@zalom/plastic 2.0.0-alpha.22 → 2.0.0-alpha.23

package/agents/plastic-enforcer.md

@@ -26,9 +26,12 @@ deliberately; the auto pipeline never dispatches them.
    2.0, intent 304): record the rulings, write `spec.md`, then `plan.md`, at least one real
    `actions/ACTION_N.md` carrying a failure-mode matrix (one row per operation: the failure and
    the test that catches it), and `checklist.md`. One consolidated `ACTION_1.md` by default,
-   never an empty `actions/`.
+   never an empty `actions/`. Every name given to a node, file, or field comes from the concept
+   family it lives under, graph engineering, the Plastic concepts coined on top of it, and the
+   software and AI engineering concepts those rest on; a gap is a design finding to raise, not
+   a word to coin.
 3. **Have the plan reviewed before code** - dispatch one adversarial plan reviewer on
-   `plastic-intent-executing`'s `plan-reviewer-prompt.md`; fold every finding into the spec, the
+   `plastic-intent-executing`'s `plan-reviewer-prompt.md`; merge every finding into the spec, the
    matrix, and the tests.
 4. **Dispatch one executor, tests first** - the executor commits the matrix's tests red, then
    builds, then drives the full suite green; you verify tick-versus-diff at the
@@ -50,7 +53,7 @@ dispatch call's model parameter, alongside the spawn-preamble live-state injecti
 
 1. Take the intent; record the rulings in `## Context` + `### Decisions`; write `spec.md`.
 2. Write `plan.md`, the action files with their matrix, and `checklist.md`; dispatch the plan
-   reviewer; fold the review.
+   reviewer; merge the review findings.
 3. Dispatch the executor through `plastic-intent-executing` with the whole consolidated action
    pasted in; require the red commit before the code and a green suite after it. Sequential,
    one team per intent, on one branch when files are shared.

package/agents/plastic-executor.md

@@ -65,3 +65,7 @@ verification, checklist deltas, deviations, blockers, insights) plus the executo
 - Safe-by-default: rename instead of drop, additive migrations, backups before destructive steps
 - One action at a time; do not batch unrelated changes into one step
 - Do not claim done until the full suite is green; show the final summary
+- Every test, file, and symbol you name comes from the same concept family: graph engineering,
+  the Plastic concepts coined on top of it, and the software and AI engineering concepts those
+  rest on; a name from outside that stack is refused, and a gap is a design finding to raise,
+  not a word to coin

package/agents/plastic-node-research.md

@@ -0,0 +1,28 @@
+---
+name: plastic-node-research
+description: |
+  Dispatched for a research node by Plastic's node-graph runner. Given the
+  packet path the dispatch line names, research the question it names by
+  reading the repository, and reply with the YAML return the dispatch line
+  names. Read-only: no Bash, no edit. Never spawned outside a runner
+  dispatch.
+tools:
+  - Read
+  - Glob
+  - Grep
+model: sonnet
+---
+
+You are one node in Plastic's node-graph runner: one packet in, one YAML return out, no diff.
+
+Read the packet the dispatch line names; it is your whole input. Research the question it names
+by reading the repository, never by running it. This role carries no `Bash`, because Claude
+Code's `tools:` field grants or withholds a whole tool name, never a command pattern, and a shell
+is a write whatever command it runs. `Read`, `Glob`, and `Grep` are enough to read every file the
+packet points at.
+
+A research node produces no diff. Put what you found in your return's `findings`, never in a code
+change.
+
+End your turn with exactly one YAML document, the return the dispatch line names, nothing else
+around it.

package/agents/plastic-node-verify.md

@@ -0,0 +1,27 @@
+---
+name: plastic-node-verify
+description: |
+  Dispatched for a verify node by Plastic's node-graph runner. Given the
+  packet path the dispatch line names, check the work it names by reading
+  the repository, and reply with the YAML return the dispatch line names.
+  Read-only: no Bash, no edit. Never spawned outside a runner dispatch.
+tools:
+  - Read
+  - Glob
+  - Grep
+model: opus
+---
+
+You are one node in Plastic's node-graph runner: one packet in, one YAML return out, no diff.
+
+Read the packet the dispatch line names; it is your whole input. Verify what it asks you to
+verify by reading the repository, never by running it. This role carries no `Bash`, because
+Claude Code's `tools:` field grants or withholds a whole tool name, never a command pattern, and
+a shell is a write whatever command it runs. `Read`, `Glob`, and `Grep` are enough to read every
+file the packet points at.
+
+A verify node produces no diff. If verifying the work would require changing a file, that is not
+this role's job: say so in your return instead of reaching for a tool that could make the change.
+
+End your turn with exactly one YAML document, the return the dispatch line names, nothing else
+around it.

package/agents/plastic-node-work.md

@@ -0,0 +1,32 @@
+---
+name: plastic-node-work
+description: |
+  Dispatched for a work node by Plastic's node-graph runner. Given the packet
+  path the dispatch line names, make the node's code changes inside the node
+  worktree, commit them there, and reply with the YAML return the dispatch
+  line names. Never spawned outside a runner dispatch.
+tools:
+  - Read
+  - Write
+  - Edit
+  - Bash
+  - Glob
+  - Grep
+model: sonnet
+---
+
+You are one node in Plastic's node-graph runner: one packet in, your files and your commit and
+one YAML return out.
+
+Read the packet the dispatch line names; it is your whole input. Make the changes it asks for,
+inside the worktree it names, and commit them there. Touch no file outside the packet's `files:`
+list, write to no other node's worktree, and write no ledger line yourself: the runner's own
+gates read your commit and your return, never your word.
+
+This `tools:` allowlist is a guardrail on tool names, not a sandbox on what `Bash` can do once
+granted. A shell can read, write, and reach the network the same as any of the other tools here,
+so `ruby -e File.write(...)` or a stray `curl` walks straight through it. The diff-scope check at
+`done` is the real backstop for what your commit is allowed to touch, not this list.
+
+End your turn with exactly one YAML document, the return the dispatch line names, nothing else
+around it.

package/bin/lib/context_budget.rb

@@ -87,7 +87,7 @@ module ContextBudget
 
   # What the harness loads at boot: every skill's name and description VALUES,
   # YAML-parsed. Not the raw frontmatter (that would count the keys and the
-  # operational fields), and not a line regex (that would truncate a folded
+  # operational fields), and not a line regex (that would truncate a flattened
   # description at its first line).
   def self.skill_catalog_bytes(repo:)
     skill_paths(repo: repo).sum do |path|

package/hooks/hooks.json

@@ -88,6 +88,18 @@
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook\" stop",
+            "statusMessage": ""
+          }
+        ]
+      }
     ]
   }
 }

package/hooks/statusline

@@ -187,6 +187,7 @@ FIELDS=$(printf '%s' "$INPUT" | awk '
     wanted["context_window.current_usage.cache_read_input_tokens"] = 1
     wanted["cost.total_cost_usd"] = 1
     wanted["rate_limits.five_hour.used_percentage"] = 1
+    wanted["rate_limits.five_hour.resets_at"] = 1
     wanted["rate_limits.seven_day.used_percentage"] = 1
   }
   { buf = buf $0 " " }
@@ -209,6 +210,7 @@ CU_CC=""
 CU_CR=""
 COST_RAW=""
 M5_PCT=""
+M5_RESETS=""
 M7_PCT=""
 
 while IFS=$'\t' read -r k v; do
@@ -224,6 +226,7 @@ while IFS=$'\t' read -r k v; do
     context_window.current_usage.cache_read_input_tokens) CU_CR="$v" ;;
     cost.total_cost_usd) COST_RAW="$v" ;;
     rate_limits.five_hour.used_percentage) M5_PCT="$v" ;;
+    rate_limits.five_hour.resets_at) M5_RESETS="$v" ;;
     rate_limits.seven_day.used_percentage) M7_PCT="$v" ;;
   esac
 done <<FIELDS_EOF
@@ -301,6 +304,31 @@ meter_seg() {   # $1 = label, $2 = raw percentage
 M5=$(meter_seg "5h" "$M5_PCT")
 M7=$(meter_seg "7d" "$M7_PCT")
 
+# --- Rate-limits cache for MeterWatch (graph.md D11) ---
+# Written only when the payload carries a meter at all; an API-key session
+# with no rate_limits section leaves the cache untouched. A present meter
+# with no matching value writes null rather than dropping the key, so
+# MeterWatch always sees the same three fields. Temp file in the cache
+# directory, then mv, so MeterWatch never reads a half-written file.
+if [ -n "$M5_PCT" ] || [ -n "$M7_PCT" ]; then
+  CACHE_DIR="$HOME/.plastic/.cache"
+  mkdir -p "$CACHE_DIR"
+  CACHE5=$(to_int "$M5_PCT")
+  CACHE7=$(to_int "$M7_PCT")
+  [ -z "$CACHE5" ] && CACHE5=null
+  [ -z "$CACHE7" ] && CACHE7=null
+  if [ -n "$M5_RESETS" ]; then
+    RESETS_JSON="\"$M5_RESETS\""
+  else
+    RESETS_JSON=null
+  fi
+  CACHE_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  CACHE_TMP="$CACHE_DIR/.rate-limits.json.tmp.$$"
+  printf '{"five_hour":%s,"seven_day":%s,"resets_at":%s,"at":"%s"}\n' \
+    "$CACHE5" "$CACHE7" "$RESETS_JSON" "$CACHE_AT" > "$CACHE_TMP"
+  mv "$CACHE_TMP" "$CACHE_DIR/rate-limits.json"
+fi
+
 # --- Session cost (stdin cost.total_cost_usd); hidden when it renders as $0.00 ---
 COST_SEG=""
 if [ -n "$COST_RAW" ]; then

package/hooks/stop

@@ -0,0 +1,5 @@
+#!/bin/bash
+INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+echo "$INPUT" | env -u RUBYOPT ruby "$SCRIPT_DIR/../scripts/hook-stop" "$HOME/.plastic"
+exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zalom/plastic",
-  "version": "2.0.0-alpha.22",
+  "version": "2.0.0-alpha.23",
   "description": "Intent-driven idea development system for AI coding agents",
   "type": "module",
   "bin": {

package/scripts/doctor.rb

@@ -29,6 +29,7 @@ require_relative "lib/lock"
 require_relative "lib/savepoint"
 require_relative "lib/node_ledger"
 require_relative "lib/ready_set"
+require_relative "lib/graph_measure_models"
 require_relative "lib/index_projection"
 require_relative "lib/agent_models"
 require_relative "lib/outcome_guard"
@@ -138,7 +139,7 @@ class Doctor
         --intent ID     Per-intent structure gate at intent-end (intent 222): one
                         closing intent only, never a store sweep. Pair with
                         --store <key> to disambiguate an id that collides across
-                        stores, and --disposition delivered|abandoned to fold in
+                        stores, and --disposition delivered|abandoned to include
                         the outcome.md disposition check. 3-state pass/warn/fail.
         -h, --help      Show this help
 
@@ -631,6 +632,15 @@ class Doctor
     # ReadySet's own require chain is 65,648 bytes, far past that budget.
     checks.concat(node_graph_checks(intent_dirs))
 
+    # model_requalification (D42, intent 343 G10 n7): a recorded model= that no
+    # longer matches what RunnerPolicy.model_for resolves for its role today
+    # means every measurement taken under the old model measured a different
+    # system. Lives here for the same reason node_graph_checks does: pins to
+    # test/doctor_core_split_test.rb's exact-set boot-path assertion, never
+    # doctor_core.rb (D11) - GraphMeasureModels' own require chain (NodeLedger,
+    # NodeFile, RunnerPolicy, AgentModels) is far past that file's byte budget.
+    checks.concat(model_requalification_checks(scopes: scopes))
+
     # unpromoted_rules (intent 341, G8, C37): an Insights entry tagged
     # `rule:` (via `insight-append --rule`) is a promise the rule will make
     # it into project doctrine. Advisory only.
@@ -982,14 +992,14 @@ def check_done_signals(scopes: nil)
   # rebuild-savepoint for most gaps, or knowingly excluded for the ones 219 D6 forbids ever
   # repairing (no real outcome.md to echo a disposition from). Three branches (spec D4/D5):
   # a malformed exclusion file can never report pass (loud), a clean remaining gap set reports
-  # pass with the exclusion count folded in, and a real remaining gap set stays warn, same as
-  # before intent 274, with the same count folded in when exclusions applied.
+  # pass with the exclusion count included, and a real remaining gap set stays warn, same as
+  # before intent 274, with the same count included when exclusions applied.
   #
-  # `dead_suffix` (intent 280) folds in a second, independent drift notice: exclusion rows that
+  # `dead_suffix` (intent 280) adds a second, independent drift notice: exclusion rows that
   # suppressed nothing this run. It is purely informational, exactly like `exclusion_suffix` - it
   # never changes status on any of the three branches below, because a stale governance-record row
   # is bookkeeping drift, not a store regression (219 D6 is untouched: no disposition is invented).
-  # Per rule (intent 308): savepoint_operational and backfilled_complete each fold in only
+  # Per rule (intent 308): savepoint_operational and backfilled_complete each include only
   # their own exclusions and dead rows, so one check never carries the other's counts.
   suffixes = lambda do |excluded_rows, dead|
     ex = excluded_rows.empty? ? "" : " (#{excluded_rows.size} excluded via #{exclusion_paths.join(", ")})"
@@ -1040,7 +1050,7 @@ def check_done_signals(scopes: nil)
   # backfilled_complete (intent 308): spec.md, plan.md, or a real action file missing on a
   # terminal intent. Same three branches as savepoint_operational: a malformed exclusion
   # file is always loud, a clean set passes with its own exclusion and dead-row counts
-  # folded in, a real gap set warns with the backfill verb as the fix.
+  # included, a real gap set warns with the backfill verb as the fix.
   backfill_hint = "Write the missing documents from the record via " \
                   "`scaffold-intent backfill --store <store> --id <id> --disposition " \
                   "<delivered|abandoned>` (never touches real content, one intent per invocation)."
@@ -1787,6 +1797,70 @@ end
     end
   end
 
+  # --- Check: re-qualification on model change (D42, intent 343 G10 n7) ---
+  #
+  # When the model behind a role changes, every measurement GraphMeasureModels
+  # took under the old model measured a different system, and the numbers
+  # need re-qualifying before anyone acts on them (D42). This warns, never
+  # fails (D10): a model change is routine, and a red doctor over it would
+  # train people to stop reading the report. The comparison itself is
+  # GraphMeasureModels' own (D16, via RunnerPolicy.model_for) - this method
+  # never re-derives it, it only names the drift rows GraphMeasureModels
+  # already computed.
+  #
+  # Runs once per discovered store (StoreDiscovery, shared with every other
+  # store-scoped check here), never per intent directory: GraphMeasureModels
+  # walks a whole store_dir itself in one pass. A store this process cannot
+  # read - or any other exception the store walk raises - is skipped, never
+  # fatal: one bad store must never take every other doctor check down with
+  # it.
+  #
+  # NEW-4 (v2 review, D22): this rule used to pass `project_config: {}` on
+  # purpose, reasoning there was no live project scope at doctor-run time -
+  # false: each discovered store DOES have a real sibling `config.yml`
+  # (`GraphMeasureModels.project_config_path`), the same file the `cohorts`
+  # verb resolves. Loading it here means the doctor and `cohorts` can never
+  # disagree about the same store's project-scope override again.
+  def model_requalification_checks(scopes: nil)
+    global_config = load_yaml_safe(File.join(plastic_home, "config.yml")) || {}
+    findings = []
+
+    store_discovery[:stores].each do |s|
+      next if scopes && !scopes.include?(s[:key])
+
+      project_config = load_yaml_safe(GraphMeasureModels.project_config_path(s[:store])) || {}
+      record = begin
+        GraphMeasureModels.read(s[:store], project_config: project_config, global_config: global_config)
+      rescue StandardError
+        next
+      end
+
+      %i[executor advisor].each do |role|
+        Array(record[:drift][role]).each do |row|
+          findings << "#{s[:key]}/#{row[:intent]}/#{row[:node]} (#{role}): recorded model=#{row[:recorded]}, " \
+                      "current config resolves #{row[:expected]} for kind #{row[:kind]} - re-qualify any " \
+                      "measurement taken while model=#{row[:recorded]} was in effect"
+        end
+      end
+    end
+
+    if findings.empty?
+      [check(
+        category: "conventions", name: "model_requalification", status: "pass",
+        message: "No recorded model= differs from what config resolves today for its role"
+      )]
+    else
+      [check(
+        category: "conventions", name: "model_requalification", status: "warn",
+        message: "#{findings.size} node(s) recorded a model that no longer matches the role's " \
+                 "config-resolved model",
+        details: findings, fixable: false,
+        fix_hint: "The old measurements were taken against a different model; re-qualify them under " \
+                  "the current model before acting on their numbers"
+      )]
+    end
+  end
+
   # --- Check: unpromoted rule: findings (intent 341, G8, C37) ---------------
   #
   # `insight-append --rule` tags an entry "... - rule: <text>". A tag is a

package/scripts/end-intent

@@ -287,7 +287,7 @@ end
 # Abandoned closes and machine-backfilled outcomes (the backfill marker) are
 # exempt: the reader cannot expect labels the writer never had.
 #
-# Intent 334 (G1, fold A3; post-execution review, blocking 2): the legacy
+# Intent 334 (G1, review A3; post-execution review, blocking 2): the legacy
 # "S3" label grammar applies only to actions/*.md headings, and the node id
 # grammar (kind prefix n/v/d/r plus digits, D1r) applies only to nodes/*.md
 # headings - never both over both directories. This repo's own house words
@@ -310,7 +310,7 @@ end
 # 339 S9 (D18): a node id counts as a label in an actions/*.md heading too,
 # but only when it stands alone as one of the heading's " - "-delimited
 # segments - this repo's own convention, "### S1 - n1 - Title" (this action
-# file's own headings, post-fold) or the bare "### n1 - Title". Never as a
+# file's own headings, post-merge) or the bare "### n1 - Title". Never as a
 # free word inside ordinary prose: the comment above ACTION_ID_LABEL_RE
 # records exactly why intent 334 restricted the node-id grammar to
 # nodes/*.md headings in the first place, and that reasoning does not change
@@ -342,7 +342,7 @@ def hollow_report_reason(intent_dir, disposition)
   # a node id ("n1", "v2", "d3", "r4"). A terse legacy close with no labeled
   # matrix stays report-and-proceed (intent 334, G1, D10r).
   #
-  # Every matching token per heading is kept, not just the first (fold A3):
+  # Every matching token per heading is kept, not just the first (review A3):
   # a legacy actions/ heading can carry BOTH an S-label and prose that reads
   # like a node id ("### The v2 rewrite (S3)"). Restricting the word-scan
   # node-id grammar to nodes/*.md headings (post-execution review, blocking

package/scripts/graph-measure

@@ -0,0 +1,249 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "json"
+require "yaml"
+require "date"
+require_relative "lib/savepoint"
+
+# graph-measure - the one read-only executable over the node ledger (intent
+# 343, G10, n2). A subcommand table over one library, following
+# scripts/runner's shape (327 spec): the public verbs are named up front even
+# before every module lands, a flag outside a verb's own vocabulary is
+# refused by name, and each verb's module is required LAZILY inside its own
+# branch so a verb whose module has not landed yet reports plainly instead of
+# taking `intent`, the verb an operator runs constantly, down with it.
+#
+# Usage:
+#   graph-measure <intent|budget|cohorts> <dir> [--format text|json]
+#
+# `intent` (n2) and `budget` (n4) take an INTENT directory. `cohorts` (n5,
+# its model section; n6 adds the rates, the latency and the bar to the same
+# verb) takes a STORE directory instead - the directory holding `id--slug/`
+# intent folders for one project - and is validated against that shape, not
+# `intent_directory?`.
+#
+# Exit codes:
+#   0 - a report rendered (anomalies never change this: a ledger with torn
+#       lines still renders, lists them, and exits 0)
+#   1 - the directory has no savepoint.md to measure at all, named
+#   2 - usage: no args, an unknown subcommand, an unknown flag, or the path
+#       is not the right shape for its verb (an intent directory for
+#       `intent`/`budget`, a store directory for `cohorts`)
+#   3 - the verb's module has not been delivered yet
+module GraphMeasureCLI
+  module_function
+
+  VERBS = %w[intent budget cohorts].freeze
+  SAVEPOINT_FILE = "savepoint.md"
+
+  # verb -> [[ModuleName, lib_file], ...], required lazily inside the verb's
+  # own branch (row 2.6). "budget" and "cohorts" name libraries n4 and n5
+  # ship; requiring them today raises LoadError, caught below.
+  LAZY_MODULES = {
+    "intent" => [["GraphMeasure", "graph_measure"], ["GraphMeasureReport", "graph_measure_report"]],
+    "budget" => [["GraphMeasureBudget", "graph_measure_budget"]],
+    "cohorts" => [["GraphMeasureModels", "graph_measure_models"], ["GraphMeasureCohorts", "graph_measure_cohorts"]],
+  }.freeze
+
+  KNOWN_FLAGS = {
+    "intent" => %w[--format],
+    "budget" => %w[--format],
+    "cohorts" => %w[--format],
+  }.freeze
+
+  # "intent" and "budget" take one intent directory; "cohorts" takes the
+  # store directory that holds many of them (row 5.15).
+  DIR_KIND = { "intent" => :intent, "budget" => :intent, "cohorts" => :store }.freeze
+
+  def usage
+    warn "Usage: graph-measure <#{VERBS.join('|')}> <dir> [--format text|json]"
+  end
+
+  def intent_directory?(dir)
+    dir && File.directory?(dir) && File.exist?(Savepoint.intent_file(dir))
+  end
+
+  def store_directory?(dir)
+    dir && File.directory?(dir)
+  end
+
+  def valid_dir?(verb, dir)
+    DIR_KIND.fetch(verb, :intent) == :store ? store_directory?(dir) : intent_directory?(dir)
+  end
+
+  def opt(args, name)
+    (i = args.index(name)) && args[i + 1]
+  end
+
+  def unrecognized_flag(verb, args)
+    allowed = KNOWN_FLAGS.fetch(verb, [])
+    args.find { |a| a.is_a?(String) && a.start_with?("--") && !allowed.include?(a) }
+  end
+
+  def main(argv)
+    args = argv.dup
+    verb = args.shift
+
+    unless verb
+      usage
+      return 2
+    end
+
+    unless VERBS.include?(verb)
+      warn "graph-measure: unknown subcommand #{verb.inspect}"
+      usage
+      return 2
+    end
+
+    dir_arg = args.shift
+    unless valid_dir?(verb, dir_arg && File.expand_path(dir_arg))
+      label = DIR_KIND.fetch(verb, :intent) == :store ? "not a store directory" : "not an intent directory"
+      warn "graph-measure: #{dir_arg.inspect} is #{label}"
+      usage
+      return 2
+    end
+    dir = File.expand_path(dir_arg)
+
+    bad_flag = unrecognized_flag(verb, args)
+    if bad_flag
+      warn "graph-measure: unknown flag #{bad_flag.inspect} for #{verb}"
+      usage
+      return 2
+    end
+
+    format = opt(args, "--format") || "text"
+    unless %w[text json].include?(format)
+      warn "graph-measure: unknown --format #{format.inspect} (use text or json)"
+      usage
+      return 2
+    end
+
+    run_lazy(verb, dir, format)
+  rescue StandardError => e
+    # Row 2.22: a malformed graph.md, a torn ledger, or invalid UTF-8 never
+    # raises out of GraphMeasure or GraphMeasureReport (both are built to
+    # resolve broken data to an anomaly, never an exception) - this is
+    # defence in depth so a defect in either never reaches the owner as a
+    # bare Ruby backtrace.
+    warn "graph-measure: internal error: #{e.message}"
+    1
+  end
+
+  def run_lazy(verb, dir, format)
+    LAZY_MODULES.fetch(verb, []).each { |(_name, file)| require_relative(File.join("lib", file)) }
+  rescue LoadError
+    warn "graph-measure: #{verb} is not yet delivered (its module has not landed)"
+    3
+  else
+    dispatch_lazy(verb, dir, format)
+  end
+
+  def dispatch_lazy(verb, dir, format)
+    case verb
+    when "intent"
+      run_intent(dir, format)
+    when "budget"
+      run_budget(dir, format)
+    when "cohorts"
+      run_cohorts(dir, format)
+    else
+      warn "graph-measure: #{verb}'s module loaded but no dispatcher is wired up yet"
+      3
+    end
+  end
+
+  # M1: the boundary's own config resolution, never GraphMeasureModels' or
+  # GraphMeasureCohorts' (spec D2, both modules' own DI convention). Mirrors
+  # scripts/doctor.rb's own `PLASTIC_HOME` fallback and `load_yaml_safe`
+  # shape exactly, so a missing or malformed config.yml/project.yml resolves
+  # to `{}` (the shipped-default chain), never an exception.
+  def plastic_home
+    ENV.fetch("PLASTIC_HOME") { File.join(Dir.home, ".plastic") }
+  end
+
+  def load_yaml_safe(path)
+    return {} unless path && File.exist?(path)
+
+    YAML.safe_load(File.read(path), permitted_classes: [Date, Time]) || {}
+  rescue StandardError
+    {}
+  end
+
+  def missing_savepoint(dir)
+    savepoint_path = File.join(dir, SAVEPOINT_FILE)
+    return nil if File.exist?(savepoint_path)
+
+    warn "graph-measure: #{savepoint_path} does not exist, nothing to measure"
+    savepoint_path
+  end
+
+  def run_intent(dir, format)
+    # Row 2.5: checked directly, ahead of GraphMeasure.read, which resolves a
+    # missing file to an empty (not absent) record by design (D3) - the CLI
+    # boundary is the only place that can still tell "nothing to measure"
+    # apart from "measured, and it is empty".
+    return 1 if missing_savepoint(dir)
+
+    record = GraphMeasure.read(dir)
+    puts format == "json" ? GraphMeasureReport.render_json(record) : GraphMeasureReport.render_text(record)
+    0
+  end
+
+  def run_budget(dir, format)
+    return 1 if missing_savepoint(dir)
+
+    record = GraphMeasureBudget.read(dir)
+    puts format == "json" ? GraphMeasureBudget.render_json(record) : GraphMeasureBudget.render_text(record)
+    0
+  end
+
+  # Row 2.5's "missing savepoint.md" check does not apply here: `dir` is a
+  # STORE directory (spec D1's "the directory holding id--slug/ intent
+  # folders"), which never carries a savepoint.md of its own.
+  #
+  # n6 adds the rates, the latency and the bar to this same verb, sourced
+  # from `GraphMeasureCohorts`. Its bar section reuses the one
+  # `GraphMeasureModels` walk's `qualified` counts (passed in here) rather
+  # than triggering a second store walk for the same numbers.
+  #
+  # M1 (v1 review): this call used to pass neither `project_config:` nor
+  # `global_config:`, so the model comparison always resolved against
+  # RunnerPolicy's shipped defaults only, never the real project-then-
+  # global-then-default chain the CHANGELOG describes and
+  # `scripts/doctor.rb`'s own `model_requalification_checks` actually reads.
+  # Reproduced: with a `plastic-executor:` override present in global
+  # config, `GraphMeasureModels.read` reports real drift rows while this
+  # verb (unpatched) always reported zero. `GraphMeasure`'s own modules stay
+  # config-free by design (D2's DI convention: they never read disk or ENV
+  # themselves) - this executable is the boundary that is allowed to, the
+  # same role `scripts/doctor.rb` already plays for the same two config
+  # files.
+  #
+  # NEW-4 (v2 review, D22): the project-scope half named `<store>/../project.yml`,
+  # a file whose template carries no `agents:` key at all, so a real
+  # operator override at the file that DOES exist in the wild - the store's
+  # sibling `config.yml` - was silently ignored. The path now comes from
+  # `GraphMeasureModels.project_config_path`, the one function
+  # `scripts/doctor.rb`'s own rule calls too, so the two commands cannot
+  # resolve a different file for the same store.
+  def run_cohorts(dir, format)
+    global_config = load_yaml_safe(File.join(plastic_home, "config.yml"))
+    project_config = load_yaml_safe(GraphMeasureModels.project_config_path(dir))
+
+    models_record = GraphMeasureModels.read(dir, project_config: project_config, global_config: global_config)
+    cohorts_record = GraphMeasureCohorts.read(dir, qualified: models_record[:qualified],
+                                                    project_config: project_config, global_config: global_config)
+    if format == "json"
+      combined = GraphMeasureModels.model(models_record).merge(GraphMeasureCohorts.model(cohorts_record))
+      puts JSON.generate(combined)
+    else
+      puts GraphMeasureModels.render_text(models_record)
+      puts GraphMeasureCohorts.render_text(cohorts_record)
+    end
+    0
+  end
+end
+
+exit GraphMeasureCLI.main(ARGV) if $PROGRAM_NAME == __FILE__

package/scripts/hook-capture

@@ -11,6 +11,7 @@
 
 require "json"
 require "open3"
+require "time"
 require "fileutils"
 require_relative "lib/session_ledger"
 require_relative "lib/dashboard_banner"