@matt82198/aesop 0.1.0 → 0.3.1

package/hooks/pre-push-policy.sh

@@ -252,21 +252,42 @@ check_branch_policy() {
   # Finding 3: Handle tty mode and final line without trailing newline
   if [ -t 0 ]; then
     # Running interactively on a tty; skip stdin processing with note
-    # but still check current branch as fallback
+    # but still check current branch as fallback. Note: main() blocks tty before this can matter.
     :
   else
     # Not a tty; read stdin normally
+    local saw_tuple=0
+    local saw_nondelete=0
     while IFS=' ' read -r local_ref local_sha remote_ref remote_sha || [ -n "$local_ref" ]; do
       # Skip empty lines
       if [ -z "$remote_ref" ]; then
         continue
       fi
+      saw_tuple=1
+
+      # Delete refspec (local sha all zeros): removes a remote ref, pushes no
+      # content. Deleting refs/heads/main|master is still blocked below; other
+      # deletions never constitute a push TO main.
+      if [ "$local_sha" = "0000000000000000000000000000000000000000" ]; then
+        if [ "$remote_ref" = "refs/heads/main" ] || [ "$remote_ref" = "refs/heads/master" ]; then
+          return 1
+        fi
+        continue
+      fi
+      saw_nondelete=1
 
       # Block if attempting to push to main or master
       if [ "$remote_ref" = "refs/heads/main" ] || [ "$remote_ref" = "refs/heads/master" ]; then
         return 1
       fi
     done
+
+    # Delete-only push (tuples seen, none pushing content): allowed regardless
+    # of the currently checked-out branch -- branch deletion from a main
+    # checkout is administrative, not a push to main.
+    if [ "$saw_tuple" = "1" ] && [ "$saw_nondelete" = "0" ]; then
+      return 0
+    fi
   fi
 
   # If no protected branch in stdin, also check current branch as fallback
@@ -292,19 +313,46 @@ get_commit_range() {
   # FIRST tuple, so a multi-ref push only ever scanned the first branch's
   # range and every other ref in the same push silently bypassed the secret
   # scan. Returns 0 if at least one range was emitted, 1 if none could be
-  # parsed (tty, empty stdin, or no valid tuple) -- single-ref callers see
-  # exactly the same one-line output as before.
+  # parsed (malformed/invalid tuples), 2 if delete-only (tuples present but
+  # all deletions), 3 if truly empty stdin (no tuples at all, e.g. up-to-date
+  # push) -- single-ref callers see exactly the same one-line output as before.
+  # P1 bug fix: distinguish empty stdin (rc=3, allow) from malformed stdin
+  # (rc=1, fail-closed).
   local local_ref local_sha remote_ref remote_sha
   local found=0
+  local saw_any_tuple=0
 
   if [ -t 0 ]; then
-    # Running interactively on a tty; no stdin to parse
+    # Running interactively on a tty; no stdin to parse → fail-closed (direct hook invocation)
+    # main() blocks tty before this is reached via the normal flow; nearly dead code but tests exercise it
+    printf 'Error: No stdin on tty; cannot parse pre-push ref tuples (interactive hook invocation)\n' >&2
     return 1
   fi
 
+  local saw_delete=0
   while IFS=' ' read -r local_ref local_sha remote_ref remote_sha || [ -n "$local_ref" ]; do
-    # Skip empty lines
-    if [ -z "$remote_ref" ]; then
+    # Skip truly empty lines (no fields at all)
+    # A line with any content (even if malformed) will have at least one non-empty field
+    if [ -z "$local_ref" ] && [ -z "$local_sha" ] && [ -z "$remote_ref" ] && [ -z "$remote_sha" ]; then
+      continue
+    fi
+
+    # Harden tuple parsing: require all 4 fields present (P1 fix)
+    # If we have some content but not all 4 fields, it's malformed
+    if [ -z "$remote_ref" ] || [ -z "$remote_sha" ]; then
+      # Malformed line: has fewer than 4 fields
+      printf 'Error: Malformed pre-push stdin: insufficient fields (expected 4, got fewer) in line: %s %s %s %s\n' "$local_ref" "$local_sha" "$remote_ref" "$remote_sha" >&2
+      return 1
+    fi
+
+    saw_any_tuple=1
+
+    # Delete refspec (local sha all zeros): no content is pushed, so there is
+    # no commit range to scan. Skipped here; if the WHOLE push is deletes we
+    # return 2 so the caller can pass without weakening fail-closed behavior
+    # for unparseable stdin (which stays return 1).
+    if [ "$local_sha" = "0000000000000000000000000000000000000000" ]; then
+      saw_delete=1
       continue
     fi
 
@@ -327,6 +375,15 @@ get_commit_range() {
   if [ "$found" -eq 1 ]; then
     return 0
   fi
+  if [ "$saw_delete" -eq 1 ]; then
+    # Delete-only push: nothing to scan (distinct from unparseable stdin)
+    return 2
+  fi
+  if [ "$saw_any_tuple" -eq 0 ]; then
+    # Truly empty stdin: no tuples at all (e.g., up-to-date push) (P1 fix: rc=3)
+    return 3
+  fi
+  # Malformed stdin: tuples present but none were valid
   return 1
 }
 
@@ -340,30 +397,51 @@ check_secret_scan() {
     scan_bin="python"
   fi
 
-  local aesop_root="${AESOP_ROOT:-$HOME/aesop}"
-  local scan_script="$aesop_root/tools/secret_scan.py"
-
-  if [ ! -f "$scan_script" ]; then
-    # Scanner not found: log event and warn to stderr, but don't block (fail-open)
-    log_event "secret_scan_unavailable"
-    printf 'Warning: secret_scan.py not found at %s\n' "$scan_script" >&2
-    return 0
-  fi
-
-  # Parse pre-push stdin to get commit range(s), then scan files in each range.
+  # Parse pre-push stdin FIRST: a delete-only push carries no content, so it
+  # needs no scanner at all — the availability check below only applies when
+  # there is actually content to scan (ordering matters: in scanner-less
+  # environments a branch deletion must still be possible).
   # A multi-ref push (git push --all, or multiple branches/tags in one
   # invocation) yields one range per line from get_commit_range(); scan EVERY
   # one and fail if ANY range is dirty (P3 wave-25 fix: previously only the
   # first ref tuple's range was ever scanned).
+  # P1 bug fix: distinguish empty stdin (rc=3, allow) from malformed stdin
+  # (rc=1, fail-closed).
   local commit_ranges
   commit_ranges=$(get_commit_range)
   local parse_exit_code=$?
 
+  if [ $parse_exit_code -eq 2 ]; then
+    # Delete-only push: no content pushed, nothing to scan. Explicitly allowed
+    # (rc=2 is only emitted when tuples WERE parsed and all were deletions);
+    # unparseable/empty stdin still fails closed below.
+    log_event "secret_scan_skipped_delete_only_push"
+    return 0
+  fi
+
+  if [ $parse_exit_code -eq 3 ]; then
+    # Empty stdin: no tuples at all (e.g., up-to-date push), nothing to scan (P1 fix: rc=3)
+    # This is distinct from malformed stdin (rc=1) and is explicitly allowed
+    log_event "secret_scan_skipped_empty_stdin"
+    return 0
+  fi
+
+  local aesop_root="${AESOP_ROOT:-$HOME/aesop}"
+  local scan_script="$aesop_root/tools/secret_scan.py"
+
+  if [ ! -f "$scan_script" ] || [ ! -x "$scan_script" ]; then
+    # Scanner not found or not executable: fail-closed (cannot verify => deny)
+    log_block "secret_scan_unavailable"
+    printf 'FATAL: secret_scan.py not found or not executable at %s\n' "$scan_script" >&2
+    return 1
+  fi
+
   if [ $parse_exit_code -ne 0 ] || [ -z "$commit_ranges" ]; then
-    # Malformed stdin or unable to parse: fail-CLOSED (security P1 fix)
+    # Malformed stdin: fail-CLOSED (security P1 fix)
     # Only fail-open for missing scanner tool, not for malformed input
+    # rc=1 is returned for malformed tuples (e.g., 3-field lines), which must fail-closed
     log_block "secret_scan_stdin_parse_failed"
-    printf 'Error: Could not parse pre-push stdin for commit range (malformed or empty)\n' >&2
+    printf 'Error: Could not parse pre-push stdin for commit range (malformed tuple)\n' >&2
     return 1
   fi
 
@@ -417,7 +495,7 @@ log_event() {
   local seq
   seq=$(get_next_seq "$audit_log")
 
-  printf '{"seq":%d,"prev_hash":"%s","ts":"%s","repo":"%s","event":"%s","user":"%s"}\n' "$seq" "$prev_hash" "$ts" "$repo_name" "$(json_escape "$event_type")" "$(json_escape "$user")" >> "$audit_log" 2>/dev/null
+  printf '{"seq":%d,"prev_hash":"%s","ts":"%s","repo":"%s","event":"%s","user":"%s"}\n' "$seq" "$prev_hash" "$ts" "$(json_escape "$repo_name")" "$(json_escape "$event_type")" "$(json_escape "$user")" >> "$audit_log" 2>/dev/null
 
   # Update tail hash sidecar
   if [ -s "$audit_log" ]; then
@@ -454,7 +532,7 @@ log_block() {
   local seq
   seq=$(get_next_seq "$audit_log")
 
-  printf '{"seq":%d,"prev_hash":"%s","ts":"%s","repo":"%s","event":"push_blocked","reason":"%s","user":"%s"}\n' "$seq" "$prev_hash" "$ts" "$repo_name" "$(json_escape "$reason")" "$(json_escape "$user")" >> "$audit_log" 2>/dev/null
+  printf '{"seq":%d,"prev_hash":"%s","ts":"%s","repo":"%s","event":"push_blocked","reason":"%s","user":"%s"}\n' "$seq" "$prev_hash" "$ts" "$(json_escape "$repo_name")" "$(json_escape "$reason")" "$(json_escape "$user")" >> "$audit_log" 2>/dev/null
 
   # Update tail hash sidecar
   if [ -s "$audit_log" ]; then
@@ -547,6 +625,13 @@ run_test_mode() {
   (
     export AESOP_ROOT="$tmpdir/aesop"
     mkdir -p "$AESOP_ROOT/state"
+    # SCOPED (identity-polluter class): quoted-name check runs inside an
+    # isolated fixture repo; must NEVER touch the live repo config.
+    SELFTEST_REPO="$tmpdir/selftest_identity_repo"
+    mkdir -p "$SELFTEST_REPO"
+    cd "$SELFTEST_REPO" || exit 1
+    git init -q
+    git config user.email "test@example.com"
     git config user.name 'John "Jack" Doe'
     log_block "reason_with_backslash\\test"
 
@@ -631,13 +716,18 @@ run_test_mode() {
     export AESOP_ROOT="$tmpdir/aesop_no_scanner"
     mkdir -p "$AESOP_ROOT/state"
 
+    # Provide a valid 4-field tuple to test the scanner-missing condition
+    # (empty stdin would now skip the scan with log_event "secret_scan_skipped_empty_stdin")
+    # Format: <local-ref> <local-sha> <remote-ref> <remote-sha>
+    stdin_input="refs/heads/feature/test abc123def456 refs/heads/feature/test 0000000000000000000000000000000000000000"
+
     # Capture stderr to verify warning is printed
-    stderr_output=$( { check_secret_scan; } 2>&1 1>/dev/null )
+    stderr_output=$( { printf '%s\n' "$stdin_input" | check_secret_scan; } 2>&1 1>/dev/null )
     exit_code=$?
 
-    # Should return 0 (fail-open)
-    if [ "$exit_code" -ne 0 ]; then
-      printf 'FAIL: check_secret_scan should return 0 when scanner missing (fail-open)\n'
+    # Should return 1 (fail-closed, security-safe default)
+    if [ "$exit_code" -ne 1 ]; then
+      printf 'FAIL: check_secret_scan should return 1 when scanner missing (fail-closed)\n'
       exit 1
     fi
 
@@ -656,22 +746,22 @@ run_test_mode() {
       exit 1
     fi
 
-    # Verify event type is "secret_scan_unavailable"
-    if ! printf '%s' "$audit_line" | grep -q '"event":"secret_scan_unavailable"'; then
+    # Verify event type is "push_blocked" (fail-closed logged as blocked)
+    if ! printf '%s' "$audit_line" | grep -q '"event":"push_blocked"'; then
       printf 'FAIL: Audit log entry missing correct event type\n'
-      printf 'Expected event: "secret_scan_unavailable"\n'
+      printf 'Expected event: "push_blocked"\n'
       printf 'Entry: %s\n' "$audit_line"
       exit 1
     fi
 
     # Verify a warning was printed to stderr
-    if ! printf '%s' "$stderr_output" | grep -q -i 'unavailable\|missing\|not found'; then
+    if ! printf '%s' "$stderr_output" | grep -q -i 'unavailable\|missing\|not found\|fatal'; then
       printf 'FAIL: No warning message printed to stderr\n'
       printf 'stderr was: %s\n' "$stderr_output"
       exit 1
     fi
 
-    printf 'PASS: Secret scan unavailable logged with event and stderr warning\n'
+    printf 'PASS: Secret scan unavailable fails-closed and logged as push_blocked\n'
   )
   if [ $? -eq 0 ]; then
     test_passed=$((test_passed + 1))
@@ -957,15 +1047,23 @@ main() {
     exit $?
   fi
 
+  # Option B: Fail-closed TTY semantics — block interactive invocation before stdin capture.
+  # git pre-push ALWAYS pipes stdin; tty means human ran hook directly (not via git push).
+  # Refusing to skip security checks in interactive mode closes the window where empty stdin
+  # could be misinterpreted as a legitimate up-to-date push.
+  if [ -t 0 ]; then
+    printf 'Error: interactive invocation: this hook runs under git push; refusing to skip security checks (fail-closed)\n' >&2
+    log_block "interactive_invocation_blocked"
+    exit 1
+  fi
+
   # git pre-push provides ref info on stdin, and BOTH check_branch_policy and
   # check_secret_scan (via get_commit_range) need to read every ref tuple.
   # Capture the real pipe ONCE here and hand each consumer its own here-string
   # copy -- reading a pipe twice on the same fd starves the second reader
   # (once check_branch_policy drains it, get_commit_range would see nothing
   # but EOF and fail-closed on every push). A here-string preserves each
-  # function's existing tty-vs-pipe read semantics unchanged (an interactive
-  # tty yields no captured content, which both functions already treat the
-  # same way as "no ref tuples" via their existing fallback/fail-closed paths).
+  # function's existing tty-vs-pipe read semantics unchanged.
   local prepush_stdin=""
   if [ ! -t 0 ]; then
     prepush_stdin=$(cat)

package/mcp/server.mjs

@@ -6,10 +6,14 @@
  * Resolves AESOP_ROOT from env or --root flag; gracefully handles missing state files.
  *
  * Tools:
- *   fleet_status    - heartbeat ages + orchestrator status + alert count
- *   fleet_agents    - active agents from transcripts via dash-extra.mjs passthrough
- *   fleet_tracker   - open items by lane from state/tracker.json
- *   fleet_cost      - per-model token totals from state/ledger/OUTCOMES-LEDGER.md
+ *   fleet_status       - heartbeat ages + orchestrator status + alert count
+ *   fleet_agents       - active agents from transcripts via dash-extra.mjs passthrough
+ *   fleet_tracker      - open items by lane from state/tracker.json
+ *   fleet_cost         - per-model token totals from state/ledger/OUTCOMES-LEDGER.md
+ *   fleet_cost_by_wave - per-wave token totals from state/ledger/OUTCOMES-LEDGER.md
+ *   fleet_budget       - cost ceiling, current spend, remaining headroom, halt status
+ *   fleet_cost_trend   - per-wave token trend over last N waves from ledger
+ *   fleet_verify_stats - defect escape stats (first-try-green, fix-forward rate) if available
  *
  * All tools are read-only; no state mutations, no file writes.
  */
@@ -399,6 +403,268 @@ function getFleetCost() {
   return result;
 }
 
+/**
+ * fleet_cost_by_wave: Parse ledger and aggregate token counts by wave
+ */
+function getFleetCostByWave() {
+  const result = {
+    absent: !fs.existsSync(LEDGER_FILE),
+    by_wave: {},
+    total_tokens_in: 0,
+    total_tokens_out: 0
+  };
+
+  try {
+    if (fs.existsSync(LEDGER_FILE)) {
+      const lines = fs.readFileSync(LEDGER_FILE, 'utf8').split('\n');
+
+      for (const line of lines) {
+        // Parse markdown table row: | ts | agent_type | model | dur | tokens_in | tokens_out | verdict | phase | wave |
+        // Regex to extract all pipe-delimited columns
+        if (!line.startsWith('|') || !line.endsWith('|')) continue;
+
+        const parts = line.split('|').map(p => p.trim()).filter(p => p !== '');
+
+        // Need at least 9 parts (ts, agent_type, model, dur, tokens_in, tokens_out, verdict, phase, wave)
+        if (parts.length < 9) continue;
+
+        // Skip header line
+        if (parts[0].toLowerCase() === 'iso ts' || parts[0].toLowerCase() === 'timestamp') continue;
+        if (parts[0].toLowerCase().includes('iso') || parts[1].toLowerCase() === 'agent_type') continue;
+
+        // Skip separator lines (all dashes and pipes)
+        if (/^-+$/.test(parts[0])) continue;
+
+        try {
+          const tokensIn = parseInt(parts[4], 10);
+          const tokensOut = parseInt(parts[5], 10);
+
+          // Skip if tokens are not valid numbers
+          if (isNaN(tokensIn) || isNaN(tokensOut)) continue;
+
+          const wave = parts[8].trim() || 'unknown';
+
+          if (!result.by_wave[wave]) {
+            result.by_wave[wave] = {
+              tokens_in: 0,
+              tokens_out: 0,
+              total_tokens: 0,
+              count: 0
+            };
+          }
+
+          result.by_wave[wave].tokens_in += tokensIn;
+          result.by_wave[wave].tokens_out += tokensOut;
+          result.by_wave[wave].total_tokens += tokensIn + tokensOut;
+          result.by_wave[wave].count += 1;
+
+          result.total_tokens_in += tokensIn;
+          result.total_tokens_out += tokensOut;
+        } catch (e) {
+          // Skip malformed rows
+          continue;
+        }
+      }
+    }
+  } catch (e) {
+    // Silently ignore errors
+  }
+
+  return result;
+}
+
+/**
+ * fleet_budget: Read cost ceiling from config and calculate remaining headroom
+ */
+function getFleetBudget() {
+  const result = {
+    period: 'wave',
+    ceiling: null,
+    spent: 0,
+    remaining: null,
+    halted: false,
+    halt_reason: null,
+    halt_timestamp: null
+  };
+
+  try {
+    // Check if halted
+    const haltSentinelPath = path.join(STATE_ROOT, '.HALT');
+    if (fs.existsSync(haltSentinelPath)) {
+      result.halted = true;
+      try {
+        const haltData = JSON.parse(fs.readFileSync(haltSentinelPath, 'utf8'));
+        result.halt_reason = haltData.reason || null;
+        result.halt_timestamp = haltData.timestamp || null;
+      } catch (e) {
+        result.halt_reason = '(unreadable sentinel)';
+      }
+    }
+
+    // Read ceiling from config
+    if (config && config.limits && config.limits.max_wave_tokens !== null) {
+      result.ceiling = config.limits.max_wave_tokens;
+    }
+
+    // Calculate spent tokens from ledger
+    if (fs.existsSync(LEDGER_FILE)) {
+      const lines = fs.readFileSync(LEDGER_FILE, 'utf8').split('\n');
+
+      for (const line of lines) {
+        if (!line.startsWith('|') || !line.endsWith('|')) continue;
+
+        const parts = line.split('|').map(p => p.trim()).filter(p => p !== '');
+
+        // Need at least 7 parts (ts, agent_type, model, dur, tokens_in, tokens_out, verdict, ...)
+        if (parts.length < 7) continue;
+
+        // Skip header lines
+        if (parts[0].toLowerCase() === 'iso ts' || parts[0].toLowerCase() === 'timestamp') continue;
+        if (parts[0].toLowerCase().includes('iso') || parts[1].toLowerCase() === 'agent_type') continue;
+
+        // Skip separator lines (all dashes)
+        if (/^-+$/.test(parts[0])) continue;
+
+        try {
+          const tokensIn = parseInt(parts[4], 10);
+          const tokensOut = parseInt(parts[5], 10);
+
+          // Skip if tokens are not valid numbers
+          if (isNaN(tokensIn) || isNaN(tokensOut)) continue;
+
+          result.spent += tokensIn + tokensOut;
+        } catch (e) {
+          // Skip malformed rows
+          continue;
+        }
+      }
+    }
+
+    // Calculate remaining headroom
+    if (result.ceiling !== null) {
+      result.remaining = Math.max(0, result.ceiling - result.spent);
+    }
+  } catch (e) {
+    // Silently ignore errors
+  }
+
+  return result;
+}
+
+/**
+ * fleet_cost_trend: Parse ledger and return per-wave token trend over last N waves
+ */
+function getFleetCostTrend(params = {}) {
+  const result = {
+    absent: !fs.existsSync(LEDGER_FILE),
+    trend: [],
+    period_count: 0
+  };
+
+  const N = params.n || 10;
+
+  try {
+    if (fs.existsSync(LEDGER_FILE)) {
+      const lines = fs.readFileSync(LEDGER_FILE, 'utf8').split('\n');
+
+      // Parse all waves from ledger
+      const waveData = {};
+      const waveOrder = [];
+
+      for (const line of lines) {
+        if (!line.startsWith('|') || !line.endsWith('|')) continue;
+
+        const parts = line.split('|').map(p => p.trim()).filter(p => p !== '');
+
+        if (parts.length < 9) continue;
+
+        // Skip header and separator lines
+        if (parts[0].toLowerCase() === 'iso ts' || parts[0].toLowerCase() === 'timestamp') continue;
+        if (parts[0].toLowerCase().includes('iso') || parts[1].toLowerCase() === 'agent_type') continue;
+        if (/^-+$/.test(parts[0])) continue;
+
+        try {
+          const tokensIn = parseInt(parts[4], 10);
+          const tokensOut = parseInt(parts[5], 10);
+
+          if (isNaN(tokensIn) || isNaN(tokensOut)) continue;
+
+          const wave = parts[8].trim() || 'unknown';
+
+          if (!waveData[wave]) {
+            waveData[wave] = {
+              tokens_in: 0,
+              tokens_out: 0,
+              total_tokens: 0,
+              count: 0
+            };
+            waveOrder.push(wave);
+          }
+
+          waveData[wave].tokens_in += tokensIn;
+          waveData[wave].tokens_out += tokensOut;
+          waveData[wave].total_tokens += tokensIn + tokensOut;
+          waveData[wave].count += 1;
+        } catch (e) {
+          continue;
+        }
+      }
+
+      // Get last N waves in chronological order
+      const lastNWaves = waveOrder.slice(-N);
+      result.trend = lastNWaves.map(wave => ({
+        wave,
+        total_tokens: waveData[wave].total_tokens,
+        tokens_in: waveData[wave].tokens_in,
+        tokens_out: waveData[wave].tokens_out,
+        count: waveData[wave].count
+      }));
+      result.period_count = lastNWaves.length;
+
+      if (result.period_count === 0) {
+        result.absent = true;
+      }
+    }
+  } catch (e) {
+    // Silently ignore errors
+  }
+
+  return result;
+}
+
+/**
+ * fleet_verify_stats: Read defect escape stats if available
+ * Attempts to read pre-computed state/verify-stats.json or invoke defect_escape.py
+ */
+function getFleetVerifyStats() {
+  const result = {
+    absent: true,
+    first_try_green: null,
+    fix_forward_rate: null,
+    source: null
+  };
+
+  // Try to read pre-computed stats file
+  const statsFile = path.join(STATE_ROOT, 'verify-stats.json');
+  if (fs.existsSync(statsFile)) {
+    try {
+      const content = fs.readFileSync(statsFile, 'utf8').trim();
+      if (content) {
+        const stats = JSON.parse(content);
+        result.absent = false;
+        result.first_try_green = stats.first_try_estimate || null;
+        result.fix_forward_rate = stats.fixforward_rate || null;
+        result.source = 'verify-stats.json';
+        return result;
+      }
+    } catch (e) {
+      // Silently ignore parse errors
+    }
+  }
+
+  return result;
+}
+
 // ============================================================================
 // MCP Tool & Resource Definitions
 // ============================================================================
@@ -435,6 +701,44 @@ const TOOLS = [
       type: 'object',
       properties: {}
     }
+  },
+  {
+    name: 'fleet_cost_by_wave',
+    description: 'Get per-wave token usage totals from outcomes ledger, grouped by wave column',
+    inputSchema: {
+      type: 'object',
+      properties: {}
+    }
+  },
+  {
+    name: 'fleet_budget',
+    description: 'Get cost budget status: configured ceiling, current spend, remaining headroom, and halt status',
+    inputSchema: {
+      type: 'object',
+      properties: {}
+    }
+  },
+  {
+    name: 'fleet_cost_trend',
+    description: 'Get per-wave token usage trend over the last N waves from outcomes ledger',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        n: {
+          type: 'integer',
+          description: 'Number of waves to return (default: 10)',
+          default: 10
+        }
+      }
+    }
+  },
+  {
+    name: 'fleet_verify_stats',
+    description: 'Get defect escape stats (first-try-green rate, fix-forward rate) if available',
+    inputSchema: {
+      type: 'object',
+      properties: {}
+    }
   }
 ];
 
@@ -479,6 +783,18 @@ async function handleToolCall(requestId, params) {
       case 'fleet_cost':
         result = getFleetCost();
         break;
+      case 'fleet_cost_by_wave':
+        result = getFleetCostByWave();
+        break;
+      case 'fleet_budget':
+        result = getFleetBudget();
+        break;
+      case 'fleet_cost_trend':
+        result = getFleetCostTrend(args);
+        break;
+      case 'fleet_verify_stats':
+        result = getFleetVerifyStats();
+        break;
       default:
         mcp.writeError(requestId, -32601, `Unknown tool: ${name}`);
         return;