Start Here — Execution Layer (canonical handoff)

Last updated: 2026-05-19 (session 36). System tag: ZW-ENGINE-V9.
Original spec: START_HERE_EXECUTION_LAYER_CLAUDE_CODE_MASTER.md (workspace root).
Single ongoing handoff doc — do not create parallel ones (spec §17).

What Start Here is

An execution spine on the Personal Command Inbox sheet
(1U0-Ll_WDDiYPuzXRnkISGfUTWxOpWQgz3gprQvAcXNU). Captures become live action cards with a
forced next action and an immutable proof log:
Signal → State → One Next Action → Proof → Logged Closure.
It upgrades the Command Inbox — no web app, no rebuild (spec Anti-80%).

Status — 2026-05-19

clasp push updated the editor code only. The deployed Web App still serves the old
version (old code, old secret) until Sam deploys a new version — so the live webhook is not
broken in the meantime.

Architecture

• Code.js — doPost validates the token (INBOX_SECRET Script Property), always
  captures the raw message to INBOX, then calls routeCommand_ for state-changing commands.
  No secrets or IDs in the file.
• start-here.gs — the action engine: Action_Queue + Action_Events tabs, createAction_,
  updateActionStatus_, deferAction_, delegateAction_ (blocks Mildred on sensitive cards),
  addProof_, appendEvent_, routeCommand_, 5 seed cards, test functions.
• Script Properties (Apps Script → Project Settings): INBOX_SECRET (Sam-set, never in
  git), INBOX_SHEET_ID (set by initStartHere_Properties()).

Action_Queue cols: Action_ID, Title, Lane, Source, Owner, Assigned_To, Status, Priority, Due_Date, Next_Action, Proof_Required, Proof_Link, Visibility, Sensitive_Flag, Mildred_Allowed, Related_URL, Created_At, Updated_At, Completed_At, Last_Event_Note.
Action_Events cols: Event_ID, Action_ID, Actor, Event_Type, Old_Status, New_Status, Note, Payload_JSON, Timestamp. Action_ID = A-YYYYMMDD-###.

Deploy — Sam's checklist (~15 min, Apps Script editor)

The code is already pushed. Remaining steps are all in the Apps Script UI:

1. Open the project: Apps Script editor for the Personal Command Inbox script
   (1GIAKknTtdvqMH2EfPH5cYEsMyqpcnrzXcuDJWFsEtzyiadlqj-Wf5945).
2. Set the secret: Project Settings → Script Properties → Add property:
   - INBOX_SECRET = a brand-new random token you generate (e.g. a 40+ char random string).
   Do not reuse the old one — it was exposed. Do not paste it into chat or git.
3. Set the sheet ID: in the editor, run initStartHere_Properties() once (sets
   INBOX_SHEET_ID).
4. Build the tabs: run setupStartHere() → creates Action_Queue + Action_Events.
5. Verify: run runStartHereTests() → open the log → all five should show pass:true.
6. Seed: run seedStartHereCards() → 5 acceptance cards land in Action_Queue
   (Shellpoint is card #1).
7. Update the iOS Shortcut: change its token field to the new INBOX_SECRET.
8. Cut over: Manage Deployments → edit the active deployment → New version → Deploy.
   Never clasp redeploy a Web App (feedback_clasp_redeploy_breaks_webapp.md).
9. Test: fire the Shortcut with ACTION test card from phone — confirm a row in INBOX
   and a row in Action_Queue.

Acceptance test (spec §9)

After step 6: 5 cards in Action_Queue; runStartHereTests() passes (create / proof /
done-blocked-then-allowed / defer / Mildred-delegation-blocked); Action_Events has immutable
rows; INBOX still captures. After step 9: one action created from the iOS Shortcut.

Part E — Mildred briefing automation (designed, not built)

Add mildredWeeklyBriefingEmail_() to the BOS v1 script (1_cgriwCQ...) reusing
buildMildredStart_ (Code.js:2689) + createWeeklyTrigger_ (Code.js:1393); render the
2026-05-19 Mildred HTML; create a Gmail draft (v1 = draft, not auto-send); Friday trigger.
Deploy gate: no new email automation until the trigger registry is audited duplicate-free
(feedback_capture_is_not_closure.md). Build alongside a future BOS session.

Handoff by Claude Code · 2026-05-19 session 36.