The brain your AI agent
never loses.

# Master prompt: build a self-auditing, self-restoring, mirrored memory ("Backup Brain") for Claude Code.
# Fill the [BRACKET]s or let it auto-detect. Keep the repos PRIVATE. Safe to paste again. Then paste the whole block in.

ROLE. Give yourself a permanent, self-backing-up, self-auditing brain so a new session, or a
rebuilt machine, resumes exactly where the last one left off. It holds the living state of the work:
the project and its goal, the roadmap, what is done / in progress / blocked, the bugs found and fixed,
the audits run and their findings, the decisions made and why, the recurring lessons, and the open
loops waiting on a human. Build it, verify each piece, keep memory current as you work, and report
LIVE vs MANUAL vs UNVERIFIED. Do not stop at a plan.

GOAL. The distilled memory (index plus fact files) lives in a private git repo, backs itself up
after every turn, syncs at session start, mirrors to a second repo, audits its own integrity, and
restores from a fresh clone with one command. Zero ongoing effort from me.

INPUTS (resolve before STEP 1; ask me ONCE, batched, only for what you cannot safely infer, then
run autonomously). MEMORY_DIR: auto-detect an existing MEMORY.md under ~/.claude or this project; if
one, use it; if none, default ~/.claude/projects/<slug>/memory; if several, ask. BRAIN_REPO: derive
from the dir or an existing remote. MIRROR_REPO: <BRAIN_REPO>-mirror. GH_ACCOUNT: from `gh auth
status`; if several, ask. Echo the four resolved values back before STEP 1; never invent an account
or push to an org you cannot confirm. This is the ONLY place asking is expected.
 - IDEMPOTENT: safe to paste again. Reuse existing repos/remotes/dir, merge (never duplicate)
   hooks, never overwrite memory newer locally than in git, never commit an unchanged tree. Converge, do not rebuild.
 - DEGRADE GRACEFULLY: if a step cannot complete, finish the rest, mark that one capability MANUAL
   with the exact remaining command, and continue. 80% LIVE with two labelled MANUAL rows beats an abort.

THREAT MODEL & CONTENT POLICY. The repos are PRIVATE, not encrypted: anyone holding the token,
any org owner, and GitHub itself can read every byte, and the mirror doubles that surface. The repo
also executes on restore (bootstrap wires its scripts into settings.json), so write access equals code
execution on any machine that restores it. The security boundary is the CONTENT, not the private flag.
 - Never write a secret VALUE. Store a reference: the env-var NAME, a key ID or last-4, and where the
   real value lives (e.g. "rotate CLERK_SECRET in Doppler"). This covers passwords, connection strings,
   publishable keys, webhook secrets, and tokens, INCLUDING any flagged "to rotate".
 - Third-party PII: name external people by role plus company ("the DHL ops contact"), never by
   personal name or email. Your own contact is fine; other people's are not.
 - Minimize: MEMORY.md is injected into context every session and may be pasted or shared. Keep it
   high-signal and free of anything you would not want in a shared transcript.

WHAT THE BRAIN KEEPS (structure it; do not just dump notes). Maintain as living documents:
 - OVERVIEW: the project, its goal, the roadmap (next / later / someday).
 - STATE: done / in progress / blocked plus active branch. The pinned START HERE a cold session reads first.
 - DECISIONS: options weighed, the choice, and why, so it is not re-litigated.
 - BUGS: status (open or fixed), root cause, and the fix or the repro.
 - AUDITS: what it covered, what it found, and what is fixed versus open.
 - LESSONS: the recurring gotchas and house rules.
 - OPEN LOOPS: one pinned register of everything blocked on a human or external decision
   (approvals, rotations, gates), each with owner and what unblocks it. Close the loop when resolved.
 - FACTS: durable reference, one idea per file (endpoints, where each secret lives by name, a
   glossary of codenames when they are dense).
 RECALL before acting: at session start read the pinned START HERE, then the files it links for
 the area you will touch; before any unit of work `grep -ril <topic> "$MEMORY_DIR"` for prior art or a
 settled decision, and state in one line what you found or "no prior memory". Never re-solve what a
 LESSON/DECISION already settles. If memory and the live repo disagree, trust the repo and flag STATE stale.
 WRITE with discipline: evergreen files (FACTS, LESSONS, DECISIONS, STATE, OVERVIEW, OPEN LOOPS)
 are atomic and updated in place, no date in the name, never duplicated; grep for an existing file
 before creating one. Dated episodic logs (project_<slug>_<date>.md) are fine, but fold their durable
 residue into the matching evergreen file. Index bullets are one-line pointers, not second copies.
 SUPERSEDE, do not overwrite: when a file retires another, link forward and move the closed log
 to archive/; never overwrite the record of a past decision with its successor.
 VERIFIED vs ASSUMED: every done / bug-fixed / audit-clean entry carries a UTC date and names its
 proof (commit, PR, deploy, or command output). Anything you did not observe is written ASSUMED, never done.

PRE-FLIGHT (do first; stop and tell me if any fails).
 - Confirm git, gh, jq installed. Confirm gh is authenticated; if a platform token shadows git, use
   env -u GITHUB_TOKEN rather than failing.
 - Resolve MEMORY_DIR. Confirm it has its OWN .git, distinct from this project's repo.
 - Scan the whole tree AND full history (gitleaks if on PATH, else the gate regex over `git log -p`),
   not just HEAD. If any secret or third-party email is already present, stop: it needs the
   burned-secret runbook, not a deleted line.

STEPS.
 1) REPOS + CREDENTIAL. With gh, create PRIVATE [YOUR_GITHUB_USERNAME]/[BRAIN_REPO_NAME] and
    [BRAIN_REPO_NAME]-mirror (reuse if they exist; never overwrite). Make MEMORY_DIR a git repo
    (origin plus a `mirror` remote), commit, push to both, verify local HEAD == each remote HEAD.
    Disable GitHub Actions on both (`gh api -X PUT repos/{owner}/{repo}/actions/permissions`) since the
    repo executes on restore. Commit a .gitattributes with `*.md merge=union` so two machines' appends
    auto-merge instead of conflicting.
 2) ALLOWLIST. A .gitignore that tracks ONLY *.md, *.sh, .gitignore, and the CLI file; everything
    else ignored, so a stray or generated file can never be staged.
 3) sync.sh (auto-backup, Stop hook; must stay OFF the turn's critical path).
      - flock so two turns cannot write at once; if locked, exit quietly. Stage all; if nothing
        changed, exit silent. If a prior rebase is stuck (.git/rebase-merge exists), git rebase --abort first.
      - SECRET + PII GATE: if gitleaks/trufflehog is on PATH, run it on the staged diff and block on
        any finding; else regex the high-signal shapes (sk_live_ / pk_live_ / whsec_ / sk-ant- /
        github_pat_ / AKIA / credential-bearing URIs / PEM keys) and any email outside [your-domain.com].
        Deliberately do NOT flag documented synthetic fixtures (sk_t_fake, redacted ...). On a hit:
        unstage, block, write the blocked status, print file:line, stop. Deliberate override: `brain sync --force`.
      - DESTRUCTION GATE: block (never fail the turn) if the staged diff would empty MEMORY.md,
        shrink it past a floor, or net-delete beyond a large threshold; `brain sync --force` overrides.
        Sync replicates to origin AND mirror in one turn, so an unguarded wipe is gone everywhere at once.
      - Else commit UTC-stamped, rebase --autostash, then background the push (origin, then mirror)
        under a hard timeout. INSIDE that worker, refetch and set last_success only when the remote HEAD
        matches what you pushed; record the mirror as its own field. A local commit is not a backup.
      - Write .brain-status.json (attempt, success, error, fail_streak). On a repeated streak or an auth
        failure, print ONE loud actionable line ("Backup Brain: N turns not backed up (auth) - run gh
        auth login, then brain sync"); a single offline miss stays quiet and retries on the next change.
 4) pull.sh (SessionStart hook). First SELF-HEAL: if either hook is missing from settings.json or
    points at a path that no longer exists, re-run bootstrap.sh. Then rebase-pull (abort a stuck
    rebase first). Warn if the last success is over a day old, or at once on an auth failure. Point the
    session at the pinned START HERE.
 5) bootstrap.sh (self-restore, idempotent). Set gh as the git credential helper, then jq-merge
    two hooks into ~/.claude/settings.json WITHOUT clobbering existing keys:
        "hooks": { "Stop":         [{ "hooks": [{ "type":"command", "command":"bash <dir>/sync.sh" }] }],
                   "SessionStart": [{ "hooks": [{ "type":"command", "command":"bash <dir>/pull.sh" }] }] }
    The Stop hook must first confirm MEMORY_DIR is the brain repo and exit 0 otherwise, so it never
    touches the wrong project. A machine rebuild wipes ~/.claude, so also invoke bootstrap from the
    machine's own startup (devcontainer setup.sh / postCreateCommand / shell rc) to survive it. Read
    any token or passphrase with `read -rs`, never a CLI arg; write credential files with umask 077.
 6) audit.sh. Prove local == remote and the tree is clean; run git fsck; check the index BOTH
    ways (no dangling link AND no orphan file unreachable from the index); fetch the mirror and report
    it behind or DIVERGED; warn if STATE is older than the newest fact file; fail if history holds a
    secret or third-party email. Fix or report what it flags.
 7) test.sh. Prove the gate BLOCKS a planted fake key AND a third-party email and commits
    nothing; the allowlist rejects a stray file; both hooks are installed; sync and pull rebase. PROVE
    THE RED: force audit.sh to fail on purpose (rewind local one commit behind origin; add an index
    link to a missing file), then recover, so the auditor is shown catching a real break, not only
    passing when healthy.
 8) brain (one CLI): sync | pull | audit | test | status | mirror | snapshot | restore | compact
    | heal | restore-drill. `restore-drill` clones the MIRROR to a temp dir, runs audit inside it,
    diffs against live, confirms bootstrap would install the hooks, deletes it. `heal` re-clones origin
    (or mirror) when the local repo is corrupt or missing and re-runs bootstrap; restore and heal share
    one routine. `status` prints last backup, fail_streak, orphan count, and mirror parity.
 9) START-HERE. Create project_current_state.md (living done / in progress / blocked) and pin a
    pointer to it at the very TOP of MEMORY.md. At session end, before the final sync, reconcile it
    against the files you wrote this session so it never drifts behind reality.
10) SELF-DOCUMENT. Write one memory file describing this whole system so future sessions keep it.
11) COMPACT (run when a product ships, a branch merges, or the dated logs pile up). `brain
    compact` rolls several episodic logs on one topic into one evergreen summary, moves the raw logs to
    archive/ (kept, not deleted), promotes a now-recurring gotcha into a LESSON, dedupes, and trims the
    index bullets to one line each. It relocates and distills; it never discards a decision or a lesson.
12) OPTIONAL. Opt-in encrypted snapshot (openssl, passphrase via env or stdin, off by default).
    A least-privilege fine-grained PAT (Contents: read-write on only the two repos, with an expiry) to
    replace the broad gh token for pushes, and a read-only clone PAT in a Codespaces/Doppler secret for
    hands-off rebuild-restore. GitHub only mints these in its web UI, so wire the swap script but leave
    both as MANUAL rows with the exact steps: never claim them LIVE.

ORDERING: do not activate the Stop hook until STEP 7 has proven the secret gate blocks a planted
key. An always-on auto-push must never go live before its gate is verified.

VERIFY (prove each with a pasted command plus its real output; do not assume).
 - A test edit auto-pushes to BOTH repos via the Stop hook; audit.sh and test.sh pass; a fresh clone
   plus bootstrap.sh reinstalls the hooks; `brain restore-drill` restores the mirror clean.
 - A planted sk_live_ line, a pk_live_ line, a postgres://user:pass@host URI, and a third-party email
   are each BLOCKED and nothing is pushed; the full-history scan is clean.
 - PROVE THE RED: audit.sh exits non-zero when local is one commit behind origin and when an index
   link points at a missing file; then show the restored green run. A push to a dead URL still ends the
   turn cleanly and writes last_error.

GUARDRAILS. Repos stay private; the brain lives in its OWN repo, never inside the project you are
working in (never cross-commit). Never write a secret VALUE or third-party PII; store a reference. Back
up ONLY the distilled memory, never the raw transcripts. Nothing is LIVE until you have run the proof
this session; never fabricate or estimate a number, copy every count from real output. Never
force-push, with ONE exception: purging a burned secret from history (rotate it at the source FIRST,
then filter-repo or BFG on both remotes if available, else emit the manual steps). Reuse existing
repos. Write plainly. No em-dashes.

DONE WHEN. Every VERIFY passes, proven with pasted output, and you print one table:
Capability | LIVE / MANUAL / UNVERIFIED | Proof (command plus observed output) | if MANUAL, the one
command to finish it. "Proof" means evidence you ran and watched pass THIS session, never reasoning or
a prior run. Scope each claim to what you proved ("restores from a fresh clone here", not "any
machine"). End with a two-line "from now on": what happens automatically, and the single command to
restore the brain on a new machine.

# HYPALOOP: an autonomous, self-verifying, self-improving work loop for Claude Code.
# Fill the GOAL block at the bottom (the yellow [BRACKETS]), then paste. Claude primes from memory,
# loops until the goal is truly done and proven, then writes back what it learned. Blanks get a named default.

MISSION. Drive the GOAL to full, verified completion on your own. Do not stop at a plan or a first
draft. Keep looping until every item is done, proven, and two clean passes find nothing new.

STATE & RESUME. The loop's memory lives in HYPALOOP.state.md on disk, not in this chat, so it survives
a context limit, a crash, or a new session. On start, if that file exists this is a RESUME: load it,
trust it over memory, continue from its `current item`, and do NOT re-run SET UP. It is the single
source of truth: the GOAL, baseline, checklist (per item: status, exact verify command, proof path),
invariants, blockers queue, changelog, and clean-pass counter. Update it after every step and never
delete a past line; correct with a new one. On resume, re-verify anything not recorded DONE with fresh proof.

SET UP (once, unless resuming):
 - PRIME FROM MEMORY. If a persistent memory exists (e.g. a Backup Brain), sync and read it: the index,
   the current-state doc, and every house-rule/feedback file, which are HARD CONSTRAINTS not tips. Do
   not redo parked work or relitigate settled decisions. If none exists, keep equivalent notes on disk.
 - CLARIFY FIRST. Restate the GOAL as one OUTCOME line plus a short done-when list. If a blank or
   ambiguity would change what you build, ask ONCE in a grouped list (max 5 questions), each with a
   recommended default so I can reply "use your defaults". Otherwise state your assumptions and start.
 - DECOMPOSE into a dependency-ordered checklist; mark disjoint-file tracks parallel-safe and
   serialize overlapping ones. Give each task a testable "done when" and its exact VERIFY method.
 - FREEZE the done-whens, baseline, and quality bar now: the work moves to meet the bar, never the bar
   to the work; any target change is a logged SCOPE CHANGE. Baseline = a dated metrics ledger (tests,
   coverage, bundle, perf, errors); no tracked metric may end below it without a logged reason. Bar:
   score each finished item 1-5 on correctness, robustness, polish; below 4 on any is not done.
 - FENCE THE BLAST RADIUS (the only files/dirs you may modify; all else read-only) and set a BUDGET
   (caps on iterations, wall-clock, spend). Work on a throwaway branch off HEAD, never main. WHEN ANY
   CAP IS HIT, STOP and emit a partial report.

THE LOOP. SELECT next: only items whose dependencies are all DONE are eligible; among those take the
highest severity or impact. A new blocker preempts only at a clean boundary (finish or cleanly revert
the in-flight change first; never leave two items half-done).
 1) ACT. Make the smallest complete change that finishes the item. Default every command to local/dev
    with disposable data; name the environment before running anything that touches state.
 2) VERIFY by measuring, never assuming. PROOF is a verbatim artifact: the exact command + its real
    exit code and output, or the saved path of a render/screenshot (skip screenshots for non-UI work).
    "Should work" is not proof; with no artifact the item stays OPEN. Confirm the check CAN fail (red
    on the broken state, green after); a check never seen red proves nothing. Verify read-only/local;
    a check that writes, sends, deploys, or hits a paid service is a STOP GATE. Ambiguous output is NOT verified.
 3) SELF-HEAL. If red, fix the CAUSE and re-verify. Reaching green by skipping or deleting a test,
    weakening an assertion, loosening a threshold, swallowing an error, mocking away the thing under
    test, `|| true`, or bypassing a guard (--no-verify, @ts-ignore, disabling lint) is a FAIL logged as
    a bug, never a pass. Never advance on a failing check.
 4) REGRESSION-GUARD. Re-run earlier checks and the INVARIANTS (properties every done item must keep).
    If an item re-opens 3+ times it has a hidden constraint: capture it as an invariant, or park it.
 5) RED-TEAM your own work as a fresh reviewer: correctness, edge cases, empty and huge inputs,
    concurrency, security, performance, accessibility, first-time user. Each real weakness is a task.
 6) DISCOVER from several distinct angles at once to reduce correlated blind spots; log what each
    covered. Tag findings blocker/major/minor/cosmetic; add the real ones. Findings outside the fence
    are logged for a human, not executed.
 7) SCORE and REGULATE. Score the item; below the bar, keep improving. Rank the backlog by severity,
    do not gold-plate. Track ONE progress number per iteration (open core items + open blocker/major
    findings); it must trend down. An item that resists three honest attempts is PARKED with a return trigger.
 8) LOG and CHECKPOINT. Append one changelog line tied to a metric (what changed, before->after from
    real output) and commit a checkpoint. A no-metric, no-close iteration is flagged NON-PRODUCTIVE.

ESCALATE, never idle. The instant an item needs a human-only decision, add it to the BLOCKERS queue
with exactly what you need and what you will do once unblocked, then work other tracks; batch so the
human answers once. HARD-HALT before anything irreversible, destructive, production, regulated, shared,
spend, external-send, or secret-touching, or that would violate a house rule: stop and escalate, never
self-approve. Self-approve ONLY work that is reversible, in-fence, local, non-prod, secret- and spend-free.

STOP ONLY WHEN every item is DONE, verified, and at or above the bar; or, if the rest is all PARKED or
BLOCKED, stop and emit ONE consolidated BLOCKED report so a single reply unblocks the set. Converge
honestly: ANY change (a fix, a new task, a moved score) resets the clean-pass counter to zero, and the
two clean passes must use DIFFERENT techniques with nothing changed between them. Once core items are
done, only blocker or major findings may reopen the loop; log minor and cosmetic under NICE-TO-HAVE.
Then re-verify EVERY done item fresh from a clean state at the final commit (test, typecheck, lint,
build, real output) and run a FINAL COHESION AUDIT end to end, re-reading the GOAL to confirm nothing was missed.

CLOSE THE LOOP (a closeout, not a gate on whether the goal was met): if a persistent memory exists,
update the current-state doc in place, write a dated log of what shipped plus its proof plus what is
still open, link it from the index, append the final numbers to the ledger, and distill the process
lessons into durable house rules; then sync and confirm. If none exists, leave equivalent notes on disk.

OUTPUT. Lead with a plain-language FOR YOU summary: the honest verdict first (GOAL NOT FULLY MET if
anything is open, parked, or unverifiable; never let a wall of DONE rows imply completion); the 3 to 5
things that actually changed, in plain words; what is still open and any decision you need; HOW TO CHECK
IT YOURSELF (exact commands or pages); and HOW TO UNDO IT (branch name and rollback command). Then the
table: each item DONE (proof, score, one-line residual risk) or OPEN (reason, next step), the changelog,
and a line confirming zero checks were skipped, disabled, or weakened.

RULES.
 - Measure, never assume; real output wins every argument. Keep verified and assumed separate; never
   invent a result or a number.
 - Fix the code, never the check. A check you altered is not proof unless a human approved the change.
 - Stay inside the blast radius; widening it is human-gated, not a judgement call.
 - Guard your context budget: push heavy reading and independent verification of high-impact items to
   sub-agents that return a distilled result, collapse each DONE item to its one-line proof, and
   checkpoint to disk before any large read. Running out of context mid-task is a failure, not a finish.
 - Leave an append-only trail (the state file, the proofs, the changelog) so anyone can check your work.

GOAL (fill in what you can; leave a blank and I will ask or pick a safe default and name it):
 - OUTCOME: [in a sentence or two, what should be true when this is done, and why / who it is for]
 - WHERE: [repo path, the files, pages, or URLs, and any plan or audit doc to follow]
 - DONE WHEN: [how you will personally know it worked, in your own words]
 - LIMITS: [anything not to touch or build, plus any deadline, budget, or must-use / must-avoid tools]
 - SAFETY: [may I push, open a PR, deploy, or touch prod or live data? blank = new branch, commit locally, do NOT push, deploy, or touch prod]
 - ASK ME ABOUT: [decisions to check first; blank = only secrets, payments, or irreversible external actions]