@rigour-labs/core 6.6.6 → 6.7.1

package/dist/services/adaptive-thresholds.js

@@ -1,17 +1,6 @@
 /**
- * Adaptive Thresholds Service (v2)
- *
- * Dynamically adjusts quality gate thresholds based on:
- * - Project maturity (age, commit count, file count)
- * - Historical failure rates with Z-score anomaly detection
- * - Complexity tier (hobby/startup/enterprise)
- * - Per-provenance trend analysis (ai-drift, structural, security separate)
- *
- * v2 upgrades:
- * - Z-score replaces naive delta comparison for trend detection
- * - Per-provenance failure tracking (AI drift vs structural vs security)
- * - Statistical anomaly detection normalizes across project sizes
- *
+ * Quality history: every gate run's failures by provenance, kept in .rigour/adaptive-history.json, and the
+ * trends read from it (Z-score of recent runs against the earlier baseline), overall and per provenance.
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -182,123 +171,6 @@ export function getProvenanceTrends(cwd) {
         securityZScore: security.z,
     };
 }
-/**
- * Detect project complexity tier based on metrics
- */
-export function detectComplexityTier(metrics) {
-    // Enterprise: Large teams, many files, mature codebase
-    if (metrics.fileCount > 500 || (metrics.commitCount && metrics.commitCount > 1000)) {
-        return 'enterprise';
-    }
-    // Startup: Growing codebase, active development
-    if (metrics.fileCount > 50 || (metrics.commitCount && metrics.commitCount > 100)) {
-        return 'startup';
-    }
-    // Hobby: Small projects, early stage
-    return 'hobby';
-}
-/**
- * Calculate adaptive thresholds based on project state.
- * v5: Uses Z-score trending and per-provenance analysis.
- */
-export function calculateAdaptiveThresholds(cwd, metrics, config = {}) {
-    const reasoning = [];
-    // Determine tier
-    const tier = config.forced_tier ??
-        (config.auto_detect_tier !== false ? detectComplexityTier(metrics) : 'startup');
-    reasoning.push(`Complexity tier: ${tier} (files: ${metrics.fileCount})`);
-    // Get overall trend (Z-score based)
-    const trend = getQualityTrend(cwd);
-    reasoning.push(`Quality trend: ${trend} (Z-score analysis)`);
-    // Get per-provenance trends
-    const provenanceTrends = getProvenanceTrends(cwd);
-    if (provenanceTrends.aiDrift !== 'stable') {
-        reasoning.push(`AI drift trend: ${provenanceTrends.aiDrift} (Z=${provenanceTrends.aiDriftZScore})`);
-    }
-    if (provenanceTrends.structural !== 'stable') {
-        reasoning.push(`Structural trend: ${provenanceTrends.structural} (Z=${provenanceTrends.structuralZScore})`);
-    }
-    if (provenanceTrends.security !== 'stable') {
-        reasoning.push(`Security trend: ${provenanceTrends.security} (Z=${provenanceTrends.securityZScore})`);
-    }
-    // Base thresholds
-    let coverageThreshold = config.base_coverage_threshold ?? 80;
-    let qualityThreshold = config.base_quality_threshold ?? 80;
-    let securityBlockLevel = 'high';
-    let leniencyFactor = 0.5;
-    // Adjust by tier
-    switch (tier) {
-        case 'hobby':
-            coverageThreshold = Math.max(50, coverageThreshold - 30);
-            qualityThreshold = Math.max(60, qualityThreshold - 20);
-            securityBlockLevel = 'critical';
-            leniencyFactor = 0.8;
-            reasoning.push('Hobby tier: relaxed thresholds, only critical security blocks');
-            break;
-        case 'startup':
-            coverageThreshold = Math.max(60, coverageThreshold - 15);
-            qualityThreshold = Math.max(70, qualityThreshold - 10);
-            securityBlockLevel = 'high';
-            leniencyFactor = 0.5;
-            reasoning.push('Startup tier: moderate thresholds, high+ security blocks');
-            break;
-        case 'enterprise':
-            coverageThreshold = coverageThreshold;
-            qualityThreshold = qualityThreshold;
-            securityBlockLevel = 'medium';
-            leniencyFactor = 0.2;
-            reasoning.push('Enterprise tier: strict thresholds, medium+ security blocks');
-            break;
-    }
-    // Adjust by overall trend
-    if (trend === 'improving') {
-        coverageThreshold = Math.max(50, coverageThreshold - 5);
-        qualityThreshold = Math.max(60, qualityThreshold - 5);
-        leniencyFactor = Math.min(1, leniencyFactor + 0.1);
-        reasoning.push('Improving trend: bonus threshold relaxation (+5%)');
-    }
-    else if (trend === 'degrading') {
-        coverageThreshold = Math.min(95, coverageThreshold + 5);
-        qualityThreshold = Math.min(95, qualityThreshold + 5);
-        leniencyFactor = Math.max(0, leniencyFactor - 0.1);
-        reasoning.push('Degrading trend: tightened thresholds (-5%)');
-    }
-    // v5: Per-provenance adjustments
-    // If AI drift is degrading but structural is stable, tighten AI-specific gates
-    if (provenanceTrends.aiDrift === 'degrading' && provenanceTrends.structural !== 'degrading') {
-        leniencyFactor = Math.max(0, leniencyFactor - 0.15);
-        reasoning.push('AI drift degrading while structural stable: AI is the problem, tightening AI gates');
-    }
-    // If security is degrading, escalate security block level
-    if (provenanceTrends.security === 'degrading') {
-        if (securityBlockLevel === 'critical')
-            securityBlockLevel = 'high';
-        else if (securityBlockLevel === 'high')
-            securityBlockLevel = 'medium';
-        reasoning.push(`Security trend degrading: escalated block level to ${securityBlockLevel}+`);
-    }
-    // Recent failure rate adjustment
-    if (metrics.recentFailureRate !== undefined) {
-        if (metrics.recentFailureRate > 50) {
-            leniencyFactor = Math.min(1, leniencyFactor + 0.2);
-            reasoning.push(`High failure rate (${metrics.recentFailureRate.toFixed(0)}%): increased leniency`);
-        }
-        else if (metrics.recentFailureRate < 10) {
-            leniencyFactor = Math.max(0, leniencyFactor - 0.1);
-            reasoning.push(`Low failure rate (${metrics.recentFailureRate.toFixed(0)}%): stricter enforcement`);
-        }
-    }
-    return {
-        tier,
-        trend,
-        coverageThreshold: Math.round(coverageThreshold),
-        qualityThreshold: Math.round(qualityThreshold),
-        securityBlockLevel,
-        leniencyFactor: Math.round(leniencyFactor * 100) / 100,
-        reasoning,
-        provenanceTrends,
-    };
-}
 /**
  * Clear adaptive history (for testing)
  */
@@ -309,20 +181,3 @@ export function clearAdaptiveHistory(cwd) {
         fs.unlinkSync(historyPath);
     }
 }
-/**
- * Get summary of adaptive thresholds for logging
- */
-export function getAdaptiveSummary(adjustments) {
-    let summary = `[${adjustments.tier.toUpperCase()}] ` +
-        `Coverage: ${adjustments.coverageThreshold}%, ` +
-        `Quality: ${adjustments.qualityThreshold}%, ` +
-        `Security: ${adjustments.securityBlockLevel}+, ` +
-        `Trend: ${adjustments.trend}`;
-    if (adjustments.provenanceTrends) {
-        const pt = adjustments.provenanceTrends;
-        if (pt.aiDrift !== 'stable' || pt.structural !== 'stable' || pt.security !== 'stable') {
-            summary += ` | AI:${pt.aiDrift}(Z=${pt.aiDriftZScore}) Struct:${pt.structural}(Z=${pt.structuralZScore}) Sec:${pt.security}(Z=${pt.securityZScore})`;
-        }
-    }
-    return summary;
-}

package/dist/services/adaptive-thresholds.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { detectComplexityTier, calculateAdaptiveThresholds, recordGateRun, getQualityTrend, clearAdaptiveHistory, getAdaptiveSummary, } from './adaptive-thresholds.js';
+import { recordGateRun, getQualityTrend, clearAdaptiveHistory, } from './adaptive-thresholds.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
@@ -12,49 +12,6 @@ describe('AdaptiveThresholds', () => {
         clearAdaptiveHistory(testDir);
         fs.rmSync(testDir, { recursive: true, force: true });
     });
-    describe('detectComplexityTier', () => {
-        it('should detect hobby tier for small projects', () => {
-            const tier = detectComplexityTier({ fileCount: 20 });
-            expect(tier).toBe('hobby');
-        });
-        it('should detect startup tier for medium projects', () => {
-            const tier = detectComplexityTier({ fileCount: 100 });
-            expect(tier).toBe('startup');
-        });
-        it('should detect enterprise tier for large projects', () => {
-            const tier = detectComplexityTier({ fileCount: 600 });
-            expect(tier).toBe('enterprise');
-        });
-        it('should consider commit count for tier detection', () => {
-            const tier = detectComplexityTier({ fileCount: 50, commitCount: 1500 });
-            expect(tier).toBe('enterprise');
-        });
-    });
-    describe('calculateAdaptiveThresholds', () => {
-        it('should return lenient thresholds for hobby tier', () => {
-            const adjustments = calculateAdaptiveThresholds(testDir, { fileCount: 20 });
-            expect(adjustments.tier).toBe('hobby');
-            expect(adjustments.coverageThreshold).toBeLessThan(80);
-            expect(adjustments.securityBlockLevel).toBe('critical');
-            expect(adjustments.leniencyFactor).toBeGreaterThan(0.5);
-        });
-        it('should return strict thresholds for enterprise tier', () => {
-            const adjustments = calculateAdaptiveThresholds(testDir, { fileCount: 600 });
-            expect(adjustments.tier).toBe('enterprise');
-            expect(adjustments.coverageThreshold).toBe(80);
-            expect(adjustments.securityBlockLevel).toBe('medium');
-            expect(adjustments.leniencyFactor).toBeLessThan(0.5);
-        });
-        it('should respect forced_tier config', () => {
-            const adjustments = calculateAdaptiveThresholds(testDir, { fileCount: 20 }, { forced_tier: 'enterprise' });
-            expect(adjustments.tier).toBe('enterprise');
-        });
-        it('should include reasoning for adjustments', () => {
-            const adjustments = calculateAdaptiveThresholds(testDir, { fileCount: 100 });
-            expect(adjustments.reasoning.length).toBeGreaterThan(0);
-            expect(adjustments.reasoning.some(r => r.includes('tier'))).toBe(true);
-        });
-    });
     describe('historical tracking', () => {
         it('should record gate runs', () => {
             recordGateRun(testDir, 5, 2, 10);
@@ -93,41 +50,4 @@ describe('AdaptiveThresholds', () => {
             expect(trend).toBe('degrading');
         });
     });
-    describe('trend-based adjustments', () => {
-        it('should relax thresholds for improving trend', () => {
-            // Baseline: 15 runs with high failures (with variance)
-            for (let i = 0; i < 15; i++) {
-                recordGateRun(testDir, 3, 5, 15 + (i % 5) * 3);
-            }
-            // Recent: 5 runs with very low failures
-            for (let i = 0; i < 5; i++) {
-                recordGateRun(testDir, 7, 0, 1);
-            }
-            const adjustments = calculateAdaptiveThresholds(testDir, { fileCount: 100 });
-            expect(adjustments.trend).toBe('improving');
-            expect(adjustments.reasoning.some(r => r.includes('bonus'))).toBe(true);
-        });
-        it('should tighten thresholds for degrading trend', () => {
-            // Baseline: 15 runs with low failures (with variance)
-            for (let i = 0; i < 15; i++) {
-                recordGateRun(testDir, 7, 1, 1 + (i % 3));
-            }
-            // Recent: 5 runs with high failures
-            for (let i = 0; i < 5; i++) {
-                recordGateRun(testDir, 3, 5, 25);
-            }
-            const adjustments = calculateAdaptiveThresholds(testDir, { fileCount: 100 });
-            expect(adjustments.trend).toBe('degrading');
-            expect(adjustments.reasoning.some(r => r.includes('tightened'))).toBe(true);
-        });
-    });
-    describe('getAdaptiveSummary', () => {
-        it('should return formatted summary string', () => {
-            const adjustments = calculateAdaptiveThresholds(testDir, { fileCount: 100 });
-            const summary = getAdaptiveSummary(adjustments);
-            expect(summary).toContain('STARTUP');
-            expect(summary).toContain('Coverage:');
-            expect(summary).toContain('Quality:');
-        });
-    });
 });

package/dist/settings.d.ts

@@ -18,8 +18,6 @@ export interface RigourSettings {
         defaultProvider?: string;
         defaultModel?: string;
         apiBaseUrl?: string;
-        maxTokens?: number;
-        temperature?: number;
     };
     agents?: {
         [agentName: string]: {
@@ -33,10 +31,24 @@ export interface RigourSettings {
         colorOutput?: boolean;
         verboseOutput?: boolean;
     };
+    reviewer?: UserReviewerSettings;
     cursor?: {
         apiKey?: string;
     };
 }
+/** What a person may set for their own reviewer runs. They cannot set a team floor (`required`). */
+export interface UserReviewerSettings {
+    enabled?: boolean;
+    mode?: 'single' | 'cross' | 'full';
+    panel?: boolean;
+    judges?: 2 | 3;
+    escalate?: 'always' | 'risk';
+    /** A lower cap for your own runs; never above the team's. */
+    max_runs_per_day?: number;
+    max_usd_per_day?: number;
+    reviewers?: string[];
+    models?: Record<string, string>;
+}
 /**
  * Resolved deep options from CLI flags merged with settings.json
  */
@@ -45,8 +57,6 @@ export interface ResolvedDeepOptions {
     provider?: string;
     apiBaseUrl?: string;
     modelName?: string;
-    maxTokens?: number;
-    temperature?: number;
 }
 /**
  * CLI options that may override settings
@@ -56,8 +66,6 @@ export interface CLIDeepOptions {
     provider?: string;
     apiBaseUrl?: string;
     modelName?: string;
-    maxTokens?: number;
-    temperature?: number;
 }
 /**
  * Get the settings file path: ~/.rigour/settings.json

package/dist/settings.js

@@ -102,12 +102,6 @@ export function resolveDeepOptions(cliOptions) {
     if (settings.deep?.apiBaseUrl) {
         result.apiBaseUrl = settings.deep.apiBaseUrl;
     }
-    if (settings.deep?.maxTokens) {
-        result.maxTokens = settings.deep.maxTokens;
-    }
-    if (settings.deep?.temperature) {
-        result.temperature = settings.deep.temperature;
-    }
     // 2. Apply provider selection (settings or default)
     let selectedProvider = settings.deep?.defaultProvider || 'anthropic';
     if (cliOptions.provider) {
@@ -141,12 +135,6 @@ export function resolveDeepOptions(cliOptions) {
     if (cliOptions.apiBaseUrl) {
         result.apiBaseUrl = cliOptions.apiBaseUrl;
     }
-    if (cliOptions.maxTokens) {
-        result.maxTokens = cliOptions.maxTokens;
-    }
-    if (cliOptions.temperature) {
-        result.temperature = cliOptions.temperature;
-    }
     return result;
 }
 /**

package/dist/storage/team-diagnostics.js

@@ -54,5 +54,5 @@ export async function diagnoseMissingMembership(pool) {
             + `cannot see its membership. Run \`rigour team init-schema\` with the administrator URL to add the read policies.`;
     }
     return 'This database role has no membership for the configured organization, team and actor. '
-        + 'Ask the administrator to add it (see docs/ENTERPRISE.md).';
+        + 'Ask the administrator to add it (see docs/TEAM_DATABASE.md).';
 }

package/dist/storage/team-schema.d.ts

@@ -3,4 +3,4 @@
  * (`rigour team init-schema`) adds anything missing, including the RLS
  * policies, without touching data.
  */
-export declare const TEAM_SCHEMA = "\nCREATE SCHEMA IF NOT EXISTS rigour;\nCREATE TABLE IF NOT EXISTS rigour.meta (\n    key TEXT PRIMARY KEY,\n    value TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS rigour.memberships (\n    db_role NAME NOT NULL,\n    organization_id TEXT NOT NULL,\n    team_id TEXT NOT NULL,\n    actor_id TEXT NOT NULL,\n    role TEXT NOT NULL CHECK (role IN ('member', 'sme', 'owner')),\n    PRIMARY KEY (db_role, team_id)\n);\nCREATE TABLE IF NOT EXISTS rigour.lessons (\n    id TEXT PRIMARY KEY,\n    organization_id TEXT NOT NULL,\n    team_id TEXT NOT NULL,\n    repository_id TEXT NOT NULL,\n    actor_id TEXT NOT NULL,\n    visibility TEXT NOT NULL CHECK (visibility IN ('personal', 'team')),\n    state TEXT NOT NULL CHECK (state IN ('candidate', 'validated', 'promoted', 'rejected', 'superseded')),\n    kind TEXT NOT NULL,\n    subject TEXT NOT NULL,\n    evidence_json JSONB NOT NULL,\n    confidence DOUBLE PRECISION NOT NULL,\n    source TEXT NOT NULL,\n    supersedes_id TEXT,\n    created_at BIGINT NOT NULL,\n    updated_at BIGINT NOT NULL\n);\nALTER TABLE rigour.lessons ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS lessons_read ON rigour.lessons;\nCREATE POLICY lessons_read ON rigour.lessons FOR SELECT USING (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lessons.organization_id\n          AND membership.team_id = lessons.team_id\n          AND ((lessons.visibility = 'team' AND lessons.state = 'promoted')\n               OR membership.actor_id = lessons.actor_id)\n    )\n);\nDROP POLICY IF EXISTS lessons_write ON rigour.lessons;\nCREATE POLICY lessons_write ON rigour.lessons FOR ALL USING (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lessons.organization_id\n          AND membership.team_id = lessons.team_id\n          AND membership.actor_id = lessons.actor_id\n          AND (lessons.visibility = 'personal' OR membership.role IN ('sme', 'owner'))\n    )\n) WITH CHECK (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lessons.organization_id\n          AND membership.team_id = lessons.team_id\n          AND membership.actor_id = lessons.actor_id\n          AND (lessons.visibility = 'personal' OR membership.role IN ('sme', 'owner'))\n    )\n);\n-- Row-level security on every team table. A host (for example Supabase's\n-- security advisor) may enable RLS on its own; without a policy each member\n-- login would then see no rows at all. Members read only their own\n-- membership rows (the lessons policies read memberships the same way), and\n-- meta holds only the schema version.\nALTER TABLE rigour.memberships ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS memberships_read_own ON rigour.memberships;\nCREATE POLICY memberships_read_own ON rigour.memberships FOR SELECT USING (db_role = current_user);\nALTER TABLE rigour.meta ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS meta_read ON rigour.meta;\nCREATE POLICY meta_read ON rigour.meta FOR SELECT USING (true);\nINSERT INTO rigour.meta (key, value) VALUES ('schema_version', '1')\nON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;\n";
+export declare const TEAM_SCHEMA = "\nCREATE SCHEMA IF NOT EXISTS rigour;\nCREATE TABLE IF NOT EXISTS rigour.meta (\n    key TEXT PRIMARY KEY,\n    value TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS rigour.memberships (\n    db_role NAME NOT NULL,\n    organization_id TEXT NOT NULL,\n    team_id TEXT NOT NULL,\n    actor_id TEXT NOT NULL,\n    role TEXT NOT NULL CHECK (role IN ('member', 'sme', 'owner')),\n    PRIMARY KEY (db_role, team_id)\n);\nCREATE TABLE IF NOT EXISTS rigour.lessons (\n    id TEXT PRIMARY KEY,\n    organization_id TEXT NOT NULL,\n    team_id TEXT NOT NULL,\n    repository_id TEXT NOT NULL,\n    actor_id TEXT NOT NULL,\n    visibility TEXT NOT NULL CHECK (visibility IN ('personal', 'team')),\n    state TEXT NOT NULL CHECK (state IN ('candidate', 'validated', 'promoted', 'rejected', 'superseded')),\n    kind TEXT NOT NULL,\n    subject TEXT NOT NULL,\n    evidence_json JSONB NOT NULL,\n    confidence DOUBLE PRECISION NOT NULL,\n    source TEXT NOT NULL,\n    supersedes_id TEXT,\n    created_at BIGINT NOT NULL,\n    updated_at BIGINT NOT NULL\n);\n-- Every sync reads a team's lessons changed since its last read.\nCREATE INDEX IF NOT EXISTS lessons_team_updated ON rigour.lessons (organization_id, team_id, updated_at);\nALTER TABLE rigour.lessons ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS lessons_read ON rigour.lessons;\nCREATE POLICY lessons_read ON rigour.lessons FOR SELECT USING (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lessons.organization_id\n          AND membership.team_id = lessons.team_id\n          AND ((lessons.visibility = 'team' AND lessons.state = 'promoted')\n               OR membership.actor_id = lessons.actor_id)\n    )\n);\nDROP POLICY IF EXISTS lessons_write ON rigour.lessons;\nCREATE POLICY lessons_write ON rigour.lessons FOR ALL USING (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lessons.organization_id\n          AND membership.team_id = lessons.team_id\n          AND membership.actor_id = lessons.actor_id\n          AND (lessons.visibility = 'personal' OR membership.role IN ('sme', 'owner'))\n    )\n) WITH CHECK (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lessons.organization_id\n          AND membership.team_id = lessons.team_id\n          AND membership.actor_id = lessons.actor_id\n          AND (lessons.visibility = 'personal' OR membership.role IN ('sme', 'owner'))\n    )\n);\n-- Row-level security on every team table. A host (for example Supabase's\n-- security advisor) may enable RLS on its own; without a policy each member\n-- login would then see no rows at all. Members read only their own\n-- membership rows (the lessons policies read memberships the same way), and\n-- meta holds only the schema version.\nALTER TABLE rigour.memberships ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS memberships_read_own ON rigour.memberships;\nCREATE POLICY memberships_read_own ON rigour.memberships FOR SELECT USING (db_role = current_user);\nALTER TABLE rigour.meta ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS meta_read ON rigour.meta;\nCREATE POLICY meta_read ON rigour.meta FOR SELECT USING (true);\nINSERT INTO rigour.meta (key, value) VALUES ('schema_version', '1')\nON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;\n";

package/dist/storage/team-schema.js

@@ -34,6 +34,8 @@ CREATE TABLE IF NOT EXISTS rigour.lessons (
     created_at BIGINT NOT NULL,
     updated_at BIGINT NOT NULL
 );
+-- Every sync reads a team's lessons changed since its last read.
+CREATE INDEX IF NOT EXISTS lessons_team_updated ON rigour.lessons (organization_id, team_id, updated_at);
 ALTER TABLE rigour.lessons ENABLE ROW LEVEL SECURITY;
 DROP POLICY IF EXISTS lessons_read ON rigour.lessons;
 CREATE POLICY lessons_read ON rigour.lessons FOR SELECT USING (

package/dist/storage/team-store.js

@@ -208,6 +208,13 @@ async function splitOutbox(db, queued, config) {
     }
     return { sendable, held };
 }
+/** How far before the last pull a sync reads again, for members whose clocks run behind. */
+const PULL_OVERLAP_MS = 15 * 60_000;
+/** Postgres refused the row itself: insufficient privilege (row-level security) or an integrity constraint (class 23). */
+function refusedRow(error) {
+    const code = error?.code;
+    return typeof code === 'string' && (code === '42501' || code.startsWith('23'));
+}
 export async function syncTeamOutbox(options = {}) {
     const config = await loadTeamConfiguration();
     if (!config?.databaseUrl)
@@ -263,14 +270,27 @@ export async function syncTeamOutbox(options = {}) {
                     synced++;
                 }
                 catch (error) {
-                    await db.run('UPDATE sync_outbox SET attempts = attempts + 1, last_error = ? WHERE id = ?', String(error instanceof Error ? error.message : error).slice(0, 1_000), item.id);
+                    const message = String(error instanceof Error ? error.message : error).slice(0, 1_000);
+                    // The database refused this one row (row-level security, a constraint): it will refuse it every time,
+                    // so it is set aside with the reason and the rest of the queue goes on. Anything else (the
+                    // connection, the server) stops the sync and the item is tried again next time.
+                    if (refusedRow(error)) {
+                        await db.run('UPDATE sync_outbox SET synced_at = ?, last_error = ? WHERE id = ?', Date.now(), `refused by the team database: ${message}`, item.id);
+                        continue;
+                    }
+                    await db.run('UPDATE sync_outbox SET attempts = attempts + 1, last_error = ? WHERE id = ?', message, item.id);
                     throw error;
                 }
             }
+            // Only what changed since the last pull, less a margin: updated_at comes from each member's clock, and
+            // re-reading a few minutes is harmless (the local write is an upsert) where a skewed clock would lose a lesson.
+            const mark = `team_pulled:${config.organizationId}/${config.teamId}/${config.actorId}`;
+            const last = Number((await db.get('SELECT value FROM meta WHERE key = ?', mark))?.value ?? 0);
             const remote = await pool.query(`SELECT * FROM rigour.lessons
                  WHERE team_id = $1 AND organization_id = $3
                    AND ((actor_id = $2) OR (visibility = 'team' AND state = 'promoted'))
-                 ORDER BY updated_at ASC`, [config.teamId, config.actorId, config.organizationId]);
+                   AND updated_at > $4
+                 ORDER BY updated_at ASC`, [config.teamId, config.actorId, config.organizationId, Math.max(0, last - PULL_OVERLAP_MS)]);
             for (const row of remote.rows) {
                 const evidence = typeof row.evidence_json === 'string' ? JSON.parse(row.evidence_json) : row.evidence_json;
                 await db.run(`INSERT INTO lessons (
@@ -283,8 +303,11 @@ export async function syncTeamOutbox(options = {}) {
                         updated_at=excluded.updated_at`, row.id, row.repository_id, row.actor_id, row.team_id, row.visibility, row.state, row.kind, row.subject, await encryptLocalPayload(evidence), row.confidence, row.source, row.supersedes_id, Number(row.created_at), Number(row.updated_at));
                 pulled++;
             }
-            if (pulled > 0)
+            if (pulled > 0) {
+                const newest = Math.max(last, ...remote.rows.map((row) => Number(row.updated_at)));
+                await db.run('INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value', mark, String(newest));
                 await db.run("DELETE FROM context_cache WHERE cache_type = 'semantic'");
+            }
         }
         finally {
             await pool.end();

package/dist/storage/team-sync-scope.test.js

@@ -1,11 +1,15 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 /** The outbox and repositories a machine holds, and what reached the team database. */
-const state = vi.hoisted(() => ({ outbox: [], repos: new Map(), sent: [] }));
+const state = vi.hoisted(() => ({ outbox: [], repos: new Map(), sent: [], refuse: new Set(), meta: new Map(), remote: [], since: [] }));
 vi.mock('./db.js', () => ({
     openDatabase: async () => ({
         all: async () => state.outbox.filter(o => o.synced_at == null),
-        get: async (_sql, id) => (state.repos.has(id) ? { canonical_uri: state.repos.get(id) } : undefined),
+        get: async (sql, id) => sql.includes('FROM meta')
+            ? (state.meta.has(id) ? { value: state.meta.get(id) } : undefined)
+            : (state.repos.has(id) ? { canonical_uri: state.repos.get(id) } : undefined),
         run: async (sql, ...p) => {
+            if (sql.startsWith('INSERT INTO meta'))
+                state.meta.set(p[0], p[1]);
             if (sql.startsWith('UPDATE sync_outbox SET synced_at')) {
                 const id = p.at(-1);
                 Object.assign(state.outbox.find(o => o.id === id) ?? {}, { synced_at: p[0], last_error: p.length === 3 ? p[1] : null });
@@ -20,9 +24,15 @@ vi.mock('pg', () => ({
     Pool: class {
         async query(sql, params) {
             if (sql.includes('INSERT INTO rigour.lessons')) {
+                if (state.refuse.has(params[0]))
+                    throw Object.assign(new Error('new row violates row-level security policy for table "lessons"'), { code: '42501' });
                 state.sent.push(params[0]);
                 return { rowCount: 1, rows: [] };
             }
+            if (sql.includes('FROM rigour.lessons')) {
+                state.since.push(params[3]);
+                return { rowCount: 0, rows: state.remote.filter(row => row.updated_at > params[3]) };
+            }
             return { rowCount: 1, rows: [] };
         }
         async end() { }
@@ -40,6 +50,10 @@ beforeEach(() => {
     delete process.env.RIGOUR_TEAM_SYNC_PERSONAL;
     state.outbox = [];
     state.sent = [];
+    state.refuse = new Set();
+    state.meta = new Map();
+    state.remote = [];
+    state.since = [];
     state.repos = new Map([['r-team', 'https://github.com/acme/web'], ['r-other', 'https://github.com/other-org/app']]);
     queue('l-team', 'r-team', 'team');
     queue('l-other', 'r-other', 'team');
@@ -60,6 +74,25 @@ describe('team sync scope', () => {
         expect(reasons['outbox-l-unknown']).toContain('repository unknown');
         expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0, withheld: 0 }); // never retried
     });
+    it('sets aside a lesson the database refuses and sends the rest of the queue', async () => {
+        state.outbox = [];
+        queue('l-refused', 'r-team', 'team'); // queued first: it must not hold back what comes after
+        queue('l-team', 'r-team', 'team');
+        state.refuse.add('l-refused');
+        expect(await syncTeamOutbox()).toMatchObject({ synced: 1 });
+        expect(state.sent).toEqual(['l-team']);
+        expect(state.outbox.find(o => o.id === 'outbox-l-refused').last_error).toContain('refused by the team database: new row violates row-level security');
+        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0 }); // not tried again
+    });
+    it('pulls only what changed since the last pull, re-reading a margin for slow clocks', async () => {
+        const lesson = (id, updated) => ({ id, repository_id: 'r-team', actor_id: 'dev-2', team_id: 'web', visibility: 'team', state: 'promoted', kind: 'k', subject: 's', evidence_json: {}, confidence: 1, source: 'x', supersedes_id: null, created_at: updated, updated_at: updated });
+        const HOUR = 3_600_000;
+        state.remote = [lesson('a', 10 * HOUR), lesson('b', 20 * HOUR)];
+        expect(await syncTeamOutbox()).toMatchObject({ pulled: 2 });
+        expect(state.since).toEqual([0]); // the first pull reads everything
+        expect(await syncTeamOutbox()).toMatchObject({ pulled: 1 }); // only b, inside the 15-minute margin
+        expect(state.since[1]).toBe(20 * HOUR - 15 * 60_000);
+    });
     it('sends nothing when the team lists no repositories', async () => {
         delete process.env.RIGOUR_TEAM_REPOSITORIES;
         expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0, withheld: 4 });

package/dist/telemetry/telemetry.d.ts

@@ -15,6 +15,9 @@ export interface TelemetryDeps {
 export declare function telemetryToken(env?: Env): string;
 export declare function readTelemetryState(home?: string): TelemetryState;
 export declare function setTelemetryEnabled(enabled: boolean, home?: string): TelemetryState;
+/** Opted out by the environment, whatever the stored answer. */
+/** The cross-tool opt-out (consoledonottrack.com): any value but "0" means no telemetry and no update check. */
+export declare function doNotTrack(env?: Env): boolean;
 export declare function isTelemetryEnabled(deps?: TelemetryDeps): boolean;
 /** Ask only once, only a person at a terminal, only when sending would be possible at all. */
 export declare function shouldAskTelemetry(isTty: boolean, deps?: TelemetryDeps): boolean;
@@ -24,5 +27,7 @@ export declare function countUsage(name: string, by?: number, deps?: TelemetryDe
 /** Send the day's counters as one `daily_usage` event once they are a day old, then start a new day. */
 export declare function flushDailyUsage(deps?: TelemetryDeps): Promise<boolean>;
 /** A duration as a coarse bucket, so timing never identifies a run. */
+/** A model run's cost as a coarse bucket: never the amount. */
+export declare function costBucket(usd: number | undefined): string | undefined;
 export declare function durationBucket(ms: number): string;
 export {};

package/dist/telemetry/telemetry.js

@@ -50,8 +50,12 @@ function isCi(env) {
     return CI_MARKERS.some(name => !!env[name]);
 }
 /** Opted out by the environment, whatever the stored answer. */
+/** The cross-tool opt-out (consoledonottrack.com): any value but "0" means no telemetry and no update check. */
+export function doNotTrack(env = process.env) {
+    return !!env.DO_NOT_TRACK && env.DO_NOT_TRACK !== '0';
+}
 function vetoed(env) {
-    return (!!env.DO_NOT_TRACK && env.DO_NOT_TRACK !== '0') || env.RIGOUR_TELEMETRY === '0' || !telemetryToken(env);
+    return doNotTrack(env) || env.RIGOUR_TELEMETRY === '0' || !telemetryToken(env);
 }
 export function isTelemetryEnabled(deps = {}) {
     const env = deps.env ?? process.env;
@@ -141,6 +145,12 @@ function writeJson(target, value) {
     fs.writeFileSync(target, JSON.stringify(value, null, 2) + '\n');
 }
 /** A duration as a coarse bucket, so timing never identifies a run. */
+/** A model run's cost as a coarse bucket: never the amount. */
+export function costBucket(usd) {
+    if (typeof usd !== 'number')
+        return undefined;
+    return usd < 0.1 ? '<$0.10' : usd < 0.5 ? '$0.10-0.50' : usd < 2 ? '$0.50-2' : '>$2';
+}
 export function durationBucket(ms) {
     if (ms < 1000)
         return '<1s';

package/dist/templates/paradigms.js

@@ -13,10 +13,6 @@ export const PARADIGM_TEMPLATES = [
                     complexity: 10,
                     max_methods: 10,
                     max_params: 5,
-                    max_nesting: 4,
-                    max_inheritance_depth: 3,
-                    max_class_dependencies: 5,
-                    max_function_lines: 60,
                 },
             },
         },
@@ -35,10 +31,6 @@ export const PARADIGM_TEMPLATES = [
                     complexity: 8,
                     max_methods: 15, // Functions, not classes
                     max_params: 4,
-                    max_nesting: 3,
-                    max_inheritance_depth: 3,
-                    max_class_dependencies: 5,
-                    max_function_lines: 40,
                 },
             },
         },

package/dist/templates/presets.d.ts

@@ -7,7 +7,6 @@ export interface Template {
         paradigm?: string;
         commands?: Record<string, unknown>;
         gates?: Partial<Gates>;
-        planned?: string[];
         ignore?: string[];
     };
 }