@dzhechkov/harness-core 0.8.38 → 0.8.40

package/src/qe-bridge.ts

@@ -50,7 +50,10 @@ export const CLAUDE_BRIDGE_PROMPT_CEILING_CHARS = 200_000;
  */
 export const KNOWN_CLAUDE: Record<string, 1> = { opus: 1, sonnet: 1, haiku: 1 };
 
-/** The terminal verdict grammar: `QE-BRIDGE-SIGNOFF grade=<A-F> findings=<n>`. */
+/** The terminal verdict grammar: `QE-BRIDGE-SIGNOFF grade=<A-F, optionally + or -> findings=<n>`.
+ *  bridge-grade-grammar (ddf83072): a live Sonnet review wrote `grade=B-` in all three channels on
+ *  2026-09-17 06:52 and the whole 145-second review was discarded as no-grade-marker, while every
+ *  other consumer (round close, score, recap) already accepted modifiers. */
 export const BRIDGE_MARKER = 'QE-BRIDGE-SIGNOFF';
 
 /** The fenced block's info string. */
@@ -345,7 +348,7 @@ export function defangSignoffEchoes(text: string): string {
   out = out.replace(/qe-bridge-signoff/gi, '[quoted-fence-label]');
   out = out.split(BRIDGE_EXTRACT_END).join('[quoted-boundary]');
   // Line-anchored verdict lines only — prose such as "upgrade the grade later" is untouched.
-  out = out.replace(/^([ \t>*~-]*)(?:\*{0,2}#{0,4}[ \t]*)?GRADE[ \t]*[:=—–-]?[ \t]*([A-F])\b/gim, '$1[quoted-grade] $2');
+  out = out.replace(/^([ \t>*~-]*)(?:\*{0,2}#{0,4}[ \t]*)?GRADE[ \t]*[:=—–-]?[ \t]*([A-F](?:[+-](?![ \t]*[A-F]\b))?)(?![A-Za-z])/gim, '$1[quoted-grade] $2');
   return out;
 }
 
@@ -410,13 +413,14 @@ export function buildBridgePrompt(
     'happen in this environment.',
     '',
     'Output format — ALL THREE parts are required, in this order, at the END of your answer:',
-    '  (a) your review prose, containing exactly ONE line that reads:  GRADE: <A-F>',
+    '  (a) your review prose, containing exactly ONE line that reads:  GRADE: ' + GRADE_PLACEHOLDER,
     '  (b) a fenced code block labelled ' + BRIDGE_FENCE_LABEL + ' whose body is JSON:',
-    '      {"grade":"<A-F>","findings":[{"n":1,"severity":"major","title":"…","file":"path","line":12}]}',
+    '      {"grade":"' + GRADE_PLACEHOLDER + '","findings":[{"n":1,"severity":"major","title":"…","file":"path","line":12}]}',
     '      A genuinely clean review writes "findings": [] — but it must WRITE it.',
-    '  (c) a final line, on its own:  ' + BRIDGE_MARKER + ' grade=<A-F> findings=<n>',
-    'The grade in all three places must be the SAME letter — ONE capital letter A, B, C, D, E or F,',
-    'with NO + or - suffix (write B, never B- or B+; a modifier makes the whole answer unparseable).',
+    '  (c) a final line, on its own:  ' + BRIDGE_MARKER + ' grade=' + GRADE_PLACEHOLDER + ' findings=<n>',
+    'The grade in all three places must be the SAME grade, character for character — one capital',
+    'letter A, B, C, D, E or F, optionally followed by + or -.',
+    'A modifier is fine (B+, B, B-) and is carried through verbatim; what breaks the parse is a RANGE (A-F), prose in place of the letter, or two channels disagreeing.',
     'Anything else is discarded as a failed call — an unparseable answer is treated as no review at',
     'all, never as a passing one.',
     '',
@@ -447,7 +451,14 @@ export function buildBridgePrompt(
 
 /** Line-anchored marker. Leading quote/list decoration is allowed on purpose: a planted marker
  * SHOULD match the grammar — and then lose to the LAST one. Anchoring is the defence, not evasion. */
-const MARKER_LINE = /^[ \t>*~-]*QE-BRIDGE-SIGNOFF[ \t]+grade=([A-F])[ \t]+findings=(\d{1,6})[ \t]*$/gim;
+/** The grade placeholder the reviewer prompt shows in ALL THREE output slots. It lives in one
+ * constant because round-2 review (2026-09-18, HIGH #1 partial) found the opposite: the marker slot
+ * invited a modifier while the prose and JSON slots still read `<A-F>` — which is also the exact
+ * spelling of the RANGE the parser refuses, so the template taught the reviewer to write the one
+ * thing that breaks the parse. One spelling, three slots, no drift. */
+const GRADE_PLACEHOLDER = '<A-F, optionally with + or ->';
+
+const MARKER_LINE = /^[ \t>*~-]*QE-BRIDGE-SIGNOFF[ \t]+grade=([A-F][+-]?)[ \t]+findings=(\d{1,6})[ \t]*$/gim;
 
 /** Fenced `qe-bridge-signoff` block. */
 const SIGNOFF_FENCE = /^[ \t]*(?:`{3,}|~{3,})[ \t]*qe-bridge-signoff[ \t]*\r?\n([\s\S]*?)^[ \t]*(?:`{3,}|~{3,})[ \t]*$/gim;
@@ -538,7 +549,7 @@ export function parseBridgeOutput(
   // channel 1 — the LAST terminal marker line, which must be the FINAL content of the answer
   const marker = lastMatch(MARKER_LINE, text);
   if (marker === null) {
-    return fail('no-grade-marker', 'no `' + BRIDGE_MARKER + ' grade=<A-F> findings=<n>` line anywhere in ' + text.length + ' chars of reviewer output — text without a verdict marker is not a verdict');
+    return fail('no-grade-marker', 'no `' + BRIDGE_MARKER + ' grade=<A-F, optionally with + or -> findings=<n>` line anywhere in ' + text.length + ' chars of reviewer output — text without a verdict marker is not a verdict');
   }
   const markerGrade = String(marker[1]).toUpperCase();
   const markerCount = Number(marker[2]);
@@ -576,8 +587,8 @@ export function parseBridgeOutput(
   }
   const obj = parsedJson as Record<string, unknown>;
   const jsonGradeRaw = obj['grade'];
-  if (typeof jsonGradeRaw !== 'string' || !/^[A-Fa-f]$/.test(jsonGradeRaw.trim())) {
-    return fail('no-signoff-json', 'the fenced JSON block names no `grade` letter A-F (saw ' + JSON.stringify(jsonGradeRaw) + ')');
+  if (typeof jsonGradeRaw !== 'string' || !/^[A-Fa-f][+-]?$/.test(jsonGradeRaw.trim())) {
+    return fail('no-signoff-json', 'the fenced JSON block names no `grade` letter A-F (optionally with + or -) (saw ' + JSON.stringify(jsonGradeRaw) + ')');
   }
   const jsonGrade = jsonGradeRaw.trim().toUpperCase();
   const validated = validateFindings(obj['findings']);

package/src/rake-analyzer.ts

@@ -15,6 +15,7 @@
  */
 
 import { existsSync, readFileSync, readdirSync, statSync, realpathSync } from 'node:fs';
+import { maskMarkdown } from './markdown-masker.js';
 import { join } from 'node:path';
 
 export type Severity = 'blocker' | 'high' | 'medium' | 'low' | 'unknown';
@@ -47,28 +48,67 @@ export interface RakeReport {
 }
 
 export interface RakeSignature { readonly id: string; readonly label: string; readonly patterns: readonly RegExp[] }
+export interface RakeSignatureSpec { readonly id: string; readonly label: string; readonly patterns: readonly string[]; readonly flags?: string }
+
+/**
+ * Decode the data-only signature table. This fails closed: stateful `g`/`y` patterns would make
+ * RegExp.test() depend on lastIndex, which breaks signatureOf's determinism.
+ */
+export function loadRakeSignatures(raw: unknown): readonly RakeSignature[] {
+  if (!Array.isArray(raw)) throw new Error('Rake signatures: expected an array');
+  const signatures = raw.map((entry, index): RakeSignature => {
+    const name = typeof entry === 'object' && entry !== null && typeof (entry as { id?: unknown }).id === 'string'
+      ? (entry as { id: string }).id
+      : `entry #${index}`;
+    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) throw new Error(`Rake signature ${name}: expected an object`);
+    const spec = entry as Partial<RakeSignatureSpec>;
+    if (typeof spec.id !== 'string' || spec.id === '') throw new Error(`Rake signature ${name}: missing id`);
+    if (typeof spec.label !== 'string' || spec.label === '') throw new Error(`Rake signature ${name}: missing label`);
+    if (!Array.isArray(spec.patterns) || spec.patterns.length === 0 || spec.patterns.some((p) => typeof p !== 'string' || p === '')) {
+      throw new Error(`Rake signature ${name}: patterns must be a non-empty string array`);
+    }
+    const flags = spec.flags ?? '';
+    if (typeof flags !== 'string') throw new Error(`Rake signature ${name}: flags must be a string`);
+    if (/[gy]/.test(flags)) throw new Error(`Rake signature ${name}: stateful g/y flags are forbidden`);
+    let patterns: RegExp[];
+    try { patterns = spec.patterns.map((pattern) => new RegExp(pattern, flags)); }
+    catch (error) { throw new Error(`Rake signature ${name}: invalid regular expression (${error instanceof Error ? error.message : String(error)})`); }
+    for (const pattern of patterns) Object.freeze(pattern);
+    return Object.freeze({ id: spec.id, label: spec.label, patterns: Object.freeze(patterns) });
+  });
+  return Object.freeze(signatures);
+}
 
 /**
  * Known rake classes (extensible, data-only). Seeded from the classes that actually recur in this repo's
  * QE reports — that IS the dogfood. First match in order wins; unmatched → normalized-text bucket.
  */
-export const RAKE_SIGNATURES: readonly RakeSignature[] = [
-  { id: 'esm-require-footgun', label: 'ESM lazy require() undefined at runtime', patterns: [/require\(['"]node:/, /\besm\b.*require/i, /lazy require/i] },
-  { id: 'untested-adr-property', label: 'ADR-named safety property left untested', patterns: [/load-bearing.*(untested|not\s+tested|no\s+test)/i, /adr.*names.*(property|test)/i, /safety property.*test/i] },
-  { id: 'claim-check-fp', label: 'claim-check false positive / untagged count', patterns: [/claim-check.*(false positive|\bfp\b)/i, /untagged.*(count|claim)/i, /metric term/i] },
-  // "traversal" alone over-matches (AST/tree traversal); require a filesystem-scope token to CO-OCCUR
-  // (or a literal `../`) — cross-model QE caught the over-match.
-  { id: 'path-traversal', label: 'path not constrained to the repo (traversal)', patterns: [/\.\.\//, /(?=.*travers)(?=.*(repo|root|\bpath\b|director|\/etc\/))/i, /escapes.{0,12}repo/i] },
-  { id: 'silent-drop-or-inject', label: 'silent drop / silent injection (no report)', patterns: [/silent(ly)?\s+(drop|inject|discard|dropped)/i, /no silent (injection|caps|drop)/i] },
-  { id: 'swallow-generic-exception', label: 'generic except/catch swallows real bugs', patterns: [/except\s+Exception/i, /catch.*swallow/i, /generic (exception|catch)/i] },
-  { id: 'determinism-hole', label: 'non-deterministic output (unsorted/clock/random)', patterns: [/non-determinis/i, /determinism hole/i, /unsorted|not sorted/i] },
-  { id: 'cross-model-self-qe', label: 'coder self-QE instead of cross-model', patterns: [/self-qe/i, /coder.*(review|qe).*(itself|self)/i, /cross-model/i] },
-  { id: 'malformed-input-bypass', label: 'malformed input bypasses validation', patterns: [/array.*(pass|bypass)/i, /malformed.*(bypass|pass|manifest)/i, /typeof.*object/i] },
-];
-// Deep-freeze so an external caller can't inject a `/g`-flag regex whose `.test()` mutates lastIndex and
-// makes signatureOf non-deterministic (cross-model QE). None of the patterns above use `g`/`y`.
-for (const s of RAKE_SIGNATURES) { Object.freeze(s.patterns); Object.freeze(s); }
-Object.freeze(RAKE_SIGNATURES);
+/**
+ * Таблица живёт В ПАКЕТЕ, а не в `docs/`, и путь записан ровно как у близнеца
+ * `slop-lint.ts` → `../src/slop-markers.json`: из собранного `dist/` он указывает в `src/`,
+ * который входит в `files[]` и потому ПУБЛИКУЕТСЯ. Запись бэклога предлагала
+ * `docs/methodology/`, но чтение стоит на верхнем уровне модуля — в опубликованном пакете
+ * такого пути нет, и модуль упал бы ПРИ ИМПОРТЕ, утащив за собой каждого потребителя.
+ * Человекочитаемое описание схемы осталось в `docs/methodology/rake-signatures.md`.
+ */
+const RAKE_SIGNATURES_FILE = new URL('../src/rake-signatures.json', import.meta.url);
+export const RAKE_SIGNATURES = loadRakeSignatures(readRakeSignaturesFile(RAKE_SIGNATURES_FILE));
+
+/** Отдельный читатель, чтобы отсутствие или порча файла назывались СВОИМИ ИМЕНАМИ, а не
+ *  прилетали сырым ENOENT/SyntaxError из середины загрузки модуля. */
+function readRakeSignaturesFile(url: URL): unknown {
+  let raw: string;
+  try {
+    raw = readFileSync(url, 'utf8');
+  } catch (err) {
+    throw new Error(`rake-signatures: таблица не найдена по пути ${url.pathname} — пакет собран без src/? (${err instanceof Error ? err.message : String(err)})`);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`rake-signatures: ${url.pathname} не разбирается как JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
 
 const byStr = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0);
 const uniqSorted = (xs: readonly string[]): string[] => [...new Set(xs)].sort(byStr);
@@ -97,8 +137,8 @@ const toSeverity = (raw: string): Severity => SEV_MAP[raw.trim().toLowerCase()]
 const SITE_RE = /([\w./-]+\.(?:ts|js|tsx|jsx|py|go|md|json|yml|yaml):\d+)/;
 
 /** The signature of a finding: first matching rule, else the normalized-text bucket. */
-export function signatureOf(finding: Finding): { id: string; label: string } {
-  for (const s of RAKE_SIGNATURES) {
+export function signatureOf(finding: Finding, signatures: readonly RakeSignature[] = RAKE_SIGNATURES): { id: string; label: string } {
+  for (const s of signatures) {
     if (s.patterns.some((p) => p.test(finding.text))) return { id: s.id, label: s.label };
   }
   const key = normalizeText(finding.text);
@@ -115,13 +155,28 @@ export function signatureOf(finding: Finding): { id: string; label: string } {
  */
 export function extractFindings(markdown: string, source: string): Finding[] {
   const out: Finding[] = [];
+  // Строки ВНУТРИ блока кода находками не являются: отчёт QE регулярно показывает ПРИМЕР того,
+  // как писать не надо, и пример оформлен той же таблицей. ИЗМЕРЕНО 2026-09-19: отчёт с одной
+  // настоящей находкой и одной строкой-примером в ```-блоке давал ДВЕ находки.
+  // Маскировщик здесь ОБЩИЙ (`markdown-masker`), тот же, что у `amendment-trace` и у гейта K2 —
+  // запись 8b309a04 просила один проход на весь харнесс, а не третий собственный разбор.
+  // Решение «считать ли строку» принимается по МАСКЕ, а текст находки берётся из ИСХОДНИКА:
+  // маска сохраняет разбиение на строки, но не содержимое.
+  // ОДИН механизм: читаем МАСКУ. Маскировщик заменяет строки внутри блока кода филлером той же
+  // длины и не трогает остальные, поэтому отдельный список «пропустить замаскированные» был бы
+  // ВТОРОЙ защитой — и мутация, снимающая только её, осталась бы эквивалентной (проверено:
+  // 35 тестов из 35 зелёные при «снятой» починке). Ровно тот же капкан, что сегодня в гейте K2.
+  const maskLines = String(maskMarkdown(markdown)).split('\n');
   const push = (severity: Severity, text: string): void => {
     const t = text.replace(/\s+/g, ' ').trim();
     if (t.length < 8) return;                                  // too short to be a finding
     const site = SITE_RE.exec(t)?.[1];
     out.push(site ? { source, severity, text: t, site } : { source, severity, text: t });
   };
-  for (const line of markdown.split('\n')) {
+  const sourceLines = markdown.split('\n');
+  for (let i = 0; i < sourceLines.length; i++) {
+    // Читаем маску, а не исходник: строка, спрятанная блоком кода, до правил ниже не доходит.
+    const line = maskLines[i] ?? sourceLines[i] ?? '';
     // (a) table row: | ... | <sev> | <finding> | ...
     const cells = line.includes('|') ? line.split('|').map((c) => c.trim()) : null;
     if (cells && cells.length >= 4) {

package/src/rake-signatures.json

@@ -0,0 +1,98 @@
+[
+  {
+    "id": "esm-require-footgun",
+    "label": "ESM lazy require() undefined at runtime",
+    "patterns": ["require\\(['\\\"]node:", "\\besm\\b.*require", "lazy require"],
+    "flags": "i"
+  },
+  {
+    "id": "untested-adr-property",
+    "label": "ADR-named safety property left untested",
+    "patterns": ["load-bearing.*(untested|not\\s+tested|no\\s+test)", "adr.*names.*(property|test)", "safety property.*test"],
+    "flags": "i"
+  },
+  {
+    "id": "claim-check-fp",
+    "label": "claim-check false positive / untagged count",
+    "patterns": ["claim-check.*(false positive|\\bfp\\b)", "untagged.*(count|claim)", "metric term"],
+    "flags": "i"
+  },
+  {
+    "id": "path-traversal",
+    "label": "path not constrained to the repo (traversal)",
+    "patterns": ["\\.\\./", "(?=.*travers)(?=.*(repo|root|\\bpath\\b|director|/etc/))", "escapes.{0,12}repo"],
+    "flags": "i"
+  },
+  {
+    "id": "silent-drop-or-inject",
+    "label": "silent drop / silent injection (no report)",
+    "patterns": ["silent(ly)?\\s+(drop|inject|discard|dropped)", "no silent (injection|caps|drop)"],
+    "flags": "i"
+  },
+  {
+    "id": "swallow-generic-exception",
+    "label": "generic except/catch swallows real bugs",
+    "patterns": ["except\\s+Exception", "catch.*swallow", "generic (exception|catch)"],
+    "flags": "i"
+  },
+  {
+    "id": "determinism-hole",
+    "label": "non-deterministic output (unsorted/clock/random)",
+    "patterns": ["non-determinis", "determinism hole", "unsorted|not sorted"],
+    "flags": "i"
+  },
+  {
+    "id": "cross-model-self-qe",
+    "label": "coder self-QE instead of cross-model",
+    "patterns": ["self-qe", "coder.*(review|qe).*(itself|self)", "cross-model", "same-family.{0,40}(qe|review)", "cross-family.{0,60}(not obtained|did not happen|fell back)"],
+    "flags": "i"
+  },
+  {
+    "id": "malformed-input-bypass",
+    "label": "malformed input bypasses validation",
+    "patterns": ["array.*(pass|bypass)", "malformed.*(bypass|pass|manifest)", "typeof.*object"],
+    "flags": "i"
+  },
+  {
+    "id": "wiring-tail",
+    "label": "implementation wiring tail left unfinished",
+    "patterns": ["wiring[-\\s]tail", "wiring-хвост", "незавершённая проводка"],
+    "flags": "i"
+  },
+  {
+    "id": "canonical-copy-edit",
+    "label": "edit made in a canonical copy",
+    "patterns": ["canonical\\s+copy", "каноническ\\w*\\s+коп", "edited in the\\s+\\*\\*canonical\\*\\*\\s+copy"],
+    "flags": "i"
+  },
+  {
+    "id": "zero-or-partial-landing",
+    "label": "zero or partial implementation landing",
+    "patterns": ["zero\\s+code\\s+landed", "genuinely-not-landed", "step\\s*7.{0,50}did not land"],
+    "flags": "i"
+  },
+  {
+    "id": "corpus-preimage-not-repinned",
+    "label": "corpus preimage was not re-pinned",
+    "patterns": ["preimage.{0,80}(never|not).{0,30}re-?pinned", "(?:registry|corpus).{0,40}(?:find|anchor).{0,80}(never|not).{0,30}re-?pinned", "find.{0,10}string was never re-pinned"],
+    "flags": "i"
+  },
+  {
+    "id": "verdict-from-proxy",
+    "label": "verdict inferred from a proxy instead of the subject",
+    "patterns": ["(?:verdict|decision|grade).{0,60}proxy", "proxy.{0,60}(?:verdict|decision|grade|property)", "asserted a\\s+\\*\\*?proxy\\*\\*?.{0,80}not the\\s+\\*\\*?property"],
+    "flags": "i"
+  },
+  {
+    "id": "single-language-book-silence",
+    "label": "book result silently omitted for a single-language query",
+    "patterns": ["books are silent", "книги молчат", "book.{0,50}(silent|silence)"],
+    "flags": "i"
+  },
+  {
+    "id": "reserved-heading-collision",
+    "label": "reserved heading collision",
+    "patterns": ["(?:name|heading).{0,12}collision.{0,60}reused.{0,8}#{1,6}\\s", "reused.{0,8}#{1,6}\\s+scenario coverage", "заголов.{0,50}(?:collision|столкнов)"],
+    "flags": "i"
+  }
+]

package/src/recap.ts

@@ -351,16 +351,20 @@ export function buildRecap(facts: RecapFacts): RecapReport {
     const covered = coveredWindow(v, facts.window);
     const items = (facts.deliveries?.items ?? []).map(normaliseDelivery).filter((d) => withinWindow(covered, d.createdIso));
     const graded = items.filter((d): d is Extract<Delivery, { gradeStatus: 'unique' }> => d.gradeStatus === 'unique');
-    // fix-round-1: 'invalid' (a malformed QE-VERDICT attempt) is folded into the same printed bucket
-    // as 'ambiguous' — both are "no single grade can be trusted", just a different reason.
-    const ambiguous = items.filter((d) => d.gradeStatus === 'ambiguous' || d.gradeStatus === 'invalid');
+    // recap-invalid-bucket (backlog 3bd73eec): the two were printed as ONE number, so a reader could
+    // not tell "the report states two grades" from "the report's verdict line is malformed" — and the
+    // second is a FIXABLE authoring defect in our own artifact, while the first is a real
+    // disagreement between reviews. `dz score --slug` already separated them; recap now does too.
+    const ambiguous = items.filter((d) => d.gradeStatus === 'ambiguous');
+    const invalid = items.filter((d) => d.gradeStatus === 'invalid');
     const ungraded = items.filter((d) => d.gradeStatus === 'none' || d.gradeStatus === 'no-report');
     const lines = sectionLines(v, facts.window, (scope) => items.length === 0
       ? emptyOrUnavailable(v, `no feature directories were created in ${scope}`)
       : [
           `${items.length} feature director${items.length === 1 ? 'y' : 'ies'} created in ${scope}`,
           `${graded.length} carry a grade an independent review stated unambiguously${graded.length > 0 ? `: ${tally(graded.map((d) => d.grade))}` : ''}`,
-          `${ambiguous.length} have a report that states MORE THAN ONE grade or a malformed QE-VERDICT line — reported as ambiguous, never guessed`,
+          `${ambiguous.length} have a report that states MORE THAN ONE grade — reported as ambiguous, never guessed`,
+          `${invalid.length} have a findings table but a MALFORMED or missing QE-VERDICT line — the report cannot be read, which is a formatting problem rather than two reviews disagreeing`,
           `${ungraded.length} have no letter grade in their report, or no report at all`,
           'cadence is not value: this counts deliveries, not what they were worth',
         ]);

package/src/registry.ts

@@ -8,7 +8,7 @@
  */
 
 import { existsSync, readdirSync, readFileSync, realpathSync, statSync, type Dirent } from 'node:fs';
-import { basename, dirname, join, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { stems } from './stem.js';
@@ -188,6 +188,42 @@ export function discoverSkillCarryingDirs(cwd: string): { pack: string; dir: str
  * drop the `unsigned` verdict for a `skills-*` pack that carries no manifest — turning "unsigned" into
  * "absent", which is the same class of silence this fixes.
  */
+/**
+ * Чей это пак: проекта, который проверяют, или самого прибора, который проверяет.
+ *
+ * ИЗМЕРЕНО 2026-09-21 на одном репозитории в одну минуту: `dz` из PATH перечисляет 88 паков и
+ * сообщает «31 verified», сборка из дерева — 57 и «0 verified». Оба ответа ВЕРНЫ и расходятся
+ * ровно на 29 подписанных манифестов внутри глобальной установки: `discoverVerifiablePackDirs`
+ * намеренно дотягивается до упакованных копий самого прибора. Беда не в числе, а в строке, где оно
+ * стоит: «31 verified» рядом с именем проекта читается как охват ПРОЕКТА, хотя проверены копии
+ * инструмента. Разделение считается по пути, потому что только путь и отличает эти два случая.
+ *
+ * Сравнение путей РАЗДЕЛИТЕЛЬНОЕ: `/repo-2/x` не внутри `/repo`. Наивный `startsWith` этот репозиторий
+ * уже однажды отгружал.
+ */
+export function packScope(dir: string, projectRoot: string): 'project' | 'instrument' {
+  const rel = relative(projectRoot, dir);
+  const inside = rel === '' || (!isAbsolute(rel) && rel !== '..' && !rel.startsWith(`..${sep}`));
+  return inside ? 'project' : 'instrument';
+}
+
+/**
+ * Уточнение к числу проверенных подписей: сколько из них — паки ЭТОГО проекта, а сколько принадлежат
+ * самому прибору. Возвращает ПУСТУЮ строку, когда уточнять нечего (ничего не проверено либо всё
+ * проверенное — проектное): приписка к нулю была бы шумом, а шум в строке охвата её и обесценивает.
+ */
+export function verifiedScopeNote(
+  checks: readonly { readonly dir: string; readonly verdict: string }[],
+  projectRoot: string,
+): string {
+  const verified = checks.filter((c) => c.verdict === 'verified');
+  if (verified.length === 0) return '';
+  const outside = verified.filter((c) => packScope(c.dir, projectRoot) === 'instrument').length;
+  if (outside === 0) return '';
+  return ` (${verified.length - outside} in this project, ${outside} in the instrument's own install`
+    + " — not this project's artifacts)";
+}
+
 export function discoverVerifiablePackDirs(cwd: string): { pack: string; dir: string }[] {
   const out: { pack: string; dir: string }[] = [];
   // Keyed on the RESOLVED path: a globally-installed `dz` reaches its own bundled packs as well as the
@@ -388,6 +424,60 @@ function categoryFromPack(pack: string): string {
  * `node_modules/@dzhechkov`, **and** the CLI's own install location. This is why
  * `dz registry` works for a globally-installed `dz`, not only inside the monorepo.
  */
+/** One skill as the public showcase page (`marketplace/index.html`) renders it. */
+export interface ShowcaseSkill {
+  readonly id: string;
+  readonly pack: string;
+  readonly description: string;
+  readonly trustTier: number;
+  readonly category: string;
+  /** The exact command a visitor copies. Derived, never stored — one spelling, one place. */
+  readonly install: string;
+}
+
+export interface ShowcaseRegistry {
+  readonly version: string;
+  readonly generated: string;
+  readonly totalSkills: number;
+  readonly totalPacks: number;
+  readonly categories: readonly string[];
+  readonly skills: readonly ShowcaseSkill[];
+}
+
+/**
+ * The public showcase catalogue, projected from the SAME {@link Registry} the plugin manifests come
+ * from — so the page and the manifests can never answer "how many skills are there" differently.
+ *
+ * Why this exists: MEASURED 2026-09-04 and re-measured 2026-09-20, `marketplace/registry.json` said
+ * 57 skills / 10 packs while `buildRegistry` counted 260 / 37, and the file's last commit was
+ * 2026-06-03 — because NOTHING wrote it. A grep for its path across the whole source tree returned
+ * zero writers (backlog 9595b21e). A catalogue with no generator does not go stale slowly; it stops
+ * being true the first time anything ships, and it was the one surface a visitor actually reads.
+ *
+ * `generated` is the caller's to supply: a timestamp minted inside would make the output
+ * non-reproducible and the drift gate unable to compare a fresh build against the published file.
+ */
+export function buildShowcaseRegistry(
+  registry: Registry,
+  opts: { readonly version: string; readonly generated: string },
+): ShowcaseRegistry {
+  return {
+    version: opts.version,
+    generated: opts.generated,
+    totalSkills: registry.totalSkills,
+    totalPacks: registry.totalPacks,
+    categories: [...registry.categories],
+    skills: registry.entries.map((e) => ({
+      id: e.id,
+      pack: e.pack,
+      description: e.description,
+      trustTier: e.trustTier,
+      category: e.category,
+      install: `dz init --target claude-code --select ${e.id}`,
+    })),
+  };
+}
+
 export function buildRegistry(cwd: string): Registry {
   const entries: RegistryEntry[] = [];
   const packs = discoverSkillCarryingDirs(cwd);

package/src/release.ts

@@ -25,7 +25,7 @@ import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import type { Dirent } from 'node:fs';
 import { join, relative } from 'node:path';
 
-import { discoverPackages, orderByDependencies } from './publish.js';
+import { discoverPackages, matchesPublishFilter, orderByDependencies } from './publish.js';
 import { planPackedInstallSmoke, judgePackedInstallSmoke } from './packed-install-smoke.js';
 import type { PackedInstallPlan, PackedInstallExecution } from './packed-install-smoke.js';
 
@@ -243,9 +243,14 @@ export function collectPackageFacts(monorepoRoot: string, filter?: readonly stri
   if (filter !== undefined && filter.length === 0) {
     throw new Error('release: --filter requires a non-empty list of package-name substrings (empty would match ALL packages)');
   }
+  // The twin of the publish guard: an empty ELEMENT matches every name, so the list being
+  // non-empty is not enough. Both doors must be shut or the weaker one becomes the entrance.
+  if (filter?.some((f) => f.length === 0)) {
+    throw new Error('release: --filter requires non-empty package-name substrings (empty would match ALL packages)');
+  }
   const discovered = discoverPackages(monorepoRoot);
   const selected =
-    filter === undefined ? discovered : discovered.filter((p) => filter.some((f) => p.name.includes(f) || p.dir.includes(f)));
+    filter === undefined ? discovered : discovered.filter((p) => filter.some((f) => matchesPublishFilter(p, f, monorepoRoot)));
   const ordered = orderByDependencies(selected);
 
   return ordered.map((p) => {
@@ -727,7 +732,8 @@ export function outputTail(stdout: unknown, stderr: unknown, maxLines = 40, maxB
  * - `token`/`secret`/`password` (case-insensitive) as a `key: value` or `key=value` pair — the
  *   KEY survives, only the value is replaced;
  * - `Bearer <token>` HTTP auth headers;
- * - vendor-prefixed tokens: `npm_…`, `ghp_…`, `sk-…`, `AKIA…`;
+ * - vendor-prefixed tokens: `npm_…`, `ghp_…`, `github_pat_…`, `sk-…` (hyphenated forms whole), `AKIA…`;
+ * - JSON keys (`"token":"…"`) and env-style names ending in TOKEN/SECRET/PASSWORD/API_KEY;
  * - long opaque strings (base64/hex-ish, `[A-Za-z0-9+/=]{32,}`) that look like a key/secret even
  *   without a recognisable prefix.
  * Order matters: prefixed/labelled patterns run BEFORE the generic long-opaque-string pattern so
@@ -738,8 +744,16 @@ export function redactSecrets(text: string): string {
   out = out.replace(/\bBearer\s+\S+/gi, 'Bearer [redacted]');
   out = out.replace(/\bnpm_[A-Za-z0-9]+/g, '[redacted]');
   out = out.replace(/\bghp_[A-Za-z0-9]+/g, '[redacted]');
-  out = out.replace(/\bsk-[A-Za-z0-9]+/g, '[redacted]');
+  out = out.replace(/\bgithub_pat_[A-Za-z0-9_]+/g, '[redacted]');
+  // `sk-proj-…` (and any other hyphenated vendor form) is redacted WHOLE — the old `[A-Za-z0-9]+` stopped
+  // at the first hyphen and let the tail through (MEASURED 2026-09-13, backlog 2df653d9).
+  out = out.replace(/\bsk-[A-Za-z0-9_-]+/g, '[redacted]');
   out = out.replace(/\bAKIA[A-Za-z0-9]+/g, '[redacted]');
+  // JSON keys: `"token":"…"` has a quote between key and colon, so the labelled rule below never saw it.
+  out = out.replace(/"(token|secret|password|api[_-]?key|access[_-]?token)"\s*:\s*"[^"]*"/gi, '"$1":"[redacted]"');
+  // Env-style names that END in a secret word (`GITHUB_TOKEN=`, `NPM_ACCESS_TOKEN=`): `_` is a word
+  // character, so `\btoken` never matched them.
+  out = out.replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY))(\s*[:=]\s*)(\S+)/g, '$1$2[redacted]');
   out = out.replace(/\b(token|secret|password)(\s*[:=]\s*)(\S+)/gi, '$1$2[redacted]');
   out = out.replace(/\b[A-Za-z0-9+/=]{32,}\b/g, '[redacted]');
   return out;
@@ -915,6 +929,42 @@ function fencedBlock(text: string, indent = '    '): string[] {
   return [`${indent}${fence}`, ...contentLines, `${indent}${fence}`];
 }
 
+/**
+ * Формы отказа `gh`, означающие «учётные данные не приняты», а не «команда не та».
+ * Список узкий намеренно: широкая сетка превратила бы любой сбой в повод лезть в окружение.
+ */
+const GH_AUTH_FAILURE_SHAPES: readonly RegExp[] = [
+  /no longer valid/i,
+  /bad credentials/i,
+  /authentication failed/i,
+  /requires authentication/i,
+  /gh auth login/i,
+  /HTTP 401/i,
+];
+
+/**
+ * Стоит ли повторить вызов `gh` БЕЗ переменной `GITHUB_TOKEN`.
+ *
+ * ИЗМЕРЕНО 2026-09-21 в этой среде: `gh auth status` → «the github.com token in GITHUB_TOKEN is no
+ * longer valid», а `env -u GITHUB_TOKEN gh auth status` → вход как djd1m через keyring. То есть
+ * мёртвая переменная ЗАТЕНЯЕТ рабочие учётные данные, и всякий вызов `gh` из скрипта падает
+ * (бэклог ead5f8e0). Переменная живёт в окружении tmux-сервера и снимается только владельцем.
+ *
+ * Почему повтор, а не безусловное снятие: в сборочной среде `GITHUB_TOKEN` — ШТАТНЫЙ способ
+ * авторизации, и выбрасывать его всегда значило бы ломать работающее ради сломанного. Поэтому
+ * сначала обычный вызов, и лишь на отказе ИМЕННО по авторизации — одна попытка без переменной.
+ */
+export function shouldRetryGhWithoutToken(input: {
+  readonly exitCode: number;
+  readonly stderr: string;
+  readonly stdout: string;
+  readonly tokenPresent: boolean;
+}): boolean {
+  if (input.exitCode === 0 || !input.tokenPresent) return false;
+  const text = `${input.stderr}\n${input.stdout}`;
+  return GH_AUTH_FAILURE_SHAPES.some((re) => re.test(text));
+}
+
 /**
  * gh-2.4-safe `gh issue create` payload (only `--title`/`--body` are assumed downstream).
  * Pure + deterministic for a fixed verdict — the issue is the verdict's echo, never its judge.

package/src/reqe.ts

@@ -187,7 +187,17 @@ export interface ReqeSettlement {
 export function extractReportGrade(text: string): string | null {
   // the lookahead rejects RANGES in punctuation form (A-F, A/F) AND word form (A through F,
   // A to F) — Codex QE round-2 #6: 'GRADE A through F' must not read as grade A
-  const matches = [...String(text ?? '').matchAll(/^\s*(?:\*{0,2}#{0,4}\s*)?GRADE\s*[:=—–-]?\s*([A-F])\b(?!\s*(?:[-–—/]|through|to|thru)\s*[A-F]\b)/gim)];
+  // bridge-grade-grammar (backlog ddf83072): the rest of the instrument already speaks in modifiers —
+  // `dz round close --grade B-` is accepted and `dz recap` tallies `A-×21` — so a review that writes
+  // `GRADE B-` must be readable here too. The modifier is allowed ONLY when a letter does not follow
+  // it, because `GRADE A-F` is a RANGE (the boilerplate "GRADE A-F + findings"), not an A-minus.
+  // The dash class below is the UNICODE dash family, not just the ASCII hyphen (Codex review HIGH #2):
+  // a reviewer's editor turns `A-F` into `A−F` (U+2212) or `A‐F` (U+2010) without asking, and a range
+  // written that way used to read as a bare `A`. Any dash-family character following the letter means
+  // the text is not a plain grade, so the extractor refuses instead of guessing which half was meant —
+  // the same rule that makes `GRADE B-Critical` null. A modifier is only ever its ASCII form (`+`, `-`).
+  //   hyphen-minus - | hyphen ‐ | non-breaking ‑ | figure ‒ | en – | em — | horizontal bar ― | minus −
+  const matches = [...String(text ?? '').matchAll(/^\s*(?:\*{0,2}#{0,4}\s*)?GRADE\s*[:=‐-―−-]?\s*([A-F](?:[+-](?![ \t]*[A-F]\b))?)(?![A-Za-z])(?![ \t]*[-‐-―−])(?!\s*(?:through|to|thru)\s*[A-F]\b)/gim)];
   const distinct = new Set(matches.map((m) => (m[1] ?? '').toUpperCase()).filter((g) => g !== ''));
   if (distinct.size !== 1) return null;
   return [...distinct][0] ?? null;

package/src/round-exec.ts

@@ -37,14 +37,25 @@ export function classifyRoundExecOutcome(input: {
   readonly exitCode: number | null;
   readonly timedOut: boolean;
   readonly bytes: number;
+  /** How the run ENDED: the limit/refusal signatures are end-state facts, so they read the tail. */
   readonly tail: string;
+  /**
+   * The WHOLE log, when the caller has it. The turn marker is not an end-state fact — it is the last
+   * `\ncodex\n` ANYWHERE in the log — and a fixed tail window cannot hold it: MEASURED 2026-09-20 on
+   * three real rounds, Codex's final answer ran 12–20 KB (it quotes runner output), so the marker sat
+   * at ~95% of the file and fell outside the caller's 4 KB tail. All three runs had landed their files
+   * and were green, and all three were recorded `failed`. Defaults to `tail` for callers that only
+   * have the window.
+   */
+  readonly fullText?: string;
 }): RoundExecOutcome {
   if (input.timedOut) return 'timeout';
   if (/rate limit|usage limit|limit reached/i.test(input.tail)) return 'session-limit';
   if (/HTTP 400|not supported when using Codex/i.test(input.tail)) return 'model-refused';
   if (input.exitCode === 0 && input.bytes > 0) {
-    const marker = input.tail.lastIndexOf('\ncodex\n');
-    const finalLine = marker < 0 ? '' : input.tail.slice(marker + '\ncodex\n'.length).split(/\r?\n/, 1)[0]?.trim() ?? '';
+    const haystack = input.fullText ?? input.tail;
+    const marker = haystack.lastIndexOf('\ncodex\n');
+    const finalLine = marker < 0 ? '' : haystack.slice(marker + '\ncodex\n'.length).split(/\r?\n/, 1)[0]?.trim() ?? '';
     if (finalLine !== '') return 'done';
   }
   if (input.exitCode === 0 && input.bytes === 0) return 'empty';