docs(todo): schedule Signal MCP server install for 2026-05-29

Files a [#B] :feature: TODO under Rulesets Open Work to install
rymurr/signal-mcp as an MCP server. The MCP gives Claude native tool
access to send_message_to_user, send_message_to_group, and
receive_message instead of shelling out to the page-signal wrapper.
The differentiator is receive_message. Claude can listen for replies
and act on them, enabling page-as-confirm flows and structured Q&A
across devices.

Dependency: signal-cli has to be registered with the Google Voice
number first. Sending from Craig's primary number to itself doesn't
notify (Signal treats it as one account on linked devices). The MCP
server takes --user-id at startup, one account per instance, so it
has to point at the GV account.

Implementation touches mcp/servers.json (stdio entry), mcp/README.org
(dependency note), and possibly mcp/secrets.env.gpg if any auth
material needs encrypting. Verification: make install-mcp followed by
make check-mcp shows signal-mcp ok. Smoke-test via a tool call.

The task is scheduled for 2026-05-29.

1 files changed, 132 insertions, 112 deletions

diff --git a/todo.org b/todo.org
index 912d387..d9442a8 100644
--- a/todo.org
+++ b/todo.org
@@ -1047,36 +1047,6 @@ having a skill to generate or check OV-1-shaped artifacts. Don't build
 speculatively — defense-specific notations are narrow enough that each
 skill should be driven by a concrete contract need, not aspiration.
 
-** DONE [#C] Add =make uninstall-mcp= + =mcp/install.py --check= for symmetry :feature:solo:quick:
-CLOSED: [2026-05-28 Thu]
-:PROPERTIES:
-:LAST_REVIEWED: 2026-05-28
-:END:
-
-Currently the MCP install pipeline only flows one direction. No way to remove rulesets-managed MCP servers in one command. No way to ask "what's the drift between =servers.json= and =claude mcp list=" without eyeballing.
-
-*** =make uninstall-mcp=
-
-Iterate over =servers.json=, run =claude mcp remove <name> -s user= for each. Ignore "not registered" errors. Idempotent.
-
-*** =mcp/install.py --check=
-
-Dry-run mode. Decrypt secrets, but instead of registering, print the drift report:
-
-- Servers in =servers.json= not in =claude mcp list= → =MISSING=
-- Servers in =claude mcp list= not in =servers.json= → =EXTRA=
-- Servers in both → =ok=
-
-Useful for diagnosing connection failures and for the eventual =make doctor= integration.
-
-** DONE [#C] Update =README.org= with MCP install pipeline section :chore:solo:quick:
-CLOSED: [2026-05-28 Thu]
-:PROPERTIES:
-:LAST_REVIEWED: 2026-05-28
-:END:
-
-=README.org= covers global install, per-project language bundles, and design principles, but doesn't mention =make install-mcp= or the =mcp/= directory. Add a short section after "Per-project language bundles" describing the user-scope MCP install pattern (decrypt → expand → register) and pointing at the eventual =mcp/README.org=.
-
 ** TODO [#C] Token-rotation helper for =@a-bonus/google-docs-mcp= OAuth refresh :feature:quick:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-05-28
@@ -1127,21 +1097,6 @@ The four canonical rules (=commits=, =testing=, =verification=, =subagents=) are
 
 The Elisp pair is the most suspicious — three repos using essentially the same rules. Audit: diff these across the projects, check for drift, then decide whether to canonicalize them under =~/code/rulesets/claude-rules/languages/<lang>/= and symlink, or leave them as project-local.
 
-** DONE [#C] Consolidate =claude-templates/Makefile= after fold :chore:quick:solo:
-CLOSED: [2026-05-28 Thu]
-:PROPERTIES:
-:LAST_REVIEWED: 2026-05-28
-:END:
-
-Sibling follow-up from the fold child (2026-05-15). After the subtree merge, =rulesets/claude-templates/Makefile= still has its standalone =install= / =uninstall= / =list= / =test-scripts= targets. The =install= target's =bin/ai= logic is now duplicated in =rulesets/Makefile=. Both work; the redundancy is harmless but worth cleaning up.
-
-Options:
-- *Delete* =claude-templates/Makefile= entirely — forces all install through rulesets root. Cleaner.
-- *Strip down* to just =test-scripts= — the one piece not redundant with =rulesets/Makefile=.
-- *Leave it* — slight redundancy, no functional harm.
-
-Triggered by: 2026-05-15 fold session's refactor audit (commit =2d645fc=).
-
 ** TODO [#C] Refactor =daily-prep.org= to delegate to =triage-intake.org= for the triage section :chore:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-05-28
@@ -1238,20 +1193,33 @@ Verification: simulate two agents sharing a project (separate AI_AGENT_ID values
 
 Parent: see [[#16 Generic agent runtime support][Generic agent runtime support — Codex spec v0]] above for the larger arc this is sliced from.
 
-** DONE [#C] Run =--archive-done= sweep at start of =open-tasks.org= Phase A :chore:quick:solo:
-CLOSED: [2026-05-28 Thu]
+** TODO [#B] Add Signal MCP server (rymurr/signal-mcp) :feature:
+SCHEDULED: <2026-05-29 Fri>
 :PROPERTIES:
-:CREATED: [2026-05-28 Thu]
-:LAST_REVIEWED: 2026-05-28
+:CREATED: [2026-05-29 Fri]
+:LAST_REVIEWED: 2026-05-29
 :END:
 
-From pearl handoff 2026-05-28. =open-tasks.org= Next Mode reads =* Project Open Work= and skips =* Project Resolved= correctly, but a level-2 task that completed during a session sits as =** DONE= under Open Work until something archives it. Between cleanups, a freshly-DONE task can surface as a "what's next" candidate.
+Install [[https://github.com/rymurr/signal-mcp][rymurr/signal-mcp]] so Claude can call =send_message_to_user=, =send_message_to_group=, and =receive_message= natively rather than shelling out to the =page-signal= wrapper. Python, MCP framework, depends on =signal-cli= being configured locally.
 
-Proposed fix: as the first step of =open-tasks.org= Phase A, run =emacs --batch -q -l .ai/scripts/todo-cleanup.el --archive-done todo.org=, then read =todo.org=. The cleanup tool already exists; this is wiring it into the workflow.
+Two-way capability is the differentiator over the CLI: =receive_message= lets the agent listen for replies on the phone, enabling page-as-confirm flows, "should I proceed?" loops over Signal, and structured Q&A across devices.
 
-Cost: a few hundred ms at the start of every "what's next" invocation. Win: recommendations never include DONE work.
+*** Dependency
 
-Optional refinement: gate behind a check for read-only / dry-run mode if that's ever introduced. The default invocation archives.
+This depends on the Google Voice account being registered with =signal-cli= first. Sending from Craig's primary number to itself doesn't notify (Signal treats it as one account on linked devices). The MCP server takes =--user-id= at startup, one account per instance, so it has to point at the GV account, with the primary as the per-send recipient.
+
+If GV registration is still pending when this task runs, block here and surface that.
+
+*** Implementation
+
+- =mcp/servers.json= — add =signal-mcp= entry under stdio transport (=command=, =args=, optional =env= for the user-id pointer).
+- =mcp/README.org= — document the signal-cli + GV-registration dependency and the user-id pattern.
+- =mcp/secrets.env.gpg= — only if the MCP server's user-id needs to be encrypted (probably not; the GV number isn't a secret beyond being personal).
+- Verify: =make install-mcp= followed by =make check-mcp= shows =signal-mcp ok=; smoke-test via a Claude tool call sending a message + waiting on =receive_message=.
+
+*** Why this matters
+
+=page-signal= is the fast path (a hook, a script, a make recipe can call it without an MCP round-trip). The MCP server is the smart path. When Claude wants to send and then *react to the reply*, the CLI can't do that — only the MCP server can. The two complement each other; this task adds the second half.
 
 ** TODO [#C] Enumerate implementation tasks in =spec-review.org= Phase 6 :feature:solo:
 :PROPERTIES:
@@ -1267,15 +1235,6 @@ Three wins: handoff is one paste not a re-read; forces specs to be implementable
 
 If the spec lacks an =Implementation phases= section, the step is the prompt to ask the author to add one before =Ready=.
 
-** DONE [#C] Triage Codex enhancement backlog :spec:
-CLOSED: [2026-05-28 Thu]
-:PROPERTIES:
-:CREATED: [2026-05-28 Thu]
-:LAST_REVIEWED: 2026-05-28
-:END:
-
-Triaged interactively 2026-05-28. Disposition table for all 14 items lives at [[file:docs/design/2026-05-28-rulesets-enhancement-backlog.org][2026-05-28-rulesets-enhancement-backlog.org]] under "Triage Dispositions": 3 accepted (filed below as TODOs), 3 pilot/scope-limited (filed below), 2 marked as conventions rather than tracked tasks, 6 rejected with rationale. Items #1 and #2 already had homes (#16 and the Phase-1 codex TODO).
-
 ** TODO [#C] Add =.aiignore= for agent inventory exclusions :chore:
 :PROPERTIES:
 :CREATED: [2026-05-28 Thu]
@@ -1326,56 +1285,6 @@ Teach startup/routing to read =Summary= only at routing time, then =Execution= o
 
 After the pilot, evaluate: did the savings show up in real session token use? Did the structure constrain the workflow expressiveness too much? If yes to savings and no to constraint, expand to the next-largest workflows. If not, document why and stop. Don't templatize universally — shorter workflows don't need tiering.
 
-** DONE [#C] Canonical/mirror drift detection via pre-commit hook or =make sync-check= :feature:quick:solo:
-CLOSED: [2026-05-28 Thu]
-:PROPERTIES:
-:CREATED: [2026-05-28 Thu]
-:LAST_REVIEWED: 2026-05-28
-:END:
-
-From the codex enhancement backlog (item #7), reframed: don't dedupe the dual source — the canonical-in-=claude-templates/= + mirror-in-=.ai/= pattern is a feature (other projects rsync from the canonical; the mirror lets rulesets-as-a-project have a working copy). The real pain is sync-discipline overhead — every workflow edit needs both copies updated, and forgetting one leaves the next startup's rsync to surface the drift.
-
-Scope: write a small =scripts/sync-check.sh= (or fold into the existing Makefile) that diffs =claude-templates/.ai/workflows/= against =.ai/workflows/=, exits non-zero on drift. Wire as a pre-commit hook (=githooks/pre-commit= or equivalent) so the discipline is enforced before publish, not at the next startup. =make sync-check= as a manual entry point.
-
-Verification: introduce a deliberate diff, commit, hook should block. Restore parity, hook should pass.
-
-** DONE [#C] Add =make status= — compose audit + doctor + open-task count :feature:quick:solo:
-CLOSED: [2026-05-28 Thu]
-:PROPERTIES:
-:CREATED: [2026-05-28 Thu]
-:LAST_REVIEWED: 2026-05-28
-:END:
-
-From the codex enhancement backlog (item #12), scope-limited: =make status= only. Reject the rest of #12 (=make sync= duplicates the existing sync flow; =make health= wraps existing checks without adding signal; =make bootstrap-project= duplicates =install-ai= + =install-lang=).
-
-Scope: one Makefile target that prints a compact summary of:
-
-- Install audit state (clean / drift, calling =make audit=).
-- Machine-global doctor state (calling =make doctor=).
-- Open-task count (top-level entries in =todo.org= under =* Rulesets Open Work=).
-- Inbox count (files in =inbox/= excluding =.gitkeep= and =PROCESSED-= prefixes).
-- Git working-tree status (clean / dirty, ahead/behind upstream).
-
-Output should be roughly 10 lines, scannable in one glance. Composes the existing checks; no new logic except the summary formatting.
-
-** DONE [#C] Iteration-history backfill for spec-review and spec-response :docs:followup:
-CLOSED: [2026-05-28 Thu]
-Source: org-drill inbox 2026-05-28.
-
-Once the in-flight WIP lands (the requirement that specs carry a bottom =Review and iteration history= section, with iteration / date / contributor / role / what / why / artifacts), backfill the two workflow files themselves using rulesets' session history as evidence.
-
-Files to update:
-- =claude-templates/.ai/workflows/spec-review.org=
-- =claude-templates/.ai/workflows/spec-response.org=
-
-Investigation: search =.ai/sessions/=, =.ai/notes.org=, inbox archive, and git log for mentions of these workflow docs. Identify review/response/design iterations, dates, and contributors (including agents where known: Claude Code, Codex, local models). Distinguish high-confidence history (commits, dated session entries) from inferred (chat-only context). Recommend whether enough evidence exists to populate the section, and draft the entries if so.
-
-Dependency: spec-review.org and spec-response.org have uncommitted edits in flight. Wait for those to land before writing to the files. The read-only research portion (search sessions, identify iterations, draft entries to a scratch file) can run in parallel without conflict.
-
-:PROPERTIES:
-:LAST_REVIEWED: 2026-05-28
-:END:
-
 * Rulesets Resolved
 ** DONE [#C] Fix =cj-scan= false positives on cj fences nested inside other =#+begin_*= blocks :bug:
 CLOSED: [2026-05-15 Fri]
@@ -2338,3 +2247,114 @@ Wrote =mcp/README.org= covering everything in the "what to cover" list: the file
 - Token rotation: when a refresh token gets revoked, the recovery flow (re-auth on one machine, re-bundle, recommit).
 - Adding a new server: edit =servers.json=, add any new =${VAR}= placeholders to the bundle, re-encrypt.
 - The OAuth dance for HTTP-transport servers (linear, notion) versus stdio (google-docs-*) — different paths, different gotchas.
+** DONE [#C] Add =make uninstall-mcp= + =mcp/install.py --check= for symmetry :feature:solo:quick:
+CLOSED: [2026-05-28 Thu]
+:PROPERTIES:
+:LAST_REVIEWED: 2026-05-28
+:END:
+
+Currently the MCP install pipeline only flows one direction. No way to remove rulesets-managed MCP servers in one command. No way to ask "what's the drift between =servers.json= and =claude mcp list=" without eyeballing.
+
+*** =make uninstall-mcp=
+
+Iterate over =servers.json=, run =claude mcp remove <name> -s user= for each. Ignore "not registered" errors. Idempotent.
+
+*** =mcp/install.py --check=
+
+Dry-run mode. Decrypt secrets, but instead of registering, print the drift report:
+
+- Servers in =servers.json= not in =claude mcp list= → =MISSING=
+- Servers in =claude mcp list= not in =servers.json= → =EXTRA=
+- Servers in both → =ok=
+
+Useful for diagnosing connection failures and for the eventual =make doctor= integration.
+** DONE [#C] Update =README.org= with MCP install pipeline section :chore:solo:quick:
+CLOSED: [2026-05-28 Thu]
+:PROPERTIES:
+:LAST_REVIEWED: 2026-05-28
+:END:
+
+=README.org= covers global install, per-project language bundles, and design principles, but doesn't mention =make install-mcp= or the =mcp/= directory. Add a short section after "Per-project language bundles" describing the user-scope MCP install pattern (decrypt → expand → register) and pointing at the eventual =mcp/README.org=.
+** DONE [#C] Consolidate =claude-templates/Makefile= after fold :chore:quick:solo:
+CLOSED: [2026-05-28 Thu]
+:PROPERTIES:
+:LAST_REVIEWED: 2026-05-28
+:END:
+
+Sibling follow-up from the fold child (2026-05-15). After the subtree merge, =rulesets/claude-templates/Makefile= still has its standalone =install= / =uninstall= / =list= / =test-scripts= targets. The =install= target's =bin/ai= logic is now duplicated in =rulesets/Makefile=. Both work; the redundancy is harmless but worth cleaning up.
+
+Options:
+- *Delete* =claude-templates/Makefile= entirely — forces all install through rulesets root. Cleaner.
+- *Strip down* to just =test-scripts= — the one piece not redundant with =rulesets/Makefile=.
+- *Leave it* — slight redundancy, no functional harm.
+
+Triggered by: 2026-05-15 fold session's refactor audit (commit =2d645fc=).
+** DONE [#C] Run =--archive-done= sweep at start of =open-tasks.org= Phase A :chore:quick:solo:
+CLOSED: [2026-05-28 Thu]
+:PROPERTIES:
+:CREATED: [2026-05-28 Thu]
+:LAST_REVIEWED: 2026-05-28
+:END:
+
+From pearl handoff 2026-05-28. =open-tasks.org= Next Mode reads =* Project Open Work= and skips =* Project Resolved= correctly, but a level-2 task that completed during a session sits as =** DONE= under Open Work until something archives it. Between cleanups, a freshly-DONE task can surface as a "what's next" candidate.
+
+Proposed fix: as the first step of =open-tasks.org= Phase A, run =emacs --batch -q -l .ai/scripts/todo-cleanup.el --archive-done todo.org=, then read =todo.org=. The cleanup tool already exists; this is wiring it into the workflow.
+
+Cost: a few hundred ms at the start of every "what's next" invocation. Win: recommendations never include DONE work.
+
+Optional refinement: gate behind a check for read-only / dry-run mode if that's ever introduced. The default invocation archives.
+** DONE [#C] Triage Codex enhancement backlog :spec:
+CLOSED: [2026-05-28 Thu]
+:PROPERTIES:
+:CREATED: [2026-05-28 Thu]
+:LAST_REVIEWED: 2026-05-28
+:END:
+
+Triaged interactively 2026-05-28. Disposition table for all 14 items lives at [[file:docs/design/2026-05-28-rulesets-enhancement-backlog.org][2026-05-28-rulesets-enhancement-backlog.org]] under "Triage Dispositions": 3 accepted (filed below as TODOs), 3 pilot/scope-limited (filed below), 2 marked as conventions rather than tracked tasks, 6 rejected with rationale. Items #1 and #2 already had homes (#16 and the Phase-1 codex TODO).
+** DONE [#C] Canonical/mirror drift detection via pre-commit hook or =make sync-check= :feature:quick:solo:
+CLOSED: [2026-05-28 Thu]
+:PROPERTIES:
+:CREATED: [2026-05-28 Thu]
+:LAST_REVIEWED: 2026-05-28
+:END:
+
+From the codex enhancement backlog (item #7), reframed: don't dedupe the dual source — the canonical-in-=claude-templates/= + mirror-in-=.ai/= pattern is a feature (other projects rsync from the canonical; the mirror lets rulesets-as-a-project have a working copy). The real pain is sync-discipline overhead — every workflow edit needs both copies updated, and forgetting one leaves the next startup's rsync to surface the drift.
+
+Scope: write a small =scripts/sync-check.sh= (or fold into the existing Makefile) that diffs =claude-templates/.ai/workflows/= against =.ai/workflows/=, exits non-zero on drift. Wire as a pre-commit hook (=githooks/pre-commit= or equivalent) so the discipline is enforced before publish, not at the next startup. =make sync-check= as a manual entry point.
+
+Verification: introduce a deliberate diff, commit, hook should block. Restore parity, hook should pass.
+** DONE [#C] Add =make status= — compose audit + doctor + open-task count :feature:quick:solo:
+CLOSED: [2026-05-28 Thu]
+:PROPERTIES:
+:CREATED: [2026-05-28 Thu]
+:LAST_REVIEWED: 2026-05-28
+:END:
+
+From the codex enhancement backlog (item #12), scope-limited: =make status= only. Reject the rest of #12 (=make sync= duplicates the existing sync flow; =make health= wraps existing checks without adding signal; =make bootstrap-project= duplicates =install-ai= + =install-lang=).
+
+Scope: one Makefile target that prints a compact summary of:
+
+- Install audit state (clean / drift, calling =make audit=).
+- Machine-global doctor state (calling =make doctor=).
+- Open-task count (top-level entries in =todo.org= under =* Rulesets Open Work=).
+- Inbox count (files in =inbox/= excluding =.gitkeep= and =PROCESSED-= prefixes).
+- Git working-tree status (clean / dirty, ahead/behind upstream).
+
+Output should be roughly 10 lines, scannable in one glance. Composes the existing checks; no new logic except the summary formatting.
+** DONE [#C] Iteration-history backfill for spec-review and spec-response :docs:followup:
+CLOSED: [2026-05-28 Thu]
+Source: org-drill inbox 2026-05-28.
+
+Once the in-flight WIP lands (the requirement that specs carry a bottom =Review and iteration history= section, with iteration / date / contributor / role / what / why / artifacts), backfill the two workflow files themselves using rulesets' session history as evidence.
+
+Files to update:
+- =claude-templates/.ai/workflows/spec-review.org=
+- =claude-templates/.ai/workflows/spec-response.org=
+
+Investigation: search =.ai/sessions/=, =.ai/notes.org=, inbox archive, and git log for mentions of these workflow docs. Identify review/response/design iterations, dates, and contributors (including agents where known: Claude Code, Codex, local models). Distinguish high-confidence history (commits, dated session entries) from inferred (chat-only context). Recommend whether enough evidence exists to populate the section, and draft the entries if so.
+
+Dependency: spec-review.org and spec-response.org have uncommitted edits in flight. Wait for those to land before writing to the files. The read-only research portion (search sessions, identify iterations, draft entries to a scratch file) can run in parallel without conflict.
+
+:PROPERTIES:
+:LAST_REVIEWED: 2026-05-28
+:END: