fix(profile): detect stale publish watcher

Author: Necmttn

apps/axctl/src/cli/install.test.ts

@@ -6,6 +6,7 @@ import {
     parseDaemonCommand,
     resolveDaemonHostPort,
     staleRunningIngestRuns,
+    watcherProfilePublishDoctorCheck,
     type DaemonStatus,
     type DoctorReport,
 } from "./install.ts";
@@ -143,6 +144,30 @@ describe("cli install operations", () => {
             ok: true,
         });
     });
+
+    test("doctor flags watcher profile publish freshness drift", () => {
+        const check = watcherProfilePublishDoctorCheck(
+            "<string>/bin/ax profile publish --if-stale=6 >>watcher.log 2&gt;&amp;1 || true</string>",
+        );
+
+        expect(check).toEqual({
+            name: "watcher-profile-publish",
+            ok: false,
+            detail: "profile publish uses --if-stale=6; expected --if-stale=2; run 'axctl install' to refresh the watcher plist",
+        });
+    });
+
+    test("doctor accepts the current watcher profile publish freshness gate", () => {
+        const check = watcherProfilePublishDoctorCheck(
+            "<string>/bin/ax profile publish --if-stale=2 >>watcher.log 2&gt;&amp;1 || true</string>",
+        );
+
+        expect(check).toEqual({
+            name: "watcher-profile-publish",
+            ok: true,
+            detail: "profile publish freshness gate: 2h",
+        });
+    });
 });
 
 describe("doctor stale ingest_run detection", () => {

apps/axctl/src/cli/install.ts

@@ -60,6 +60,7 @@ const DB_LABEL = "com.necmttn.ax-db";
 const WATCH_LABEL = "com.necmttn.ax-watch";
 const DERIVE_LABEL = "com.necmttn.ax-derive-daily";
 const QUOTA_REFRESH_LABEL = "com.necmttn.ax-quota-refresh";
+export const PROFILE_PUBLISH_IF_STALE_HOURS = 2;
 const DB_PLIST = posixPath.join(LAUNCH_AGENTS_DIR, `${DB_LABEL}.plist`);
 const WATCH_PLIST = posixPath.join(LAUNCH_AGENTS_DIR, `${WATCH_LABEL}.plist`);
 const DERIVE_PLIST = posixPath.join(LAUNCH_AGENTS_DIR, `${DERIVE_LABEL}.plist`);
@@ -176,7 +177,7 @@ const watchPlist = (binPath: string): string => `<?xml version="1.0" encoding="U
   <array>
     <string>/bin/bash</string>
     <string>-lc</string>
-    <string>${binPath} ingest --since=1 >>${LOG_DIR}/watcher.log 2>&amp;1 &amp;&amp; ${binPath} derive-signals --since=1 >>${LOG_DIR}/watcher.log 2>&amp;1; ${binPath} profile publish --if-stale=2 >>${LOG_DIR}/watcher.log 2>&amp;1 || true</string>
+    <string>${binPath} ingest --since=1 >>${LOG_DIR}/watcher.log 2>&amp;1 &amp;&amp; ${binPath} derive-signals --since=1 >>${LOG_DIR}/watcher.log 2>&amp;1; ${binPath} profile publish --if-stale=${PROFILE_PUBLISH_IF_STALE_HOURS} >>${LOG_DIR}/watcher.log 2>&amp;1 || true</string>
   </array>
   <key>WatchPaths</key>
   <array>
@@ -200,6 +201,33 @@ const watchPlist = (binPath: string): string => `<?xml version="1.0" encoding="U
 </plist>
 `;
 
+export function watcherProfilePublishDoctorCheck(plistText: string): DoctorCheck {
+    const expected = PROFILE_PUBLISH_IF_STALE_HOURS;
+    const match = /profile publish --if-stale=(\d+)/.exec(plistText);
+    if (!match) {
+        return {
+            name: "watcher-profile-publish",
+            ok: false,
+            detail: `watcher plist is missing profile publish --if-stale=${expected}; run 'axctl install' to refresh the watcher plist`,
+        };
+    }
+
+    const actual = Number.parseInt(match[1] ?? "", 10);
+    if (actual === expected) {
+        return {
+            name: "watcher-profile-publish",
+            ok: true,
+            detail: `profile publish freshness gate: ${expected}h`,
+        };
+    }
+
+    return {
+        name: "watcher-profile-publish",
+        ok: false,
+        detail: `profile publish uses --if-stale=${actual}; expected --if-stale=${expected}; run 'axctl install' to refresh the watcher plist`,
+    };
+}
+
 // Daily full ETL: runs once a day at 04:00 local time. Full ingest (no
 // --since) repulls every transcript file mtime cutoff = 0, then derives all
 // signals. Idempotent thanks to UPSERTs; safe to overlap with the watcher.
@@ -895,6 +923,9 @@ export function collectDoctorReport(): Effect.Effect<
         const runtimeStateExists = yield* fs
             .exists(daemon.endpoint.runtimeStatePath)
             .pipe(orAbsent(false));
+        const watcherPlistText = yield* fs
+            .readFileString(WATCH_PLIST)
+            .pipe(orAbsent<string | null>(null));
         const dbReachable = daemon.dbListening && daemon.endpoint.conflict === null;
         const missingBuckets = dbReachable
             ? yield* Effect.promise(() => probeMissingBuckets(daemon.endpoint))
@@ -953,6 +984,9 @@ export function collectDoctorReport(): Effect.Effect<
                 detail: `${agent.loaded ? "loaded" : "not loaded"}; plist=${agent.plistExists ? "present" : "absent"}`,
             })),
         ];
+        if (watcherPlistText !== null) {
+            checks.push(watcherProfilePublishDoctorCheck(watcherPlistText));
+        }
         if (missingBuckets !== null) {
             checks.push({
                 name: "db-buckets",

docs/superpowers/plans/2026-06-12-profile-publish.md

@@ -4,7 +4,7 @@
 
 **Goal:** `ax profile publish` pushes the ProfileV1 artifact to a user-owned public gist (create once, PATCH in place), registers the user via fork + PR into `Necmttn/ax` (`community/users/<login>.json`), and the watcher keeps the gist fresh; `ax profile unpublish` reverses it.
 
-**Architecture:** A `GitHubEnv` Effect service (mirrors hooks-sdk `GitEnv`: Context.Service + Live/Test layers) wraps every `gh api` call so all publish logic is layer-testable without network. Local consent + gist state lives in `~/.ax/profile-publish.json` (atomic-write). The publish pipeline: render (Plan 1 `buildProfile`) → first-run consent (print exact JSON, y/N) → gist create/patch → one-time registration (fork → remote commit via git-data API, no local clone → PR). Watcher plist gains a debounced `profile publish --if-stale=6h` step that silently no-ops until the user has consented once.
+**Architecture:** A `GitHubEnv` Effect service (mirrors hooks-sdk `GitEnv`: Context.Service + Live/Test layers) wraps every `gh api` call so all publish logic is layer-testable without network. Local consent + gist state lives in `~/.ax/profile-publish.json` (atomic-write). The publish pipeline: render (Plan 1 `buildProfile`) → first-run consent (print exact JSON, y/N) → gist create/patch → one-time registration (fork → remote commit via git-data API, no local clone → PR). Watcher plist gains a debounced `profile publish --if-stale=2h` step that silently no-ops until the user has consented once.
 
 **Tech Stack:** bun, effect@beta v4, `gh` CLI (auth + API transport), `@ax/lib/atomic-write`, bun:test with layer mocks.
 
@@ -810,7 +810,7 @@ Expected: all pass (no new RUNTIME entries needed - `profile` family already reg
 - [ ] **Step 3: Live smoke (careful - real GitHub)**
 
 ```bash
-bun apps/axctl/src/cli/index.ts profile publish --if-stale=6   # no state -> silent no-op, exit 0
+bun apps/axctl/src/cli/index.ts profile publish --if-stale=2   # no state -> silent no-op, exit 0
 bun apps/axctl/src/cli/index.ts profile unpublish              # "not published" message
 ```
 Do NOT run a real first publish in CI/implementation - that creates a real gist + PR. The consent prompt path is verified by the y/N abort: run `echo n | bun apps/axctl/src/cli/index.ts profile publish` and expect "Aborted".
@@ -840,7 +840,7 @@ cd __AX_DIR__ && bun src/cli/index.ts ingest --since=1 >>__LOG_DIR__/watcher.log
 to:
 
 ```
-cd __AX_DIR__ && bun src/cli/index.ts ingest --since=1 >>__LOG_DIR__/watcher.log 2>&1; bun src/cli/index.ts profile publish --if-stale=6 >>__LOG_DIR__/watcher.log 2>&1 || true
+cd __AX_DIR__ && bun src/cli/index.ts ingest --since=1 >>__LOG_DIR__/watcher.log 2>&1; bun src/cli/index.ts profile publish --if-stale=2 >>__LOG_DIR__/watcher.log 2>&1 || true
 ```
 
 (`;` not `&&` - a failed ingest must not block the freshness check; `|| true` keeps launchd happy. The publish step is a silent no-op until the user has consented once - no state file, no publish, no prompt.)
@@ -856,7 +856,7 @@ Expected: `OK`.
 
 ```bash
 git add scripts/com.necmttn.ax-watch.plist
-git commit -m "feat(watcher): keep published profile fresh (publish --if-stale=6)"
+git commit -m "feat(watcher): keep published profile fresh (publish --if-stale=2)"
 ```
 
 ---
@@ -885,7 +885,7 @@ profile (ProfileV1: stats + rig + taste patterns) from the graph.
 publish to a public gist (create once, PATCH in place). First run: consent
 prompt showing the exact JSON, then fork + community/users/<login>.json
 registration PR into Necmttn/ax (git-data API, no local clone). Watcher runs
-`--if-stale=6` after ingest - silent no-op until first consent.
+`--if-stale=2` after ingest - silent no-op until first consent.
 `ax profile unpublish` - delete gist + local state.
 State: `~/.ax/profile-publish.json`. Spec:
 docs/superpowers/specs/2026-06-12-ax-profiles-design.md.

docs/superpowers/specs/2026-06-12-ax-profiles-design.md

@@ -175,7 +175,7 @@ Identity proof: CI requires PR author == `github` field == filename.
     create gist; `gh repo fork Necmttn/ax`; commit
     `community/users/<login>.json` via GitHub API (blob/tree/commit - no
     local clone, zero disk); open registration PR.
-  - Subsequent runs: PATCH gist in place. `--if-stale=6h` reads remote
+  - Subsequent runs: PATCH gist in place. `--if-stale=2h` reads remote
     `generated_at` and no-ops when fresh (cheap; used by automation).
 - `ax profile show [--json]` - local preview, no publish.
 - `ax profile unpublish` - delete gist; open PR removing registration file.
@@ -265,7 +265,7 @@ non-goal.
 ## 5. Automation
 
 - **Client:** watcher (`com.necmttn.ax-watch`) post-ingest hook runs
-  `ax profile publish --if-stale=6h` after a successful ingest - profile
+  `ax profile publish --if-stale=2h` after a successful ingest - profile
   refreshes whenever the user codes. Debounce lives inside the command.
 - **Fallback:** `ax install` registers a daily LaunchAgent timer for machines
   where the watcher misses. Publish remains explicit opt-in (interactive

scripts/com.necmttn.ax-watch.plist

@@ -8,7 +8,7 @@
   <array>
     <string>/bin/bash</string>
     <string>-lc</string>
-    <string>cd __AX_DIR__ &amp;&amp; bun src/cli/index.ts ingest --since=1 &gt;&gt;__LOG_DIR__/watcher.log 2&gt;&amp;1; bun src/cli/index.ts profile publish --if-stale=6 &gt;&gt;__LOG_DIR__/watcher.log 2&gt;&amp;1 || true</string>
+    <string>cd __AX_DIR__ &amp;&amp; bun src/cli/index.ts ingest --since=1 &gt;&gt;__LOG_DIR__/watcher.log 2&gt;&amp;1; bun src/cli/index.ts profile publish --if-stale=2 &gt;&gt;__LOG_DIR__/watcher.log 2&gt;&amp;1 || true</string>
   </array>
   <key>WatchPaths</key>
   <array>