ascend — the night-loop spine

The headless automation of the /ascend skill: the offense engine that manufactures work worth doing while you sleep and meets you at dawn with a story.

skills/ascend/SKILL.md is a versioned snapshot. The canonical, Claude-Code-discovered skill lives at ~/.claude/skills/ascend/SKILL.md (a real file — skills must live there to resolve). Edit the canonical one; re-copy it here when it changes. This repo copy exists so the skill is version-controlled with its engine, not to be the live skill.

heat (ascend) → matter (build) → meaning (DF saga) → contract (/spiral-review, by hand)

Where /ascend is a procedure you drive interactively, ascend runs it unattended overnight: load embers → ascend each through five heating termini cross-family → score temperature → select the silence-winner → (deep-night build) → deliver the night to the embodied Dreamfinder avatar, so you wake up and talk to DF about the night's adventure (not a one-way notification).

Cross-family is the point: the same vision lit from four biases climbs higher than any one can push — harmonics, not the disagreement a cage-match mines. (The thermodynamicist quartet — Maxwell, Kelvin, Carnot, Boltzmann — is fitting: the ascent scores an ember's temperature, and k_B bridges temperature and energy.)

Ember → Kindle → Combust → Resonance → Silence. Each rung is spoken by a different family (round-robin), building on all the heat below it.

No voice may cool the ember during the ascent — a critic is a cooling move that rebuilds /spiral-review and kills the heat. The ecstasy spiral is an echo chamber by construction; you do not fix that with a mid-spiral skeptic. Honesty is restored by the build (the cold pole) and by an honest temperature score that selects what's worth building. The compiler is the ground truth.

ascend run --smoke              # 1 ember, fast, no delivery — pipeline proof
ascend run --limit 3            # ascend the first 3 embers, narrate + deliver to DF
ascend run --dry-run            # full run, but write the saga to disk instead of sending
ascend run --scorer Carnot      # let a different family score temperature
ascend run --build              # request the deep-night worktree build of the winner (next increment)

Embers live in embers.json (an array of strings, or {embers:[…]}). Each run writes its artifacts to runs/<timestamp>/: one ascent-*.md per ember, the saga.md, and run.json.

• ✅ Spine — load → ascend (cross-family, no critic) → score → select → DF narrate → deliver to avatar.
• ✅ Deep-night build (--build) — the cold pole. The winner is handed to a headless Claude Code builder that actually compiles a working sketch in runs/<ts>/build/, and DF narrates heat→matter. It runs --dangerously-skip-permissions (full bash/file tools) — now OS-caged (below).
• ✅ The cage (cage-run.mjs) — the cold pole runs inside a macOS Seatbelt (sandbox-exec) sandbox with two hard boundaries: file writes confined to the build dir (+ claude's own state dirs), and egress locked to api.anthropic.com only via a localhost allowlist proxy that is the sole door out (Claude's own github + Datadog telemetry are refused; the build is fail-soft and completes anyway). Read is best-effort (an (allow default) base minus a secret-store denylist): egress-to-API-only stops exfil to other hosts, but not to Anthropic itself — a read secret (incl. the OAuth token, bound readable for auth) could ride a model call. Acceptable under the curated-ember threat model (a build leaking its own short-lived auth to its own provider is low-value), not a claim of secret-proofing. Proven by ./test-cage.sh --live, which tries to escape (write outside the dir, hit a non-API host, read ~/.ssh) and asserts every boundary holds. Bypass with CAGE_DISABLE=1 for local debugging only — never unattended.
• 📋 Threat model — THREAT-MODEL.md is the deliberate design for the full vision (web search + GitHub PRs/reviews/merges + deploys). Today's build is hermetic — self-authored prompt in, single-host egress (api.anthropic.com) out, no external injection surface (ember trust is provenance-disciplined, not a technical control) — so the OAuth token in the cage is the low-value credential (rotatable, inference-only) and elaborate credential-scoping is not warranted yet. The doc sets capability gates: web search, GitHub, and deploy each require their control (reason/act trust-zone separation, scoped creds, gated merges) before they're enabled — the build looks safe today precisely because none of them are on.
• ✅ Morning conversation — instead of a one-way Telegram push, the night is POSTed to the embodied Dreamfinder avatar (ASCEND_DF_URL + ASCEND_DF_KEY → POST /api/ascend/night). DF greets you with a digest of the night at session start and serves the full saga + per-terminus detail to its get_last_night voice tool — so the morning saga is a conversation, not a notification.
• ✅ Scheduling (schedule/) — a launchd job (com.claude.ascend.nightly) fires the night-loop at 06:00 via schedule/ascend-nightly.sh. Substrate decision: launchd on the Mac, because the cross-family ascent needs gemini+codex (authenticated only on the Mac; the always-on OCI box has only claude — which is why it's the build substrate, reached by ssh-dispatch). The wrapper is the fail-closed boundary: it ABORTS if CAGE_DISABLE is set (an unattended run must never go uncaged), repairs PATH so codex/Carnot resolves under launchd's minimal env, and points the build at the OCI cage. Install with schedule/install.sh. Waking a sleeping Mac needs one manual step the installer prints: sudo pmset repeat wakeorpoweron MTWRFSU 05:55:00 (StartCalendarInterval alone won't wake it).
• ⏳ CRDT ascent-log — today a run is a local dir; the skill's full vision is a CRDT document on the graph engine so embers are standing fires that span machines and years.

Co-designed with Nick 2026-06-20. See project_ascend_morning_saga.md + concept_ecstasy_spiral.md.