@mcptoolshop/housekeeping 1.3.0 → 1.4.0

package/src/analyze.mjs

@@ -25,6 +25,43 @@ export const RUN_IS_LIVE_MAINLINE_SIGNAL = `
          WHERE w.snapshot_id=wr.snapshot_id AND w.repo=wr.repo AND w.path=wr.path
            AND (','||w.on_triggers||',' LIKE '%,push,%'
              OR ','||w.on_triggers||',' LIKE '%,pull_request,%')))`;
+
+// The one definition of "the default branch head's checks are red", for the
+// same three readers: the analyzer decides (CI_FAILING, below) and the CLI,
+// the MCP server and the report ask whether it did, never the raw rollup.
+export const HEAD_CHECKS_RED = `EXISTS (SELECT 1 FROM finding f
+  WHERE f.snapshot_id=r.snapshot_id AND f.repo=r.name AND f.code='CI_FAILING')`;
+
+// Check-run states that mean a check ran and did not pass. CANCELLED is not
+// among them: `cancel-in-progress` cancels a superseded run as designed.
+const FAILED_STATES = new Set(['FAILURE', 'ERROR', 'TIMED_OUT', 'STARTUP_FAILURE', 'ACTION_REQUIRED']);
+
+/**
+ * Which checks on the default branch head actually fail. Pure.
+ *
+ * GitHub's rollup is FAILURE when any check run on the commit is, and it
+ * counts a CANCELLED run as a failure. The same commit pushed twice starts
+ * two runs; the concurrency rule cancels the first and the second passes,
+ * and the rollup still reads FAILURE forever (measured 2026-09-30 on two
+ * repos, every non-green check CANCELLED beside a SUCCESS of the same name).
+ * So a check fails here only when one of its runs is in a failed state and
+ * none of its runs on this commit succeeded. A check that was only ever
+ * cancelled is not a failure either: a failed run is not a cancelled one.
+ *
+ * `contexts` are check_context rows for the head ({ name, state }). Returns
+ * [{ name, states }] for the failing checks, or null when there are no rows
+ * -- not measured, so the caller falls back to the rollup.
+ */
+export function failingHeadChecks(contexts) {
+  if (!contexts?.length) return null;
+  const byName = new Map();
+  for (const c of contexts) {
+    if (!byName.has(c.name)) byName.set(c.name, []);
+    byName.get(c.name).push(c.state ?? 'RUNNING');
+  }
+  return [...byName].filter(([, states]) => !states.includes('SUCCESS') && states.some(s => FAILED_STATES.has(s)))
+    .map(([name, states]) => ({ name, states }));
+}
 // A checker declared in package.json but invoked by no script is a gate that
 // exists on paper and never runs. The case that earned the rule: a repo carried
 // `typescript` with no typecheck script -- build is tsup and tests are vitest,
@@ -221,12 +258,80 @@ export function environmentAdmitsBranch(env, settings, branch) {
 // a missing check counted from the start, and are unaffected by it.
 export const ATLAS_ENGINE_BEHIND_COUNTS_SINCE = '2026-09-30T21:44:11Z';
 
+/**
+ * Is this repository a fork of another organization's project? Pure.
+ *
+ * rules/atlas-map.md: "A fork of another organization's project is exempt."
+ * `repo` is a repo row (is_fork, fork_parent_owner); `homeOrgs` the
+ * organizations whose projects are the org's own, compared without case. A
+ * fork whose parent was not read (a snapshot before collector 1.5.0) is NOT
+ * exempt: not measured is never read as someone else's.
+ */
+export function forkOfAnotherOrg(repo, homeOrgs = []) {
+  if (repo?.is_fork !== 1) return false;
+  const owner = repo.fork_parent_owner;
+  if (typeof owner !== 'string' || !owner) return false;
+  return !homeOrgs.some(o => String(o).toLowerCase() === owner.toLowerCase());
+}
+
 /** Does an engine behind the fleet's count, for a snapshot taken at `takenAt`? Pure. */
 export function engineBehindCounts(takenAt, since = ATLAS_ENGINE_BEHIND_COUNTS_SINCE) {
   const t = Date.parse(takenAt ?? ''), s = Date.parse(since);
   return Number.isFinite(t) && Number.isFinite(s) && t >= s;
 }
 
+/**
+ * The Atlas version the fleet carries: the `@dogfood-lab/atlas@<v> check` pin
+ * that the most repositories use in push-triggered CI. Pure.
+ *
+ * rules/atlas-map.md: "the whole fleet carries the same one. It moves by pull
+ * request." So the fleet's version is what the repositories pin, and it moves
+ * when a pin-bump wave lands -- not when npm publishes a newer engine. Each
+ * repository counts once per pin it uses; a tie goes to the higher version.
+ * `rows` are { repo, atlas_check, on_triggers } for non-archived repositories.
+ * Returns { version, repos, pinned } or null when no repository pins one.
+ */
+export function fleetPin(rows) {
+  const byPin = new Map();
+  const pinned = new Set();
+  for (const w of rows ?? []) {
+    const push = (w.on_triggers ?? '').split(',').some(t => t === 'push' || t === 'pull_request');
+    if (!push) continue;
+    for (const pin of (w.atlas_check ?? '').split('\n')) {
+      if (!pin || pin === 'unpinned' || !parseSemver(pin)) continue;
+      if (!byPin.has(pin)) byPin.set(pin, new Set());
+      byPin.get(pin).add(w.repo);
+      pinned.add(w.repo);
+    }
+  }
+  if (!byPin.size) return null;
+  // compareSemver sorts newest first, which is the tie-break wanted here.
+  const [version, repos] = [...byPin].sort(([a, ra], [b, rb]) =>
+    rb.size - ra.size || compareSemver(parseSemver(a), parseSemver(b)))[0];
+  return { version, repos: repos.size, pinned: pinned.size };
+}
+
+/**
+ * The version maps and pins are measured against, for one snapshot.
+ *
+ * From the end of the first pin-bump wave (ATLAS_ENGINE_BEHIND_COUNTS_SINCE)
+ * it is the fleet's own pin (fleetPin). Before it, it is npm's latest, which
+ * is what those snapshots were reported against; keeping it means a rebuild
+ * reproduces their findings. npm's latest is returned beside it either way.
+ */
+export function fleetEngineFor(db, sid) {
+  const npm = db.prepare('SELECT version, error FROM atlas_fleet WHERE snapshot_id = ?').get(sid) ?? null;
+  const takenAt = db.prepare('SELECT taken_at FROM snapshot WHERE id = ?').get(sid)?.taken_at;
+  if (!engineBehindCounts(takenAt)) {
+    return { version: npm?.version ?? null, source: 'npm-latest', npmLatest: npm?.version ?? null, npmError: npm?.error ?? null };
+  }
+  const pin = fleetPin(db.prepare(`SELECT w.repo, w.atlas_check, w.on_triggers FROM workflow w
+    JOIN repo r ON r.snapshot_id = w.snapshot_id AND r.name = w.repo
+    WHERE w.snapshot_id = ? AND r.is_archived = 0 AND w.atlas_check <> ''`).all(sid));
+  return { version: pin?.version ?? null, source: 'fleet-pin', repos: pin?.repos ?? 0, pinned: pin?.pinned ?? 0,
+    npmLatest: npm?.version ?? null, npmError: npm?.error ?? null };
+}
+
 const ATLAS_RULE = 'rules/atlas-map.md';
 const isOlder = (v, fleet) => {
   const a = parseSemver(v), b = parseSemver(fleet);
@@ -412,14 +517,62 @@ export function classifyRequiredChecks({ required, observedNames, declaredJobs }
   return { stale, live: required.filter(c => !staleSet.has(c)) };
 }
 
+/**
+ * Which open PRs are missing a live required check because their files missed
+ * the workflow's paths filter. `live` comes from classifyRequiredChecks;
+ * `observed` is the repo's check_context rows.
+ */
+export function gatedPrs({ prs, live, observed }) {
+  const seenByPr = new Map();
+  for (const c of observed) {
+    if (c.source !== 'pr' || c.pr_number == null) continue;
+    if (!seenByPr.has(c.pr_number)) seenByPr.set(c.pr_number, new Set());
+    seenByPr.get(c.pr_number).add(c.name);
+  }
+  // Drafts are not trying to merge, and a PR opened moments ago may have
+  // checks still being created. The window is measured off `created_at`,
+  // NOT `updated_at`: updated_at moves for comments, labels and rebases,
+  // none of which say anything about whether CI ran, so a long-open PR
+  // that someone commented on today would read as "too fresh to judge".
+  // created_at never moves.
+  //
+  // This deliberately holds fire for a day. Dependabot PRs opened 90
+  // minutes before a snapshot can have zero checks and never get any
+  // (site-only changes against a paths-gated ci.yml), but at that age
+  // "no checks yet" and "no checks ever" are genuinely indistinguishable.
+  // They surface on the next run.
+  // Residual gap: a week-old PR force-pushed seconds before a snapshot.
+  // Rare, self-heals, and the cheap direction to be wrong in.
+  //
+  // A conflicting PR is left out. GitHub builds no merge ref for it, so no
+  // pull_request workflow runs at all, and a check missing from it says
+  // nothing about paths; the repair is a rebase, which PR_CONFLICTED already
+  // asks for. Counting them called eight repos' trigger broken when every
+  // blocked PR there was simply conflicted. The cost: a conflicted PR that
+  // ALSO misses the paths filter is only reported once it is rebased.
+  const settled = prs.filter(p => !p.is_draft && (p.age_days ?? 0) >= 1 && p.mergeable !== 'CONFLICTING');
+  const blocked = settled
+    .map(p => ({ p, absent: live.filter(c => !(seenByPr.get(p.number)?.has(c))) }))
+    .filter(x => x.absent.length);
+  return { settled, blocked };
+}
+
 /**
  * `metaRepos` are exempt from product-hygiene rules: repos that hold org
  * defaults, assets or tooling rather than a shipped product. Which repos those
  * are is a fact about the org, so it comes from the config file (config.mjs),
  * not from this file. Tests pass it explicitly.
  */
-export function analyze(db, sid, { metaRepos = loadConfig().metaRepos } = {}) {
+export function analyze(db, sid, opts = {}) {
+  // The config file is read only when the caller passes nothing, so a caller
+  // that names its metaRepos (every test) never picks up a local config.
+  const cfg = opts.metaRepos === undefined ? loadConfig() : null;
+  const metaRepos = opts.metaRepos ?? cfg.metaRepos;
   const META_REPOS = new Set(metaRepos);
+  // The organizations whose projects are the org's own (rules/atlas-map.md:
+  // a fork of another organization's project is exempt). Unset: the swept org.
+  const homeOrgs = opts.homeOrgs ?? cfg?.homeOrgs
+    ?? [db.prepare('SELECT org FROM snapshot WHERE id = ?').get(sid)?.org].filter(Boolean);
   db.prepare('DELETE FROM finding WHERE snapshot_id = ?').run(sid);
   const add = db.prepare('INSERT INTO finding VALUES (?,?,?,?,?,?,?)');
   const F = (repo, code, severity, category, message, evidence = null) =>
@@ -487,13 +640,13 @@ export function analyze(db, sid, { metaRepos = loadConfig().metaRepos } = {}) {
   const envBy = byRepo(q('SELECT * FROM environment WHERE snapshot_id = ?'));
   const wfEnvBy = byRepo(q('SELECT * FROM workflow_environment WHERE snapshot_id = ?'));
 
-  // The committed maps and the engine version they are measured against. No
-  // fleet row (older snapshot, or the registry did not answer) leaves the
-  // engine check silent.
+  // The committed maps and the engine version they are measured against
+  // (fleetEngineFor: the fleet's own pin after the first wave, npm's latest
+  // before it). No version to measure against leaves the engine check silent.
   const atlasBy = new Map(
     q('SELECT * FROM atlas_map WHERE snapshot_id = ?').map(x => [x.repo, x]),
   );
-  const fleetEngine = db.prepare('SELECT version FROM atlas_fleet WHERE snapshot_id = ?').get(sid)?.version ?? null;
+  const fleetEngine = fleetEngineFor(db, sid).version;
   const engineCounts = engineBehindCounts(db.prepare('SELECT taken_at FROM snapshot WHERE id = ?').get(sid)?.taken_at);
 
   // Where each red run broke, and the door it broke in. Keyed by run id and by
@@ -710,10 +863,23 @@ export function analyze(db, sid, { metaRepos = loadConfig().metaRepos } = {}) {
     }
 
     // ---- CI health -------------------------------------------------------
+    // The rollup is read through the head's own checks when the snapshot has
+    // them: a rollup red only with cancelled runs that a green run of the
+    // same check replaced is not a failing mainline (failingHeadChecks).
     if (r.ci_rollup === 'FAILURE' || r.ci_rollup === 'ERROR') {
-      F(name, 'CI_FAILING', 'high', 'ci',
-        `Default-branch check rollup is ${r.ci_rollup}.`,
-        `${r.default_branch}@${(r.head_oid ?? '').slice(0, 7)}`);
+      const head = (ctxBy.get(name) ?? []).filter(c => c.source === 'default');
+      const failing = failingHeadChecks(head);
+      const at = `${r.default_branch}@${(r.head_oid ?? '').slice(0, 7)}`;
+      // The collector reads the first 100 checks of a commit (most seen: 19).
+      // A red rollup whose failing check could lie past that page is read as
+      // the rollup says, never as clean.
+      if (failing === null || (failing.length === 0 && head.length >= 100)) {
+        F(name, 'CI_FAILING', 'high', 'ci', `Default-branch check rollup is ${r.ci_rollup}.`, at);
+      } else if (failing.length) {
+        F(name, 'CI_FAILING', 'high', 'ci',
+          `Default-branch checks failing: ${failing.map(c => `${c.name} (${[...new Set(c.states)].join(', ')})`).join('; ')}.`,
+          `${at}; rollup ${r.ci_rollup}`);
+      }
     }
     // A run only speaks for the mainline if its workflow could still be
     // triggered by a push today. Match the run back to the workflow file it
@@ -827,35 +993,13 @@ export function analyze(db, sid, { metaRepos = loadConfig().metaRepos } = {}) {
           + stale.map(c => `"${c}"`).join(', '));
       }
       if (live.length) {
-        const seenByPr = new Map();
-        for (const c of observed) {
-          if (c.source !== 'pr' || c.pr_number == null) continue;
-          if (!seenByPr.has(c.pr_number)) seenByPr.set(c.pr_number, new Set());
-          seenByPr.get(c.pr_number).add(c.name);
-        }
-        // Drafts are not trying to merge, and a PR opened moments ago may have
-        // checks still being created. The window is measured off `created_at`,
-        // NOT `updated_at`: updated_at moves for comments, labels and rebases,
-        // none of which say anything about whether CI ran, so a long-open PR
-        // that someone commented on today would read as "too fresh to judge".
-        // created_at never moves.
-        //
-        // This deliberately holds fire for a day. Dependabot PRs opened 90
-        // minutes before a snapshot can have zero checks and never get any
-        // (site-only changes against a paths-gated ci.yml), but at that age
-        // "no checks yet" and "no checks ever" are genuinely indistinguishable.
-        // They surface on the next run.
-        // Residual gap: a week-old PR force-pushed seconds before a snapshot.
-        // Rare, self-heals, and the cheap direction to be wrong in.
-        const settled = myPrs.filter(p => !p.is_draft && (p.age_days ?? 0) >= 1);
-        const blocked = settled
-          .map(p => ({ p, absent: live.filter(c => !(seenByPr.get(p.number)?.has(c))) }))
-          .filter(x => x.absent.length);
+        const { settled, blocked } = gatedPrs({ prs: myPrs, live, observed });
         if (blocked.length) {
           const worst = blocked.slice().sort((a, b) => b.absent.length - a.absent.length)[0];
           F(name, 'CI_REQUIRED_CHECK_GATED', 'medium', 'ci',
-            `${blocked.length} of ${settled.length} open PRs are BLOCKED by required checks that `
-            + `never ran on them: the job still exists, the PR's files just missed its paths filter.`,
+            `${blocked.length} of ${settled.length} open PRs without conflicts are BLOCKED by required `
+            + `checks that never ran on them: the job still exists, the PR's files just missed its paths filter. `
+            + `rules/github-actions.md: a workflow that emits a required check takes no paths filter on pull_request.`,
             `#${worst.p.number} is missing ${worst.absent.map(c => `"${c}"`).join(', ')}`
             + (blocked.length > 1 ? `; also #${blocked.filter(x => x !== worst).map(x => x.p.number).join(', #')}` : ''));
         }
@@ -947,7 +1091,12 @@ export function analyze(db, sid, { metaRepos = loadConfig().metaRepos } = {}) {
     // "Map older than the branch" is deliberately not a finding: a map needs
     // regenerating only when the structure changes, and `atlas check` in CI is
     // what enforces that.
-    for (const f of atlasMapFindings({
+    //
+    // A fork of another organization's project is exempt too (amended
+    // 2026-10-01): its workflows are the upstream's, and a map and a CI step
+    // would make it diverge from the project it tracks and conflict on every
+    // sync. forkOfAnotherOrg() decides; an unknown parent is not exempt.
+    if (!forkOfAnotherOrg(r, homeOrgs)) for (const f of atlasMapFindings({
       hasMap: r.has_atlas_map,
       workflows: myWfs,
       scripts: myScripts.map(x => x.command ?? ''),
@@ -1051,10 +1200,19 @@ export function analyze(db, sid, { metaRepos = loadConfig().metaRepos } = {}) {
           + '(off by default). Push a branch and open an issue instead, or supply a PAT.',
           at);
       }
-      if (triggers.includes('schedule')) {
-        F(name, 'WF_SCHEDULED', 'medium', 'actions',
-          'Scheduled (cron) workflow. rules/github-actions.md allows one only when it does what a push '
-          + 'cannot, runs weekly or slower, is bounded, and opens a pull request; check it against those.',
+      // rules/github-actions.md, "Scheduled workflows" (amended 2026-09-08): a
+      // schedule is permitted in an org repo when it does what a push cannot, runs weekly or slower ("daily
+      // needs a stated reason"), is bounded, opens a PR rather than pushing, and
+      // carries workflow_dispatch. Only a condition shown to fail fires; the
+      // first is judgment and is never checked. A gap in cadence alone is `low`:
+      // the rule allows a faster schedule with a reason, and the reason lives in
+      // prose this cannot read. A NULL column is a snapshot loaded before the
+      // check existed, which says nothing either way.
+      const gaps = (w.schedule_gaps ?? '').split('\n').filter(Boolean);
+      if (triggers.includes('schedule') && gaps.length) {
+        const cadenceOnly = gaps.every(g => g.startsWith('runs more often than weekly'));
+        F(name, 'WF_SCHEDULED', cadenceOnly ? 'low' : 'medium', 'actions',
+          `Scheduled workflow outside rules/github-actions.md: ${gaps.join('; ')}.`,
           at);
       }
     }
@@ -1195,11 +1353,10 @@ export function analyze(db, sid, { metaRepos = loadConfig().metaRepos } = {}) {
         `Workspace root package "${r.pkg_name}" v${pv}; per-package versions are not audited yet.`,
         `latest tag ${r.latest_tag ?? 'none'}`);
     } else {
-      if (pv && /^0\./.test(pv)) {
-        F(name, 'PRE_1_0', 'medium', 'version',
-          `package.json is v${pv}; standard requires promotion to 1.0.0 before shipping.`,
-          r.pkg_name ?? '');
-      }
+      // PRE_1_0 was retired on 2026-09-30. It filed every 0.x package as a
+      // defect, but the standard changed on 2026-09-09: 1.0.0 means the product
+      // is 1.0, and new or unfinished work stays 0.x. A finding against a
+      // version that follows the standard is not arguable against it.
       if (pv && tag && pv !== tag) {
         F(name, 'VERSION_TAG_DRIFT', 'high', 'version',
           `package.json v${pv} != latest release tag v${tag}.`,

package/src/cli.mjs

@@ -6,7 +6,7 @@
 import { readFileSync } from 'node:fs';
 import { DatabaseSync } from 'node:sqlite';
 import { openDb, loadSnapshot, latestSnapshotFile, DB_PATH } from './load.mjs';
-import { analyze, healthScores, RUN_IS_LIVE_MAINLINE_SIGNAL } from './analyze.mjs';
+import { analyze, healthScores, RUN_IS_LIVE_MAINLINE_SIGNAL, HEAD_CHECKS_RED } from './analyze.mjs';
 import { collect, DRILL_BUDGET } from './collect.mjs';
 import { preflight } from './gh.mjs';
 import { resolveOrg } from './config.mjs';
@@ -61,7 +61,7 @@ const REPORTS = {
              WHERE wr.snapshot_id=r.snapshot_id AND wr.repo=r.name
                AND ${RUN_IS_LIVE_MAINLINE_SIGNAL}) failing
     FROM repo r WHERE r.snapshot_id=? AND r.is_archived=0
-      AND (r.ci_rollup IN ('FAILURE','ERROR') OR EXISTS (
+      AND (${HEAD_CHECKS_RED} OR EXISTS (
         SELECT 1 FROM workflow_run wr WHERE wr.snapshot_id=r.snapshot_id AND wr.repo=r.name
           AND ${RUN_IS_LIVE_MAINLINE_SIGNAL}))
     ORDER BY r.name`).all(sid)),

package/src/collect.mjs

@@ -14,11 +14,12 @@ import { priceRun, ratesFromUsage, withFallback, runnerClass } from './cost.mjs'
 import { pagesDeployJobs, jobEnvironment } from './workflow-risks.mjs';
 import { DATA_DIR } from './paths.mjs';
 
-export const COLLECTOR_VERSION = '1.4.0';
+export const COLLECTOR_VERSION = '1.5.0';
 
 const REPO_FIELDS = `
   id name description url homepageUrl
   isPrivate isArchived isFork isTemplate isEmpty
+  parent { owner { login } }
   createdAt updatedAt pushedAt diskUsage
   stargazerCount forkCount
   watchers { totalCount }
@@ -680,7 +681,9 @@ export async function collectAtlasMaps(org, repos, { get = rest, fetchImpl = fet
   }
   const fleet = await atlasFleetVersion(fetchImpl);
   log(`atlas maps: ${targets.length} committed (${fetched} fetched, ${cached} from cache, ${errored} errors); ` +
-      `fleet engine ${fleet.version ?? `unknown (${fleet.error})`}`);
+      // npm's newest, not the fleet's version: the fleet carries what the repos
+      // pin (analyze.mjs fleetPin), which moves by a pin-bump wave.
+      `npm latest ${fleet.version ?? `unknown (${fleet.error})`}`);
   return { ok: true, fleet_version: fleet, fetched, cached, repos: out };
 }
 

package/src/config.mjs

@@ -7,7 +7,12 @@
 // treated as a non-product.
 //
 //   housekeeping.config.json
-//   { "org": "your-org", "metaRepos": [".github", "design-assets"] }
+//   { "org": "your-org", "metaRepos": [".github", "design-assets"],
+//     "homeOrgs": ["your-org", "your-other-org"] }
+//
+// `homeOrgs` names the organizations whose projects count as the org's own.
+// A fork of a project outside them is exempt from the map rule. Unset, it is
+// the swept org alone.
 //
 // No network and no database here, so every branch is unit-testable.
 import { readFileSync } from 'node:fs';
@@ -17,7 +22,7 @@ import { WORK_DIR } from './paths.mjs';
 
 export const CONFIG_PATH = process.env.HK_CONFIG ?? join(WORK_DIR, 'housekeeping.config.json');
 
-const KEYS = ['org', 'metaRepos'];
+const KEYS = ['org', 'metaRepos', 'homeOrgs'];
 const invalid = message => userError('CONFIG_INVALID', message,
   'fix housekeeping.config.json; housekeeping.config.example.json shows the shape');
 const DEFAULT_META = ['.github'];
@@ -47,7 +52,11 @@ export function parseConfig(text) {
   if (!Array.isArray(meta) || meta.some(m => typeof m !== 'string' || !m.trim())) {
     throw invalid('housekeeping config: "metaRepos" must be an array of repo names');
   }
-  return { org, metaRepos: [...meta] };
+  const home = raw.homeOrgs ?? null;
+  if (home !== null && (!Array.isArray(home) || !home.length || home.some(o => typeof o !== 'string' || !o.trim()))) {
+    throw invalid('housekeeping config: "homeOrgs" must be a non-empty array of organization names');
+  }
+  return { org, metaRepos: [...meta], homeOrgs: home ? [...home] : null };
 }
 
 /** Read the config file. A missing file is the defaults; an unreadable or malformed one throws. */
@@ -55,7 +64,7 @@ export function loadConfig(path = CONFIG_PATH) {
   let text;
   try { text = readFileSync(path, 'utf8'); }
   catch (e) {
-    if (e.code === 'ENOENT') return { org: null, metaRepos: [...DEFAULT_META] };
+    if (e.code === 'ENOENT') return { org: null, metaRepos: [...DEFAULT_META], homeOrgs: null };
     throw e;
   }
   return parseConfig(text);

package/src/load.mjs

@@ -9,7 +9,7 @@ import { parse as parseYaml } from 'yaml';
 import {
   editsWorkflowFiles, prCreateWithDefaultToken, auditSteps,
   pagesDeployJobs, jobEnvironment, jobRunsOnDefaultBranch, atlasCheckPins,
-  resolveFailedStep,
+  resolveFailedStep, scheduleGaps,
 } from './workflow-risks.mjs';
 import { safeJson } from './collect.mjs';
 import { reconcileRepos } from './cost.mjs';
@@ -112,7 +112,7 @@ export function inspectWorkflow(text, path, defaultBranch = null, atlasEnv = nul
     on_triggers: '', job_count: 0, has_matrix: 0, size_bytes: text.length, job_names: '',
     edits_workflow_files: 0, pr_create_default_token: 0,
     audit_steps_enforcing: 0, audit_steps_defanged: '',
-    pages_deploy_jobs: '', environments: [], atlas_check: '',
+    pages_deploy_jobs: '', environments: [], atlas_check: '', schedule_gaps: null,
   };
   let doc;
   try { doc = parseYaml(text, { logLevel: 'silent' }); } catch { out.state = 'parse_error'; return out; }
@@ -193,6 +193,9 @@ export function inspectWorkflow(text, path, defaultBranch = null, atlasEnv = nul
 
   out.atlas_check = atlasCheckPins(doc, jobs).join('\n');
 
+  const gaps = scheduleGaps(doc, jobEntries);
+  out.schedule_gaps = gaps ? gaps.join('\n') : null;
+
   // The deploy doors, joined in analyze.mjs to the settings they depend on.
   out.pages_deploy_jobs = pagesDeployJobs(jobEntries).join('\n');
   // The environment a job deploys to is a fact Atlas also records, so where
@@ -598,6 +601,7 @@ function loadSnapshotInner(db, snap) {
       sidebarShape(r.siteAstroCfg?.text),
       starlightRange(r.sitePkg?.text),
       hasAtlasMap(r),
+      r.isFork ? (r.parent?.owner?.login ?? null) : null,
     );
 
     // The trimmed map record, when the atlas pass read one for this repo.
@@ -695,7 +699,7 @@ function loadSnapshotInner(db, snap) {
         w.on_triggers, w.job_count, w.has_matrix, f.byteSize || w.size_bytes,
         w.edits_workflow_files, w.pr_create_default_token, w.job_names ?? '',
         w.audit_steps_enforcing ?? 0, w.audit_steps_defanged ?? '',
-        w.pages_deploy_jobs ?? '', w.atlas_check ?? '');
+        w.pages_deploy_jobs ?? '', w.atlas_check ?? '', w.schedule_gaps ?? null);
       for (const e of w.environments ?? []) {
         stmts.wfEnv.run(sid, r.name, w.path, e.job, e.environment, e.runs_on_default,
           e.source ?? 'workflow', e.parsed ?? null);

package/src/mcp.mjs

@@ -12,6 +12,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { EXIT, formatError, readOnlyQuery, structured, userError } from './errors.mjs';
 import { DATA_DIR, PACKAGE_ROOT } from './paths.mjs';
+import { HEAD_CHECKS_RED } from './analyze.mjs';
 
 const DB_FILE = process.env.HK_DB || join(DATA_DIR, 'housekeeping.db');
 const VERSION = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')).version;
@@ -115,7 +116,7 @@ const TOOLS = [
             WHERE wr.snapshot_id=r.snapshot_id AND wr.repo=r.name AND wr.is_latest_on_default=1
               AND wr.conclusion='failure' AND wr.event NOT IN ('dynamic','schedule')) failing
         FROM repo r WHERE r.snapshot_id=? AND r.is_archived=0
-          AND (r.ci_rollup IN ('FAILURE','ERROR') OR EXISTS (
+          AND (${HEAD_CHECKS_RED} OR EXISTS (
             SELECT 1 FROM workflow_run wr WHERE wr.snapshot_id=r.snapshot_id AND wr.repo=r.name
               AND wr.is_latest_on_default=1 AND wr.conclusion='failure'
               AND wr.event NOT IN ('dynamic','schedule')))

package/src/report.mjs

@@ -4,7 +4,7 @@
 import { writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { openDb } from './load.mjs';
-import { healthScores, RUN_IS_LIVE_MAINLINE_SIGNAL, doorFindingRows, ATLAS_DOOR_CHECKS_SINCE, engineBehindCounts } from './analyze.mjs';
+import { healthScores, RUN_IS_LIVE_MAINLINE_SIGNAL, HEAD_CHECKS_RED, doorFindingRows, ATLAS_DOOR_CHECKS_SINCE, fleetEngineFor } from './analyze.mjs';
 import { exitCodeFor, formatError, userError } from './errors.mjs';
 import { REPORTS_DIR } from './paths.mjs';
 
@@ -77,7 +77,7 @@ export function buildReport(db, sid) {
           AND ${RUN_IS_LIVE_MAINLINE_SIGNAL}) failing_workflows
     FROM repo r
     WHERE r.snapshot_id=? AND r.is_archived=0
-      AND (r.ci_rollup IN ('FAILURE','ERROR') OR EXISTS (
+      AND (${HEAD_CHECKS_RED} OR EXISTS (
         SELECT 1 FROM workflow_run wr WHERE wr.snapshot_id=r.snapshot_id AND wr.repo=r.name
           AND ${RUN_IS_LIVE_MAINLINE_SIGNAL}))
     ORDER BY r.name`);
@@ -287,7 +287,7 @@ export function buildReport(db, sid) {
   push(md.table(relMissing));
 
   const unpub = q(`SELECT repo, message FROM finding
-    WHERE snapshot_id=? AND code IN ('NPM_UNPUBLISHED','PRE_1_0','MONOREPO_ROOT') ORDER BY code, repo`);
+    WHERE snapshot_id=? AND code IN ('NPM_UNPUBLISHED','MONOREPO_ROOT') ORDER BY code, repo`);
   push(md.h3('Other version observations'));
   push(md.table(unpub));
 
@@ -460,7 +460,7 @@ export function buildReport(db, sid) {
       SUM(CASE WHEN r.has_atlas_map IS NULL THEN 1 ELSE 0 END) unknown
     FROM repo r WHERE r.snapshot_id=?1 AND r.is_archived=0 AND r.is_empty=0
       AND EXISTS (SELECT 1 FROM workflow w WHERE w.snapshot_id=r.snapshot_id AND w.repo=r.name)`);
-  const fleet = one('SELECT version, error FROM atlas_fleet WHERE snapshot_id=?');
+  const fleet = fleetEngineFor(db, sid);
   if (!atlas?.running || atlas.unknown === atlas.running) {
     push(md.p('_Not measured — this snapshot predates the Atlas map pass (collector 1.3.0). Run `npm run refresh`._'));
   } else {
@@ -468,12 +468,16 @@ export function buildReport(db, sid) {
       '`atlas check` in CI (`rules/atlas-map.md`). ' +
       `${atlas.mapped} of ${atlas.running} such repos have \`atlas/structure.json\` on their default branch; ` +
       `${atlas.unmapped} do not` + (atlas.unknown ? `; ${atlas.unknown} could not be read` : '') + '. ' +
-      (fleet?.version
-        ? `The fleet engine is **${fleet.version}** (latest \`@dogfood-lab/atlas\` on npm). ` +
-          (engineBehindCounts(snap.taken_at)
-            ? 'An engine behind it counts as a defect (`low`): the first pin-bump wave ended on 2026-09-30.'
-            : 'This snapshot predates the end of the first pin-bump wave, so an older engine is reported here and not counted in the health score.')
-        : `The fleet engine version could not be read${fleet?.error ? ` (${fleet.error})` : ''}, so no engine is judged behind.`)));
+      (fleet.version
+        ? (fleet.source === 'fleet-pin'
+          ? `The fleet engine is **${fleet.version}**, the \`atlas check\` pin ${fleet.repos} of ${fleet.pinned} pinning repos carry` +
+            (fleet.npmLatest && fleet.npmLatest !== fleet.version ? ` (npm's newest is ${fleet.npmLatest}; the fleet moves to it by a pin-bump wave)` : '') + '. ' +
+            'An engine behind the fleet\'s counts as a defect (`low`): the first pin-bump wave ended on 2026-09-30.'
+          : `The fleet engine is **${fleet.version}** (latest \`@dogfood-lab/atlas\` on npm). ` +
+            'This snapshot predates the end of the first pin-bump wave, so an older engine is reported here and not counted in the health score.')
+        : (fleet.source === 'fleet-pin'
+          ? 'No repository pins an `atlas check` version, so no engine is judged behind.'
+          : `The fleet engine version could not be read${fleet.npmError ? ` (${fleet.npmError})` : ''}, so no engine is judged behind.`))));
     push(md.table(q(`SELECT repo, code, message FROM finding
       WHERE snapshot_id=? AND code IN ('ATLAS_MAP_MISSING','ATLAS_CHECK_NOT_IN_CI')
       ORDER BY code, repo`)));

package/src/schema.sql

@@ -46,6 +46,10 @@ CREATE TABLE IF NOT EXISTS repo (
   -- 1 = atlas/structure.json is on the default branch, 0 = it is not, NULL =
   -- not collected (a snapshot before collector 1.3.0). See rules/atlas-map.md.
   has_atlas_map INTEGER,
+  -- The owner of the repository a fork was made from. NULL for a repo that is
+  -- not a fork, and for any repo in a snapshot before collector 1.5.0, which
+  -- did not read it: an unknown parent is never read as "someone else's".
+  fork_parent_owner TEXT,
   PRIMARY KEY (snapshot_id, name)
 );
 
@@ -147,7 +151,11 @@ CREATE TABLE IF NOT EXISTS workflow (
   pages_deploy_jobs TEXT,
   -- The pin of each `@dogfood-lab/atlas@<version> check` a run step issues,
   -- newline-joined; `unpinned` for a call without a version. Empty: none.
-  atlas_check TEXT
+  atlas_check TEXT,
+  -- For a scheduled workflow, the conditions of rules/github-actions.md
+  -- ("Scheduled workflows") it is shown to fail, newline-joined (scheduleGaps).
+  -- Empty: none shown to fail. NULL: the workflow has no schedule.
+  schedule_gaps TEXT
 );
 
 -- One row per job that names a deployment environment, read from the YAML at