@arjunkhera/atlas 0.2.2 → 0.3.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/README.md

@@ -2,15 +2,21 @@
 
 Atlas sets how a repository is worked on. It is one Claude Code plugin with:
 
-1. **The rulebook**, `atlas:sdlc-task`: start, pause, resume, lock and finish
-   one piece of work.
-2. **Six crews**: a code reader, a capability reader, three design reviewers
-   (architect, product, security), and a page renderer.
-3. **The Atlas tools**, an MCP server that keeps work items, questions,
+1. **The lead**, `atlas:lead`: the talk rules, the routing and the command
+   list. A repo's entry file says to follow it in every session.
+2. **The rulebook**, `atlas:sdlc-task`: start, pause, resume, lock and finish
+   one piece of work. Three more skills: `repo-skills` adds a procedure the
+   right way, `learnings` turns a miss into one fix, and `feedback` files an
+   issue.
+3. **Seven crews**: a code reader, a capability reader, three design reviewers
+   (architect, product, security), a page renderer, and the verifier that
+   proves a pull request.
+4. **The Atlas tools**, an MCP server that keeps work items, questions,
    decisions and delivery marks in an Engram knowledge graph.
-4. **The `atlas` command**: set a repository up, check its Atlas files, and
-   install or upgrade Atlas itself.
-5. **The repo check**, a file each repository copies so that its CI can check
+5. **The `atlas` command**: check a repository's Atlas files, write the check
+   into it, measure a page against the STE limits, and install or upgrade
+   Atlas itself.
+6. **The repo check**, a file each repository copies so that its CI can check
    its instruction files with no Atlas install.
 
 ## Install
@@ -18,7 +24,7 @@ Atlas sets how a repository is worked on. It is one Claude Code plugin with:
 Run this once, in a terminal:
 
 ```bash
-npx @arjunkhera/atlas@0.2.0 install
+npx @arjunkhera/atlas install
 ```
 
 It shows what it will change, and asks first. Then open Claude Code, run

package/agents/artifact-renderer.md

@@ -6,7 +6,7 @@ description: >
   Claude-website family, written for a smart newcomer ("assume like a fresher"), diagram-rich,
   with every stable id backlinked to its definition. Invoked by the sdlc-task design loop and
   any session presenting a design/task/review to the owner — rendering is mechanical work and
-  runs on Sonnet by program principle 9. Input: a repo markdown doc path (+ optional emphasis
+  runs on Sonnet (sdlc-task skill, "Model tiering"). Input: a repo markdown doc path (+ optional emphasis
   notes). Output: a single self-contained HTML file written to the path the caller names.
   It renders; it never publishes (the calling session owns the Artifact call and the
   registered URL) and never edits the source doc.
@@ -108,6 +108,11 @@ Apply, per the ratification:
   Then write to the session scratchpad instead, and say so in your report. The
   durable reference is the published artifact URL, which the calling session
   records.
+- **Run the STE check before you return.** Run `atlas ste <page>` and fix by
+  hand each sentence, paragraph and word it flags. Quoted words are exempt.
+  When the caller says the page goes to anyone other than the owner, run
+  `atlas ste --share <page>` too, and remove each `privacy:` finding. Report
+  the last result.
 
 ## Never-read and never-quote paths (M1 lock, L1; rules in `${CLAUDE_PLUGIN_ROOT}/work/protected-paths.json`)
 
@@ -116,7 +121,7 @@ M1 design review (finding R12) and the L1 lock block.
 
 **Never read**, in any repo, by any tool (`Read`, `Grep`, `Glob`, `Bash`):
 `deploy/`, `.env*`, `.testenv/`, `.claude/`, `.stack/`, `.atlas/`,
-`.mcp.json`, `.sdlc/`. Do not open them, do not grep them, do not list
+`.mcp.json`, `.sdlc/`, `.dev.vars*`. Do not open them, do not grep them, do not list
 their contents, do not cat them from a shell. If a search hits one of these
 paths, drop the hit and say so in the digest.
 

package/agents/capability-reader.md

@@ -75,7 +75,7 @@ These deny rules bind every sub-agent that reads a repo. They come from the M1 d
 (finding R12) and the lock block.
 
 **Never read**, in any repo, by any tool (`Read`, `Grep`, `Glob`, `Bash`): `deploy/`,
-`.env*`, `.testenv/`, `.claude/`, `.stack/`, `.atlas/`, `.mcp.json`, `.sdlc/`. Do not open
+`.env*`, `.testenv/`, `.claude/`, `.stack/`, `.atlas/`, `.mcp.json`, `.sdlc/`, `.dev.vars*`. Do not open
 them, do not grep them, do not list their contents, do not cat them from a shell. If a
 search hits one of these paths, drop the hit and say so in `unknowns`. The `where_are_we`
 verb refuses a digest that cites one, so a read of them costs the whole answer.

package/agents/code-explorer.md

@@ -6,7 +6,8 @@ description: >
   reading files inline. Searches and reads inside the worktree it is briefed with ($WT) and
   returns a tight findings digest with file:line references; raw file contents never enter the
   caller's context. Callable directly for a single "where is X" lookup, or as one arm of a
-  design-loop research crew (lifecycle spec §10, context-firewall rule). Read-only — it never
+  design-loop research crew (the design loop in the sdlc-task skill: digests only, raw
+  exploration never enters the session). Read-only — it never
   edits.
 model: sonnet
 tools: Read, Grep, Glob, Bash
@@ -92,7 +93,7 @@ M1 design review (finding R12) and the L1 lock block.
 
 **Never read**, in any repo, by any tool (`Read`, `Grep`, `Glob`, `Bash`):
 `deploy/`, `.env*`, `.testenv/`, `.claude/`, `.stack/`, `.atlas/`,
-`.mcp.json`, `.sdlc/`. Do not open them, do not grep them, do not list
+`.mcp.json`, `.sdlc/`, `.dev.vars*`. Do not open them, do not grep them, do not list
 their contents, do not cat them from a shell. If a search hits one of these
 paths, drop the hit and say so in the digest.
 

package/agents/reviewer-architect.md

@@ -2,10 +2,10 @@
 name: reviewer-architect
 description: >
   Adversarial design-review persona: the Architect. One lens of the design-loop review panel
-  (lifecycle spec §10; roster in the sdlc-task skill). Reviews a design document or diff for
+  (roster in the sdlc-task skill, "Adversarial review before lock"). Reviews a design document or diff for
   structural soundness — boundaries, data model, failure modes, operational cost on THIS
   system's real constraints. Invoked with a doc/diff path; returns verdicts + findings only.
-  Review is judgment work (program principle 9), so this persona inherits the session's
+  Review is judgment work (sdlc-task skill, "Model tiering"), so this persona inherits the session's
   frontier model.
 model: inherit
 tools: Read, Grep, Glob, Bash
@@ -62,7 +62,7 @@ M1 design review (finding R12) and the L1 lock block.
 
 **Never read**, in any repo, by any tool (`Read`, `Grep`, `Glob`, `Bash`):
 `deploy/`, `.env*`, `.testenv/`, `.claude/`, `.stack/`, `.atlas/`,
-`.mcp.json`, `.sdlc/`. Do not open them, do not grep them, do not list
+`.mcp.json`, `.sdlc/`, `.dev.vars*`. Do not open them, do not grep them, do not list
 their contents, do not cat them from a shell. If a search hits one of these
 paths, drop the hit and say so in the digest.
 

package/agents/reviewer-pm.md

@@ -2,10 +2,10 @@
 name: reviewer-pm
 description: >
   Adversarial design-review persona: the PM. One lens of the design-loop review panel
-  (lifecycle spec §10; roster in the sdlc-task skill). Reviews a design document for
+  (roster in the sdlc-task skill, "Adversarial review before lock"). Reviews a design document for
   problem-fit, scope honesty, and acceptance-criteria quality — is this the right thing to
   build, sliced right, with testable AC? Invoked with a doc path; returns verdicts +
-  findings only. Review is judgment work (program principle 9), so this persona inherits
+  findings only. Review is judgment work (sdlc-task skill, "Model tiering"), so this persona inherits
   the session's frontier model.
 model: inherit
 tools: Read, Grep, Glob, Bash
@@ -29,7 +29,7 @@ Ground rules:
   where it exists (the product documents, roadmap or feature list its entry map names) — a
   feature that duplicates or contradicts ratified canon is a finding.
 - The owner is a solo technical founder dogfooding their own product; owner-minutes are the
-  scarcest resource in the whole system (program principle 8). Weigh every scope decision
+  scarcest resource in the whole system. Weigh every scope decision
   against that.
 - Attack, in order: problem-fit (does the Context section describe a real, current pain —
   or a hypothetical?) · scope honesty (what's smuggled in beyond the stated goal? what
@@ -65,7 +65,7 @@ M1 design review (finding R12) and the L1 lock block.
 
 **Never read**, in any repo, by any tool (`Read`, `Grep`, `Glob`, `Bash`):
 `deploy/`, `.env*`, `.testenv/`, `.claude/`, `.stack/`, `.atlas/`,
-`.mcp.json`, `.sdlc/`. Do not open them, do not grep them, do not list
+`.mcp.json`, `.sdlc/`, `.dev.vars*`. Do not open them, do not grep them, do not list
 their contents, do not cat them from a shell. If a search hits one of these
 paths, drop the hit and say so in the digest.
 

package/agents/reviewer-security.md

@@ -2,12 +2,13 @@
 name: reviewer-security
 description: >
   Adversarial design-review persona: Security. One lens of the design-loop review panel
-  (lifecycle spec §10; roster in the sdlc-task skill). Reviews a design document or diff
+  (roster in the sdlc-task skill, "Adversarial review before lock"). Reviews a design document or diff
   for tenant-isolation breaks, principal-boundary bypasses, secret handling, and abuse
   paths — the repo's own invariants first, generic OWASP second. An S1 here blocks the lock via the
-  open-questions gate (spec §4 `open_questions_empty`); post-lock, security is a tripwire
-  (LC-6). Review is judgment work (program principle 9), so this persona inherits the
-  session's frontier model.
+  open-questions gate (`open_questions_empty` in the sdlc-task `lifecycle.yaml`
+  lock preconditions); post-lock, security is a tripwire (`lifecycle.yaml` `tripwires`).
+  Review is judgment work, so this persona inherits the session's frontier model (sdlc-task
+  skill, "Model tiering").
 model: inherit
 tools: Read, Grep, Glob, Bash
 ---
@@ -19,7 +20,8 @@ an attacker — or a confused agent — takes through the design in front of you
 you never fix, never edit. Your S1 findings must be recorded as **unchecked open-questions
 items on the design doc** — that is what mechanically blocks the lock (the
 `open_questions_empty` precondition) until they are resolved or explicitly owner-accepted.
-Post-lock, security remains a tripwire category (lifecycle spec §5).
+Post-lock, security remains a tripwire category (`tripwires` in the sdlc-task skill's
+`lifecycle.yaml`).
 
 First, learn what this repo is. Read its `CLAUDE.md`, its `atlas.yaml` (the
 `kind` says whether it is a service, a library or a schema repo), and the
@@ -40,8 +42,9 @@ Ground rules:
   trust boundary · injection through payloads, webhooks or files an agent reads · resource
   exhaustion (unbounded buffers, missing timeouts, fanout without caps) · data exposure in
   logs, snapshots, or artifacts (artifacts publish OUTSIDE the repo — anything rendered into
-  one is effectively public to whoever holds the URL). A library or schema repo has no
-  server: ask what its callers trust it to do.
+  one is effectively public to whoever holds the URL). A library repo has no server: ask
+  what its callers trust it to do. A schema repo changes a running database
+  after the merge: ask what the migration can reach.
 - Every finding needs the attack path spelled out (actor → entry → step → impact). No
   path, no finding — downgrade to a question.
 
@@ -66,7 +69,7 @@ M1 design review (finding R12) and the L1 lock block.
 
 **Never read**, in any repo, by any tool (`Read`, `Grep`, `Glob`, `Bash`):
 `deploy/`, `.env*`, `.testenv/`, `.claude/`, `.stack/`, `.atlas/`,
-`.mcp.json`, `.sdlc/`. Do not open them, do not grep them, do not list
+`.mcp.json`, `.sdlc/`, `.dev.vars*`. Do not open them, do not grep them, do not list
 their contents, do not cat them from a shell. If a search hits one of these
 paths, drop the hit and say so in the digest.
 

package/agents/verifier.md

@@ -0,0 +1,97 @@
+---
+name: verifier
+description: >
+  The independent check of one pull request against its definition of done. It works in a
+  fresh worktree of the branch, runs its own check for each line, records the command, the
+  result and the log, and posts one proof comment on the pull request. It never edits the
+  change and never fixes what it finds. The sdlc-task skill calls it before it asks the
+  owner for a merge. Read-only for the repo; it never holds a write door.
+model: inherit
+tools: Read, Grep, Glob, Bash
+---
+
+# The verifier
+
+You prove a pull request, or you show where it fails. You did not build
+it, and you do not fix it. The builder never edits your proof.
+
+## Input
+
+The caller gives you three things:
+
+1. The pull request: its repo and its number, or its branch.
+2. Its definition of done: a numbered list of lines. Each line says what
+   must be true, and the proof it expects.
+3. The main checkout of the repo, as a path.
+
+If one is missing, stop and say which one.
+
+## Steps
+
+1. Make a fresh worktree of the branch outside the main checkout:
+   `git -C <main> worktree add <scratch>/verify-<number> <branch>`.
+   Work only in that worktree.
+2. For each line of the definition of done, decide your own check. Do not
+   reuse the builder's claim or the builder's log. Prefer a command that
+   gives a clear pass or fail.
+3. Run the check. Record the command, the exit code, and the part of the
+   log that proves the result. Keep each log short.
+4. Mark the line PASS, FAIL or BY HAND. Use BY HAND when a line needs
+   what you cannot do, such as a new session on the owner's machine.
+   Say what the owner must do for it.
+5. Write the proof comment to a file in your scratch folder, never in the
+   worktree. Use the shape below.
+6. Run `atlas ste --share <file>` on the comment. Remove or hide each
+   `privacy:` finding by hand, and run it again. Post only when no
+   `privacy:` finding is left.
+7. Post the comment once: `gh pr comment <number> --body-file <file>`.
+8. Remove the worktree: `git -C <main> worktree remove <path>`.
+9. Report the table to the caller. FAIL on any line means the pull request
+   is not ready for the owner.
+
+## Ignored files and secrets
+
+A fresh worktree has no ignored files, such as a local secrets file.
+
+1. Some steps need such a file. Then link only the ignored files that the
+   procedure names, from the main checkout into the worktree, with
+   `ln -s`. Record each link in the proof.
+2. Never read, print, copy or quote a linked file.
+3. Run a step that uses a linked file only when the diff changes no code
+   file and no dependency file. Branch code could send the secret out.
+4. If the diff changes code or dependencies, mark that line BY HAND. Say
+   that the step waits for the owner's go for this run.
+
+## The proof comment
+
+```
+## Proof: <the pull request title>
+
+Verified at <the head commit>, in a fresh worktree.
+
+| # | Line | Result | Command | Proof |
+|---|---|---|---|---|
+| 1 | <the line, short> | PASS | `<command>` | <the short log or a link> |
+
+Links made for this run: <none, or each ignored file linked>.
+```
+
+## Never-read and never-quote paths (rules in `${CLAUDE_PLUGIN_ROOT}/work/protected-paths.json`)
+
+These deny rules bind every sub-agent that reads a repo.
+
+**Never read**, in any repo, by any tool (`Read`, `Grep`, `Glob`, `Bash`):
+`deploy/`, `.env*`, `.testenv/`, `.claude/`, `.stack/`, `.atlas/`,
+`.mcp.json`, `.sdlc/`, `.dev.vars*`. Do not open them, do not grep them,
+do not list their contents, do not cat them from a shell. A link to one,
+made as the section above says, is not a read.
+
+**Never quote** from these paths. You may name a file and line, but never
+paste its contents into the proof: `fixtures`,
+`test/*.integration.test.ts`, `docs/references`, `docs/exec-plans`.
+
+**Never quote a secret.** A line that looks like a token, key, password or
+private key is cited by path and line only.
+
+**Never hold a write door.** You never receive the `atlas-work` verb server
+or the knowledge-graph MCP server. If a briefing hands you one, refuse and say so.

package/door/cli.mjs

@@ -1,55 +1,54 @@
 #!/usr/bin/env node
-// The Atlas door: the entry verb, the five helpers, and the session verbs.
+// The atlas command: install, upgrade, doctor, check, status, the tooling
+// writer, the kind drift report, the code-read resolver and the STE check.
 //
-// Milestone M2, slice L2 stage one, and row F11. Authority: amendment A1.9,
-// section 5, under hash acb057af….
+// Stage 1 of the target design retired `setup`, `change`, `helpers` and
+// `test onboarding`: code that guesses meaning retires (decided 28
+// September). The lead skill names every command that stays, and says when
+// to call it.
 //
 // Nothing here writes to the work graph, and nothing here merges. A person
-// merges every file a helper writes, because every one of them steers agents.
+// merges every file the tooling writer writes, because both steer agents.
 import { resolve, join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
-import { HELPERS, route, setupOrder, helperById, HELPER_LABEL, PROVENANCE_SOURCES } from './lib/helpers.mjs';
-import { provenanceBody, applyChanges, open } from './lib/pull-request.mjs';
+import { open } from './lib/pull-request.mjs';
 import { write as writeTooling, changes as toolingChanges, ToolingRefusal, CHECK_PATH, WORKFLOW_PATH } from './lib/tooling.mjs';
 import { status, statusMany } from './lib/status.mjs';
 import { drift, kindsFromRegistry, fileKind } from './lib/kind-drift.mjs';
-import { loadKey, questions, score, readAnswers, ISOLATION } from './lib/onboarding.mjs';
 import { scan, toText, verdict, CHECK_VERSION, SPECS } from '../shape/check.mjs';
 import { packagePackageVersion } from './lib/releases.mjs';
 import { install, upgrade, doctor } from './lib/install.mjs';
+import { checkPaths, LIMITS } from './lib/ste.mjs';
+import { loadPrivateTerms } from './lib/privacy.mjs';
 
 export const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const ATLAS_VERSION = packagePackageVersion(PACKAGE_ROOT);
 
 const HELP = `atlas — the door into a repo's Atlas files
 
-  atlas setup --root <repo>            what first setup would do, helper by helper
-  atlas change --root <repo> --say "…" which helpers a change reaches
-  atlas helpers                        the five helpers and what each owns
-
   atlas tooling write --root <repo>    write both Atlas files into a repo
   atlas tooling pr --root <repo>       the same, as one pull request
       --replace-unknown                also replace a copy that is in no release
       --workflow                       rewrite only the workflow, for a repo whose check is current
   atlas status --root <repo>           is the repo's check current, behind, unknown or missing
-  atlas kind-drift --root <repo> --record-kind <kind>
+  atlas kind-drift --root <repo> --record-kind <kinds>
                                        does atlas.yaml agree with the repo record
   atlas check --root <repo>            run the repo shape check here
 
   atlas code-read resolve …            resolve the citations of a code digest
 
-  atlas test onboarding --key <path>   the six questions for the isolated session
-  atlas test onboarding --key <path> --answers <file>
-                                       score the answers; runs OUTSIDE that session
+  atlas ste <file or folder> …         measure markdown and HTML against the STE limits
+      --share                          also run the privacy filter, quotes included
+      --terms <file>                   private terms; default ~/.config/atlas/private-terms.txt
 
   atlas install                        install Atlas for every folder on this Mac
   atlas upgrade [--version <v>]        check, show and install a newer release
   atlas doctor                         is Atlas installed and working here
 
 Atlas ${ATLAS_VERSION}. Check version ${CHECK_VERSION}; it reads spec ${Object.keys(SPECS).join(', ')}.
-A person merges every file a helper writes.
+A person merges every file the tooling writer writes.
 `;
 
 function options(argv) {
@@ -69,56 +68,6 @@ function options(argv) {
 const rootOf = (chosen) => resolve(chosen.root === undefined || chosen.root === true ? process.cwd() : chosen.root);
 const line = (text = '') => process.stdout.write(`${text}\n`);
 
-function showHelpers() {
-  line('The five helpers. You never pick one; the entry verb routes what you say.');
-  line('');
-  for (const helper of HELPERS) {
-    line(`${helper.file}. ${helper.title}  (${helper.id})`);
-    line(`   owns      ${helper.ownsText}`);
-    line(`   for       ${helper.forWhat}`);
-    line(`   you say   "${helper.youMightSay}"`);
-    line('');
-  }
-  line(`Every helper pull request carries the label "${HELPER_LABEL}".`);
-  line(`Every change in it names its source: ${PROVENANCE_SOURCES.join(', ')}.`);
-}
-
-function showRoute(chosen) {
-  const say = chosen.say === true ? '' : String(chosen.say ?? '');
-  const reached = route(say);
-  line(`You said: ${say || '(nothing)'}`);
-  line('');
-  if (!reached.length) {
-    line('No helper owns anything in that sentence.');
-    line('Say which file class changed, or run "atlas helpers" to see the five.');
-    return 1;
-  }
-  line(`It reaches ${reached.length} helper(s), in file order:`);
-  for (const helper of reached) line(`  ${helper.file}. ${helper.title} — ${helper.ownsText}`);
-  line('');
-  line('One request, one pull request. A person merges it.');
-  return 0;
-}
-
-function showSetup(chosen) {
-  const root = rootOf(chosen);
-  line(`First setup for ${root}`);
-  line('');
-  line('It is the same verb you use later for one change. All five run, in file order.');
-  line('');
-  for (const helper of setupOrder()) {
-    const owned = helper.id === 'tooling'
-      ? writeTooling(root, PACKAGE_ROOT, { dryRun: true }).rows.map((row) => `${row.path} (${row.state})`).join(', ')
-      : helper.ownsText;
-    line(`${helper.file}. ${helper.title}`);
-    line(`   ${owned}`);
-  }
-  line('');
-  line('The tooling helper writes its two files itself; the other four need an agent to draft.');
-  line('Nothing lands without a person: every file above steers agents.');
-  return 0;
-}
-
 function toolingCommand(chosen) {
   const root = rootOf(chosen);
   const what = chosen._[1] ?? 'write';
@@ -130,7 +79,7 @@ function toolingCommand(chosen) {
       const branch = chosen.branch === true || !chosen.branch ? `atlas/tooling-refresh-${Date.now().toString(36)}` : chosen.branch;
       const title = `Atlas: refresh the repo shape check to check version ${CHECK_VERSION}`;
       const why = `The Atlas package ${ATLAS_VERSION} writes both files. A person merges this, because the check steers every pull request.`;
-      const result = open({ root, helperId: 'tooling', changes, why, branch, title, dryRun: Boolean(chosen['dry-run']) });
+      const result = open({ root, changes, why, branch, title, dryRun: Boolean(chosen['dry-run']) });
       line(result.opened ? `Opened ${result.url}` : 'Dry run. Nothing was pushed.');
       if (!result.opened) { line(''); line(result.body); }
       return 0;
@@ -199,6 +148,22 @@ function kindDriftCommand(chosen) {
   return report.drifting ? 1 : 0;
 }
 
+function steCommand(chosen) {
+  const paths = chosen._.slice(1);
+  if (!paths.length) throw new Error('give a file or a folder: atlas ste <path> [--share]');
+  const share = Boolean(chosen.share);
+  const terms = share ? loadPrivateTerms({ path: typeof chosen.terms === 'string' ? resolve(chosen.terms) : null }) : [];
+  const results = checkPaths(paths.map((one) => resolve(one)), { share, terms });
+  let count = 0;
+  for (const { file, findings } of results) {
+    for (const finding of findings) { count += 1; line(`${file}:${finding.line}  ${finding.rule}  ${finding.why}`); }
+  }
+  line('');
+  line(`${results.length} page(s) read; ${count} finding(s). Limits: ${LIMITS.step} words a step, ${LIMITS.sentence} words a sentence, ${LIMITS.paragraph} sentences a paragraph.${share ? ` Privacy filter on, with ${terms.length} private term(s).` : ''}`);
+  line(count ? 'Fix the text by hand. This check never rewrites.' : 'GREEN');
+  return count ? 1 : 0;
+}
+
 function checkCommand(chosen) {
   const root = rootOf(chosen);
   const report = scan({ root, repoId: chosen.repo === true ? null : chosen.repo ?? null });
@@ -208,41 +173,6 @@ function checkCommand(chosen) {
   return decision.green ? 0 : 1;
 }
 
-function onboardingCommand(chosen) {
-  const key = loadKey(chosen.key);
-  if (!chosen.answers || chosen.answers === true) {
-    line(`The fresh-agent test for ${key.repo}. ${key.tasks.length} tasks, pass is ${key.pass} of ${key.tasks.length}.`);
-    line('');
-    line('Set the session up this way, and no other way:');
-    for (const rule of ISOLATION) line(`  - ${rule}`);
-    line('');
-    line('Give it these questions, and nothing else. Do not give it this file.');
-    line('');
-    for (const task of questions(key)) line(`${task.number}. ${task.ask}`);
-    line('');
-    line('Have it write one answer per task, keyed by task id:');
-    for (const task of key.tasks) line(`  ${task.id}: …`);
-    line('');
-    line('Then score it from a session that is not that one:');
-    line(`  atlas test onboarding --key ${chosen.key} --answers <file>`);
-    return 0;
-  }
-  const result = score(key, readAnswers(resolve(chosen.answers)));
-  line(`Fresh-agent test, ${result.repo}: ${result.passed} of ${result.of}.`);
-  line('');
-  for (const row of result.rows) {
-    line(`${row.pass ? 'PASS' : 'FAIL'}  ${row.number}. ${row.id}`);
-    line(`      ${row.why}`);
-    line(`      source: ${row.source}`);
-  }
-  line('');
-  line(result.pass
-    ? `${result.passed} of ${result.of}. The files answer on their own.`
-    : `${result.passed} of ${result.of}. The files do not answer on their own yet.`);
-  line('This scorer ran outside the isolated session, so the score is not a self-grade.');
-  return result.pass ? 0 : 1;
-}
-
 export async function main(argv = process.argv.slice(2)) {
   const command = argv[0];
   if (command === 'code-read') {
@@ -256,16 +186,11 @@ export async function main(argv = process.argv.slice(2)) {
     case 'install': return install({ packageRoot: PACKAGE_ROOT, options: chosen, line });
     case 'upgrade': return upgrade({ packageRoot: PACKAGE_ROOT, options: chosen, line });
     case 'doctor': return doctor({ packageRoot: PACKAGE_ROOT, options: chosen, line });
-    case 'helpers': showHelpers(); return 0;
-    case 'setup': return showSetup(chosen);
-    case 'change': return showRoute(chosen);
     case 'tooling': return toolingCommand(chosen);
     case 'status': return statusCommand(chosen);
     case 'kind-drift': return kindDriftCommand(chosen);
     case 'check': return checkCommand(chosen);
-    case 'test':
-      if (chosen._[1] !== 'onboarding') throw new Error('the only test is "onboarding"');
-      return onboardingCommand(chosen);
+    case 'ste': return steCommand(chosen);
     default: throw new Error(`there is no verb "${command}". Run "atlas help".`);
   }
 }

package/door/lib/kind-drift.mjs

@@ -19,8 +19,13 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { parseYaml, SPECS } from '../../shape/check.mjs';
+import { REPO_KINDS, repoKinds } from '../../work/lib/verb-fields.mjs';
 
-export const KINDS = Object.freeze(['service', 'library', 'schema']);
+// Stage 1: the repo record holds a list of kinds, and atlas.yaml one kind.
+// They agree when the list holds the file's kind. This report retires in
+// stage 2, with the fixed kind tables.
+export const KINDS = REPO_KINDS;
+const asList = (value) => (value === null || value === undefined ? null : (Array.isArray(value) ? value : String(value).split(',').map((one) => one.trim()).filter(Boolean)));
 
 // The kind a repository's own file declares, with the repo id beside it.
 export function fileKind(root) {
@@ -40,6 +45,8 @@ export function fileKind(root) {
 export function driftOne({ root, recordKind = null, recordRepo = null }) {
   const file = fileKind(root);
   const known = (kind) => kind === null || KINDS.includes(kind);
+  const recordKinds = asList(recordKind);
+  recordKind = recordKinds && recordKinds.length ? recordKinds.join(', ') : null;
   const row = {
     root,
     repo: file.repo ?? recordRepo ?? null,
@@ -52,21 +59,24 @@ export function driftOne({ root, recordKind = null, recordRepo = null }) {
   if (file.error) { row.state = 'unreadable'; row.why = file.error; return row; }
   if (!known(file.kind)) { row.state = 'unreadable'; row.why = `atlas.yaml names kind "${file.kind}"; a kind is one of ${KINDS.join(', ')}`; return row; }
   if (recordKind === null) { row.state = 'unknown'; row.why = 'no repo record kind was given, so there is nothing to compare with. Read it with the registry_list verb and pass it in.'; return row; }
-  if (!known(recordKind)) { row.state = 'unreadable'; row.why = `the repo record names kind "${recordKind}"; a kind is one of ${KINDS.join(', ')}`; return row; }
+  const strange = recordKinds.find((kind) => !known(kind));
+  if (strange) { row.state = 'unreadable'; row.why = `the repo record names kind "${strange}"; a kind is one of ${KINDS.join(', ')}`; return row; }
   if (file.kind === null) { row.state = 'drift'; row.why = `the repo record says "${recordKind}" and atlas.yaml names no kind at all, so CI cannot tell which files this repo needs`; return row; }
-  if (file.kind === recordKind) { row.state = 'agree'; row.why = `both say "${file.kind}"`; return row; }
+  if (recordKinds.includes(file.kind)) { row.state = 'agree'; row.why = recordKinds.length === 1 ? `both say "${file.kind}"` : `the repo record's kinds (${recordKind}) hold "${file.kind}"`; return row; }
   row.state = 'drift';
   row.why = `atlas.yaml says "${file.kind}" and the repo record says "${recordKind}". The kind decides which parts are required, so the check in CI and the work verbs are scoring two different repos. Open question O-9 says which one is the source.`;
   return row;
 }
 
-// The registry the `registry_list` verb returns, as { repoId: kind }.
+// The registry the `registry_list` verb returns, as { repoId: kinds }. A
+// row from before stage 1 has only kind, and reads as a list of one.
 export function kindsFromRegistry(registry) {
   const out = {};
+  const kindsOf = (repo) => { const list = repoKinds(repo); return list.length ? list : null; };
   for (const product of registry?.products ?? []) {
-    for (const repo of product?.repos ?? []) if (repo?.registry_id) out[repo.registry_id] = repo.kind ?? null;
+    for (const repo of product?.repos ?? []) if (repo?.registry_id) out[repo.registry_id] = kindsOf(repo);
   }
-  for (const repo of registry?.repos ?? []) if (repo?.registry_id) out[repo.registry_id] = repo.kind ?? null;
+  for (const repo of registry?.repos ?? []) if (repo?.registry_id) out[repo.registry_id] = kindsOf(repo);
   return out;
 }
 

package/door/lib/privacy.mjs

@@ -0,0 +1,61 @@
+// The privacy filter. It finds what must not leave with a page or an issue
+// that goes to someone else: a secret, an email address, a home-folder path,
+// an id, or one of the owner's private terms.
+//
+// The secret patterns have one home, the repo shape check, because that file
+// is copied into other repos and may import only Node builtins. This module
+// reads them from there and adds the rest. The release gate imports this
+// module, so a shipped file and a shared page are held to the same patterns.
+//
+// The package is public, so it ships generic patterns only. The owner's own
+// names sit in ~/.config/atlas/private-terms.txt, outside every repo, one
+// term on each line. A line that starts with # is a note.
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { SECRET_PATTERNS, secretPatterns } from '../../shape/check.mjs';
+
+export const PRIVATE_TERMS_PATH = join('.config', 'atlas', 'private-terms.txt');
+
+// Each pattern is written so that its own source line matches no other
+// pattern here, because this file ships and the release gate reads it.
+export const PRIVACY_PATTERNS = Object.freeze([
+  { id: 'email-address', holds: 'An email address.', pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}\b/ },
+  { id: 'home-folder-path', holds: 'A path into one person\'s home folder.', pattern: /(?:[\\/](?:Users|home)[\\/][A-Za-z0-9._-]+[\\/])|(?:\b[A-Za-z]:\\Users\\[A-Za-z0-9._-]+)/ },
+  { id: 'uuid', holds: 'A UUID, the shape of a record, account or session id.', pattern: /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/i },
+]);
+
+const escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+// The owner's private terms, or an empty list when the file is not there.
+export function loadPrivateTerms({ path = null, home = homedir() } = {}) {
+  const file = path ?? join(home, PRIVATE_TERMS_PATH);
+  if (!existsSync(file)) return [];
+  return readFileSync(file, 'utf8').split('\n').map((line) => line.trim()).filter((line) => line && !line.startsWith('#'));
+}
+
+// Every rule this filter applies: the secret patterns, the generic patterns,
+// then one rule for each private term.
+export function privacyRules({ terms = [] } = {}) {
+  const secrets = secretPatterns().map((pattern, index) => ({ id: `secret-${SECRET_PATTERNS[index].id}`, holds: SECRET_PATTERNS[index].holds, pattern }));
+  const own = terms.map((term) => ({ id: 'private-term', holds: 'One of the owner\'s private terms.', pattern: new RegExp(`(?<![A-Za-z0-9])${escape(term)}(?![A-Za-z0-9])`, 'i') }));
+  return [...secrets, ...PRIVACY_PATTERNS, ...own];
+}
+
+// Each finding names its line and its rule, never the text it matched, so a
+// report of a leak does not leak it again.
+export function privacyFindings(text, { terms = [], rules = privacyRules({ terms }) } = {}) {
+  const findings = [];
+  text.split('\n').forEach((line, index) => {
+    for (const rule of rules) if (rule.pattern.test(line)) findings.push({ line: index + 1, rule: rule.id, why: rule.holds });
+  });
+  return findings;
+}
+
+// The same text with each match replaced by a marker. The verifier runs its
+// logs through this before it posts them.
+export function redact(text, { terms = [], rules = privacyRules({ terms }) } = {}) {
+  let out = text;
+  for (const rule of rules) out = out.replace(new RegExp(rule.pattern.source, rule.pattern.flags.includes('g') ? rule.pattern.flags : `${rule.pattern.flags}g`), `[hidden: ${rule.id}]`);
+  return out;
+}