@xhulz/nina 0.52.0 → 0.53.1

package/releases/0.53.1/surfaces/money/tree/.claude/patterns.md

@@ -0,0 +1,49 @@
+<!-- nina:slot money.1 -->
+
+---
+
+## Monetary values & percentages
+
+- **Money is an integer of the currency's minor unit**, end to end — {{MINOR_UNIT}}, never a float, never a type that can hold a fraction of one. Source of precision: `{{MONEY_MODULE}}`.
+- **Percentages are basis points** (`40% → 4000`, `100% → 10000`) so a distribution is exact without floating point.
+- **Parsing, formatting and percentage arithmetic live in one module and nowhere else.** A second place that turns a string into money is a second rounding rule, and the two will disagree on a value somebody is owed.
+- **Never** convert to a floating-point type before formatting, and never let a display format round a stored value.
+- Monetary database columns are integer. JSON responses serialize them as **strings**, not numbers, so no client parses them into a float. The service owns the conversion.
+
+<!-- nina:slot money.2 -->
+
+---
+
+## Distribution invariants (enforced by reviewer + unit tests)
+
+The distribution engine lives in `{{CORE_PKG}}`. It is pure and total over integer {{MINOR_UNIT}}:
+
+- A destination is either a percentage (basis points of the amount) or a fixed value.
+- `total = Σ destinations`, computed in {{MINOR_UNIT}}.
+- `total > amount` → **reject.** Never clamp, never distribute what is not there.
+- `total < amount` → **allow**, surface the shortfall, and leave the remainder **parked**. Silence is the defect here: an unexplained remainder is indistinguishable from a bug.
+- `total = amount` → OK.
+- A retention is just another destination — the same arithmetic applies to it, with no special case.
+
+<!-- nina:slot money.3 -->
+
+---
+
+## State machines & idempotency (enforced by reviewer)
+
+- **Every money-moving entity is a state machine.** Its states and legal transitions are declared in `.claude/architecture.md`; the code follows the declaration, not the other way round. Illegal transitions throw; they are never silently coerced.
+- **Every transition writes an audit row** (entity type, entity id, from, to, actor). No transition without a trail — the trail is what makes a money bug diagnosable after the money has moved.
+- **Outbound transfers are idempotent.** Each carries a unique key, and dedupe happens before the side effect, at the serialization point.
+- **One serialization point per balance.** Whatever computes and dispatches against a single balance never runs concurrently with itself. Two concurrent runs over one balance is how a double send happens even when every individual write is correct.
+
+<!-- nina:slot money.4 -->
+- **Money computation and dispatch go through the serialization point.** Routes, queue consumers and tools never run a distribution or a transfer synchronously in the request path.
+
+<!-- nina:slot money.5 -->
+- **The distribution engine lives in `{{CORE_PKG}}`.** Services call it as a pure function; they do not embed money logic inline.
+
+<!-- nina:slot money.6 -->
+- Idempotency on money-moving writes: the record carries an idempotency key, and the serialization point refuses the second attempt *before* the side effect.
+
+<!-- nina:slot money.7 -->
+- `{{CORE_PKG}}` is the most-tested package — pure functions over fixtures. Cover the distribution invariants exhaustively: over, under, exact, mixed percentage and fixed, and rounding.

package/releases/0.53.1/surfaces/money/tree/.claude/pipeline.md

@@ -0,0 +1,2 @@
+<!-- nina:slot money.1 -->
+  - **Money invariants respected** — a distribution never exceeds the amount; a shortfall is parked, not distributed; transfers idempotent; every transition audited.

package/releases/0.53.1/surfaces/money/tree/.claude/retrieval.md

@@ -0,0 +1,2 @@
+<!-- nina:slot money.1 -->
+| New distribution / transfer logic | `.claude/architecture.md` § *Money*, `.claude/patterns.md` § *Distribution invariants*, `{{CORE_PKG}}/` | architect → implementer → reviewer → qa |

package/releases/0.53.1/surfaces/money/tree/CLAUDE.md

@@ -0,0 +1,11 @@
+<!-- nina:slot money.1 -->
+3. **An outbound transfer is idempotent — it is NEVER sent twice.** Every transfer carries an idempotency key, and deduplication happens at a single serialization point **before** the side effect, never after it. A retry, a re-delivered queue message, a double-click and a replayed webhook must all collapse to one transfer. This is the highest-blast-radius invariant in the system: almost everything else can be corrected afterwards, and a duplicated transfer cannot.
+
+<!-- nina:slot money.2 -->
+4. **Conservation — what comes in equals what goes out plus what is retained.** A distribution may NEVER exceed the amount it distributes → **block**. If it is **less**, **alert** and leave the remainder **parked** and visible — never silently distributed, never silently absorbed. All arithmetic is integer {{MINOR_UNIT}}; percentages are basis points. The LLM never computes a monetary value.
+
+<!-- nina:slot money.3 -->
+5. **State-machine integrity.** Every money-moving entity has an explicit set of states and legal transitions, declared in `.claude/architecture.md` § *State machines* — not inferred from whatever code happens to exist. Only declared transitions are legal; an illegal one throws and is never silently coerced. **Every transition writes an audit row** (entity, id, from → to, actor, when). Skipping a state, inventing one, or landing a transition with no audit row is a hard reject.
+
+<!-- nina:slot money.4 -->
+- **money movement**: anything that creates, moves, settles or records a balance

package/releases/0.53.1/surfaces/pii/tree/.claude/agents/dba.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+- **Privacy.** No sensitive value in clear text where it must not be. The categories are declared in `.claude/architecture.md` § *Privacy* — they are not decided per query, and not decided by you. **Document bytes live only in the object store, referenced by key: the column holds the key, never the bytes.** Any column the architect's spec flagged for masking must be encrypted at rest. Reject a schema that widens what is stored in the clear.

package/releases/0.53.1/surfaces/pii/tree/.claude/agents/devops.md

@@ -0,0 +1,8 @@
+<!-- nina:slot pii.1 -->
+
+**Point it at an UNAUTHENTICATED route — a sign-in page is the right one.** Never sign in, and never
+screenshot a signed-in page. Accounts on deployed environments hold real personal data, and a
+screenshot or a console dump pulls it into agent transcripts and logs, where it persists and nobody
+ever looks for it again. That is a privacy leak with no upside here: the sign-in page proves
+everything this check is for. It renders from the same bundle, it exercises the same build-time env
+inlining (a missing variable blanks it identically), and it needs no session.

package/releases/0.53.1/surfaces/pii/tree/.claude/agents/reviewer.md

@@ -0,0 +1,8 @@
+<!-- nina:slot pii.1 -->
+- Check for privacy regressions: **no sensitive value in a log, an error message — a library's own included — a URL or a test fixture**, per the categories in `.claude/architecture.md` § *Privacy*; document bytes only in the object store, never plaintext in the database; no leaked secret.
+
+<!-- nina:slot pii.2 -->
+- **privacy** — the privacy check above, in full: no sensitive value in a log, an error message, a
+  URL or a test fixture; document bytes only in the object store; no leaked secret. Where
+  **tenant-and-privacy** is dispatched, its reviewer owns this too and there is no separate one; where
+  it is not, this is a dimension of its own. Either way it is never nobody's.

package/releases/0.53.1/surfaces/pii/tree/.claude/agents/secops.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+- **Privacy (Hard Rule #8)** — the categories declared in `.claude/architecture.md` § *Privacy* must never appear in logs, in responses that do not need them, in error paths, or in the database in clear text. Check every endpoint that returns a person's record for fields it includes by accident: a `select` that quietly grew a column is the usual way this leaks. Check the error paths too — they are written last and reviewed least — and what the libraries on them print or carry in their own errors, bound values included.

package/releases/0.53.1/surfaces/pii/tree/.claude/agents/solidity-auditor.md

@@ -0,0 +1,5 @@
+<!-- nina:slot pii.1 -->
+- **Nothing personal reaches the chain.** What is written on-chain is public, permanent, and beyond
+  deletion by anyone — including by you, and including after a subject asks. A hash of a personal
+  identifier is not a protection: it is a lookup table for whoever holds the input set. Reject a
+  personal datum stored in state, emitted in an event, or passed as calldata.

package/releases/0.53.1/surfaces/pii/tree/CLAUDE.md

@@ -0,0 +1,5 @@
+<!-- nina:slot pii.1 -->
+8. **Sensitive personal data is classified, and the classification is enforced.** What counts as sensitive here — identity documents, financial identifiers, anything a person would not expect to be readable by whoever can read a log — is declared in `.claude/architecture.md` § *Privacy*, along with the regime that governs it ({{PRIVACY_REGIME}}). Encrypted at rest. **No sensitive value in a log, an error message, a URL, an analytics event, or an agent transcript** — the places nobody thinks about are exactly the ones that persist. That includes what a library puts in its own errors and prints itself: a database client's error can carry the query and every bound value, and a framework can log a whole error past the logger it was given. A database error is mapped at the data layer to a typed error from a closed list before anything logs or returns it, and a test proves that a bound value it writes reaches no thrown error. Document bytes live only in the object store, referenced by key, never in the database in clear text.
+
+<!-- nina:slot pii.2 -->
+- **personal data**: where it is collected, stored, logged or sent

package/releases/0.53.1/surfaces/prisma/tree/.claude/agents/architect.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.53.1/surfaces/prisma/tree/.claude/agents/dba.md

@@ -0,0 +1,42 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-cli` | **before ANY `prisma` CLI command** — `validate`, `format`, `migrate dev`, `migrate diff`, `migrate deploy`. Flags differ between versions, and one of them (`migrate diff --shadow-database-url` against a live database) destroys the database it points at |
+| `prisma-client-api` | auditing a new or changed query — filters, operators, `$transaction` semantics. Through a driver adapter, cite the adapter's installed source for what a transaction does: the skill describes the default engine, and an adapter can roll back less |
+
+<!-- nina:slot prisma.2 -->
+Neither skill covers a **caching or edge layer sitting on top of the client** — cache strategy,
+edge-client behaviour and the rule about never caching a read that authorizes a write belong to that
+layer's own integration doc, declared like any other integration. A skill does not replace it.
+
+<!-- nina:slot prisma.3 -->
+- **With Prisma, both offline.** Run `pnpm --filter {{DB_PKG_NAME}} exec prisma validate`; it must pass. Then run `prisma migrate diff` in its **offline, file-only form** and read the generated SQL, not just the Prisma delta. Its flags changed in Prisma 7, so read the installed major (`prisma --version`) before writing the command:
+
+   ```
+   # Prisma 6. Compare the PREVIOUS schema against the working one — pure file-to-file, no database.
+   git show HEAD:{{DB_PKG}}/prisma/schema.prisma > /tmp/schema-head.prisma
+   pnpm --filter {{DB_PKG_NAME}} exec prisma migrate diff \
+     --from-schema-datamodel /tmp/schema-head.prisma \
+     --to-schema-datamodel prisma/schema.prisma \
+     --script
+   ```
+
+   From Prisma 7 the two flags are `--from-schema` and `--to-schema`, and the schema engine starts from the
+   datasource in `prisma.config.ts` even for this diff: with none there, it prints nothing and exits 0. For
+   SQLite a placeholder the diff never opens is enough, a `file:` URL under a gitignored directory; for any
+   other provider, find out what the diff opens before you give it one. Never a real database's URL. A first schema has nothing at `HEAD`: diff it `--from-empty`. Compare the output against the
+   hand-written `migration.sql` to confirm the declarative parts match.
+
+   ⚠️ **Do NOT reach for `--from-migrations`.** It looks like the natural choice and it is a trap:
+   Prisma refuses it without a shadow database (`--shadow-database-url`, or from Prisma 7 a
+   `shadowDatabaseUrl` in `prisma.config.ts`), which pushes you toward supplying a database URL — the exact move that destroys databases (below). The file-to-file form above answers the
+   same question with no database involved.
+
+   ⛔ **NEVER point `--shadow-database-url`, `--from-url`, `--to-url`, `--from-schema-datasource` — or, from Prisma 7, a `shadowDatabaseUrl` or the config datasource behind `--from-config-datasource` — at a real database, most of all not the one `{{SECRETS_LOCAL}}` names.** Prisma **executes** the entire migration history against whatever database those flags name, which **DESTROYS ALL DATA** in it. A shadow database must be a disposable, empty database and nothing else. It does not announce itself: the command completes with a reassuring "empty migration" result and no error, having already destroyed everything in the database it was pointed at. If the offline form above cannot answer your question, **STOP and report that to the orchestrator** instead of reaching for a database URL.
+
+<!-- nina:slot prisma.4 -->
+- **Where reads are cached through Prisma Accelerate,** every `findUnique` / `findMany` on a hot read path names its `cacheStrategy` (`ttl` / `swr`), and one that feeds a correctness-critical write names none.
+
+<!-- nina:slot prisma.5 -->
+- **On an edge runtime,** new Prisma code paths use the edge client of the installed major: `@prisma/client/edge` up to Prisma 6; from 7, the client the `prisma-client` generator writes with the platform's `runtime` set, imported from where it is generated — `@prisma/client/edge` fails there with `MODULE_NOT_FOUND`.
+
+<!-- nina:slot prisma.6 -->
+- Run a Prisma command that writes to a real database — `prisma migrate dev`, `migrate deploy`, `migrate reset`, `migrate resolve`, `db push`, `db execute`, `$executeRaw*` — or **any `prisma migrate diff` variant carrying a database URL**, which silently wipes the database it points at.

package/releases/0.53.1/surfaces/prisma/tree/.claude/agents/devops.md

@@ -0,0 +1,11 @@
+<!-- nina:slot prisma.1 -->
+- **`prisma-cli`** — before `migrate deploy` or any other Prisma CLI command against a real database.
+
+<!-- nina:slot prisma.2 -->
+- **Prisma migrations go out with `prisma migrate deploy`**, and nothing else changes a shared database's schema.
+
+<!-- nina:slot prisma.3 -->
+- Run `prisma migrate diff --shadow-database-url <url>` against any live database. It **executes** the migration history against that database, destroying everything in it, and reports success. Use a disposable shadow database or don't run it.
+
+<!-- nina:slot prisma.4 -->
+- Run `prisma migrate reset` against a shared database, ever.

package/releases/0.53.1/surfaces/prisma/tree/.claude/agents/implementer.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.53.1/surfaces/prisma/tree/.claude/agents/integration-tester.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-cli` | a Prisma CLI command |

package/releases/0.53.1/surfaces/prisma/tree/.claude/agents/reviewer.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.53.1/surfaces/prisma/tree/.claude/patterns.md

@@ -0,0 +1,15 @@
+<!-- nina:slot prisma.1 -->
+- **Database table/column names** (Prisma `@map` / `@@map`): `snake_case` in SQL, `camelCase` in TS.
+
+<!-- nina:slot prisma.2 -->
+- Where Prisma reads are cached through Accelerate, `cacheStrategy` lives in `{{DB_PKG}}`: services do not add, strip, or override cache policies.
+
+<!-- nina:slot prisma.3 -->
+
+### Prisma
+
+- Schema lives in `{{DB_PKG}}/prisma/schema.prisma`. Nowhere else.
+- **Never write raw SQL** unless justified in a code comment with perf data.
+- N+1 is solved with `include` / `select`, chosen deliberately.
+- Where reads are cached through Accelerate, every `findUnique` / `findMany` on a hot path defines its `cacheStrategy`, and no direct connection string is embedded in code.
+- Tests run a real Prisma client against a real database; the client is never mocked.

package/releases/0.53.1/surfaces/prisma/tree/CLAUDE.md

@@ -0,0 +1,5 @@
+<!-- nina:slot prisma.1 -->
+| Run any `prisma` CLI command (the database gate, devops, and the integration gate where there is one) | `prisma-cli` | flags differ between versions; `migrate diff --shadow-database-url` against a live DB wiped dev/staging once |
+
+<!-- nina:slot prisma.2 -->
+| Write or audit a Prisma query (architect, implementer, the database gate, reviewer) | `prisma-client-api` | filters, operators, `$transaction` semantics. a caching or edge layer on top of the client is **NOT covered** — its cache strategy belongs to that layer's own integration doc |

package/src/commands/dashboard.mjs

@@ -0,0 +1,33 @@
+/**
+ * `nina dashboard` — the office, the tasks, the pipeline, the pills, the learning cycle and the stats in one page on
+ * this machine, its address printed for a click (src/dashboard.mjs).
+ *
+ *   nina dashboard [--project <dir>] [--port <n>] [--open]
+ */
+
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { HARNESS } from '../paths.mjs';
+import { viewDashboard } from '../dashboard.mjs';
+
+/**
+ * Runs the command.
+ *
+ * @param {string[]} argv
+ * @param {{root: string}} ctx - CLI context.
+ * @returns {Promise<number>} Process exit code.
+ */
+export async function dashboard(argv, ctx) {
+  const arg = (flag) => (argv.includes(flag) ? argv[argv.indexOf(flag) + 1] ?? '' : null);
+  const target = resolve(arg('--project') ?? '.');
+  if (!existsSync(join(target, HARNESS, 'profile.json'))) {
+    console.error(`  no ${HARNESS}/profile.json under ${target} — run it inside a project, or name one with --project\n`);
+    return 1;
+  }
+  const port = arg('--port');
+  if (port !== null && !(/^\d+$/.test(port) && Number(port) <= 65535)) {
+    console.error(`  --port takes a port number, 0 to 65535, and was given ${port}\n`);
+    return 2;
+  }
+  return viewDashboard({ target, ctx, port: port === null ? undefined : Number(port), open: argv.includes('--open') });
+}

package/src/commands/learn.mjs

@@ -892,6 +892,49 @@ async function graduate(target, profile, layerRoot, known, which, here) {
   return 0;
 }
 
+/**
+ * Whether a project's pipeline is learning, link by link, as data: what `nina learn` prints, what its detector acts
+ * on, and what the dashboard's learning tab shows. Read from the store and the pills as they stand — `learn` takes a
+ * snapshot first, the dashboard does not, since the project's hooks take one every turn.
+ *
+ * @param {string} target - The project directory.
+ * @param {string} layerRoot - Its pinned release, which says whether the loop gate ships.
+ * @param {{surfaces?: string[]}} profile - The project's profile.
+ * @param {{days?: number, records?: object[], known?: Awaited<ReturnType<typeof lessons>>, report?: boolean}} [options] -
+ *   `report: false` reads only what the detector acts on: it runs every turn, and the rest — what was applied, what a
+ *   lesson changed, the gate's ledgers, the release's scripts — is the report's.
+ */
+export async function learningData(target, layerRoot, profile, { days = CAPTURE_DAYS, records, known, report = true } = {}) {
+  const rounds = records ?? (await recorded(target));
+  const pills = known ?? (await lessons(target));
+  // Who each loop-back sent work back to, read off the project's own graph.
+  const loops = loadProject(target)?.loops ?? null;
+  const owners = sentBackTo(rounds, loops);
+  const targets = loops ? new Set([...loops.values()].flatMap((byToken) => [...byToken.values()].flatMap((to) => [...to.keys()]))) : null;
+  const filed = await filedRequests(target);
+  const owed = { late: overdue(rounds, pills, new Date(), days, owners), filed, owed: undecided(pills, filed) };
+  if (!report) return owed;
+  const active = pills.filter((l) => !l.retired);
+  return {
+    ...owed,
+    days,
+    runs: new Set(rounds.map(runOf)).size,
+    rounds: rounds.length,
+    span: rounds.length ? [day(rounds[0].ts), day(rounds.at(-1).ts)] : null,
+    active,
+    ready: active.filter((l) => l.occurrences >= GRADUATION_AT),
+    open: filed.filter((r) => r.status === 'open'),
+    madeHere: filed.filter((r) => r.target === HERE).length,
+    relapses: relapsed(pills, filed),
+    use: applied(rounds, pills),
+    checks: verified(rounds, pills, { owners, targets }),
+    // The loops the lessons are about, as the gate counted them — beside the lessons, because a loop the
+    // gate held is a lesson waiting to be asked for.
+    activity: gateActivity(target, new Date(Date.now() - days * 86_400_000).toISOString()),
+    gated: (await shippedScripts(layerRoot, profile.surfaces ?? [])).has(GATE),
+  };
+}
+
 /**
  * Runs the learning report, the detector, or a graduation.
  *
@@ -943,13 +986,8 @@ export async function learn(argv, ctx) {
   }
   if (argv.includes('--close')) return close(target, argv[argv.indexOf('--close') + 1] ?? '');
 
-  // Who each loop-back sent work back to, read off the project's own graph.
-  const loops = loadProject(target)?.loops ?? null;
-  const owners = sentBackTo(records, loops);
-  const targets = loops ? new Set([...loops.values()].flatMap((byToken) => [...byToken.values()].flatMap((to) => [...to.keys()]))) : null;
-  const late = overdue(records, known, new Date(), days, owners);
-  const filed = await filedRequests(target);
-  const owed = undecided(known, filed);
+  const learning = await learningData(target, resolved.dir, profile, { days, records, known, report: !check });
+  const { late, filed, owed } = learning;
 
   if (check) {
     // During `nina upgrade --apply`: this is about history, not the move — see upgrade.mjs.
@@ -1048,17 +1086,13 @@ export async function learn(argv, ctx) {
     return 1;
   }
 
-  const active = known.filter((l) => !l.retired);
-  const ready = active.filter((l) => l.occurrences >= GRADUATION_AT);
-  const open = filed.filter((r) => r.status === 'open');
-  const use = applied(records, known);
-  const checks = verified(records, known, { owners, targets });
-  const span = records.length ? `${day(records[0].ts)} → ${day(records.at(-1).ts)}` : '';
+  const { active, ready, open, use, checks, activity, gated } = learning;
+  const span = learning.span ? `${learning.span[0]} → ${learning.span[1]}` : '';
 
   console.log(`\n  learning — core ${profile.core}\n`);
   console.log(
     records.length
-      ? `  observe   ${new Set(records.map(runOf)).size} run(s) in ${records.length} round(s) recorded, ${span}`
+      ? `  observe   ${learning.runs} run(s) in ${records.length} round(s) recorded, ${span}`
       : '  observe   ✗ nothing recorded — no transcripts found for this project, so no link below can be measured',
   );
   if (late.length === 0) console.log(`  capture   ✓ no role has looped back ${CAPTURE_AT}+ times without a lesson in the last ${days} days`);
@@ -1074,7 +1108,7 @@ export async function learn(argv, ctx) {
           `${use.listed} only listed the directory — measured since ${use.from}. Reading is not obeying; nothing here can see that.`
       : '  apply     not measured yet — runs recorded from now on say whether they read their pills',
   );
-  const madeHere = filed.filter((r) => r.target === HERE).length;
+  const { madeHere } = learning;
   console.log(
     `  graduate  ${ready.length} lesson(s) at ${GRADUATION_AT}+ occurrences · ${open.length} request(s) open` +
       (madeHere ? ` · ${madeHere} made a rule here` : '') +
@@ -1090,7 +1124,7 @@ export async function learn(argv, ctx) {
     );
   }
   for (const r of open) console.log(`            open since ${r.date}: ${r.pill} → ${r.target}. \`nina upgrade\` to the release that answers it closes it`);
-  for (const r of relapsed(known, filed)) {
+  for (const r of learning.relapses) {
     const shipped = `came back ${r.recurred} time(s) after ${ruleWent(r.request, false)}`;
     if (r.due) console.log(`            ✗ ${r.lesson.rel} ${shipped} — the rule did not hold; \`harness:check\` reopens it`);
     else console.log(`            · ${r.lesson.rel} ${shipped} — watched; it reopens at ${CAPTURE_AT}`);
@@ -1116,9 +1150,7 @@ export async function learn(argv, ctx) {
   }
   // The loops the lessons are about, as the gate counted them — beside the lessons, because a loop the
   // gate held is a lesson waiting to be asked for.
-  const since = new Date(Date.now() - days * 86_400_000).toISOString();
-  const activity = gateActivity(target, since);
-  if (!(await shippedScripts(resolved.dir, profile.surfaces ?? [])).has(GATE)) {
+  if (!gated) {
     console.log(`  loops     core ${profile.core} has no loop gate — the caps in .claude/graph.md are instructions`);
   } else if (!activity) {
     console.log('  loops     the gate has no ledger for this project — `nina gate --selftest` says whether it is wired');

package/src/commands/pills.mjs

@@ -336,43 +336,24 @@ export function validate(pill, text, roles, today) {
 }
 
 /**
- * `nina pills`.
+ * A project's pills, checked: what `nina pills` prints and the dashboard's pills tab shows — each pill's stage, status,
+ * count and trigger, and the problems and notes over the whole corpus. Null when the project has composed no agents.
  *
- * @param {string[]} argv - Command arguments; `--project <dir>` selects the target.
- * @param {{root: string}} [ctx] - CLI context; `root` is the NINA install directory.
- * @returns {Promise<number>} Process exit code.
+ * @param {string} target - The project.
+ * @param {{root?: string}} [ctx] - CLI context: where the layers are, to say where a recurring lesson belongs.
  */
-export async function pills(argv, ctx) {
-  const target = resolve(argv.includes('--project') ? argv[argv.indexOf('--project') + 1] : '.');
-  const quiet = argv.includes('--quiet');
+export async function pillsData(target, ctx) {
   const pillsDir = join(target, '.claude', 'pills');
   const agentsDir = join(target, '.claude', 'agents');
-
-  if (!existsSync(agentsDir)) {
-    console.error(`  no .claude/agents under ${target} — run \`nina compose\` first.\n`);
-    return 1;
-  }
+  if (!existsSync(agentsDir)) return null;
   const roles = (await readdir(agentsDir))
     .filter((f) => f.endsWith('.md'))
     .map((f) => f.replace(/\.md$/, ''))
     .sort();
-
   const today = new Date().toISOString().slice(0, 10);
-  if (argv.includes('--tidy')) {
-    const moved = await tidyRetired(target);
-    for (const m of moved) console.log(`  moved ${m} → ${RETIRED}/${m}`);
-    console.log(moved.length ? `\npills: ${moved.length} retired pill(s) moved where no agent opens them\n` : 'pills: no retired pill where agents read\n');
-    return 0;
-  }
   const files = existsSync(pillsDir) ? await pillFiles(pillsDir) : [];
 
-  // The directory itself is composed, so its presence says nothing. An empty corpus is the
-  // normal state of a new project and the suspicious state of an old one — say which, and
-  // leave the judgement to whoever knows how long the pipeline has been running.
-  if (files.length === 0) {
-    if (!quiet) console.log(`  no pill written yet under ${target} — either nothing has been learned the expensive way, or nothing was written down.\n`);
-    return 0;
-  }
+  if (files.length === 0) return { files: 0, active: 0, retired: 0, problems: [], notes: [], pills: [] };
   const problems = [];
   const notes = [];
   const active = [];
@@ -404,8 +385,21 @@ export async function pills(argv, ctx) {
   let resolved = 0;
   let cited = 0;
 
+  const each = [];
   for (const pill of files) {
     const result = validate(pill, await readFile(pill.path, 'utf8'), roles, today);
+    const f = result.fields ?? {};
+    each.push({
+      label: result.label,
+      status: f.status ?? null,
+      roles: list(f.applies_to),
+      occurrences: Number(f.occurrences ?? 1) || 1,
+      date: f.date ?? null,
+      last_seen: f.last_seen ?? null,
+      severity: f.severity ?? null,
+      trigger: f.trigger ?? null,
+      problems: result.problems.length,
+    });
     problems.push(...result.problems);
     notes.push(...result.notes);
     if (pill.dir && pill.dir !== 'shared' && pill.dir !== RETIRED) taught.add(pill.dir);
@@ -478,14 +472,47 @@ export async function pills(argv, ctx) {
   const dated = active.map((p) => p.date).filter(Boolean).sort();
   if (dated.length > 0) notes.push(`oldest active pill is ${dated[0]}, newest ${dated[dated.length - 1]}`);
 
+  return { files: files.length, active: active.length, retired, problems, notes, pills: each };
+}
+
+/**
+ * `nina pills`.
+ *
+ * @param {string[]} argv - Command arguments; `--project <dir>` selects the target.
+ * @param {{root: string}} [ctx] - CLI context; `root` is the NINA install directory.
+ * @returns {Promise<number>} Process exit code.
+ */
+export async function pills(argv, ctx) {
+  const target = resolve(argv.includes('--project') ? argv[argv.indexOf('--project') + 1] : '.');
+  const quiet = argv.includes('--quiet');
+  const agentsDir = join(target, '.claude', 'agents');
+
+  if (!existsSync(agentsDir)) {
+    console.error(`  no .claude/agents under ${target} — run \`nina compose\` first.\n`);
+    return 1;
+  }
+  if (argv.includes('--tidy')) {
+    const moved = await tidyRetired(target);
+    for (const m of moved) console.log(`  moved ${m} → ${RETIRED}/${m}`);
+    console.log(moved.length ? `\npills: ${moved.length} retired pill(s) moved where no agent opens them\n` : 'pills: no retired pill where agents read\n');
+    return 0;
+  }
+  const { files, active, retired, problems, notes } = await pillsData(target, ctx);
+  // The directory itself is composed, so its presence says nothing. An empty corpus is the
+  // normal state of a new project and the suspicious state of an old one — say which, and
+  // leave the judgement to whoever knows how long the pipeline has been running.
+  if (files === 0) {
+    if (!quiet) console.log(`  no pill written yet under ${target} — either nothing has been learned the expensive way, or nothing was written down.\n`);
+    return 0;
+  }
   if (!(quiet && problems.length === 0)) {
-    console.log(`  ${files.length} pill(s): ${active.length} active, ${retired} retired\n`);
+    console.log(`  ${files} pill(s): ${active} active, ${retired} retired\n`);
     for (const p of problems) console.log(`  ✗ ${p}`);
     for (const n of notes) console.log(`  · ${n}`);
     if (problems.length === 0 && notes.length === 0) console.log('  ✓ every pill is well formed, placed where it is read, and carries evidence');
     console.log(
       problems.length === 0
-        ? `\npills: all ${files.length} well formed${notes.length > 0 ? ` (${notes.length} note(s))` : ''}\n`
+        ? `\npills: all ${files} well formed${notes.length > 0 ? ` (${notes.length} note(s))` : ''}\n`
         : `\npills: ${problems.length} problem(s)\n`,
     );
   }

package/src/commands/pipeline.mjs

@@ -165,6 +165,54 @@ export function historyOf(records, since) {
   return byRole;
 }
 
+/**
+ * A composed pipeline, as data: what `nina pipeline` draws and the dashboard's pipeline tab shows — the line and where
+ * it ends, the gates, the stages that run as several agents, who sends work back to whom and how many rounds per
+ * issue, and each stage's model, effort, skills and what it ran since `since`; the project's own agents; and which
+ * chain each task shape takes. Null when the project has no composed graph.
+ *
+ * @param {string} dir - The project.
+ * @param {{since?: string}} [options] - The first day of the history each stage is measured over.
+ */
+export function pipelineData(dir, { since } = {}) {
+  const graphPath = join(dir, '.claude', 'graph.md');
+  if (!existsSync(graphPath)) return null;
+  const graphText = readFileSync(graphPath, 'utf8');
+  const graph = parseGraph(graphText);
+  const words = stageWords(graphText);
+  const shape = shapeOf(graph);
+  const claude = join(dir, 'CLAUDE.md');
+  const profile = readProfile(dir).profile ?? {};
+  const agentsDir = join(dir, '.claude', 'agents');
+  const specs = new Map();
+  for (const file of existsSync(agentsDir) ? readdirSync(agentsDir).filter((f) => f.endsWith('.md')).sort() : []) {
+    specs.set(file.replace(/\.md$/, ''), readFileSync(join(agentsDir, file), 'utf8'));
+  }
+  const from = since || localDay(new Date(Date.now() - HISTORY_DAYS * 86_400_000).toISOString());
+  const records = projectRecords(dir);
+  const history = records ? historyOf(records, from) : null;
+  return {
+    project: basename(dir),
+    core: profile.core ?? null,
+    surfaces: (profile.surfaces ?? []).slice().sort(),
+    graph,
+    line: shape.line,
+    ends: shape.ends,
+    gates: shape.gates,
+    many: [...(graph.many ?? new Map())].map(([stage, { when }]) => ({ stage, when })),
+    back: shape.back,
+    since: from,
+    measured: history !== null,
+    stages: [...graph.stages].map((stage) => {
+      const spec = specs.get(stage) ?? '';
+      const front = frontmatter(spec) ?? {};
+      return { stage, model: front.model ?? null, effort: front.effort ?? null, words: words.get(stage) ?? '', history: history?.get(stage) ?? null, skills: [...required(spec).skills].sort() };
+    }),
+    own: [...specs.keys()].filter((role) => !graph.stages.has(role)).map((role) => ({ role, description: (frontmatter(specs.get(role)) ?? {}).description ?? '' })),
+    shapes: existsSync(claude) ? chainsByShape(readFileSync(claude, 'utf8')) : [],
+  };
+}
+
 /**
  * Runs the command.
  *
@@ -200,12 +248,9 @@ export async function pipeline(argv) {
     }
     return viewOffice({ target: dir, wanted: arg('--session') || undefined, replay: argv.includes('--replay'), port: port === null ? undefined : Number(port), open: argv.includes('--open') });
   }
-  const graphText = readFileSync(graphPath, 'utf8');
-  const graph = parseGraph(graphText);
-  const words = stageWords(graphText);
-  const shape = shapeOf(graph);
-  const claude = join(dir, 'CLAUDE.md');
-  const shapes = existsSync(claude) ? chainsByShape(readFileSync(claude, 'utf8')) : [];
+  const data = pipelineData(dir, { since: arg('--since') || undefined });
+  const { graph, shapes } = data;
+  const shape = { line: data.line, ends: data.ends, gates: data.gates, back: data.back };
 
   // `--for`: one shape's chain, and only the stages on it.
   const query = arg('--for');
@@ -232,9 +277,7 @@ export async function pipeline(argv) {
   const padName = (s, n) => `${name(s)}${' '.repeat(Math.max(n - s.length, 1))}`;
 
   // A pipeline composed by hand draws all the same; only the header has less to say.
-  const profile = readProfile(dir).profile ?? {};
-  const surfaces = (profile.surfaces ?? []).slice().sort();
-  console.log(`  pipeline · ${basename(dir)}${profile.core ? ` · core ${profile.core}` : ''}${surfaces.length ? ` · surfaces ${surfaces.join(', ')}` : ''}`);
+  console.log(`  pipeline · ${data.project}${data.core ? ` · core ${data.core}` : ''}${data.surfaces.length ? ` · surfaces ${data.surfaces.join(', ')}` : ''}`);
 
   // The stages this drawing covers: all of them, or those the chosen shape's chain names.
   const onChain = chosen ? (chosen.chain.match(/[a-z][a-z-]*/g) ?? []).filter((w) => graph.stages.has(w)) : null;
@@ -300,30 +343,18 @@ export async function pipeline(argv) {
   }
 
   // Each stage: what it does, on which model and effort, with which skills, and what it did lately.
-  const agentsDir = join(dir, '.claude', 'agents');
-  const specs = new Map();
-  for (const file of existsSync(agentsDir) ? readdirSync(agentsDir).filter((f) => f.endsWith('.md')).sort() : []) {
-    specs.set(file.replace(/\.md$/, ''), readFileSync(join(agentsDir, file), 'utf8'));
-  }
-  const since = arg('--since') || localDay(new Date(Date.now() - HISTORY_DAYS * 86_400_000).toISOString());
-  const runs = projectRecords(dir);
-  const history = runs ? historyOf(runs, since) : null;
-  const stages = [...graph.stages].filter((s) => covered.has(s));
-  const col = Math.max(...stages.map((s) => s.length), 10) + 2;
-  console.log(`\n  ${dim(history ? `stages · what each ran since ${since}, from the measured history` : 'stages · no measured history for this project yet')}`);
-  for (const stage of stages) {
-    const spec = specs.get(stage) ?? '';
-    const front = frontmatter(spec) ?? {};
-    const on = [front.model, front.effort].filter(Boolean).join(' · ') || 'no spec';
-    console.log(`    ${padName(stage, col)}${on.padEnd(26)}${dim(fit(words.get(stage) ?? '', width - col - 32))}`);
-    if (history) {
-      const h = history.get(stage);
+  const stages = data.stages.filter((s) => covered.has(s.stage));
+  const col = Math.max(...stages.map((s) => s.stage.length), 10) + 2;
+  console.log(`\n  ${dim(data.measured ? `stages · what each ran since ${data.since}, from the measured history` : 'stages · no measured history for this project yet')}`);
+  for (const { stage, model, effort, words, history: h, skills } of stages) {
+    const on = [model, effort].filter(Boolean).join(' · ') || 'no spec';
+    console.log(`    ${padName(stage, col)}${on.padEnd(26)}${dim(fit(words, width - col - 32))}`);
+    if (data.measured) {
       const said = !h
         ? 'no run'
         : `${h.runs} run(s)${h.rounds > h.runs ? ` in ${h.rounds} rounds` : ''}${h.read === 0 ? ', no verdict read' : `, sent back ${h.back} of ${h.read} (${Math.round((100 * h.back) / h.read)}%)`}`;
       console.log(`    ${' '.repeat(col)}${dim('ran     ')}${said}`);
     }
-    const skills = [...required(spec).skills].sort();
     if (skills.length > 0) {
       const lines = [];
       let current = '';
@@ -341,12 +372,10 @@ export async function pipeline(argv) {
 
   if (!chosen) {
     // An agent the project wrote for itself is not a stage, and the graph does not route to it.
-    const own = [...specs.keys()].filter((role) => !graph.stages.has(role));
-    if (own.length > 0) {
+    if (data.own.length > 0) {
       console.log(`\n  ${dim("the project's own agents, outside the pipeline")}`);
-      for (const role of own) {
-        const front = frontmatter(specs.get(role)) ?? {};
-        console.log(`    ${role}${' '.repeat(Math.max(col - role.length, 2))}${dim(fit(front.description ?? '', width - col - 6))}`);
+      for (const { role, description } of data.own) {
+        console.log(`    ${role}${' '.repeat(Math.max(col - role.length, 2))}${dim(fit(description, width - col - 6))}`);
       }
     }
     if (shapes.length > 0) {