@mmerterden/multi-agent-pipeline 20.33.0 → 20.35.0

package/pipeline/scripts/learnings-ledger.mjs

@@ -14,7 +14,10 @@
  * run re-discovers the same structure and reviewers re-flag preferences the team
  * already rejected.
  *
- * Each line conforms to pipeline/schemas/learnings-ledger.schema.json.
+ * Each line conforms to pipeline/schemas/learnings-ledger.schema.json. Every
+ * entry passes the secret scan in _secret-scan.mjs before it is written, and
+ * `<private>` spans are removed first; a refused entry is counted in
+ * `droppedBySecretScan`.
  *
  * Subcommands:
  *   add        --kind <fact|convention|rejected-preference> --statement "..."
@@ -43,6 +46,12 @@
  *                 severity rejections are NOT distilled - a wrong rejection of a
  *                 blocking issue must never permanently suppress that class. Exit 2
  *                 when nothing new was distilled (a repeat of the same triage).
+ *   feedback   --id <id> --outcome <useful|dead_end|corrected> [--task <id>] [--repo-slug <slug>]
+ *                 Record how an injected entry fared. An entry marked corrected,
+ *                 or judged a dead end at least twice and more often than useful,
+ *                 leaves brief and profile; one useful at least twice ranks by
+ *                 its strength too (_memory-policy.mjs). Kept beside the ledger
+ *                 in learnings-feedback.jsonl.
  *   forget     [--statement "..."] [--kind <kind>] [--repo-slug <slug>]
  *                 Remove ledger entries matching the statement substring and/or
  *                 kind (rewrites the file). Use to clear a bad/stale learning.
@@ -70,7 +79,15 @@ import {
 import { homedir } from "node:os";
 import { execFileSync } from "node:child_process";
 import { join, basename, dirname } from "node:path";
-import { bm25, recencyRank, rrf, tokens, shortId, recallConfig } from "./_retrieval.mjs";
+import { bm25, recencyRank, rrf, tokens, recallConfig } from "./_retrieval.mjs";
+import {
+  checkedSlug,
+  ledgerRowId,
+  memoryExcluded,
+  nearDuplicate,
+  standing,
+} from "./_memory-policy.mjs";
+import { openScanner, stripPrivate } from "./_secret-scan.mjs";
 
 const argv = process.argv.slice(2);
 const SUB = argv[0];
@@ -110,6 +127,10 @@ function die(msg, code = 1) {
 // the learning replay always miss. `--git-common-dir` points at the main
 // repository's .git for every linked worktree.
 function repoSlug() {
+  return checkedSlug(rawRepoSlug());
+}
+
+function rawRepoSlug() {
   if (flags["repo-slug"]) return String(flags["repo-slug"]);
   if (process.env.MULTI_AGENT_REPO_SLUG) return process.env.MULTI_AGENT_REPO_SLUG;
   try {
@@ -150,6 +171,36 @@ function ledgerPath(slug) {
   );
 }
 
+function feedbackPath(slug) {
+  return join(dirname(ledgerPath(slug)), "learnings-feedback.jsonl");
+}
+
+/** id -> outcome rows recorded against it. */
+function readFeedback(slug) {
+  const p = feedbackPath(slug);
+  const byId = new Map();
+  if (!existsSync(p)) return byId;
+  for (const line of readFileSync(p, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const f = JSON.parse(line);
+      if (!byId.has(f.id)) byId.set(f.id, []);
+      byId.get(f.id).push(f);
+    } catch {
+      /* skip corrupted line */
+    }
+  }
+  return byId;
+}
+
+/** Rows with their standing; suppressed ones dropped. */
+function standingRows(slug, rows) {
+  const fb = readFeedback(slug);
+  return rows
+    .map((r) => ({ r, s: standing(fb.get(rowId(r)) ?? []) }))
+    .filter((x) => !x.s.suppressed);
+}
+
 function ensureDir(p) {
   mkdirSync(dirname(p), { recursive: true });
 }
@@ -171,9 +222,7 @@ function normStatement(s) {
 // Stable pointer for a ledger row, from the same fields the dedup key uses.
 // Not stored on the row: an existing ledger gets ids without a migration, and a
 // re-added entry keeps the id it already had.
-function rowId(row) {
-  return shortId("L", row.kind, normStatement(row.statement));
-}
+const rowId = ledgerRowId;
 
 function readLedger(slug) {
   const p = ledgerPath(slug);
@@ -197,8 +246,22 @@ function writeRow(slug, row) {
   appendFileSync(p, JSON.stringify(row) + "\n", "utf8");
 }
 
+// One scanner per process; every write goes through it (_secret-scan.mjs).
+let scanner = null;
+const secretScan = { dropped: 0 };
+function passesSecretScan(text) {
+  if (!scanner) {
+    scanner = openScanner();
+    process.on("exit", () => scanner.close());
+  }
+  if (scanner.isClean(text)) return true;
+  secretScan.dropped++;
+  return false;
+}
+
 /** Append one entry unless an entry with the same kind + normalized statement
- *  already exists (idempotent). Returns true when written. */
+ *  already exists (idempotent), or the text fails the secret scan. Returns
+ *  true when written. */
 function addEntry(slug, { kind, statement, scope, task, confidence, diagnosis, source }, existing) {
   // One line, enforced here rather than hoped for. The schema says "the
   // knowledge itself, in one line", and both blocks render one entry per line -
@@ -206,16 +269,23 @@ function addEntry(slug, { kind, statement, scope, task, confidence, diagnosis, s
   // `from-triage` builds statements out of model-written finding text, a
   // newline plus a plausible-looking `</repo-profile>` would break out of the
   // injected block itself. Collapsing whitespace closes both at the store.
-  const stmt = oneLine(statement);
+  const stmt = oneLine(stripPrivate(statement));
   if (!stmt) return false;
   const seenKey = `${kind}::${normStatement(stmt)}`;
   if (existing.has(seenKey)) return false;
+  const sameKind = [...existing]
+    .filter((k) => k.startsWith(`${kind}::`))
+    .map((k) => k.slice(kind.length + 2));
+  if (nearDuplicate(stmt.toLowerCase(), sameKind)) return false;
+  const diag = oneLine(stripPrivate(diagnosis));
+  const scopeText = scope || "global";
+  if (!passesSecretScan(`${stmt}\n${diag}\n${scopeText}`)) return false;
   const row = {
     v: "1.0.0",
     ts: new Date().toISOString(),
     repo_slug: slug,
     kind,
-    scope: scope || "global",
+    scope: scopeText,
     statement: stmt,
     source_task: task || null,
     confidence: CONFIDENCES.has(confidence) ? confidence : "medium",
@@ -223,7 +293,6 @@ function addEntry(slug, { kind, statement, scope, task, confidence, diagnosis, s
   // Optional causal diagnosis (Reflexion P5): the "why it failed" behind a
   // lesson. Verbal diagnosis is what turns a detected error into a prevented
   // one; a bare outcome does not. Stored only when supplied.
-  const diag = oneLine(diagnosis);
   if (diag) row.diagnosis = diag;
   // Who found it. Optional so old rows stay valid, but written whenever the
   // caller knows: a machine-mined path correction and a model's architectural
@@ -235,11 +304,19 @@ function addEntry(slug, { kind, statement, scope, task, confidence, diagnosis, s
   return true;
 }
 
+function refuseExcluded(slug) {
+  if (!memoryExcluded(slug)) return false;
+  process.stdout.write(JSON.stringify({ ok: true, slug, added: 0, excluded: true }) + "\n");
+  process.exitCode = 2;
+  return true;
+}
+
 function cmdAdd() {
   const kind = flags.kind;
   if (!KINDS.has(kind)) die(`--kind must be one of: ${[...KINDS].join(", ")}`, 1);
   if (!flags.statement || flags.statement === true) die('add needs --statement "..."', 1);
   const slug = repoSlug();
+  if (refuseExcluded(slug)) return;
   const existing = new Set(readLedger(slug).map((r) => `${r.kind}::${normStatement(r.statement)}`));
   const wrote = addEntry(
     slug,
@@ -256,7 +333,13 @@ function cmdAdd() {
     existing,
   );
   process.stdout.write(
-    JSON.stringify({ ok: true, slug, added: wrote ? 1 : 0, deduped: wrote ? 0 : 1 }) + "\n",
+    JSON.stringify({
+      ok: true,
+      slug,
+      added: wrote ? 1 : 0,
+      deduped: wrote || secretScan.dropped ? 0 : 1,
+      droppedBySecretScan: secretScan.dropped,
+    }) + "\n",
   );
   process.exit(wrote ? 0 : 2);
 }
@@ -267,6 +350,7 @@ function cmdFromTriage() {
   if (!existsSync(triagePath)) die(`triage file not found: ${triagePath}`, 1);
   const task = flags.task && flags.task !== true ? String(flags.task) : null;
   const slug = repoSlug();
+  if (refuseExcluded(slug)) return;
   let triage;
   try {
     triage = JSON.parse(readFileSync(triagePath, "utf8"));
@@ -311,7 +395,15 @@ function cmdFromTriage() {
       written++;
     }
   }
-  process.stdout.write(JSON.stringify({ ok: true, slug, added: written, skippedBlocking }) + "\n");
+  process.stdout.write(
+    JSON.stringify({
+      ok: true,
+      slug,
+      added: written,
+      skippedBlocking,
+      droppedBySecretScan: secretScan.dropped,
+    }) + "\n",
+  );
   process.exitCode = written ? 0 : 2;
   return;
 }
@@ -430,12 +522,14 @@ function compareCodepoints(a, b) {
 }
 
 function cmdBrief() {
-  const slug = flags["repo-slug"] ? String(flags["repo-slug"]) : repoSlug();
+  const slug = repoSlug();
   const cfg = recallConfig();
   const max = flags.max ? Math.max(1, Number(flags.max)) : 20;
   const task = flags.task && flags.task !== true ? String(flags.task) : null;
   const scope = flags.scope && flags.scope !== true ? String(flags.scope) : null;
-  const rows = readLedger(slug);
+  const scored = standingRows(slug, readLedger(slug));
+  const rows = scored.map((x) => x.r);
+  const strengthOf = new Map(scored.map((x) => [x.r, x.s.corroborated ? x.s.strength : 0]));
   if (rows.length === 0) {
     process.exit(2); // nothing to inject; caller skips silently
   }
@@ -471,8 +565,13 @@ function cmdBrief() {
     );
     const fresh = recencyRank(pool, { halfLifeDays: cfg.halfLifeDays });
     const matched = new Set(relevance.filter((x) => x.score > 0).map((x) => x.index));
-    const fused = rrf([relevance, fresh], { k: [10, 60], weights: [3, 1] }).filter((x) =>
-      matched.has(x.index),
+    // Entries recorded useful at least twice rank by their strength as well;
+    // with no feedback this list is empty and the fusion is unchanged.
+    const earned = pool
+      .map((r, index) => ({ index, score: strengthOf.get(r) || 0 }))
+      .sort((a, b) => b.score - a.score);
+    const fused = rrf([relevance, fresh, earned], { k: [10, 60, 60], weights: [3, 1, 1] }).filter(
+      (x) => matched.has(x.index),
     );
     ordered = fused.slice(0, max).map((x) => pool[x.index]);
     // A task whose words match nothing in the ledger must not silently inject an
@@ -527,10 +626,10 @@ function scopeMatches(entryScope, target) {
 // everything after it. Detail is deliberately absent; each line carries the
 // pointer that buys it back.
 function cmdProfile() {
-  const slug = flags["repo-slug"] ? String(flags["repo-slug"]) : repoSlug();
+  const slug = repoSlug();
   const cfg = recallConfig();
   const max = flags.max ? Math.max(1, Number(flags.max)) : 60;
-  const rows = readLedger(slug);
+  const rows = standingRows(slug, readLedger(slug)).map((x) => x.r);
   if (rows.length === 0) process.exit(2);
 
   const ordered = rows
@@ -565,7 +664,7 @@ function cmdProfile() {
 function cmdShow() {
   const id = flags.id && flags.id !== true ? String(flags.id) : null;
   if (!id) die("show needs --id <id>", 1);
-  const slug = flags["repo-slug"] ? String(flags["repo-slug"]) : repoSlug();
+  const slug = repoSlug();
   const want = id.startsWith("L:") ? id : `L:${id}`;
   const row = readLedger(slug).find((r) => rowId(r) === want);
   if (!row) {
@@ -592,7 +691,7 @@ function cmdShow() {
 function cmdTimeline() {
   const id = flags.anchor && flags.anchor !== true ? String(flags.anchor) : null;
   if (!id) die("timeline needs --anchor <id>", 1);
-  const slug = flags["repo-slug"] ? String(flags["repo-slug"]) : repoSlug();
+  const slug = repoSlug();
   const before = flags.before && flags.before !== true ? Math.max(0, Number(flags.before)) : 3;
   const after = flags.after && flags.after !== true ? Math.max(0, Number(flags.after)) : 3;
   const want = id.startsWith("L:") ? id : `L:${id}`;
@@ -622,15 +721,32 @@ function cmdTimeline() {
 }
 
 function cmdPath() {
-  process.stdout.write(
-    ledgerPath(flags["repo-slug"] ? String(flags["repo-slug"]) : repoSlug()) + "\n",
-  );
+  process.stdout.write(ledgerPath(repoSlug()) + "\n");
   process.exitCode = 0;
   return;
 }
 
+const OUTCOMES = new Set(["useful", "dead_end", "corrected"]);
+
+function cmdFeedback() {
+  const slug = repoSlug();
+  const raw = flags.id && flags.id !== true ? String(flags.id).replace(/^\[|\]$/g, "") : "";
+  const id = raw && !raw.startsWith("L:") ? `L:${raw}` : raw;
+  const outcome = String(flags.outcome || "");
+  if (!id || !OUTCOMES.has(outcome))
+    die("feedback needs --id <id> --outcome <useful|dead_end|corrected>", 1);
+  if (!readLedger(slug).some((r) => rowId(r) === id)) die(`no ledger entry ${id}`, 2);
+  if (refuseExcluded(slug)) return;
+  const row = { ts: new Date().toISOString(), id, outcome };
+  if (flags.task && flags.task !== true) row.task = String(flags.task);
+  ensureDir(feedbackPath(slug));
+  appendFileSync(feedbackPath(slug), JSON.stringify(row) + "\n", "utf8");
+  const s = standing(readFeedback(slug).get(id) ?? []);
+  process.stdout.write(JSON.stringify({ ok: true, slug, id, ...s }) + "\n");
+}
+
 function cmdStats() {
-  const slug = flags["repo-slug"] ? String(flags["repo-slug"]) : repoSlug();
+  const slug = repoSlug();
   const rows = readLedger(slug);
   const counts = { fact: 0, convention: 0, "rejected-preference": 0 };
   for (const r of rows) if (counts[r.kind] !== undefined) counts[r.kind]++;
@@ -651,6 +767,9 @@ switch (SUB) {
   case "forget":
     cmdForget();
     break;
+  case "feedback":
+    cmdFeedback();
+    break;
   case "brief":
     cmdBrief();
     break;
@@ -671,7 +790,7 @@ switch (SUB) {
     break;
   default:
     process.stderr.write(
-      "usage: learnings-ledger.mjs <add|from-triage|forget|brief|profile|show|timeline|path|stats> [flags]\n",
+      "usage: learnings-ledger.mjs <add|from-triage|feedback|forget|brief|profile|show|timeline|path|stats> [flags]\n",
     );
     process.exit(64);
 }

package/pipeline/scripts/office-build.mjs

@@ -9,9 +9,11 @@
  * pipeline/office/index.html: the list of sprite names in pipeline/office/assets
  * (served by contract-server.mjs at /office/assets/), the strings as a JSON
  * literal, the two code files in order inside one IIFE. It also renders the
- * pixel grids in pipeline/office-art into PNG sprites in pipeline/office/assets
- * and writes pipeline/office/toolkit.json, the toolkit version shipped with
- * the page; --check holds all three to their sources.
+ * pixel grids in pipeline/office-art into PNG sprites in pipeline/office/assets,
+ * recolors the character sheets into the company's employees
+ * (office-art/employees.json) and writes pipeline/office/toolkit.json, the
+ * toolkit version shipped with the page; --check holds all of them to their
+ * sources.
  *
  *   node pipeline/scripts/office-build.mjs          write the page
  *   node pipeline/scripts/office-build.mjs --check  exit 1 when the page on
@@ -21,7 +23,7 @@
 
 import { createHash } from "node:crypto";
 import { readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { deflateSync } from "node:zlib";
+import { deflateSync, inflateSync } from "node:zlib";
 import { basename, join } from "node:path";
 import { pathToFileURL } from "node:url";
 
@@ -78,6 +80,272 @@ export function encodePng(width, height, rgba) {
   ]);
 }
 
+/**
+ * An 8-bit RGBA PNG decoded to {width, height, rgba}. Only that colour type is
+ * read (every sheet in office/assets is one); anything else throws.
+ */
+export function decodePng(buf) {
+  if (buf.subarray(0, 8).toString("hex") !== PNG_SIGNATURE) throw new Error("not a PNG file");
+  let o = 8;
+  let width = 0;
+  let height = 0;
+  const idat = [];
+  while (o + 8 <= buf.length) {
+    const len = buf.readUInt32BE(o);
+    const type = buf.toString("ascii", o + 4, o + 8);
+    const data = buf.subarray(o + 8, o + 8 + len);
+    if (type === "IHDR") {
+      width = data.readUInt32BE(0);
+      height = data.readUInt32BE(4);
+      if (data[8] !== 8 || data[9] !== 6 || data[12] !== 0)
+        throw new Error("only 8-bit RGBA, non-interlaced PNGs are read");
+    } else if (type === "IDAT") idat.push(data);
+    else if (type === "IEND") break;
+    o += 12 + len;
+  }
+  if (!width || !height) throw new Error("PNG has no IHDR");
+  const raw = inflateSync(Buffer.concat(idat));
+  const stride = width * 4;
+  if (raw.length !== (stride + 1) * height) throw new Error("PNG data has the wrong length");
+  const rgba = Buffer.alloc(stride * height);
+  for (let y = 0; y < height; y++) {
+    const filter = raw[y * (stride + 1)];
+    const line = y * (stride + 1) + 1;
+    for (let x = 0; x < stride; x++) {
+      const a = x >= 4 ? rgba[y * stride + x - 4] : 0;
+      const b = y > 0 ? rgba[(y - 1) * stride + x] : 0;
+      const c = x >= 4 && y > 0 ? rgba[(y - 1) * stride + x - 4] : 0;
+      let v = raw[line + x];
+      if (filter === 1) v += a;
+      else if (filter === 2) v += b;
+      else if (filter === 3) v += (a + b) >> 1;
+      else if (filter === 4) {
+        const p = a + b - c;
+        const pa = Math.abs(p - a);
+        const pb = Math.abs(p - b);
+        const pc = Math.abs(p - c);
+        v += pa <= pb && pa <= pc ? a : pb <= pc ? b : c;
+      } else if (filter !== 0) throw new Error(`unknown PNG filter ${filter}`);
+      rgba[y * stride + x] = v & 255;
+    }
+  }
+  return { width, height, rgba };
+}
+
+// --- the employees -----------------------------------------------------------
+// office-art/employees.json gives each person of the company a base character
+// sheet and four colours. A sheet's colours are sorted into parts by where
+// they sit in the 16x32 frame (hair above the face, the shirt below it, then
+// trousers and shoes) and skin by the face's tone; the near-black outline,
+// white, the eyes and the shoes keep their colours. Each part moves to the
+// person's colour with its shading kept.
+
+const FRAME_H = 32;
+const BANDS = [
+  ["hair", 0, 13],
+  ["face", 13, 18],
+  ["top", 18, 25],
+  ["bottom", 25, 28],
+  ["shoes", 28, 32],
+];
+const PARTS = ["hair", "skin", "top", "bottom"];
+const SKIN_NEAR = 48;
+
+const channels = (hex) => [0, 2, 4].map((i) => parseInt(hex.slice(i, i + 2), 16));
+
+function hsl(r, g, b) {
+  const [R, G, B] = [r / 255, g / 255, b / 255];
+  const max = Math.max(R, G, B);
+  const min = Math.min(R, G, B);
+  const l = (max + min) / 2;
+  const d = max - min;
+  if (!d) return [0, 0, l];
+  const s = d / (1 - Math.abs(2 * l - 1));
+  const h = max === R ? ((G - B) / d + 6) % 6 : max === G ? (B - R) / d + 2 : (R - G) / d + 4;
+  return [h * 60, s, l];
+}
+
+function rgbOf(h, s, l) {
+  const c = (1 - Math.abs(2 * l - 1)) * s;
+  const x = c * (1 - Math.abs(((h / 60) % 2) - 1));
+  const m = l - c / 2;
+  const sector = [
+    [c, x, 0],
+    [x, c, 0],
+    [0, c, x],
+    [0, x, c],
+    [x, 0, c],
+    [c, 0, x],
+  ][Math.min(5, Math.floor(h / 60))];
+  return sector.map((v) => Math.round(Math.min(1, Math.max(0, v + m)) * 255));
+}
+
+/** The band of a sheet row: hair, face, top, bottom or shoes, by its place in the 32-row frame. */
+export function bandOf(y) {
+  return BANDS.find(([, a, b]) => y % FRAME_H >= a && y % FRAME_H < b)[0];
+}
+
+/**
+ * The middle of the face where it faces the viewer: the first row of frames
+ * (the front view; the second shows the back of the head), the face rows,
+ * away from the sides long hair covers and the collar rises into.
+ */
+export function inFaceCentre(x, y) {
+  return y >= 13 && y < 18 && x % 16 >= 5 && x % 16 <= 10;
+}
+
+/**
+ * The part of every pixel of a sheet: hair, skin, top, bottom, keep, or null
+ * for a transparent one. A pixel is judged by its colour and its row:
+ *  - near-black outline and white keep their colour everywhere;
+ *  - the face's tone is skin wherever it is (neck, arms, hands, legs);
+ *  - the hair rows are hair, the dark strand lines inside it included;
+ *  - the face rows are skin, hair (a colour of the hair rows: long hair at the
+ *    sides) or kept (eyes, mouth, the face's outline), never clothing;
+ *  - the body rows are the top, except a hair colour (a braid over the
+ *    shoulder), the leg rows are the bottom, and the shoes keep theirs.
+ */
+export function pixelParts(sheet) {
+  const { width, height, rgba } = sheet;
+  const seen = new Map();
+  for (let y = 0; y < height; y++) {
+    const band = bandOf(y);
+    for (let x = 0; x < width; x++) {
+      const o = (y * width + x) * 4;
+      if (!rgba[o + 3]) continue;
+      const hex = rgba.subarray(o, o + 3).toString("hex");
+      const counts = seen.get(hex) || {
+        hair: 0,
+        face: 0,
+        top: 0,
+        bottom: 0,
+        shoes: 0,
+        centre: 0,
+      };
+      counts[band]++;
+      if (inFaceCentre(x, y)) counts.centre++;
+      seen.set(hex, counts);
+    }
+  }
+  const info = new Map();
+  for (const [hex, counts] of seen) {
+    const rgb = channels(hex);
+    const [h, s, l] = hsl(...rgb);
+    const n = counts.hair + counts.face + counts.top + counts.bottom + counts.shoes;
+    const [band] = BANDS.map(([name]) => [name, counts[name]]).sort((p, q) => q[1] - p[1])[0];
+    info.set(hex, {
+      rgb,
+      counts,
+      n,
+      band,
+      fixed: Math.max(...rgb) < 0x18 || Math.min(...rgb) > 0xf8,
+      skinLike: h >= 8 && h <= 45 && s >= 0.25 && l >= 0.15,
+      h,
+      s,
+    });
+  }
+  // The face is the skin-like colours of its middle, where no hair hangs, that
+  // the hair rows use less (a forehead under the fringe counts). Skin elsewhere
+  // is a colour the hair rows never use that sits next to a face colour (the
+  // shading of arms and hands); a hair highlight of a skin-like hue lives in the
+  // hair rows, and a clothing colour of a skin-like hue is far from the face or
+  // lives below the waist. Hair never reaches the middle of the face.
+  const faceTones = [...info.values()].filter(
+    (c) => c.skinLike && c.counts.centre > 0 && c.counts.centre * 2 >= c.counts.hair,
+  );
+  const near = (c, f) =>
+    Math.abs(c.s - f.s) <= 0.3 && c.rgb.every((v, i) => Math.abs(v - f.rgb[i]) <= SKIN_NEAR);
+  const skin = (c) =>
+    faceTones.includes(c) ||
+    (c.skinLike && c.counts.hair === 0 && c.band !== "bottom" && faceTones.some((f) => near(c, f)));
+  const hairColour = (c) => c.counts.hair > 0 && c.counts.hair * 2 >= c.n - c.counts.hair;
+  const out = new Array(width * height).fill(null);
+  for (let y = 0; y < height; y++) {
+    const band = bandOf(y);
+    for (let x = 0; x < width; x++) {
+      const o = (y * width + x) * 4;
+      if (!rgba[o + 3]) continue;
+      const c = info.get(rgba.subarray(o, o + 3).toString("hex"));
+      let part;
+      if (c.fixed) part = "keep";
+      else if (skin(c)) part = "skin";
+      else if (band === "hair") part = "hair";
+      else if (band === "face") part = hairColour(c) && !inFaceCentre(x, y) ? "hair" : "keep";
+      else if (band === "top") part = c.band === "hair" ? "hair" : "top";
+      else if (band === "bottom") part = "bottom";
+      else part = "keep";
+      out[y * width + x] = part;
+    }
+  }
+  return out;
+}
+
+/** A part's target lightness for a source lightness: a monotone ramp around the part's mean. */
+function rampOf(l, mean, target) {
+  if (l <= mean) return target * (l / mean);
+  const top = Math.min(0.92, target + 0.35);
+  return target + (top - target) * ((l - mean) / (1 - mean));
+}
+
+/**
+ * A character sheet in one person's colours: {hair, skin, top, bottom} as
+ * "rrggbb". Returns {width, height, rgba, parts}, parts being pixelParts.
+ */
+export function recolorSheet(sheet, colours) {
+  const parts = pixelParts(sheet);
+  const { rgba } = sheet;
+  const sum = {};
+  const n = {};
+  for (let i = 0; i < parts.length; i++) {
+    const p = parts[i];
+    if (!PARTS.includes(p)) continue;
+    const [, , l] = hsl(rgba[i * 4], rgba[i * 4 + 1], rgba[i * 4 + 2]);
+    sum[p] = (sum[p] || 0) + l;
+    n[p] = (n[p] || 0) + 1;
+  }
+  const targets = {};
+  for (const p of PARTS) {
+    if (!n[p]) continue;
+    if (!/^[0-9a-f]{6}$/i.test(colours[p] || "")) throw new Error(`no ${p} colour`);
+    targets[p] = hsl(...channels(colours[p]));
+  }
+  const out = Buffer.from(rgba);
+  const memo = new Map();
+  for (let i = 0; i < parts.length; i++) {
+    const p = parts[i];
+    if (!PARTS.includes(p)) continue;
+    const o = i * 4;
+    const key = p + rgba.subarray(o, o + 3).toString("hex");
+    let to = memo.get(key);
+    if (!to) {
+      const [th, ts, tl] = targets[p];
+      const [, , l] = hsl(rgba[o], rgba[o + 1], rgba[o + 2]);
+      to = rgbOf(th, ts, Math.min(0.94, Math.max(0.03, rampOf(l, sum[p] / n[p], tl))));
+      memo.set(key, to);
+    }
+    [out[o], out[o + 1], out[o + 2]] = to;
+  }
+  return { width: sheet.width, height: sheet.height, rgba: out, parts };
+}
+
+/** The employees as the page reads them, and their sheets: "char_<slot>" -> PNG bytes. */
+export function employees() {
+  const { employees: list } = JSON.parse(readFileSync(join(ART, "employees.json"), "utf8"));
+  const sprites = new Map();
+  const slots = new Set();
+  const people = list.map((e) => {
+    if (!Number.isInteger(e.slot) || e.slot < 12 || e.slot > 99 || slots.has(e.slot))
+      throw new Error(`${e.role}: slot must be a unique integer from 12 to 99`);
+    if (!Number.isInteger(e.base) || e.base < 0 || e.base > 5)
+      throw new Error(`${e.role}: base is a character sheet from 0 to 5`);
+    slots.add(e.slot);
+    const sheet = recolorSheet(decodePng(readFileSync(join(ASSETS, `char_${e.base}.png`))), e);
+    sprites.set(`char_${e.slot}`, encodePng(sheet.width, sheet.height, sheet.rgba));
+    return { role: e.role, name: e.name, agent: e.agent, tier: e.tier, slot: e.slot };
+  });
+  return { people, sprites };
+}
+
 /** One art file as a PNG; throws on a size line, row length or letter that does not fit. */
 export function renderArt(text, colors, name = "sprite") {
   const lines = text.replace(/\r/g, "").trimEnd().split("\n");
@@ -150,11 +418,13 @@ export function build() {
   const read = (f) => readFileSync(join(SRC, f), "utf8");
   const strings = JSON.parse(read("strings.json"));
   const sprites = atlas();
+  const staff = employees();
   const script = [
     '"use strict";',
     "(() => {",
     `const ATLAS = ${JSON.stringify(sprites)};`,
     `const STRINGS = ${JSON.stringify(strings)};`,
+    `const EMPLOYEES = ${JSON.stringify(staff.people)};`,
     'const spriteUrl = (name) => "/office/assets/" + name + ".png";',
     read("world.js").trim(),
     read("app.js").trim(),
@@ -166,6 +436,7 @@ export function build() {
   const hash = createHash("sha256").update(script).update(style).update(read("shell.html"));
   // Redrawn sprites change the page too, though no source text did.
   for (const [name, png] of artSprites()) hash.update(name).update(png);
+  for (const [name, png] of staff.sprites) hash.update(name).update(png);
   const build = hash.digest("hex").slice(0, 12);
   // Text that would close the inline element early, or open an HTML comment
   // inside it, turns source into markup.
@@ -181,7 +452,7 @@ export function build() {
 
 const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
 if (isMain) {
-  const art = artSprites();
+  const art = new Map([...artSprites(), ...employees().sprites]);
   const check = process.argv.includes("--check");
   if (!check) for (const [name, png] of art) writeFileSync(join(ASSETS, `${name}.png`), png);
   const html = build();