feat!: remove implicit agent writes and retired surfaces

.codex/skills/hack-cli/SKILL.md

@@ -12,11 +12,11 @@ Use `hack` as the primary interface for local-first development.
 
 ## Integration freshness
 
-- These instructions were generated by hack CLI v3.5.0; treat cached rules from another version as potentially stale.
+- These instructions were generated by hack CLI v3.5.2; treat cached rules from another version as potentially stale.
 - At session start, audit project and global integrations with `hack setup sync --all-scopes --check`.
-- If anything is stale, missing, or deprecated, run `hack setup sync --all-scopes`, then reload the agent session so cached instructions are replaced.
+- If anything is stale or missing, run `hack setup sync --all-scopes`, then reload the agent session so cached instructions are replaced.
 - Never copy or hand-edit generated Hack rules to refresh them; update the CLI and run the sync command.
-- Content revision: `1319d93c89c3` (version alone is not a freshness guarantee).
+- Content revision: `994ef1552d14` (version alone is not a freshness guarantee).
 
 ## Product boundary
 
@@ -74,7 +74,7 @@ Use `hack` as the primary interface for local-first development.
 - Generated (do not hand-edit): `.hack/.internal/compose.override.yml`, `.hack/.internal/compose.env.override.yml`, `.hack/.internal/compose.runtime.override.yml`, `.hack/.branch/compose.<branch>.override.yml`, `.hack/.branch/compose.<branch>.runtime.override.yml`.
 - Managed via CLI: `.hack/.internal/extra-hosts.json` (use `hack internal extra-hosts ...` commands).
 - Lifecycle runtime files: `.hack/.internal/lifecycle/state.json`, `.hack/.internal/lifecycle/*.log`.
-- Ignore rules: hack owns a committed `.hack/.gitignore` (self-healing on init/up) covering machine-local generated files (`.internal/`, `.branch/`, `.env`, `.env.state.json`, `hack.env*.local.yaml`); keep it committed, and if generated files leaked into git, `hack doctor --fix` untracks them (files stay on disk).
+- Ignore rules: hack owns a committed `.hack/.gitignore` (self-healing on init/up) covering machine-local generated files (`.internal/`, `.branch/`, `.env`, `.env.state.json`, `hack.env*.local.yaml`) plus the retired `tickets/` cache path for upgrade safety; keep it committed, and if generated files leaked into git, `hack doctor --fix` untracks them (files stay on disk).
 
 ## Linked git worktrees
 
@@ -190,10 +190,11 @@ Use `hack` as the primary interface for local-first development.
 
 ## Agent integration maintenance
 
-- Project-level hack commands auto-check integration drift and attempt auto-sync (project docs, client skills/rules, shared global skills, and MCP).
-- When drift is detected, Hack reports it before repair and tells the agent to reload after repair; it never silently leaves the session using cached rules.
-- Set `HACK_SETUP_SYNC_MODE=warn` to only warn, or `HACK_SETUP_SYNC_MODE=off` to disable.
+- Ordinary Hack commands, `hack update`, and `hack doctor --fix` may audit freshness but never render, repair, remove, or otherwise mutate agent integration files.
+- Use `hack setup sync` only when explicitly choosing to manage project or user docs, skills, rules, hooks, or MCP config.
+- Read-only freshness checks are available through `hack setup sync --all-scopes --check`, `hack doctor`, and `hack agent prime`.
 - Refresh project + user integrations: `hack setup sync --all-scopes`
+- Explicit sync removes recognized Hack-owned artifacts from retired integrations and preserves unrecognized files for manual review.
 - Audit integration state only: `hack setup sync --all-scopes --check`
 - Remove generated integration artifacts: `hack setup sync --all-scopes --remove`
 - After upgrading CLI: `hack update` then `hack setup sync --all-scopes`

.cursor/rules/hack.mdc

@@ -7,11 +7,11 @@ Prefer `hack` when shell access is available. Use MCP only when shell access is
 
 ## Integration freshness
 
-- These instructions were generated by hack CLI v3.5.0; treat cached rules from another version as potentially stale.
+- These instructions were generated by hack CLI v3.5.2; treat cached rules from another version as potentially stale.
 - At session start, audit project and global integrations with `hack setup sync --all-scopes --check`.
-- If anything is stale, missing, or deprecated, run `hack setup sync --all-scopes`, then reload the agent session so cached instructions are replaced.
+- If anything is stale or missing, run `hack setup sync --all-scopes`, then reload the agent session so cached instructions are replaced.
 - Never copy or hand-edit generated Hack rules to refresh them; update the CLI and run the sync command.
-- Content revision: `1319d93c89c3` (version alone is not a freshness guarantee).
+- Content revision: `994ef1552d14` (version alone is not a freshness guarantee).
 
 ## Product boundary
 
@@ -37,7 +37,7 @@ Prefer `hack` when shell access is available. Use MCP only when shell access is
 - Generated (do not hand-edit): `.hack/.internal/compose.override.yml`, `.hack/.internal/compose.env.override.yml`, `.hack/.internal/compose.runtime.override.yml`, `.hack/.branch/compose.<branch>.override.yml`, `.hack/.branch/compose.<branch>.runtime.override.yml`.
 - Managed via CLI: `.hack/.internal/extra-hosts.json` (use `hack internal extra-hosts ...` commands).
 - Lifecycle runtime files: `.hack/.internal/lifecycle/state.json`, `.hack/.internal/lifecycle/*.log`.
-- Ignore rules: hack owns a committed `.hack/.gitignore` (self-healing on init/up) covering machine-local generated files (`.internal/`, `.branch/`, `.env`, `.env.state.json`, `hack.env*.local.yaml`); keep it committed, and if generated files leaked into git, `hack doctor --fix` untracks them (files stay on disk).
+- Ignore rules: hack owns a committed `.hack/.gitignore` (self-healing on init/up) covering machine-local generated files (`.internal/`, `.branch/`, `.env`, `.env.state.json`, `hack.env*.local.yaml`) plus the retired `tickets/` cache path for upgrade safety; keep it committed, and if generated files leaked into git, `hack doctor --fix` untracks them (files stay on disk).
 
 ## Linked git worktrees
 
@@ -91,10 +91,11 @@ Prefer `hack` when shell access is available. Use MCP only when shell access is
 
 ## Agent integration maintenance
 
-- Project-level hack commands auto-check integration drift and attempt auto-sync (project docs, client skills/rules, shared global skills, and MCP).
-- When drift is detected, Hack reports it before repair and tells the agent to reload after repair; it never silently leaves the session using cached rules.
-- Set `HACK_SETUP_SYNC_MODE=warn` to only warn, or `HACK_SETUP_SYNC_MODE=off` to disable.
+- Ordinary Hack commands, `hack update`, and `hack doctor --fix` may audit freshness but never render, repair, remove, or otherwise mutate agent integration files.
+- Use `hack setup sync` only when explicitly choosing to manage project or user docs, skills, rules, hooks, or MCP config.
+- Read-only freshness checks are available through `hack setup sync --all-scopes --check`, `hack doctor`, and `hack agent prime`.
 - Refresh project + user integrations: `hack setup sync --all-scopes`
+- Explicit sync removes recognized Hack-owned artifacts from retired integrations and preserves unrecognized files for manual review.
 - Audit integration state only: `hack setup sync --all-scopes --check`
 - Remove generated integration artifacts: `hack setup sync --all-scopes --remove`
 - After upgrading CLI: `hack update` then `hack setup sync --all-scopes`

.factory/library/architecture.md

@@ -5,8 +5,8 @@ Durable architecture rules for current Hack work.
 ## Core Product Boundary
 
 - Hack v3 is CLI-first, local-first, and self-contained.
-- Supported product surface: project init, local runtime orchestration, routing/TLS, env and secrets, lifecycle, sessions, diagnostics, MCP/agent setup, the slim macOS companion, and optional local tickets.
-- Retired product surfaces: hosted auth, account/org/team admin, web dashboard, built-in GitHub workflows, and built-in Linear sync.
+- Supported product surface: project init, local runtime orchestration, routing/TLS, env and secrets, lifecycle, sessions, diagnostics, MCP/agent setup, and the slim macOS companion.
+- Retired product surfaces: hosted auth, account/org/team admin, web dashboard, Hack Tickets, built-in GitHub workflows, and built-in Linear sync.
 - Remote/gateway/node/dispatch code may remain source-available, but it is unsupported experimental and must stay out of first-run docs, release gates, and default agent paths.
 
 ## Runtime Ownership
@@ -30,9 +30,3 @@ Durable architecture rules for current Hack work.
 - Use `onConflict: "adopt"` only when a complete existing listener set is equivalent and should be reused.
 - `singleton` adoption is listener-level reuse, not ownership transfer; Hack must leave adopted external processes running on `hack down`.
 - Stale mux state should be recovered through lifecycle metadata carefully enough to avoid orphaning Hack-owned processes while not broadening cleanup to unrelated process groups.
-
-## Tickets Ownership
-
-- Tickets are optional local helpers, not a headline hosted workflow.
-- Durable ticket state is the git-backed JSONL journal under `refs/hack/tickets` or the configured branch ref.
-- Local projection and checkout state under `.hack/tickets/` is rebuildable.

.factory/library/environment.md

@@ -22,7 +22,7 @@ Environment variables, external dependencies, and setup notes for current Hack w
 
 - Use `hackdance/hack:slim` for repo-local managed-agent containers when Docker Hub is available.
 - Inject `HACK_ENV_SECRET_KEY` from the runtime or secret manager; never bake `.hack.secret.key` into an image.
-- Slim/codex mode should use repo-local commands such as `hack env list`, `hack host exec`, `hack host shell`, and `hack tickets`.
+- Slim/codex mode should use repo-local commands such as `hack env list`, `hack host exec`, and `hack host shell`.
 - Machine-wide surfaces such as `hack global install`, Caddy/CoreDNS/Loki/Grafana, and local CA bootstrap are not expected in slim mode.
 
 ## Runtime and Lifecycle
@@ -35,4 +35,3 @@ Environment variables, external dependencies, and setup notes for current Hack w
 
 - For stale env compatibility output, use `hack doctor` and `hack env materialize`.
 - For stale lifecycle state, use `hack doctor`, then `hack down`, then rerun `hack doctor`.
-- For tickets remote auth failures, prefer explicit SSH guidance and bounded timeouts over interactive prompts.

.factory/library/user-testing.md

@@ -7,7 +7,7 @@ Testing surfaces, tools, and validation concurrency for current Hack work.
 ### CLI and runtime
 
 - Primary tools: `./dist/hack`, repo-local Bun commands, and global `hack` only for installed-runtime orchestration checks.
-- Use for: runtime lifecycle, env, tickets, sessions, doctor, daemon, project config, and agent setup.
+- Use for: runtime lifecycle, env, sessions, doctor, daemon, project config, and agent setup.
 - Prefer `--json` when validating machine-readable behavior.
 - If validating current-branch command behavior, build first and run `./dist/hack` or `bun index.ts` from the repo root.
 
@@ -32,7 +32,7 @@ Testing surfaces, tools, and validation concurrency for current Hack work.
 ### CLI validators
 
 - Max concurrent validators: `2`.
-- Rationale: project state, tickets state, runtime metadata, and branch/worktree artifacts can race.
+- Rationale: project state, runtime metadata, and branch/worktree artifacts can race.
 
 ### Runtime/lifecycle validators
 
@@ -48,5 +48,4 @@ Testing surfaces, tools, and validation concurrency for current Hack work.
 
 - Env changes: cover overlay order, worktree-local overrides, linked-worktree key lookup, host-vs-compose target mode, and materialization drift.
 - Lifecycle changes: cover shell semantics, process groups, stale metadata, singleton full/partial listener conflicts, and doctor recovery guidance.
-- Tickets changes: cover offline/stale-local fallback only for transient connectivity; hard remote misconfiguration should surface clearly.
 - Agent setup changes: update source renderers and checked-in generated examples, then run setup/MCP tests.

.factory/services.yaml

@@ -13,7 +13,6 @@ commands:
   lifecycle_tests: bun test tests/project-lifecycle-processes.test.ts tests/project-lifecycle-singleton.test.ts tests/project-lifecycle-hygiene.test.ts
   env_list_json: ./dist/hack env list --json
   env_tests: bun test tests/project-env-config.test.ts tests/env-command.test.ts tests/project-run-command.test.ts
-  tickets_tests: bun test tests/tickets-git-channel.test.ts tests/tickets-store.test.ts
   setup_docs_tests: bun test tests/setup.test.ts tests/mcp.test.ts
 
 services:

.factory/skills/control-plane-worker/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: control-plane-worker
-description: Implements local-first CLI, runtime, env, lifecycle, tickets, and macOS companion features for Hack.
+description: Implements local-first CLI, runtime, env, lifecycle, and macOS companion features for Hack.
 ---
 
 # Control Plane Worker
@@ -12,7 +12,7 @@ NOTE: Startup and cleanup are handled by `worker-base`. This skill defines the W
 Use this skill for features that primarily touch:
 - `src/**` CLI and control-plane code
 - `.hack/docker-compose.yml`, `.hack/hack.config.json`, or other source-of-truth Hack runtime files
-- local runtime orchestration, env/runtime hardening, lifecycle processes, tickets, sessions, MCP/agent setup, docs, or the slim macOS companion
+- local runtime orchestration, env/runtime hardening, lifecycle processes, sessions, MCP/agent setup, docs, or the slim macOS companion
 
 Do not use this skill for retired v3 surfaces:
 - hosted auth/account/org/team management
@@ -22,16 +22,15 @@ Do not use this skill for retired v3 surfaces:
 
 ## Required Skills
 
-- `hack-cli` — invoke when the feature touches `.hack/**`, runtime orchestration, lifecycle/session flows, tickets, env, or any `hack up/ps/open/down` verification.
+- `hack-cli` — invoke when the feature touches `.hack/**`, runtime orchestration, lifecycle/session flows, env, or any `hack up/ps/open/down` verification.
 
 ## Work Procedure
 
 1. Read the assigned feature, `mission.md`, mission `AGENTS.md`, `.factory/services.yaml`, and relevant `.factory/library/*.md` files. Restate the exact assertions or outcomes the feature must complete.
 2. Investigate existing code paths and add the failing test or regression harness first. Prefer the narrowest relevant suites under `tests/*.test.ts`. If the feature has no `fulfills` claims, still add characterization or regression coverage for the changed behavior.
-3. Implement the smallest coherent change set in CLI, runtime config, tickets, env, lifecycle, macOS, or agent setup. Never hand-edit `.hack/.internal/**` or `.hack/.branch/**`; only change source-of-truth files.
+3. Implement the smallest coherent change set in CLI, runtime config, env, lifecycle, macOS, or agent setup. Never hand-edit `.hack/.internal/**` or `.hack/.branch/**`; only change source-of-truth files.
 4. Run focused validators first, then the smallest meaningful `typecheck`/`check` commands for the touched surfaces. For repo-bound CLI behavior, build and validate with `./dist/hack` or repo-local Bun entrypoints. When invoking `bun test` from the repo root against files outside `./tests`, use absolute paths or explicit `./`-prefixed paths that Bun actually honors in this repo so targeted commands do not silently skip files.
    - If the assigned feature is explicitly about fixing a known red baseline, capture the failing baseline evidence once, then continue the repair work and rerun the gate before handoff.
-   - If repo-bound GitHub CLI routes cannot reach the changed auth code because `dance.hack.github` is not enabled in project config yet, use a direct resolver or similarly narrow deterministic smoke and record why the repo-bound path was unavailable.
    - If no safe repo-bound hook exists to force a failure mode (for example local-sync failure injection), deterministic regression tests are acceptable proof as long as you explain why a live manual repro would mutate real project state.
    - For daemon/gateway request-target hardening, raw-socket regression coverage against the proxy transport is preferred. If you also need live proof without mutating shared user daemon state, an isolated temp-HOME `bun index.ts daemon start --foreground` smoke is an acceptable validation pattern; record the isolation setup in the handoff.
    - For lifecycle changes, verify shell semantics, process-group cleanup, stale pane/process metadata reconciliation, singleton listener behavior, and doctor recovery guidance.

.github/workflows/ci.yml

@@ -52,7 +52,7 @@ jobs:
             --tag hack-runtime-ci:slim
       - name: Smoke slim runtime image defaults
         run: |
-          docker run --rm --entrypoint sh hack-runtime-ci:slim -lc 'command -v bun >/dev/null && command -v hack >/dev/null && test "${HACK_EXECUTION_MODE}" = "codex" && test "${HACK_DAEMON_DISABLE_DOCKER_EVENTS}" = "1" && test "${HACK_SETUP_SYNC_MODE}" = "warn" && hack --help >/tmp/hack-help.txt && grep -q "Usage:" /tmp/hack-help.txt'
+          docker run --rm --entrypoint sh hack-runtime-ci:slim -lc 'command -v bun >/dev/null && command -v hack >/dev/null && test "${HACK_EXECUTION_MODE}" = "codex" && test "${HACK_DAEMON_DISABLE_DOCKER_EVENTS}" = "1" && hack --help >/tmp/hack-help.txt && grep -q "Usage:" /tmp/hack-help.txt'
       - name: Smoke slim runtime mounted-project env flow
         run: bash scripts/portable-container-smoke.sh hack-runtime-ci:slim linux/amd64
 

.gitignore

@@ -73,7 +73,7 @@ apps/macos/.ghostty/
 zig-cache/
 zig-out/
 
-# hack tickets
+# Retired Hack Tickets cache retained for upgrade safety
 .hack/tickets/
 .hack/.internal/
 .hack/supervisor/

.hack/README.md

@@ -1,14 +1,3 @@
 # hack-cli
 
-This repo is dogfooding the tickets extension.
-
-- Enablement: `.hack/hack.config.json`
-- Usage:
-  - `hack x tickets setup`
-  - `hack x tickets create --title "..." --body-stdin`
-  - `hack x tickets list`
-  - `hack x tickets show T-AB12CD34EF`
-  - `hack x tickets status T-AB12CD34EF in_progress`
-  - `hack x tickets sync`
-
 No services are required for this repo; `docker-compose.yml` is intentionally empty.

.hack/hack.config.json

@@ -3,30 +3,8 @@
   "name": "hack-cli",
   "dev_host": "hack-cli.hack",
   "controlPlane": {
-    "extensions": {
-      "dance.hack.github": {
-        "enabled": false
-      },
-      "dance.hack.tickets": {
-        "enabled": false
-      },
-      "dance.hack.linear": {
-        "enabled": false
-      }
-    },
     "gateway": {
       "enabled": true
-    },
-    "routing": {
-      "overrides": {
-        "linear": {
-          "profile": "default",
-          "projectId": "7a3c8adf-ede5-4d3a-8779-9c32695c76bf",
-          "projectName": "Hack",
-          "teamId": "e0aedec9-5273-446f-b975-aa4cd1525900",
-          "additionalProjects": []
-        }
-      }
     }
   }
 }