@mmerterden/multi-agent-pipeline 20.8.0 → 20.8.2

package/pipeline/scripts/gen-ref-toc.mjs

@@ -1,279 +0,0 @@
-#!/usr/bin/env node
-// gen-ref-toc.mjs  -  a table of contents on every long reference file.
-//
-// Anthropic's published Agent Skills guidance: "For reference files longer than
-// 100 lines, include a table of contents". The reason is the same one behind
-// the one-level-deep rule - an agent that reads a long file partially needs to
-// know from the top what is further down, and without that it answers from the
-// first screen and stops.
-//
-// Generated, never hand-written. Fifty-six files' worth of hand-maintained
-// contents lists would be wrong by the second edit, and a wrong ToC is worse
-// than none: it tells a reader a section exists where it does not.
-//
-// Section level is DERIVED, not assumed. These files are not consistent: some
-// open at `##` and section at `###` (keychain.md), others open at `###` and
-// section at `##` (phases/phase-2-dev.md). The rule is the shallowest heading
-// depth that occurs more than once - a depth used exactly once is a title, not
-// a section level.
-//
-// Not every long file is eligible, and the exclusion is measured rather than
-// preferred. A contents list helps a file that is OPENED AND SKIMMED. It is
-// pure cost on a file that is loaded whole by contract, because there is no
-// partial read for it to rescue - and those files are already at their limit:
-//
-//   the 8 phase docs   a ToC each puts 5 of 8 over their per-phase max and the
-//                      aggregate 1,533 tokens over 62,700
-//   rules.md           always loaded; 59,908 of a 60,000 byte ceiling, and a
-//                      ToC takes it to 60,997
-//   the analysis refs  mounted as one set per analysis run; 158,500 byte
-//                      ceiling, and the ToCs put them 2,298 over
-//
-// So the two published rules genuinely conflict there, and the ToC is the one
-// that loses: raising either ceiling to buy navigation nobody navigates is the
-// move this repo spent a release removing.
-//
-// The exclusion is DERIVED from those two budgets, never hand-listed. A
-// document entering or leaving a budget changes its ToC status by itself, which
-// is the difference between a rule and a list somebody has to remember.
-//
-// Usage:
-//   node gen-ref-toc.mjs            write/refresh every eligible file
-//   node gen-ref-toc.mjs --check    report drift, write nothing, exit 1 if any
-//   node gen-ref-toc.mjs --stats    byte cost, write nothing
-//   node gen-ref-toc.mjs --verify   every generated anchor resolves to a heading
-
-import { readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join, relative } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
-const REFS = join(ROOT, "pipeline", "multi-agent-refs");
-const MIN_LINES = 100;
-const MARK_OPEN = "<!-- toc -->";
-const MARK_CLOSE = "<!-- /toc -->";
-
-// Every file that some other gate already holds to a byte or token ceiling.
-function budgeted() {
-  const out = new Set();
-  const budget = JSON.parse(readFileSync(join(ROOT, "pipeline/schemas/token-budget.json"), "utf8"));
-  for (const phase of Object.keys(budget.phases)) {
-    out.add(join(REFS, "phases", `${phase}.md`));
-  }
-  // The always-loaded set, read out of the gate that owns it rather than copied.
-  const ctx = readFileSync(join(ROOT, "pipeline/scripts/smoke-context-budget.sh"), "utf8");
-  const block = ctx.match(/TRACKED="\n([\s\S]*?)"/);
-  if (block) {
-    for (const line of block[1].split("\n")) {
-      const t = line.trim();
-      if (t) out.add(join(ROOT, t));
-    }
-  }
-
-  // The analysis set, mounted whole per analysis run under its own ceiling. Same
-  // two globs that gate uses - `analysis/<name>.md` named by the analysis
-  // command, plus every analysis-template*.md.
-  const cmd = readFileSync(join(ROOT, "pipeline/commands/multi-agent/analysis/SKILL.md"), "utf8");
-  for (const m of cmd.matchAll(/analysis\/[a-z-]+\.md/g)) out.add(join(REFS, m[0]));
-  for (const e of readdirSync(REFS, { withFileTypes: true })) {
-    if (e.isFile() && /^analysis-template.*\.md$/.test(e.name)) out.add(join(REFS, e.name));
-  }
-  return out;
-}
-
-function walk(dir, out = []) {
-  for (const e of readdirSync(dir, { withFileTypes: true })) {
-    const p = join(dir, e.name);
-    if (e.isDirectory()) walk(p, out);
-    else if (e.name.endsWith(".md")) out.push(p);
-  }
-  return out;
-}
-
-// GitHub's anchor rule, which is what a `](#...)` link resolves against.
-function slug(text) {
-  return text
-    .toLowerCase()
-    .replace(/`/g, "")
-    .replace(/\[([^\]]*)\]\([^)]*\)/g, "$1")
-    .replace(/[^\w\s-]/g, "")
-    .trim()
-    .replace(/\s+/g, "-");
-}
-
-function sections(lines) {
-  const heads = [];
-  let fenced = false;
-  lines.forEach((l, i) => {
-    if (/^\s*```/.test(l)) fenced = !fenced;
-    if (fenced) return;
-    const m = l.match(/^(#{1,6})\s+(.*\S)\s*$/);
-    if (m) heads.push({ depth: m[1].length, text: m[2], line: i });
-  });
-  if (!heads.length) return { level: 0, heads: [] };
-  const counts = {};
-  for (const h of heads) counts[h.depth] = (counts[h.depth] || 0) + 1;
-  const depths = Object.keys(counts)
-    .map(Number)
-    .sort((a, b) => a - b);
-  // The shallowest depth used more than once. A depth used exactly once is the
-  // document's title and listing it as the only entry is a ToC of one.
-  const level = depths.find((d) => counts[d] > 1) ?? depths[depths.length - 1];
-  return { level, heads: heads.filter((h) => h.depth === level) };
-}
-
-function render(heads) {
-  const seen = new Map();
-  const rows = heads.map((h) => {
-    let a = slug(h.text);
-    const n = (seen.get(a) || 0) + 1;
-    seen.set(a, n);
-    if (n > 1) a = `${a}-${n - 1}`;
-    return `- [${h.text.replace(/\|/g, "\\|")}](#${a})`;
-  });
-  return [MARK_OPEN, ...rows, MARK_CLOSE].join("\n");
-}
-
-// After the frontmatter and after the first heading, so the reader sees what the
-// file IS before a list of what is in it.
-function insertionPoint(lines) {
-  let i = 0;
-  if (lines[0] === "---") {
-    i = 1;
-    while (i < lines.length && lines[i] !== "---") i += 1;
-    i += 1;
-  }
-  for (let j = i; j < lines.length; j += 1) {
-    if (/^#{1,6}\s/.test(lines[j])) return j + 1;
-  }
-  return i;
-}
-
-const BUDGETED = budgeted();
-const excluded = [];
-const files = walk(REFS)
-  .filter((f) => readFileSync(f, "utf8").split("\n").length - 1 > MIN_LINES)
-  .filter((f) => {
-    if (!BUDGETED.has(f)) return true;
-    excluded.push(relative(ROOT, f));
-    return false;
-  })
-  .sort();
-
-// Does every `](#anchor)` in a generated block name a heading that exists in the
-// same file? --check cannot answer that: it compares the file against THIS
-// script's output, so a wrong slug rule agrees with itself. This validates the
-// rule against the real headings instead, and it lives here so there is one
-// definition of `slug`, not a second copy inside a gate.
-if (process.argv.includes("--verify")) {
-  let total = 0;
-  const bad = [];
-  for (const f of walk(REFS)) {
-    const raw = readFileSync(f, "utf8");
-    if (!raw.includes(MARK_OPEN)) continue;
-    const lines = raw.split("\n");
-    const seen = new Map();
-    const anchors = new Set();
-    let fenced = false;
-    for (const l of lines) {
-      if (/^\s*```/.test(l)) fenced = !fenced;
-      if (fenced) continue;
-      const m = l.match(/^#{1,6}\s+(.*\S)\s*$/);
-      if (!m) continue;
-      let a = slug(m[1]);
-      const n = (seen.get(a) || 0) + 1;
-      seen.set(a, n);
-      if (n > 1) a = `${a}-${n - 1}`;
-      anchors.add(a);
-    }
-    const s0 = lines.indexOf(MARK_OPEN);
-    const e0 = lines.indexOf(MARK_CLOSE, s0);
-    for (const l of lines.slice(s0 + 1, e0)) {
-      const m = l.match(/\]\(#(.+)\)\s*$/);
-      if (!m) continue;
-      total += 1;
-      if (!anchors.has(m[1])) bad.push(`${relative(ROOT, f)} -> #${m[1]}`);
-    }
-  }
-  if (total === 0) {
-    console.log("gen-ref-toc: no anchors found at all - the generator produced nothing");
-    process.exit(1);
-  }
-  if (bad.length) {
-    console.log(`gen-ref-toc: ${bad.length} of ${total} anchor(s) point at no heading:`);
-    for (const b of bad.slice(0, 10)) console.log(`  ${b}`);
-    process.exit(1);
-  }
-  console.log(`gen-ref-toc: ${total} anchors, all resolve to a heading in their own file`);
-  process.exit(0);
-}
-
-const mode = process.argv.includes("--check")
-  ? "check"
-  : process.argv.includes("--stats")
-    ? "stats"
-    : "write";
-
-const drifted = [];
-const skipped = [];
-let added = 0;
-
-for (const f of files) {
-  const raw = readFileSync(f, "utf8");
-  const rel = relative(ROOT, f);
-  const lines = raw.split("\n");
-  const { heads } = sections(lines);
-  // Fewer than three sections is a file that does not need a map of itself.
-  if (heads.length < 3) {
-    skipped.push(`${rel} (${heads.length} section(s))`);
-    continue;
-  }
-  const block = render(heads);
-
-  const start = lines.indexOf(MARK_OPEN);
-  let next;
-  if (start !== -1) {
-    const end = lines.indexOf(MARK_CLOSE, start);
-    if (end === -1) {
-      drifted.push(`${rel}: ${MARK_OPEN} with no ${MARK_CLOSE}`);
-      continue;
-    }
-    const current = lines.slice(start, end + 1).join("\n");
-    if (current === block) continue;
-    next = [...lines.slice(0, start), ...block.split("\n"), ...lines.slice(end + 1)];
-    drifted.push(`${rel}: contents no longer match the headings`);
-  } else {
-    const at = insertionPoint(lines);
-    next = [...lines.slice(0, at), "", ...block.split("\n"), ...lines.slice(at)];
-    drifted.push(`${rel}: no table of contents`);
-  }
-  const out = next.join("\n");
-  added += out.length - raw.length;
-  if (mode === "write") writeFileSync(f, out);
-}
-
-if (mode === "stats") {
-  console.log(`eligible: ${files.length} ref files over ${MIN_LINES} lines`);
-  console.log(`excluded as loaded-whole-by-contract: ${excluded.length}`);
-  console.log(`skipped (under 3 sections): ${skipped.length}`);
-  console.log(
-    `would add: ${added} bytes total, ~${Math.round(added / 4)} tokens if every one were read`,
-  );
-  process.exit(0);
-}
-
-if (mode === "check") {
-  if (drifted.length === 0) {
-    console.log(`gen-ref-toc: ${files.length} long ref(s) carry a current table of contents`);
-    process.exit(0);
-  }
-  console.log(
-    `gen-ref-toc: ${drifted.length} file(s) need \`node pipeline/scripts/gen-ref-toc.mjs\`:`,
-  );
-  for (const d of drifted) console.log(`  ${d}`);
-  process.exit(1);
-}
-
-console.log(
-  `gen-ref-toc: ${drifted.length} file(s) updated, ${skipped.length} skipped, ${added} bytes added`,
-);

package/pipeline/scripts/make-manifest.mjs

@@ -1,199 +0,0 @@
-#!/usr/bin/env node
-/**
- * make-manifest.mjs  -  a digest of everything the package ships.
- *
- * "Is my install the one that was published, or has something edited it" is a
- * question this tree could not answer. The install is a COPY: `install.js`
- * writes into ~/.claude, ~/.copilot and ~/.codex, and from that moment the two
- * halves drift independently. An edit made in the installed copy looks like a
- * feature nobody can find the source of; a file the installer failed to write
- * looks like a bug in a script that was never there.
- *
- * The manifest turns both into one command. It records a SHA-256 for every
- * file the package ships, the version, and the commit it was built from, and
- * `multi-agent-pipeline verify` compares an installed tree against it, file by
- * file.
- *
- * The file set is not guessed: it comes from `npm pack --dry-run --json`, so
- * it is by construction the same set npm will publish, `files` globs and all.
- * `--ignore-scripts` is on the inner call because this script runs FROM
- * prepack, and without it npm would run prepack again.
- *
- * Two things the manifest cannot cover, said here rather than discovered later:
- * it cannot hash itself (it does not exist when the list is taken), and a
- * signature over it does not authenticate the tarball - the verifier and the
- * public key travel inside the same tarball, so anyone able to rewrite one can
- * rewrite the others. What a signature DOES catch is a manifest damaged in
- * transit or edited after install, which is the failure this file exists for.
- * Provenance belongs to npm's own integrity field, not to us.
- *
- * Usage:
- *   make-manifest.mjs              write manifest.json at the repo root
- *   make-manifest.mjs --sign       also write manifest.sig (needs a signing key)
- *   make-manifest.mjs --check      recompute and report drift, write nothing
- *   make-manifest.mjs --json
- *
- * Exit codes:
- *   0  written, or --check found no drift
- *   1  --check found drift
- *   2  usage or environment error
- */
-
-import { execFileSync } from "node:child_process";
-import { createHash, createPrivateKey, sign as cryptoSign } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { runMain } from "../lib/fatal.mjs";
-
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
-const MANIFEST = join(ROOT, "manifest.json");
-
-const argv = process.argv.slice(2);
-const has = (f) => argv.includes(f);
-
-/** The exact set npm would publish, in npm's own words. */
-function shippedFiles() {
-  const out = execFileSync("npm", ["pack", "--dry-run", "--json", "--ignore-scripts"], {
-    cwd: ROOT,
-    encoding: "utf-8",
-    maxBuffer: 64 * 1024 * 1024,
-    stdio: ["ignore", "pipe", "ignore"],
-  });
-  const parsed = JSON.parse(out);
-  const files = parsed?.[0]?.files;
-  if (!Array.isArray(files) || !files.length) {
-    throw new Error("npm pack --dry-run returned no file list");
-  }
-  return files
-    .map((f) => f.path)
-    .filter((p) => p !== "manifest.json" && p !== "manifest.sig")
-    .sort();
-}
-
-function sha256(path) {
-  return createHash("sha256").update(readFileSync(path)).digest("hex");
-}
-
-function gitCommit() {
-  try {
-    return execFileSync("git", ["rev-parse", "HEAD"], {
-      cwd: ROOT,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
-  } catch {
-    // A tarball unpacked outside a checkout has no git. The manifest is still
-    // valid; only the provenance line is unknown, and saying so beats writing
-    // a placeholder that reads like a real commit.
-    return null;
-  }
-}
-
-function build() {
-  const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf-8"));
-  const files = {};
-  for (const rel of shippedFiles()) {
-    const abs = join(ROOT, rel);
-    if (!existsSync(abs)) continue;
-    files[rel] = sha256(abs);
-  }
-  return {
-    name: pkg.name,
-    version: pkg.version,
-    commit: gitCommit(),
-    generatedAt: new Date().toISOString(),
-    algorithm: "sha256",
-    fileCount: Object.keys(files).length,
-    files,
-  };
-}
-
-/**
- * Sign the manifest with an ed25519 key. Optional, and silent about its absence
- * on the common path: a package with no signature still verifies on hashes
- * alone, which is the property that actually gets used.
- *
- * The key is read through the credential store, never taken from argv and never
- * printed. MULTI_AGENT_SIGNING_KEY is the fallback for a build host that has no
- * store (CI), and it holds the PEM itself.
- *
- * @param {string} manifestJson exact bytes that were written to disk
- * @returns {string|null} base64 signature, or null when no key is configured
- */
-function sign(manifestJson) {
-  let pem = process.env.MULTI_AGENT_SIGNING_KEY || "";
-  if (!pem) {
-    try {
-      pem = execFileSync(
-        join(ROOT, "pipeline", "lib", "credential-store.sh"),
-        ["get", "pipeline_signing"],
-        {
-          encoding: "utf-8",
-          stdio: ["ignore", "pipe", "ignore"],
-        },
-      ).trim();
-    } catch {
-      pem = "";
-    }
-  }
-  if (!pem) {
-    process.stderr.write(
-      "make-manifest: no signing key configured - manifest written unsigned (hashes still verify)\n",
-    );
-    return null;
-  }
-  const privateKey = createPrivateKey(pem);
-  return cryptoSign(null, Buffer.from(manifestJson), privateKey).toString("base64");
-}
-
-function main() {
-  if (has("--check")) {
-    if (!existsSync(MANIFEST)) {
-      process.stderr.write("make-manifest: no manifest.json to check\n");
-      process.exit(2);
-    }
-    const stored = JSON.parse(readFileSync(MANIFEST, "utf-8"));
-    const fresh = build();
-    const changed = [];
-    for (const [rel, hash] of Object.entries(fresh.files)) {
-      if (stored.files[rel] !== hash) changed.push(rel);
-    }
-    const gone = Object.keys(stored.files).filter((r) => !(r in fresh.files));
-    const report = { changed, gone, stale: changed.length + gone.length > 0 };
-    if (has("--json")) process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
-    else if (!report.stale)
-      process.stdout.write(`manifest.json is current (${fresh.fileCount} files)\n`);
-    else {
-      process.stdout.write(
-        `manifest.json is stale: ${changed.length} changed, ${gone.length} gone\n`,
-      );
-      for (const r of [...changed, ...gone].slice(0, 20)) process.stdout.write(`  ${r}\n`);
-    }
-    process.exitCode = report.stale ? 1 : 0;
-    return;
-  }
-
-  const manifest = build();
-  const json = `${JSON.stringify(manifest, null, 2)}\n`;
-  writeFileSync(MANIFEST, json);
-  if (has("--sign")) {
-    const sig = sign(json);
-    if (sig) writeFileSync(join(ROOT, "manifest.sig"), `${sig}\n`);
-  }
-  if (has("--json"))
-    process.stdout.write(
-      `${JSON.stringify({ written: MANIFEST, ...manifest, files: undefined }, null, 2)}\n`,
-    );
-  else
-    // STDERR, not stdout. This runs as `prepack`, and npm passes a prepack
-    // script's stdout straight through - so one friendly line here lands INSIDE
-    // `npm pack --dry-run --json` and every consumer that parses that JSON
-    // fails with "Unexpected token 'm'". Two gates caught it within minutes;
-    // a publish would not have.
-    process.stderr.write(
-      `manifest.json: ${manifest.fileCount} files, version ${manifest.version}, commit ${manifest.commit?.slice(0, 12) ?? "unknown"}\n`,
-    );
-}
-
-runMain("make-manifest", main);

package/pipeline/scripts/scorecard-snapshot.mjs

@@ -1,178 +0,0 @@
-#!/usr/bin/env node
-/**
- * scorecard-snapshot.mjs  -  keep what the scorecard said, and say what moved.
- *
- * The scorecard answers "does every mechanical claim hold right now". It
- * cannot answer "is this better or worse than last week", and that second
- * question is the one that catches slow rot: a metric that has been failing
- * for a month reads identically to one that broke an hour ago.
- *
- * WHAT THIS DELIBERATELY DOES NOT DO: collapse the result into a 0-100 score.
- * ruflo's scorecard does, and the discipline worth taking from it is
- * "measurable and comparable over time", not the number. The scorecard already
- * reports twelve measured metrics AND four it refuses to measure - a single
- * figure would hide both halves, and an unmeasured category would silently
- * count as zero or as full marks depending on an arithmetic choice nobody
- * would ever read. A diff keeps every metric answering for itself.
- *
- * Snapshots live in ~/.claude/state/scorecard/<iso>.json and are never pruned
- * by this script: they are small, and a history that deletes itself cannot
- * answer the question it was kept for.
- *
- * Usage:
- *   scorecard-snapshot.mjs --save             run the scorecard, store a snapshot
- *   scorecard-snapshot.mjs --diff             latest vs the one before it
- *   scorecard-snapshot.mjs --diff a.json b.json   two snapshots by path
- *   scorecard-snapshot.mjs --list             what is stored
- *
- * Exit codes:
- *   0  -  nothing regressed (or a save succeeded)
- *   1  -  at least one metric that used to pass now fails
- *   2  -  usage error, or not enough snapshots to compare
- */
-
-import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { runMain } from "../lib/fatal.mjs";
-
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
-const STORE = process.env.SCORECARD_STORE || join(homedir(), ".claude", "state", "scorecard");
-
-/** Metric identity. Category plus metric name, because neither is unique alone. */
-const keyOf = (r) => `${r.category} :: ${r.metric}`;
-
-function runScorecard() {
-  // `--json` prints the report on stdout; a failing metric is a non-zero exit
-  // and is exactly the case worth snapshotting, so the status is captured
-  // rather than thrown.
-  try {
-    return JSON.parse(
-      execFileSync("node", ["pipeline/scripts/scorecard.mjs", "--json"], {
-        cwd: ROOT,
-        encoding: "utf-8",
-        maxBuffer: 32 * 1024 * 1024,
-      }),
-    );
-  } catch (err) {
-    const out = err?.stdout;
-    if (typeof out === "string" && out.trim().startsWith("{")) return JSON.parse(out);
-    throw new Error(`scorecard did not produce JSON: ${err?.message ?? err}`, { cause: err });
-  }
-}
-
-function snapshots() {
-  if (!existsSync(STORE)) return [];
-  return (
-    readdirSync(STORE)
-      .filter((f) => f.endsWith(".json"))
-      // ISO-8601 sorts lexically in time order, which is the whole reason the
-      // file is named after the timestamp rather than a counter.
-      .sort()
-      .map((f) => join(STORE, f))
-  );
-}
-
-function save() {
-  const report = runScorecard();
-  mkdirSync(STORE, { recursive: true });
-  const at = new Date().toISOString().replace(/[:.]/g, "-");
-  const path = join(STORE, `${at}.json`);
-  writeFileSync(path, JSON.stringify({ at: new Date().toISOString(), ...report }, null, 2) + "\n");
-  process.stdout.write(`scorecard snapshot: ${path}\n`);
-  process.stdout.write(`  ${report.passed} passed, ${report.failed} failed\n`);
-  return 0;
-}
-
-function diff(aPath, bPath) {
-  const a = JSON.parse(readFileSync(aPath, "utf-8"));
-  const b = JSON.parse(readFileSync(bPath, "utf-8"));
-  // UNMEASURED rows carry no `ok` at all - they are the categories the
-  // scorecard refuses to score. Comparing verdicts across them would invent
-  // one, which is the thing that section exists to avoid.
-  const measured = (rs) => (rs || []).filter((r) => r.kind !== "UNMEASURED");
-  const ma = new Map(measured(a.results).map((r) => [keyOf(r), r]));
-  const mb = new Map(measured(b.results).map((r) => [keyOf(r), r]));
-
-  const regressed = [];
-  const fixed = [];
-  const added = [];
-  const removed = [];
-  const changed = [];
-
-  for (const [k, rb] of mb) {
-    const ra = ma.get(k);
-    if (!ra) {
-      added.push(rb);
-      continue;
-    }
-    if (ra.ok && !rb.ok) regressed.push({ k, ra, rb });
-    else if (!ra.ok && rb.ok) fixed.push({ k, ra, rb });
-    // A metric whose verdict held but whose DETAIL moved is the early warning:
-    // coverage sliding from 72 to 69 passes the floor and is still the thing
-    // that will fail next month.
-    else if (ra.detail !== rb.detail) changed.push({ k, ra, rb });
-  }
-  for (const [k, ra] of ma) if (!mb.has(k)) removed.push({ k, ra });
-
-  const out = [];
-  out.push(`scorecard diff  -  ${a.at ?? aPath} → ${b.at ?? bPath}`);
-  out.push(`  ${a.passed}/${a.passed + a.failed} → ${b.passed}/${b.passed + b.failed} passing`);
-  const section = (title, rows, fmt) => {
-    if (!rows.length) return;
-    out.push("");
-    out.push(`${title} (${rows.length})`);
-    for (const r of rows) out.push(`  ${fmt(r)}`);
-  };
-  section("REGRESSED", regressed, ({ k, rb }) => `${k}\n      now: ${rb.detail ?? "(no detail)"}`);
-  section("FIXED", fixed, ({ k, rb }) => `${k}\n      now: ${rb.detail ?? "(no detail)"}`);
-  section("NEW METRIC", added, (r) => `${keyOf(r)} ${r.ok ? "passing" : "FAILING"}`);
-  section("METRIC GONE", removed, ({ k }) => `${k}  -  no longer measured`);
-  section(
-    "SAME VERDICT, DIFFERENT NUMBERS",
-    changed,
-    ({ k, ra, rb }) =>
-      `${k}\n      was: ${ra.detail ?? "(none)"}\n      now: ${rb.detail ?? "(none)"}`,
-  );
-
-  if (!regressed.length && !fixed.length && !added.length && !removed.length && !changed.length) {
-    out.push("");
-    out.push("  nothing moved");
-  }
-  process.stdout.write(out.join("\n") + "\n");
-  return regressed.length ? 1 : 0;
-}
-
-function main() {
-  const args = process.argv.slice(2);
-  if (args.includes("--save")) return save();
-  if (args.includes("--list")) {
-    const s = snapshots();
-    process.stdout.write(s.length ? s.join("\n") + "\n" : `no snapshots under ${STORE}\n`);
-    return 0;
-  }
-  if (args.includes("--diff")) {
-    const paths = args.filter((a) => !a.startsWith("--"));
-    if (paths.length === 2) return diff(paths[0], paths[1]);
-    const s = snapshots();
-    if (s.length < 2) {
-      process.stderr.write(
-        `need two snapshots to compare, found ${s.length} under ${STORE}\n` +
-          `  take one with: node pipeline/scripts/scorecard-snapshot.mjs --save\n`,
-      );
-      return 2;
-    }
-    return diff(s[s.length - 2], s[s.length - 1]);
-  }
-  process.stderr.write("usage: scorecard-snapshot.mjs --save | --diff [a.json b.json] | --list\n");
-  return 2;
-}
-
-// `process.exitCode`, never `process.exit()`: stdout to a pipe is asynchronous
-// and exit() discards whatever has not drained, which truncated two scripts in
-// this repo at a buffer boundary and only ever when piped.
-runMain("scorecard-snapshot", () => {
-  process.exitCode = main();
-});