@arjunkhera/atlas 0.4.29 → 0.4.31

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.4.29",
+  "version": "0.4.31",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.29",
+  "version": "0.4.31",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/skills/learnings/SKILL.md

@@ -22,21 +22,35 @@ and makes it hard to miss again.
 
 1. **Name the lesson** in one plain sentence. Say what went wrong and
    what is right.
-2. **Pick one home.**
+2. **Look for a repeat.** Call `lessons` for the product. Read each line.
+   When an earlier lesson says the same thing, this lesson is a repeat.
+   Keep that lesson's id, and read its fix: the fix did not hold, so make
+   the new fix stronger.
+3. **Pick one home.**
    - The lesson holds only for this repo: it becomes a change here.
    - The lesson holds for every repo: it becomes an Atlas item.
-3. **For an Atlas lesson,** propose an item in the Atlas tracker, with
+4. **For an Atlas lesson,** propose an item in the Atlas tracker, with
    the Atlas tools. Put the owner's words in it, word for word. Tag it
    `learning`. Link it to the repo where the miss happened. Tell the owner
    the item and that an Atlas release, on their word, closes it.
-4. **Pick the strongest form that fits,** in this order:
+5. **Pick the strongest form that fits,** in this order:
    1. a check that fails when the miss happens again;
    2. a tool that makes the right way the easy way;
    3. a skill step;
    4. a line in a doc, with a short note.
-5. **Prune.** A new rule retires or merges each rule it replaces. Name
+6. **Prune.** A new rule retires or merges each rule it replaces. Name
    the rules you removed in the pull request.
-6. **Make the change** in its home, through the normal flow.
+7. **Make the change** in its home, through the normal flow.
+8. **Record the lesson.** Call `lesson_record` once, when the fix exists:
+   - `line`: the sentence of step 1;
+   - `home`: `repo` with the repo id, or `atlas`;
+   - `form`: `check`, `tool`, `skill` or `doc`;
+   - `fix`: the pull request, or the Atlas item of step 4;
+   - `source`: `owner`, `revert`, `bug` or `machine`, and in `source_ref`
+     the step-in, the revert or the bug;
+   - `repeats`: the id that step 2 found, if any.
+9. **Link the step-in.** When the owner's message started the lesson, call
+   `step_in_name` on that step-in with the lesson id as `lesson`.
 
 ## Rules
 
@@ -46,3 +60,4 @@ and makes it hard to miss again.
 2. A lesson about one repo's product stays in that repo. It never goes
    into an Atlas release.
 3. One lesson is one fix. Do not batch unrelated lessons.
+4. Every lesson leaves one record, a repo lesson too. Never skip step 8.

package/skills/sdlc-task/SKILL.md

@@ -202,11 +202,12 @@ next action. One short paragraph.
    option (owner, 22 October 2026). Fix the test first. If the owner still
    approved a merge with one known red test, record the words
    with `decision_record` on the item. The words must name the pull request
-   and quote the exact test. One decision accepts one red check. Then pass
-   `accepted_red` to `item_done`; it needs the owner present. Any other red
-   check still refuses the mark.
-2. If anything was a struggle, encode the fix where it stops a repeat — a lint,
-   then a tool, then a skill, then a doc — and say which.
+   and quote the exact test. One decision accepts one red check. The owner
+   then signs a waiver act on his Mac with `atlas approve` and posts the
+   block on the pull request. Then pass `accepted_red` to `item_done`; it
+   needs the owner present. Any other red check still refuses the mark.
+2. If anything was a struggle, run the `atlas:learnings` skill. It picks the
+   home and the form of the fix, and records the lesson.
 3. Rebuild the design's page and the hub, so both read "Shipped". The
    design folder does not change: the tracker holds the delivery. A design
    in the older format is one file, not a folder. Keep its page, and rebuild

package/work/lib/delivery.mjs

@@ -16,6 +16,7 @@ import { refuse, text, isoDate, url, stringList, sha256, repoKinds, LIVE_KINDS }
 import { oneLine, ROW_LINE_MAX, priorityOrderOf, byPriority, orderNote, waitsOnLine, blockersOf, blocksOf, blockedPhrase, waitsShown } from './questions.mjs';
 import { parseYaml } from '../../shape/check.mjs';
 import { ACTIONS_APP_ID } from '../../door/lib/gate.mjs';
+import { MARKER as SIGNED_MARKER, SIGNERS_FILE, parseSigners, verifyTexts, findAct } from '../../door/lib/signed-act.mjs';
 
 export const DELIVERY_WRITE_VERBS = Object.freeze(['item_done', 'item_reopen']);
 export const DELIVERY_READ_VERBS = Object.freeze(['in_flight']);
@@ -147,10 +148,20 @@ export function requiredStates(names, headRuns, mergeRuns) {
   });
 }
 
+// R17 line 2: a skipped check names what each commit saw. A check can be
+// skipped on the head and never run on the merge commit.
+const SIDE = { head: 'the head', merge: 'the merge commit' };
+function skippedSides(row) {
+  const seen = Array.isArray(row.seen) ? row.seen : [];
+  if (seen.every((one) => one.state === 'skipped')) return 'was skipped on the head and on the merge commit';
+  return seen.map((one) => (one.state === 'skipped' ? `was skipped on ${SIDE[one.on] ?? one.on}`
+    : one.state === 'missing' ? `never ran on ${SIDE[one.on] ?? one.on}` : `ended ${one.conclusion ?? one.state} on ${SIDE[one.on] ?? one.on}`)).join(' and ');
+}
+
 export const requiredWhy = (row) => ({
   pending: `${row.name} is still running`,
   red: `${row.name} is red (${row.seen.map((one) => `${one.on} ${one.conclusion ?? one.state}`).join(', ')})`,
-  skipped: `${row.name} was skipped on the head and on the merge commit: a path filter or a condition skipped it, so it proved nothing`,
+  skipped: `${row.name} ${skippedSides(row)}: a path filter or a condition skipped it, so it proved nothing`,
   missing: `${row.name} never ran on the head or on the merge commit`,
 }[row.state] ?? `${row.name} ended ${row.state}`);
 
@@ -424,6 +435,46 @@ export function createDeliveryVerbs(core) {
   // passing accepted_red needs the owner-present flag, the same flag that
   // decision_record needs. A forged record then gives a caller nothing it
   // could not write itself (security review of this change, finding 1).
+  // R17 line 6: a decision record alone does not waive a red check. The owner
+  // signs a waiver act with his security key (R72, design
+  // docs/design-docs/signed-act/) and posts the block on the pull request.
+  // The act names the repo, the pull request, its head, the decision and the
+  // check. The key must be in atlas/owner-signers on the base of the merge,
+  // its first parent, so a key that the pull request added does not count.
+  async function signedWaiver(pull, decisionId, check) {
+    const head = String(pull.head_sha ?? '').toLowerCase();
+    if (!/^[0-9a-f]{40}$/.test(head)) refuse(`GitHub names no head commit of ${pull.url}, so no signed waiver can match it`);
+    const commit = await github(`repos/${pull.repo}/commits/${pull.merge_commit_sha}`);
+    const parent = commit?.parents?.[0]?.sha;
+    if (typeof parent !== 'string' || !/^[0-9a-f]{40}$/i.test(parent)) refuse(`GitHub names no parent of the merge commit ${pull.merge_commit_sha} of ${pull.url}`);
+    // A rebase merge makes the first parent a commit of the pull request, so
+    // the key must also be on the merge base of that parent and the head: a
+    // commit the pull request did not write (verifier of atlas#240).
+    const compared = await github(`repos/${pull.repo}/compare/${parent}...${head}`);
+    const forkPoint = compared?.merge_base_commit?.sha;
+    if (typeof forkPoint !== 'string' || !/^[0-9a-f]{40}$/i.test(forkPoint)) refuse(`GitHub names no merge base of ${pull.url}, so no signed waiver can be checked`);
+    const keysAt = async (ref) => {
+      const file = await githubOrNull(`repos/${pull.repo}/contents/${SIGNERS_FILE}?ref=${ref}`);
+      return parseSigners(file && typeof file.content === 'string' ? Buffer.from(file.content, 'base64').toString('utf8') : '').keys;
+    };
+    const atFork = forkPoint.toLowerCase() === parent.toLowerCase() ? null : new Set((await keysAt(forkPoint)).map((key) => key.fingerprint));
+    const keys = (await keysAt(parent)).filter((key) => !atFork || atFork.has(key.fingerprint));
+    if (!keys.length) refuse(`accepted_red needs the owner's signed waiver, and ${SIGNERS_FILE} on the base of ${pull.url} holds no owner key`);
+    const texts = [];
+    for (let page = 1; page <= 10; page += 1) {
+      const rows = await github(`repos/${pull.repo}/issues/${pull.number}/comments?per_page=100&page=${page}`);
+      for (const row of Array.isArray(rows) ? rows : []) if (typeof row?.body === 'string' && row.body.includes(SIGNED_MARKER)) texts.push(row.body);
+      if (!Array.isArray(rows) || rows.length < 100) break;
+    }
+    const verified = verifyTexts(texts, keys);
+    const found = findAct(verified, { kind: 'waiver', repo: pull.repo, pr: pull.number, head, decision: decisionId, check });
+    if (!found) {
+      const why = verified.find((row) => row.error)?.error;
+      refuse(`accepted_red needs the owner's signed waiver on ${pull.url} for check ${check}, head ${head.slice(0, 12)} and decision ${decisionId}; none counts${why ? ` (a block was refused: ${why})` : ''}. The owner runs: atlas approve act waiver, and posts the block on the pull request`);
+    }
+    return { key: found.key, signed_at: found.signed_at };
+  }
+
   async function acceptedRed(value, pulls, item) {
     if (value === undefined) return [];
     if (!Array.isArray(value)) refuse('accepted_red must be an array of { pr, check, test, decision_id }');
@@ -471,7 +522,8 @@ export function createDeliveryVerbs(core) {
         || new RegExp(`(?:^|[^A-Za-z0-9_/.-])#${pull.number}(?![0-9])`).test(words);
       if (!namesPull) refuse(`decision ${decisionId} does not name ${pull.url}; the owner's words must name the pull request (its URL or #${pull.number})`);
       if (!words.includes(testName)) refuse(`decision ${decisionId} does not quote the test "${testName}"; the owner's own words must name the exact test`);
-      rows.push({ pr: pull.url, check, test: testName, decision_id: decision.id, decision_version: decision.version ?? null, decision });
+      const waiver = await signedWaiver(pull, decision.id, check);
+      rows.push({ pr: pull.url, check, test: testName, decision_id: decision.id, decision_version: decision.version ?? null, waiver, decision });
     }
     return rows;
   }
@@ -639,7 +691,7 @@ export function createDeliveryVerbs(core) {
           if (!run) refuse(`accepted_red names check ${row.check} on ${pull.url}, but that check is not red in the merge gate; drop the entry`);
           const { decision: _record, ...kept } = row;
           acceptedRows.push({ ...kept, conclusion: run.conclusion, run_url: run.url,
-            detail: `${row.check} concluded ${run.conclusion} for ${pull.url}. The owner accepted the red test "${row.test}" in decision ${row.decision_id}. The gate names the check, not the test, so the verb proved the check level only.` });
+            detail: `${row.check} concluded ${run.conclusion} for ${pull.url}. The owner accepted the red test "${row.test}" in decision ${row.decision_id}, and signed the waiver with key ${row.waiver.key}. The gate names the check, not the test, so the verb proved the check level only.` });
         }
         if (!required.length && !passed.length) refuse(`no check run succeeded for ${pull.url}; the merge gate is the independent record and it says nothing`);
         // A check name whose LATEST run succeeded is green. A name whose earlier

package/work/lib/lessons.mjs

@@ -0,0 +1,133 @@
+// Roadmap R55 (item 8d87c567): every lesson leaves one record. A lesson is
+// a mark of kind lesson, so the tracker needs no new type. It holds one line,
+// the home, the form, the fix link, the source and the lesson it repeats.
+// The learnings skill reads the lessons before it records one, and records a
+// match as a repeat. The roundup counts them per week.
+//
+// Three rules hold it together:
+//   1. A mark is never edited. A lesson that repeats another names it; the
+//      first lesson stays as it was.
+//   2. A repeat names a lesson of the same product. A lesson home in a repo
+//      names a registered repo of that product.
+//   3. A failed read throws. It never reads as zero lessons.
+import { refuse, text, oneOf, url } from './verb-fields.mjs';
+import { oneLine, scrubSecrets } from './questions.mjs';
+import { standingOf, isStepIn } from './step-ins.mjs';
+import { isRevert } from './numbers.mjs';
+
+export const LESSON_WRITE_VERBS = Object.freeze(['lesson_record']);
+export const LESSON_READ_VERBS = Object.freeze(['lessons']);
+export const LESSON_KIND = 'lesson';
+// Where the fix lives: this repo, or Atlas for every repo.
+export const LESSON_HOMES = Object.freeze(['repo', 'atlas']);
+// The strongest form that fits, in the order of the learnings skill.
+export const LESSON_FORMS = Object.freeze(['check', 'tool', 'skill', 'doc']);
+// What found the miss: the owner's correction, a revert, a bug after a
+// merge, or a machine (a red main branch, a revert job) with no owner words.
+export const LESSON_SOURCES = Object.freeze(['owner', 'revert', 'bug', 'machine']);
+const RECORD_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const MAX_LISTED = 100;
+
+// A link is a URL, or the id of a tracker record such as the item a lesson
+// became.
+function linkOf(value, name, { optional = false } = {}) {
+  if (value === undefined && optional) return '';
+  const plain = text(value, name, { max: 2000 }).trim();
+  if (RECORD_ID.test(plain)) return plain.toLowerCase();
+  return url(plain, name);
+}
+
+// One rule for a revert and one for a step-in, shared with the numbers of
+// R16: a revert pull request (numbers.mjs), and a step-in that still counts,
+// an owner message whose newest name gives no class (step-ins.mjs).
+export { isRevert };
+export const countedStepIns = (marks) => standingOf(marks).filter(isStepIn).map(({ mark }) => mark);
+
+const rowOf = (mark, repeatedBy) => ({
+  lesson: mark.id, at: mark.fields.marked_at, line: mark.fields.line, home: mark.fields.home, repo: mark.fields.repo || null,
+  form: mark.fields.form, fix: mark.fields.fix, source: mark.fields.source, source_ref: mark.fields.source_ref || null,
+  repeats: mark.fields.repeats || null, item: mark.fields.item || null, repeated_by: repeatedBy.get(mark.id) ?? [],
+});
+
+export function createLessonVerbs(core) {
+  const { client, now, typeNamed, registry, requireProduct, requireItem, create, edge, landed } = core;
+
+  async function lessonMarks(product) {
+    const type = await typeNamed('mark');
+    const rows = await client.listAllEntities({ type: type.name, state: 'active' });
+    return rows.filter((one) => one.fields?.kind === LESSON_KIND && (!product || one.fields?.product === product));
+  }
+
+  return {
+    // R55 line 1: one lesson, one mark. The learnings skill calls it once the
+    // fix exists, so the fix link is never empty.
+    async lesson_record(args, requestId, meta) {
+      const reg = await registry();
+      const product = (await requireProduct(args.product, reg)).fields.registry_id;
+      const scrubbed = scrubSecrets(text(args.line, 'line', { max: 300 }));
+      const line = oneLine(scrubbed.text, 300);
+      const home = oneOf(args.home, 'home', LESSON_HOMES);
+      let repo = '';
+      if (home === 'repo') {
+        repo = text(args.repo, 'repo', { max: 200 });
+        const record = reg.repos.get(repo);
+        if (!record) refuse(`unknown repo id: ${repo}. Known: ${[...reg.repos.keys()].sort().join(', ') || 'none'}`);
+        if (record.fields?.product !== product) refuse(`repo ${repo} belongs to product ${record.fields?.product}, not ${product}`);
+      } else if (args.repo !== undefined) refuse('repo goes with home "repo" only; an Atlas lesson holds for every repo');
+      const form = oneOf(args.form, 'form', LESSON_FORMS);
+      const fix = linkOf(args.fix, 'fix');
+      const source = oneOf(args.source, 'source', LESSON_SOURCES);
+      const sourceRef = linkOf(args.source_ref, 'source_ref', { optional: true });
+      const item = args.item_id === undefined ? null : await requireItem(args.item_id);
+      let repeated = null;
+      if (args.repeats !== undefined) {
+        const id = text(args.repeats, 'repeats', { max: 200 });
+        let entity;
+        try { entity = await client.getEntity(id); }
+        catch (error) { if (error?.status === 404) refuse(`unknown lesson id: ${id}`); throw error; }
+        const type = await typeNamed('mark');
+        if (entity.type_id !== type.id || entity.fields?.kind !== LESSON_KIND) refuse(`entity ${id} is not a lesson mark`);
+        if (entity.fields?.product !== product) refuse(`lesson ${id} belongs to product ${entity.fields?.product}, not ${product}`);
+        repeated = entity;
+      }
+      const type = await typeNamed('mark');
+      const prior = await landed(type, requestId, meta);
+      const mark = prior ?? await create(type, requestId, 'lesson_record', {
+        digest: meta?.digest,
+        title: oneLine(`Lesson${repeated ? ' (repeat)' : ''} · ${line}`, 200),
+        body: `${line}\n\nHome: ${home === 'repo' ? repo : 'Atlas'}. Form: ${form}. Fix: ${fix}. Source: ${source}${sourceRef ? ` (${sourceRef})` : ''}.${repeated ? ` It repeats lesson ${repeated.id}.` : ''}`,
+        fields: {
+          kind: LESSON_KIND, verdict: repeated ? 'repeat' : 'new', item: item?.id ?? '', product, marked_at: now(),
+          line, home, repo, form, fix, source, source_ref: sourceRef, repeats: repeated?.id ?? '',
+        },
+        tags: ['atlas-mark', 'lesson', `product:${product}`, ...(repeated ? ['repeat'] : [])],
+      });
+      if (repeated) await edge(mark, repeated, 'references', requestId);
+      if (item) await edge(mark, item, 'references', requestId);
+      return {
+        verb: 'lesson_record', lesson: mark.id, product, line, home, repo: repo || null, form, fix, source, source_ref: sourceRef || null,
+        repeats: repeated?.id ?? null, item: item?.id ?? null, ...(scrubbed.redactions ? { redactions: scrubbed.redactions } : {}), ...(prior ? { replayed_from_graph: true } : {}),
+      };
+    },
+
+    // R55 line 2: a product's lessons, newest first. Each row lists the
+    // lessons that repeat it, so the learnings skill sees what came back.
+    async lessons(args = {}) {
+      const reg = await registry();
+      const product = (await requireProduct(args.product, reg)).fields.registry_id;
+      const since = args.since === undefined ? null : text(args.since, 'since', { max: 40 });
+      if (since !== null && Number.isNaN(Date.parse(since))) refuse('since must be an ISO date or time');
+      const limit = args.limit === undefined ? 20 : Number(args.limit);
+      if (!Number.isInteger(limit) || limit < 1 || limit > MAX_LISTED) refuse(`limit must be a whole number from 1 to ${MAX_LISTED}`);
+      const marks = await lessonMarks(product);
+      const repeatedBy = new Map();
+      for (const mark of marks) if (mark.fields.repeats) repeatedBy.set(mark.fields.repeats, [...(repeatedBy.get(mark.fields.repeats) ?? []), mark.id]);
+      const rows = marks.filter((mark) => !since || String(mark.fields.marked_at) >= new Date(since).toISOString())
+        .sort((a, b) => String(b.fields.marked_at).localeCompare(String(a.fields.marked_at)));
+      return {
+        verb: 'lessons', product, total: rows.length, repeats: rows.filter((mark) => mark.fields.repeats).length,
+        rows: rows.slice(0, limit).map((mark) => rowOf(mark, repeatedBy)),
+      };
+    },
+  };
+}

package/work/lib/numbers.mjs

@@ -176,8 +176,9 @@ export function notOnGreenReasons({ required = [], runs = [], mergedAt }) {
 }
 
 // A merged pull request that undoes another: GitHub's revert button writes
-// both of these.
-export const isRevert = (pull) => /^revert\b/i.test(String(pull.title ?? '').trim()) || /^Reverts [A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+#\d+/m.test(String(pull.body ?? ''));
+// both of these. The roundup's rows keep the body inside names
+// (delivery.mjs).
+export const isRevert = (pull) => /^revert\b/i.test(String(pull.title ?? '').trim()) || /^Reverts [A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+#\d+/m.test(String(pull.body ?? pull.names ?? ''));
 
 // The old tests that one merge changed or removed. An added test is new, so
 // it is not here.

package/work/lib/roundup.mjs

@@ -12,7 +12,9 @@
 //                       but not marked, open pull requests that name no item,
 //                       and questions that wait longer than STUCK_DAYS
 //   5. Trend            per week, for TREND_WEEKS weeks: merges, deliveries,
-//                       new items; and the open questions with the oldest age
+//                       new items, lessons, repeats, step-ins and reverts
+//                       (roadmap R55); and the open questions with the
+//                       oldest age. A failed read of the marks is an error.
 //   6. The numbers      per repo, per week and per month: merges, merges not
 //                       on green, reverts, reopens, unchecked test changes,
 //                       step-ins and owner messages; and the time from input
@@ -24,6 +26,7 @@ import { refuse, isoDate, LIVE_LIFECYCLES } from './verb-fields.mjs';
 import { oneLine, ROW_LINE_MAX } from './questions.mjs';
 import { readPullsByRepo, pullsOfItem, daysBetween, listLine } from './delivery.mjs';
 import { readNumbers, periodOf } from './numbers.mjs';
+import { LESSON_KIND, countedStepIns, isRevert } from './lessons.mjs';
 
 export const ROUNDUP_READ_VERBS = Object.freeze(['roundup']);
 
@@ -174,17 +177,29 @@ export function createRoundupVerbs(core) {
       const audits = await readAudits(repoIds, readGitHub, readAt);
 
       // 5. Trend, per week; week 1 is the last seven days.
-      const weeks = Array.from({ length: TREND_WEEKS }, (_, index) => ({ week: index + 1, from: dayOf(minus(readAt, (index + 1) * 7)), to: dayOf(minus(readAt, index * 7)), merged: 0, delivered: 0, new_items: 0 }));
-      const bump = (at, key) => { const week = weekOf(at, readAt); if (week) weeks[week - 1][key] += 1; };
+      // Lessons, repeats and step-ins come from the marks; reverts from the
+      // merged pull requests. When GitHub did not answer for a repo, the
+      // reverts read null, never 0 (R55 line 4).
+      // One read of the marks serves part 5 and part 6.
+      const markType = await typeNamed('mark');
+      const marks = await client.listAllEntities({ type: markType.name, state: 'active' });
+      const productMarks = marks.filter((row) => row.fields?.product === product);
+      const revertsKnown = !repoErrors.length;
+      const weeks = Array.from({ length: TREND_WEEKS }, (_, index) => ({ week: index + 1, from: dayOf(minus(readAt, (index + 1) * 7)), to: dayOf(minus(readAt, index * 7)), merged: 0, delivered: 0, new_items: 0, lessons: 0, repeats: 0, step_ins: 0, reverts: revertsKnown ? 0 : null }));
+      const bump = (at, key) => { const week = weekOf(at, readAt); if (week && weeks[week - 1][key] !== null) weeks[week - 1][key] += 1; };
       for (const pull of pulls) if (pull.state === 'merged') bump(pull.merged_at, 'merged');
+      for (const pull of pulls) if (pull.state === 'merged' && isRevert(pull)) bump(pull.merged_at, 'reverts');
       for (const row of flight.delivered ?? []) bump(row.delivered_at, 'delivered');
       for (const row of items) bump(row.created_at, 'new_items');
+      for (const mark of productMarks.filter((row) => row.fields?.kind === LESSON_KIND)) {
+        bump(mark.fields.marked_at, 'lessons');
+        if (mark.fields.repeats) bump(mark.fields.marked_at, 'repeats');
+      }
+      for (const mark of countedStepIns(productMarks)) bump(mark.fields.marked_at, 'step_ins');
       const oldest = needRows.reduce((max, row) => Math.max(max, row.days_waiting ?? 0), 0);
 
       // 6. The numbers. They read every pull request of the period, not only
       // the newest 100, and the marks of the tracker.
-      const markType = await typeNamed('mark');
-      const marks = await client.listAllEntities({ type: markType.name, state: 'active' });
       const numbers = await readNumbers({
         product, items, marks, period, readGitHub,
         repos: repoIds.map((id) => ({ id, default_branch: reg.repos.get(id)?.fields?.default_branch ?? null })),
@@ -241,7 +256,7 @@ function render(view) {
   out.push(stuck.join('\n'));
 
   out.push([`5. Trend, per week (week 1 is the last seven days)`,
-    ...weeks.map((week) => `   week ${week.week} (${week.from} to ${week.to}): ${plural(week.merged, 'merge')} · ${plural(week.delivered, 'delivery')} · ${plural(week.new_items, 'new item')}`),
+    ...weeks.map((week) => `   week ${week.week} (${week.from} to ${week.to}): ${plural(week.merged, 'merge')} · ${plural(week.delivered, 'delivery')} · ${plural(week.new_items, 'new item')} · ${plural(week.lessons, 'lesson')} (${plural(week.repeats, 'repeat')}) · ${plural(week.step_ins, 'step-in')} · ${week.reverts === null ? 'reverts unknown' : plural(week.reverts, 'revert')}`),
     `   waiting on you: ${plural(needRows.length, 'question')}${needRows.length ? `, oldest ${plural(oldest, 'day')}` : ''}`].join('\n'));
 
   out.push(renderNumbers(numbers, more));

package/work/lib/verbs.mjs

@@ -22,6 +22,7 @@ import { createCapabilityVerbs, CAPABILITY_READ_VERBS, hubOf } from './capabilit
 import { createRoundupVerbs, ROUNDUP_READ_VERBS } from './roundup.mjs';
 import { createActivityVerbs, diffOf, LOG_VERBS, ENTRY_VERBS, ACTIVITY_WRITE_VERBS, ACTIVITY_READ_VERBS } from './activity.mjs';
 import { createStepInVerbs, STEP_IN_WRITE_VERBS, STEP_IN_READ_VERBS } from './step-ins.mjs';
+import { createLessonVerbs, LESSON_WRITE_VERBS, LESSON_READ_VERBS } from './lessons.mjs';
 
 export { VerbError, canonicalJson, sha256, COSTS, LIVE_LIFECYCLES, REPO_KINDS, LIVE_KINDS, repoKinds };
 export const MANIFEST_VERSION = '0.7.0';
@@ -754,9 +755,11 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
   // through record and notCounted, which no tool exposes.
   const stepIns = createStepInVerbs(core);
   Object.assign(verbs, stepIns.verbs);
+  // Roadmap R55: every lesson leaves one record, a mark of kind lesson.
+  Object.assign(verbs, createLessonVerbs(core));
 
-  const WRITE_VERBS = Object.freeze(['setup', 'product_add', 'product_edit', 'repo_add', 'repo_edit', 'item_propose', 'item_lock', 'item_split', 'item_park', 'item_resume', 'item_drop', 'item_edit', 'item_block', 'item_unblock', 'item_stage', 'item_link', ...QUESTION_WRITE_VERBS, ...DELIVERY_WRITE_VERBS, ...ACTIVITY_WRITE_VERBS, ...STEP_IN_WRITE_VERBS]);
-  const READ_VERBS = Object.freeze(['registry_list', ...QUESTION_READ_VERBS, ...DELIVERY_READ_VERBS, ...CAPABILITY_READ_VERBS, ...ROUNDUP_READ_VERBS, ...ACTIVITY_READ_VERBS, ...STEP_IN_READ_VERBS]);
+  const WRITE_VERBS = Object.freeze(['setup', 'product_add', 'product_edit', 'repo_add', 'repo_edit', 'item_propose', 'item_lock', 'item_split', 'item_park', 'item_resume', 'item_drop', 'item_edit', 'item_block', 'item_unblock', 'item_stage', 'item_link', ...QUESTION_WRITE_VERBS, ...DELIVERY_WRITE_VERBS, ...ACTIVITY_WRITE_VERBS, ...STEP_IN_WRITE_VERBS, ...LESSON_WRITE_VERBS]);
+  const READ_VERBS = Object.freeze(['registry_list', ...QUESTION_READ_VERBS, ...DELIVERY_READ_VERBS, ...CAPABILITY_READ_VERBS, ...ROUNDUP_READ_VERBS, ...ACTIVITY_READ_VERBS, ...STEP_IN_READ_VERBS, ...LESSON_READ_VERBS]);
 
   async function run(verb, args = {}) {
     if (!verbs[verb]) refuse(`unknown verb: ${verb}`);

package/work/mcp.mjs

@@ -23,6 +23,7 @@ import { createActionStore } from './lib/action-store.mjs';
 import { createVerbs, STAGES, TIERS, DRIVERS, LINK_KINDS, REPO_KINDS, WAITS_ON, MANIFEST_VERSION, COSTS } from './lib/verbs.mjs';
 import { COST_MEANING, DECISION_KINDS } from './lib/questions.mjs';
 import { STEP_IN_CLASSES, stepInFolder, flushStepIns } from './lib/step-ins.mjs';
+import { LESSON_HOMES, LESSON_FORMS, LESSON_SOURCES } from './lib/lessons.mjs';
 import { FATAL_CONCLUSIONS } from './lib/delivery.mjs';
 import { createMcpServer } from './lib/mcp-stdio.mjs';
 import { childEnvironment, CLOUD_NODE_VARIABLES } from './lib/child-env.mjs';
@@ -61,11 +62,13 @@ export const TOOLS = [
   { name: 'item_activity', description: 'Answer "what happened on this item?". One list, newest first: the comments, each change an item verb made with its old and new values, the questions, the decisions, the delivery marks, the pieces and the links. A write that kept no values, such as one from before manifest 0.7.0, shows its verb and time with "no values recorded". The edits kept on the item before 0.7.0 show too. Scope: read, no owner flag needed.', inputSchema: { type: 'object', required: ['item_id'], properties: { item_id: S('Item id.'), limit: { type: 'integer', minimum: 1, maximum: 200, description: 'How many rows, newest first. Default 50.' } }, additionalProperties: false } },
   { name: 'step_in_name', description: `Name what one message of the person was, or link the lesson it led to (roadmap R15). The step-in hook counts each message the person sends, and the server writes each one as a step-in mark; this verb never adds, skips or deletes one. It writes a new mark that corrects the step-in, and the newest name stands. A message with no class is a step-in. The classes: ${STEP_IN_CLASSES.join(', ')}. The first eight are the classes of the owner-only list. "answer" needs question_id, a question that was open when the message came. When: the lead knows what the message was, or a lesson came out of it. No owner flag. ${RULES}`, inputSchema: { type: 'object', required: ['request_id', 'step_in'], properties: { request_id: REQUEST_ID, step_in: S('The step-in mark id, from step_ins.'), class: { type: 'string', enum: [...STEP_IN_CLASSES], description: 'What the message was. Leave it out to keep it a step-in and only link a lesson.' }, question_id: S('For class answer: the question the message answered.'), item_id: S('The item the message was about. An answer takes the item of its question.'), lesson: S('The lesson the step-in led to: a URL, or the id of a tracker record.') }, additionalProperties: false } },
   { name: 'step_ins', description: 'List the step-in marks, newest first, with the name that stands on each: the time, the session, the repos, and the class and lesson the lead named. step_ins counts the messages with no class; not_counted_sessions counts the sessions whose hooks were off. When: before step_in_name, to find the id. Scope: read, no owner flag needed.', inputSchema: { type: 'object', properties: { session: S('Only this session.'), since: S('ISO date or time: only step-ins from then on.'), limit: { type: 'integer', minimum: 1, maximum: 100, description: 'How many rows. Default 20.' } }, additionalProperties: false } },
+  { name: 'lesson_record', description: `Record one lesson as a mark of kind lesson (roadmap R55): one line, its home, its form, the fix link, the source and the lesson it repeats. A mark is never edited. When: the learnings skill made the fix; call lessons first, and pass repeats when an earlier lesson says the same thing. The line goes through the secret filter. No owner flag. ${RULES}`, inputSchema: { type: 'object', required: ['request_id', 'product', 'line', 'home', 'form', 'fix', 'source'], properties: { request_id: REQUEST_ID, product: S('Product id.'), line: S('The lesson in one plain sentence: what went wrong and what is right. At most 300 characters.'), home: { type: 'string', enum: [...LESSON_HOMES], description: 'repo: the lesson holds for one repo. atlas: it holds for every repo.' }, repo: S('For home repo: the registered repo id of this product.'), form: { type: 'string', enum: [...LESSON_FORMS], description: 'The form of the fix: a check, a tool, a skill step or a doc line.' }, fix: S('The fix: a pull request URL, or the id of the tracker item the lesson became.'), source: { type: 'string', enum: [...LESSON_SOURCES], description: 'What found the miss: owner (a correction), revert, bug (after a merge), or machine (no owner words).' }, source_ref: S('Where the miss shows: the step-in mark id, the revert pull request, or the bug issue.'), repeats: S('The id of an earlier lesson of this product that this lesson repeats.'), item_id: S('The work item the lesson is about.') }, additionalProperties: false } },
+  { name: 'lessons', description: 'List the lessons of one product, newest first (roadmap R55). Each row gives the line, the home, the form, the fix, the source, the lesson it repeats and the lessons that repeat it. total counts the lessons; repeats counts the repeats. A failed read is an error, never zero lessons. When: the learnings skill calls it before lesson_record, to find a match. Scope: read, no owner flag needed.', inputSchema: { type: 'object', required: ['product'], properties: { product: S('Product id.'), since: S('ISO date or time: only lessons from then on.'), limit: { type: 'integer', minimum: 1, maximum: 100, description: 'How many rows. Default 20.' } }, additionalProperties: false } },
   { name: 'item_link', description: `Attach a typed link (kind, url, role, note) to an item: a PR, an issue, an artifact, a design doc, a conversation. When: any in-session agent has a link the item should carry, for example a PR it opened. No owner flag needed. A duplicate kind and url is a no-op. ${RULES}`, inputSchema: { type: 'object', required: ['request_id', 'item_id', 'kind', 'url'], properties: { request_id: REQUEST_ID, item_id: S('Item id.'), kind: S(`One of ${LINK_KINDS.join(', ')}.`), url: S('Absolute http or https URL.'), role: S('What the link is to the item, for example "delivers", "design", "evidence".'), note: S('One line.') }, additionalProperties: false } },
   { name: 'question_ask', description: `Ask the owner one question that blocks work on an item, and say what waiting costs. When: an agent is blocked and cannot decide by itself. Any in-session agent may call it; no owner flag. The question shows in the "Needs me" view until it is answered. ${RULES}`, inputSchema: { type: 'object', required: ['request_id', 'text', 'item_id', 'product', 'cost'], properties: { request_id: REQUEST_ID, text: S('The question, in plain words, answerable without opening a source.'), item_id: S('Entity id of the work item the question blocks.'), product: S('Product id of that item.'), cost: S(`What waiting costs. One of: ${COSTS.map((cost) => `${cost} (${COST_MEANING[cost]})`).join('; ')}.`), context: { type: 'object', description: 'What the owner needs to answer without opening a source.', properties: { current_behavior: S('What happens today.'), change: S('What would change.'), affected: { type: 'array', items: { type: 'string' }, description: 'Parts that change.' }, options: { type: 'array', items: { type: 'string' }, description: 'The options, one per entry.' }, consequences: S('What follows from each option.'), sources: { type: 'array', items: { type: 'string' }, description: 'Absolute http or https URLs that back the context.' } } } }, additionalProperties: false } },
   { name: 'question_answer', description: `Record the owner's answer to one open question. One call writes the decision in the owner's words, keeps the rendered answer as a receipt, and closes the question, so the "Needs me" view loses the row. Refuses an unknown question and one that is already answered. Owner present only. ${RULES}`, inputSchema: { type: 'object', required: ['request_id', 'question_id', 'text', 'date'], properties: { request_id: REQUEST_ID, question_id: S('Entity id of the open question.'), text: S("The owner's answer, verbatim."), date: S('ISO date the owner said it, in the form YYYY-MM-DD.'), source: S('Where the words are on record: a chat turn, a doc URL, an issue.'), kind: S(`One of ${DECISION_KINDS.join(', ')}. Default answer.`), items: { type: 'array', items: { type: 'string' }, description: 'Item ids the decision touches. Default: the question\'s item.' }, priority_order: { type: 'array', items: { type: 'string' }, description: 'Item ids in the order the owner set.' }, replaces: S('Entity id of the decision this one replaces.'), rendered: S('The view text the owner acted on. Default: the question and the answer.'), view: S('Which view the owner read, for example needs-me.') }, additionalProperties: false } },
   { name: 'decision_record', description: `Record what the owner decided outside a question, in their own words. Refuses missing text and a missing date. Pass rendered to keep the view the owner acted on as a receipt in the same call. Owner present only. ${RULES}`, inputSchema: { type: 'object', required: ['request_id', 'text', 'date'], properties: { request_id: REQUEST_ID, text: S("The owner's words, verbatim."), date: S('ISO date the owner said it.'), source: S('Where the words are on record.'), kind: S(`One of ${DECISION_KINDS.join(', ')}. Default decision.`), product: S('Product id the decision is about.'), items: { type: 'array', items: { type: 'string' }, description: 'Item ids the decision touches.' }, priority_order: { type: 'array', items: { type: 'string' }, description: 'Item ids in the order the owner set.' }, replaces: S('Entity id of the decision this one replaces.'), rendered: S('The view text the owner acted on.'), view: S('Which view the owner read.') }, additionalProperties: false } },
-  { name: 'item_done', description: `Mark an item delivered. What proves it follows the repo kind (amendment A1.7). A service or schema repo gets the three read-only live checks: the deployed commit carries the pull requests, the health endpoint answers, and a functional check scoped to the change passes. Every check is a GET. The merge state of each pull request and the gate runs come from GitHub; the caller supplies none of them, and a red gate (${FATAL_CONCLUSIONS.join(', ')}) refuses the mark. One exception, a last resort for an extraordinary case with no other option: the owner can accept a known red test on one merged pull request. Name it in accepted_red with the decision that records the owner's words; those words must name the pull request and quote the exact test, and one decision accepts one red check. accepted_red needs the owner present. The gate names a check, not a test, so the verb proves the check level, and every other red check still refuses the mark. A library repo has no deploy target, so its delivery is proven by the merge and the gate alone: pass no functional, and the product needs no health_url. A schema repo keeps the three checks, because its migration runs after the merge. When atlas.yaml on the base of a merge lists required_checks, each one needs a successful newest GitHub Actions run on the pull request head or on the merge commit; a skipped check and a check that never ran are named apart. When atlas.yaml says live: release, a published release must hold each merge commit, and the mark stores that version; a red run on the merge commit is then a warning on the mark, because the release was built from a later green main. An item with no registered repo, or a repo whose kind was never set, keeps the three checks. The delivering agent calls this; the lead calls it to catch up a delivery made outside a session. No owner flag. ${RULES}`, inputSchema: { type: 'object', required: ['request_id', 'item_id', 'prs'], properties: { request_id: REQUEST_ID, item_id: S('Item id. The item must be active. Unless every repo it names is a library, its product must carry a health_url.'), prs: { type: 'array', items: { type: 'string' }, description: 'The merged GitHub pull request URLs this delivery shipped. Required: the item\'s own pr links are not read, because a link can be a design or a lock, not a delivery.' }, functional: { type: 'object', required: ['url', 'contains'], description: 'The read-only functional check. Required for a service or schema repo, and refused for a library repo. The verb GETs this URL once. No method, body or headers are accepted.', properties: { url: S('Absolute URL on the product health endpoint\'s origin, under one of the product\'s check_paths, and not the health endpoint itself.'), contains: { type: 'array', items: { type: 'string' }, description: 'Required. Strings the answer must carry, chosen so they exist only because of this change. Only whether each was found is recorded; the answer itself never enters the graph.' }, status: { type: 'number', description: 'Expected HTTP status, 2xx only. Default 200.' } } }, note: S('One line on what was delivered.'), accepted_red: { type: 'array', description: 'Red checks the owner accepted, one entry for each pull request and check. Owner present only. The decision must be a decision or an answer on this item, written by decision_record or question_answer and not replaced. Its words must name the pull request and quote the test. One decision accepts one check on one pull request. A listed check that is not red is refused.', items: { type: 'object', required: ['pr', 'check', 'test', 'decision_id'], additionalProperties: false, properties: { pr: S('One of the prs of this delivery.'), check: S('The name of the red check run in the merge gate, for example "test".'), test: S('The exact name of the red test, as the owner\'s words quote it.'), decision_id: S('The decision that records the owner\'s acceptance.') } } } }, additionalProperties: false } },
+  { name: 'item_done', description: `Mark an item delivered. What proves it follows the repo kind (amendment A1.7). A service or schema repo gets the three read-only live checks: the deployed commit carries the pull requests, the health endpoint answers, and a functional check scoped to the change passes. Every check is a GET. The merge state of each pull request and the gate runs come from GitHub; the caller supplies none of them, and a red gate (${FATAL_CONCLUSIONS.join(', ')}) refuses the mark. One exception, a last resort for an extraordinary case with no other option: the owner can accept a known red test on one merged pull request. Name it in accepted_red with the decision that records the owner's words; those words must name the pull request and quote the exact test, and one decision accepts one red check. The owner must also sign a waiver act for the repo, the pull request, its head, the decision and the check (atlas approve act waiver) and post the block on the pull request; the key must be in atlas/owner-signers on the base of the merge. accepted_red needs the owner present. The gate names a check, not a test, so the verb proves the check level, and every other red check still refuses the mark. A library repo has no deploy target, so its delivery is proven by the merge and the gate alone: pass no functional, and the product needs no health_url. A schema repo keeps the three checks, because its migration runs after the merge. When atlas.yaml on the base of a merge lists required_checks, each one needs a successful newest GitHub Actions run on the pull request head or on the merge commit; a skipped check and a check that never ran are named apart. When atlas.yaml says live: release, a published release must hold each merge commit, and the mark stores that version; a red run on the merge commit is then a warning on the mark, because the release was built from a later green main. An item with no registered repo, or a repo whose kind was never set, keeps the three checks. The delivering agent calls this; the lead calls it to catch up a delivery made outside a session. No owner flag. ${RULES}`, inputSchema: { type: 'object', required: ['request_id', 'item_id', 'prs'], properties: { request_id: REQUEST_ID, item_id: S('Item id. The item must be active. Unless every repo it names is a library, its product must carry a health_url.'), prs: { type: 'array', items: { type: 'string' }, description: 'The merged GitHub pull request URLs this delivery shipped. Required: the item\'s own pr links are not read, because a link can be a design or a lock, not a delivery.' }, functional: { type: 'object', required: ['url', 'contains'], description: 'The read-only functional check. Required for a service or schema repo, and refused for a library repo. The verb GETs this URL once. No method, body or headers are accepted.', properties: { url: S('Absolute URL on the product health endpoint\'s origin, under one of the product\'s check_paths, and not the health endpoint itself.'), contains: { type: 'array', items: { type: 'string' }, description: 'Required. Strings the answer must carry, chosen so they exist only because of this change. Only whether each was found is recorded; the answer itself never enters the graph.' }, status: { type: 'number', description: 'Expected HTTP status, 2xx only. Default 200.' } } }, note: S('One line on what was delivered.'), accepted_red: { type: 'array', description: 'Red checks the owner accepted, one entry for each pull request and check. Owner present only. The decision must be a decision or an answer on this item, written by decision_record or question_answer and not replaced. Its words must name the pull request and quote the test. One decision accepts one check on one pull request. A listed check that is not red is refused.', items: { type: 'object', required: ['pr', 'check', 'test', 'decision_id'], additionalProperties: false, properties: { pr: S('One of the prs of this delivery.'), check: S('The name of the red check run in the merge gate, for example "test".'), test: S('The exact name of the red test, as the owner\'s words quote it.'), decision_id: S('The decision that records the owner\'s acceptance.') } } } }, additionalProperties: false } },
   { name: 'item_reopen', description: `Reopen a delivered item: the lifecycle goes back to active and a reopen mark is appended, citing the failed check by URL. The delivery mark is never erased; the reopen points at it with the corrects relation. The owner, or the lead in this session, calls it. ${RULES}`, inputSchema: { type: 'object', required: ['request_id', 'item_id', 'reason', 'failed_check'], properties: { request_id: REQUEST_ID, item_id: S('Item id carrying at least one delivery mark.'), reason: S('Why it is reopened, in plain words.'), failed_check: S('Absolute URL of the check that failed: a CI run, a monitor, an issue.'), corrects: S('Mark id of the delivery this reopen corrects. Default: the item\'s latest delivery mark.') }, additionalProperties: false } },
   { name: 'in_flight', description: 'Answer "what are we working on, and what changed since a date?". Active items per product, ordered by the owner\'s current priority decision first, when it carries an order, then by days since the last change with the latest on top, and the days shown on each row. Each row says what the item waits on. Movement is read from the marks and from each registered repo\'s recent pull requests: the item\'s own pr links, plus any pull request whose title, body or branch names the item id. Merged pull requests with no delivery mark are listed as "merged, not marked". A legacy seal reads as a delivery mark with verdict "legacy". Computed at read time and never stored. Scope: read, no owner flag needed.', inputSchema: { type: 'object', properties: { product: S('Limit the view to one product id.'), since: S('ISO date. Adds what was delivered since then.') }, additionalProperties: false } },
   { name: 'needs_me', description: 'Answer "what needs me?": every open question on a proposed, active or paused item, per product, ordered by what waiting costs. A row on an item that is not active names its lifecycle. Each row is three lines, the question, the item and the cost, with the context folded under it. Computed at read time and never stored. Scope: read, no owner flag needed. Pass the row text back as rendered when the owner answers.', inputSchema: { type: 'object', properties: { product: S('Limit the view to one product id.') }, additionalProperties: false } },
@@ -210,6 +213,10 @@ export const GITHUB_READS = Object.freeze([
   new RegExp(`^repos/${REPO}/contents/atlas\\.yaml\\?ref=(?:${SHA}|${BRANCH})$`),
   new RegExp(`^repos/${REPO}/releases\\?per_page=\\d{1,3}$`),
   new RegExp(`^repos/${REPO}/compare/${SHA}\\.\\.\\.${TAG}$`),
+  // R17 line 6: the signed waiver on the comments of a pull request, and the
+  // owner's key file on the base of its merge.
+  new RegExp(`^repos/${REPO}/issues/\\d{1,9}/comments\\?per_page=100&page=\\d{1,2}$`),
+  new RegExp(`^repos/${REPO}/contents/atlas/owner-signers\\?ref=[0-9a-fA-F]{40}$`),
   // Roadmap R16: the numbers page past 100 pull requests, and read the
   // files of each merge to find a changed test.
   new RegExp(`^repos/${REPO}/pulls\\?state=all&sort=updated&direction=desc&per_page=\\d{1,3}&page=\\d{1,3}$`),