Orchestrator (Claude Code session)
    │
    ├── Reads BOARD.md for agent list, invocation commands
    ├── Reads/writes agent inboxes (brief.md, context.md, round2-brief.md, etc.)
    ├── Launches agents in parallel (per BOARD.md parallelism pattern)
    ├── Collects reports from outboxes
    └── Synthesises findings → REVIEW-LOG.md

Orchestrator (host)
    │
    ├── sudo -u $BOARD_USER
    │   (agents run as board user)
    │
    ├── unset CLAUDECODE
    │   (prevents nested session error)
    │
    └── claude/codex exec from agent dir
        (reads CLAUDE.md, inbox, writes outbox)

# Check if board user has credentials
sudo -u llmuser cat ~/.claude/.credentials.json 2>&1 | head -3
# If missing, copy from current user:
sudo cp ~/.claude/.credentials.json ~llmuser/.claude/.credentials.json
sudo chown llmuser:llmuser ~llmuser/.claude/.credentials.json

sudo -u llmuser bash -c 'unset CLAUDECODE && cd $AGENT_DIR && claude ...'

# WRONG:
codex --dangerously-bypass-approvals-and-sandbox "prompt"

# RIGHT:
codex exec --dangerously-bypass-approvals-and-sandbox "prompt"

codex exec ... > /tmp/codex-output.out 2>&1
if [ ! -s outbox/report.md ]; then cp /tmp/codex-output.out outbox/report.md; fi

"read CLAUDE.md then read inbox/context.md and inbox/brief.md and write your report to outbox/report.md"

cd /path/to/FrontierBoard/.board && claude --dangerously-skip-permissions -p "read CLAUDE.md then /run"

BOARD=/path/to/.board
for agent in pragmatist systems-thinker skeptic; do
  echo "=== $agent ==="
  stat -c '%Y %n' "$BOARD/board/$agent/outbox/.run-id" "$BOARD/board/$agent/outbox/report.md" 2>/dev/null
done
# report.md timestamp should be AFTER .run-id timestamp

# Check ownership
ls -la $BOARD/.board/board/

# Fix: chown entire .board to board user
chown -R llmuser:llmuser $BOARD/.board/

# Also ensure parent directory is traversable
chmod o+x $BOARD $BOARD/.board $BOARD/.board/board

# Check if locked
cat $BOARD/.board/.review-lock 2>/dev/null
# Format: project|PID|timestamp

# If stuck (review crashed without cleanup):
rm $BOARD/.board/.review-lock

LOCK_PID=$(cat $BOARD/.board/.review-lock 2>/dev/null | cut -d'|' -f2)
ps -p $LOCK_PID &>/dev/null && echo "Review still running (PID $LOCK_PID)" || echo "Stale lock — safe to remove"

AGENT_DIR=$BOARD/board/pragmatist
echo "Smoke test: confirm identity." > $AGENT_DIR/inbox/brief.md
echo "Context." > $AGENT_DIR/inbox/context.md
rm -f $AGENT_DIR/outbox/report.md

sudo -u llmuser bash -c "unset CLAUDECODE && cd $AGENT_DIR && claude --dangerously-skip-permissions -p 'read CLAUDE.md then read inbox/context.md and inbox/brief.md and write your report to outbox/report.md'"

[ -s "$AGENT_DIR/outbox/report.md" ] && echo "PASS" || echo "FAIL"

echo "=== FrontierBoard Diagnostic ==="
BOARD="${BOARD:-$(pwd)}"
# Auto-detect: are we in .board/ or the clone root?
[ -f "$BOARD/.board/board/BOARD.md" ] && BOARD_STATE="$BOARD/.board" || BOARD_STATE="$BOARD"
[ -f "$BOARD_STATE/board/BOARD.md" ] || { echo "ERROR: Can't find BOARD.md. Set BOARD= to FrontierBoard clone dir."; exit 1; }

echo -e "\n1. Board file exists?"
[ -f "$BOARD_STATE/board/BOARD.md" ] && echo "  OK: $(head -1 $BOARD_STATE/board/BOARD.md)" || echo "  FAIL: No BOARD.md"

echo -e "\n2. Isolation mode?"
grep -m1 'Isolation\|isolation' "$BOARD_STATE/board/BOARD.md" 2>/dev/null || echo "  UNKNOWN"

echo -e "\n3. Claude Code authenticated?"
[ -f "$HOME/.claude/.credentials.json" ] && {
  python3 -c "
import json, time
d = json.load(open('$HOME/.claude/.credentials.json'))
o = d.get('claudeAiOauth', {})
if o.get('accessToken'):
    remaining = (o['expiresAt'] - time.time()*1000) / 60000
    print(f'  OK: OAuth token valid ({remaining:.0f} min remaining, {o.get(\"subscriptionType\",\"?\")} plan)')
else:
    print('  FAIL: No access token in credentials file')
" 2>/dev/null
} || echo "  FAIL: No credentials file. Run: claude /login"

echo -e "\n4. Codex authenticated?"
[ -f "$HOME/.codex/auth.json" ] && {
  python3 -c "
import json
d = json.load(open('$HOME/.codex/auth.json'))
t = d.get('tokens', {})
if t.get('access_token'):
    print(f'  OK: Codex auth ({d.get(\"auth_mode\",\"?\")} mode, token length {len(t[\"access_token\"])})')
else:
    print('  FAIL: No access token. Run codex interactively to authenticate.')
" 2>/dev/null
} || echo "  WARN: No Codex auth file (only needed if you have a Codex agent)"

echo -e "\n5. Agent directories?"
for agent in $BOARD_STATE/board/*/; do
  name=$(basename "$agent")
  [ "$name" = "*" ] && continue
  [ -f "$agent/CLAUDE.md" ] || { echo "  FAIL: $name missing CLAUDE.md"; continue; }
  [ -d "$agent/inbox" ] || { echo "  FAIL: $name missing inbox/"; continue; }
  [ -d "$agent/outbox" ] || { echo "  FAIL: $name missing outbox/"; continue; }
  echo "  OK: $name (inbox, outbox, CLAUDE.md)"
done

echo -e "\n6. Review lockfile?"
if [ -f "$BOARD_STATE/.review-lock" ]; then
  LOCK=$(cat "$BOARD_STATE/.review-lock")
  LOCK_PID=$(echo "$LOCK" | cut -d'|' -f2)
  ps -p "$LOCK_PID" &>/dev/null && echo "  ACTIVE: Review in progress ($LOCK)" || echo "  STALE: Lock exists but PID $LOCK_PID is dead. Safe to remove: rm $BOARD_STATE/.review-lock"
else
  echo "  OK: No lock"
fi

echo -e "\n7. Deferred items?"
[ -f "$BOARD_STATE/board/DEFERRED_WORK.md" ] && {
  count=$(grep -c '^\*\*\|^### \|^- \*\*' "$BOARD_STATE/board/DEFERRED_WORK.md" 2>/dev/null)
  echo "  Found: ~$count items in DEFERRED_WORK.md"
} || echo "  INFO: No deferred items file (normal for first review)"

echo -e "\n=== Done ==="