HappyPet — Session Handoff (2026-07-23, GO-LIVE: cron enabled, autonomous publishing active)

Ground truth: main @ 119b6ac, clean working tree except two long-standing untracked files (CLAUDE.md, GENERATION_RESULT.json) — leave them, pre-existing. Tests: ./.venv/Scripts/python.exe -m pytest test_pipeline.py test_stage1_cli.py -q → 200 passed. This session: PR #82 (category-drift fix, live+verified), PR #83 (AUTO_MERGE=on routine path), PR #84 (publish auto-fires on Stage-1 draft merge — no actions:write), the routine ran the first fully-autonomous E2E (PR #85, best-automatic-litter-box written→reviewed→auto-merged→published→pinned unattended), PR #86 (fixed blank pin photos — the cloud container can’t fetch Amazon images, so pins now regenerate on the GHA runner), and a manual pin re-fire with a cache-bust (-v2.jpg) to get the corrected photo past Pinterest’s cache. THE DIRECTOR THEN ENABLED THE SCHEDULED ROUTINE: trig_01MeaAqB7AJsQTCsmBxYNWcM is now enabled: true, cron 0 12 * * 1,4 (Mon+Thu 12:00 UTC = 7am EST/8am EDT), AUTO_MERGE=on. Go-live is no longer held — the pipeline publishes autonomously on schedule. Prior handoff archived as HANDOFF-archive-2026-07-22-1512.md. Cross-session decision log: ~/.claude/projects/C--Users-derek-MAEVE-HappyPet/memory/happypet-autonomy-plan.md.

1. Mission

HappyPet is an affiliate pet-review blog (happypetproductreviews.com): a Jekyll site with a generate → publish → deploy → pin pipeline. Stage 1 (article generation) was replaced with an internal Claude routine that writes/reviews/rewrites on the Claude subscription (no OpenRouter, no API key), opens a PR, and hands off to the downstream stages. Goal: hands-off autonomy. On 2026-07-22 the first article went fully live end-to-end through the pipeline — the project has now published for real.

2. Current State

NEWEST (2026-07-22b):

• Category-drift defect FIXED + LIVE (PR #82). The dog-gear/cat-gear catch-all matched no homepage topic-pill, so 11 published posts were invisible under every category button. Re-categorized all 11 to topical slugs + jekyll-redirect-from for the old /*-gear/<slug>/ URLs (verified live: old URLs 302 to new, new URLs 200 — no fired pin 404s); backfilled products.json (19 gear entries; best-dog-pools left gear, no fitting pill); widened VALID_CATEGORIES; enabled jekyll-redirect-from. Guarded forever: test_pipeline.py (run by test.yml on every PR to main) fails if any published post OR any queued product (bar best-dog-pools) lands in a non-pill category — so drift can’t be merged, and the auto-merge path hard-waits for green CI.
• AUTO_MERGE=on routine path BUILT + wired (PRs #83, #84). SKILL.md Phase-2 steps 8–11: wait CI green → gh pr merge --merge → publish auto-fires on the merge → verify live. PR #84 added a push trigger on _posts/DRAFT-*.md to publish.yml: merging the Stage-1 PR (via the GitHub App, not GITHUB_TOKEN) auto-fires publishing, so no App actions: write is needed — the explicit gh workflow run publish.yml is now just an ignorable fallback. Routine trig_01MeaAqB7AJsQTCsmBxYNWcM prompt set to AUTO_MERGE=on (still enabled: false).
• FIRST AUTONOMOUS E2E RAN — SUCCESS (PR #85). The Director manually ran the routine; it wrote best-automatic-litter-box, reviewed (Sonnet), passed the gate, opened the PR, waited for CI, self-merged, publish auto-fired on the merge, deployed, and pinned — fully unattended, live at /cat-litter/best-automatic-litter-box/ (HTTP 200). The whole write→review→gate→merge→publish→deploy→pin chain works end-to-end.
• Blank pin photos FIXED (PR #86) for FUTURE articles. Root cause: the routine generates the pin in the Claude cloud container, which can’t reach Amazon’s image hosts, so fetch_image() returned None and the pin rendered photo-less (check_image_has_content’s byte check missed it — 151KB of blank frame still passes). Fix: publish.yml now regenerates pins on the GHA runner (reaches images-na) via generate_pin_images.py --slug; make_pin_for_post(strict=True) raises if the photo still can’t be fetched, so a blank pin never deploys/pins again.
• This article’s pin required a SECOND fix (manual, done): re-firing with the corrected asset at the SAME URL still posted blank, because Pinterest caches by URL and doesn’t re-fetch — confirmed by the Director spotting it live. Fixed by copying the corrected image to best-automatic-litter-box-v2.jpg (a URL Pinterest had never seen), pointing the pin JSON at it, deploying, and re-firing (gh workflow run pin.yml --field slugs=best-automatic-litter-box --field force=true) — that fire succeeded against the fresh URL. See Gotchas §5 for the reusable rule. The Director is manually deleting the stray blank pins from BOTH the original run and the first (pre-cache-bust) re-fire attempt.
• GO-LIVE: the Director enabled the scheduled routine. trig_01MeaAqB7AJsQTCsmBxYNWcM: enabled: true, cron 0 12 * * 1,4 (Mon+Thu 12:00 UTC), AUTO_MERGE=on. This is no longer HELD — it now autonomously writes, reviews, merges, publishes, and pins on schedule with zero human step. Because today (2026-07-23) is a Thursday, the very next scheduled fire is later TODAY (~12:00 UTC) — a second article may appear same-day as the first manual E2E. Confirm the pin photo comes through correct on that run (should, since PR #86 is on main) — if a cloud-generated pin is EVER blank again despite PR #86, that’s a regression, not the known cache-fetch limitation.

LIVE (prior headline): best-dog-cooling-mat is published and fully distributed — the first article through the internal-Claude Stage-1 → publish → deploy → pin pipeline, on the Director’s explicit “go”. (Its URL moved to /dog-beds/best-dog-cooling-mat/ in PR #82, with a redirect from the old /dog-gear/ path.)

• Article: https://happypetproductreviews.com/dog-gear/best-dog-cooling-mat/ (HTTP 200).
• Pinterest pins fired (IFTTT happypet_pin_dogs + happypet_pin_home); Google Sheets audit + Facebook queue appended; _pin_queue/.pending-slugs consumed. .fired sentinels committed on main so it will not re-pin.

Merged this session (all on main): PR #76 internal Stage-1 routine (Phase 1); #77 the cooling-mat article (published live); #78 pin-image fix; #79 IFTTT secrets env-fallback; #80 Sheets/FB-queue secrets env-fallback; #81 pipeline hardening (publish→deploy dispatch, pin.yml --autostash, varied FB message).

The pipeline now runs publish → deploy → pin with no manual nudges — the three go-live workarounds I did by hand are all fixed in code (see §3). Verified reasoning + YAML lint + unit tests; the two workflow fixes get their first real-world exercise on the next publish run (can’t smoke-test without publishing another article).

The scheduled Stage-1 cloud routine: trig_01MeaAqB7AJsQTCsmBxYNWcM (“HappyPet Stage 1”), cron 15 8 * * 1,4 (Mon+Thu 08:15 UTC), env env_01FAP6A4RtRLLr1mRAD9FTL4 (Derek Claude cloud, subscription-backed), model claude-opus-4-8 + Task tool (Sonnet reviewer), PR-only mode. Its current enabled state is UNCONFIRMED. If enabled, the next Thu run opens a new stage1/<slug> PR for the following topic. Dashboard: https://claude.ai/code/routines/trig_01MeaAqB7AJsQTCsmBxYNWcM

Not done — Phase 2 (full autonomy), all Director-gated: (a) have the routine/SKILL dispatch publish.yml after its PR merges so a run goes article→live unattended; (b) flip the auto_merge toggle on (green Stage-1 PRs self-merge instead of PR-only); (c) enable the schedule / retire generate.yml (deprecated OpenRouter Stage 1, cron HELD).

Exact next action for a fresh session: none is blocked — it’s a Director decision between two paths: (1) wire Phase 2 now, or (2) let the next scheduled Stage-1 run open a PR and shepherd one more article through the now-hardened pipeline under supervision before going autonomous. Also worth doing early: confirm the routine’s enabled state so you know whether a PR will appear Thursday.

3. Decisions Made (and Why)

Prior-session decisions that still stand:

• Internal Claude routine replaces OpenRouter Stage 1 (Opus writes / Sonnet reviews / Opus rewrites). Reason: Director wants “simpler and internal”; removes the reviewer-hallucination and rule-unaware-fact-check failure modes. Reversibility: medium (Stage 2/3 + plumbing untouched).
• Routine drives deterministic plumbing (stage1_cli.py) for topic-selection/prompt-building/gate/staging; Claude never hand-formats front-matter/pin-JSON. Reversibility: n/a (additive).
• authoritative_gate computes pass from reviewer scores + hard-checks, ignoring the reviewer’s pass boolean; fabrication check narrowed to explicit verbs; reviewer told which figures are verified. Reason: the old gate held clean articles on hallucinated vetoes. Reversibility: easy, but don’t — it’s the fix.
• Enforced bar stays 3; loop targets 4. Reason: reverting straight to 4 reintroduces the permanent-hold failure PR #69 removed. Data: cloud #77 scored 4/4/4/5, supervised 4/4/4/4. Reversibility: config; Director’s call (still open, §7).

New decisions this session:

• Decision: Published best-dog-cooling-mat live (merged #77, ran publish.yml, dispatched deploy.yml, ran pin.yml). Reason: Director’s explicit “go for goal on publishing.” Reversibility: low — a live post + real Pinterest pins; deleting the post is possible, un-pinning is not clean.
• Decision: Pin image sources from the curated product["image"] (/images/I/…), deriving from the ASIN /images/P/ scheme only as a fallback. Alternatives: keep ASIN-primary; ship the vault to CI. Reason: /images/P/{ASIN} returns a 43-byte placeholder for modern B0G… ASINs → text-only pins. Reversibility: easy; don’t.
• Decision: Secret loading in post_pins.py + push_pins_to_sheets.py resolves vault first, then env at call time (mirrors chewy_lookup.py); left brain_secrets.py’s “None on CI by design” contract untouched. Alternatives: make brain_secrets itself fall back to env (changes its documented contract + a test); ship COGNITIVE_DB_KEY + the encrypted brain to CI (worse security). Reason: the old except ImportError fallback was dead because brain_secrets imports cleanly on a runner. Reversibility: easy.
• Decision: publish.yml explicitly dispatches deploy.yml after pushing the dated post (added actions: write). Reason: GITHUB_TOKEN pushes do not trigger workflows, so the push-filter auto-deploy never fired. Reversibility: easy. (Supersedes the older assumption that Stage 2’s commit auto-fires deploy.)
• Decision: pin.yml consume step uses git pull --rebase --autostash. Reason: the Sheets step leaves the tree dirty; rebase-before-staging failed (exit 128). Reversibility: trivial.
• Decision: FB-queue fallback message picks from a pool of 8 hooks keyed deterministically by slug hash (push_pins_to_sheets.py). Alternatives: curate every slug; random choice. Reason: every uncurated slug reused one sentence; deterministic keeps re-runs idempotent. Reversibility: trivial (edit the pool).

Decisions 2026-07-22b (category fix + auto-merge):

• Decision: Fix category drift by re-categorizing the 11 live posts + adding redirects (not URL-preserving theme hacks), and stretch odd-fits into the nearest existing pill (no new pills; cat-tree → Toys). Reason: Director’s picks; proper topical URLs + working buttons, redirects protect already-fired pins/SEO. Reversibility: low for the live URL moves (redirects mitigate), easy for products.json/vocab.
• Decision: Leave best-dog-pools as dog-gear (exempt in the queue guard). Reason: an outdoor pool maps to no existing pill and its only keyword (“water”) would wrongly land it under Feeding. Reversibility: trivial; the post-guard (no exemptions) forces a real category before it can ever publish.
• Decision: Auto-merge safety is procedural (CI-gated), not branch-protection. The routine waits on gh pr checks --watch then merges; no repo-settings change. Reason: test.yml already runs the suite on every PR and is a sufficient backstop; avoids an admin settings change. Reversibility: easy.
• Decision: Set the routine prompt to AUTO_MERGE=on while keeping enabled: false. Reason: the Director wants a supervised manual E2E, not unattended cron publishing (go-live cron still HELD). Reversibility: trivial (RemoteTrigger update).
• Decision (PR #84): Publish auto-fires on the Stage-1 draft merge (a push trigger on _posts/DRAFT-*.md) rather than depending on the routine dispatching publish.yml. Reason: the dispatch needed the GitHub App to have actions: write — a scope Anthropic defines and the user can’t grant per-install; merging (which the App already can do) auto-fires publish because App-authored pushes trigger workflows (unlike GITHUB_TOKEN). Removes the fragile dependency for good; the explicit dispatch stays as an ignorable fallback. Reversibility: easy (drop the trigger). Double-fire is safe (concurrency + the 2nd run finds no draft).

4. Architecture & Key Files

• stage1_cli.py — plumbing CLI the routine drives: next-topic, review-prompt, gate, rewrite-prompt, stage. No model calls.
• .claude/skills/happypet-stage1/SKILL.md — the routine’s write→review→rewrite→gate→stage→PR procedure (local or scheduled-cloud).
• generate_posts.py — authoritative_gate, build_verified_facts, extracted select_next_topic/build_writer_inputs/stage_article. stage_article pin-source fix (PR #78): prefers curated /images/I/ image, ASIN /images/P/ only as fallback. Legacy OpenRouter Stage-1 layer (GENERATOR/REVIEW/REWRITE chains, call_generator, evaluate_scorecard) still present — retire in Phase 2.
• brain_secrets.py — read-only client for Maeve’s encrypted SecretVault (sibling MaeveJarvis/, one level up). By design get_secret returns None on CI (no vault); get_sheets_creds raises if the vault lacks the key. Callers must env-fallback themselves. Changed 2026-07-27: the unlock key COGNITIVE_DB_KEY now resolves env → secrets.env → Windows Credential Manager (maeve/COGNITIVE_DB_KEY, written by MAEVE\secrets-migration\keyring_helper.py), so the key can leave the plaintext secrets.env without this module going quiet. If a vault is configured here but no key can be found anywhere, get_secret now raises BrainSecretsUnavailable instead of returning None — a misconfiguration is not an absence. Where there is no vault at all (CI), it still returns None, unchanged. post_pins/push_pins_to_sheets re-raise that one exception through their blanket except Exception env-fallback.
• post_pins.py (Stage 3 IFTTT) + push_pins_to_sheets.py (Stage 3 Sheets audit + FB queue) — both now resolve secrets vault-then-env at call time (PRs #79/#80). push_pins_to_sheets.py also holds _FB_HOOKS (curated per-slug messages) and _FB_FALLBACK_TEMPLATES (varied fallback pool, PR #81).
• .github/workflows/publish.yml (Stage 2, EDITED PR #81) — dates DRAFT-*.md→YYYY-MM-DD-*.md, writes .pending-slugs, pushes, then dispatches deploy.yml. Triggers: cron 0 12 * * 1,4, workflow_dispatch, workflow_run from the deprecated generate.yml.
• .github/workflows/pin.yml (Stage 3, EDITED PR #81) — workflow_dispatch only (dispatched by deploy.yml’s trigger-pins job when .pending-slugs is non-empty). Consume step now --autostash.
• .github/workflows/deploy.yml (UNCHANGED) — Jekyll build + Pages deploy on push to main matching _posts/YYYY-MM-DD-*.md / assets/** / layouts / config; its trigger-pins job dispatches pin.yml from .pending-slugs. NOTE: its inline comment still claims Stage 2’s push auto-fires deploy — that’s the stale assumption #81 worked around; leave the comment or fix it, but the behavior is handled by publish.yml’s explicit dispatch.
• test_pipeline.py / test_stage1_cli.py — 224 tests (2026-07-27: +24 for vault-key resolution, caller error propagation, resolve_sheet_ids). This session added TestStageArticle pin-source, TestPostPinsSecretFallback, TestPushPinsToSheetsSecretFallback, TestFbMessage.

5. Gotchas & Hard-Won Knowledge

• Pinterest caches the image at a URL — re-firing the SAME image URL re-serves its cached (possibly bad) copy, it does NOT re-fetch. Discovered 2026-07-23 fixing the litter-box blank pin: the pin JSON’s image_url has a ?v= query, but post_pins.py’s build_pin_image_url_for_ifttt strips all query strings before sending to IFTTT — so a --force re-fire hits the exact bare URL Pinterest already has cached. My first re-fire attempt (after fixing the asset) still produced a blank pin for this reason; fixed by copying the corrected image to a NEW filename (best-automatic-litter-box-v2.jpg), pointing the pin JSON at that, deploying, then re-firing. Rule: any pin re-fire that changes the image content MUST use a filename Pinterest has never seen — bumping the ?v= query is NOT enough (post_pins strips it anyway, and even if it didn’t, Pinterest may key on the bare path). The stray blank pins from the first (pre-cache-bust) re-fire attempt need manual deletion on Pinterest same as the original.
• GITHUB_TOKEN pushes do NOT trigger other workflows (GitHub anti-recursion). Stage 2’s dated-post commit therefore never auto-fired deploy.yml — handled now by publish.yml’s explicit gh workflow run deploy.yml. Any future “committed but nothing deployed” symptom is this.
• brain_secrets imports cleanly on a runner (heavy deps load lazily inside _get_vault()), so try: from brain_secrets… except ImportError: <env fallback> leaves the fallback dead. get_secret returns None on CI and callers must fall back to env at call time. This silently broke pin posting from 2026-07-02 until PRs #79/#80.
• brain_secrets.py’s vault has been DEAD on Derek’s box since the 2026-07-21 vault reorg (found 2026-07-27, not fixed — needs a decision). _SECRETS_ENV points at MAEVE\MaeveJarvis\secrets.env, but that repo moved to MAEVE\_archive\MaeveJarvis\; the COGNITIVE_DB_PATH inside that file is stale too (the real vault is MAEVE\brain\maeve-brain-v2.db, which does open and holds all 42 HAPPYPET__/GLOBAL__ secrets). So every local get_secret has silently returned None for weeks and callers have been running on env vars alone. Re-pointing those two paths would change what a local run uses for credentials (vault values may differ from the env/GitHub-Secret copies), so it is a deliberate decision, not a drive-by fix. Cloud/GHA runs are unaffected either way — there is no vault there.
• .fired sentinels are committed to main (_pin_queue/.fired/<slug>.fired). Re-running pin.yml without --force SKIPs already-fired slugs — so a re-run is safe (no double Pinterest post). Use --force only to deliberately re-fire.
• pin.yml consume step rebases before staging; the Sheets step leaves the tree dirty → needs --autostash (fixed). Without it: cannot pull with rebase: You have unstaged changes (exit 128), .pending-slugs not consumed → risk of a duplicate FB-queue append next deploy.
• Pin image /images/P/{ASIN} returns a 43-byte GIF placeholder for modern B0G… ASINs → text-only pin. Use curated /images/I/…; fetch_image recovers it on the images-na host if m.media-amazon.com is blocked.
• Merging any assets/** change to main triggers deploy.yml. Pins only fire if .pending-slugs is non-empty (written by Stage 2). It is absent on main now; a stale one would fire pins on any deploy — check before merging asset changes.
• Cloud-container setup is the fragile part, not our code. Runs can hang at “setting up cloud container” during Anthropic platform incidents (open bugs #58719/#54685/#55736). Repo files load after container setup, so they can’t cause it. The PR step needs GitHub write access (the Claude GitHub App).
• Windows/worktree: run tests with ./.venv/Scripts/python.exe; a worktree has no .venv (use the main repo interpreter by absolute path). Source has literal U+2014/U+2013; always encoding="utf-8". Console can’t print the paw emoji (\U0001f43e) under cp1252 — strip it when echoing FB messages locally.

6. Conventions In Play

• Branch + PR for everything; claude/happypet-recovery-N-<slug> — next N is 45. Self-merge green recovery PRs (Director preference). Cloud-routine PRs use stage1/<slug> branches, PR-only unless auto_merge is on.
• TDD: write failing test, watch it fail, implement, pass. Conventional commits ending Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>; PR bodies end with the Claude Code footer.
• Live publishing is ALWAYS Director-gated. The first live publish (2026-07-22) happened on an explicit “go”; that authorization does not roll forward to the next article. Project law: this file + CLAUDE.md + the Maeve constitution (C:\Users\derek\MAEVE\CLAUDE.md → MAEVE.md).

7. Open Questions

1. Go autonomous now, or one more supervised run? The pipeline is hardened; the remaining Phase-2 wiring is (a) dispatch publish.yml after a Stage-1 PR merges, (b) flip auto_merge on, (c) enable schedule / retire generate.yml. Director’s call.
2. Enforced bar 3 vs 4? Still config-only. Data is thin but good (cloud 4/4/4/5, supervised 4/4/4/4). Raise to 4 only with more clean runs, or the permanent-hold failure returns.
3. Is the scheduled routine enabled? Unconfirmed. If yes, a new stage1/<slug> PR appears Thu 08:15 UTC — is that wanted before Phase-2 decisions are made?
4. FB fallback topic length: for roundup titles the {topic} is the full de-prefixed title (e.g., “dog cooling mats to beat the summer heat”), which reads long in some templates. Acceptable now; could shorten to the core noun later.

8. Do Not Touch

• deploy.yml — unchanged and load-bearing (Jekyll build + Pages + trigger-pins). publish.yml and pin.yml WERE edited this session (PR #81, authorized) and are hardened — don’t casually refactor any of the three; they’re the live publish path.
• .fired sentinels and _pin_queue/ state on main — don’t hand-edit; they are the pin dedup/liveness ledger.
• evaluate_scorecard + the OpenRouter model chains in generate_posts.py — legacy; the routine uses authoritative_gate. Don’t “unify” them (retire in Phase 2).
• generate.yml cron — the OLD/deprecated OpenRouter Stage-1 schedule, superseded by the routine. Leave HELD/disabled; retire in a future cleanup pass.
• Scheduled routine trig_01MeaAqB7AJsQTCsmBxYNWcM — NOW LIVE (enabled: true, autonomous). Don’t disable/recreate/reconfigure without the Director’s explicit instruction — it is the production publish schedule now, not a dormant test harness.
• CLAUDE.md, GENERATION_RESULT.json (untracked at repo root) — pre-existing, leave them.

9. Resume Command

Read HANDOFF.md. main @ 119b6ac, 200 tests (./.venv/Scripts/python.exe -m pytest test_pipeline.py test_stage1_cli.py -q). HappyPet is now live and autonomous. The first fully-autonomous E2E ran and worked (PR #85, best-automatic-litter-box): write→review→gate→auto-merge→publish (auto-fires on merge, PR #84)→deploy→pin, unattended. The blank-pin-photo bug it exposed is fixed for future runs (PR #86, pins regenerate on the GHA runner with a strict guard); THIS article’s pin needed one extra manual fix — Pinterest caches by URL, so re-firing the corrected image at the same URL still served the cached blank copy, fixed by cache-busting to -v2.jpg (see Gotchas §5) — the Director is manually cleaning up the stray blank pins on Pinterest from both the original run and the pre-cache-bust re-fire attempt. The Director then ENABLED the scheduled routine: trig_01MeaAqB7AJsQTCsmBxYNWcM is enabled: true, cron 0 12 * * 1,4 (Mon+Thu 12:00 UTC), AUTO_MERGE=on — go-live is no longer held, it publishes on its own schedule now. Since today is Thursday, expect a second autonomous article ~12:00 UTC today; check its pin renders with a real photo (if a cloud-generated pin is blank despite PR #86, that’s a NEW regression, investigate). Ongoing job: watch scheduled runs for quality/failures, since this is now unattended in production. Next recovery branch N = 49.