clean

Five categories, gathered first, shown together, agreed once, removed once. Nothing is removed
before the operator has answered, and nothing outside the agreed categories is touched.

The repository is /Users/antony/projects/polycode-public/concordance. Every command runs from
there with git -C or an explicit cd; a worktree is never the working directory for this skill.

Part 1: gather

Read, do not assume. Run all five gathers before showing anything.

1. Failed stacks. Needs an SSO session (aws sso login --profile polycode-sandbox); without
one, report the category as "unverified: no SSO session" and leave it out of the question.

aws --profile polycode-sandbox --region eu-west-2 cloudformation list-stacks \
  --stack-status-filter ROLLBACK_COMPLETE DELETE_FAILED CREATE_FAILED UPDATE_ROLLBACK_FAILED \
  --query "StackSummaries[?starts_with(StackName,'concordance-')].[StackName,StackStatus,CreationTime]" --output text

A stack in ROLLBACK_COMPLETE or DELETE_FAILED is a candidate. Never list a stack in
CREATE_COMPLETE or UPDATE_COMPLETE: those are the live sandbox, and deploy.yml owns them.

2. Merged branches, local and origin. git fetch --prune origin first. Run the loop under
bash (the session shell is zsh, which does not split $files on newlines and so reports every
branch as content-on-main):

bash <<'SCRIPT'
for ref in $(git for-each-ref --format='%(refname:short)' refs/heads refs/remotes/origin \
             | grep -v -E '^(main|origin|origin/main|origin/HEAD)$'); do
  ahead=$(git rev-list --count main..$ref)
  if [ "$ahead" = 0 ]; then echo "$ref merged"; else
    files=$(git diff --name-only main...$ref)
    if [ -z "$files" ] || git diff --quiet main $ref -- $files; then echo "$ref content-on-main ($ahead commits)"; else echo "$ref UNIQUE ($ahead commits)"; fi
  fi
done
SCRIPT

merged and content-on-main (a squashed worktree branch whose every change already sits on
main) are candidates. UNIQUE never is; list it under "kept" with its commit count so the
operator sees it. A branch with an open PR is kept whatever the diff says
(gh pr list --state open --json headRefName).

3. Worktrees of merged branches. git worktree list --porcelain; a worktree is a candidate
when its branch is a candidate in category 2. Run git status --short inside each candidate
first: one with uncommitted tracked changes is kept and reported, because removal would lose that
work. Untracked node_modules does not count.

4. Logs and test artefacts. Globs run under bash with shopt -s nullglob, since an unmatched
glob aborts a zsh command. At the repository root: *.log, coverage/, test-results/,
target/, .cache/, and the same under every worktree. Never .env, models/ (pulled Ollama
models) or corpora/*/raw (downloaded source documents): they cost a download to rebuild, so they
stay unless the operator names them.

5. Build output and libraries. cdk.out/ and node_modules/ (followed by npm ci), and
node_modules/ under every worktree that survives category 3. Show sizes with du -sh.
Everything here is regenerated by the next build or install, so this category is cheap and safe;
anything that is not both stays out of it. The Docker volume that holds the Postgres data is not
build output; npm run db:down stops the database and never removes the volume.

Part 2: show and ask

One table, one row per category, with the count, the size where it is known, and the names in full
(a stack, a branch, a worktree path, a file). Categories that are empty are not shown and not
asked about. Then one AskUserQuestion with multiSelect: true, one option per non-empty
category, each option's description naming what it removes. No removal before the answer.

Part 3: remove, all agreed categories in one go

Run the agreed removals in category order and report each command's result.

• Stacks. An AWS write outside the workflow is the operator's: print
  ! aws --profile polycode-sandbox --region eu-west-2 cloudformation delete-stack --stack-name <name>
  in full for each, and read the stack's status afterwards when the operator says it ran.
• Branches. git branch -D <local…> and git push origin --delete <remote…>.
• Worktrees. git worktree remove --force --force <path> for each (the doubled flag overrides
  locks), joined with ;, then git worktree prune.
• Logs and artefacts. rm -f the files and rm -rf the directories named in the table.
• Build output. rm -rf cdk.out node_modules, then npm ci in the foreground with a 600 s
  timeout.

git worktree remove, git branch -D and git push --delete can be denied to the session by the
permission settings. When a command is denied, print the whole remaining block for that category
in a fenced block prefixed with !, in full, and carry on with the next category; the operator
runs the block or leaves it, and nothing else waits on it.

Part 4: back to main

"Ongoing work" means any of: uncommitted tracked changes in the primary checkout (git status --short with untracked files ignored), a worktree kept in category 3 because it holds uncommitted
work, or a local branch reported UNIQUE in category 2 with no PR. When none of these exists:

git -C /Users/antony/projects/polycode-public/concordance fetch --prune origin
git -C /Users/antony/projects/polycode-public/concordance checkout main
git -C /Users/antony/projects/polycode-public/concordance pull --ff-only origin main

When ongoing work exists, say what it is and leave the checkout where it is.

Report

Fact first: what was removed, per category, with counts; then what was kept and why (a UNIQUE
branch, a dirty worktree, a live stack); then any block handed to the operator; then the branch
the checkout is on and its head. Nothing else.