@geonosis/ratchet 1.2.0 → 1.3.0

package/README.md

@@ -172,10 +172,17 @@ lines) is refused **even on a clean exit**. `npm ERR!` is not stripped — that
 command never ran, and it must never read as zero. Unset is the default and changes nothing, so a repo that never opts in keeps exactly
 the behaviour it had. Valid values: `unix`, `agent`, `default`.
 
-When a number **grew**, the last ten lines of that counter's command output print under the
+When a number **grew**, up to ten lines of that counter's command output print under the
 `<-- REGRESSED` line, indented — so the report says what grew, not only that something did. A
 counter that reads a file rather than running a command (`lawLineCount`) prints nothing extra.
 
+The lines are the ones the counter says its number came from, not the tail of the run. `oxlintRule`
+cites the findings attributed to ITS rule; `oxlintErrors` cites errors and `oxlintWarnings`
+warnings. The tail was wrong for exactly the run that needs it most: a consumer's +2 on one rule
+printed two unrelated **warnings** as its evidence, because those were the last lines oxlint wrote
+and the two real errors sat higher up. A counter written outside this package that names nothing —
+or that recognises nothing in a run — falls back to the tail, as before.
+
 ### `testFailures` reads the runner's summary, never the exit code
 
 The counter looks for the runner's own count and **refuses when it cannot parse one**. It never
@@ -281,6 +288,19 @@ been shown to work — and this one guards the running time of every other gate.
   nothing more. If a child command needs `NODE_OPTIONS` — a TypeScript shim, a loader — put it on
   the script that invokes `geonosis-ratchet`, not on the counter's own line, and not only in your
   interactive shell.
+- **`NODE_OPTIONS` in the parent script + a counter that shells out to `pnpm` = the counter dies.**
+  The nested `pnpm` INHERITS the option. dielime preloads a TypeScript-5 shim through
+  `NODE_OPTIONS` in its `lint` script; run the ratchet from inside that script and the nested pnpm
+  goes looking for a `.pnpmfile.mjs` that is not there and exits non-zero. The ratchet refuses —
+  correctly, a command that cannot run is never a silent zero — but nothing in the message is near
+  the cause. Run the ratchet outside that script, or unset `NODE_OPTIONS` for the nested call:
+
+  ```json
+  { "counter": "archViolations", "command": "env -u NODE_OPTIONS pnpm --silent verify:arch" }
+  ```
+
+  `geonosis-doctor --only drift` asks for this shape by name: a manifest script carrying
+  `NODE_OPTIONS` beside a counter whose command shells to `pnpm`.
 - **A path in a counter's command must be absolute, or `--prove` cannot run it.** A probe runs in a
   scratch directory with none of your repo in it, so a loader or shim named relatively — `node
   --import ./scripts/ts5-shim.mjs …` — resolves to nothing there and the counter comes back
@@ -423,3 +443,10 @@ npx geonosis-doctor --baseline-against origin/main --strict
 ```
 
 Apache-2.0.
+
+## The pairing rule (#136)
+
+A scoped fast tier (changed files only) is safe exactly when the full tier is TOTAL: every hard cap
+— max-lines, bundle bytes, suppression counts — needs a full-tier counter watching the whole tree,
+or it is a cap in prose that a file can sit over indefinitely. `oxlintRule`, `suppressionCount`,
+`bundleBytes` and friends exist to be that counter.

package/dist/{chunk-LSYVFUP4.js → chunk-HBM6F3GO.js}

@@ -124,6 +124,14 @@ var loadConfig = (cwd) => {
   }
   return { baseline: parsed.baseline ?? "gate-baseline.json", counters: parsed.counters };
 };
+var resolveBaseline = (cwd) => {
+  try {
+    const parsed = JSON.parse(readFileSync2(resolve(cwd, CONFIG_FILE), "utf8"));
+    return typeof parsed.baseline === "string" ? parsed.baseline : "gate-baseline.json";
+  } catch {
+    return "gate-baseline.json";
+  }
+};
 
 // src/core/types.ts
 var CounterError = class extends Error {
@@ -136,23 +144,21 @@ var CounterError = class extends Error {
 };
 
 // src/core/shell.ts
-import { execSync } from "child_process";
+import { spawnSync } from "child_process";
 var ANSI = /\[[0-9;]*m/g;
 var runCommand = (cwd, counterId, env) => (command) => {
-  try {
-    const output = execSync(`(
-${command}
-) 2>&1`, {
+  {
+    const run = spawnSync(command, {
       cwd,
       encoding: "utf8",
       env,
       maxBuffer: 64 * 1024 * 1024,
+      shell: true,
       stdio: ["ignore", "pipe", "pipe"]
     });
-    return { code: 0, output: output.replaceAll(ANSI, "") };
-  } catch (error) {
-    const failed = error;
-    const output = `${failed.stdout ?? ""}${failed.stderr ?? ""}`.replaceAll(ANSI, "");
+    const output = `${run.stdout ?? ""}${run.stderr ?? ""}`.replaceAll(ANSI, "");
+    if (run.error === void 0 && (run.status ?? 0) === 0) return { code: 0, output };
+    const failed = { status: run.status ?? 1, stderr: "", stdout: "" };
     const code = failed.status ?? -1;
     if (code === 126 || code === 127 || code === -1) {
       throw new CounterError(
@@ -334,10 +340,14 @@ var runProve = async ({
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { resolve as resolve4 } from "path";
 var EVIDENCE_LINES = 10;
-var recorded = (run) => {
+var recorded = (counter, params, run) => {
   let output = "";
+  const trimmed = (lines) => lines.map((line) => line.trimEnd()).filter((line) => line !== "").slice(-EVIDENCE_LINES);
   return {
-    last: () => output.split("\n").map((line) => line.trimEnd()).filter((line) => line !== "").slice(-EVIDENCE_LINES),
+    cited: () => {
+      const counted = counter.evidence === void 0 ? [] : counter.evidence({ output, params });
+      return trimmed(counted.length > 0 ? counted : output.split("\n"));
+    },
     run: (command) => {
       const result = run(command);
       output = result.output;
@@ -398,12 +408,12 @@ var runRatchet = async ({
       );
     }
     const tolerance = toleranceOf(entry, key, counter);
-    const recorder = recorded(runCommand(cwd, entry.counter));
+    const recorder = recorded(counter, entry, runCommand(cwd, entry.counter));
     const now = await counter.run({ cwd, key, params: entry, run: recorder.run });
     const verdict = verdictOf(now, limit, tolerance);
     measurements.push({
       baseline: limit,
-      evidence: verdict === "grew" ? recorder.last() : [],
+      evidence: verdict === "grew" ? recorder.cited() : [],
       key,
       now,
       verdict
@@ -646,7 +656,7 @@ var fastTierMs = {
     expect: 4500,
     input: (dir) => plant(
       dir,
-      DEFAULT_REPORT,
+      ".geonosis/gate-report.fast.json",
       JSON.stringify({
         finishedAt: "2026-08-30T10:00:04.500Z",
         ok: true,
@@ -657,8 +667,10 @@ var fastTierMs = {
     )
   },
   run: async ({ cwd, params }) => {
-    const relative = stringParam("fastTierMs", params, "report", DEFAULT_REPORT);
     const wanted = stringParam("fastTierMs", params, "tier", "fast");
+    const own = `.geonosis/gate-report.${wanted}.json`;
+    const asked = stringParam("fastTierMs", params, "report", "");
+    const relative = asked !== "" ? asked : existsSync5(resolve7(cwd, own)) ? own : DEFAULT_REPORT;
     const path = resolve7(cwd, relative);
     if (!existsSync5(path)) {
       throw new CounterError(
@@ -678,7 +690,7 @@ var fastTierMs = {
     if (report.tier !== wanted) {
       throw new CounterError(
         "fastTierMs",
-        `${relative} is a report of tier "${String(report.tier)}", not "${wanted}"`
+        `${relative} is a report of tier "${String(report.tier)}", not "${wanted}" \u2014 run \`geonosis-verify ${wanted}\`, which records ${own}`
       );
     }
     const spent = Date.parse(String(report.finishedAt)) - Date.parse(String(report.startedAt));
@@ -729,12 +741,32 @@ var UNIX_FINDING = /^\S[^\n]*:\d+:\d+: .*\[(Error|Warning)\/[^\]\n]+\]$/gm;
 var UNIX_SUMMARY = /^(\d+) problems?$/m;
 var AGENT_FINDING = /^\S[^\n]*:\d+:\d+: (error|warning) /gm;
 var DEFAULT_SUMMARY = /^Found (\d+) warnings? and (\d+) errors?\.$/m;
-var DEFAULT_FINDING = /^\s*[x!] [^\s(]+\([^)\n]+\): /m;
+var DEFAULT_FINDING = /^\s*([x!]) [^\s(]+\([^)\n]+\): /m;
 var FINDING_SHAPES = [UNIX_FINDING, AGENT_FINDING, DEFAULT_FINDING].map(
   (shape) => new RegExp(shape.source)
 );
 var RULE_TOKEN = /\([^()\n]+\)/;
-var findingLinesOf = (output) => output.split("\n").filter((line) => FINDING_SHAPES.some((shape) => shape.test(line)));
+var SEVERITY_BY_TOKEN = {
+  "!": "warning",
+  Error: "error",
+  error: "error",
+  Warning: "warning",
+  warning: "warning",
+  x: "error"
+};
+var severityOf = (line) => {
+  for (const shape of FINDING_SHAPES) {
+    const token = shape.exec(line)?.[1];
+    if (token !== void 0) return SEVERITY_BY_TOKEN[token];
+  }
+  return void 0;
+};
+var findingLinesOf = (output) => output.split("\n").filter((line) => severityOf(line) !== void 0);
+var linesOfSeverity = (output, want) => output.split("\n").filter((line) => severityOf(line) === want);
+var linesOfRule = (output, rule) => {
+  const named = new RegExp(`\\(${escapeForRegex(rule)}\\)`);
+  return findingLinesOf(output).filter((line) => named.test(line));
+};
 var FORMATS = ["agent", "default", "unix"];
 var isFormat = (value) => typeof value === "string" && FORMATS.some((one) => one === value);
 var expectedFormat = (counter, params) => {
@@ -793,6 +825,7 @@ ${output.trim()}`);
   return refuse2(`the tool exited ${code} and printed no findings and no summary`);
 };
 var oxlintErrors = {
+  evidence: ({ output }) => linesOfSeverity(output, "error"),
   id: "oxlintErrors",
   probe: {
     ...oxlintProbe("error", "typescript/no-explicit-any", ONE_ANY),
@@ -806,6 +839,7 @@ var oxlintErrors = {
   }
 };
 var oxlintWarnings = {
+  evidence: ({ output }) => linesOfSeverity(output, "warning"),
   id: "oxlintWarnings",
   // A warning, so the run exits 0 — the window `expectFormat` exists to close is also the window a
   // probe has to survive.
@@ -830,10 +864,12 @@ var countRule = (result, rule, expect) => {
 ${result.output.trim()}`
     );
   }
-  const named = new RegExp(`\\(${escapeForRegex(rule)}\\)`);
-  return lines.filter((line) => named.test(line)).length;
+  return linesOfRule(result.output, rule).length;
 };
 var oxlintRule = {
+  // The rule is a required param, so a run that got here always has one; a citation is not the
+  // place to raise that, and the report falls back to the tail rather than losing the regression.
+  evidence: ({ output, params }) => typeof params.rule === "string" ? linesOfRule(output, params.rule) : [],
   id: "oxlintRule",
   // The probe names its OWN rule: which rule a repo tracks is its business, and a probe that had to
   // make the repo's rule fire would need the repo's plugin loadable from a scratch directory.
@@ -1035,10 +1071,50 @@ var sumOfCounts = {
   }
 };
 
+// src/counters/suppressions.ts
+import { readdirSync as readdirSync4, readFileSync as readFileSync9 } from "fs";
+import { join as join7, resolve as resolve11 } from "path";
+var CODE_FILE = /\.(?:ts|tsx|js|jsx|mjs|cjs|mts|cts|vue|svelte|astro)$/;
+var SKIP3 = /^(?:node_modules|dist|coverage|\.[^.]|__fixtures__)/;
+var SUPPRESSION = /(?:eslint|oxlint|biome)-(?:disable|ignore)(?:-next-line|-line)?|@ts-expect-error|@ts-ignore/g;
+var countIn = (dir, depth = 12) => {
+  let entries;
+  try {
+    entries = readdirSync4(dir, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  let found = 0;
+  for (const entry of entries) {
+    if (SKIP3.test(entry.name)) continue;
+    if (entry.isDirectory()) {
+      if (depth > 0) found += countIn(join7(dir, entry.name), depth - 1);
+      continue;
+    }
+    if (!CODE_FILE.test(entry.name)) continue;
+    try {
+      found += readFileSync9(join7(dir, entry.name), "utf8").match(SUPPRESSION)?.length ?? 0;
+    } catch {
+    }
+  }
+  return found;
+};
+var suppressionCount = {
+  id: "suppressionCount",
+  probe: {
+    expect: 2,
+    input: (dir) => plant(dir, "src/planted.ts", "// eslint-disable-next-line x\n// @ts-expect-error y\n")
+  },
+  run: async ({ cwd, params }) => {
+    const roots = stringsParam(params, "roots", ["."]);
+    return roots.reduce((sum, root) => sum + countIn(resolve11(cwd, root)), 0);
+  }
+};
+
 // src/counters/tests.ts
-import { existsSync as existsSync9, mkdtempSync as mkdtempSync2, readFileSync as readFileSync9, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync9, mkdtempSync as mkdtempSync2, readFileSync as readFileSync10, rmSync as rmSync4 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join7, resolve as resolve11 } from "path";
+import { join as join8, resolve as resolve12 } from "path";
 var COUNTER = "testFailures";
 var VITEST_LINE = /^\s*Tests {2,}(.+?)\s*$/;
 var VITEST_TOTAL = /\(\d+\)$/;
@@ -1078,7 +1154,7 @@ var fromReport = (path) => {
   }
   let report;
   try {
-    report = JSON.parse(readFileSync9(path, "utf8"));
+    report = JSON.parse(readFileSync10(path, "utf8"));
   } catch (error) {
     throw new CounterError(
       COUNTER,
@@ -1102,14 +1178,14 @@ var fromReport = (path) => {
 };
 var reportPathFor = (cwd, params, command) => {
   const named = params.reportPath;
-  if (typeof named === "string" && named !== "") return { own: false, path: resolve11(cwd, named) };
+  if (typeof named === "string" && named !== "") return { own: false, path: resolve12(cwd, named) };
   if (!command.includes(PLACEHOLDER)) {
     throw new CounterError(
       COUNTER,
       `report: "${VITEST_JSON}" needs somewhere to put the report \u2014 write ${PLACEHOLDER} into the command (--outputFile=${PLACEHOLDER}) or give the entry a "reportPath"`
     );
   }
-  return { own: true, path: join7(mkdtempSync2(join7(tmpdir2(), "geonosis-report-")), "report.json") };
+  return { own: true, path: join8(mkdtempSync2(join8(tmpdir2(), "geonosis-report-")), "report.json") };
 };
 var testFailures = {
   id: COUNTER,
@@ -1158,7 +1234,7 @@ var testFailures = {
       run(command.replaceAll(PLACEHOLDER, path));
       return fromReport(path);
     } finally {
-      if (own) rmSync4(join7(path, ".."), { force: true, recursive: true });
+      if (own) rmSync4(join8(path, ".."), { force: true, recursive: true });
     }
   }
 };
@@ -1198,8 +1274,8 @@ var typecheckErrors = {
 };
 
 // src/counters/walk.ts
-import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
-import { resolve as resolve12 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync11 } from "fs";
+import { resolve as resolve13 } from "path";
 var DEFAULT_REPORT2 = ".geonosis/walk-report.json";
 var CLASSES = /* @__PURE__ */ new Set([
   "buy-box-above-fold",
@@ -1243,7 +1319,7 @@ var walkFindings = {
   },
   run: async ({ cwd, params }) => {
     const relative = stringParam("walkFindings", params, "report", DEFAULT_REPORT2);
-    const path = resolve12(cwd, relative);
+    const path = resolve13(cwd, relative);
     if (!existsSync10(path)) {
       throw new CounterError(
         "walkFindings",
@@ -1252,7 +1328,7 @@ var walkFindings = {
     }
     let report;
     try {
-      report = JSON.parse(readFileSync10(path, "utf8"));
+      report = JSON.parse(readFileSync11(path, "utf8"));
     } catch (error) {
       throw new CounterError(
         "walkFindings",
@@ -1282,6 +1358,7 @@ var COUNTERS = [
   fastTierMs,
   knipIssues,
   lawLineCount,
+  suppressionCount,
   oxlintErrors,
   oxlintRule,
   oxlintWarnings,
@@ -1361,6 +1438,7 @@ export {
   CONFIG_FILE,
   keyOf,
   loadConfig,
+  resolveBaseline,
   CounterError,
   runCommand,
   runProve,

package/dist/cli.js

@@ -5,9 +5,80 @@ import {
   formatReport,
   runProve,
   runRatchet
-} from "./chunk-LSYVFUP4.js";
+} from "./chunk-HBM6F3GO.js";
 
 // src/cli.ts
+import process from "process";
+var USAGE = `geonosis-ratchet [--cwd <dir>] [--tier <name>] [--prove] [--exclusive]
+
+Debt as a number that may only shrink. Runs the counters named in geonosis.ratchet.json, compares
+each against gate-baseline.json, and REWRITES the baseline down when a number shrank \u2014 so the win is
+locked in the same commit that earned it.
+
+  --cwd <dir>                  the repo to measure (default: the working directory)
+  --tier <name>                only the counters in that tier (default: every counter)
+  --prove                      plant a finding for each counter and require it to be read
+  --exclusive                  hold the machine-wide heavy lock for the run
+  --exclusive-timeout <secs>   how long to wait for that lock
+  --hold <ms>                  take the lock, wait, give it back \u2014 the --prove self-test's slow thing
+  --help, -h                   this text
+
+Exit codes: 0 no counter grew \xB7 1 a counter grew \xB7 2 the run could not measure.
+
+Every flag it does not know is REFUSED. This bin used to let anything unrecognised fall through to a
+full measurement, so \`--help\` ran the whole ratchet \u2014 a run that can rewrite the baseline, started
+by a typo.`;
+var KNOWN = /* @__PURE__ */ new Set([
+  "--cwd",
+  "--exclusive",
+  "--exclusive-timeout",
+  "--hold",
+  "--prove",
+  "--tier"
+]);
+var TAKES_A_VALUE = /* @__PURE__ */ new Set(["--cwd", "--exclusive-timeout", "--hold", "--tier"]);
+var CONFIG_SHAPE = `geonosis-ratchet reads geonosis.ratchet.json and gate-baseline.json
+
+geonosis.ratchet.json
+  baseline    string?              the file holding the numbers (default "gate-baseline.json")
+  counters    CounterEntry[]       required, and every entry is:
+      counter   string             required \u2014 the id of a counter this build ships
+      key       string?            the baseline key it writes (default: the counter id).
+                                   Two entries writing one key are refused: the loser's debt
+                                   would vanish into the baseline
+      tiers     string[]?          the tiers it runs in (default: all of them). A malformed
+                                   list is refused, never quietly matched to no tier
+      \u2026                            each counter reads its own further keys
+
+gate-baseline.json
+  <key>       number               one number per counter key. Written DOWN in place when a
+                                   number shrank, so the win lands in the commit that earned it`;
+var argv = process.argv.slice(2);
+if (argv.includes("--help") || argv.includes("-h")) {
+  process.stdout.write(`${USAGE}
+`);
+  process.exit(0);
+}
+if (argv.includes("--print-config-shape")) {
+  process.stdout.write(`${CONFIG_SHAPE}
+`);
+  process.exit(0);
+}
+var refuse = (message) => {
+  process.stderr.write(`geonosis-ratchet: ${message}
+`);
+  process.exit(2);
+};
+for (let at = 0; at < argv.length; at += 1) {
+  const arg = argv[at];
+  if (KNOWN.has(arg)) {
+    if (TAKES_A_VALUE.has(arg)) at += 1;
+    continue;
+  }
+  refuse(
+    `${arg} is not an option it takes. Run geonosis-ratchet --help for the ones it does \u2014 an unrecognised argument is refused rather than measured, because a run here can rewrite the baseline.`
+  );
+}
 var numberAfter = (flag) => {
   const at = process.argv.indexOf(flag);
   return at === -1 ? void 0 : Number(process.argv[at + 1] ?? Number.NaN);

package/dist/index.d.ts

@@ -41,6 +41,22 @@ type CounterProbe = {
     params?: Record<string, unknown>;
 };
 type Counter = {
+    /**
+     * Which lines of a run this counter actually COUNTED, for the report to cite when the number
+     * grew. Absent means the tail of the run is shown, which is right for a counter whose tool prints
+     * nothing but findings and wrong for every counter that reads one rule or one severity out of a
+     * mixed run: the tail is whatever printed LAST, and dielime got two unrelated warnings under a
+     * +2 on one rule while the two real errors sat further up.
+     *
+     * It takes the output rather than being handed the lines during the run so that it stays a pure
+     * function of what the tool said — the same reading the count was taken from, testable on its
+     * own. Returning nothing falls back to the tail: a citation nobody could make is no reason to
+     * show the reader nothing at all.
+     */
+    evidence?: (context: {
+        output: string;
+        params: Record<string, unknown>;
+    }) => string[];
     id: string;
     /**
      * Whether this counter's number is a measured QUANTITY — bytes, milliseconds — rather than a
@@ -151,6 +167,16 @@ declare const CONFIG_FILE = "geonosis.ratchet.json";
 /** The baseline key an entry writes. Defaults to the counter's own id. */
 declare const keyOf: (entry: CounterConfig) => string;
 declare const loadConfig: (cwd: string) => RatchetConfig;
+/**
+ * #120: the ONE answer to "where does the baseline live". Three tools guessed instead of asking —
+ * rails' deny rail rendered `<root>/gate-baseline.json` over a repo whose baseline is
+ * `scripts/gate-baseline.json` (measured on sandbox-exec: the tampering write LANDED), and mcp's
+ * preamble said "no gate-baseline.json here" over twenty ratcheted counters. Anything that SPEAKS
+ * about the baseline resolves it here; `loadConfig` stays the strict door for anything that RUNS
+ * counters. Never throws: a missing or unreadable config means the default, because naming the
+ * baseline must work in repos that have not adopted the ratchet yet.
+ */
+declare const resolveBaseline: (cwd: string) => string;
 
 declare const COUNTERS: Counter[];
 declare const counterById: (id: string) => Counter;
@@ -244,4 +270,4 @@ declare const formatProve: ({ proofs, proven }: ProveResult) => string;
  */
 declare const runCommand: (cwd: string, counterId: string, env?: NodeJS.ProcessEnv) => (command: string) => CommandResult;
 
-export { CONFIG_FILE, COUNTERS, type CommandResult, type Counter, type CounterConfig, type CounterContext, CounterError, type CounterProbe, type Holder, type Measurement, type Proof, type ProveResult, type RatchetConfig, type RatchetResult, type Verdict, acquireExclusive, counterById, formatProve, formatReport, heavyLockPath, keyOf, loadConfig, runCommand, runProve, runRatchet };
+export { CONFIG_FILE, COUNTERS, type CommandResult, type Counter, type CounterConfig, type CounterContext, CounterError, type CounterProbe, type Holder, type Measurement, type Proof, type ProveResult, type RatchetConfig, type RatchetResult, type Verdict, acquireExclusive, counterById, formatProve, formatReport, heavyLockPath, keyOf, loadConfig, resolveBaseline, runCommand, runProve, runRatchet };

package/dist/index.js

@@ -9,10 +9,11 @@ import {
   heavyLockPath,
   keyOf,
   loadConfig,
+  resolveBaseline,
   runCommand,
   runProve,
   runRatchet
-} from "./chunk-LSYVFUP4.js";
+} from "./chunk-HBM6F3GO.js";
 export {
   CONFIG_FILE,
   COUNTERS,
@@ -24,6 +25,7 @@ export {
   heavyLockPath,
   keyOf,
   loadConfig,
+  resolveBaseline,
   runCommand,
   runProve,
   runRatchet

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/ratchet",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "types": "./dist/index.d.ts",
   "description": "Debt as a number that may only shrink — one ratchet, pluggable counters.",
   "keywords": [