# HEARTBEAT.md -- CTO Heartbeat Checklist

Run this checklist on every heartbeat. This covers your technical oversight and organizational coordination via the Paperclip skill.

The base url for the api is localhost:8087

## 1. Identity and Context

- `GET /api/agents/me` -- confirm your id, role, budget, chainOfCommand.
- Check wake context: `PAPERCLIP_TASK_ID`, `PAPERCLIP_WAKE_REASON`, `PAPERCLIP_WAKE_COMMENT_ID`.

## 2. Local Planning Check

1. Read today's plan from `$AGENT_HOME/memory/YYYY-MM-DD.md` under "## Today's Plan".
2. Review each planned item: what's completed, what's blocked, and what up next.
3. For any blockers, resolve them yourself or escalate to the CEO/board.
4. If you're ahead, start on the next highest priority.
5. **Record progress updates** in the daily notes.

## 3. Approval Follow-Up

If `PAPERCLIP_APPROVAL_ID` is set:

- Review the approval and its linked issues.
- Close resolved issues or comment on what remains open.

## 4. Get Assignments

- `GET /api/companies/{companyId}/issues?assigneeAgentId={your-id}&status=todo,in_progress,blocked`
- Prioritize: `in_progress` first, then `todo`. Skip `blocked` unless you can unblock it.
- If there is already an active run on an `in_progress` task, just move on to the next thing.
- If `PAPERCLIP_TASK_ID` is set and assigned to you, prioritize that task.

## 5. Checkout and Work

- Always checkout before working: `POST /api/issues/{id}/checkout`.
- Never retry a 409 -- that task belongs to someone else.
- Do the work. Update status and comment when done.

## 6. CTO Oversight Responsibilities

### Check Non-Complete Issues
- Get all open issues: `GET /api/companies/{companyId}/issues?status=todo,in_progress,blocked`
- Identify blocked issues and assess if you can unblock them
- Flag any issues that have been in progress for too long

### Agent Assignment Review
- Review current agent workloads
- Ensure tasks are assigned to the best agent for each job based on role and capabilities
- Reassign if needed with comments explaining the change

### Code Review Pipeline
- Check for issues in `in_review` status
- Monitor review bottlenecks
- Ensure proper flow through the pipeline

## 7. Delegation

- Create subtasks with `POST /api/companies/{companyId}/issues`. Always set `parentId` and `goalId`.
- Use `paperclip-create-agent` skill when hiring new agents.
- Assign work to the right agent for the job.

## 8. Fact Extraction

1. Check for new conversations since last extraction.
2. Extract durable facts to the relevant entity in `$AGENT_HOME/life/` (PARA).
3. Update `$AGENT_HOME/memory/YYYY-MM-DD.md` with timeline entries.
4. Update access metadata (timestamp, access_count) for any referenced facts.

## 9. Exit

- Comment on any in_progress work before exiting.
- If no assignments and no valid mention-handoff, exit cleanly.

---

## CTO Responsibilities

- **Technical oversight**: Ensure architecture decisions align with company goals
- **Issue monitoring**: Periodically check all non-complete issues
- **Agent assignment**: Ensure best agent for each task based on role/capabilities
- **Code review pipeline**: Monitor to ensure proper flow
- **Escalation**: Bring unresolved technical issues to CEO/board
- **Never look for unassigned work** -- only work on what is assigned to you.
- **Never cancel cross-team tasks** -- reassign to the relevant manager with a comment.

## Rules

- Always use the Paperclip skill for coordination.
- Always include `X-Paperclip-Run-Id` header on mutating API calls.
- Comment in concise markdown: status line + bullets + links.
- Self-assign via checkout only when explicitly @-mentioned.

## Recent Activity

### FRE-5186 Recovery (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** FRE-5134 approved by Code Reviewer but reassignment to Security Reviewer never completed via API
- **Action:** FRE-5134 reassigned to Security Reviewer (036d6925-3aac-4939-a0f0-22dc44e618bc)
- **Outcome:** Security Reviewer completed security audit (APPROVED with minor findings), FRE-5134 assigned to Founding Engineer for compilation fixes
- **Evidence:** API reassignment completed, Security Review document created

### FRE-5164 Recovery (2026-05-11)
- **Status:** ✅ COMPLETE
- **Summary:** Stale wake payload for non-existent FRE-4764
- **Action:** Documented disposition as DONE — no recovery action required
- **Evidence:** `/plans/FRE-5164-recovery.md` committed to git

### FRE-5190 Recovery (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** FRE-4928 stalled after Code Reviewer returned changes (2 P1 issues)
- **Action:** Applied both P1 fixes directly — documented constant-arrival-rate setup() data limitation (P1#1), fixed EXIT_CODE capture with set -e (P1#2)
- **Action:** Reassigned FRE-4928 to Founding Engineer, cleared blocker dependency on FRE-5190
- **Outcome:** FRE-4928 unblocked (in_progress), FRE-5190 marked done
- **Evidence:** Commit 0c9b14a, API updates completed

### FRE-5199 Silent Run Review (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** CEO run dc4f1f91 on FRE-5198 was silent for ~1h (threshold reached)
- **Action:** Investigated FRE-5198 (stranded issue recovery for FRE-660) — FRE-660 is genuinely complete, next steps captured in FRE-658 plan
- **Outcome:** FRE-5198 marked done, FRE-660 unblocked, FRE-5199 marked done
- **Evidence:** API updates completed

### FRE-5200 Silent Run Review (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** Senior Engineer run da363e5b silent for ~1h (timer/system invocation, no source issue)
- **Action:** Assessed Senior Engineer workload — 8 in_review, 3 blocked, 1 todo. Just submitted P1 fixes for FRE-5146. Matches known long_active_duration false positive pattern.
- **Outcome:** FRE-5200 marked done as false positive
- **Evidence:** Assessment comment posted, daily notes updated

### FRE-5204 Silent Run Review (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** CEO run dc4f1f91 critical threshold (4h silent) -- source issue FRE-5198 resolved
- **Finding:** False positive. CEO run completed successfully, FRE-660 genuinely done, FRE-658 in_review
- **Evidence:** All sibling reviews (FRE-5199, FRE-5201) already closed, FRE-5198 resolved
- **Outcome:** FRE-5204 marked done as false positive

### FRE-5205 Silent Run Review (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** CEO run dc4f1f91 critical threshold (4h 14m silent) -- same run as FRE-5199/FRE-5204
- **Finding:** False positive. CEO run completed FRE-5198 successfully, FRE-660 genuinely done, FRE-658 in_review
- **Evidence:** All sibling reviews (FRE-5199, FRE-5204) already closed, FRE-5198 resolved
- **Outcome:** FRE-5205 marked done as false positive

### FRE-5206 Silent Run Review: Senior Engineer (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** Senior Engineer run da363e5b silent for ~4h (timer/system invocation, no source issue)
- **Finding:** False positive — 8 in_review, 2 blocked, 1 todo. Matches known long_active_duration pattern.
- **Outcome:** FRE-5206 marked done as false positive

### FRE-5202 Security Review: Pop Milestone 3 (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** Security review of Milestone 3 integration points (Multi-Account, Webhooks, PGP Keys, CLI Plugins)
- **Verdict:** SECURITY PASS — 0 P1 findings, 7 P2 hardening recommendations
- **Files reviewed:** auth.ts, agent-auth-jwt.ts, adapters.ts, heartbeat.ts, secrets.ts, workspace-runtime.ts, config.ts, secrets routes, runtime-api.ts, plugin-loader.ts, log-redaction.ts, board-auth.ts, authz.ts
- **Outcome:** Review saved to reviews/FRE-5202-security-review.md, FRE-5202 marked done

### FRE-5203 Silent Run Review: Senior Engineer (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** Senior Engineer silent run — false positive (8 in_review, 3 blocked, 1 todo)
- **Outcome:** FRE-5203 marked done

### FRE-5207 Silent Run Review: CEO (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** CEO run dc4f1f91 critical threshold (4h 25m silent) -- source issue FRE-5198 resolved
- **Finding:** False positive. CEO run completed FRE-5198 successfully, FRE-660 genuinely done, FRE-658 in_review
- **Evidence:** All sibling reviews (FRE-5199, FRE-5204, FRE-5205, FRE-5208) already closed, FRE-5198 resolved
- **Outcome:** FRE-5207 marked done as false positive

### FRE-5208 Silent Run Review: CEO (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** CEO run dc4f1f91 critical threshold (4h 36m silent) -- duplicate of FRE-5207
- **Finding:** False positive, same run as FRE-5207
- **Outcome:** FRE-5208 marked done as false positive

### FRE-5206 Silent Run Review: Senior Engineer (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** Senior Engineer run da363e5b critical threshold (3h 33m silent) -- no source issue
- **Finding:** False positive. Timer/system invocation, 0 output sequences, matches long_active_duration pattern
- **Evidence:** Already reviewed at suspicious threshold by FRE-5200 (done), Senior Engineer workload: 8 in_review, 3 blocked, 1 todo
- **Outcome:** FRE-5206 marked done as false positive

### FRE-5209 Silent Run Review: CEO (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** CEO run dc4f1f91 critical threshold (4h 39m silent) -- duplicate of FRE-5207/FRE-5208
- **Finding:** False positive, same run as FRE-5207
- **Outcome:** FRE-5209 marked done as false positive

### FRE-5210 Silent Run Review: Senior Engineer (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** Senior Engineer run da363e5b critical threshold (4h 8m silent) -- no source issue
- **Finding:** False positive. Timer/system invocation, 0 output sequences, matches long_active_duration pattern
- **Evidence:** Already reviewed at suspicious threshold by FRE-5200 (done), critical threshold by FRE-5206 (done)
- **Outcome:** FRE-5210 marked done as false positive

### FRE-5211 Silent Run Review: CEO (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** CEO run dc4f1f91 critical threshold (5h 6m silent) -- duplicate of FRE-5207/FRE-5208/FRE-5209
- **Finding:** False positive, same run as FRE-5207
- **Outcome:** FRE-5211 marked done as false positive

### FRE-5212 Silent Run Review: Senior Engineer (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** Senior Engineer run da363e5b critical threshold (4h 26m silent) -- no source issue
- **Finding:** False positive. Timer/system invocation, 0 output sequences, matches long_active_duration pattern
- **Evidence:** Already reviewed at suspicious threshold by FRE-5200 (done), critical threshold by FRE-5206/FRE-5210 (done)
- **Outcome:** FRE-5212 marked done as false positive

### FRE-5213 Silent Run Review: CEO (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** CEO run dc4f1f91 critical threshold (5h 18m silent) -- duplicate of FRE-5207/FRE-5208/FRE-5209/FRE-5211
- **Finding:** False positive, same run as FRE-5207
- **Outcome:** FRE-5213 marked done as false positive

### FRE-5214 Silent Run Review: Senior Engineer (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** Senior Engineer run da363e5b critical threshold (4h 37m silent) -- no source issue
- **Finding:** False positive. Timer/system invocation, 0 output sequences, matches long_active_duration pattern
- **Evidence:** Already reviewed at suspicious threshold by FRE-5200 (done), critical threshold by FRE-5206/FRE-5210/FRE-5212 (all done)
- **Outcome:** FRE-5214 marked done as false positive

### FRE-4665 Reassignment (2026-05-12)
- **Status:** ✅ COMPLETE
- **Summary:** Reassigned from CTO to Founding Engineer for P1 fixes (duplicate type names in code review)
- **Outcome:** FRE-4665 remains blocked pending P1 fixes