@dzhechkov/harness-cli 0.3.243 → 0.3.245

package/.dz-manifest.json

@@ -9,7 +9,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "5f4e31653970ef6970b6d87c862a1c6ac1f2da92c3f4f913b4be4155284db1f4"
+        "sha256": "8be358264886041e22508990afe5d9b395f9fc4248dd46a9cee7a2cf6cd4429e"
       },
       {
         "path": "coverage/coverage-final.json",
@@ -41,15 +41,15 @@
       },
       {
         "path": "dist/cli.d.ts.map",
-        "sha256": "2bb00d2f42334250ee57b4d0f88d92968cbe3f010ec8d75bb748c0ee6f8de0b8"
+        "sha256": "894d5779615292e57a6b5c204ebd04cef4b065e3fe4d8546c0f3dfbe0fb22529"
       },
       {
         "path": "dist/cli.js",
-        "sha256": "d959d7623b68286e440e04f90ee3ae7af0166c1fe506f2cf7e6e9e317439409d"
+        "sha256": "aaaf1d89fb27f39c125c3404b37d57f9251fe62d7993f79df5696944ae8bddcf"
       },
       {
         "path": "dist/cli.js.map",
-        "sha256": "68e0bbf621169f7bae350a5b723f9425969ab12b6f7dd98ce26bb06d32c77c92"
+        "sha256": "dfdfb4feeb07bf037194a1aa7da4f956e88da30ec8c1848fa2e989d82ed34a0b"
       },
       {
         "path": "dist/index.d.ts",
@@ -73,7 +73,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "e26250419d70ec922def52f25f63000b658eec8203b29a2135edad1be98f8d5d"
+        "sha256": "af2086ded1d37777464e520760fc7c25435bd0c96808e7555f0144f2cd4863af"
       },
       {
         "path": "src/bin.ts",
@@ -81,7 +81,7 @@
       },
       {
         "path": "src/cli.ts",
-        "sha256": "14a3db7155fcc858272439a55bc7a43a09c7f6fd7caa302e5a13c153fe1a6d16"
+        "sha256": "967efe0f790775d915f31665e270490794a8ca4bdbecd0844562edda2edf42d9"
       },
       {
         "path": "src/index.ts",
@@ -101,5 +101,5 @@
       }
     ]
   },
-  "signature": "gGmbCW5Q8VH8CPNbUxHMrZBTxa6wqihi7F0bfUw+dyfN09I/hBQJZzhkautvL4TeFLGJGxkzzXVvpBqjoLHEAw=="
+  "signature": "Ittm2O/b8yBu3Iu5RFRkiEnj8nTDq3a9G5mS8k94mXHmqrmNOJiUqUTk4YtZO7jZ1nyKQP7sCYwUmC5MZq5rBQ=="
 }

package/README.md

@@ -434,6 +434,36 @@ dz parity — codex  (capabilities: shell, skills, mcp)
 **When to use:** before promising a workflow to a teammate on Cursor/Codex/Hermes; when choosing
 a target for a project; as the requirements input for porting a feature to more targets.
 
+### Does the learning loop actually pay? — `dz compounding`
+
+dz's self-learning has collect, rank and apply legs — this command answers whether they COMPOUND,
+honestly. Ported from rUv's darwin-mode with a deliberate split: the seeded statistics came over
+verbatim (deterministic bootstrap, lower-95 promotion, and a minimum of 5 samples per arm — darwin's
+own calibration measured a 33% false-discovery rate at n=3); darwin's measurement legs did NOT (they
+score fixtures, not your data). The measurements here run over what your machine actually recorded:
+
+```
+$ dz compounding
+  POOL PAYOFF: 154 lessons · 27 ever injected by the apply leg · 89 touched by any recall
+    write-only ratio (strict bar): 82%
+  GUARD TRAJECTORY (violations, first half vs second half of the audit span):
+    ↓ no-workspace-star: 31 → 0
+    ↓ readme-first: 49 → 4
+  COLD-VS-WARM REPLAY: 2 unique prompt event(s); 5 needed — queries are recorded as of 2026-07-28
+  INSTRUMENTATION: last apply-leg record … — live
+```
+
+Three honesty rules are load-bearing:
+- **a gate without enough data says INSUFFICIENT DATA** — never a verdict (the apply-leg log turned
+  out to have been silently dead for 19 days; "no data" is a finding, not a pass);
+- **readiness is not a result** — the replay section says `ready`, never `promote`;
+- **improvement is judged by RATE** (violations per audit), so a quiet afternoon cannot masquerade
+  as progress.
+
+The prompt queries that make replay possible stay on your machine: `.dz/recall-usage.jsonl` is
+git-ignored, entries are truncated at 200 chars and flagged when truncated (a prefix is not a prompt,
+so flagged rows never count as replayable).
+
 ### Usage estimates you can act on — `dz usage`
 
 `dz usage` estimates how much of your Claude session (5h block) and week you have spent, from local
@@ -447,6 +477,9 @@ Two things changed to make it mean something:
   1-hour TTL write, cache-read 0.1x, output 5x).
 - **Subagent transcripts count.** `<session>/subagents/*.jsonl` carry real, non-duplicated usage and
   were silently excluded.
+- **The walk is safe and bounded.** Only regular files are read, symlinked files and directory
+  components are skipped (a FIFO used to block it, a symlink used to be followed), and the file cap
+  keeps the NEWEST transcripts so a long history cannot push current usage out of view.
 
 ```bash
 dz usage                       # session ~13% (resets 10:24) · week ~15% (resets 08:59) · estimated

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwRH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA20L9E,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAoJ5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA6RH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAs6L9E,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAsJ5E"}

package/dist/cli.js

@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url';
 import { execSync, spawn } from 'node:child_process';
 import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
-import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, buildParityMatrix, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, mirrorEntriesToVector, patternVectorEntry, readMemoryLearningConfig, promotePatterns, quarantineExpiryCandidates, pruneQuarantinePatterns, clearAgentdbQuarantine, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, collectDeliveryFacts, planDeliveryCheck, renderDeliveryBrief, classifyDelivery, isUsablePlaneResult, renderDeliveryReview, scanSkillsLayout, parseInitFacts, verifyRegistration, buildContentProbePrompt, classifyContentProbe, renderContentProbe, findNonRegistrableSkillDirs, registrationExitCode, renderRegistrationReport, } from '@dzhechkov/harness-core';
+import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, buildParityMatrix, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, mirrorEntriesToVector, patternVectorEntry, readMemoryLearningConfig, promotePatterns, quarantineExpiryCandidates, pruneQuarantinePatterns, clearAgentdbQuarantine, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, collectDeliveryFacts, planDeliveryCheck, renderDeliveryBrief, classifyDelivery, isUsablePlaneResult, renderDeliveryReview, scanSkillsLayout, parseInitFacts, verifyRegistration, buildContentProbePrompt, classifyContentProbe, renderContentProbe, findNonRegistrableSkillDirs, assembleCompoundingReport, renderCompoundingReport, readReinforcementState, readQuarantineState, registrationExitCode, renderRegistrationReport, } from '@dzhechkov/harness-core';
 import { getPreset, PRESET_NAMES } from '@dzhechkov/harness-presets';
 import { scanGitHub, analyzeRepo, generateReport, deepAnalyze, scanAllSources, ScoutMemory } from '@dzhechkov/scout';
 const USAGE = `dz - DZ cross-platform harness CLI
@@ -36,6 +36,7 @@ Usage:
   dz parity [--target <name>] [--json]   (the honest feature×target map, COMPUTED from the capability model — which harness feature is full / manual / absent on each of the ${TARGET_NAMES.length} targets, and via which form)
   dz delivery-check --slug <slug> [--context-only] [--findings <f.json>] [--strict] [--author <model>] [--json]   (portable Step-10 Delivery Gate: prints the 4-plane review brief + artifact probes; --findings classifies a fed-back review into a fail-closed ready|blocked hand-off and writes features/<slug>/10_delivery_review.md; --strict exits 1 on blocked)
   dz skills-verify [--dir <project>] [--expect a,b] [--static] [--strict] [--json]   (does .claude/skills/ actually REGISTER? --static = instant layout scan for CI; default reads the authoritative system/init listing from a real session. exit 0 pass / 1 fail / 2 inconclusive — never a false pass)
+  dz compounding [--project <dir>] [--json]   (honest learning-loop payoff report: pool write-only ratio, guard repeat-violation trajectory, cold-vs-warm replay readiness, instrumentation health — a gate without enough data says INSUFFICIENT_DATA, never a fake verdict)
   dz setup --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--project <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--install-driver] [--force] [--enrich]
   dz teach "<pattern>" [--reward <0-1>] [--domain <name>] [--type rule|success-pattern|lesson-learned] [--project <dir>] [--no-mirror]   (--project pins the learned store to <dir>/.dz, not the cwd — pin to a canonical brain)
   dz teach --from-json <file> [--project <dir>] [--no-mirror]   (bulk-import a 'dz recall --all --json' export — share a learned store across machines)
@@ -5371,6 +5372,100 @@ function nameFor(t, outcome) {
  *   --author <model>         cosmetic: the reviewer to dispatch, printed alongside the brief
  *   --json                   machine contract { planesChecked, planesSkipped, findings, handoff, artifact }
  */
+/**
+ * `dz compounding` — does the learning loop actually PAY? (feature compounding, scout C2.)
+ * Gathers the facts (store rows, apply-leg usage log, guard audit) and hands them to the PURE
+ * report assembler. Gates without enough data say INSUFFICIENT_DATA — never a fake verdict.
+ */
+function cmdCompounding(options, flags, cwd, write) {
+    const json = flags.has('json');
+    if (flags.has('help')) {
+        write('dz compounding [--project <dir>] [--json] — honest learning-loop payoff report');
+        write('  pool payoff (write-only ratio) · guard repeat-violation trajectory · cold-vs-warm replay readiness · instrumentation health');
+        return 0;
+    }
+    for (const flag of flags) {
+        if (!new Set(['json', 'help']).has(flag)) {
+            write(json ? JSON.stringify({ error: `unknown option --${flag}`, exitCode: 1 }) : `dz compounding: unknown option --${flag}\n  allowed: --project <dir>, --json`);
+            return 1;
+        }
+    }
+    for (const key of options.keys()) {
+        if (key.startsWith('_positional_')) {
+            write(json ? JSON.stringify({ error: `unexpected argument "${options.get(key)}"`, exitCode: 1 }) : `dz compounding: unexpected argument "${options.get(key)}"\n  allowed: --project <dir>, --json`);
+            return 1;
+        }
+        if (key !== 'project') {
+            write(json ? JSON.stringify({ error: `unknown option --${key}`, exitCode: 1 }) : `dz compounding: unknown option --${key}\n  allowed: --project <dir>, --json`);
+            return 1;
+        }
+    }
+    const root = resolve(cwd, options.get('project') ?? '.');
+    // lessons — the store, with reinforcement + quarantine metadata
+    const lessons = loadStoreRecords(root).map((r) => ({
+        dzId: r.id,
+        uses: readReinforcementState(r).uses,
+        quarantined: readQuarantineState(r).quarantined,
+        reward: typeof r.score === 'number' ? r.score : null,
+    }));
+    // apply-leg usage events (read records only; aggregate rows carry no query by construction)
+    const usage = [];
+    try {
+        const text = readFileSync(join(root, '.dz', 'recall-usage.jsonl'), 'utf-8');
+        for (const line of text.split('\n')) {
+            if (line.trim() === '')
+                continue;
+            try {
+                const o = JSON.parse(line);
+                if (typeof o.dzId === 'string' && typeof o.ts === 'string' && o.kind !== 'aggregate') {
+                    usage.push({
+                        dzId: o.dzId,
+                        ts: o.ts,
+                        ...(typeof o.query === 'string' ? { query: o.query } : {}),
+                        ...(typeof o.runId === 'string' ? { runId: o.runId } : {}),
+                    });
+                }
+            }
+            catch {
+                /* one bad line must not kill the report */
+            }
+        }
+    }
+    catch {
+        /* no log yet — the report says so */
+    }
+    // guard audit events
+    const guard = [];
+    try {
+        const text = readFileSync(join(root, '.dz', 'guard-audit.jsonl'), 'utf-8');
+        for (const line of text.split('\n')) {
+            if (line.trim() === '')
+                continue;
+            try {
+                const o = JSON.parse(line);
+                if (typeof o.ts === 'string' && typeof o.verdict === 'string') {
+                    guard.push({
+                        ts: o.ts,
+                        verdict: o.verdict,
+                        rules: Array.isArray(o.violations) ? o.violations.map((v) => (typeof v?.rule === 'string' ? v.rule : '')).filter(Boolean) : [],
+                    });
+                }
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    catch {
+        /* no audit yet */
+    }
+    const report = assembleCompoundingReport({ lessons, usage, guard, nowTs: new Date().toISOString() });
+    if (json)
+        write(JSON.stringify({ ...report, exitCode: 0 }, null, 2));
+    else
+        write(renderCompoundingReport(report));
+    return 0;
+}
 /**
  * Env vars an INHERITED Claude session leaks into a child. Left in place, the probe can silently
  * read the parent's project instead of the target — the exact confound that made a hand-rolled
@@ -6161,6 +6256,8 @@ export async function runCli(argv, io = {}) {
                 return cmdDeliveryCheck(options, flags, cwd, write);
             case 'skills-verify':
                 return cmdSkillsVerify(options, flags, cwd, write);
+            case 'compounding':
+                return cmdCompounding(options, flags, cwd, write);
             case 'routing':
                 return cmdRouting(options, flags, cwd, write);
             case 'bto-optimize':