atris 3.74.22 → 3.74.23

package/bin/atris.js

@@ -669,7 +669,7 @@ function showHelpAll() {
   console.log('  land       - The landing: what is actually done vs still in the air; --reap backs up + clears overdue');
   console.log('  caretaker  - Classify open pull requests on origin (scan only; no fix, comment, or merge)');
   console.log('  drive      - One self-driving tick: mission doctor -> auto-fix -> count disengagements');
-  console.log('  rsi        - Read the Dream-RSI attempt ledger (trees, attempts, policy, dreams)');
+  console.log('  rsi        - Read the Dream-RSI attempt ledger; rsi loop ships notebook fixes with no mission');
   console.log(`  autoland   - Approve the policy once; ${require('../lib/autoland').certifiedWorkLandsPhrase(process.cwd())}, you keep irreversible calls`);
   console.log('  engine     - engine registry, answer validation, dispatch flights, and live progress');
   console.log('  link       - What two things could become together: one line, why, a first thing to make, who makes it');
@@ -2495,6 +2495,10 @@ if (command === 'guide') {
   Promise.resolve().then(() => require('../commands/balance').balanceCommand(process.argv.slice(3)))
     .then((code) => exitAfterStdoutDrain(typeof code === 'number' ? code : 0))
     .catch((err) => { console.error(String(err.message || err).replace(/\s+/g, ' ')); process.exit(1); });
+} else if (command === 'spend') {
+  // Spend guard: unattended Claude runs on paid models need a yes (2026-10-28, $900 day).
+  const code = require('../commands/spend').spendCommand(process.argv.slice(3));
+  exitAfterStdoutDrain(typeof code === 'number' ? code : 0);
 } else if (command === 'usage') {
   Promise.resolve().then(() => require('../commands/usage').usageCommand(process.argv.slice(3)))
     .then((code) => exitAfterStdoutDrain(typeof code === 'number' ? code : 0))

package/commands/improve.js

@@ -453,7 +453,7 @@ function collectImproveVitals(options = {}, deps = {}) {
     return fs.existsSync(plistPath);
   })();
   const installed = launchdInstalled || legacyCronInstalled;
-  const installNudge = installed ? null : 'the scheduled improve loop is off. turn it on: atris pulse install --model claude-sonnet-5';
+  const installNudge = installed ? null : 'the scheduled improve loop is off. turn it on: atris pulse install';
 
   const experimentsPath = path.join(root, '.atris', 'state', 'experiments-daily.json');
   const experiments = readJsonFile(experimentsPath, {});

package/commands/mission.js

@@ -9360,7 +9360,7 @@ function buildTickPrompt(mission, tickIndex, maxTicks, frozen, pings = [], cwd =
     `## Your task`,
     `Do ONE increment of work toward the stop condition. ONE. No more.`,
     `- ${memberIdentityLine(mission.owner)} Your member files are preloaded above; open atris/team/${mission.owner}/MEMBER.md only if that copy is marked truncated. Work in that identity, inside its scope and stop rules. Atris writes your member log from your receipt, so end the receipt with one \`learned: <one line>\` line instead of editing the log.`,
-    `- FIRST: inspect current mission/task state before acting. Read the relevant files, run \`atris mission status ${mission.id}\`, \`git status\`, or \`atris task list\` as needed so you know what's already done.`,
+    `- Start with the job: inspect the files or state directly relevant to the objective, then do the smallest useful action. Skip workspace boot and start-of-session routines, including brain activation, general Atris or task listings, and reading MAP, persona, or skill files solely for startup. Inspect mission or task state only if the job requires it.`,
     `- Pick the smallest concrete action that moves the mission forward.`,
     `- Before acting, state your single next move in one sentence.`,
     `- Edit / run / research as needed for the lane.`,
@@ -10082,6 +10082,16 @@ function engineHealthRoot(cwd) {
   return dir && path.basename(dir) === '.git' ? path.dirname(dir) : cwd;
 }
 
+function reviewerHealthRoot(engine) {
+  return path.join(require('../lib/state-home').atrisHome(), 'reviewer-health', engine);
+}
+
+function reviewerCooling(engine, registry) {
+  const saved = registry.readEngineRegistry(reviewerHealthRoot(engine), { persist: false })
+    .engines.find((entry) => entry.id === engine);
+  return saved?.health?.status === 'cooling' && !registry.engineReadyAt(saved);
+}
+
 // Every spelling and version of one model family counts as the same model,
 // with or without the long-context tag. Unknown counts as same.
 function reviewerMayBeSameModel(a, b) {
@@ -10109,12 +10119,12 @@ function engineVerifierLineup(mission, cwd, preferredEngine = '', options = {})
     const workerEngine = canonicalEngineName(mission?.runner) || 'claude';
     const workerModel = resolveMissionTickRunnerModel(mission);
     const team = registry.resolveEngineForRoleRanked('validator', root, { job: 'review', quiet: true }).team || [];
-    const backup = team.find((engine) => engine && engine.id !== primary
+    const backup = team.find((engine) => engine && engine.id !== primary && !reviewerCooling(engine.id, registry)
       && !(engine.id === workerEngine && reviewerMayBeSameModel(engine.roster_model, workerModel)));
     if (!backup) return lineup;
     lineup.push({ engine: backup.id, model: backup.roster_model || '' });
     const saved = registry.readEngineRegistry(root, { persist: false }).engines.find((engine) => engine.id === primary);
-    if (saved && !registry.engineReadyAt(saved)) lineup.shift();
+    if ((saved && !registry.engineReadyAt(saved)) || reviewerCooling(primary, registry)) lineup.shift();
   } catch {}
   return lineup;
 }
@@ -10134,7 +10144,7 @@ async function runEngineVerifier(mission, options = {}) {
         sessionId: crypto.randomUUID(),
         cwd,
         signal: options.signal,
-        timeoutMs: ENGINE_VERIFY_TIMEOUT_MS,
+        timeoutMs: options.timeoutMs || ENGINE_VERIFY_TIMEOUT_MS,
         prompt: buildEngineVerifyPrompt(mission, options.tickIndex || 1, missionDoneLooksLike(mission, cwd), {
           timeoutMs: ENGINE_VERIFY_TIMEOUT_MS,
           checkPassed: options.checkPassed || '',
@@ -10147,11 +10157,16 @@ async function runEngineVerifier(mission, options = {}) {
       restoreRunnerProfile();
     }
     verdict = engineVerifierResultFromRun(engineResult, engine);
+    if (engineResult?.ok && !engineResult?.timedOut && !engineResult?.aborted) {
+      try { setEngineHealth(engine, 'ready', healthRoot); } catch {}
+      try { setEngineHealth(engine, 'ready', reviewerHealthRoot(engine)); } catch {}
+    }
     if (verdict.mode !== 'engine-unavailable' || engineResult?.aborted) return verdict;
     // Member lab 10/26: codex hung on every review, and each job waited out
     // the full five minutes. Bench it so the next review starts on the backup.
     if (engineResult?.timedOut) {
       try { setEngineHealth(engine, 'cooling', healthRoot); } catch {}
+      try { setEngineHealth(engine, 'cooling', reviewerHealthRoot(engine)); } catch {}
     }
   }
   return verdict;
@@ -13007,6 +13022,7 @@ module.exports = {
   receiptLearnedLine,
   tickTouchedCheckDefinition,
   engineVerifierLineup,
+  runEngineVerifier,
   claudeRunnerMcpArgs,
   crystallizeMemberSkillLesson,
   listSiblingWorkspaceMissionHints,

package/commands/rsi.js

@@ -6,6 +6,8 @@
 // outcomes, the live policy id, and the last dream receipt. Read-only: it
 // never touches record.py, never writes state, and exits 0 even when the
 // workspace has no ledger yet.
+//
+// `atris rsi loop` ships notebook fixes with no mission queued (lib/rsi-loop.js).
 
 const fs = require('fs');
 const rsi = require('../lib/rsi-record');
@@ -114,8 +116,29 @@ Usage:
   atris rsi            same as status
   atris rsi status     trees + attempts by lane, last night's outcomes, policy, last dream
   atris rsi status --json   machine-readable status
+  atris rsi loop [--minutes M] [--json]
+                       find notebook fixes with no mission queued, verify, commit and
+                       push them on one reusable isolated branch (default budget 5 minutes)
+
+status is read-only. loop checks atris/ pages for line refs that point at
+moved code and for wording the slop rules can repair, commits each check
+that verifies, and pushes the branch. It removes the local branch and checkout
+only once the remote tip matches; the remote branch is reused on later runs.
+The budget is checked between steps and limits network operations.
+The main checkout is never edited.
+
+State lives in .atris/state/rsi/ (or $ATRIS_RSI_STATE); loop reports go to loops.jsonl there.`);
+}
 
-Read-only. State lives in .atris/state/rsi/ (or $ATRIS_RSI_STATE).`);
+async function runLoopCommand(args) {
+  const rsiLoop = require('../lib/rsi-loop');
+  const i = args.indexOf('--minutes');
+  const raw = i >= 0 ? String(args[i + 1] || '') : '';
+  const minutes = i < 0 ? undefined : (/^\d+(\.\d+)?$/.test(raw) ? Number(raw) : NaN);
+  const result = await rsiLoop.runLoop({ minutes, workspace: process.cwd() });
+  console.log(args.includes('--json') ? JSON.stringify(result) : rsiLoop.formatLoopReport(result));
+  if (result.refused) return 2;
+  return result.ok ? 0 : 1;
 }
 
 function run(argv = []) {
@@ -125,6 +148,7 @@ function run(argv = []) {
     return 0;
   }
   const sub = args[0] && !args[0].startsWith('-') ? args[0] : 'status';
+  if (sub === 'loop') return runLoopCommand(args.slice(1));
   if (sub !== 'status') {
     console.log(`unknown rsi subcommand: ${sub}`);
     showHelp();

package/commands/spend.js

@@ -0,0 +1,78 @@
+'use strict';
+
+const fs = require('fs');
+const guard = require('../lib/claude-spend-guard');
+
+function showSpendHelp() {
+  console.log('usage: atris spend guard [install|uninstall|status]');
+  console.log('       atris spend log [--limit N]');
+  console.log('');
+  console.log('The guard stops unattended Claude runs on paid models (anything but Haiku)');
+  console.log(`unless ${guard.APPROVAL_ENV}=<model> names the model for that run.`);
+  console.log('It also stops unattended runs that carry a pay-per-use Anthropic key.');
+  console.log('Interactive Claude sessions are never blocked.');
+}
+
+function printStatus(status) {
+  if (!status.readable) {
+    console.log(`guard: unknown, could not read ${status.settings}`);
+    return;
+  }
+  console.log(status.installed ? 'guard: on' : 'guard: off');
+  console.log(`settings: ${status.settings}`);
+  console.log(`hook: ${status.script}`);
+}
+
+function guardCommand(action = 'status') {
+  if (action === 'install') {
+    const status = guard.installGuard();
+    printStatus(status);
+    if (status.installed) {
+      console.log('Unattended Claude runs on paid models now need a yes on this computer.');
+    }
+    return status.installed ? 0 : 1;
+  }
+  if (action === 'uninstall') {
+    printStatus(guard.uninstallGuard());
+    return 0;
+  }
+  if (action === 'status') {
+    const status = guard.guardStatus();
+    printStatus(status);
+    return status.installed ? 0 : 1;
+  }
+  showSpendHelp();
+  return 1;
+}
+
+function logCommand(args) {
+  const i = args.indexOf('--limit');
+  const limit = i >= 0 ? Math.max(1, Number(args[i + 1]) || 20) : 20;
+  const file = guard.ledgerPath();
+  if (!fs.existsSync(file)) {
+    console.log('no guard decisions recorded on this computer.');
+    return 0;
+  }
+  const rows = fs.readFileSync(file, 'utf8').trim().split('\n').slice(-limit);
+  for (const line of rows) {
+    try {
+      const r = JSON.parse(line);
+      console.log(`${r.ts}  ${r.decision}  ${r.model}  ${r.job || ''}  ${r.cwd || ''}`.trimEnd());
+    } catch {}
+  }
+  return 0;
+}
+
+function spendCommand(args = []) {
+  const [sub, ...rest] = args;
+  if (!sub || sub === '--help' || sub === '-h' || sub === 'help') {
+    showSpendHelp();
+    return sub ? 0 : 1;
+  }
+  if (sub === 'guard') return guardCommand(rest[0] || 'status');
+  if (sub === 'log') return logCommand(rest);
+  showSpendHelp();
+  return 1;
+}
+
+module.exports = { spendCommand };

package/lib/claude-spend-guard.js

@@ -0,0 +1,288 @@
+'use strict';
+
+// Claude spend guard. On 2026-10-28 unattended jobs ran Opus and Fable models
+// in loops and billed about $900 of paid Claude usage in one day.
+//
+// The rule, enforced in two places:
+// 1. Our own launchers call checkClaudeSpend() before starting `claude`, and
+//    hand it claudeChildEnv() so the pay-per-use key never reaches it.
+// 2. `atris spend guard install` adds a Claude Code hook on this computer that
+//    applies the same rule to every unattended `claude` run, whatever script
+//    started it.
+//
+// Haiku runs freely. Any other Claude model in an unattended run needs the
+// owner's yes for that run: ATRIS_CLAUDE_SPEND_OK=<model>[,<model>].
+// A person typing in an interactive Claude session is never blocked.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const APPROVAL_ENV = 'ATRIS_CLAUDE_SPEND_OK';
+const KEY_OK_ENV = 'ATRIS_CLAUDE_KEY_OK';
+// Either of these moves a `claude` run from the plan login to metered billing.
+const PAID_KEY_VARS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'];
+const HOOK_MARK = 'claude-spend-guard';
+
+function home(env = process.env) {
+  return env.HOME || os.homedir();
+}
+
+function ledgerPath(env = process.env) {
+  return path.join(home(env), '.atris', 'spend', 'claude-guard.jsonl');
+}
+
+function isFreeModel(model) {
+  return /haiku/i.test(String(model || ''));
+}
+
+function approvedModels(env = process.env) {
+  return String(env[APPROVAL_ENV] || '')
+    .split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
+}
+
+function hasPaidKey(env = process.env) {
+  return PAID_KEY_VARS.some((name) => Boolean(env[name]));
+}
+
+// The model a `claude` run will use when no --model flag is given: the
+// ANTHROPIC_MODEL env var, then the user's settings, then the account default,
+// which on Max is Opus.
+function defaultClaudeModel(env = process.env) {
+  if (env.ANTHROPIC_MODEL) return env.ANTHROPIC_MODEL;
+  try {
+    const settings = JSON.parse(fs.readFileSync(path.join(home(env), '.claude', 'settings.json'), 'utf8'));
+    if (settings && typeof settings.model === 'string' && settings.model) return settings.model;
+  } catch {}
+  return 'default';
+}
+
+// `--model haiku` can be remapped by ANTHROPIC_DEFAULT_HAIKU_MODEL; judge the
+// model that actually runs.
+function resolveAlias(model, env = process.env) {
+  const alias = String(model).toLowerCase().replace(/\[1m\]$/, '');
+  const mapped = { opus: 'ANTHROPIC_DEFAULT_OPUS_MODEL', sonnet: 'ANTHROPIC_DEFAULT_SONNET_MODEL',
+    haiku: 'ANTHROPIC_DEFAULT_HAIKU_MODEL' }[alias];
+  return (mapped && env[mapped]) || model;
+}
+
+function record(entry, env = process.env) {
+  try {
+    const file = ledgerPath(env);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, JSON.stringify({ ts: new Date().toISOString(), host: os.hostname(), ...entry }) + '\n');
+  } catch {}
+}
+
+function blockMessage(model, job) {
+  const who = job ? `${job}: ` : '';
+  return `${who}${model} is a paid Claude model and this run is unattended. Haiku runs free. `
+    + `Get the owner's yes with a dollar estimate, then rerun with ${APPROVAL_ENV}=${model}.`;
+}
+
+// Decide whether an unattended Claude run may start.
+// Returns { ok, reason, message }. Never throws.
+function checkClaudeSpend({ model, job = '', env = process.env, checkKey = false, log = true } = {}) {
+  const resolved = resolveAlias(String(model || '').trim() || defaultClaudeModel(env), env);
+  if (checkKey && hasPaidKey(env) && env[KEY_OK_ENV] !== '1') {
+    const message = `${job ? `${job}: ` : ''}this unattended Claude run carries a pay-per-use key `
+      + `(${PAID_KEY_VARS.join(' or ')}). Unset it so the run uses the plan login.`;
+    if (log) record({ decision: 'blocked', reason: 'paid_key', model: resolved, job, cwd: process.cwd() }, env);
+    return { ok: false, reason: 'paid_key', model: resolved, message };
+  }
+  if (isFreeModel(resolved)) return { ok: true, reason: 'free_model', model: resolved };
+  if (approvedModels(env).includes(resolved.toLowerCase())) {
+    if (log) record({ decision: 'approved', model: resolved, job, cwd: process.cwd() }, env);
+    return { ok: true, reason: 'approved', model: resolved };
+  }
+  if (log) record({ decision: 'blocked', reason: 'paid_model', model: resolved, job, cwd: process.cwd() }, env);
+  return { ok: false, reason: 'paid_model', model: resolved, message: blockMessage(resolved, job) };
+}
+
+// A copy of env safe to hand a `claude` child: no pay-per-use key, so the run
+// bills the plan login. ATRIS_CLAUDE_KEY_OK=1 keeps the key (servers only).
+function claudeChildEnv(env = process.env) {
+  const out = { ...env };
+  if (out[KEY_OK_ENV] === '1') return out;
+  for (const name of PAID_KEY_VARS) delete out[name];
+  return out;
+}
+
+// ---- Claude Code hook --------------------------------------------------
+
+function processArgs(pid) {
+  try {
+    if (process.platform === 'linux') {
+      return fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').split('\0').filter(Boolean);
+    }
+    const line = execFileSync('ps', ['-o', 'args=', '-p', String(pid)], { encoding: 'utf8', timeout: 3000 }).trim();
+    return line ? line.split(/\s+/) : [];
+  } catch {
+    return [];
+  }
+}
+
+function parentPid(pid) {
+  try {
+    const out = execFileSync('ps', ['-o', 'ppid=', '-p', String(pid)], { encoding: 'utf8', timeout: 3000 }).trim();
+    const n = Number(out);
+    return Number.isInteger(n) && n > 1 ? n : 0;
+  } catch {
+    return 0;
+  }
+}
+
+function isClaudeArgv(argv) {
+  if (!argv.length) return false;
+  if (path.basename(argv[0]) === 'claude') return true;
+  return argv.slice(0, 3).some((a) => /claude-code|[\\/]claude$/.test(a));
+}
+
+// The argv of the `claude` process that ran this hook. Hooks run as direct
+// children of claude; walk a few levels up in case a shell sits between.
+function claudeArgv(startPid = process.ppid) {
+  let pid = startPid;
+  for (let i = 0; i < 4 && pid; i += 1) {
+    const argv = processArgs(pid);
+    if (isClaudeArgv(argv)) return argv;
+    pid = parentPid(pid);
+  }
+  return null;
+}
+
+function modelFromArgv(argv) {
+  let model = '';
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === '--model' && argv[i + 1]) model = argv[i + 1];
+    else if (argv[i].startsWith('--model=')) model = argv[i].slice('--model='.length);
+  }
+  return model;
+}
+
+// Unattended means print mode or an SDK run. A person's interactive session
+// reports CLAUDE_CODE_ENTRYPOINT=cli and has no -p flag.
+function isUnattended(argv, env = process.env) {
+  if (String(env.CLAUDE_CODE_ENTRYPOINT || '').startsWith('sdk')) return true;
+  return argv.includes('-p') || argv.includes('--print');
+}
+
+// Decide for the hook. Returns { block, message }.
+function hookDecision({ argv, env = process.env }) {
+  if (!argv || !isUnattended(argv, env)) return { block: false };
+  const verdict = checkClaudeSpend({ model: modelFromArgv(argv), job: 'claude spend guard', env, checkKey: true });
+  return verdict.ok ? { block: false } : { block: true, message: verdict.message };
+}
+
+function readStdin() {
+  try {
+    return fs.readFileSync(0, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+// Entry point for the UserPromptSubmit hook. Exit 2 stops the run before any
+// model call; anything unexpected fails open so a guard bug never breaks work.
+function hookMain() {
+  let event = {};
+  try { event = JSON.parse(readStdin() || '{}'); } catch {}
+  if (event.hook_event_name && event.hook_event_name !== 'UserPromptSubmit') return 0;
+  const decision = hookDecision({ argv: claudeArgv() });
+  if (!decision.block) return 0;
+  try { fs.writeSync(2, `${decision.message}\n`); } catch {}
+  return 2;
+}
+
+// ---- install into ~/.claude/settings.json ------------------------------
+
+function settingsPath(env = process.env) {
+  return path.join(home(env), '.claude', 'settings.json');
+}
+
+function hookScriptPath(env = process.env) {
+  return path.join(home(env), '.claude', 'hooks', `${HOOK_MARK}.js`);
+}
+
+function nodeBinary() {
+  for (const candidate of ['/opt/homebrew/bin/node', '/usr/local/bin/node', '/usr/bin/node']) {
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  return process.execPath;
+}
+
+function readSettings(file) {
+  if (!fs.existsSync(file)) return {};
+  const text = fs.readFileSync(file, 'utf8');
+  if (!text.trim()) return {};
+  return JSON.parse(text);
+}
+
+function guardEntries(settings) {
+  const groups = (settings.hooks && settings.hooks.UserPromptSubmit) || [];
+  return groups.filter((g) => (g.hooks || []).some((h) => String(h.command || '').includes(HOOK_MARK)));
+}
+
+function guardStatus(env = process.env) {
+  let settings = {};
+  let readable = true;
+  try { settings = readSettings(settingsPath(env)); } catch { readable = false; }
+  return {
+    installed: readable && guardEntries(settings).length > 0 && fs.existsSync(hookScriptPath(env)),
+    settings: settingsPath(env),
+    script: hookScriptPath(env),
+    readable,
+  };
+}
+
+function installGuard({ env = process.env, modulePath = __filename } = {}) {
+  const file = settingsPath(env);
+  const settings = readSettings(file); // throws on unparseable settings: never clobber them
+  // The hook is a copy of this file, so it keeps working if the CLI moves.
+  // Rerun install after a CLI update to pick up guard fixes.
+  const script = hookScriptPath(env);
+  fs.mkdirSync(path.dirname(script), { recursive: true });
+  fs.copyFileSync(modulePath, script);
+  fs.chmodSync(script, 0o755);
+  settings.hooks = settings.hooks || {};
+  const groups = settings.hooks.UserPromptSubmit || [];
+  const kept = groups.filter((g) => !guardEntries({ hooks: { UserPromptSubmit: [g] } }).length);
+  // First in line, so it runs before any hook that might spend.
+  settings.hooks.UserPromptSubmit = [
+    { hooks: [{ type: 'command', command: `${nodeBinary()} ${script}` }] },
+    ...kept,
+  ];
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.atris-tmp-${process.pid}`;
+  fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n');
+  fs.renameSync(tmp, file);
+  return guardStatus(env);
+}
+
+function uninstallGuard({ env = process.env } = {}) {
+  const file = settingsPath(env);
+  const settings = readSettings(file);
+  if (settings.hooks && settings.hooks.UserPromptSubmit) {
+    const kept = settings.hooks.UserPromptSubmit.filter((g) => !guardEntries({ hooks: { UserPromptSubmit: [g] } }).length);
+    if (kept.length) settings.hooks.UserPromptSubmit = kept;
+    else delete settings.hooks.UserPromptSubmit;
+    const tmp = `${file}.atris-tmp-${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n');
+    fs.renameSync(tmp, file);
+  }
+  try { fs.unlinkSync(hookScriptPath(env)); } catch {}
+  return guardStatus(env);
+}
+
+module.exports = {
+  APPROVAL_ENV,
+  checkClaudeSpend,
+  claudeChildEnv,
+  hookDecision,
+  guardStatus,
+  installGuard,
+  uninstallGuard,
+  ledgerPath,
+};
+
+if (require.main === module) process.exit(hookMain());

package/lib/engine-ask.js

@@ -7,6 +7,7 @@ const path = require('path');
 const { spawn, spawnSync } = require('child_process');
 const {
   DEFAULT_CLAUDE_RUNNER_MODEL,
+  applySpendGate,
   RUNNER_PROFILE_DEFS,
 } = require('./runner-command');
 const {
@@ -252,7 +253,9 @@ function resolveAskModel(engine, modelName = '') {
       : currentClaudeModel(requested);
   }
   if (engine !== 'claude' && engine !== 'fable' && engine !== 'haiku') return '';
-  return RUNNER_PROFILE_DEFS[engine]?.model || DEFAULT_CLAUDE_RUNNER_MODEL;
+  // No model named: this is the unattended default, so it goes through the
+  // spend gate. A model a person typed is their own yes.
+  return applySpendGate(RUNNER_PROFILE_DEFS[engine]?.model || DEFAULT_CLAUDE_RUNNER_MODEL);
 }
 
 // The effort flag as argv, from the same profile table the runners use
@@ -289,7 +292,7 @@ function buildReadOnlyEngineInvocation(engineName, prompt, modelName = '', {
       bin: profile.bin,
       args: [
         '-p', request,
-        '--model', model || profile.model || DEFAULT_CLAUDE_RUNNER_MODEL,
+        '--model', model || applySpendGate(profile.model || DEFAULT_CLAUDE_RUNNER_MODEL),
         ...effortArgs,
         '--tools', 'Read,Glob,Grep,WebSearch,WebFetch',
         '--permission-mode', 'plan',

package/lib/engine-validate.js

@@ -6,6 +6,7 @@ const os = require('node:os');
 const path = require('node:path');
 const {
   DEFAULT_CLAUDE_RUNNER_MODEL,
+  applySpendGate,
   RUNNER_PROFILE_DEFS,
 } = require('./runner-command');
 const { canonicalEngineName } = require('./engine-registry');
@@ -78,7 +79,7 @@ function refereeModel(engine) {
   const profile = RUNNER_PROFILE_DEFS[engine];
   if (!profile) return '';
   if (engine === 'claude' || engine === 'fable' || engine === 'haiku') {
-    return profile.model || DEFAULT_CLAUDE_RUNNER_MODEL;
+    return applySpendGate(profile.model || DEFAULT_CLAUDE_RUNNER_MODEL);
   }
   return profile.model || '';
 }

package/lib/known-commands.js

@@ -4,7 +4,7 @@ const knownCommands = ['init', 'guide', 'doctor', 'doc-health', 'install', 'work
                        'activate', '_activate', 'agent', 'team', 'chat', 'fast', 'ax', 'console', 'serve', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
                        'clean', 'close', 'harvest', 'verify', 'recover', 'search', 'scout', 'skill', 'member', 'codex-goal', 'app', 'apps', 'learn', 'lesson', 'taste', 'teach', 'plugin', 'experiments', 'bench', 'router', 'tree', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'watch', 'cloud', 'live', 'align', 'terminal', 'computer', 'diff', 'business', 'sync', 'youtube', 'x-search',
                        'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'decide', 'campaign', 'agents', 'probe', 'worktree', 'land', 'caretaker', 'autoland', 'drive', 'aeo', 'slop', 'voice', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'game', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail', 'scoreboard', 'sync-checkout', 'zen',
-                       'ci', 'github', 'vercel', 'supabase', 'linear', 'stripe', 'balance', 'usage', 'api-key', 'agent-client', 'topup', 'buy', 'transactions', 'hire', 'hires', 'mail', 'design', 'mcp', 'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
+                       'ci', 'github', 'vercel', 'supabase', 'linear', 'stripe', 'balance', 'usage', 'spend', 'api-key', 'agent-client', 'topup', 'buy', 'transactions', 'hire', 'hires', 'mail', 'design', 'mcp', 'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
                        'fork', 'browse', 'publish', 'pack', 'sleep', 'wake', 'feedback', 'errors', 'wiki', 'code-review', 'cr', 'soul', 'fleet', 'fleet-report', 'loops', 'self-improve', 'compile', 'spaceship', 'truth', 'sign', 'engine', 'engines', 'link', 'playbook', 'feed', 'brief', 'social', 'host', 'people', 'follow', 'unfollow', 'friends', 'msg', 'inbox', 'invite', 'join', 'rsi', 'pay', 'trust'];
 
 // Damerau-Levenshtein edit distance between two short strings. Counts an

package/lib/member-save-work.js

@@ -3,6 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const { TRAILER } = require('../commands/sign');
 
 // A member that passed its check but never committed leaves its work loose in
 // a side checkout that cleanup later deletes (member lab 2026-10-24: navigator
@@ -45,7 +46,7 @@ function saveLeftoverMemberWork({ worktreePath, member = 'member', objective = '
   const staged = stagedAll.filter((file) => !SECRET_PATH.test(file));
   if (!staged.length) return { saved: false, reason: 'nothing_left', ...(skipped.length ? { skipped } : {}) };
   const title = String(objective || '').split('\n').map((line) => line.trim()).find(Boolean) || 'finished work';
-  const message = `${member}: ${title.slice(0, 72)}\n\nSaved by atris after the check passed; the member left these changes uncommitted.`;
+  const message = `${member}: ${title.slice(0, 72)}\n\nSaved by atris after the check passed; the member left these changes uncommitted.\n\n${TRAILER}`;
   const commit = git(['commit', '-q', '-m', message], worktreePath);
   if (!commit.ok) return { saved: false, reason: 'commit_failed', files: staged };
   return { saved: true, files: staged, ...(skipped.length ? { skipped } : {}), sha: git(['rev-parse', 'HEAD'], worktreePath).stdout };

package/lib/roster-models.js

@@ -13,6 +13,7 @@ const {
   RUNNER_PROFILE_DEFS,
   RUNNER_PROFILE_ALIASES,
   DEFAULT_CLAUDE_RUNNER_MODEL,
+  applySpendGate,
 } = require('./runner-command');
 
 const CLAUDE_FAMILY = Object.freeze(['claude', 'fable', 'haiku']);
@@ -77,7 +78,8 @@ function engineRunsView(engineId, { model = '', effort = '' } = {}, options = {}
       view.model_source = 'codex settings';
     }
   } else if (CLAUDE_FAMILY.includes(id)) {
-    view.model = String(process.env.ATRIS_RUNNER_MODEL || '').trim() || def.model || DEFAULT_CLAUDE_RUNNER_MODEL;
+    // Shown as it really runs: the spend gate may have dropped it to the cheap model.
+    view.model = applySpendGate(String(process.env.ATRIS_RUNNER_MODEL || '').trim() || def.model || DEFAULT_CLAUDE_RUNNER_MODEL, { silent: true });
     view.model_source = 'atris default';
   } else if (ATRIS_PINNED.includes(id) && def.model) {
     view.model = def.model;

package/lib/rsi-loop.js

@@ -0,0 +1,353 @@
+'use strict';
+
+// atris rsi loop: find and ship notebook fixes with no mission queued.
+//
+// One run works on one isolated branch cut from the remote mainline. Built-in
+// checks find problems in the atris/ notebook and fix them with no engine:
+// line refs in the map docs that point at moved code, and plain-wording
+// repairs the slop rules can make safely. Each check is applied, kept inside
+// the allowed paths, verified, and committed on its own; a check that fails
+// its verify is undone. The run then pushes the branch within the time left.
+//
+// Cleanup happens only after delivery is proven: the remote branch tip equals
+// the checkout's HEAD and the checkout has no uncommitted changes. Any other
+// end keeps the checkout and branch, and the next run picks the branch up.
+// The main checkout is never edited, so its own uncommitted work is safe.
+//
+// Report: one atris.rsi.loop.v1 row per run in <rsi state>/loops.jsonl.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const rsi = require('./rsi-record');
+const mapRefs = require('./map-refs');
+const slop = require('../commands/slop');
+const worktree = require('../commands/worktree');
+
+const LOOP_SCHEMA = 'atris.rsi.loop.v1';
+const DEFAULT_MINUTES = 5;
+const MAX_MINUTES = 60;
+const OWNER = 'rsi';
+const JOB = 'notebook';
+const BRANCH_PREFIX = `codex/${OWNER}-${JOB}`;
+const MAX_WORDING_FILES = 10;
+const CO_AUTHOR = 'Co-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>';
+// The board and journal are rewritten by atris itself; team templates and
+// atris/CLAUDE.md ship to every user project and need a version bump.
+const OFF_LIMITS = /^atris\/(?:team\/|logs\/|TODO\.md$|CLAUDE\.md$)/;
+
+function allowedPath(file) {
+  return /^atris\/.+\.md$/.test(file) && !OFF_LIMITS.test(file);
+}
+
+function git(cwd, args, options = {}) {
+  return spawnSync('git', args, { cwd, encoding: 'utf8', killSignal: 'SIGKILL', ...options });
+}
+
+function gitOut(cwd, args) {
+  const r = git(cwd, args);
+  return r.status === 0 ? String(r.stdout || '').trim() : '';
+}
+
+// Changed paths in a checkout, untracked files listed one by one.
+function changedPaths(cwd) {
+  const r = git(cwd, ['status', '--porcelain=v1', '-z', '--untracked-files=all']);
+  if (r.status !== 0) return null;
+  return String(r.stdout || '').split('\0').filter(Boolean)
+    .map((entry) => ({ code: entry.slice(0, 2), file: entry.slice(3) }));
+}
+
+// Put back exactly what a check touched in the run's own checkout.
+function undo(wt, changes) {
+  for (const { code, file } of changes) {
+    if (code === '??') fs.rmSync(path.join(wt, file), { force: true });
+    else {
+      git(wt, ['reset', '-q', '--', file]);
+      git(wt, ['checkout', '--', file]);
+    }
+  }
+}
+
+function lockPath(root) {
+  return path.join(path.dirname(rsi.attemptsPath(root)), 'loop.lock');
+}
+
+function loopsPath(root) {
+  return path.join(path.dirname(rsi.attemptsPath(root)), 'loops.jsonl');
+}
+
+function alive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === 'EPERM';
+  }
+}
+
+// One loop per workspace. A lock whose process is gone is stale and is taken.
+function acquireLock(root, { pid = process.pid, host = os.hostname(), isAlive = alive } = {}) {
+  const file = lockPath(root);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const read = () => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      fs.writeFileSync(file, `${JSON.stringify({ pid, host, started_at: new Date().toISOString() })}\n`, { flag: 'wx' });
+      return {
+        ok: true,
+        release: () => {
+          const holder = read();
+          if (holder && holder.pid === pid && holder.host === host) fs.rmSync(file, { force: true });
+        },
+      };
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+    }
+    const holder = read();
+    if (holder && (holder.host !== host || isAlive(holder.pid))) return { ok: false, holder };
+    fs.rmSync(file, { force: true });
+  }
+  return { ok: false, holder: read() };
+}
+
+// Map docs: rewrite refs whose symbol moved to one clear line. Passes when no
+// moved ref is left and no more refs need a person than before.
+const mapRefsCheck = {
+  name: 'map_refs',
+  run(wt) {
+    const root = fs.realpathSync(wt);
+    const unsafe = mapRefs.existingMapDocs(wt).some((doc) => {
+      try {
+        const full = path.join(wt, doc);
+        return !fs.lstatSync(full).isFile() || !fs.realpathSync(full).startsWith(`${root}${path.sep}`);
+      } catch { return true; }
+    });
+    if (unsafe) throw new Error('map file is a symlink or outside the isolated checkout');
+    const before = mapRefs.checkMapDocs(wt);
+    const fixed = mapRefs.fixMapDocs(wt).changes.length;
+    return {
+      found: fixed,
+      message: `rsi: point ${fixed} notebook line ref${fixed === 1 ? '' : 's'} at the moved code`,
+      verify: () => {
+        const after = mapRefs.checkMapDocs(wt);
+        const left = (s) => s.ambiguous + s.missing + s.missing_file;
+        return after.moved === 0 && left(after) <= left(before);
+      },
+    };
+  },
+};
+
+// Wording: the slop rules' safe repairs on tracked notebook pages, a few
+// files per run. Passes when the edited lines scan clean.
+const wordingCheck = {
+  name: 'wording',
+  run(wt) {
+    const tracked = gitOut(wt, ['ls-files', '--', 'atris']).split('\n').filter(allowedPath).filter((file) => {
+      try {
+        const full = path.join(wt, file);
+        return fs.lstatSync(full).isFile() && fs.realpathSync(full).startsWith(`${fs.realpathSync(wt)}${path.sep}`);
+      } catch { return false; }
+    });
+    const rules = slop.RULES.concat(slop.loadProjectRules(wt));
+    const fixable = new Set(rules.filter((r) => typeof r.fix === 'function').map((r) => r.id));
+    const flagged = [...new Set(slop.scanPaths(tracked, { root: wt, rules }).findings
+      .filter((f) => fixable.has(f.rule)).map((f) => f.file))];
+    const { fixedFiles } = slop.applyFixes(flagged.slice(0, MAX_WORDING_FILES), rules);
+    return {
+      found: fixedFiles.length,
+      message: `rsi: plain wording in ${fixedFiles.length} notebook page${fixedFiles.length === 1 ? '' : 's'}`,
+      verify: () => slop.scanPaths(fixedFiles, { root: wt, changedLines: slop.gitChangedLines(false, wt) }).findings.length === 0,
+    };
+  },
+};
+
+const CHECKS = [mapRefsCheck, wordingCheck];
+
+// The newest kept run whose commits never reached the base, when its checkout
+// is gone or clean, so a cut-off run is finished instead of redone.
+function openCheckout(root, base) {
+  const branch = BRANCH_PREFIX;
+  const remoteRef = `refs/remotes/origin/${branch}`;
+  const remoteHead = gitOut(root, ['rev-parse', '--verify', remoteRef]);
+  const localHead = gitOut(root, ['rev-parse', '--verify', `refs/heads/${branch}`]);
+  // Never overwrite an existing local branch. Resume only our clean checkout.
+  const checkout = worktree.listWorktrees(root).find((wt) => wt.branch === branch);
+  if (checkout) {
+    const changes = changedPaths(checkout.path);
+    if (!changes || changes.length) return { error: 'RSI checkout contains uncommitted work; preserve it and resolve it before retrying' };
+  }
+  const start = localHead || remoteHead || base;
+  if (remoteHead && git(root, ['merge-base', '--is-ancestor', remoteHead, start]).status !== 0) {
+    return { error: 'local RSI branch does not contain the remote RSI branch; resolve the divergence before retrying' };
+  }
+  // Do not silently omit changes from the current mainline.
+  if (git(root, ['merge-base', '--is-ancestor', base, start]).status !== 0) {
+    return { error: 'RSI branch is behind or diverged from the remote mainline; integrate it before retrying' };
+  }
+  if (checkout) return { branch, wt: checkout.path, resumed: true };
+  const wt = path.join(path.dirname(root), '.agent-worktrees', path.basename(root), 'rsi-notebook');
+  const args = localHead ? ['worktree', 'add', wt, branch] : ['worktree', 'add', '-b', branch, wt, start];
+  const added = git(root, args);
+  if (added.status !== 0) return { error: String(added.stderr || 'worktree add failed').trim() };
+  return { branch, wt, resumed: Boolean(localHead || remoteHead), error: null };
+}
+
+// Remove the checkout and local branch. Plain removal refuses a checkout with
+// changes, so nothing unsaved is ever lost here.
+function cleanup(root, wt, branch) {
+  if (git(root, ['worktree', 'remove', wt]).status !== 0) return false;
+  return git(root, ['branch', '-D', branch]).status === 0;
+}
+
+/**
+ * Run the notebook checks and ship them within opts.minutes. deps can replace
+ * now, checks, and isAlive for tests. Returns the report row plus
+ * report_path, or { ok: false, refused } when the run does not start.
+ */
+async function runLoop(opts = {}, deps = {}) {
+  const root = path.resolve(opts.workspace || process.cwd());
+  const clock = deps.now || Date.now;
+  const checks = deps.checks || CHECKS;
+  const minutes = opts.minutes === undefined ? DEFAULT_MINUTES : opts.minutes;
+  if (!(typeof minutes === 'number' && minutes > 0 && minutes <= MAX_MINUTES)) {
+    return { ok: false, refused: `--minutes must be a number above 0 and at most ${MAX_MINUTES}` };
+  }
+  if (process.env[rsi.GUARD_ENV]) return { ok: false, refused: 'an rsi attempt is already open in this process; a loop inside it would nest' };
+  if (!gitOut(root, ['rev-parse', '--verify', 'HEAD'])) return { ok: false, refused: 'not a git checkout with a commit' };
+  if (!gitOut(root, ['remote', 'get-url', 'origin'])) return { ok: false, refused: 'no origin remote to push the fixes to' };
+  const lock = acquireLock(root, { isAlive: deps.isAlive || alive });
+  if (!lock.ok) {
+    const h = lock.holder || {};
+    return { ok: false, refused: `another rsi loop holds this workspace (pid ${h.pid || '?'} on ${h.host || '?'})` };
+  }
+
+  const startedMs = clock();
+  const deadline = startedMs + minutes * 60000;
+  const left = () => deadline - clock();
+  const row = {
+    schema: LOOP_SCHEMA,
+    started_at: new Date(startedMs).toISOString(),
+    max_minutes: minutes,
+    branch: null,
+    resumed: false,
+    checks: [],
+    commits: 0,
+    pushed_sha: null,
+    delivered: false,
+    cleaned: false,
+    kept: null,
+    stop_reason: null,
+  };
+  try {
+    await shipOnce(root, row, { checks, left, now: clock });
+  } catch (error) {
+    row.stop_reason = row.stop_reason || 'error';
+    row.error = String((error && error.message) || error);
+  } finally {
+    lock.release();
+  }
+  row.finished_at = new Date(clock()).toISOString();
+  row.ok = ['delivered', 'nothing_to_do'].includes(row.stop_reason);
+  const reportPath = loopsPath(root);
+  fs.mkdirSync(path.dirname(reportPath), { recursive: true });
+  fs.appendFileSync(reportPath, `${JSON.stringify(row)}\n`, 'utf8');
+  return { ...row, report_path: reportPath };
+}
+
+async function shipOnce(root, row, { checks, left, now }) {
+  if (left() <= 0) { row.stop_reason = 'time_budget'; return; }
+  const fetched = git(root, ['fetch', '-q', 'origin'], { timeout: Math.max(1, Math.min(30000, left())), env: worktree.gitNetworkEnvironment(process.env, root) });
+  if (fetched.status !== 0) { row.stop_reason = 'fetch_failed'; row.error = String(fetched.stderr || fetched.error || 'fetch failed').trim(); return; }
+  if (left() <= 0) { row.stop_reason = 'time_budget'; return; }
+  const base = worktree.defaultMainlineBase(root);
+  const opened = openCheckout(root, base);
+  if (opened.error) { row.stop_reason = 'checkout_failed'; row.error = opened.error; return; }
+  const { wt, branch } = opened;
+  row.branch = branch;
+  row.resumed = opened.resumed;
+  const keep = (reason) => { row.stop_reason = reason; row.kept = wt; };
+
+  for (const check of checks) {
+    if (left() <= 0) return keep('time_budget');
+    const result = check.run(wt);
+    const changes = changedPaths(wt);
+    if (!changes) return keep('status_failed');
+    const entry = { name: check.name, found: result.found || 0, files: changes.map((c) => c.file), outcome: 'nothing' };
+    row.checks.push(entry);
+    if (!changes.length) continue;
+    if (changes.some((c) => !allowedPath(c.file))) { undo(wt, changes); entry.outcome = 'outside_allowed_paths'; continue; }
+    if (!result.verify()) { undo(wt, changes); entry.outcome = 'verify_failed'; continue; }
+    const staged = git(wt, ['add', '--', ...entry.files]);
+    if (staged.status !== 0) { row.error = String(staged.stderr || 'git add failed').trim(); return keep('stage_failed'); }
+    const committed = git(wt, ['commit', '-q', '-m', `${result.message}\n\n${CO_AUTHOR}`]);
+    if (committed.status !== 0) {
+      entry.outcome = 'commit_blocked';
+      row.error = String(committed.stderr || committed.stdout || '').trim().slice(0, 400);
+      return keep('commit_blocked');
+    }
+    entry.outcome = 'committed';
+    row.commits += 1;
+  }
+
+  const remoteHead = gitOut(root, ['rev-parse', '--verify', `refs/remotes/origin/${branch}`]);
+  const headBeforePush = gitOut(wt, ['rev-parse', 'HEAD']);
+  const ahead = remoteHead ? remoteHead !== headBeforePush : gitOut(wt, ['cherry', base, 'HEAD']).split('\n').some((line) => line.startsWith('+'));
+  if (!ahead) {
+    row.stop_reason = 'nothing_to_do';
+    row.cleaned = cleanup(root, wt, branch);
+    if (!row.cleaned) row.kept = wt;
+    return;
+  }
+  if (left() <= 0) return keep('time_budget');
+  const head = gitOut(wt, ['rev-parse', 'HEAD']);
+  const pushed = git(wt, ['push', '-q', 'origin', `HEAD:refs/heads/${branch}`], {
+    timeout: left(),
+    env: worktree.gitNetworkEnvironment(process.env, wt),
+  });
+  if (pushed.status !== 0) {
+    row.error = String(pushed.stderr || (pushed.error && pushed.error.message) || '').trim().slice(0, 400);
+    return keep(pushed.signal || left() <= 0 ? 'time_budget' : 'push_failed');
+  }
+  const remoteTip = git(wt, ['ls-remote', 'origin', `refs/heads/${branch}`], { timeout: Math.max(1, left()), env: worktree.gitNetworkEnvironment(process.env, wt) }).stdout?.trim().split(/\s+/)[0];
+  const clean = (changedPaths(wt) || [null]).length === 0;
+  if (remoteTip !== head || !clean) return keep('delivery_unproven');
+  row.pushed_sha = head;
+  row.delivered = true;
+  row.stop_reason = 'delivered';
+  row.cleaned = cleanup(root, wt, branch);
+  if (!row.cleaned) row.kept = wt;
+}
+
+const STOP_WORDS = {
+  delivered: 'the fixes are pushed',
+  nothing_to_do: 'the checks found nothing to fix',
+  time_budget: 'the time ran out before the push',
+  push_failed: 'the push was refused',
+  commit_blocked: 'a commit was refused',
+  delivery_unproven: 'the remote branch does not match the commit',
+  checkout_failed: 'the isolated checkout could not be made',
+  error: 'something failed',
+};
+
+function formatLoopReport(result = {}) {
+  if (result.refused) return `rsi loop did not start: ${result.refused}.`;
+  const lines = [`rsi loop: ${result.commits} fix commit${result.commits === 1 ? '' : 's'}, stopped because ${STOP_WORDS[result.stop_reason] || result.stop_reason}.`];
+  for (const c of result.checks || []) lines.push(`  ${c.name}: ${c.outcome}${c.files.length ? ` (${c.files.length} file${c.files.length === 1 ? '' : 's'})` : ''}`);
+  if (result.branch) lines.push(`branch: ${result.branch}${result.pushed_sha ? ` at ${result.pushed_sha.slice(0, 12)}` : ''}`);
+  if (result.kept) lines.push(`kept for the next run: ${result.kept}`);
+  if (result.error) lines.push(`detail: ${String(result.error).split('\n')[0]}`);
+  if (result.report_path) lines.push(`report: ${result.report_path}`);
+  return lines.join('\n');
+}
+
+module.exports = {
+  BRANCH_PREFIX,
+  CHECKS,
+  allowedPath,
+  runLoop,
+  formatLoopReport,
+  loopsPath,
+  lockPath,
+};

package/lib/runner-command.js

@@ -8,7 +8,10 @@
 // so autonomous runs are reproducible, while keeping explicit per-run/env knobs
 // first in precedence. Precedence: explicit model -> ATRIS_RUNNER_MODEL env ->
 // ATRIS_RUNNER_PROFILE -> legacy ATRIS_CLAUDE_MODEL env -> pinned default.
-const DEFAULT_CLAUDE_RUNNER_MODEL = 'claude-opus-5-5';
+// The default is the cheap model: an unattended loop must never land on a
+// costly one by accident (2026-10-28: loops spent about $900 in one day).
+// Opus, Fable and Sonnet run unattended only through the spend gate below.
+const DEFAULT_CLAUDE_RUNNER_MODEL = 'claude-haiku-5-5';
 const DEFAULT_FABLE_RUNNER_MODEL = 'claude-fable-5-1';
 const DEFAULT_CLAUDE_RUNNER_BIN = 'claude';
 // Effort words a roster line may carry after the model. Each engine lists the
@@ -215,7 +218,63 @@ function runnerProfileValue(key) {
   return profile && profile[key] ? profile[key] : '';
 }
 
+// The spend gate. Every model an unattended run is about to launch passes
+// through here. Opus, Fable and Sonnet need the owner's yes, given as
+// ATRIS_CLAUDE_SPEND_OK=<that exact model id>, so one yes covers one model. Without
+// it the run drops to the cheap model, which keeps loops alive but stops the
+// spend. The warning prints once per model per process.
+const SPEND_GATED_MODEL = /opus|fable|sonnet/i;
+const SPEND_FALLBACK_MODEL = DEFAULT_CLAUDE_RUNNER_MODEL;
+const spendGateWarned = new Set();
+
+function isSpendGatedModel(model) {
+  return SPEND_GATED_MODEL.test(String(model || ''));
+}
+
+// `fallback` is the model to run instead. An engine that is not the claude cli
+// cannot take a claude model id, so it passes '' and rides its own default.
+function applySpendGate(model, { silent = false, fallback = SPEND_FALLBACK_MODEL } = {}) {
+  const value = String(model || '').trim();
+  if (!value || !isSpendGatedModel(value)) return value;
+  if (String(process.env.ATRIS_CLAUDE_SPEND_OK || '').trim() === value) return value;
+  if (!silent && !spendGateWarned.has(`${value}>${fallback}`)) {
+    spendGateWarned.add(`${value}>${fallback}`);
+    const instead = fallback || "that engine's own default model";
+    process.stderr.write(`atris: unattended run on ${value} needs the owner's yes; running on ${instead}. To allow it for this run: ATRIS_CLAUDE_SPEND_OK=${value}\n`);
+  }
+  return fallback;
+}
+
+function resetSpendGateWarnings() {
+  spendGateWarned.clear();
+}
+
+// Engines that run only their own vendor's models drop any claude model name
+// later, so the gate has nothing to stop there and stays quiet.
+function runnerDropsClaudeModels() {
+  const name = resolveRunnerProfileName();
+  const def = name ? RUNNER_PROFILE_DEFS[RUNNER_PROFILE_ALIASES[name] || name] : null;
+  if (def && def.ownModelsOnly) return true;
+  return Boolean(ownModelsOnlyEngineForBin(resolveClaudeRunnerBin()));
+}
+
+// Whether the launch goes through the claude cli, the only engine that can take
+// the cheap claude fallback by name.
+function runnerRidesClaudeCli() {
+  const name = resolveRunnerProfileName();
+  const canonical = name ? (RUNNER_PROFILE_ALIASES[name] || name) : '';
+  return !canonical || canonical === 'claude' || canonical === 'fable' || canonical === 'haiku';
+}
+
+// The choke point: every unattended Claude launch (mission, autopilot, run,
+// pulse, fleet) resolves its model here, directly or via buildRunnerCommand.
 function resolveClaudeRunnerModel(mission) {
+  const model = resolveClaudeRunnerModelUngated(mission);
+  if (!isSpendGatedModel(model) || runnerDropsClaudeModels()) return model;
+  return applySpendGate(model, { fallback: runnerRidesClaudeCli() ? SPEND_FALLBACK_MODEL : '' });
+}
+
+function resolveClaudeRunnerModelUngated(mission) {
   const explicit = mission && mission.model != null ? normalizeClaudeModelName(mission.model) : '';
   if (explicit) return explicit;
   const env = normalizeClaudeModelName(firstConfiguredEnv(['ATRIS_RUNNER_MODEL']));
@@ -233,7 +292,10 @@ function resolveClaudeRunnerModel(mission) {
 // '' means nothing is pinned, so the engine's CLI picks its own default.
 function resolvePinnedRunnerModel(mission) {
   const explicit = mission && mission.model != null ? String(mission.model).trim() : '';
-  return explicit || runnerProfileValue('model');
+  const pinned = explicit || runnerProfileValue('model');
+  // Cheap check first: an ungated pin never needs the profile looked up.
+  if (!isSpendGatedModel(pinned) || runnerDropsClaudeModels()) return pinned;
+  return applySpendGate(pinned, { fallback: runnerRidesClaudeCli() ? SPEND_FALLBACK_MODEL : '' });
 }
 
 // The own-models-only engine a runner bin launches ("codex", "/opt/bin/grok"),
@@ -447,6 +509,8 @@ module.exports = {
   HIDDEN_PROFILE_NAMES,
   resolveRunnerProfile,
   resolveClaudeRunnerModel,
+  applySpendGate,
+  resetSpendGateWarnings,
   resolvePinnedRunnerModel,
   runnerModelFor,
   resolveClaudeRunnerBin,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.74.22",
+  "version": "3.74.23",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",