@sriinnu/omit 0.3.0

package/.clinerules/omit.md

@@ -0,0 +1,15 @@
+# omit: Omit needless code.
+
+Great software is edited, not written. You are the editor, not just the author. Draft less, cite everything, cut last.
+
+**Before code: the Seven Omissions** (stop at the first that holds): (1) Omit the feature: speculative need = needless until proven needed; write nothing. (2) Omit the new code: the codebase already does this; reuse it. (3) Omit the custom: stdlib covers it. (4) Omit the script: the platform does it natively. (5) Omit the dependency: an installed dep covers it; never add a new one for a few lines. (6) Omit the ceremony: one plain line beats a pattern. (7) What survives editing, ships.
+
+**Fact-Check**: no omission counts until verified now: codebase reuse → cite path:line; stdlib/platform claims → real docs or a run snippet; dependency claims → manifest + API exists in the installed version.
+
+**Final Draft**: after tests go green, one ruthless edit of your own diff; report the net (±lines, files, new deps: target 0). Done = final draft, not green tests.
+
+**Never cut load-bearing lines**: validation at trust boundaries, error handling preventing data loss, security, accessibility, concurrency correctness, explicit requests. Announce (`load-bearing: <reason>`), never skip.
+
+**Footnotes**: record deliberate omissions: `// omitted: <what>; <when to add it back>`.
+
+**Voice**: root causes, not symptoms; boring beats clever; deletion is the strongest edit.

package/.cursor/rules/omit.mdc

@@ -0,0 +1,25 @@
+---
+description: omit: Omit needless code. Draft less, cite everything, cut last.
+alwaysApply: true
+---
+
+Great software is edited, not written. You are the editor, not just the author.
+
+BEFORE code: the Seven Omissions (stop at the first that holds):
+1. Omit the feature: speculative need = needless until proven needed; write nothing.
+2. Omit the new code: the codebase already does this; reuse it.
+3. Omit the custom: stdlib covers it.
+4. Omit the script: the platform does it natively (CSS over JS, HTML5 over widget libs, SQL over app code).
+5. Omit the dependency: an installed dep covers it; never add a new one for a few lines.
+6. Omit the ceremony: one plain line beats a pattern.
+7. What survives editing, ships: minimum that works, fewest files, shortest diff.
+
+FACT-CHECK: no omission counts until verified now: codebase reuse → cite path:line; stdlib/platform claims → real docs or a run snippet; dependency claims → in the manifest AND the API exists in the installed version. A hallucinated shortcut is a fabricated quote.
+
+AFTER green: the Final Draft: one ruthless edit of your own diff (dead branches, unused params/imports, speculative options, restating comments, single-caller indirection). Report the net: ±lines, files, new deps (target 0). Done = final draft, not green tests.
+
+NEVER CUT: load-bearing lines: input validation at trust boundaries, error handling preventing data loss, security, accessibility, concurrency correctness, anything explicitly requested. Announce them ("load-bearing: <reason>"), never skip them for a shorter diff.
+
+FOOTNOTES: record deliberate omissions in code: `// omitted: <what>; <when to add it back>`.
+
+VOICE: root causes, not symptoms; boring beats clever; deletion is the strongest edit; shortest explanation that transfers understanding.

package/.windsurf/rules/omit.md

@@ -0,0 +1,15 @@
+# omit: Omit needless code.
+
+Great software is edited, not written. You are the editor, not just the author. Draft less, cite everything, cut last.
+
+**Before code: the Seven Omissions** (stop at the first that holds): (1) Omit the feature: speculative need = needless until proven needed; write nothing. (2) Omit the new code: the codebase already does this; reuse it. (3) Omit the custom: stdlib covers it. (4) Omit the script: the platform does it natively. (5) Omit the dependency: an installed dep covers it; never add a new one for a few lines. (6) Omit the ceremony: one plain line beats a pattern. (7) What survives editing, ships.
+
+**Fact-Check**: no omission counts until verified now: codebase reuse → cite path:line; stdlib/platform claims → real docs or a run snippet; dependency claims → manifest + API exists in the installed version.
+
+**Final Draft**: after tests go green, one ruthless edit of your own diff; report the net (±lines, files, new deps: target 0). Done = final draft, not green tests.
+
+**Never cut load-bearing lines**: validation at trust boundaries, error handling preventing data loss, security, accessibility, concurrency correctness, explicit requests. Announce (`load-bearing: <reason>`), never skip.
+
+**Footnotes**: record deliberate omissions: `// omitted: <what>; <when to add it back>`.
+
+**Voice**: root causes, not symptoms; boring beats clever; deletion is the strongest edit.

package/AGENTS.md

@@ -0,0 +1,43 @@
+# omit: Omit needless code.
+
+Editorial rules for AI coding agents. Portable: copy this file (or its contents) into any agent's rule system (`AGENTS.md`, `.cursor/rules/`, `.clinerules/`, `.github/copilot-instructions.md`, `GEMINI.md`, …).
+
+Great software is edited, not written. Every line must earn its place, every claim needs a citation, and a diff is not done until it has been cut.
+
+> Draft less. Cite everything. Cut last.
+
+## Before code: the Seven Omissions
+
+Try to omit, in order: stop at the first omission that holds:
+
+1. **Omit the feature.** Speculative need: needless until proven needed. Write nothing.
+2. **Omit the new code.** The codebase already does this. Reuse it.
+3. **Omit the custom.** The standard library covers it.
+4. **Omit the script.** The platform does it natively (CSS over JS, HTML5 over widget libs, SQL over app code).
+5. **Omit the dependency.** An installed dep covers it. Never add a new one for a few lines of code.
+6. **Omit the ceremony.** One plain line beats a pattern.
+7. **What survives editing, ships.** Minimum that works: fewest files, shortest diff, no unrequested abstraction.
+
+## The Fact-Check
+
+No omission counts until verified in this session: codebase reuse → cite `path:line`; stdlib/platform claims → real docs or a run snippet; dependency claims → in the manifest AND the API exists in the installed version. No citation, no omission.
+
+## After code works: the Final Draft
+
+One ruthless edit of your own diff: dead branches, unused params/imports, speculative options, comments restating code, single-caller indirection. Report the net (+/− lines, files, new deps: target 0). Done = final draft, not green tests.
+
+## Load-Bearing Lines: never cut
+
+Input validation at trust boundaries; error handling preventing data loss; security (authn/authz, secrets, injection, deserialization); accessibility; concurrency correctness; anything explicitly requested. Mark with `load-bearing: <reason>` and write it.
+
+## Footnotes
+
+Record deliberate omissions in code: `// omitted: <what>; <when to add it back>`.
+
+## Voice
+
+Root causes, not symptoms. Boring beats clever. Deletion is the strongest edit. Shortest explanation that transfers understanding.
+
+## Modes
+
+`margin` (advisory) · `redline` (default: full enforcement) · `rewrite` (also challenge the assignment) · `off`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 omit contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,175 @@
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="assets/logo-dark.svg">
+    <img src="assets/logo-light.svg" alt="omit: Omit needless code." width="480">
+  </picture>
+</p>
+
+# omit
+
+**Omit needless code.**
+
+An editorial discipline for AI coding agents. Named after Strunk & White's Rule 17: *"Omit needless words"*: applied to the way agents write software: they overwrite (bloat) and they overclaim (hallucinated shortcuts). `omit` fixes both.
+
+> Draft less. Cite everything. Cut last.
+
+## The problem
+
+AI agents are prolific authors and terrible editors. Left alone they add abstractions nobody asked for, pull in dependencies for three lines of logic, and: when told to "keep it simple": confidently reach for stdlib APIs that don't exist. Minimalism-only rulesets fix the bloat and make the overclaiming *worse*: the pressure to write less rewards inventing shortcuts.
+
+## The system
+
+`omit` turns the agent from author into editor. Four parts:
+
+| Part | What it does |
+|---|---|
+| **The Seven Omissions** | Before writing anything, try seven ways to *not* write it: omit the feature, the new code, the custom, the script, the dependency, the ceremony: stopping at the first omission that holds. What survives editing, ships. |
+| **The Fact-Check** | No omission counts without a citation verified this session: `path:line` for "the codebase has this", real docs or a run snippet for "stdlib covers it", manifest + installed API for "the dep handles it". A hallucinated shortcut is a fabricated quote. |
+| **The Final Draft** | Working code is a first draft. After tests go green, one ruthless edit of the agent's own diff: then a net report: files, ±lines, new deps (target: 0). Done means final draft, not green tests. |
+| **Load-Bearing Lines** | Editing cuts fat, not walls. Validation, error handling, security, accessibility, concurrency correctness, and explicit requests are never cut: and adding them is announced, never smuggled or skipped. |
+
+Deliberate omissions go on the record as footnotes in the code:
+
+```js
+// omitted: retries: single caller tolerates failure; add backoff if this goes multi-tenant
+```
+
+## Enforcement: asked for vs. made to
+
+Every other skill in this genre is words the agent can ignore under context pressure. omit ships mechanisms that run *outside* the model:
+
+| Mechanism | What it does |
+|---|---|
+| **Command sentinel** (hook) | Inspects every shell command BEFORE it runs and blocks the classic agent disasters: `rm -rf ~`, recursive deletes of system/drive roots, deletes through unset variables (`rm -rf $OUT/*` with `$OUT` empty), `dd` to block devices, `mkfs`, fork bombs. The user's machine is load-bearing. |
+| **Dep sentinel** (hook) | A new dependency hits a manifest with no receipt in `.omit/receipts.jsonl` → the edit is objected to on the spot. Cite why omissions 2-5 failed, or revert. |
+| **Hazard sentinel** (hook) | Hardcoded API keys/secrets and injection-prone patterns (string-built SQL, `eval`, shell concatenation, `innerHTML`, unsafe deserialization) are blocked the moment they land in a file. Secrets have no override; injection lines need a reviewed `omit-allow: <reason>`. |
+| **Lint sentinel** (hook) | omit ships no lint rules. It detects the linter the repo already configured (eslint, biome, ruff, flake8) and runs it on every edited file, so the agent hears objections immediately instead of at CI time. |
+| **Final Draft gate** (hook) | The session cannot end with an edited tree and no `.omit/final-draft.md` net report. The deletion pass is a gate, not a suggestion. |
+| **Receipts ledger** | Every Fact-Check citation is appended to `.omit/receipts.jsonl`: an auditable trail of the agent's claims your reviewers can actually read. |
+
+Hooks install automatically with the Claude Code plugin. Escape hatch for humans: `OMIT_OFF=1`.
+
+## Any provider, same gates
+
+The enforcement logic lives in a zero-dependency CLI, not in any one vendor's hook system: Claude Code's hooks are just thin adapters over it. For Cursor, Codex, Copilot, or anything else, enforce at the two chokepoints every agent passes through:
+
+```
+npx @sriinnu/omit hook install   # git pre-commit: audits the staged diff,
+                                 # fails on secrets, injections, uncited deps
+npx @sriinnu/omit audit          # net diff, new deps, hazards, omit score
+npx @sriinnu/omit check <files>  # hazard-scan specific files (wire into any hook system)
+npx @sriinnu/omit lint [files]   # run the repo's OWN linter on changed files
+npx @sriinnu/omit guard "<cmd>"  # is this shell command a disaster? (wire into any hook system)
+npx @sriinnu/omit gate           # the pre-commit check, callable from anywhere
+```
+
+And server-side, the GitHub Action comments the verdict on every PR regardless of what wrote the code:
+
+```yaml
+# .github/workflows/omit.yml
+on: pull_request
+permissions: { pull-requests: write }
+jobs:
+  omit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+      - uses: sriinnu/omit@main
+```
+
+```
+### omit verdict
+- net: +61 −204 lines across 4 files
+- new deps: 0 ✅
+- hazards: 0 ✅
+- footnotes: 3 recorded · load-bearing: 1 marked
+- omit score: 91/100 🟢
+```
+
+## The referee (experimental)
+
+`bench/` is METHODOLOGY.md made runnable: paired agentic runs of the same tasks under baseline, omit, or **any competing skill**, metrics computed from the actual git diffs, all transcripts kept. The category argues about self-reported numbers; omit ships the measuring instrument. See `bench/README.md`.
+
+## Modes
+
+| Mode | Behavior |
+|---|---|
+| `margin` | Build as asked; note in the margin what could have been omitted |
+| `redline` | **Default.** Full enforcement: Seven Omissions, Fact-Check, Final Draft |
+| `rewrite` | Also question the assignment itself before building |
+| `off` | Disabled until re-invoked |
+
+Say `omit redline` (or any mode) in chat, or use `/omit <mode>` where slash commands are supported.
+
+## Install
+
+New here? **[GETTING-STARTED.md](GETTING-STARTED.md)** has a copy-paste setup for every agent.
+
+**Claude Code (plugin marketplace)**: one command pair, gets you the skill plus `/omit` and `/omit-edit`:
+
+```
+/plugin marketplace add sriinnu/omit
+/plugin install omit@omit
+```
+
+**Global command**: install once from GitHub, use everywhere:
+
+```
+npm install -g github:sriinnu/omit
+omit init cursor        # or: omit audit / omit gate / omit hook install
+```
+
+**npm / npx**: drops the right rule file into the current repo (never overwrites existing files):
+
+```
+npx @sriinnu/omit init            # AGENTS.md (default)
+npx @sriinnu/omit init claude     # .claude/skills/omit/SKILL.md
+npx @sriinnu/omit init cursor     # .cursor/rules/omit.mdc
+npx @sriinnu/omit init cline      # .clinerules/omit.md
+npx @sriinnu/omit init windsurf   # .windsurf/rules/omit.md
+npx @sriinnu/omit init all        # everything above
+npx @sriinnu/omit hook install    # git pre-commit gate (works with ANY agent)
+```
+
+**Claude Code (manual)**: copy the skill into your project or user skills directory:
+
+```
+skills/omit/SKILL.md  →  .claude/skills/omit/SKILL.md      (project)
+                         ~/.claude/skills/omit/SKILL.md    (all projects)
+```
+
+**Codex / Takumi / any AGENTS.md-aware agent**: copy `AGENTS.md` into your repo root (or append to an existing one), or `npx @sriinnu/omit init codex`.
+
+**GitHub Copilot**: copy `.github/copilot-instructions.md` into your repo, or `npx @sriinnu/omit init copilot`.
+
+**Cursor**: copy `.cursor/rules/omit.mdc` into your repo.
+
+**Cline**: copy `.clinerules/omit.md` into your repo.
+
+**Windsurf**: copy `.windsurf/rules/omit.md` into your repo.
+
+**Anything else**: paste the contents of `AGENTS.md` into the agent's custom-instructions/rules mechanism. It's plain markdown; there is nothing to build.
+
+```
+// omitted: an MCP server: MCP exposes tools and data; omit is a behavioral
+// discipline, and rule files + skills already deliver it. Add one only if
+// omit ever grows verifiable tooling (e.g., a standalone diff auditor).
+```
+
+## Commands (Claude Code)
+
+- `/omit [margin|redline|rewrite|off]`: switch or show the current mode
+- `/omit-edit`: run an editor's pass over the current diff: flag bloat, uncited claims, missing footnotes, and cut opportunities
+
+## Benchmarks
+
+None yet: and we won't publish numbers we can't hand you the harness for. `benchmarks/METHODOLOGY.md` defines the measurement we consider honest (paired tasks, agentic baseline, net LOC / new deps / defect rate / load-bearing violations, full transcripts). Reproducible runs are the most welcome PR this repo can receive.
+
+## Prior art
+
+The minimalism-pressure idea was popularized by [ponytail](https://github.com/DietrichGebert/ponytail), which deserves its stars. `omit` differs where it matters: shortcuts require citations, the diff is edited *after* it works, safety lines are enumerated and never cut, and what's left out is footnoted instead of silent.
+
+## License
+
+MIT

package/action.yml

@@ -0,0 +1,26 @@
+name: omit audit
+description: Comment the omit verdict (net diff, new deps, hazards, score) on pull requests: works whatever agent or editor wrote the code.
+branding:
+  icon: scissors
+  color: gray-dark
+inputs:
+  base:
+    description: Base ref to diff against
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Run omit audit
+      shell: bash
+      run: |
+        BASE="${{ inputs.base }}"
+        if [ -z "$BASE" ]; then BASE="origin/${{ github.event.pull_request.base.ref }}"; fi
+        git fetch --depth=1 origin "${{ github.event.pull_request.base.ref }}" || true
+        node "${{ github.action_path }}/bin/omit.mjs" audit --base "$BASE" --markdown > omit-verdict.md
+        cat omit-verdict.md
+    - name: Comment on PR
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: gh pr comment ${{ github.event.pull_request.number }} --body-file omit-verdict.md --repo ${{ github.repository }}

package/bench/README.md

@@ -0,0 +1,13 @@
+# omit bench (experimental)
+
+The runnable referee for `benchmarks/METHODOLOGY.md`: paired agentic runs of the same tasks under different rule files: baseline, omit, or any competing skill: with every metric computed from the actual git diff and every transcript kept.
+
+```
+node bench/run.mjs bench/bench.config.json
+```
+
+Copy `bench.config.example.json`, point `tasks[].repo` at real fixture repos with real test suites, and pick your arms. Output lands in `bench/runs/<timestamp>/`: per-run logs, `results.json`, and a median summary table.
+
+Status: **experimental**: the harness runs, but no official numbers exist yet because none have been produced by a run anyone can reproduce. That is the standard; it doesn't bend for the project that set it.
+
+`// omitted: cost/token accounting: agent CLIs report spend differently; add per-agent adapters when the first real run needs them`

package/bench/bench.config.example.json

@@ -0,0 +1,18 @@
+{
+  "agentCmd": "claude",
+  "agentArgs": ["-p", "{prompt}", "--dangerously-skip-permissions"],
+  "timeoutMinutes": 20,
+  "arms": [
+    { "name": "baseline" },
+    { "name": "omit", "rules": "./AGENTS.md" },
+    { "name": "other-skill", "rules": "../some-other-skill/AGENTS.md" }
+  ],
+  "tasks": [
+    {
+      "id": "add-pagination",
+      "repo": "../fixtures/fastapi-app",
+      "prompt": "Add cursor-based pagination to the /items endpoint. Existing tests must keep passing.",
+      "testCmd": "python -m pytest -q"
+    }
+  ]
+}

package/bench/run.mjs

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+// omit bench: EXPERIMENTAL referee harness. Runs paired agentic tasks across
+// arms (baseline / omit / any other rule file) and reports the metrics from
+// benchmarks/METHODOLOGY.md with full per-run logs. No numbers without receipts.
+//
+//   node bench/run.mjs bench/bench.config.json
+import { cpSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { execSync, spawnSync } from 'node:child_process'
+import { tmpdir } from 'node:os'
+import { basename, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { isManifest, addedDeps } from '../lib/deps.mjs'
+import { findHazards } from '../lib/hazards.mjs'
+
+const configPath = process.argv[2]
+if (!configPath) {
+  console.error('usage: node bench/run.mjs <config.json>   (see bench.config.example.json)')
+  process.exit(1)
+}
+const cfg = JSON.parse(readFileSync(configPath, 'utf8'))
+const benchRoot = join(dirnameOf(import.meta.url), 'runs', String(Date.now()))
+mkdirSync(benchRoot, { recursive: true })
+
+function dirnameOf(url) {
+  return join(fileURLToPath(url), '..')
+}
+const sh = (cmd, cwd) => execSync(cmd, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })
+
+const results = []
+for (const task of cfg.tasks) {
+  for (const arm of cfg.arms) {
+    const dir = mkdtempSync(join(tmpdir(), `omit-bench-`))
+    cpSync(resolve(task.repo), dir, { recursive: true })
+    if (arm.rules) cpSync(resolve(arm.rules), join(dir, arm.rulesDest ?? 'AGENTS.md'))
+    if (!existsSync(join(dir, '.git'))) {
+      sh('git init -q && git add -A && git -c user.email=bench@omit -c user.name=bench commit -qm base', dir)
+    }
+
+    console.log(`▶ ${task.id} × ${arm.name}`)
+    const t0 = Date.now()
+    // {prompt} in agentArgs is replaced inline; if absent, the prompt goes to stdin
+    // (safer quoting, and `claude -p` reads stdin in print mode).
+    const inline = cfg.agentArgs.some((a) => a.includes('{prompt}'))
+    const run = spawnSync(cfg.agentCmd, cfg.agentArgs.map((a) => a.replaceAll('{prompt}', task.prompt)), {
+      cwd: dir,
+      encoding: 'utf8',
+      input: inline ? undefined : task.prompt,
+      timeout: (cfg.timeoutMinutes ?? 20) * 60_000,
+      shell: process.platform === 'win32',
+    })
+    const durationMs = Date.now() - t0
+
+    // metrics vs the base commit
+    let added = 0, deleted = 0, newDeps = [], hazards = []
+    try {
+      sh('git add -A', dir)
+      for (const row of sh('git diff --cached --numstat', dir).split('\n').filter(Boolean)) {
+        const [a, d, path] = row.split('\t')
+        if (a === '-') continue
+        added += +a
+        deleted += +d
+        if (isManifest(path)) newDeps.push(...addedDeps(basename(path), sh(`git diff --cached -- "${path}"`, dir)))
+      }
+      const addedLines = sh('git diff --cached', dir).split('\n').filter((l) => l.startsWith('+') && !l.startsWith('+++')).map((l) => l.slice(1))
+      hazards = findHazards(addedLines)
+    } catch {}
+
+    let testPass = null
+    if (task.testCmd) {
+      const t = spawnSync(task.testCmd, { cwd: dir, shell: true, encoding: 'utf8', timeout: 10 * 60_000 })
+      testPass = t.status === 0
+    }
+
+    const rec = { task: task.id, arm: arm.name, added, deleted, net: added - deleted, newDeps, hazards: hazards.length, testPass, durationMs, dir }
+    results.push(rec)
+    writeFileSync(join(benchRoot, `${task.id}--${arm.name}.log`), `${run.stdout ?? ''}\n--- stderr ---\n${run.stderr ?? ''}`)
+    console.log(`   net ${rec.net >= 0 ? '+' : ''}${rec.net} · deps +${newDeps.length} · hazards ${rec.hazards} · tests ${testPass === null ? 'n/a' : testPass ? 'pass' : 'FAIL'} · ${(durationMs / 1000).toFixed(0)}s`)
+  }
+}
+
+writeFileSync(join(benchRoot, 'results.json'), JSON.stringify(results, null, 2))
+
+// summary table: metric medians per arm
+const arms = [...new Set(results.map((r) => r.arm))]
+const med = (xs) => (xs.length ? xs.slice().sort((a, b) => a - b)[Math.floor(xs.length / 2)] : null)
+let table = `| metric | ${arms.join(' | ')} |\n|---|${arms.map(() => '---').join('|')}|\n`
+for (const [label, pick] of [
+  ['median net LOC', (r) => r.net],
+  ['new deps (total)', null],
+  ['test failures', null],
+  ['hazards (total)', null],
+]) {
+  const cells = arms.map((a) => {
+    const rs = results.filter((r) => r.arm === a)
+    if (label === 'median net LOC') return med(rs.map(pick))
+    if (label === 'new deps (total)') return rs.reduce((n, r) => n + r.newDeps.length, 0)
+    if (label === 'test failures') return rs.filter((r) => r.testPass === false).length
+    return rs.reduce((n, r) => n + r.hazards, 0)
+  })
+  table += `| ${label} | ${cells.join(' | ')} |\n`
+}
+writeFileSync(join(benchRoot, 'summary.md'), table)
+console.log(`\n${table}\nfull transcripts and results: ${benchRoot}`)