@wenaixi/dsh-ponytail 4.9.0

package/AGENTS.md

@@ -0,0 +1,32 @@
+# Ponytail, lazy senior dev mode
+
+You are a lazy senior developer. Lazy means efficient, not careless. The best code is the code never written.
+
+Before writing any code, stop at the first rung that holds:
+
+1. Does this need to be built at all? (YAGNI)
+2. Does it already exist in this codebase? Reuse the helper, util, or pattern that's already here, don't re-write it.
+3. Does the standard library already do this? Use it.
+4. Does a native platform feature cover it? Use it.
+5. Does an already-installed dependency solve it? Use it.
+6. Can this be one line? Make it one line.
+7. Only then: write the minimum code that works.
+
+The ladder runs after you understand the problem, not instead of it: read the task and the code it touches, trace the real flow end to end, then climb.
+
+Bug fix = root cause, not symptom: a report names a symptom. Grep every caller of the function you touch and fix the shared function once — one guard there is a smaller diff than one per caller, and patching only the path the ticket names leaves a sibling caller still broken.
+
+Rules:
+
+- No abstractions that weren't explicitly requested.
+- No new dependency if it can be avoided.
+- No boilerplate nobody asked for.
+- Deletion over addition. Boring over clever. Fewest files possible.
+- Shortest working diff wins, but only once you understand the problem. The smallest change in the wrong place isn't lazy, it's a second bug.
+- Question complex requests: "Do you actually need X, or does Y cover it?"
+- Pick the edge-case-correct option when two stdlib approaches are the same size, lazy means less code, not the flimsier algorithm.
+- Mark deliberate simplifications that cut a real corner with a known ceiling (global lock, O(n²) scan, naive heuristic) with a `ponytail:` comment naming the ceiling and upgrade path.
+
+Not lazy about: understanding the problem (read it fully and trace the real flow before picking a rung, a small diff you don't understand is just laziness dressed up as efficiency), input validation at trust boundaries, error handling that prevents data loss, security, accessibility, the calibration real hardware needs (the platform is never the spec ideal, a clock drifts, a sensor reads off), anything explicitly requested. Lazy code without its check is unfinished: non-trivial logic leaves ONE runnable check behind, the smallest thing that fails if the logic breaks (an assert-based demo/self-check or one small test file; no frameworks, no fixtures). Trivial one-liners need no test.
+
+(Yes, this file also applies to agents working on the ponytail repo itself. Especially to them.)

package/CHANGELOG.md

@@ -0,0 +1,26 @@
+# Changelog
+
+所有重要变更记录于此，格式基于 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.0.0/)，版本号与上游 [DietrichGebert/ponytail](https://github.com/DietrichGebert/ponytail) 同步。
+
+## [4.9.0] - 2026-08-21
+
+### Added
+- 完整移植上游 v4.9.0：6 个 Skill（`ponytail` / `ponytail-review` / `ponytail-audit` / `ponytail-debt` / `ponytail-gain` / `ponytail-help`）
+- Always-on 梯子注入（`systemPrompt` section, `order: 50`），随 `lite/full/ultra/off/review` 动态裁剪
+- 复刻 hooks 行为：`activate` / `mode-tracker` / `subagent` / `config` / `instructions` / `runtime`
+- `PONYTAIL_DEFAULT_MODE` env > cordis 配置 > 配置文件 > `full` 三级回退，`review` 不可作默认，BOM 处理、`isShellSafe`、`isDeactivationCommand` 全量对齐
+- 中文化：6 个 Skill 的 `description` 与正文、fallback 指令、hook 日志、systemPrompt 注入文本全部中文，触发词兼容中英文
+- `CLAUDE.md` 核心记忆库、`LICENSE`（MIT）、`README.md`/`README.en.md`、`CHANGELOG.md`、`assets/`、`AGENTS.md`
+
+### Changed
+- DSH 形态：单一插件包 `dsh-ponytail`，`dsh.bundle.patch = ./cordis.patch.yml`，包名引用挂载
+- 注入文本中文化：`PONYTAIL 已激活 — 等级：…`，`hook` 日志全中文
+
+### Fixed
+- `initialMode` 优先级修正为 `env > cordis 显式 config > 文件 > full`，与上游语义一致
+
+### Notes
+- 无空 tool（不在 `ctx.tools` 注册任何占位），`scripts/verify.mjs` 校验
+- 构建：`pnpm build` (`tsc -p tsconfig.build.json`)，`pnpm typecheck`，`pnpm verify`
+
+[4.9.0]: https://github.com/Wenaixi/dsh-ponytail/releases/tag/v4.9.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DietrichGebert
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md

@@ -0,0 +1,100 @@
+# dsh-ponytail
+
+<p align="center">
+  <img src="assets/logo.png" width="180" alt="Ponytail" />
+</p>
+
+<p align="center">
+  <strong>The Lazy Senior �?ported to DeepSeek Harness</strong><br/>
+  <em>The best code is the code you never wrote.</em>
+</p>
+
+<p align="center">
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-111111?style=flat-square" alt="MIT"/></a>
+  <img src="https://img.shields.io/badge/version-4.9.0-111111?style=flat-square" alt="version"/>
+  <img src="https://img.shields.io/badge/DSH-0.1.1--rc.2-333333?style=flat-square" alt="DSH"/>
+  <img src="https://img.shields.io/badge/skills-6-008080?style=flat-square" alt="skills"/>
+  <img src="https://img.shields.io/badge/node-%3E%3D18-3C873A?style=flat-square" alt="node"/>
+</p>
+
+<p align="center">
+  <a href="README.md">中文</a> · English · <a href="CHANGELOG.md">Changelog</a> · <a href="https://github.com/DietrichGebert/ponytail">Upstream</a>
+</p>
+
+---
+
+> A complete DSH port of [DietrichGebert/ponytail](https://github.com/DietrichGebert/ponytail) v4.9.0.
+> Brings the "lazy senior dev" into DeepSeek Harness: always-on ladder injection + 6 localized skills, no empty tools.
+
+## �?Features
+
+- **Always-on ladder**: 7-rung decision (YAGNI �?reuse �?stdlib �?platform native �?installed dep �?one-liner �?minimal), auto-injected before every model request, silent when `off`.
+- **6 localized skills**: `ponytail` / `ponytail-review` / `ponytail-audit` / `ponytail-debt` / `ponytail-gain` / `ponytail-help`, `rank: 550` so project layers can override.
+- **Three intensities**: `lite` / `full` (default) / `ultra`.
+- **Upstream-faithful behavior**: `PONYTAIL_DEFAULT_MODE` env > cordis config > config file > `full`; `review` not allowed as default; whole-sentence deactivation; `ponytail:` debt ledger; `PONYTAIL_SUBAGENT_MATCHER` filtering.
+- **No empty tools**: no `ctx.tools` placeholder �?everything via `ctx.skills`.
+
+## 📦 Skills
+
+| Skill | Type | Notes |
+|---|---|---|
+| `ponytail` | skill + always-on | 7-rung ladder, 3 intensities, CN/EN triggers |
+| `ponytail-review` | skill | diff review, `delete/stdlib/native/yagni/shrink` |
+| `ponytail-audit` | skill | repo-wide audit, same tags, ranked |
+| `ponytail-debt` | skill | harvest `ponytail:` comments |
+| `ponytail-gain` | skill | scoreboard (benchmark medians) |
+| `ponytail-help` | skill | quick reference |
+
+## 🚀 Install
+
+```bash
+pnpm install && pnpm build
+dsh plugin --profile demo add ./
+dsh --profile demo --dump-config  # should show ponytail
+dsh --profile demo
+```
+
+Or from a tarball:
+
+```bash
+pnpm pack && dsh plugin --profile demo add ./dsh-ponytail-4.9.0.tgz
+```
+
+Remove:
+
+```bash
+dsh plugin --profile demo remove @wenaixi/dsh-ponytail
+```
+
+## ⚙️ Configure
+
+```yaml
+- insert:
+    - id: ponytail
+      name: dsh-ponytail
+      config:
+        providerName: ponytail
+        skillDir: /path/to/skills
+        defaultMode: full   # off|lite|full|ultra
+```
+
+Priority: `PONYTAIL_DEFAULT_MODE` env > explicit cordis `defaultMode` > `~/.config/ponytail/config.json` (`%APPDATA%` on Windows, `XDG_CONFIG_HOME` wins) > `full`. `/ponytail default <mode>` persists to that file.
+
+## 🎮 Usage
+
+- Active by default on every coding turn. Explicit: `/ponytail [lite|full|ultra|off]`, `/ponytail default <mode>`, `/ponytail-review` etc.
+- One-shot skills: `/ponytail-review`, `/ponytail-audit`, `/ponytail-debt`, `/ponytail-gain`, `/ponytail-help`
+- Deactivate: `stop ponytail` / `normal mode` (whole sentence) or `/ponytail off`
+- Subagents: `PONYTAIL_SUBAGENT_MATCHER` regex, same as upstream
+
+## 🛠�?Dev
+
+```bash
+pnpm typecheck && pnpm build && node scripts/verify.mjs
+dsh --profile web --patch ./cordis.patch.yml --dump-config
+pnpm dsh web --patch ./cordis.patch.yml
+```
+
+## 📄 License
+
+[MIT](LICENSE) © DietrichGebert / Wenaixi

package/README.md

@@ -0,0 +1,139 @@
+# dsh-ponytail
+
+<p align="center">
+  <img src="assets/logo.png" width="180" alt="Ponytail" />
+</p>
+
+<p align="center">
+  <strong>懒惰的资深工程师 · 移植�?DeepSeek Harness</strong><br/>
+  <em>The best code is the code you never wrote.</em>
+</p>
+
+<p align="center">
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-111111?style=flat-square" alt="MIT"/></a>
+  <a href="https://www.npmjs.com/package/dsh-ponytail"><img src="https://img.shields.io/npm/v/dsh-ponytail?color=111111&style=flat-square" alt="npm"/></a>
+  <img src="https://img.shields.io/badge/version-4.9.0-111111?style=flat-square" alt="version"/>
+  <img src="https://img.shields.io/badge/DSH-0.1.1--rc.2-333333?style=flat-square" alt="DSH"/>
+  <img src="https://img.shields.io/badge/skills-6-008080?style=flat-square" alt="skills"/>
+  <img src="https://img.shields.io/badge/node-%3E%3D18-3C873A?style=flat-square" alt="node"/>
+</p>
+
+<p align="center">
+  <a href="README.md">中文</a> · <a href="README.en.md">English</a> · <a href="CHANGELOG.md">Changelog</a> · <a href="https://github.com/DietrichGebert/ponytail">上游</a> · <a href="https://www.npmjs.com/package/dsh-ponytail">npm</a>
+</p>
+
+---
+
+> [DietrichGebert/ponytail](https://github.com/DietrichGebert/ponytail) v4.9.0 �?**DSH 完整移植�?*�?> 把「懒惰的资深工程师」带�?DeepSeek Harness：always-on 梯子注入 + 6 个中�?Skill，无�?tool，开箱即用�?
+## �?特�?
+- **Always-on 梯子**�? 阶决策（YAGNI �?复用 �?标准�?�?平台原生 �?已有依赖 �?一�?�?最小实现），每轮模型请求前自动注入，`off` 时静默�?- **6 个中�?Skill**：`ponytail` / `ponytail-review` / `ponytail-audit` / `ponytail-debt` / `ponytail-gain` / `ponytail-help`，`rank: 550` 可被项目级覆盖�?- **三档强度**：`lite`（点出更懒的替代�?/ `full`（默认，强制走梯子） / `ultra`（先删后加，挑战需求本身）�?- **上游行为全量复刻**：`PONYTAIL_DEFAULT_MODE` env > cordis 配置 > 配置文件 > `full`；`review` 不可作默认；`stop ponytail` 全句匹配；`ponytail:` 债务台账；`PONYTAIL_SUBAGENT_MATCHER` 过滤�?- **无空 tool**：不�?`ctx.tools` 注册任何占位 tool，全部能力经 `ctx.skills` 暴露�?
+## 📦 包含能力
+
+| 能力 | 类型 | 说明 |
+|---|---|---|
+| `ponytail` | skill + always-on | 7 级梯子，lite/full/ultra 三档，触发词兼容中英�?|
+| `ponytail-review` | skill | diff 过度设计评审，`delete/stdlib/native/yagni/shrink` |
+| `ponytail-audit` | skill | 全仓审计，按可删收益排序 |
+| `ponytail-debt` | skill | 收割 `ponytail:` 注释台账 |
+| `ponytail-gain` | skill | 收益看板（benchmark 中位数） |
+| `ponytail-help` | skill | 速查�?|
+| 模式切换 | hook | `agent/pre-step` + `session/event` 双路径，/ponytail 族指�?|
+| 持久�?| 文件 | `~/.config/ponytail/config.json`（Win: `%APPDATA%`），`/ponytail default <mode>` 写入 |
+
+## 🚀 安装
+
+### 方式一：npm（推荐，发布后可用）
+
+```bash
+# 作为 DSH 插件安装（自动走 dsh.bundle�?dsh plugin --profile demo add @wenaixi/dsh-ponytail
+
+# 或作为普�?npm �?npm i @wenaixi/dsh-ponytail
+# �?pnpm / yarn
+pnpm add @wenaixi/dsh-ponytail
+```
+
+> 版本与上游同步，当前 `4.9.0`，`npm view dsh-ponytail version` 可查�?
+### 方式二：GitHub 直装（无需构建，lib 已提交）
+
+```bash
+dsh plugin --profile demo add github:Wenaixi/dsh-ponytail
+# 指定 tag / 分支亦可
+dsh plugin --profile demo add github:Wenaixi/dsh-ponytail#v4.9.0
+```
+
+### 方式三：本地联调 / tarball
+
+```bash
+pnpm install && pnpm build
+dsh plugin --profile demo add ./
+dsh --profile demo --dump-config  # 应能看到 ponytail �?
+# �?pnpm pack && dsh plugin --profile demo add ./dsh-ponytail-4.9.0.tgz
+```
+
+### 卸载
+
+```bash
+dsh plugin --profile demo remove @wenaixi/dsh-ponytail
+```
+
+### 验证（不重启 3080�?
+```bash
+pnpm build && pnpm typecheck && node scripts/verify.mjs
+dsh --profile demo --dump-config | grep -A2 ponytail  # 应出�?- id: ponytail
+# 隔离 profile 验证 GitHub 直装（不影响 web/3080�?dsh plugin --profile ponytail-test add github:Wenaixi/dsh-ponytail
+dsh --profile ponytail-test --dump-config | grep -A2 ponytail
+```
+
+## ⚙️ 配置
+
+�?`cordis.patch.yml` 行内覆盖�?
+```yaml
+- insert:
+    - id: ponytail
+      name: dsh-ponytail
+      config:
+        providerName: ponytail
+        skillDir: E:/path/to/skills   # 调试用，默认包内 skills/
+        defaultMode: full             # off|lite|full|ultra
+```
+
+优先级（与上游一致）�?
+1. `PONYTAIL_DEFAULT_MODE=ultra` 环境变量（最高）
+2. `cordis.patch.yml` 中显式的 `defaultMode`
+3. `~/.config/ponytail/config.json`（Windows: `%APPDATA%\ponytail\config.json`，`XDG_CONFIG_HOME` 优先�?4. `full`
+
+持久化：`/ponytail default <mode>` 会写入上述配置文件；`review` 不可作默认�?
+## 🎮 使用
+
+- **自动生效**：任一编码任务都会注入梯子，无需手动触发�?- **显式切换**：`/ponytail`（full）、`/ponytail lite|full|ultra|off`、`/ponytail default <mode>`、`/ponytail-review`
+- **一键技�?*：`/ponytail-review`、`/ponytail-audit`、`/ponytail-debt`、`/ponytail-gain`、`/ponytail-help`
+- **退�?*：`stop ponytail` �?`normal mode`（需整句匹配）或 `/ponytail off`，随时用 `/ponytail` 恢复
+- **子智能体**：`PONYTAIL_SUBAGENT_MATCHER` 正则过滤（与上游一致），DSH 侧所�?agent 共享同一 section
+
+## 🛠�?本地开�?
+```bash
+pnpm typecheck
+pnpm build
+pnpm verify                         # 6 技�?+ 产物 + 无空 tool 校验
+dsh --profile web --patch ./cordis.patch.yml --dump-config
+pnpm dsh web --patch ./cordis.patch.yml   # 热重载：�?src/ �?skills/ 即生�?```
+
+- `skills/` 中文化后需重跑 `build` �?`verify`（已处理 BOM �?`\r\n`�?- HMR：改 `src/*.ts` �?`skills/**/SKILL.md` 后旧 provider/section 自动清理
+- 发布：`pnpm build && npm publish --access public --provenance`（需 npm Trusted Publisher 或带 2FA �?granular token�?
+## 📂 目录
+
+```
+src/ponytail.ts              # 唯一入口，name/inject/Config/apply
+src/ponytail-config.ts       # env > 文件 > full（含 BOM、review 限制、shell 白名单）
+src/ponytail-instructions.ts # �?mode 裁剪 SKILL.md + 中文 fallback
+src/ponytail-runtime.ts      # flag 文件 + 多平台识别（Claude/Codex/Qoder�?skills/ponytail/*.md         # 6 个中�?Skill
+assets/                      # logo / benchmark �?lib/                         # 构建产物（已提交，支�?GitHub 直装�?cordis.patch.yml             # - insert: { id: ponytail, name: dsh-ponytail }
+```
+
+## 🔗 上游
+
+- 原仓：https://github.com/DietrichGebert/ponytail（MIT，v4.9.0�?- 本包：MIT，`skills/` �?`AGENTS.md` 原样拷贝自上游，仅为 DSH 运行时做适配
+- 关联：`ponytail:` 债务台账、`ponytail-gain` 永不输出本仓实时节省�?
+## 📄 许可
+
+[MIT](LICENSE) © DietrichGebert / Wenaixi

package/assets/benchmark-3model.svg

@@ -0,0 +1,21 @@
+<svg viewBox="0 0 860 336" xmlns="http://www.w3.org/2000/svg" font-family="-apple-system, 'Segoe UI', Helvetica, Arial, sans-serif">
+  <title>Median lines of code per arm across three models</title>
+  <text x="20" y="26" font-size="15" font-weight="600" fill="#8b949e">Median lines of code. 10 runs per cell. Lower is leaner.</text>
+  <text x="20" y="45" font-size="12" fill="#8b949e" opacity="0.85">Ponytail writes 80-94% less code, costs 42-75% less, and runs 3-6x faster than a no-skill agent.</text>
+  <rect x="20" y="58" width="12" height="12" rx="2" fill="#8b949e"/><text x="38" y="69" font-size="13" fill="#8b949e">baseline (no skill)</text>
+  <rect x="190" y="58" width="12" height="12" rx="2" fill="#d9822b"/><text x="208" y="69" font-size="13" fill="#8b949e">caveman</text>
+  <rect x="300" y="58" width="12" height="12" rx="2" fill="#2da44e"/><text x="318" y="69" font-size="13" fill="#8b949e">ponytail</text>
+  <text x="112" y="119" font-size="13" font-weight="600" fill="#8b949e" text-anchor="end">Haiku</text>
+  <rect x="120" y="92" width="508" height="14" rx="2" fill="#8b949e"/><text x="634" y="103" font-size="11" fill="#8b949e">518</text>
+  <rect x="120" y="110" width="114" height="14" rx="2" fill="#d9822b"/><text x="240" y="121" font-size="11" fill="#d9822b">116</text>
+  <rect x="120" y="128" width="38" height="14" rx="2" fill="#2da44e"/><text x="164" y="139" font-size="11" fill="#2da44e" font-weight="600">39</text>
+  <text x="112" y="193" font-size="13" font-weight="600" fill="#8b949e" text-anchor="end">Sonnet</text>
+  <rect x="120" y="166" width="680" height="14" rx="2" fill="#8b949e"/><text x="806" y="177" font-size="11" fill="#8b949e">693</text>
+  <rect x="120" y="184" width="118" height="14" rx="2" fill="#d9822b"/><text x="244" y="195" font-size="11" fill="#d9822b">120</text>
+  <rect x="120" y="202" width="43" height="14" rx="2" fill="#2da44e"/><text x="169" y="213" font-size="11" fill="#2da44e" font-weight="600">44</text>
+  <text x="112" y="267" font-size="13" font-weight="600" fill="#8b949e" text-anchor="end">Opus</text>
+  <rect x="120" y="240" width="251" height="14" rx="2" fill="#8b949e"/><text x="377" y="251" font-size="11" fill="#8b949e">256</text>
+  <rect x="120" y="258" width="66" height="14" rx="2" fill="#d9822b"/><text x="192" y="269" font-size="11" fill="#d9822b">67</text>
+  <rect x="120" y="276" width="50" height="14" rx="2" fill="#2da44e"/><text x="176" y="287" font-size="11" fill="#2da44e" font-weight="600">51</text>
+  <text x="120" y="324" font-size="11" fill="#8b949e" opacity="0.8">Median of 10 runs/cell, default temperature. 5 tasks (email, debounce, CSV sum, countdown, rate-limit), same model per group. Reproduce: npx promptfoo eval -c benchmarks/promptfooconfig.yaml</text>
+</svg>

package/assets/benchmark-agentic.svg

@@ -0,0 +1,62 @@
+<svg viewBox="0 0 860 488" xmlns="http://www.w3.org/2000/svg" font-family="-apple-system, 'Segoe UI', Helvetica, Arial, sans-serif">
+  <title>Each arm vs the no-skill baseline across every metric, plus safety, Claude Code on Haiku 4.5</title>
+  <text x="430" y="24" font-size="15" font-weight="600" fill="#8b949e" text-anchor="middle">Every metric vs the no-skill baseline (Claude Code, Haiku 4.5, 12 tasks)</text>
+
+  <rect x="212" y="38" width="12" height="12" rx="2" fill="#8b949e"/><text x="229" y="48" font-size="12" fill="#8b949e">baseline</text>
+  <rect x="300" y="38" width="12" height="12" rx="2" fill="#d9822b"/><text x="317" y="48" font-size="12" fill="#8b949e">caveman</text>
+  <rect x="392" y="38" width="12" height="12" rx="2" fill="#2da44e"/><text x="409" y="48" font-size="12" fill="#8b949e">ponytail</text>
+  <rect x="478" y="38" width="12" height="12" rx="2" fill="#8957e5"/><text x="495" y="48" font-size="12" fill="#8b949e">yagni-oneliner</text>
+
+  <text x="32" y="248" font-size="12" fill="#8b949e" text-anchor="middle" transform="rotate(-90 32 248)">% of baseline (lower is leaner)</text>
+  <line x1="85" y1="360" x2="815" y2="360" stroke="#8b949e" stroke-opacity="0.55"/>
+  <line x1="85" y1="305" x2="815" y2="305" stroke="#8b949e" stroke-opacity="0.16"/>
+  <line x1="85" y1="250" x2="815" y2="250" stroke="#8b949e" stroke-opacity="0.16"/>
+  <line x1="85" y1="195" x2="815" y2="195" stroke="#8b949e" stroke-opacity="0.16"/>
+  <line x1="85" y1="140" x2="815" y2="140" stroke="#8b949e" stroke-opacity="0.45" stroke-dasharray="4 4"/>
+  <text x="78" y="364" font-size="11" fill="#8b949e" text-anchor="end">0%</text>
+  <text x="78" y="309" font-size="11" fill="#8b949e" text-anchor="end">25%</text>
+  <text x="78" y="254" font-size="11" fill="#8b949e" text-anchor="end">50%</text>
+  <text x="78" y="199" font-size="11" fill="#8b949e" text-anchor="end">75%</text>
+  <text x="78" y="144" font-size="11" fill="#8b949e" text-anchor="end">100%</text>
+
+  <!-- LOC -->
+  <rect x="108" y="140" width="30" height="220" rx="2" fill="#8b949e"/><text x="123" y="135" font-size="10" fill="#8b949e" text-anchor="middle">100%</text>
+  <rect x="146" y="184" width="30" height="176" rx="2" fill="#d9822b"/><text x="161" y="179" font-size="10" fill="#d9822b" text-anchor="middle">80%</text>
+  <rect x="184" y="259" width="30" height="101" rx="2" fill="#2da44e"/><text x="199" y="254" font-size="10" font-weight="600" fill="#2da44e" text-anchor="middle">46%</text>
+  <rect x="222" y="213" width="30" height="147" rx="2" fill="#8957e5"/><text x="237" y="208" font-size="10" fill="#8957e5" text-anchor="middle">67%</text>
+  <text x="180" y="380" font-size="13" fill="#8b949e" text-anchor="middle">LOC</text>
+  <text x="180" y="395" font-size="10" fill="#8b949e" opacity="0.8" text-anchor="middle">base 191</text>
+
+  <!-- tokens -->
+  <rect x="288" y="140" width="30" height="220" rx="2" fill="#8b949e"/><text x="303" y="135" font-size="10" fill="#8b949e" text-anchor="middle">100%</text>
+  <rect x="326" y="125" width="30" height="235" rx="2" fill="#d9822b"/><text x="341" y="120" font-size="10" fill="#d9822b" text-anchor="middle">107%</text>
+  <rect x="364" y="188" width="30" height="172" rx="2" fill="#2da44e"/><text x="379" y="183" font-size="10" font-weight="600" fill="#2da44e" text-anchor="middle">78%</text>
+  <rect x="402" y="171" width="30" height="189" rx="2" fill="#8957e5"/><text x="417" y="166" font-size="10" fill="#8957e5" text-anchor="middle">86%</text>
+  <text x="360" y="380" font-size="13" fill="#8b949e" text-anchor="middle">tokens</text>
+  <text x="360" y="395" font-size="10" fill="#8b949e" opacity="0.8" text-anchor="middle">base 349k</text>
+
+  <!-- cost -->
+  <rect x="468" y="140" width="30" height="220" rx="2" fill="#8b949e"/><text x="483" y="135" font-size="10" fill="#8b949e" text-anchor="middle">100%</text>
+  <rect x="506" y="136" width="30" height="224" rx="2" fill="#d9822b"/><text x="521" y="131" font-size="10" fill="#d9822b" text-anchor="middle">102%</text>
+  <rect x="544" y="184" width="30" height="176" rx="2" fill="#2da44e"/><text x="559" y="179" font-size="10" font-weight="600" fill="#2da44e" text-anchor="middle">80%</text>
+  <rect x="582" y="188" width="30" height="172" rx="2" fill="#8957e5"/><text x="597" y="183" font-size="10" fill="#8957e5" text-anchor="middle">78%</text>
+  <text x="540" y="380" font-size="13" fill="#8b949e" text-anchor="middle">cost</text>
+  <text x="540" y="395" font-size="10" fill="#8b949e" opacity="0.8" text-anchor="middle">base $0.10</text>
+
+  <!-- time -->
+  <rect x="648" y="140" width="30" height="220" rx="2" fill="#8b949e"/><text x="663" y="135" font-size="10" fill="#8b949e" text-anchor="middle">100%</text>
+  <rect x="686" y="136" width="30" height="224" rx="2" fill="#d9822b"/><text x="701" y="131" font-size="10" fill="#d9822b" text-anchor="middle">102%</text>
+  <rect x="724" y="199" width="30" height="161" rx="2" fill="#2da44e"/><text x="739" y="194" font-size="10" font-weight="600" fill="#2da44e" text-anchor="middle">73%</text>
+  <rect x="762" y="206" width="30" height="154" rx="2" fill="#8957e5"/><text x="777" y="201" font-size="10" fill="#8957e5" text-anchor="middle">70%</text>
+  <text x="720" y="380" font-size="13" fill="#8b949e" text-anchor="middle">time</text>
+  <text x="720" y="395" font-size="10" fill="#8b949e" opacity="0.8" text-anchor="middle">base 69s</text>
+
+  <text x="20" y="418" font-size="11" fill="#8b949e" opacity="0.8">Each bar = that arm's mean as a % of the no-skill baseline (the gray 100% bars). Lower is leaner / cheaper / faster; caveman rises above 100% on tokens, cost and time. n=4.</text>
+
+  <line x1="20" y1="438" x2="815" y2="438" stroke="#8b949e" stroke-opacity="0.25"/>
+  <text x="20" y="460" font-size="11" fill="#8b949e" opacity="0.9">Safety, separate 6-task adversarial tier (path-traversal, SQLi, token forgery, malformed input, rate-limit). Higher is safer:</text>
+  <text x="90" y="478" font-size="12" fill="#8b949e">baseline 100%</text>
+  <text x="230" y="478" font-size="12" fill="#d9822b">caveman 100%</text>
+  <text x="370" y="478" font-size="12" font-weight="600" fill="#2da44e">ponytail 100%</text>
+  <text x="510" y="478" font-size="12" fill="#8957e5">yagni-oneliner <tspan fill="#cf222e" font-weight="600">95%</tspan> (dropped a guard once)</text>
+</svg>