@dzhechkov/harness-cli 0.3.244 → 0.3.246

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.244",
+  "version": "0.3.246",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -57,7 +57,7 @@
     "@dzhechkov/skills-reverse-engineering": "^0.1.0",
     "@dzhechkov/skills-presentation-storyteller": "^0.1.0",
     "@dzhechkov/skills-website-cloner": "^0.1.0",
-    "@dzhechkov/harness-core": "0.3.135"
+    "@dzhechkov/harness-core": "0.3.137"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2471dcbdf8588a65410c17557f5ef331c4f8cc77923824728f64ebe7e33d84dc"
+          "content": "129ee8a3fc96a1edda2258d02cd6dc4b8df2ab766f3b03ddb38f1559f0c0d9b9"
         }
       ]
     },
@@ -105,7 +105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2bb00d2f42334250ee57b4d0f88d92968cbe3f010ec8d75bb748c0ee6f8de0b8"
+          "content": "894d5779615292e57a6b5c204ebd04cef4b065e3fe4d8546c0f3dfbe0fb22529"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d959d7623b68286e440e04f90ee3ae7af0166c1fe506f2cf7e6e9e317439409d"
+          "content": "aaaf1d89fb27f39c125c3404b37d57f9251fe62d7993f79df5696944ae8bddcf"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "68e0bbf621169f7bae350a5b723f9425969ab12b6f7dd98ce26bb06d32c77c92"
+          "content": "dfdfb4feeb07bf037194a1aa7da4f956e88da30ec8c1848fa2e989d82ed34a0b"
         }
       ]
     },
@@ -185,7 +185,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ff01608759bb01a9bb83aa45cc4658182765d9fb4b2512f3a096b8ea55370eac"
+          "content": "139d06a7617876ef1f9a1c7408f993314f1c3415a7c95a4dc53d89dcf453d866"
         }
       ]
     },
@@ -205,7 +205,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "14a3db7155fcc858272439a55bc7a43a09c7f6fd7caa302e5a13c153fe1a6d16"
+          "content": "967efe0f790775d915f31665e270490794a8ca4bdbecd0844562edda2edf42d9"
         }
       ]
     },

package/src/cli.ts

@@ -199,6 +199,10 @@ import {
   classifyContentProbe,
   renderContentProbe,
   findNonRegistrableSkillDirs,
+  assembleCompoundingReport,
+  renderCompoundingReport,
+  readReinforcementState,
+  readQuarantineState,
   registrationExitCode,
   renderRegistrationReport,
 } from '@dzhechkov/harness-core';
@@ -232,6 +236,7 @@ Usage:
   dz parity [--target <name>] [--json]   (the honest feature×target map, COMPUTED from the capability model — which harness feature is full / manual / absent on each of the ${TARGET_NAMES.length} targets, and via which form)
   dz delivery-check --slug <slug> [--context-only] [--findings <f.json>] [--strict] [--author <model>] [--json]   (portable Step-10 Delivery Gate: prints the 4-plane review brief + artifact probes; --findings classifies a fed-back review into a fail-closed ready|blocked hand-off and writes features/<slug>/10_delivery_review.md; --strict exits 1 on blocked)
   dz skills-verify [--dir <project>] [--expect a,b] [--static] [--strict] [--json]   (does .claude/skills/ actually REGISTER? --static = instant layout scan for CI; default reads the authoritative system/init listing from a real session. exit 0 pass / 1 fail / 2 inconclusive — never a false pass)
+  dz compounding [--project <dir>] [--json]   (honest learning-loop payoff report: pool write-only ratio, guard repeat-violation trajectory, cold-vs-warm replay readiness, instrumentation health — a gate without enough data says INSUFFICIENT_DATA, never a fake verdict)
   dz setup --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--project <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--install-driver] [--force] [--enrich]
   dz teach "<pattern>" [--reward <0-1>] [--domain <name>] [--type rule|success-pattern|lesson-learned] [--project <dir>] [--no-mirror]   (--project pins the learned store to <dir>/.dz, not the cwd — pin to a canonical brain)
   dz teach --from-json <file> [--project <dir>] [--no-mirror]   (bulk-import a 'dz recall --all --json' export — share a learned store across machines)
@@ -5620,6 +5625,97 @@ function nameFor(t: { file: string; name?: string }, outcome: 'pass' | 'fail' |
  *   --author <model>         cosmetic: the reviewer to dispatch, printed alongside the brief
  *   --json                   machine contract { planesChecked, planesSkipped, findings, handoff, artifact }
  */
+/**
+ * `dz compounding` — does the learning loop actually PAY? (feature compounding, scout C2.)
+ * Gathers the facts (store rows, apply-leg usage log, guard audit) and hands them to the PURE
+ * report assembler. Gates without enough data say INSUFFICIENT_DATA — never a fake verdict.
+ */
+function cmdCompounding(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+  const json = flags.has('json');
+  if (flags.has('help')) {
+    write('dz compounding [--project <dir>] [--json] — honest learning-loop payoff report');
+    write('  pool payoff (write-only ratio) · guard repeat-violation trajectory · cold-vs-warm replay readiness · instrumentation health');
+    return 0;
+  }
+  for (const flag of flags) {
+    if (!new Set(['json', 'help']).has(flag)) {
+      write(json ? JSON.stringify({ error: `unknown option --${flag}`, exitCode: 1 }) : `dz compounding: unknown option --${flag}\n  allowed: --project <dir>, --json`);
+      return 1;
+    }
+  }
+  for (const key of options.keys()) {
+    if (key.startsWith('_positional_')) {
+      write(json ? JSON.stringify({ error: `unexpected argument "${options.get(key)}"`, exitCode: 1 }) : `dz compounding: unexpected argument "${options.get(key)}"\n  allowed: --project <dir>, --json`);
+      return 1;
+    }
+    if (key !== 'project') {
+      write(json ? JSON.stringify({ error: `unknown option --${key}`, exitCode: 1 }) : `dz compounding: unknown option --${key}\n  allowed: --project <dir>, --json`);
+      return 1;
+    }
+  }
+  const root = resolve(cwd, options.get('project') ?? '.');
+
+  // lessons — the store, with reinforcement + quarantine metadata
+  const lessons = loadStoreRecords(root).map((r) => ({
+    dzId: r.id,
+    uses: readReinforcementState(r).uses,
+    quarantined: readQuarantineState(r).quarantined,
+    reward: typeof r.score === 'number' ? r.score : null,
+  }));
+
+  // apply-leg usage events (read records only; aggregate rows carry no query by construction)
+  const usage: { dzId: string; ts: string; query?: string; runId?: string }[] = [];
+  try {
+    const text = readFileSync(join(root, '.dz', 'recall-usage.jsonl'), 'utf-8');
+    for (const line of text.split('\n')) {
+      if (line.trim() === '') continue;
+      try {
+        const o = JSON.parse(line) as Record<string, unknown>;
+        if (typeof o.dzId === 'string' && typeof o.ts === 'string' && o.kind !== 'aggregate') {
+          usage.push({
+            dzId: o.dzId,
+            ts: o.ts,
+            ...(typeof o.query === 'string' ? { query: o.query } : {}),
+            ...(typeof o.runId === 'string' ? { runId: o.runId } : {}),
+          });
+        }
+      } catch {
+        /* one bad line must not kill the report */
+      }
+    }
+  } catch {
+    /* no log yet — the report says so */
+  }
+
+  // guard audit events
+  const guard: { ts: string; verdict: string; rules: string[] }[] = [];
+  try {
+    const text = readFileSync(join(root, '.dz', 'guard-audit.jsonl'), 'utf-8');
+    for (const line of text.split('\n')) {
+      if (line.trim() === '') continue;
+      try {
+        const o = JSON.parse(line) as { ts?: unknown; verdict?: unknown; violations?: { rule?: unknown }[] };
+        if (typeof o.ts === 'string' && typeof o.verdict === 'string') {
+          guard.push({
+            ts: o.ts,
+            verdict: o.verdict,
+            rules: Array.isArray(o.violations) ? o.violations.map((v) => (typeof v?.rule === 'string' ? v.rule : '')).filter(Boolean) : [],
+          });
+        }
+      } catch {
+        /* skip */
+      }
+    }
+  } catch {
+    /* no audit yet */
+  }
+
+  const report = assembleCompoundingReport({ lessons, usage, guard, nowTs: new Date().toISOString() });
+  if (json) write(JSON.stringify({ ...report, exitCode: 0 }, null, 2));
+  else write(renderCompoundingReport(report));
+  return 0;
+}
+
 /**
  * Env vars an INHERITED Claude session leaks into a child. Left in place, the probe can silently
  * read the parent's project instead of the target — the exact confound that made a hand-rolled
@@ -6397,6 +6493,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdDeliveryCheck(options, flags, cwd, write);
       case 'skills-verify':
         return cmdSkillsVerify(options, flags, cwd, write);
+      case 'compounding':
+        return cmdCompounding(options, flags, cwd, write);
       case 'routing':
         return cmdRouting(options, flags, cwd, write);
       case 'bto-optimize':