@rulemetric/local 0.11.0 → 0.12.0

package/dist/supabase/migrations/00087_cleanup_test_data_fix.sql

@@ -1,7 +1,7 @@
 -- Fix cleanup_stale_test_users: it failed nightly 2026-06-07..09 on
 -- projects_created_by_fkey because projects / project_instructions gained
 -- NO ACTION FKs to auth.users after 00062 was written. Also extend the
--- sweep to delete leaked smoke-test sessions — scripts/smoke-test.sh's
+-- sweep to delete leaked smoke-test sessions — scripts/verify/smoke-test.sh's
 -- hook-execution section creates sessions under the dev user
 -- (external_session_id '00000000-0000-4000-8000-…') that the teardown
 -- only closed, never deleted.

package/dist/supabase/migrations/00185_trial_throughput_settings.sql

@@ -0,0 +1,43 @@
+-- Randomised measurement gets a throughput dial.
+--
+-- ## The complaint, and what actually caused it
+--
+-- "One a day per project takes forever." Correct, and it was not the
+-- concurrency ceiling that caused it. Two constants in
+-- `routes/instruction-suggestions/loop.ts` compose badly:
+--
+--   TRIAL_MAX_CONCURRENT = 3   how many rules may be under measurement at once
+--   TRIAL_MAX_PER_RUN    = 1   how many NEW trials one cycle may start
+--
+-- The producer runs nightly, so `per run` is really `per night`. Starting from
+-- zero, a project needs THREE NIGHTS to reach a ceiling of three — the first
+-- two nights leave measurement capacity deliberately idle. That is pure
+-- latency: it buys no statistical protection, because the steady state it
+-- ramps toward is the same either way.
+--
+-- The ceiling is a real trade and stays put by default: every running
+-- experiment withholds its rule from ~half that project's sessions, so
+-- concurrency is context the agent does not get. The RAMP is not a trade at
+-- all. So the default for per-run rises to fill the ceiling in one cycle
+-- (3 nights -> 1), and both numbers become settings for anyone who wants to
+-- spend more context to answer more questions at once.
+--
+-- What this does NOT touch: GRADUATION_MIN_N (25 measured sessions per arm).
+-- Sessions are the scarce resource and that gate is what keeps a verdict from
+-- enshrining noise. Testing faster must mean asking more questions in
+-- parallel, never accepting thinner evidence for each.
+--
+-- NULL = use the shipped default, so an untouched account tracks changes to
+-- the default instead of freezing today's value at signup. Per-project
+-- overrides live in `projects.metadata.trialLimits` and win over these.
+-- Mirrors 00184's auto-accept budget settings exactly.
+
+ALTER TABLE public.profiles
+  ADD COLUMN IF NOT EXISTS trial_max_concurrent integer,
+  ADD COLUMN IF NOT EXISTS trial_max_per_run integer;
+
+COMMENT ON COLUMN public.profiles.trial_max_concurrent IS
+  'Account override for how many instruction experiments may run at once on one project. NULL = shipped default (3). Each running experiment withholds its rule from ~half that project''s sessions, so this is a context-vs-questions trade. Per-project override: projects.metadata.trialLimits.maxConcurrent.';
+
+COMMENT ON COLUMN public.profiles.trial_max_per_run IS
+  'Account override for how many NEW experiments one training cycle may start. NULL = shipped default (3, i.e. fill the concurrency ceiling in a single run). Raising this shortens ramp latency only; it cannot exceed the concurrency ceiling, which is what actually bounds context withholding. Per-project override: projects.metadata.trialLimits.maxPerRun.';

package/dist/supabase/migrations/00186_canonical_checkout_prefers_live.sql

@@ -0,0 +1,256 @@
+-- One authority for "which path is this project", and it may never be a dead one.
+--
+-- THE DEFECT (measured against production 2026-08-13).
+--
+-- Five call sites resolved a project's canonical checkout with the same
+-- hand-copied rule: `distinct on (project_id) ... order by is_worktree asc,
+-- last_seen desc`. Non-worktree first, most-recent second. `project_checkouts`
+-- for momento-mori holds three rows:
+--
+--   /Users/nickyeager/Code/agents/momento-mori                 is_worktree=TRUE   2026-08-10
+--   /Users/nickyeager/Code/agents/momento-mori/.worktrees/…    is_worktree=true   2026-05-04
+--   /Users/nickyeager/Code/agents/momento-mori/apps/cli        is_worktree=false  2026-05-01
+--
+-- Session ingest upserts `is_worktree` from each session's own metadata on
+-- every create (routes/sessions/ingest/create.ts), so ONE session that reported
+-- `isWorktree: true` while its projectPath was the repo root flipped the root's
+-- flag. `is_worktree ASC` then outranks recency absolutely, and the crown went
+-- to `apps/cli` — a path no session has rendered from since 2026-05-01.
+--
+-- Consequences, all silent, all of them looking like "nothing eligible":
+--
+--   * `regenerate_insights_jobs` analysed apps/cli every 6h from 2026-08-10
+--     onward — 136 completed jobs re-deriving the same May-era conclusions
+--     ("Across 13 CLI sessions…") while the repo they describe moved on.
+--   * The insights-authored suggestions those runs produce are filed under
+--     project_path=…/apps/cli, so `cron_auto_accept_suggestions` writes
+--     apps/cli/CLAUDE.md and reports `nothing-eligible` for the repo root
+--     every single night.
+--   * 00175 pinned trial nomination to this same rule. Its own comment
+--     diagnoses the apps/cli experiment as undead ("no session has rendered
+--     from apps/cli in months") and then adopts the rule that elects it.
+--
+-- tinyworlds is mis-routed identically, to `…/tinyworlds/src` (2026-05-04).
+--
+-- THE RULE. Recency outranks the worktree flag, but only when the gap is
+-- material: a path may not win if it is more than 30 days staler than the
+-- freshest path that project has. Stated against the project's OWN freshest
+-- path rather than against `now()`, so a project dormant for a year still
+-- resolves to the checkout it was last worked in instead of falling back to
+-- whichever dead sibling happens to carry is_worktree=false.
+--
+-- Within a staleness tier the original intent survives untouched: a real
+-- checkout beats a worktree, and the most recently seen breaks the tie.
+--
+-- This is a VIEW rather than a sixth copy of the ORDER BY on purpose. The
+-- rule has now been wrong in five places at once; the repo's own recorded
+-- lesson for two-copies drift (00177's comment) is that the copies disagree
+-- in the silent direction. TypeScript callers select from this view too.
+
+create or replace view public.project_canonical_checkouts as
+select distinct on (project_id)
+       project_id,
+       path,
+       is_worktree,
+       last_seen,
+       -- Exposed so callers can SAY the path is stale rather than silently
+       -- acting on it. /api/loop/status renders this; a canonical path that
+       -- has gone quiet while the project has not is how this defect hid.
+       (last_seen < freshest - interval '30 days') as is_stale,
+       freshest as project_last_seen
+  from (
+    select pc.project_id,
+           pc.path,
+           pc.is_worktree,
+           pc.last_seen,
+           max(pc.last_seen) over (partition by pc.project_id) as freshest
+      from public.project_checkouts pc
+     where pc.path is not null
+       and pc.path <> ''
+  ) q
+ order by project_id,
+          (last_seen < freshest - interval '30 days') asc,  -- live before stale
+          is_worktree asc,                                  -- checkout before worktree
+          last_seen desc;                                   -- then most recent
+
+comment on view public.project_canonical_checkouts is
+  'The single authority for a project''s canonical checkout path. Ranks live paths above ones more than 30 days staler than the project''s freshest, THEN non-worktree, THEN most-recently-seen. Replaces the hand-copied `order by is_worktree asc, last_seen desc` in regenerate_insights_jobs, enqueue_instruction_training, routes/insights/jobs.ts and routes/sessions/query.ts (x3), which elected a path dead since 2026-05-01 for momento-mori and tinyworlds because one session flipped the live root''s is_worktree flag. See 00186.';
+
+grant select on public.project_canonical_checkouts to authenticated, service_role;
+
+-- ── The insights producer ───────────────────────────────────────────────────
+-- Body unchanged from 00176 except that `canonical` now selects from the view.
+
+create or replace function public.regenerate_insights_jobs(
+  p_min_sessions integer default 3,
+  p_freshness_hours integer default 6
+)
+returns text
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_inserted int := 0;
+  v_skipped_fresh int := 0;
+  v_skipped_queued int := 0;
+  v_reclaimed int := 0;
+  v_id uuid;
+  r record;
+begin
+  for r in
+    with eligible as (
+      select s.user_id, s.project_id
+      from sessions s
+      where s.project_id is not null
+      group by s.user_id, s.project_id
+      having count(*) >= p_min_sessions
+    )
+    select e.user_id, e.project_id, c.path as project_path
+    from eligible e
+    join public.project_canonical_checkouts c on c.project_id = e.project_id
+    -- ACTIVITY since this project's last analysis — start, progress, or end.
+    where exists (
+      select 1 from sessions s2
+      where s2.user_id = e.user_id
+        and s2.project_id = e.project_id
+        and greatest(
+              s2.started_at,
+              coalesce(s2.ended_at, s2.started_at)
+            ) > coalesce(
+          (select max(j.completed_at)
+             from insights_jobs j
+            where j.user_id = e.user_id
+              and j.project_path = c.path
+              and j.status = 'completed'),
+          now() - interval '30 days'
+        )
+    )
+  loop
+    if exists (
+      select 1 from insights_jobs j
+      where j.user_id = r.user_id
+        and j.project_path = r.project_path
+        and j.status = 'completed'
+        and j.completed_at > now() - (p_freshness_hours || ' hours')::interval
+    ) then
+      v_skipped_fresh := v_skipped_fresh + 1;
+      continue;
+    end if;
+
+    update insights_jobs j
+    set status = 'failed',
+        completed_at = now(),
+        error = 'reclaimed by regenerate_insights_jobs: queued/in-flight >24h with no progress — worker likely died before any state write'
+    where j.user_id = r.user_id
+      and j.project_path = r.project_path
+      and j.status in ('pending', 'claimed', 'running')
+      and j.created_at < now() - interval '24 hours';
+    if found then
+      v_reclaimed := v_reclaimed + 1;
+    end if;
+
+    if exists (
+      select 1 from insights_jobs j
+      where j.user_id = r.user_id
+        and j.project_path = r.project_path
+        and j.status in ('pending', 'claimed', 'running')
+    ) then
+      v_skipped_queued := v_skipped_queued + 1;
+      continue;
+    end if;
+
+    v_id := gen_random_uuid();
+    insert into insights_jobs (id, user_id, project_id, status, project_path, task_kind, payload)
+    values (
+      v_id,
+      r.user_id,
+      r.project_id,
+      'pending',
+      r.project_path,
+      'process_insights',
+      jsonb_build_object('mirrorId', v_id, 'projectPath', r.project_path)
+    );
+    v_inserted := v_inserted + 1;
+  end loop;
+
+  return format(
+    'regenerated: %s inserted, %s skipped (fresh), %s skipped (queued), %s reclaimed (stale)',
+    v_inserted, v_skipped_fresh, v_skipped_queued, v_reclaimed
+  );
+end;
+$$;
+
+comment on function public.regenerate_insights_jobs(integer, integer) is
+  'Every-6h producer for process_insights. Enqueues one job per (user, project) with >= p_min_sessions sessions and activity since that project''s last completed analysis. As of 00186 the canonical path comes from public.project_canonical_checkouts, so the analysis can no longer be aimed at a checkout dead for months.';
+
+-- ── The training producer ───────────────────────────────────────────────────
+-- Body unchanged from 00175 except that `canonical` now selects from the view.
+-- The settle half stays ungated and per-path so off-canonical experiments
+-- retire rather than orphan.
+
+create or replace function public.enqueue_instruction_training(p_active_days integer default 7)
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with eligible as (
+    select s.user_id, s.project_path
+      from instruction_suggestions s
+      join public.project_canonical_checkouts c on c.path = s.project_path
+     where s.kind = 'add'
+       and s.accepted_at is null
+       and s.dismissed_at is null
+       and s.declined_at is null
+       and s.is_stale = false
+       and exists (
+         select 1 from sessions se
+          where se.project_id = c.project_id
+            and se.user_id = s.user_id
+            and se.started_at > now() - (p_active_days || ' days')::interval
+       )
+       and not exists (
+         select 1 from agent_jobs j
+          where j.task_kind = 'cron_instruction_training'
+            and j.status in ('pending', 'claimed', 'running')
+            and j.payload->>'projectPath' = s.project_path
+            and j.user_id = s.user_id
+       )
+     group by s.user_id, s.project_path
+
+    union
+
+    select e.user_id, e.project_path
+      from instruction_experiments e
+     where e.status = 'running'
+       and not exists (
+         select 1 from agent_jobs j
+          where j.task_kind = 'cron_instruction_training'
+            and j.status in ('pending', 'claimed', 'running')
+            and j.payload->>'projectPath' = e.project_path
+            and j.user_id = e.user_id
+       )
+     group by e.user_id, e.project_path
+  ),
+  ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_instruction_training',
+           'pending',
+           jsonb_build_object('projectPath', e.project_path),
+           'instruction-training:' || e.user_id::text || ':' || e.project_path
+      from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_instruction_training(integer) is
+  'Nightly producer for cron_instruction_training. The TRIAL half nominates only on a project''s canonical checkout path with a session inside p_active_days (default 7); SETTLE stays ungated and per-path so existing off-path experiments retire rather than orphan. As of 00186 canonical comes from public.project_canonical_checkouts — 00175 pinned this to a rule that elected the very apps/cli path its own comment describes as undead.';

package/dist/supabase/migrations/00187_recommendation_applications.sql

@@ -0,0 +1,32 @@
+create table public.recommendation_applications (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null references public.profiles(id) on delete cascade,
+  instruction_id uuid not null references public.instructions(id) on delete cascade,
+  project_id uuid references public.projects(id) on delete set null,
+  project_path text not null,
+  harness text not null check (harness in ('claude_code', 'codex', 'shared')),
+  target_path text not null,
+  status text not null default 'proposed' check (status in ('proposed', 'ready', 'applied', 'measuring', 'improved', 'inconclusive', 'harmful', 'rollback_ready', 'reverted', 'failed')),
+  apply_mode text not null check (apply_mode in ('auto', 'human')),
+  before_hash text,
+  applied_hash text,
+  applied_at timestamptz,
+  measurement_started_at timestamptz,
+  measurement_ended_at timestamptz,
+  verdict text check (verdict is null or verdict in ('improved', 'inconclusive', 'harmful')),
+  verdict_detail text,
+  reverted_at timestamptz,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (user_id, instruction_id, project_path, harness, target_path)
+);
+
+create index idx_recommendation_applications_user_status on public.recommendation_applications(user_id, status, updated_at desc);
+create index idx_recommendation_applications_user_harness on public.recommendation_applications(user_id, harness, updated_at desc);
+create index idx_recommendation_applications_project on public.recommendation_applications(project_id, updated_at desc);
+
+alter table public.recommendation_applications enable row level security;
+create policy "Users manage own recommendation applications"
+  on public.recommendation_applications for all
+  using (auth.uid() = user_id)
+  with check (auth.uid() = user_id);

package/dist/supabase/migrations/00188_training_producer_canonical_path.sql

@@ -0,0 +1,117 @@
+-- The training producer's ACTIVE gate passes for paths nobody works in.
+--
+-- ## Measured 2026-08-14
+--
+-- 00174 added the gate that stops undead trials, and it resolves
+-- `suggestion.project_path → project_checkouts → project_id → sessions`. That
+-- last hop is the defect: it asks "has this PROJECT been active?", not "has
+-- this PATH been active?". Every checkout of an active repo therefore passes,
+-- including ones with no session in months.
+--
+-- Concretely, `/Users/nickyeager/Code/agents/momento-mori/apps/cli` maps to the
+-- momento-mori project, whose ROOT is worked in daily, so the subpath cleared
+-- the gate and the producer enqueued a training job for it every night. Those
+-- jobs nominated real trials against a checkout with no session since
+-- 2026-05-01: 6 running experiments were sitting on it tonight, holding slots,
+-- unable to ever enroll an arm — the exact "undead" failure 00174 was written
+-- to end, arriving through the one hop it did not close. (They were stopped by
+-- hand under `inactive_project`; this stops them being created again.)
+--
+-- ## The rule
+--
+-- A suggestion's path may start a trial only if it IS the project's canonical
+-- checkout. `public.project_canonical_checkouts` (00186) is the single
+-- authority — CLAUDE.md's hard invariant is that this is never re-derived, and
+-- 00174's hand-rolled join is precisely a re-derivation. The view already ranks
+-- live-before-stale, so "canonical" cannot silently mean a dead path.
+--
+-- The per-path activity check is KEPT as well: canonical and recently active
+-- are different claims, and a project that has gone quiet entirely should still
+-- start no new trials.
+--
+-- The SETTLE half stays ungated, unchanged, for 00174's reason: gating it would
+-- orphan an experiment whose project went quiet mid-trial.
+
+create or replace function public.enqueue_instruction_training(p_active_days integer default 7)
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with eligible as (
+    select s.user_id, s.project_path
+      from instruction_suggestions s
+     where s.kind = 'add'
+       and s.accepted_at is null
+       and s.dismissed_at is null
+       and s.declined_at is null
+       and s.is_stale = false
+       -- CANONICAL (new in 00188): this path is the project's canonical
+       -- checkout, per the view that owns that answer. Without it, every
+       -- subdirectory of an active repo is treated as its own live project.
+       and exists (
+         select 1
+           from project_checkouts pc
+           join project_canonical_checkouts c on c.project_id = pc.project_id
+          where pc.path = s.project_path
+            and c.path = s.project_path
+       )
+       -- ACTIVE (00174, unchanged in intent): the project produced a session
+       -- inside the window. An experiment enrolls sessions at render time, so a
+       -- project with none coming can only ever produce an undead trial.
+       and exists (
+         select 1
+           from project_checkouts pc
+           join sessions se on se.project_id = pc.project_id
+          where pc.path = s.project_path
+            and se.user_id = s.user_id
+            and se.started_at > now() - (p_active_days || ' days')::interval
+       )
+       and not exists (
+         select 1 from agent_jobs j
+          where j.task_kind = 'cron_instruction_training'
+            and j.status in ('pending', 'claimed', 'running')
+            and j.payload->>'projectPath' = s.project_path
+            and j.user_id = s.user_id
+       )
+     group by s.user_id, s.project_path
+
+    union
+
+    -- Settle half: deliberately NOT gated (neither on activity nor on
+    -- canonicality). One cheap API call per project per night, and gating it
+    -- would orphan a running experiment the moment its project went quiet — or,
+    -- with the new gate, the moment its checkout stopped being canonical.
+    select e.user_id, e.project_path
+      from instruction_experiments e
+     where e.status = 'running'
+       and not exists (
+         select 1 from agent_jobs j
+          where j.task_kind = 'cron_instruction_training'
+            and j.status in ('pending', 'claimed', 'running')
+            and j.payload->>'projectPath' = e.project_path
+            and j.user_id = e.user_id
+       )
+     group by e.user_id, e.project_path
+  ),
+  ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_instruction_training',
+           'pending',
+           jsonb_build_object('projectPath', e.project_path),
+           'instruction-training:' || e.user_id::text || ':' || e.project_path
+      from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_instruction_training(integer) is
+  'Nightly producer for cron_instruction_training. TRIAL half requires (a) the path IS the project canonical checkout per project_canonical_checkouts (00188 — the project-level activity join in 00174 let every subpath of an active repo through, and apps/cli collected 6 undead trials that way), and (b) a session on the project within p_active_days (default 7). SETTLE half stays ungated so a quiet or non-canonical project cannot orphan a running experiment. Widen deliberately: select enqueue_instruction_training(30).';

package/dist/supabase/migrations/00189_limit_obs_window_index.sql

@@ -0,0 +1,37 @@
+-- 00189: make GET /api/usage/current-limits index-bounded instead of
+-- partition-scanning.
+--
+-- Measured on prod 2026-08-15 with EXPLAIN (ANALYZE, BUFFERS): 133 ms and
+-- 155,494 shared buffer hits PER CALL, x 122,479 calls = 19.0B buffer hits.
+-- That matched the 19.3B in pg_stat_statements exactly and made this the #1
+-- query by total DB time (25.3%) — ahead of realtime WAL decode and far ahead
+-- of the context_snapshots inserts everyone was looking at.
+--
+-- The cost was never the row count of the ANSWER (3 rows). It was that both
+-- LATERAL probes read the ENTIRE (user, provider, source_type, limit_type)
+-- partition — 37,946 index tuples x 3 limit types x 2 probes = 227,676 tuples
+-- to return 3 rows:
+--   * probe 1 is `max(resets_at)`, an aggregate with no LIMIT, so it must visit
+--     every row in the prefix;
+--   * probe 2 filters `resets_at >= <window> - interval '5 minutes'`, which is
+--     NOT sargable against idx_limit_obs_current — that index orders its
+--     trailing column by observed_at, so resets_at is only ever a filter.
+--
+-- Ordering the trailing column by resets_at makes both probes index-bounded:
+-- probe 1 becomes ORDER BY ... LIMIT 1 (one tuple), probe 2 becomes a range
+-- scan over just the current window. NULLS LAST is load-bearing — Postgres
+-- defaults DESC to NULLS FIRST, which would put legacy null-window rows at the
+-- head and make `ORDER BY resets_at DESC LIMIT 1` return NULL instead of the
+-- live window.
+--
+-- INCLUDE (value, observed_at) keeps it index-only: those are the only other
+-- columns the endpoint reads.
+--
+-- idx_limit_obs_current is NOT dropped — the legacy null-window fallback path
+-- still orders by observed_at DESC, and the ingest dedup path uses it too.
+--
+-- CONCURRENTLY; run OUTSIDE a transaction (same convention as 00094/00182).
+
+CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_limit_obs_window
+  ON limit_observations (user_id, provider, source_type, limit_type, resets_at DESC NULLS LAST)
+  INCLUDE (value, observed_at);

package/dist/supabase/migrations/00190_eval_targets_artifact_link.sql

@@ -0,0 +1,176 @@
+-- Give an eval target a real link to the artifact it measures.
+--
+-- THE STRUCTURAL DEFECT
+--
+-- `eval_targets` stored no reference to the thing under test: no
+-- `instruction_id`, no project. Just a COPY of the content and a `name` string.
+-- "Which artifact does this target measure?" was answered by parsing the name —
+-- if it starts with '/', treat it as a file path — a convention enforced
+-- nowhere that the actuator nonetheless depends on
+-- (`cron-instruction-evolution.ts`: `target.name.startsWith('/') && existsSync`).
+--
+-- When the name is not a path, the loop still measures the target and still
+-- "promotes" it; the promotion writes back to `eval_targets.content`, the
+-- target's own copy, which nothing downstream reads. Measured 2026-08-15:
+-- `TypeScript Best Practices` — a 129-character demo row seeded 2026-03-10 —
+-- was one of only 2 autorun-enabled targets out of 251, write-enabled, and had
+-- burned 102 eval runs producing edits no session could ever load.
+--
+-- The link was available and discarded. `sessions/linking.ts` auto-creates
+-- targets from captured instructions (169 of 197 instruction targets came from
+-- there); it SELECTs `instructions` by `inst.id` to read the content, then
+-- stores only `inst.name`. The session — and therefore the project — is in
+-- scope in the same function.
+--
+-- WHY project_path RATHER THAN project_id
+--
+-- The trial half of the system already models this correctly:
+-- `instruction_experiments` carries `instruction_id` + `project_path`, and its
+-- verdicts (`instruction_verdicts`) carry the same pair. Skills are globally
+-- defined (scope 'public') but their EFFECTIVENESS is per-project — the same
+-- skill helps in one repo and not another. Matching that table's shape keeps
+-- the two measurement modes joinable on the same keys. (Modes A and B are
+-- complementary, not redundant: a repo file cannot be withheld from real work,
+-- so CLAUDE.md is Mode A only, while a skill can be, so it is trialled.)
+--
+-- Both columns are NULLABLE and nothing is backfilled. 249 of 251 targets are
+-- not enrolled in anything; guessing their provenance from a name would be
+-- inventing data. The gate below applies only where promotions can happen.
+
+alter table public.eval_targets
+  add column if not exists instruction_id uuid references public.instructions(id) on delete set null,
+  add column if not exists project_path text;
+
+comment on column public.eval_targets.instruction_id is
+  'The instruction this target measures. Null for targets whose provenance was never recorded (everything created before 00190) and for prompt-type targets captured from a session. Populated at auto-creation, where the id is already in hand.';
+
+comment on column public.eval_targets.project_path is
+  'Project the target is measured FOR. Mirrors instruction_experiments.project_path so the eval (Mode A) and trial (Mode B) halves join on the same keys. A public skill is global; its effectiveness is not.';
+
+create index if not exists idx_eval_targets_instruction
+  on public.eval_targets (instruction_id) where instruction_id is not null;
+
+create index if not exists idx_eval_targets_project
+  on public.eval_targets (project_path) where project_path is not null;
+
+-- ---------------------------------------------------------------------------
+-- The gate, at the producer — the same place 00188 gated the training producer
+-- on the canonical checkout, and for the same reason: enrolment is a manual
+-- metadata toggle, so the producer is the only chokepoint every scheduled batch
+-- must pass through.
+--
+-- A target may only consume the autorun budget if the loop can name what a
+-- promotion would land on. Two ways to qualify:
+--
+--   (a) it carries a link (instruction_id or project_path), or
+--   (b) it is named by an absolute path — the legacy convention, kept so the
+--       163 file-anchored targets that predate this migration keep working
+--       without a backfill.
+--
+-- A target with neither is refused. That is exactly the demo row: no
+-- instruction, no project, and a name that is a label rather than a path.
+-- ---------------------------------------------------------------------------
+
+create or replace function public.enqueue_eval_autorun()
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with eligible as (
+    select t.id, t.user_id,
+      -- Current judge for this target = most recent stamped run, mirroring
+      -- judge-calibration's own resolution (created_at desc, model desc for a
+      -- stable tie-break).
+      (
+        select r.grading->>'judge_model'
+        from eval_runs r
+        where r.eval_target_id = t.id
+          and r.grading->>'judge_model' is not null
+        order by r.created_at desc, r.grading->>'judge_model' desc
+        limit 1
+      ) as current_judge
+    from eval_targets t
+    where coalesce(t.metadata->>'autoRunEnabled', 'false') = 'true'
+      -- Gate 0 (00190): the target must be anchored to something a promotion
+      -- could land on. Without this, a batch is two LLM executions plus a
+      -- judged grade spent to rewrite a row nothing reads.
+      and (
+        t.instruction_id is not null
+        or t.project_path is not null
+        or t.name like '/%'
+      )
+      -- Gate 2a: recent grading wasn't MOSTLY ungradeable (proportional, and
+      -- identical to the evolution producer's 2a since 00163).
+      and not exists (
+        select 1 from eval_runs r
+        where r.eval_target_id = t.id
+          and r.created_at > now() - interval '7 days'
+        group by r.eval_target_id
+        having count(*) >= 5
+           and count(*) filter (
+                 where jsonb_typeof(r.grading->'expectations') = 'array'
+                   and exists (
+                     select 1 from jsonb_array_elements(r.grading->'expectations') e
+                     where coalesce(e->>'errored', 'false') = 'true'
+                   )
+               ) * 4 >= count(*)
+      )
+      -- Gate 2b: no human anchors pointing at an ungradeable assertion.
+      and not exists (
+        select 1
+        from eval_grade_annotations a
+        join eval_runs r on r.id = a.eval_run_id
+        where a.eval_target_id = t.id
+          and jsonb_typeof(r.grading->'expectations') = 'array'
+          and coalesce(
+            r.grading->'expectations'->(a.expectation_index)->>'errored', 'false'
+          ) = 'true'
+      )
+      -- Gate 2c: last week's batch wasn't mostly failures.
+      and not exists (
+        select 1 from eval_runs r
+        where r.eval_target_id = t.id
+          and r.created_at > now() - interval '7 days'
+        group by r.eval_target_id
+        having count(*) >= 5
+           and count(*) filter (where r.status = 'failed') * 4 >= count(*)
+      )
+      -- Gate 3: the target has live cases to actually run.
+      and exists (
+        select 1 from evals ev
+        where ev.eval_target_id = t.id and ev.retired_at is null
+      )
+      -- One in flight at a time, per the 00083/00086 pattern.
+      and not exists (
+        select 1 from agent_jobs j
+        where j.task_kind = 'cron_eval_autorun'
+          and j.status in ('pending', 'claimed', 'running')
+          and j.payload->>'evalTargetId' = t.id::text
+      )
+  ), ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_eval_autorun',
+           'pending',
+           jsonb_build_object('evalTargetId', e.id::text, 'maxRuns', 12)
+             || case
+                  when e.current_judge is not null
+                    then jsonb_build_object('graderModel', e.current_judge)
+                  else '{}'::jsonb
+                end,
+           'eval-autorun:' || e.id::text
+    from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_eval_autorun() is
+  'Nightly producer for cron_eval_autorun. Enqueues one bounded depth batch per OPTED-IN, ANCHORED, healthy, under-powered eval target, with the grader pinned to the target''s current judge (00148, #196). Gate 0 (00190) requires instruction_id, project_path, or an absolute-path name: a target anchored to nothing can be measured and "promoted" forever while rewriting only its own content column — measured 2026-08-15, a 129-char demo row had burned 102 runs that way. Health 2a is PROPORTIONAL as of 00169. Opt in with: update eval_targets set metadata = coalesce(metadata, ''{}''::jsonb) || ''{"autoRunEnabled":true}''::jsonb where id = ...';