modify or debug specific lines
+2. `graphify-out/graph.json` does not exist yet
+
+- If `graphify-out/wiki/index.md` exists, navigate it instead of reading raw files
+- Read `graphify-out/GRAPH_REPORT.md` only for broad architecture review when query/path/explain do not surface enough context
+- After modifying code files, run `graphify update .` to keep the graph current (AST-only, no API cost).
+- At **session end**, always run `graphify update .` even if the last edits were docs-only, so the next session's queries match the tree.

.gitignore

@@ -11,3 +11,6 @@ dist/
 # Playwright
 test-results/
 .tmp-*
+
+# Graphify knowledge graph (local, regenerable)
+graphify-out/

AGENTS.md

@@ -200,6 +200,7 @@ When the user corrects you, a test or review proves a mistake, or you discover a
 ## Lessons
 
 - Website Coolify deploys must `npm start` (`server.mjs`) or the Dockerfile; Vite preview is not production.
+- After each landed task, commit (no secrets); session end run `graphify update .`.
 
 ## Memory protocol
 
@@ -208,8 +209,8 @@ Subagents have no memory and cannot see this conversation — durable knowledge
 ## State continuity and proactive improvement
 
 - Do not rely on the transcript for project state. At the start of a resumed or fresh conversation, invoke `/resume-project` before planning or editing.
-- Before ending a substantial task, update `docs/HANDOFF.md` with the verified state, changed paths, checks run, risks, and next smallest action, and promote durable knowledge per the memory protocol.
-- At every phase seal and session end, refresh `docs/PROGRESS.md` for the owner in plain language. `HANDOFF.md` speaks to the next agent; `PROGRESS.md` speaks to the owner.
+- Before ending a substantial task, update `docs/HANDOFF.md` with the verified state, changed paths, checks run, risks, and next smallest action, and promote durable knowledge per the memory protocol. Then **commit** the landed files (no secrets, no `graphify-out/`); do not push unless asked.
+- At every phase seal and session end, refresh `docs/PROGRESS.md` for the owner in plain language. Then run `graphify update .` (AST-only) so `graphify-out/` matches the tree. `HANDOFF.md` speaks to the next agent; `PROGRESS.md` speaks to the owner.
 - After a verified recurring mistake, correction, or workflow gap, invoke `/continuous-improvement` and delegate changes to `system-steward`.
 - Improve agents, skills, and rules only from concrete evidence. Keep changes small and testable; never silently change lane routing, tool permissions, hooks, safety rules, or external-action authority.
 

CLAUDE.md

@@ -337,6 +337,7 @@ Keep rules general, evidence-backed, and under 20 words. Never add secrets, pers
 - Style inline; Tailwind classes do nothing until PostCSS is wired.
 - Verify CHANGELOG entries against code, not commit subjects or handoff summaries.
 - Website Coolify deploys must `npm start` (`server.mjs`) or the Dockerfile; Vite preview is not production.
+- After each landed task, commit (no secrets); session end run `graphify update .`.
 
 ## Memory protocol
 
@@ -354,8 +355,8 @@ Run `/memory-sync` at a phase change, before ending a long run, or when any capp
 ## State continuity and proactive improvement
 
 - Do not rely on the chat transcript for project state. At the start of a resumed, compacted, or fresh session, invoke `/resume-project` before planning or editing.
-- Before ending a substantial task, update `docs/HANDOFF.md` with the verified state, changed paths, checks run, risks, and the next smallest action, and promote any durable new knowledge per the memory protocol.
-- At every phase seal and session end, refresh `docs/PROGRESS.md` for the owner in plain language: what newly works and how to see it, the *Waiting on you* queue, and what proceeds without them. `HANDOFF.md` speaks to the next agent; `PROGRESS.md` speaks to the owner.
+- Before ending a substantial task, update `docs/HANDOFF.md` with the verified state, changed paths, checks run, risks, and the next smallest action, and promote any durable new knowledge per the memory protocol. Then **commit** the landed files (no secrets, no `graphify-out/`); do not push unless asked.
+- At every phase seal and session end, refresh `docs/PROGRESS.md` for the owner in plain language: what newly works and how to see it, the *Waiting on you* queue, and what proceeds without them. Then run `graphify update .`. `HANDOFF.md` speaks to the next agent; `PROGRESS.md` speaks to the owner.
 - After a verified recurring mistake, user correction, or workflow gap, invoke `/continuous-improvement`. Opus delegates changes to `system-steward`.
 - Improve agents and skills only from concrete evidence. Keep changes small, testable, and versioned; never silently change model routing, tool permissions, safety rules, or external-action authority.
 

docs/DECISIONS.md

@@ -22,6 +22,16 @@ Add an entry when a choice is hard to reverse, shapes future work, or a future m
 
 ## Log
 
+### D-2026-09-04-01 — Commit each landed task; graphify update at session end
+
+- **Status:** accepted
+- **Context:** Graph and git lagged behind work (SEO sat uncommitted; graph needed a manual deep rebuild).
+- **Decision:** After every completed task, commit landed files (never secrets or `graphify-out/`). Do not push unless asked. At session end, run `graphify update .`.
+- **Alternatives considered:** Commit only when asked (lost work); full `/graphify --mode deep` every session (too expensive).
+- **Consequences:** More small commits on `dev`. Graph stays AST-current; docs/images still need an occasional deep extract.
+- **Verification:** Session-start hook reminds the workflow; `graphify-out/` stays gitignored.
+- **Owner / date:** John Kevin, 2026-09-04
+
 ### D-2026-09-03-01 — Website path URLs for Google indexing
 
 - **Status:** accepted

docs/HANDOFF.md

@@ -4,6 +4,7 @@
 
 ## Current state
 
-- **Outcome:** Sitemap accepted in GSC. SEO pass: intent titles, home FAQ + FAQPage JSON-LD, breadcrumbs, lastmod sitemap, 5-min cache on robots/sitemap.
-- **Verified:** `website:typecheck` + `website:build` OK (inject wrote route HTML + sitemap.xml).
-- **Next smallest action:** Merge/deploy this to `main`, purge Cloudflare `/robots.txt`, then in GSC request indexing for `/` and `/docs`.
+- **Outcome:** Standing workflow: commit after each landed task; session end `graphify update .`.
+- **Shipped:** `AGENTS.md` / `CLAUDE.md` lessons + state continuity; `.cursor/rules/graphify.mdc`; session-start reminder; `D-2026-09-04-01`.
+- **Verified:** docs/rules updated; graphify-out gitignored.
+- **Next smallest action:** Continue product work; this session will commit this change and run `graphify update .`.

docs/LESSONS_LEARNED.md

@@ -6,6 +6,16 @@ This is the project’s shared, evidence-backed memory of mistakes worth prevent
 
 `AGENTS.md` → `## Lessons` is the canonical active rule list loaded every session. Keep supporting evidence here; mirror an active rule here only when its detail is useful for maintenance. Keep at most 12 active rules, each short and imperative.
 
+### L-2026-09-04-01 — Commit each landed task; session end `graphify update .`
+
+- **Status:** active
+- **Trigger:** Owner asked to stop leaving finished work uncommitted and the knowledge graph stale.
+- **Root cause / failure boundary:** Commit-on-request plus no session-end graph refresh.
+- **Prevention:** Commit after each landed task (no secrets). Session end: `graphify update .`.
+- **Evidence:** Owner instruction 2026-09-04; graphify CLI `update`.
+- **Eval:** manual guardrail — git status + graphify-out mtime
+- **Owner / review:** lead / if auto-commit becomes noisy
+
 ### L-2026-08-17-01 — Serve website `dist/` on `0.0.0.0:$PORT`; do not use Vite preview in production
 
 - **Status:** active

docs/MEMORY.md

@@ -18,6 +18,7 @@
 - Prefer encrypted Chrome key path; keep plaintext `apiKey` fallback until migration.
 - VS Code / CLI must not import `@lib/crypto` or `@lib/messaging`.
 - Root scripts: `install:all`, `chrome:*`, `vscode:*`, `cli:*`, `website:*`.
+- After each landed task: git commit (no secrets; `graphify-out/` ignored). Session end: `graphify update .`. Do not push unless asked.
 
 ## Environment quirks
 

docs/PROGRESS.md

@@ -2,7 +2,7 @@
 
 > For the owner. What works, how to see it, and what's waiting on you — plain language.
 
-**Updated:** 2026-09-04 · **Overall:** Search Console sitemap is success; next deploy the SEO copy/FAQ pass
+**Updated:** 2026-09-04 · **Overall:** Search Console is live; agents now commit after each task and refresh the code graph at session end
 
 ## What works now