@bongos/core 1.17.0

package/scripts/gds/audit-ships.js

@@ -0,0 +1,251 @@
+// Retroactive audit script for task #204.
+//
+// Loads every task shipped in the last `days` (default 2), fetches full
+// task data via the authenticated /tasks/:id API, derives diff stats from
+// git (one commit per task, found by the `<VERSION> #<id>:` subject prefix),
+// then calls src/bongos/grader.js in-process to get a score.
+//
+// Output: JSON to stdout (--json) or human-readable table (default).
+// Audit-only — does NOT write to task_grades. Pre-grader ships keep clean
+// history.
+
+const { execSync } = require('node:child_process');
+const grader = require('../../modules/grading/grader');
+const { cliClient } = require('./cli-lib');
+
+const DAYS = Number(process.env.AUDIT_DAYS || 2);
+
+function findCommitForTask(taskId) {
+  let sha;
+  try {
+    sha = execSync(
+      // Matches both subject conventions: the legacy ' #NNN:' prefix and the
+      // de-#-ed 'task NNN:' form ship.js writes since task 916 (a bare "#NNN"
+      // in commit subjects autolinked to dead GitHub issue numbers).
+      `git log --all --format='%H %s' | grep -E ' (#|task )${taskId}:' | head -1 | awk '{print $1}'`,
+      { encoding: 'utf8', shell: '/bin/bash' }
+    ).trim();
+  } catch (_) {
+    return null;
+  }
+  return sha || null;
+}
+
+function gitDiffStatsForCommit(sha) {
+  if (!sha) return null;
+  let raw;
+  try {
+    raw = execSync(`git show --shortstat --format='' ${sha}`, { encoding: 'utf8' });
+  } catch (_) {
+    return null;
+  }
+  // Example shortstat line: " 15 files changed, 1171 insertions(+), 65 deletions(-)"
+  const m = raw.match(/(\d+) files? changed(?:, (\d+) insertions?\(\+\))?(?:, (\d+) deletions?\(-\))?/);
+  if (!m) return null;
+  return {
+    files_changed: Number(m[1] || 0),
+    lines_added: Number(m[2] || 0),
+    lines_removed: Number(m[3] || 0),
+    commit_sha: sha,
+  };
+}
+
+function filesTouchedByCommit(sha) {
+  if (!sha) return [];
+  try {
+    const out = execSync(`git show --name-only --format='' ${sha}`, { encoding: 'utf8' });
+    return out.split('\n').map((s) => s.trim()).filter(Boolean);
+  } catch (_) {
+    return [];
+  }
+}
+
+// Downstream-impact heuristic: number of distinct commits on main reachable
+// from origin/main that landed AFTER `sha` and touched any of `files`. High
+// count = subsequent work has built on top of this change, so a "redo"
+// risks conflicts. Excludes `sha` itself.
+function downstreamImpact(sha, files) {
+  if (!sha || files.length === 0) {
+    return { commits_after_touching_files: 0, distinct_files_touched: 0, sample_subjects: [] };
+  }
+  // -- shell-quote each file path so spaces/specials don't break the cmd.
+  const fileArgs = files.map((f) => `'${f.replace(/'/g, "'\\''")}'`).join(' ');
+  let out;
+  try {
+    out = execSync(
+      `git log ${sha}..origin/main --format='%H %s' -- ${fileArgs}`,
+      { encoding: 'utf8' }
+    );
+  } catch (_) {
+    return { commits_after_touching_files: 0, distinct_files_touched: 0, sample_subjects: [] };
+  }
+  const lines = out.split('\n').map((s) => s.trim()).filter(Boolean);
+  // Distinct downstream files touched
+  let distinct = 0;
+  try {
+    const namesOut = execSync(
+      `git log ${sha}..origin/main --name-only --format='' -- ${fileArgs}`,
+      { encoding: 'utf8' }
+    );
+    const set = new Set(
+      namesOut.split('\n').map((s) => s.trim()).filter(Boolean)
+    );
+    distinct = set.size;
+  } catch (_) {
+    distinct = 0;
+  }
+  return {
+    commits_after_touching_files: lines.length,
+    distinct_files_touched: distinct,
+    sample_subjects: lines.slice(0, 3).map((l) => l.split(' ').slice(1).join(' ')),
+  };
+}
+
+async function fetchShipped(days) {
+  const r = await fetch(
+    `https://status.amazonprimea.com/api/gds/public/recent-shipped?days=${days}&limit=500`
+  );
+  const data = await r.json();
+  return data.tasks || [];
+}
+
+async function fetchFullTask(id) {
+  const api = await cliClient();
+  const r = await api.tasks.getTasksId({ id });
+  if (!r.ok) return null;
+  return r.data.task;
+}
+
+async function fetchLearning(taskId) {
+  // /api/gds/learnings?task=<id> — we just need body_md.
+  const api = await cliClient();
+  const r = await api.learnings.getLearnings({ query: { task: taskId } });
+  if (!r.ok) return null;
+  const rows = r.data.learnings || [];
+  return rows[0] ? { body_md: rows[0].body_md } : null;
+}
+
+async function main() {
+  console.error(`Loading shipped tasks (last ${DAYS} days)...`);
+  const shipped = await fetchShipped(DAYS);
+  console.error(`Got ${shipped.length} shipped tasks. Fetching full data + diffs...`);
+
+  const results = [];
+  for (const t of shipped) {
+    const full = await fetchFullTask(t.id);
+    if (!full) {
+      console.error(`  #${t.id}: could not fetch full task — skip`);
+      continue;
+    }
+    const sha = findCommitForTask(t.id);
+    const diff = gitDiffStatsForCommit(sha);
+    const files = filesTouchedByCommit(sha);
+    const downstream = downstreamImpact(sha, files);
+    const verification = {
+      scanner_clean: true, // got shipped → passed
+      smoke_clean: true,
+      diff_stats: diff || undefined,
+    };
+    const learningRow =
+      full.kind === 'learning-capture' ? await fetchLearning(full.id) : null;
+
+    // V3.R18 (#209): the runtime grade entry switched to gradeSubagent;
+    // this retroactive #204 audit keeps using the v1 deterministic scorer
+    // because the historical signal we're measuring (process audit, not
+    // subagent quality) is what's in the v1 rubric. The function was
+    // renamed from grade() to gradeDeterministic() in the same commit.
+    const g = grader.gradeDeterministic({
+      task: full,
+      verification,
+      actualMinutes: full.actual_minutes,
+      valueSummary: full.value_summary,
+      learningRow,
+    });
+
+    // Categorize failure mode. Only meaningful when g.passed === false.
+    // - calibration-noise: only criterion under 5 is est_actual_band
+    // - quality-concern:   multiple criteria under 5
+    // - structural-risk:   downstream impact high (≥10 commits or ≥10 distinct files)
+    let category = null;
+    if (!g.passed) {
+      const lowCriteria = Object.entries(g.rubric_scores)
+        .filter(([_k, v]) => v < 5)
+        .map(([k]) => k);
+      const onlyCalibrationLow = lowCriteria.length === 1 && lowCriteria[0] === 'est_actual_band';
+      const heavyDownstream =
+        downstream.commits_after_touching_files >= 10 ||
+        downstream.distinct_files_touched >= 10;
+      if (heavyDownstream) category = 'structural-risk';
+      else if (onlyCalibrationLow) category = 'calibration-noise';
+      else category = 'quality-concern';
+    }
+
+    results.push({
+      id: full.id,
+      title: full.title,
+      version_id: full.version_id,
+      kind: full.kind,
+      discipline: full.discipline,
+      est_minutes: full.est_minutes,
+      actual_minutes: full.actual_minutes,
+      scoping_confidence: full.scoping_confidence,
+      value_summary: full.value_summary,
+      description: full.description,
+      shipped_at: t.shipped_at,
+      diff_stats: diff,
+      files_touched: files,
+      downstream,
+      grade: g,
+      category,
+    });
+  }
+
+  if (process.argv.includes('--json')) {
+    console.log(JSON.stringify(results, null, 2));
+    return;
+  }
+
+  // Human-readable summary.
+  const passed = results.filter((r) => r.grade.passed);
+  const failed = results.filter((r) => !r.grade.passed);
+  console.log(`\n=== Audit summary ===`);
+  console.log(`Total graded:  ${results.length}`);
+  console.log(`Passed:        ${passed.length}`);
+  console.log(`Failed:        ${failed.length}  (threshold ${grader.RUBRIC.v1.threshold}, v1 deterministic)`);
+  console.log('');
+
+  if (failed.length === 0) {
+    console.log('No failures. Nothing to redo.');
+    return;
+  }
+
+  console.log('=== FAILURES (sorted by score asc) ===\n');
+  failed
+    .sort((a, b) => a.grade.score - b.grade.score)
+    .forEach((r) => {
+      console.log(`#${r.id}  score ${r.grade.score}/10  [${r.kind}]  est=${r.est_minutes}m act=${r.actual_minutes}m`);
+      console.log(`  ${r.title}`);
+      const scores = r.grade.rubric_scores;
+      const parts = Object.entries(scores).map(([k, v]) => `${k}=${v}`);
+      console.log(`  ${parts.join('  ')}`);
+      console.log('');
+    });
+
+  // Score histogram for the passed set so we see what the distribution looks like.
+  const buckets = { '5.0-5.9': 0, '6.0-6.9': 0, '7.0-7.9': 0, '8.0-8.9': 0, '9.0-10': 0 };
+  for (const r of passed) {
+    const s = r.grade.score;
+    if (s < 6) buckets['5.0-5.9']++;
+    else if (s < 7) buckets['6.0-6.9']++;
+    else if (s < 8) buckets['7.0-7.9']++;
+    else if (s < 9) buckets['8.0-8.9']++;
+    else buckets['9.0-10']++;
+  }
+  console.log('=== Passed-score histogram ===');
+  for (const [k, v] of Object.entries(buckets)) console.log(`  ${k}: ${v}`);
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/scripts/gds/autonomy-gate.js

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+// scripts/gds/autonomy-gate.js — System 3 (task 1351): the $0 deterministic
+// autonomy precheck. Before any model boots, a nightly routine runs this as
+// Step 0; on NO-GO it exits cleanly and NOTHING spawns. Three skips it can make:
+//   - no claimable autonomous work AND origin/main unchanged since the last run
+//     (overnight-builder on a no-signal night),
+//   - no open ideas to triage (triage routines),
+//   - the autonomous month-to-date spend has hit its ceiling (hard spend-brake).
+//
+// BUILT DISABLED (owner directive — hard rule 6). The gate is INERT until
+// OTB_AUTONOMY_ENABLED=1: while off, decide() always returns GO, so wiring a
+// routine's Step 0 to this changes nothing. Arm it only alongside the grader
+// rework. Every decision (especially a SKIP) is recorded to autonomy_runs.
+//
+// Usage (on the droplet, with DB + git in context):
+//   node scripts/gds/autonomy-gate.js <routine>     # exit 0 = GO, 1 = NO-GO
+//   node scripts/gds/autonomy-gate.js <routine> --json
+
+'use strict';
+
+const AUTONOMY_FLAG = 'OTB_AUTONOMY_ENABLED';
+const DEFAULT_CEILING_USD = 30; // conservative autonomous-fleet MTD ceiling; override via env
+
+function isEnabled(env = process.env) {
+  return env[AUTONOMY_FLAG] === '1';
+}
+function ceilingUsd(env = process.env) {
+  const v = Number(env.OTB_AUTONOMY_CEILING_USD);
+  return Number.isFinite(v) && v > 0 ? v : DEFAULT_CEILING_USD;
+}
+
+// Pure: the go/no-go decision from already-gathered signals. No I/O — unit-tested.
+//   enabled        — master flag; when false the gate is inert (always GO).
+//   routine        — selects which signal matters (builder/triage/…).
+//   claimableCount — parallel-safe autonomous tasks available now.
+//   openIdeasCount — open idea_inbox rows.
+//   mtdSpendUsd    — autonomous (cron:%) api spend this month.
+//   ceiling        — the spend-brake threshold.
+//   headSha/lastHeadSha — origin/main now vs the last `go` run (no-signal check).
+function decide({ enabled, routine = '', claimableCount = 0, openIdeasCount = 0, mtdSpendUsd = 0, ceiling = DEFAULT_CEILING_USD, headSha = null, lastHeadSha = null } = {}) {
+  if (!enabled) {
+    return { decision: 'go', reason: `autonomy gate disabled (${AUTONOMY_FLAG}!=1) — proceeding as normal (inert)` };
+  }
+  // 1) Hard spend-brake first — economy safety trumps any signal.
+  if (mtdSpendUsd >= ceiling) {
+    return { decision: 'no-go', reason: `autonomous MTD spend $${mtdSpendUsd.toFixed(2)} ≥ ceiling $${ceiling.toFixed(2)} — spend brake` };
+  }
+  // 2) No-signal skips, per routine kind.
+  const wantsClaimable = /builder|simplify|code-?review/i.test(routine);
+  const wantsIdeas = /idea|triage/i.test(routine);
+  const headUnchanged = !!(headSha && lastHeadSha && headSha === lastHeadSha);
+  if (wantsClaimable && claimableCount === 0 && headUnchanged) {
+    return { decision: 'no-go', reason: `no claimable autonomous tasks and origin/main unchanged since last run (${String(headSha).slice(0, 8)}) — no signal` };
+  }
+  if (wantsIdeas && openIdeasCount === 0) {
+    return { decision: 'no-go', reason: 'no open ideas to triage — no signal' };
+  }
+  return { decision: 'go', reason: `signal present (claimable=${claimableCount}, ideas=${openIdeasCount}, main ${headUnchanged ? 'unchanged' : 'changed'})` };
+}
+
+// Gather the live signals (DB + git). Real deps on the droplet; injectable for tests.
+async function gatherSignals(routine, deps = {}) {
+  // listClaimableTasks carved into modules/lifecycle/db.js (BV1.R86 / ADR 0093 §3).
+  // A CLI may require a module directly (outside the kernel boundary — precedent).
+  const db = deps.db || require('../../modules/lifecycle/db'); // listClaimableTasks — lifecycle
+  // The autonomy_runs slice (recordAutonomyRun/lastAutonomyHead) carved into
+  // modules/autonomy/db.js (BV1.R83 / ADR 0093 §1). This gate is a domain CLI that
+  // travels with the autonomy module but stays under scripts/ (a command travels
+  // with its domain; from outside the kernel boundary it may require the module
+  // directly — the memory/grading-carve precedent).
+  const autonomyDb = deps.autonomyDb || require('../../modules/autonomy/db');
+  const inbox = deps.inbox || require('../../modules/ideas/inbox'); // carved → modules/ideas/ (BV1.R78)
+  // autonomousApiSpendMtd carved into modules/economy/ (BV1.R77 / ADR 0093 §1-2).
+  // A CLI may require a module directly (the memory/grading-carve precedent); the
+  // economy cost module owns the autonomous-spend MTD read.
+  const economy = deps.economy || require('../../modules/economy/cost');
+  const git = deps.git || ((cmd) => require('child_process').execSync(cmd, { encoding: 'utf8' }).trim());
+  const claimable = await db.listClaimableTasks({ fit: 'autonomous' }).catch(() => []);
+  const openIdeasCount = await inbox.countOpenIdeas().catch(() => 0);
+  const mtdSpendUsd = await economy.autonomousApiSpendMtd().catch(() => 0);
+  let headSha = null;
+  try { git('git fetch origin main --quiet'); headSha = git('git rev-parse origin/main'); } catch (_) { /* git unavailable → null */ }
+  const lastHeadSha = await autonomyDb.lastAutonomyHead(routine).catch(() => null);
+  return { claimableCount: Array.isArray(claimable) ? claimable.length : 0, openIdeasCount: Number(openIdeasCount) || 0, mtdSpendUsd: Number(mtdSpendUsd) || 0, headSha, lastHeadSha };
+}
+
+// Full precheck: gather (only when enabled — no point paying for git/db when inert),
+// decide, record. Best-effort recording. Returns the decision + signals.
+async function precheck(routine, deps = {}) {
+  const env = deps.env || process.env;
+  const enabled = isEnabled(env);
+  let signals = { claimableCount: 0, openIdeasCount: 0, mtdSpendUsd: 0, headSha: null, lastHeadSha: null };
+  if (enabled) { try { signals = await gatherSignals(routine, deps); } catch (_) { /* fail-open → decide on zeros */ } }
+  const result = decide({ enabled, routine, ceiling: ceilingUsd(env), ...signals });
+  try {
+    // recordAutonomyRun carved into modules/autonomy/db.js (BV1.R83 / ADR 0093 §1).
+    const autonomyDb = deps.autonomyDb || require('../../modules/autonomy/db');
+    await autonomyDb.recordAutonomyRun({ routine, decision: result.decision, reason: result.reason, headSha: signals.headSha, claimableCount: signals.claimableCount, enabled });
+  } catch (_) { /* observability is best-effort; never block the gate on a log write */ }
+  return { routine, enabled, ...result, ...signals };
+}
+
+// System 3 (task 1354): the single-pass safe_autofix lane gate. A review finding
+// may be auto-fixed-AND-shipped in one run ONLY when ALL of these hold — anything
+// else stays on the inbox→promote (human-in-the-loop) path:
+//   - the autonomy gate is armed (OTB_AUTONOMY_ENABLED),
+//   - the grader is LIVE (NEVER auto-fix while GRADER_BYPASS is on — auto-shipping
+//     with the quality gate off is precisely the thing we must not do),
+//   - the change is NOT a protected path (permission-path-check.matchProtected),
+//   - the finding is high-confidence AND single-file.
+// Pure; the DEFAULTS are the refusing values (off / bypass-on / protected / low /
+// many files) so any missing field → no autofix, and the lane is inert by default.
+function autofixAllowed({ enabled = false, graderBypassOn = true, isProtected = true, confidence = 'low', fileCount = 99 } = {}) {
+  return enabled === true
+    && graderBypassOn === false
+    && isProtected === false
+    && String(confidence).toLowerCase() === 'high'
+    && Number(fileCount) === 1;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const routine = args.find((a) => !a.startsWith('--'));
+  if (!routine) { console.error('usage: autonomy-gate.js <routine> [--json]'); process.exit(2); }
+  const out = await precheck(routine);
+  if (args.includes('--json')) console.log(JSON.stringify(out, null, 2));
+  else console.log(`autonomy-gate [${routine}]: ${out.decision.toUpperCase()} — ${out.reason}`);
+  process.exit(out.decision === 'go' ? 0 : 1);
+}
+
+if (require.main === module) {
+  main().catch((e) => { console.error('autonomy-gate: error (fail-open → GO):', e && e.message); process.exit(0); });
+}
+
+module.exports = { decide, autofixAllowed, gatherSignals, precheck, isEnabled, ceilingUsd, AUTONOMY_FLAG, DEFAULT_CEILING_USD };

package/scripts/gds/backfill-cost.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+// Backfill cost_log from the art-pipeline cost ledger.
+//
+// Reads art/iterations/cost_ledger.jsonl (gitignored, lives in whichever
+// worktree ran the pipeline) and POSTs each row to /api/gds/cost.
+//
+// Idempotent thanks to migration 004_pms_cost_idempotency.sql:
+// re-running this script is a no-op (skipped rows print as 'dup').
+//
+// Usage:
+//   node scripts/gds/backfill-cost.js [path/to/cost_ledger.jsonl]
+//
+// If no path is given, the script searches for the ledger in the
+// expected locations (current art/iterations/, sibling worktrees, or
+// $OTB_COST_LEDGER env var).
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { cliClient, requireSession, fmtUsd } = require('./cli-lib');
+// Cost-attribution audit carved into modules/economy/cost-classify.js (BV1.R77 /
+// ADR 0093 §1-2). A CLI may require a module directly (the memory/grading-carve
+// precedent — grade-smoke.js requires modules/grading/grader).
+const { auditCostAttribution, formatAuditReport } = require('../../modules/economy/cost-classify');
+
+const KNOWN_LEDGER_PATHS = [
+  process.env.OTB_COST_LEDGER,
+  path.resolve(__dirname, '../../art/iterations/cost_ledger.jsonl'),
+  // Two historical absolute-path fallbacks (under the old Desktop folder name)
+  // were dropped after the project-folder rename. Pass the ledger path as a CLI
+  // arg or set OTB_COST_LEDGER to point at any non-default location.
+];
+
+function findLedger(argPath) {
+  const candidates = argPath ? [argPath, ...KNOWN_LEDGER_PATHS] : KNOWN_LEDGER_PATHS;
+  for (const p of candidates) {
+    if (p && fs.existsSync(p)) return p;
+  }
+  return null;
+}
+
+function parseLedger(filePath) {
+  const text = fs.readFileSync(filePath, 'utf8');
+  const rows = [];
+  let lineNum = 0;
+  for (const line of text.split('\n')) {
+    lineNum++;
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      rows.push({ ...JSON.parse(trimmed), _line: lineNum });
+    } catch (err) {
+      console.warn(`skip malformed line ${lineNum}: ${err.message}`);
+    }
+  }
+  return rows;
+}
+
+async function postCost(row, sourceRef) {
+  const payload = {
+    amount_usd: Number(row.cost_usd),
+    category: 'art',
+    description: [row.model, row.kind, row.tile, row.attempt != null ? `attempt ${row.attempt}` : null]
+      .filter(Boolean)
+      .join(' · '),
+    source: 'art_pipeline',
+    source_ref: sourceRef,
+    recorded_at: row.ts,
+  };
+  // V3.R11 (#91): forward the per-builder attribution stamped onto the ledger
+  // row by cost_ledger.log_call(). The cost route enforces that builder_id
+  // matches the authed builder, so we only pass it through if the row's id
+  // matches our session — otherwise we send no id and the route defaults it
+  // to the authed builder (which is the right behavior for "I'm backfilling
+  // my own historical ledger").
+  if (row.builder_id != null) {
+    payload.builder_id = Number(row.builder_id);
+  }
+  const api = await cliClient();
+  return api.cost.postCost({ body: payload });
+}
+
+async function main() {
+  // --audit (V3.R83 #303): run the cost-attribution audit against the live
+  // public cost-summary and exit. No ledger, no session needed — it reads the
+  // public endpoint and reports how much spend is attributed vs. honestly
+  // unattributed, and flags any orphaned attribution. Add --json for the raw
+  // report object.
+  if (process.argv.includes('--audit')) {
+    const api = await cliClient();
+    const summary = await api.public.getPublicCostSummary();
+    if (!summary.ok) {
+      console.error(`audit: failed to fetch cost-summary (HTTP ${summary.status})`);
+      process.exit(1);
+    }
+    const report = auditCostAttribution(summary.data);
+    if (process.argv.includes('--json')) {
+      console.log(JSON.stringify(report, null, 2));
+    } else {
+      console.log(formatAuditReport(report));
+    }
+    process.exit(report.ok ? 0 : 1);
+  }
+
+  const argPath = process.argv[2];
+  await requireSession();
+
+  const ledgerPath = findLedger(argPath);
+  if (!ledgerPath) {
+    console.error('No cost_ledger.jsonl found. Pass a path or set OTB_COST_LEDGER.');
+    console.error('Searched:');
+    for (const p of KNOWN_LEDGER_PATHS) if (p) console.error(`  - ${p}`);
+    process.exit(2);
+  }
+  console.log(`Using ledger: ${ledgerPath}`);
+
+  const rows = parseLedger(ledgerPath);
+  console.log(`Loaded ${rows.length} rows.`);
+
+  let inserted = 0;
+  let dup = 0;
+  let failed = 0;
+  let totalUsdInserted = 0;
+
+  for (let i = 0; i < rows.length; i++) {
+    const row = rows[i];
+    if (typeof row.cost_usd !== 'number' || row.cost_usd <= 0) {
+      // Skip zero-cost rows (no point logging $0).
+      continue;
+    }
+    const sourceRef = `ledger:${row.ts}:${row.tile || 'unknown'}:${row._line}`;
+    const res = await postCost(row, sourceRef);
+    if (res.status === 201) {
+      inserted++;
+      totalUsdInserted += Number(row.cost_usd);
+    } else if (res.status === 200 && res.data && res.data.skipped) {
+      dup++;
+    } else {
+      failed++;
+      if (failed <= 5) {
+        console.warn(`row ${i} failed: ${res.status} ${JSON.stringify(res.data)}`);
+      }
+    }
+    if ((i + 1) % 50 === 0) {
+      console.log(`  progress: ${i + 1}/${rows.length} (inserted=${inserted}, dup=${dup}, failed=${failed})`);
+    }
+  }
+
+  console.log('');
+  console.log(`Done. inserted=${inserted}  dup=${dup}  failed=${failed}`);
+  console.log(`Total inserted: ${fmtUsd(totalUsdInserted)}`);
+
+  // Final check against the public summary
+  const api = await cliClient();
+  const summary = await api.public.getPublicCostSummary();
+  if (summary.ok) {
+    console.log(`Public total now: ${fmtUsd(summary.data.total_usd)}`);
+  }
+
+  process.exit(failed > 0 ? 1 : 0);
+}
+
+main().catch((err) => {
+  console.error('backfill-cost.js failed:', err);
+  process.exit(1);
+});