issue-zero: a nightly tally flow that reads open issues, matches protocol cards, dispatches by tier, evaluates, and leaves card/* branches with receipts; never merges, never switches

[mecattaf]

Why

The second half of the issue-count-zero design (/home/tom/today/review/2026-09-19/ISSUE-ZERO-DISTILLATION.md sections 6, 8 and 9). MEASURED: PRs are merged a median 19 seconds after they open and the closed-issue median latency is 111 hours; the machine's job is the tail, and the merge stays Tom's (ruling 27).

Outcome

A flow issue-zero in flows/tally-flows.nix, onCalendar null like every other flow, run by hand with tally flow run issue-zero until two hand runs are green.

1. Read gh issue list -R mecattaf/dotfiles --state open --json number,title,labels,body (read-only) and the card library from the kit's store path.
2. Match each issue to the first card whose trigger matches (label card:<id> if present, else title regex). Skip classes keep and human-area from protocols/issue-classes.tsv. Unmatched issues are reported, never attempted.
3. Dispatch by the card's current tier, at most 6 jobs a night: atomic and halogen tiers through the shell runner on worker-gpu; sonnet and opus tiers through claude-code on cc2 only after Ruling: may the kernel lease a Claude seat for unattended work, and through which row? (rows.md:41-55, tally-b.nix:57-63, D-B6) #362 is answered, else report "needs a seat ruling".
4. Per job: fresh worktree from origin/main under /home/tom/.local/state/tally-worktrees/card--, run the card, git apply --check then git apply, enforce may_touch and never_touch before applying, run every verify entry, commit with the card's template, write the receipt line, remove the worktree only on green.
5. Dedup key card:<id>:issue:<n>:base:<main-sha12> as the taskId.
6. Output: local branch card//, PR body file, and /home/tom/today/review//ISSUE-ZERO-REPORT.md listing per issue the card, tier, model, verify results, diff stat, branch, receipt path, and the one push-and-open command per branch.
7. A red run comments on the issue with the receipt path and demotes the card one rung. No labels, no closes, no merges, no switch, no push.
8. The flow's user unit is under failure-surfacing.

Guard rails (exact)

• No push by the flow. Tom's morning command per branch: git push -u origin card/<id>/<issue> && gh pr create --fill-first --body-file <pr-body>. If Tom lifts no-push for card/* branches only, the flow runs that command itself with Refs, never Closes, and still never merges.
• No nix invocation outside a verify entry under the lease. No nixos-rebuild in any card.
• Envelope per job from the card: seconds (required), tokens_out; prompt cap 30k on atomic tier.
• A base rev that moved during the night is not retried the same night.

Acceptance

• tally flow run issue-zero on the three seed cards leaves three branches, three receipts and one report; nothing is pushed.
• A deliberately red card (bad verify argv) produces a comment on a fixture issue and a demotion in the card's history, and the worktree remains for inspection.
• Two hand runs green before any timer is proposed (ruling 22); the timer, when proposed, is 23:30 with Persistent=false, finishing before the 00:45 update-center-seed.

Refs #362, #403, #423, #425, #354, tally #59, tally #60, tally #62.