@ericrisco/rsc 4.0.3 → 4.0.5

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.0.3",
+  "version": "4.0.5",
   "counts": {
     "skills": 274,
     "agents": 34,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "4.0.3",
+  "version": "4.0.5",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {

package/scripts/lib/review-ledger.js

@@ -122,6 +122,22 @@ export function round(root, task, { now = new Date().toISOString() } = {}) {
   return { ok: true, round: n, message: `task "${task}": review round ${n} of ${MAX_ROUNDS}` };
 }
 
+// Records that a review panel ran on a task: which lenses, distinct. Self-attested, like the sello's
+// approve — it binds the claim to a task, it does not prove the review was good. The ship guard reads
+// it: a tier-2 branch does not leave the machine without a panel of the required size on its spec.
+export function panel(root, task, lenses, { now = new Date().toISOString() } = {}) {
+  if (!QUALIFIED_TASK.test(task)) {
+    return { ok: false, message: `rsc: qualify the task with its spec slug, e.g. \`review ledger panel <slug>/closing --lenses correctness,security,tests\`.` };
+  }
+  const list = [...new Set(String(lenses || '').split(',').map((l) => l.trim().toLowerCase()).filter(Boolean))];
+  if (!list.length) return { ok: false, message: 'rsc: name the lenses that ran: --lenses correctness,security,tests' };
+  // Bound to the commit reviewed: code committed after it is code no panel has seen.
+  const r = spawnSync('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8', windowsHide: true });
+  const sha = r.status === 0 ? r.stdout.trim() : null;
+  append(root, [{ type: 'panel', task, lenses: list, sha, at: now }]);
+  return { ok: true, message: `task "${task}": panel of ${list.length} recorded (${list.join(', ')})${sha ? ` on ${sha.slice(0, 7)}` : ''}` };
+}
+
 export function stats(root) {
   const ledger = readLedger(root);
   const findings = ledger.filter((e) => e.type === 'finding');

package/scripts/lib/risk.js

@@ -6,7 +6,7 @@
 // Spec: 02-DOCS/wiki/sdd/specs/asdd-v4.md.
 
 import { spawnSync } from 'node:child_process';
-import { NESTED_WORKTREES, SELLO_STATE_PATHS, classifyRisk, lensesRequired, readEffectiveConfig, trunkRef } from '../../targets/sello.mjs';
+import { NESTED_WORKTREES, SELLO_STATE_PATHS, classifyChange, lensesRequired, readEffectiveConfig, trunkRef } from '../../targets/sello.mjs';
 
 function git(root, args) {
   const r = spawnSync('git', ['-C', root, '-c', 'core.quotePath=false', ...args], { encoding: 'utf8', windowsHide: true, maxBuffer: 64 * 1024 * 1024 });
@@ -31,18 +31,22 @@ export function changedPaths(root, base = null) {
     .filter((n) => !SELLO_STATE_PATHS.includes(n)));
   let names = diff(mb);
   let shown = ref;
+  let from = mb;
   // Working straight on the trunk (FTD on an open main), the merge-base IS HEAD, and a change
   // already committed would read as no change at all: tier 0, no reviewer, no escalation. With
   // nothing uncommitted, the last commit is the change being asked about.
   if (!base && mb === head.trim() && !names.size && git(root, ['rev-parse', '--verify', '--quiet', 'HEAD~1']) !== null) {
     names = diff('HEAD~1');
     shown = 'HEAD~1 (on the trunk: the last commit)';
+    from = 'HEAD~1';
   }
-  return { ok: true, base: shown, paths: [...names].sort() };
+  return { ok: true, base: shown, from, paths: [...names].sort() };
 }
 
-export function assess(paths, cfg = null) {
-  const { tier, classes, configError } = classifyRisk(paths, cfg);
+// `texts` is what the change adds per path (sello.changeText): content signals raise a path that its
+// name alone would leave at tier 1 — auth code in `src/app.js`.
+export function assess(paths, cfg = null, texts = {}) {
+  const { tier, classes, configError, content } = classifyChange(paths, texts, cfg);
   return {
     tier,
     classes: [...new Set(Object.values(classes))].sort(),
@@ -51,6 +55,7 @@ export function assess(paths, cfg = null) {
     // Tier 2 is ASDD work, whatever lane it started in: the ship guard refuses to push it without a spec.
     escalate: tier >= 2 ? 'asdd' : null,
     paths: classes,
+    content,
     ...(configError ? { configError } : {}),
   };
 }
@@ -65,6 +70,7 @@ export function render(r) {
     ...(r.base ? [`base: ${r.base}`] : []),
     ...(r.escalate ? ['escalate: asdd — tier 2 needs a spec linked to this branch (`branch: <name>` in its frontmatter) that passes `npx @ericrisco/rsc spec gate`; push and PR are refused until it exists. Write it now, before more code.'] : []),
     ...(r.configError ? [`config ignored: ${r.configError}`] : []),
+    ...(r.content || []).slice(0, 10).map((h) => `  content: ${h.class} in ${h.path} ("${h.match}")`),
     ...top.slice(0, 20).map(([p, c]) => `  ${c.padEnd(10)} ${p}`),
     ...(top.length > 20 ? [`  … ${top.length - 20} more`] : []),
   ].join('\n');

package/scripts/rsc.js

@@ -1262,13 +1262,17 @@ async function main() {
         .map((p) => rel(root, res(process.cwd(), p)).split('\\').join('/'));
       let paths = given;
       let against = null;
+      let from = null;
       if (!given.length) {
         const c = K.changedPaths(root, base || null);
         if (!c.ok) { say(c.message); process.exitCode = 1; return; }
         paths = c.paths;
         against = c.base;
+        from = c.from;
       }
-      const r = { ...K.assess(paths, S.readEffectiveConfig(root)), ...(against ? { base: against } : {}) };
+      // Given paths are read whole (a forecast or a single file); a diff contributes its added lines.
+      const texts = S.changeText(root, from, paths);
+      const r = { ...K.assess(paths, S.readEffectiveConfig(root), texts), ...(against ? { base: against } : {}) };
       say(argv.includes('--json') ? JSON.stringify(r, null, 2) : K.render(r));
       return;
     }
@@ -1279,7 +1283,7 @@ async function main() {
       const USE = [
         'Use: npx @ericrisco/rsc review consolidate [report.md|findings.json ...] [--json] [--window <lines>]',
         '  Without files it reads stdin. Each lens report carries its findings in ```json findings blocks.',
-        '     npx @ericrisco/rsc review ledger record <findings.json> [--task <id>] | outcome <id> <fixed|false|intentional|irrelevant|parked> | round <slug>/<task> | stats [--json]',
+        '     npx @ericrisco/rsc review ledger record <findings.json> [--task <id>] | outcome <id> <fixed|false|intentional|irrelevant|parked> | round <slug>/<task> | panel <slug>/<task> --lenses a,b,c | stats [--json]',
         '     npx @ericrisco/rsc review escapes [--since <ref>] [--json]',
       ].join('\n');
       if (argv[1] === 'ledger' || argv[1] === 'escapes') {
@@ -1328,6 +1332,13 @@ async function main() {
           if (!r.ok) process.exitCode = 1;
           return;
         }
+        if (sub === 'panel') {
+          if (!a || a.startsWith('--')) return fail(USE);
+          const r = L.panel(root, a, str('lenses'));
+          if (!r.ok) return fail(r.message);
+          say(r.message);
+          return;
+        }
         if (sub === 'stats') {
           const s = L.stats(root);
           say(json ? JSON.stringify(s, null, 2) : L.renderStats(s));
@@ -1532,7 +1543,7 @@ async function main() {
           if (!candidate) { say(S.MESSAGES.noTrunk()); process.exitCode = 1; return; }
           const paths2 = Object.keys(candidate.files);
           if (!paths2.length) { say('sello: nothing to freeze — the working tree matches the trunk base.'); return; }
-          const risk = S.classifyRisk(paths2, cfg);
+          const risk = S.classifyCandidate(root, candidate, cfg);
           if (risk.configError) say(`⚠️  ${risk.configError}\n   (using the default risk table until it is fixed)`);
           const required = S.lensesRequired(risk.tier, cfg);
           S.writeSello(root, { status: 'frozen', ...candidate, risk, required, lenses: [], createdAt: new Date().toISOString() });

package/skills/asdd/SKILL.md

@@ -51,7 +51,7 @@ Every spec answers four questions, and `spec:gate` refuses one dated 2026-11-03
 
 ### The risk decides, never the agent
 
-`npx @ericrisco/rsc risk [--base <ref>] [paths…]` classifies a change by **what it touches** (the sello's path table; works with the sello off): tier 0 docs/copy → no reviewer; tier 1 ordinary code → one fresh-context reviewer; tier 2 auth, billing, CI workflows, migrations, secrets, harness config → the three-refuter panel **and human approval**. An agent's approval never counts as a human's.
+`npx @ericrisco/rsc risk [--base <ref>] [paths…]` classifies a change by **what it touches and what it adds** (the sello's path table plus fixed content patterns — password hashing, session cookies, payments, schema changes, secrets — so auth code in `src/app.js` is still auth; works with the sello off): tier 0 docs/copy → no reviewer; tier 1 ordinary code → one fresh-context reviewer; tier 2 auth, billing, CI workflows, migrations, secrets, harness config → the three-refuter panel **and human approval**. An agent's approval never counts as a human's. **Enforced at push:** a tier-2 branch leaves the machine only with a spec linked to it that passes `rsc spec gate` **and** a panel recorded with `rsc review ledger panel <slug>/<task> --lenses correctness,security,tests`.
 
 ### The loop converges
 
@@ -61,7 +61,7 @@ Every spec answers four questions, and `spec:gate` refuses one dated 2026-11-03
 
 Tier 2, a contradiction with a recorded decision, a gap that would make the build unsafe, or no convergence in 3 rounds: the task goes to the **decision queue** (`## Decision queue` in `progress/<slug>.md`) with its evidence, and the agent **continues with the independent tasks**. The run never waits at 2 a.m. for an answer.
 
-Every entry carries a kind, one line each:
+Every entry carries a kind, one line each, in exactly this form (no bold, no other bullet):
 
 ```markdown
 - [blocking] Q3 — <what must be decided>, <evidence>, <task>
@@ -102,6 +102,8 @@ Autopilot does not stop the run for questions — it **parks**: real ambiguity,
 - `implement` parks `blocking` items and continues with the independent tasks.
 - `ship` lands by the rule below.
 
+**Never hand the turn back mid-run.** No "¿sigo?" / "shall I continue?": not between phases, not while reviewers run. Background reviewers are waited for (their completion notice, or run them in the foreground); ending the turn to wait ends a headless run. A later "continue" from the person resumes the run; it is **not** approval for a tier-2 merge, which needs an explicit yes to that merge.
+
 **Landing — there is always a legal path.** A remote exists → open a PR; self-merge only when `rsc risk` says tier 0-1, CI is green and no `blocking` entry is open; `review-after` entries go into the PR body. No remote → **park**: leave the branch committed, write the explainer, the open entries and the exact merge command for the human into `progress/<slug>.md`, and stop. Never merge locally around the branch guard: when `rsc main status` says `closed: true`, the guard denies it.
 
 Narrate in the `orient` voice: name each stage as it passes and show its artifact, one line each.

package/skills/implement/SKILL.md

@@ -115,7 +115,7 @@ review of the task, this first one included. Round 1 is the task's first review,
 | --- | --- |
 | 0 | none — the controls (e) still run |
 | 1 | one fresh-context reviewer; frozen brief in `references/per-task-review.md` |
-| 2 | the three refuters (`refuter-correctness` · `refuter-security` · `refuter-tests`) in parallel, as `../review/SKILL.md` runs them |
+| 2 | the three refuters (`refuter-correctness` · `refuter-security` · `refuter-tests`) in parallel, as `../review/SKILL.md` runs them; then `review ledger panel <slug>/<task> --lenses correctness,security,tests` — the push gate checks it. Wait for every reviewer inside the turn; never end the turn to ask whether to continue |
 
 Every reviewer gets the **spec**, the **diff as a file** (`scripts/review-package <BASE> <HEAD>`, BASE
 = the task's *recorded* base sha, never `HEAD~1`), the **surrounding code** at that sha (not just the

package/skills/review/SKILL.md

@@ -11,7 +11,7 @@ origin: risco
 
 Tests prove the code works, not that it does what was asked. Review answers that other question: **is the diff correct, well-scoped and faithful to the spec — or did it pass for the wrong reasons?** In ASDD (`../asdd/SKILL.md`) it runs in two modes:
 
-- **Per task** — called from `implement`'s loop after each task's self-check. Depth comes from `npx @ericrisco/rsc risk [--base <ref>] [paths…]` (same path table as the sello, works with the sello off): **tier 0** → no review; **tier 1** → one fresh-context reviewer (a subagent that never saw the implementation conversation); **tier 2** → the three-refuter panel below, and the branch will wait for human approval at ship.
+- **Per task** — called from `implement`'s loop after each task's self-check. Depth comes from `npx @ericrisco/rsc risk [--base <ref>] [paths…]` (same path table as the sello, works with the sello off): **tier 0** → no review; **tier 1** → one fresh-context reviewer (a subagent that never saw the implementation conversation); **tier 2** → the three-refuter panel below, recorded after it runs with `npx @ericrisco/rsc review ledger panel <slug>/<task> --lenses correctness,security,tests` (the ship guard refuses to push a tier-2 branch without it — one reviewer is not a panel), and the branch will wait for human approval at ship. The tier reads the diff's content too: auth code in a generic file is tier 2.
 - **Closing review** — once, before `ship`: the whole branch against the spec. Forty individually-correct tasks can still fail to be the feature together: a criterion nobody owned, two tasks that each assumed the other handled an edge, scope that crept in a slice at a time. Read the spec's acceptance criteria and "must respect" list against `git diff <base>...HEAD`, not the task reviews. Its record — tier, counts, verdict, each finding with its outcome — goes to `02-DOCS/wiki/sdd/reviews/<slug>.md`.
 
 This skill owns **two roles that share one discipline**:

package/skills/ship/SKILL.md

@@ -246,6 +246,7 @@ In the `orient` voice: the explainer, the checklist result in one line, the thre
 | "I'll add `Co-Authored-By: Claude` / a 'Generated with Claude Code' footer to be transparent" | It forges the record. The work is the responsible person's — no AI trailer, ever. Strip it. |
 | "Review didn't formally approve but it's obviously fine" | No verdict = not ready. Ship runs on APPROVE only. Route back to review. |
 | "Tier 2, but the three refuters approved — I'll self-merge" | An agent's approval never counts as a human's. Tier 2 waits for human approval. |
+| "Tier 2, one reviewer was enough here" | The push gate wants the panel recorded (`review ledger panel … --lenses correctness,security,tests`). Run the three, record them, then push. |
 | "The tree has a couple of stray edits, they're harmless" | A dirty tree means the merge is not the reviewed diff. Clean it or stash it first. |
 | "`main` is protected but I'll just force-merge, I'm sure" | Protected means PR. Don't bypass the gate the repo deliberately set. |
 | "No remote and the guard denies the merge — I'll merge another way" | The denial is the answer. Park the branch with the merge command for the human. |

package/targets/asdd-gate.mjs

@@ -53,6 +53,37 @@ export function linkedSpecs(root, branch, specCompleteness) {
   });
 }
 
+// A panel still covers HEAD when its commit is an ancestor of HEAD and this branch's own commits since
+// changed no code. Not code, by the same rules the gate applies above: documentation, the harness's
+// own state (.rsc/ journals, nested worktrees) and harness configuration. Commits that came from the
+// trunk (a merge of main into the branch) are not this branch's work and are not counted.
+function reviewedStill(root, sha, trunk, sello, cfg) {
+  if (!sha) return false;
+  if (spawnSync('git', ['-C', root, 'merge-base', '--is-ancestor', sha, 'HEAD'], { windowsHide: true }).status !== 0) return false;
+  const since = [...new Set((git(root, 'log', '--no-merges', '--no-renames', '--format=', '--name-only', `${sha}..HEAD`, `^${trunk}`) || '')
+    .split('\n').map((l) => l.trim()).filter(Boolean))]
+    .filter((n) => !sello.SELLO_STATE_PATHS.includes(n) && !sello.NESTED_WORKTREES.test(n));
+  const { classes } = sello.classifyRisk(since, cfg);
+  return Object.values(classes).every((c) => c === 'docs' || c === 'harness');
+}
+
+// Largest panel recorded in the review ledger for a task of any of these specs (`<slug>/<task>`) that
+// still covers HEAD.
+function panelSize(root, slugs, stillValid = () => true) {
+  let text = '';
+  try { text = readFileSync(join(root, '.rsc', 'review-ledger.jsonl'), 'utf8'); } catch { return 0; }
+  let best = 0;
+  for (const line of text.split('\n')) {
+    let e;
+    try { e = JSON.parse(line); } catch { continue; }
+    if (e?.type !== 'panel' || typeof e.task !== 'string' || !Array.isArray(e.lenses)) continue;
+    if (!slugs.some((s) => e.task.toLowerCase().replace(/_/g, '-').startsWith(`${s.toLowerCase().replace(/_/g, '-')}/`))) continue;
+    if (!stillValid(e.sha)) continue;
+    best = Math.max(best, new Set(e.lenses.map((l) => String(l).toLowerCase())).size);
+  }
+  return best;
+}
+
 /**
  * null when the command may go ahead; the denial text (with its way out, P6) when it may not.
  * `lib` carries the sibling modules so tests and the hook load them the same way.
@@ -71,12 +102,26 @@ export function asddGate(root, command, { sello, specCompleteness }) {
     ...(git(root, 'diff', '--name-only', '--no-renames', '-z', base) || '').split('\0'),
     ...(git(root, 'ls-files', '--others', '--exclude-standard', '-z') || '').split('\0').filter((n) => !sello.NESTED_WORKTREES.test(n)),
   ].filter(Boolean))].filter((n) => !sello.SELLO_STATE_PATHS.includes(n));
-  const { tier, classes } = sello.classifyRisk(paths, cfg);
+  const { tier, classes } = sello.classifyChange(paths, sello.changeText(root, base, paths), cfg);
   if (tier < 2) return null;
   const tierTwo = [...new Set(Object.values(classes))].filter((c) => c !== 'default' && c !== 'docs');
   if (tierTwo.length && tierTwo.every((c) => c === 'harness')) return null;
   const specs = linkedSpecs(root, branch, specCompleteness);
-  if (specs.some((s) => s.ok)) return null;
+  const passing = specs.filter((s) => s.ok);
+  if (passing.length) {
+    // The spec exists; now the review it requires. A tier-2 change gets the full panel (three lenses
+    // by default), recorded against one of its linked specs in the review ledger.
+    const required = sello.lensesRequired(2, cfg);
+    const slugs = passing.map((s) => s.path.split('/').pop().slice(0, -3));
+    const best = panelSize(root, slugs, (sha) => reviewedStill(root, sha, trunk, sello, cfg));
+    if (best >= required) return null;
+    return `Branch "${branch}" is risk tier 2 and its spec passes, but no review panel of ${required} lens(es) is recorded for it` +
+      `${best ? ` (largest still valid: ${best})` : ''}. Tier 2 is reviewed by the full panel, not by one reviewer, and a panel covers ` +
+      'the commit it was recorded on: code committed after it needs the panel again (the record is self-attested, like the sello). ' +
+      `Recover: run the ${required} fresh-context refuters (correctness, security, tests) on the branch, then record it — ` +
+      `\`npx @ericrisco/rsc review ledger panel ${slugs[0]}/closing --lenses correctness,security,tests\` — and push again. ` +
+      'To turn this gate off for the project: create `.rsc/.no-asdd-gate`.';
+  }
   const why = [...new Set(Object.values(classes).filter((c) => c !== 'default' && c !== 'docs'))].join(', ');
   const found = specs.length
     ? `The linked spec does not pass the gate: ${specs.map((s) => `${s.path} (missing: ${[...s.missing, ...s.empty].join(', ') || '—'})`).join('; ')}. `

package/targets/claude.js

@@ -45,6 +45,8 @@ export function hookWiringOf(entry) {
 // plus the legacy cat-form) from settings.json, across all events. User hooks and
 // other settings are preserved. Empty event arrays (and an empty hooks object) are
 // pruned so we don't leave noise behind.
+const ATTRIBUTION_MARKER = '.rsc/attribution-default';
+
 export function unwireHook(paths) {
   // The bootstrap lives in the COMMITTED tree, so leaving it behind does not just orphan a file the
   // way a stray `.rsc/` entry would — it leaves an executable in something the user pushes. Nothing
@@ -62,7 +64,18 @@ export function unwireHook(paths) {
   if (!existsSync(file)) return removed;
   let settings;
   try { settings = JSON.parse(readFileSync(file, 'utf8')); } catch { return removed; }
-  if (!settings.hooks) return removed;
+  // wireHook's attribution default goes back out with it — only when wireHook wrote it (the marker)
+  // and it is still untouched. The same value set by the person before rsc stays theirs.
+  const marker = join(paths.projectRoot, ATTRIBUTION_MARKER);
+  const a = settings.attribution;
+  const ours = existsSync(marker) && a && Object.keys(a).length === 2 && a.commit === '' && a.pr === '';
+  if (ours) delete settings.attribution;
+  try { rmSync(marker, { force: true }); } catch { /* cleanup never fails the uninstall */ }
+  if (!settings.hooks) {
+    if (!ours) return removed;
+    writeFileSync(file, JSON.stringify(settings, null, 2) + '\n');
+    return [...removed, file];
+  }
   for (const event of Object.keys(settings.hooks)) {
     settings.hooks[event] = (settings.hooks[event] || []).filter((e) => {
       const s = hookWiringOf(e);
@@ -319,6 +332,15 @@ export function wireHook(paths, sourceMd, policy = {}) {
   }
   if (!settings.hooks.PreToolUse.length) delete settings.hooks.PreToolUse;
 
+  // Authorship is the responsible person, never an AI trailer (constitution P8). Claude Code's own
+  // default adds a Co-Authored-By line to commits and a footer to PRs, and the 4.0.4 run had to rebase
+  // them out by hand. Empty strings hide both. A choice already in the file is the person's and stays.
+  if (settings.attribution === undefined && settings.includeCoAuthoredBy === undefined) {
+    settings.attribution = { commit: '', pr: '' };
+    mkdirSync(join(paths.projectRoot, '.rsc'), { recursive: true });
+    writeFileSync(join(paths.projectRoot, ATTRIBUTION_MARKER), '');
+  }
+
   mkdirSync(dirname(file), { recursive: true });
   writeFileSync(file, JSON.stringify(settings, null, 2) + '\n');
 

package/targets/sello.mjs

@@ -202,6 +202,97 @@ export function classifyRisk(paths, cfg = null) {
   return { tier, classes, lowered, configError };
 }
 
+// ---------------------------------------------------------------- content signals
+// A path table only sees code that lives where its name says. A real 4.0.3 run put a whole login —
+// password hashing, session cookies — into `src/app.js`: tier 1 by path, so no gate and no panel would
+// have fired had the spec not happened to be called `login.md`. These rows read WHAT the change adds:
+// code that hashes passwords, sets session cookies, moves money, alters a schema or carries a secret
+// is high risk wherever it lives. Still deterministic (P1): fixed patterns over the added lines, never
+// a judgement. Documentation is not scanned — a spec that talks about passwords is not auth code.
+export const CONTENT_RISK = [
+  // Operations, not words: hashing or verifying a password, issuing a session or token. A login form's
+  // `type="password"` or an i18n string is not auth code (closing review, 4.0.4).
+  { class: 'auth', scope: 'code', pattern: String.raw`\b(?:bcrypt(?:js)?|argon2(?:id|i|d)?)\.(?:hash|compare|verify)(?:Sync)?\s*\(|\b(?:scrypt|scryptSync|pbkdf2|pbkdf2Sync|timingSafeEqual|createHmac)\s*\(|\bjwt\.(?:sign|verify)\s*\(|\b(?:password_hash|password_verify)\s*\(|\bpassport\.(?:use|authenticate)\s*\(|\b(?:getServerSession|verifyIdToken|signInWith[A-Z]\w*)\s*\(|\bres\.cookie\s*\(\s*(?:['"\x60](?:sid|session|token|auth)|[A-Z_]*(?:SESSION|SID|TOKEN|AUTH))|\bpromisify\s*\(\s*(?:crypto\.)?(?:scrypt|pbkdf2)\b|\b(?:jwtVerify|SignJWT)\b|\breq\.session\.(?:\w+\s*=[^=]|regenerate\s*\()|\bcreateSession\s*\(|set-cookie['"\x60]?\s*[,:]\s*['"\x60]?\s*\x60?(?:sid|session|token|auth)\w*=` },
+  { class: 'billing', scope: 'code', pattern: String.raw`\b(?:paymentIntents|charges|refunds|subscriptions|checkout\.sessions|invoices)\.(?:create|update|confirm|capture)\s*\(|\bprocess\.env\.(?:STRIPE|PAYPAL|BRAINTREE|ADYEN)_\w+` },
+  { class: 'migrations', scope: 'code', pattern: String.raw`\b(?:ALTER\s+TABLE|DROP\s+(?:TABLE|COLUMN)|CREATE\s+TABLE|ADD\s+COLUMN|RENAME\s+COLUMN)\b` },
+  // A secret is a leak wherever it is added — tests, config and docs included.
+  { class: 'secrets', scope: 'all', pattern: String.raw`-----BEGIN [A-Z ]*PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\b[sr]k_live_[0-9a-zA-Z]{16,}|\bgh[pousr]_[0-9A-Za-z]{30,}` },
+];
+// What `code` rows never read: tests and fixtures, lockfiles, minified bundles, docs, and comment lines.
+const NOT_CODE = /(?:^|\/)(?:tests?|__tests__|spec|fixtures?|__mocks__)\/|\.(?:test|spec)\.[cm]?[jt]sx?$|(?:^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|Cargo\.lock|poetry\.lock|Gemfile\.lock|composer\.lock|go\.sum)$|\.min\.(?:js|css)$/;
+const COMMENT_LINE = /^\s*(?:\/\/|#|\*|\/\*|<!--|--\s)/;
+const CONTENT_MAX_BYTES = 1024 * 1024;
+
+// The text a change ADDS, per path: added lines of the diff against `base` for tracked files, the
+// whole file for untracked ones (or for every path when there is no base — an explicit `rsc risk
+// <paths>`). One whole-tree diff, filtered after: a pathspec per file overflows the argument list on a
+// large change, and a large change must not get LESS scrutiny than a small one. Unreadable or huge
+// files are skipped: the path row still scores them.
+export function changeText(rawRoot, base, paths) {
+  const root = resolveRoot(rawRoot);
+  const out = {};
+  const wanted = new Set(paths);
+  const readWhole = (p) => {
+    try {
+      const st = lstatSync(join(root, p));
+      if (st.isFile() && st.size <= CONTENT_MAX_BYTES) out[p] = readFileSync(join(root, p), 'utf8');
+    } catch { /* gone or unreadable */ }
+  };
+  if (!base) { paths.forEach(readWhole); return out; }
+  const tracked = new Set(nulList(git(root, 'ls-files', '-z')));
+  const diff = git(root, 'diff', '-U0', '--no-renames', '--no-color', base) || '';
+  let cur = null;
+  let header = false;
+  for (const line of diff.split('\n')) {
+    if (line.startsWith('diff --git ')) { header = true; cur = null; continue; }
+    if (header) {
+      // git quotes a path with a tab, newline or quote even under core.quotePath=false: "b/tab\tx.js".
+      const q = /^\+\+\+ "b\/((?:[^"\\]|\\.)*)"$/.exec(line);
+      const m = q ? [null, q[1].replace(/\\([tn"\\])/g, (_, c) => ({ t: '\t', n: '\n', '"': '"', '\\': '\\' })[c])]
+        : /^\+\+\+ b\/(.+?)\t?$/.exec(line);
+      if (m && wanted.has(m[1])) { cur = m[1]; out[cur] ||= ''; }
+      if (line.startsWith('@@')) header = false;
+      continue;
+    }
+    if (line.startsWith('@@')) continue;
+    if (cur && line.startsWith('+')) out[cur] += `${line.slice(1)}\n`;
+  }
+  paths.filter((p) => !tracked.has(p)).forEach(readWhole);
+  return out;
+}
+
+// Path rows and content rows together. A path scores the higher of the two; `content` lists each
+// content hit (path, class, the matched text) so the reader can see why. Lowered classes apply to
+// content rows too; floor classes stay at tier 2.
+export function classifyChange(paths, texts = {}, cfg = null) {
+  const byPath = classifyRisk(paths, cfg);
+  const lowered = byPath.lowered || [];
+  const content = [];
+  let { tier } = byPath;
+  const classes = { ...byPath.classes };
+  const rowTier = (cls) => (lowered.includes(cls) && !FLOOR_CLASSES.includes(cls) ? 1 : 2);
+  const docs = new RegExp(RISK_TABLE.find((r) => r.class === 'docs').pattern);
+  for (const [p, text] of Object.entries(texts)) {
+    if (!text) continue;
+    const codeText = docs.test(p) || NOT_CODE.test(p) ? '' : text.split('\n').filter((l) => !COMMENT_LINE.test(l)).join('\n');
+    for (const row of CONTENT_RISK) {
+      const m = new RegExp(row.pattern, row.scope === 'all' ? '' : 'i').exec(row.scope === 'all' ? text : codeText);
+      if (!m) continue;
+      const t = rowTier(row.class);
+      content.push({ path: p, class: row.class, match: m[0].slice(0, 60) });
+      if (t > classifyRisk([p], cfg).tier) classes[p] = row.class;
+      if (t > tier) tier = t;
+      break;
+    }
+  }
+  return { ...byPath, tier, classes, content };
+}
+
+export function classifyCandidate(rawRoot, candidate, cfg = null) {
+  const paths = Object.keys(candidate.files);
+  return classifyChange(paths, changeText(rawRoot, candidate.base, paths), cfg);
+}
+
 // How many lenses a tier requires (capped by an explicit config knob, floor 1).
 export function lensesRequired(tier, cfg = null) {
   const base = tier === 0 ? 0 : tier === 1 ? 1 : 3;
@@ -418,7 +509,7 @@ export function checkSello(rawRoot) {
   const paths = Object.keys(candidate.files);
   if (paths.length === 0) return { ok: true, code: 'clean' };
 
-  const risk = classifyRisk(paths, cfg);
+  const risk = classifyCandidate(root, candidate, cfg);
   // P7 first, before any sello state is consulted: a docs-only change must never
   // be blocked by a leftover sello from some other change.
   if (risk.tier === 0) return { ok: true, code: 'risk0' };