fix: story tasks get Project field; elaborate reads worklog; deploy chmod scripts

- handleApproveStory: set Project = input.ProjectID on tasks and subtasks so
  the executor can resolve RepositoryURL from the project registry (was causing
  "task has no repository_url" on every story task)
- elaborate.go: read .agent/worklog.md instead of SESSION_STATE.md for project
  context injected into elaboration prompts
- deploy: explicitly chmod +x all scripts before restart (same root cause as
  the binary execute-bit loss — chown -R was stripping it)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

4 files changed, 11 insertions, 5 deletions

diff --git a/internal/api/elaborate.go b/internal/api/elaborate.go
index b6bc4e5..dd51c7d 100644
--- a/internal/api/elaborate.go
+++ b/internal/api/elaborate.go
@@ -170,7 +170,7 @@ func readProjectContext(workDir string) string {
 		return ""
 	}
 	var sb strings.Builder
-	for _, filename := range []string{"CLAUDE.md", "SESSION_STATE.md"} {
+	for _, filename := range []string{"CLAUDE.md", ".agent/worklog.md"} {
 		path := filepath.Join(workDir, filename)
 		if data, err := os.ReadFile(path); err == nil {
 			if sb.Len() > 0 {
diff --git a/internal/api/elaborate_test.go b/internal/api/elaborate_test.go
index 5216bcd..32cec3c 100644
--- a/internal/api/elaborate_test.go
+++ b/internal/api/elaborate_test.go
@@ -390,14 +390,17 @@ func createFakeClaudeCapturingArgs(t *testing.T, output string, exitCode int, ar
 func TestElaborateTask_WithProjectContext(t *testing.T) {
 	srv, _ := testServer(t)
 
-	// Create a temporary workspace with CLAUDE.md and SESSION_STATE.md
+	// Create a temporary workspace with CLAUDE.md and .agent/worklog.md
 	workDir := t.TempDir()
 	claudeContent := "Claude context info"
 	sessionContent := "Session state info"
 	if err := os.WriteFile(filepath.Join(workDir, "CLAUDE.md"), []byte(claudeContent), 0600); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(workDir, "SESSION_STATE.md"), []byte(sessionContent), 0600); err != nil {
+	if err := os.MkdirAll(filepath.Join(workDir, ".agent"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(workDir, ".agent", "worklog.md"), []byte(sessionContent), 0600); err != nil {
 		t.Fatal(err)
 	}
 
@@ -438,7 +441,7 @@ func TestElaborateTask_WithProjectContext(t *testing.T) {
 		t.Errorf("expected arguments to contain CLAUDE.md content, got %s", argsStr)
 	}
 	if !strings.Contains(argsStr, sessionContent) {
-		t.Errorf("expected arguments to contain SESSION_STATE.md content, got %s", argsStr)
+		t.Errorf("expected arguments to contain .agent/worklog.md content, got %s", argsStr)
 	}
 }
 
diff --git a/internal/api/stories.go b/internal/api/stories.go
index 2f26040..fcf8c48 100644
--- a/internal/api/stories.go
+++ b/internal/api/stories.go
@@ -253,6 +253,7 @@ func (s *Server) handleApproveStory(w http.ResponseWriter, r *http.Request) {
 		t := &task.Task{
 			ID:        uuid.New().String(),
 			Name:      tp.Name,
+			Project:   input.ProjectID,
 			StoryID:   story.ID,
 			Agent:     task.AgentConfig{Type: "claude", Instructions: tp.Instructions},
 			Priority:  task.PriorityNormal,
@@ -277,6 +278,7 @@ func (s *Server) handleApproveStory(w http.ResponseWriter, r *http.Request) {
 			st := &task.Task{
 				ID:           uuid.New().String(),
 				Name:         sub.Name,
+				Project:      input.ProjectID,
 				StoryID:      story.ID,
 				ParentTaskID: t.ID,
 				Agent:        task.AgentConfig{Type: "claude", Instructions: sub.Instructions},
diff --git a/scripts/deploy b/scripts/deploy
index 7c7dc66..1a08fc5 100755
--- a/scripts/deploy
+++ b/scripts/deploy
@@ -53,8 +53,9 @@ echo "==> Fixing permissions..."
 echo "==> Syncing credentials..."
 "${REPO_DIR}/scripts/sync-credentials"
 
-echo "==> Ensuring binary is executable..."
+echo "==> Ensuring binary and scripts are executable..."
 chmod +x "${BIN_DIR}/claudomator" /usr/local/bin/claudomator
+find "${SITE_DIR}/scripts" -maxdepth 1 -type f -exec chmod +x {} +
 
 echo "==> Restarting service..."
 sudo systemctl restart "${SERVICE}"