akm-cli 0.9.0-beta.9 → 0.9.0-rc.1

package/dist/commands/health/surfaces.js

@@ -0,0 +1,216 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * The remaining `surfaces` advisory group for `akm health` (meta-review 08).
+ * `stash-git-exposure` (08-F1) shipped first in ./stash-exposure.ts; this
+ * module adds the other four read-only checks the adjudication approved:
+ *
+ *   - `secret-file-perms`   — env/secret/backup files not 0600, dirs not 0700 (F4)
+ *   - `binary-config-skew`  — config.json written by a NEWER akm than this binary (F3)
+ *   - `orphan-stores`       — legacy config-backups dirs + 0-byte stash state.db decoy (F4/F7)
+ *   - `egress-endpoints`    — the remote-destination list, for eyeball diff (surfaces 3/9)
+ *
+ * Every collector is a pure projection over injected paths/config (no
+ * process.env reads) and is silent when there is nothing to report, matching
+ * the stash-exposure pattern. `egress-endpoints` is the one informational
+ * (pass-status) entry: it emits whenever any remote endpoint is configured.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { CURRENT_CONFIG_VERSION, compareConfigVersion } from "../../core/config/config-migration.js";
+const GROUP_OTHER_BITS = 0o077;
+const OFFENDER_EVIDENCE_CAP = 50;
+function modeOctal(mode) {
+    return (mode & 0o777).toString(8).padStart(3, "0");
+}
+/**
+ * `secret-file-perms` (08-F4): flag env/secret/backup files that are not 0600
+ * and their directories when not 0700. Scans `<stash>/env`, `<stash>/secrets`
+ * and `<cache>/config-backups`; anything readable by group/other is an
+ * offender. Silent when every path is tight (or none of the dirs exist).
+ */
+export function collectSecretPermsAdvisory(input, platform = process.platform) {
+    if (platform === "win32")
+        return undefined;
+    const roots = [
+        path.join(input.stashDir, "env"),
+        path.join(input.stashDir, "secrets"),
+        path.join(input.cacheDir, "config-backups"),
+    ];
+    const offenders = [];
+    for (const root of roots) {
+        let stat;
+        try {
+            stat = fs.statSync(root);
+        }
+        catch {
+            continue; // absent → nothing to protect
+        }
+        if ((stat.mode & GROUP_OTHER_BITS) !== 0)
+            offenders.push(`${root}/ (${modeOctal(stat.mode)}, want 700)`);
+        let entries;
+        try {
+            entries = fs.readdirSync(root, { recursive: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const abs = path.join(root, entry);
+            let entryStat;
+            try {
+                entryStat = fs.statSync(abs);
+            }
+            catch {
+                continue;
+            }
+            if ((entryStat.mode & GROUP_OTHER_BITS) === 0)
+                continue;
+            offenders.push(entryStat.isDirectory()
+                ? `${abs}/ (${modeOctal(entryStat.mode)}, want 700)`
+                : `${abs} (${modeOctal(entryStat.mode)}, want 600)`);
+        }
+    }
+    if (offenders.length === 0)
+        return undefined;
+    const preview = offenders.slice(0, 5).join("; ") + (offenders.length > 5 ? `; +${offenders.length - 5} more` : "");
+    return {
+        name: "secret-file-perms",
+        kind: "deterministic",
+        status: "warn",
+        confidence: "high",
+        message: `${offenders.length} env/secret/backup path(s) are readable by group/other: ${preview}. ` +
+            "Tighten with chmod 600 (files) / chmod 700 (dirs) — these hold tokens, keys, and config snapshots.",
+        evidence: { offenders: offenders.slice(0, OFFENDER_EVIDENCE_CAP) },
+    };
+}
+/**
+ * `binary-config-skew` (08-F3): warn when config.json carries a configVersion
+ * NEWER than (or unorderable against) this binary's CURRENT_CONFIG_VERSION —
+ * i.e. a newer/foreign akm wrote the shared config and this install is stale.
+ * That is exactly the state where auto-migration is skipped (downgrade
+ * protection) and the proven multi-install incident class begins. Silent for
+ * same/older versions (auto-migration handles those) and unreadable configs
+ * (config loading surfaces its own errors).
+ */
+export function collectConfigSkewAdvisory(configPath) {
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(configPath, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    const onDisk = raw.configVersion;
+    const order = compareConfigVersion(onDisk, CURRENT_CONFIG_VERSION);
+    const skewed = order === 1 || (onDisk !== undefined && order === undefined);
+    if (!skewed)
+        return undefined;
+    return {
+        name: "binary-config-skew",
+        kind: "deterministic",
+        status: "warn",
+        confidence: "high",
+        message: `config.json has configVersion ${JSON.stringify(onDisk)} but this binary knows ${CURRENT_CONFIG_VERSION} — ` +
+            "a newer akm wrote the shared config, so this install is stale and auto-migration is skipped " +
+            "(downgrade protection). Upgrade this install; do not keep a stale binary against the shared config/DBs.",
+        evidence: { onDiskConfigVersion: onDisk, binaryConfigVersion: CURRENT_CONFIG_VERSION },
+    };
+}
+/**
+ * `orphan-stores` (08-F4/F7): stores that look load-bearing but are dead —
+ * legacy `config-backups/` dirs in $DATA/$CONFIG (only `$CACHE/config-backups`
+ * is written and pruned today) and a 0-byte `<stash>/.akm/state.db` decoy that
+ * misleads debugging (the live state.db lives in the data dir). Read-only:
+ * this advisory NAMES them; removal stays an owner-approved per-path action.
+ */
+export function collectOrphanStoresAdvisory(input) {
+    const orphans = [];
+    for (const [label, dir] of [
+        ["legacy data-dir backup location", path.join(input.dataDir, "config-backups")],
+        ["legacy config-dir backup location", path.join(input.configDir, "config-backups")],
+    ]) {
+        try {
+            if (fs.statSync(dir).isDirectory())
+                orphans.push(`${dir}/ (${label}; live backups are in $CACHE/config-backups)`);
+        }
+        catch {
+            // absent — fine
+        }
+    }
+    const decoy = path.join(input.stashDir, ".akm", "state.db");
+    try {
+        const stat = fs.statSync(decoy);
+        if (stat.isFile() && stat.size === 0) {
+            orphans.push(`${decoy} (0-byte decoy; the live state.db is in the data dir)`);
+        }
+    }
+    catch {
+        // absent — fine
+    }
+    if (orphans.length === 0)
+        return undefined;
+    return {
+        name: "orphan-stores",
+        kind: "deterministic",
+        status: "warn",
+        confidence: "high",
+        message: `${orphans.length} orphan store(s) found: ${orphans.join("; ")}. ` +
+            "These are dead locations that mislead debugging/recovery — review and remove them (owner-approved, per-path).",
+        evidence: { orphans },
+    };
+}
+/**
+ * `egress-endpoints` (08 surfaces 3/9): the full list of remote destinations
+ * akm can talk to under the effective config — registries, remote sources,
+ * LLM endpoints, embedding endpoint — as one pass-status informational entry
+ * for eyeball diff against expectations. Silent only when nothing remote is
+ * configured at all.
+ */
+export function collectEgressAdvisory(config) {
+    if (!config)
+        return undefined;
+    const endpoints = [];
+    for (const reg of config.registries ?? []) {
+        if (reg.enabled === false || !reg.url)
+            continue;
+        endpoints.push(`registry ${reg.name ?? "(unnamed)"}: ${reg.url}`);
+    }
+    for (const source of config.sources ?? []) {
+        if (source.enabled === false || !source.url)
+            continue;
+        endpoints.push(`source ${source.name ?? "(unnamed)"} (${source.type ?? "?"}): ${source.url}`);
+    }
+    for (const [name, profile] of Object.entries(config.profiles?.llm ?? {})) {
+        if (!profile?.endpoint)
+            continue;
+        endpoints.push(`llm ${name}: ${profile.endpoint}`);
+    }
+    if (config.embedding?.endpoint)
+        endpoints.push(`embedding: ${config.embedding.endpoint}`);
+    if (endpoints.length === 0)
+        return undefined;
+    return {
+        name: "egress-endpoints",
+        kind: "deterministic",
+        status: "pass",
+        confidence: "high",
+        message: `${endpoints.length} remote endpoint(s) in the effective config (registries/sources/LLM/embedding) — ` +
+            "review the evidence list for unexpected destinations.",
+        evidence: { endpoints },
+    };
+}
+/**
+ * Aggregate the four collectors into the advisories array shape `akmHealth`
+ * consumes. Order is fixed: perms → skew → orphans → egress.
+ */
+export function collectSurfacesAdvisories(input) {
+    const results = [
+        collectSecretPermsAdvisory({ stashDir: input.stashDir, cacheDir: input.cacheDir }, input.platform ?? process.platform),
+        collectConfigSkewAdvisory(input.configPath),
+        collectOrphanStoresAdvisory({ dataDir: input.dataDir, configDir: input.configDir, stashDir: input.stashDir }),
+        collectEgressAdvisory(input.config),
+    ];
+    return results.filter((r) => r !== undefined);
+}

package/dist/commands/health/task-runs.js

@@ -0,0 +1,135 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { queryImproveRuns } from "../../storage/repositories/improve-runs-repository.js";
+import { queryCompletedTaskIntervals, queryTaskHistory } from "../../storage/repositories/task-history-repository.js";
+import { projectImproveRunSummary } from "./improve-metrics.js";
+/**
+ * Load task_history intervals for `task_id='akm-improve'` in the window.
+ * Returned sorted by startMs ascending so containment lookups can use a
+ * linear scan (typical N is ~24/day; not worth a tree).
+ *
+ * The window filter is widened by 5 minutes on each side because the cron
+ * task wraps `akm improve` — the task `started_at` fires at e.g. :07:01
+ * while `recordImproveRun` writes the matching `improve_runs.started_at`
+ * later (after config load, planning, etc.), so the improve_runs row can
+ * be inside the window even when its enclosing task_history row started
+ * just before the window opened.
+ */
+function loadTaskIntervals(db, since, until) {
+    const sinceMs = new Date(since).getTime();
+    const untilMs = until ? new Date(until).getTime() : Number.POSITIVE_INFINITY;
+    const widenedSince = new Date(sinceMs - 5 * 60 * 1000).toISOString();
+    const widenedUntil = Number.isFinite(untilMs) ? new Date(untilMs + 5 * 60 * 1000).toISOString() : undefined;
+    const rows = queryCompletedTaskIntervals(db, widenedSince, widenedUntil);
+    const intervals = [];
+    for (const row of rows) {
+        const startMs = new Date(row.started_at).getTime();
+        const endMs = new Date(row.completed_at).getTime();
+        if (!Number.isFinite(startMs) || !Number.isFinite(endMs) || endMs < startMs)
+            continue;
+        intervals.push({ startMs, endMs, durationMs: endMs - startMs });
+    }
+    return intervals;
+}
+/**
+ * Find the task_history interval that contains the given timestamp. The
+ * task wraps `akm improve`, so `improve_runs.started_at` (when
+ * `recordImproveRun` writes) always falls inside the enclosing task's
+ * [started_at, completed_at]. Returns undefined when no interval
+ * contains the timestamp (which happens for manually-invoked improve
+ * runs not driven by the `akm-improve` task).
+ *
+ * Linear scan because N is small. We tolerate a 1s slop on the upper
+ * bound to handle clock skew between the wrapper's `completed_at` write
+ * and recordImproveRun's `started_at` write.
+ */
+function findContainingTaskInterval(timestampMs, intervals) {
+    const SLOP_MS = 1000;
+    for (const interval of intervals) {
+        if (timestampMs >= interval.startMs && timestampMs <= interval.endMs + SLOP_MS) {
+            return interval;
+        }
+    }
+    return undefined;
+}
+/**
+ * Load `task_history` rows whose `task_id` begins `akm-improve` (the scheduled
+ * improve tasks: `akm-improve-frequent`, `akm-improve-proactive-weekly`, …) in
+ * the window, widened ±5 min so a task that fired just before the window opened
+ * still matches a run inside it. Used to attribute each improve run to the task
+ * that launched it.
+ */
+function loadImproveTaskRuns(db, since, until) {
+    const sinceMs = new Date(since).getTime();
+    const untilMs = until ? new Date(until).getTime() : undefined;
+    const widenedSince = new Date(sinceMs - 5 * 60 * 1000).toISOString();
+    const widenedUntil = untilMs !== undefined ? new Date(untilMs + 5 * 60 * 1000).toISOString() : undefined;
+    const runs = [];
+    for (const row of queryTaskHistory(db, { since: widenedSince, until: widenedUntil })) {
+        if (!row.task_id.startsWith("akm-improve"))
+            continue;
+        const startMs = new Date(row.started_at).getTime();
+        if (!Number.isFinite(startMs))
+            continue;
+        const endIso = row.completed_at ?? row.failed_at;
+        const endMs = endIso ? new Date(endIso).getTime() : Number.NaN;
+        runs.push({ taskId: row.task_id, startMs, endMs });
+    }
+    return runs;
+}
+/**
+ * Attribute an improve run to the scheduled task that launched it by matching
+ * start times within ±5 min, scored by start delta (plus end delta when both
+ * ends are known). Port of the health-report skill's `match_task_id`. Returns
+ * `"manual"` when no scheduled improve task matches.
+ */
+export function matchImproveTaskId(startedAt, completedAt, taskRuns) {
+    const startMs = new Date(startedAt).getTime();
+    if (!Number.isFinite(startMs))
+        return "manual";
+    const endMs = completedAt ? new Date(completedAt).getTime() : Number.NaN;
+    let best;
+    let bestScore = Number.POSITIVE_INFINITY;
+    for (const task of taskRuns) {
+        const startDelta = Math.abs(task.startMs - startMs);
+        if (startDelta > 5 * 60 * 1000)
+            continue;
+        let score = startDelta;
+        if (Number.isFinite(endMs) && Number.isFinite(task.endMs))
+            score += Math.abs(task.endMs - endMs);
+        if (score < bestScore) {
+            bestScore = score;
+            best = task.taskId;
+        }
+    }
+    return best ?? "manual";
+}
+export function buildPerRunSummaries(db, since, until) {
+    const rows = queryImproveRuns(db, since, until);
+    const taskIntervals = loadTaskIntervals(db, since, until);
+    const improveTaskRuns = loadImproveTaskRuns(db, since, until);
+    const summaries = [];
+    for (const row of rows) {
+        const startMs = new Date(row.started_at).getTime();
+        const endMs = new Date(row.completed_at).getTime();
+        // Prefer the improve_runs row's own (completed_at - started_at) delta:
+        // recordImproveRun now persists distinct start/end timestamps, so the
+        // row's own delta is the authoritative per-run wall time even for
+        // manually-invoked `akm improve` runs with no enclosing task_history.
+        // Only fall back to the task_history containing-interval join for legacy/
+        // backfill rows where started_at == completed_at (row delta is 0).
+        const hasRowDelta = Number.isFinite(startMs) && Number.isFinite(endMs) && endMs > startMs;
+        let wallTimeMs;
+        if (hasRowDelta) {
+            wallTimeMs = endMs - startMs;
+        }
+        else {
+            const interval = Number.isFinite(startMs) ? findContainingTaskInterval(startMs, taskIntervals) : undefined;
+            wallTimeMs = interval?.durationMs ?? 0;
+        }
+        const taskId = matchImproveTaskId(row.started_at, row.completed_at, improveTaskRuns);
+        summaries.push(projectImproveRunSummary(row, wallTimeMs, taskId));
+    }
+    return summaries;
+}

package/dist/commands/health/types.js

@@ -0,0 +1,26 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Lanes ratified as ENRICHMENT-ONLY: they may propose edits to existing
+ * assets (metadata, relations, content refresh) but must not mint new ones.
+ * New-asset generation belongs to the signal-gated minting lanes
+ * (extract/distill/memory-inference/recombine).
+ */
+export const ENRICHMENT_LANES = ["proactive", "high-salience", "high-retrieval", "signal-delta"];
+/** Minted share of enrichment-lane accepts that triggers a WARN advisory. */
+export const ENRICHMENT_MINTED_WARN_SHARE = 0.05;
+/** Minted share of enrichment-lane accepts that triggers a FAIL advisory. */
+export const ENRICHMENT_MINTED_FAIL_SHARE = 0.15;
+/**
+ * Cron task failure rate at or above which the `task-fail-rate` health advisory
+ * warns. 0.05 (5%) is the SAME threshold the HTML report already applies as its
+ * fail-rate pass/warn cutoff (`failOk = taskFailRate < 0.05` in
+ * src/commands/health/html-report.ts) — this constant makes it the single
+ * source so the advisory and the rendered badge cannot drift.
+ */
+export const TASK_FAIL_RATE_WARN = 0.05;
+/** Event type recorded on each completed improve run. */
+export const IMPROVE_COMPLETED_EVENT = "improve_completed";
+/** An active task older than this (ms) is treated as stuck. */
+export const ACTIVE_RUN_WARN_MS = 15 * 60 * 1000;

package/dist/commands/health/windows.js

@@ -0,0 +1,195 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Window handling for `akm health`: `--window-compare` / `--windows` parsing,
+ * per-window metric assembly, log-backing partition, and delta computation.
+ */
+import fs from "node:fs";
+import { UsageError } from "../../core/errors.js";
+import { readEvents } from "../../core/events.js";
+import { buildTaskRunId, getLoggedRunIds } from "../../core/logs-db.js";
+import { DURATION_UNITS, parseDuration } from "../../core/time.js";
+import { queryTaskHistory } from "../../storage/repositories/task-history-repository.js";
+import { buildImproveSkipSummary, computeWallTimeStats, parseTaskMetadata, roundRate, summarizeImproveCompleted, summarizeImproveRuns, } from "./improve-metrics.js";
+import { readLlmUsageAggregate } from "./llm-usage.js";
+import { computeDegradationMetrics, computeDenominatorFixedCoverage, readCalibration } from "./metrics.js";
+import { buildPerRunSummaries } from "./task-runs.js";
+import { ACTIVE_RUN_WARN_MS, IMPROVE_COMPLETED_EVENT, } from "./types.js";
+/**
+ * Parse a `--window-compare <duration>` shorthand into two adjacent windows
+ * (current, prior). Duration syntax matches {@link parseHealthSince}.
+ */
+export function resolveWindowCompare(duration, now = () => Date.now()) {
+    const trimmed = duration.trim();
+    // Canonical CLI unit grammar: `m` = minutes, `M` = months. Not lower-cased,
+    // so case distinguishes the two. See core/time.ts DURATION_UNITS.
+    const ms = parseDuration(trimmed, DURATION_UNITS);
+    if (ms === null) {
+        throw new UsageError("--window-compare must be a duration like '24h', '7d', or '30m'.", "INVALID_FLAG_VALUE");
+    }
+    if (ms <= 0) {
+        throw new UsageError("--window-compare must be a positive duration.", "INVALID_FLAG_VALUE");
+    }
+    const nowMs = now();
+    const currentSince = new Date(nowMs - ms).toISOString();
+    const currentUntil = new Date(nowMs).toISOString();
+    const priorSince = new Date(nowMs - 2 * ms).toISOString();
+    const priorUntil = currentSince;
+    return [
+        { name: "current", since: currentSince, until: currentUntil },
+        { name: "prior", since: priorSince, until: priorUntil },
+    ];
+}
+/**
+ * Parse a single repeatable `--windows` value of the form
+ * `name=...,since=...,until=...`. All keys are optional EXCEPT name and since.
+ */
+export function parseWindowSpec(raw) {
+    const fields = {};
+    for (const part of raw.split(",")) {
+        const trimmed = part.trim();
+        if (!trimmed)
+            continue;
+        const eq = trimmed.indexOf("=");
+        if (eq < 0) {
+            throw new UsageError(`--windows entry must be a comma-separated list of key=value pairs: ${raw}`, "INVALID_FLAG_VALUE");
+        }
+        const key = trimmed.slice(0, eq).trim();
+        const value = trimmed.slice(eq + 1).trim();
+        fields[key] = value;
+    }
+    if (!fields.name) {
+        throw new UsageError(`--windows entry is missing required 'name': ${raw}`, "INVALID_FLAG_VALUE");
+    }
+    if (!fields.since) {
+        throw new UsageError(`--windows entry is missing required 'since': ${raw}`, "INVALID_FLAG_VALUE");
+    }
+    return {
+        name: fields.name,
+        since: fields.since,
+        ...(fields.until ? { until: fields.until } : {}),
+    };
+}
+/** Hard-coded list of "interesting" metric paths for window-compare deltas. */
+export const INTERESTING_DELTA_PATHS = [
+    "improve.actions.reflect.failed",
+    "improve.actions.reflect.guardRejected",
+    "improve.actions.distill.llmFailed",
+    "improve.actions.distill.queued",
+    "improve.actions.distill.deferred",
+    "improve.consolidation.promoted",
+    "improve.memoryInference.written",
+    "improve.memoryInference.yieldRate",
+    "improve.memoryInference.skippedNoFacts",
+    "improve.memoryInference.htmlErrorCount",
+    "improve.graphExtraction.cacheHitRate",
+    "improve.graphExtraction.failures",
+    "improve.graphExtraction.htmlErrors",
+    "improve.graphExtraction.nonArrayBatchFailures",
+    "improve.sessionExtraction.sessionsScanned",
+    "improve.sessionExtraction.proposalsCreated",
+    "improve.autoAccept.promoted",
+    "improve.autoAccept.validationFailed",
+    "improve.wallTime.medianMs",
+    "improve.wallTime.p95Ms",
+];
+export function readNumericPath(obj, path) {
+    const parts = path.split(".");
+    let cursor = obj;
+    for (const part of parts) {
+        if (typeof cursor !== "object" || cursor === null)
+            return 0;
+        cursor = cursor[part];
+    }
+    return typeof cursor === "number" && Number.isFinite(cursor) ? cursor : 0;
+}
+export function computeDeltas(first, last) {
+    const out = {};
+    for (const path of INTERESTING_DELTA_PATHS) {
+        const from = readNumericPath(first, path);
+        const to = readNumericPath(last, path);
+        if (from === 0 && to === 0)
+            continue;
+        let pctChange;
+        if (from === 0) {
+            pctChange = to === 0 ? 0 : "+inf";
+        }
+        else {
+            pctChange = Number((((to - from) / from) * 100).toFixed(2));
+        }
+        out[path] = { from, to, pctChange };
+    }
+    return out;
+}
+/**
+ * Partition task_history rows into "should have a log" (non-null log_path) and
+ * "log is actually backed". A run counts as backed when logs.db holds rows for
+ * its run_id (#579 — the DB is the primary record); rows written before logs.db
+ * existed fall back to the transitional on-disk file check. `logsDb` may be
+ * undefined when logs.db could not be opened — then only the file check runs.
+ */
+export function partitionLogBackedRows(taskRows, logsDb) {
+    const withLogs = taskRows.filter((row) => row.log_path !== null);
+    const loggedRunIds = logsDb
+        ? getLoggedRunIds(logsDb, withLogs.map((row) => buildTaskRunId(row.task_id, row.started_at)))
+        : new Set();
+    const backed = withLogs.filter((row) => loggedRunIds.has(buildTaskRunId(row.task_id, row.started_at)) ||
+        (row.log_path !== null && fs.existsSync(row.log_path)));
+    return { withLogs, backed };
+}
+export function buildWindowMetrics(db, stateDbPath, since, until, now = () => Date.now(), logsDb) {
+    const taskRows = queryTaskHistory(db, { since }).filter((row) => {
+        const startMs = new Date(row.started_at).getTime();
+        const untilMs = new Date(until).getTime();
+        return !Number.isFinite(untilMs) || startMs < untilMs;
+    });
+    const { withLogs: taskRowsWithLogs, backed: existingLogRows } = partitionLogBackedRows(taskRows, logsDb);
+    const failedTaskRows = taskRows.filter((row) => row.status === "failed");
+    const activeRows = taskRows.filter((row) => row.status === "active");
+    const stuckActiveRuns = activeRows.filter((row) => now() - new Date(row.started_at).getTime() > ACTIVE_RUN_WARN_MS).length;
+    const promptRows = taskRows.filter((row) => row.target_kind === "prompt");
+    const promptFailures = promptRows.filter((row) => {
+        const detail = parseTaskMetadata(row).detail;
+        return typeof detail?.reason === "string" && detail.reason.length > 0;
+    });
+    const logBackingRate = taskRowsWithLogs.length === 0 ? 1 : existingLogRows.length / taskRowsWithLogs.length;
+    const taskFailRate = taskRows.length === 0 ? 0 : failedTaskRows.length / taskRows.length;
+    const agentFailureRate = promptRows.length === 0 ? 0 : promptFailures.length / promptRows.length;
+    const improveInvoked = readEvents({ since, type: "improve_invoked" }, { dbPath: stateDbPath }).events.filter((event) => new Date(event.ts ?? since).getTime() < new Date(until).getTime()).length;
+    const improveCompletedEvents = readEvents({ since, type: IMPROVE_COMPLETED_EVENT }, { dbPath: stateDbPath }).events.filter((event) => new Date(event.ts ?? since).getTime() < new Date(until).getTime());
+    const improveSkippedEvents = readEvents({ since, type: "improve_skipped" }, { dbPath: stateDbPath }).events.filter((event) => new Date(event.ts ?? since).getTime() < new Date(until).getTime());
+    const eventsMetrics = summarizeImproveCompleted(improveCompletedEvents);
+    const { metrics: improveSummary, runCount } = summarizeImproveRuns(db, since, until);
+    improveSummary.invoked = improveInvoked;
+    improveSummary.completed = eventsMetrics.completed;
+    const skipSummary = buildImproveSkipSummary(improveSkippedEvents);
+    improveSummary.skipped = skipSummary.skipped;
+    improveSummary.skipReasons = skipSummary.skipReasons;
+    // Preserve the per-phase aggregation computed by summarizeImproveRuns and
+    // derive top-level wall times from the same improve-runs window so counts
+    // and percentiles stay aligned with per-run reporting.
+    const perRunSummaries = buildPerRunSummaries(db, since, until);
+    const wallTimes = perRunSummaries.map((run) => run.wallTimeMs).filter((ms) => Number.isFinite(ms) && ms > 0);
+    improveSummary.wallTime = computeWallTimeStats(wallTimes, improveSummary.wallTime.byPhase);
+    improveSummary.calibration = readCalibration(db, since, until);
+    // WS-5: Compute denominator-fixed coverage from the most recent run's
+    // memorySummary (totalAssets = eligible + derived — the fixed denominator).
+    const totalAssets = improveSummary.memorySummary.eligible + improveSummary.memorySummary.derived;
+    improveSummary.coverage = computeDenominatorFixedCoverage(db, totalAssets, improveSummary.memorySummary.eligible, since, until);
+    // WS-5: Compute per-run degradation metrics (corpus diversity, merge fidelity,
+    // generation distribution, oracle spot-check). Health VIEWS only.
+    const degradation = computeDegradationMetrics(db, since, until);
+    if (degradation) {
+        improveSummary.degradation = degradation;
+    }
+    const metrics = {
+        taskFailRate: roundRate(taskFailRate),
+        agentFailureRate: roundRate(agentFailureRate),
+        stuckActiveRuns,
+        logBackingRate: roundRate(logBackingRate),
+        probeRoundTripMs: null,
+        llmUsage: readLlmUsageAggregate(stateDbPath, since, until),
+    };
+    return { improve: improveSummary, metrics, runs: runCount };
+}