atris 3.74.22 → 3.74.24

package/README.md

@@ -442,6 +442,23 @@ Under the hood, Atris can keep score on real repo work.
 - `atris autopilot` can run that check after review and record the result in the journal.
 - Future task picks can use recent results, so Atris learns from repo-local history without claiming model retraining.
 
+## Which AI Can Do Your Work
+
+`atris scorecard` measures which AI can do your team's work, on your own repo.
+
+```bash
+atris scorecard                            # find past changes whose own tests can grade an AI (no AI runs)
+atris scorecard run                        # try each one with Haiku on your Claude plan
+atris scorecard run --models haiku,opus    # compare models; past Haiku needs ATRIS_CLAUDE_SPEND_OK=<model>
+```
+
+- A past change becomes a task when its tests fail before it and pass after it. The ask is what your team wrote for that change.
+- The ask also names what the change's tests call that the change added or changed: a new file, a function with its arguments, an export, found with no AI. A good ticket names these; a commit message rarely does, and no model can guess a name nobody wrote down.
+- Each try starts from the change's parent in a throwaway copy with no remote. The change's own tests stay hidden until they grade the try.
+- Every try runs on your Claude plan login. Pay-per-use keys are removed, a try stops the moment Claude Code reports any other billing source, and nothing starts with extra usage on unless you pass `--allow-extra-usage`.
+- The scorecard shows how many changes each model did, how long it took, what the same runs would cost on pay-per-use, and which changes no model could do from what was written.
+- Tests that need their own command or settings go in `.atris/scorecard.json`.
+
 ## Benchmark Harness
 
 Atris ships one public head-to-head benchmark harness for comparing a pinned

package/bin/atris.js

@@ -651,6 +651,7 @@ function showHelpAll() {
   console.log('  meet       - onboard a stranger in one sitting and print their /book link');
   console.log('  avail      - Booking availability (/book/{username} weekly windows)');
   console.log('  scoreboard - Today\'s github contributions vs your best day, streak, repo commits (--watch, --json)');
+  console.log('  scorecard  - Which AI can do your team\'s work: past changes graded by their own tests, run on your Claude plan (find, run, show)');
   console.log('  brain      - Compile MAP/TODO/wiki/state into a loadable agent brain');
   console.log('  lesson     - atris lesson add <slug> <pass|fail> "<text>" (mine/sweep/resolve/revert/ledger; --detector validates the falsifier at write time)');
   console.log('  taste      - Record the operator\'s keep, kill, and more creative verdicts');
@@ -669,7 +670,7 @@ function showHelpAll() {
   console.log('  land       - The landing: what is actually done vs still in the air; --reap backs up + clears overdue');
   console.log('  caretaker  - Classify open pull requests on origin (scan only; no fix, comment, or merge)');
   console.log('  drive      - One self-driving tick: mission doctor -> auto-fix -> count disengagements');
-  console.log('  rsi        - Read the Dream-RSI attempt ledger (trees, attempts, policy, dreams)');
+  console.log('  rsi        - Read the Dream-RSI attempt ledger; rsi loop ships notebook fixes with no mission');
   console.log(`  autoland   - Approve the policy once; ${require('../lib/autoland').certifiedWorkLandsPhrase(process.cwd())}, you keep irreversible calls`);
   console.log('  engine     - engine registry, answer validation, dispatch flights, and live progress');
   console.log('  link       - What two things could become together: one line, why, a first thing to make, who makes it');
@@ -2234,6 +2235,10 @@ if (command === 'guide') {
   Promise.resolve().then(() => require('../commands/scoreboard').scoreboardCommand(process.argv.slice(3)))
     .then((code) => exitAfterStdoutDrain(typeof code === 'number' ? code : 0))
     .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
+} else if (command === 'scorecard') {
+  Promise.resolve().then(() => require('../commands/scorecard').scorecardCommand(process.argv.slice(3)))
+    .then((code) => exitAfterStdoutDrain(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'meet') {
   Promise.resolve().then(() => require('../commands/meet').meetCommand(process.argv.slice(3)))
     .then((code) => exitAfterStdoutDrain(typeof code === 'number' ? code : 0))
@@ -2495,6 +2500,10 @@ if (command === 'guide') {
   Promise.resolve().then(() => require('../commands/balance').balanceCommand(process.argv.slice(3)))
     .then((code) => exitAfterStdoutDrain(typeof code === 'number' ? code : 0))
     .catch((err) => { console.error(String(err.message || err).replace(/\s+/g, ' ')); process.exit(1); });
+} else if (command === 'spend') {
+  // Spend guard: unattended Claude runs on paid models need a yes (2026-10-28, $900 day).
+  const code = require('../commands/spend').spendCommand(process.argv.slice(3));
+  exitAfterStdoutDrain(typeof code === 'number' ? code : 0);
 } else if (command === 'usage') {
   Promise.resolve().then(() => require('../commands/usage').usageCommand(process.argv.slice(3)))
     .then((code) => exitAfterStdoutDrain(typeof code === 'number' ? code : 0))

package/commands/improve.js

@@ -453,7 +453,7 @@ function collectImproveVitals(options = {}, deps = {}) {
     return fs.existsSync(plistPath);
   })();
   const installed = launchdInstalled || legacyCronInstalled;
-  const installNudge = installed ? null : 'the scheduled improve loop is off. turn it on: atris pulse install --model claude-sonnet-5';
+  const installNudge = installed ? null : 'the scheduled improve loop is off. turn it on: atris pulse install';
 
   const experimentsPath = path.join(root, '.atris', 'state', 'experiments-daily.json');
   const experiments = readJsonFile(experimentsPath, {});

package/commands/mission.js

@@ -9360,7 +9360,7 @@ function buildTickPrompt(mission, tickIndex, maxTicks, frozen, pings = [], cwd =
     `## Your task`,
     `Do ONE increment of work toward the stop condition. ONE. No more.`,
     `- ${memberIdentityLine(mission.owner)} Your member files are preloaded above; open atris/team/${mission.owner}/MEMBER.md only if that copy is marked truncated. Work in that identity, inside its scope and stop rules. Atris writes your member log from your receipt, so end the receipt with one \`learned: <one line>\` line instead of editing the log.`,
-    `- FIRST: inspect current mission/task state before acting. Read the relevant files, run \`atris mission status ${mission.id}\`, \`git status\`, or \`atris task list\` as needed so you know what's already done.`,
+    `- Start with the job: inspect the files or state directly relevant to the objective, then do the smallest useful action. Skip workspace boot and start-of-session routines, including brain activation, general Atris or task listings, and reading MAP, persona, or skill files solely for startup. Inspect mission or task state only if the job requires it.`,
     `- Pick the smallest concrete action that moves the mission forward.`,
     `- Before acting, state your single next move in one sentence.`,
     `- Edit / run / research as needed for the lane.`,
@@ -10082,6 +10082,16 @@ function engineHealthRoot(cwd) {
   return dir && path.basename(dir) === '.git' ? path.dirname(dir) : cwd;
 }
 
+function reviewerHealthRoot(engine) {
+  return path.join(require('../lib/state-home').atrisHome(), 'reviewer-health', engine);
+}
+
+function reviewerCooling(engine, registry) {
+  const saved = registry.readEngineRegistry(reviewerHealthRoot(engine), { persist: false })
+    .engines.find((entry) => entry.id === engine);
+  return saved?.health?.status === 'cooling' && !registry.engineReadyAt(saved);
+}
+
 // Every spelling and version of one model family counts as the same model,
 // with or without the long-context tag. Unknown counts as same.
 function reviewerMayBeSameModel(a, b) {
@@ -10109,12 +10119,12 @@ function engineVerifierLineup(mission, cwd, preferredEngine = '', options = {})
     const workerEngine = canonicalEngineName(mission?.runner) || 'claude';
     const workerModel = resolveMissionTickRunnerModel(mission);
     const team = registry.resolveEngineForRoleRanked('validator', root, { job: 'review', quiet: true }).team || [];
-    const backup = team.find((engine) => engine && engine.id !== primary
+    const backup = team.find((engine) => engine && engine.id !== primary && !reviewerCooling(engine.id, registry)
       && !(engine.id === workerEngine && reviewerMayBeSameModel(engine.roster_model, workerModel)));
     if (!backup) return lineup;
     lineup.push({ engine: backup.id, model: backup.roster_model || '' });
     const saved = registry.readEngineRegistry(root, { persist: false }).engines.find((engine) => engine.id === primary);
-    if (saved && !registry.engineReadyAt(saved)) lineup.shift();
+    if ((saved && !registry.engineReadyAt(saved)) || reviewerCooling(primary, registry)) lineup.shift();
   } catch {}
   return lineup;
 }
@@ -10134,7 +10144,7 @@ async function runEngineVerifier(mission, options = {}) {
         sessionId: crypto.randomUUID(),
         cwd,
         signal: options.signal,
-        timeoutMs: ENGINE_VERIFY_TIMEOUT_MS,
+        timeoutMs: options.timeoutMs || ENGINE_VERIFY_TIMEOUT_MS,
         prompt: buildEngineVerifyPrompt(mission, options.tickIndex || 1, missionDoneLooksLike(mission, cwd), {
           timeoutMs: ENGINE_VERIFY_TIMEOUT_MS,
           checkPassed: options.checkPassed || '',
@@ -10147,11 +10157,16 @@ async function runEngineVerifier(mission, options = {}) {
       restoreRunnerProfile();
     }
     verdict = engineVerifierResultFromRun(engineResult, engine);
+    if (engineResult?.ok && !engineResult?.timedOut && !engineResult?.aborted) {
+      try { setEngineHealth(engine, 'ready', healthRoot); } catch {}
+      try { setEngineHealth(engine, 'ready', reviewerHealthRoot(engine)); } catch {}
+    }
     if (verdict.mode !== 'engine-unavailable' || engineResult?.aborted) return verdict;
     // Member lab 10/26: codex hung on every review, and each job waited out
     // the full five minutes. Bench it so the next review starts on the backup.
     if (engineResult?.timedOut) {
       try { setEngineHealth(engine, 'cooling', healthRoot); } catch {}
+      try { setEngineHealth(engine, 'cooling', reviewerHealthRoot(engine)); } catch {}
     }
   }
   return verdict;
@@ -13007,6 +13022,7 @@ module.exports = {
   receiptLearnedLine,
   tickTouchedCheckDefinition,
   engineVerifierLineup,
+  runEngineVerifier,
   claudeRunnerMcpArgs,
   crystallizeMemberSkillLesson,
   listSiblingWorkspaceMissionHints,

package/commands/rsi.js

@@ -6,6 +6,8 @@
 // outcomes, the live policy id, and the last dream receipt. Read-only: it
 // never touches record.py, never writes state, and exits 0 even when the
 // workspace has no ledger yet.
+//
+// `atris rsi loop` ships notebook fixes with no mission queued (lib/rsi-loop.js).
 
 const fs = require('fs');
 const rsi = require('../lib/rsi-record');
@@ -114,8 +116,29 @@ Usage:
   atris rsi            same as status
   atris rsi status     trees + attempts by lane, last night's outcomes, policy, last dream
   atris rsi status --json   machine-readable status
+  atris rsi loop [--minutes M] [--json]
+                       find notebook fixes with no mission queued, verify, commit and
+                       push them on one reusable isolated branch (default budget 5 minutes)
+
+status is read-only. loop checks atris/ pages for line refs that point at
+moved code and for wording the slop rules can repair, commits each check
+that verifies, and pushes the branch. It removes the local branch and checkout
+only once the remote tip matches; the remote branch is reused on later runs.
+The budget is checked between steps and limits network operations.
+The main checkout is never edited.
+
+State lives in .atris/state/rsi/ (or $ATRIS_RSI_STATE); loop reports go to loops.jsonl there.`);
+}
 
-Read-only. State lives in .atris/state/rsi/ (or $ATRIS_RSI_STATE).`);
+async function runLoopCommand(args) {
+  const rsiLoop = require('../lib/rsi-loop');
+  const i = args.indexOf('--minutes');
+  const raw = i >= 0 ? String(args[i + 1] || '') : '';
+  const minutes = i < 0 ? undefined : (/^\d+(\.\d+)?$/.test(raw) ? Number(raw) : NaN);
+  const result = await rsiLoop.runLoop({ minutes, workspace: process.cwd() });
+  console.log(args.includes('--json') ? JSON.stringify(result) : rsiLoop.formatLoopReport(result));
+  if (result.refused) return 2;
+  return result.ok ? 0 : 1;
 }
 
 function run(argv = []) {
@@ -125,6 +148,7 @@ function run(argv = []) {
     return 0;
   }
   const sub = args[0] && !args[0].startsWith('-') ? args[0] : 'status';
+  if (sub === 'loop') return runLoopCommand(args.slice(1));
   if (sub !== 'status') {
     console.log(`unknown rsi subcommand: ${sub}`);
     showHelp();

package/commands/scorecard.js

@@ -0,0 +1,297 @@
+'use strict';
+
+// atris scorecard: which AI can do your team's work, measured on your own
+// past changes and graded by the tests that shipped with them. Finding tasks
+// runs no AI. Tries run on your Claude plan login, never an API key.
+
+const fs = require('fs');
+const path = require('path');
+const { hasFlag, readFlag, readIntFlag, readNumberFlag } = require('../lib/arg-parser');
+const sc = require('../lib/repo-scorecard');
+
+const USAGE = [
+  'usage: atris scorecard [find | run | show] [options]',
+  '  which AI can do your team\'s work, measured on your own past changes.',
+  '',
+  '  atris scorecard          find tasks the first time, then show the scorecard',
+  '  atris scorecard find     turn past changes into tasks their own tests grade (no AI runs)',
+  '  atris scorecard run      try each task with each model on your Claude plan',
+  '  atris scorecard show     print the scorecard from saved results',
+  '',
+  'find options:',
+  '  --max N          keep at most N tasks (default 12)',
+  '  --scan N         look through the last N changes (default 300)',
+  '  --config FILE    test commands for this repo (default .atris/scorecard.json)',
+  '  --with-env       copy .env files into each copy, read-only, billing keys left out',
+  '',
+  'run options:',
+  '  --models a,b     models to try (default haiku). any model past haiku needs',
+  '                   ATRIS_CLAUDE_SPEND_OK=<model> because it uses much more of your plan',
+  '  --tries N        tries per task and model (default 1). a stopped run picks up where it left off',
+  '  --jobs N         tries at a time (default 2)',
+  '  --minutes N      time limit per try (default 10, 20 for opus and fable)',
+  '  --task ID        only this task (its id or the first characters of its change)',
+  '  --allow-extra-usage  run even when extra usage is on for your Claude account',
+  '',
+  '  --json           print the result as json',
+].join('\n');
+
+function storePaths(root) {
+  const dir = sc.storeDir(root);
+  return { dir, tasks: path.join(dir, 'tasks.json'), results: path.join(dir, 'results.jsonl') };
+}
+
+function readTasks(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function readResults(file) {
+  try {
+    return fs.readFileSync(file, 'utf8').split('\n').filter(Boolean).map((line) => {
+      try { return JSON.parse(line); } catch { return null; }
+    }).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+function firstLine(text, width) {
+  const line = String(text || '').split('\n')[0];
+  return line.length > width ? `${line.slice(0, width - 3)}...` : line;
+}
+
+const SKIP_WORDS = {
+  no_tests: 'had no tests changed beside the code',
+  too_big: 'were too big for one ask',
+  short_ask: 'had too few words to work from',
+  unknown_runner: 'used a test setup this cannot run yet',
+  fails_after: 'had tests that fail even with the change',
+  passes_before: 'had tests that already passed before the change',
+};
+
+function skipSummary(skipped) {
+  return Object.entries(skipped || {}).filter(([, n]) => n > 0)
+    .map(([key, n]) => `${n} ${SKIP_WORDS[key] || key}`).join(', ');
+}
+
+async function find(root, args, { quiet = false } = {}) {
+  const paths = storePaths(root);
+  const json = hasFlag(args, '--json');
+  const say = (line) => { if (!json && !quiet) console.log(line); };
+  const max = readIntFlag(args, '--max', sc.MAX_TASKS);
+  const scan = readIntFlag(args, '--scan', 300);
+  say(`atris scorecard  ${sc.repoName(root)}`);
+  say(`looking through the last ${scan} changes for ones whose own tests can grade an AI. no AI runs in this step.`);
+  say('');
+  const scratch = sc.workDir(root);
+  let result;
+  try {
+    result = await sc.findTasks(root, {
+      max,
+      scan,
+      configPath: readFlag(args, '--config', '') || undefined,
+      withEnv: hasFlag(args, '--with-env'),
+      workDir: scratch,
+      onCheck: (task, verdict) => {
+        const word = verdict === 'found' ? 'task' : 'skip';
+        const why = verdict === 'found' ? sc.runnerLabel(task.runner) : SKIP_WORDS[verdict];
+        say(`  ${word}  ${task.fix.slice(0, 7)}  ${firstLine(task.ask, 60).padEnd(60)}  ${why}`);
+      },
+    });
+  } finally {
+    sc.stopAll();
+    fs.rmSync(scratch, { recursive: true, force: true });
+  }
+  const saved = {
+    repo: sc.repoName(root),
+    root,
+    found_at: new Date().toISOString(),
+    looked: result.looked,
+    candidates: result.candidates,
+    skipped: result.skipped,
+    tasks: result.tasks,
+  };
+  fs.mkdirSync(paths.dir, { recursive: true });
+  fs.writeFileSync(paths.tasks, `${JSON.stringify(saved, null, 2)}\n`);
+  if (json) {
+    console.log(JSON.stringify(saved, null, 2));
+    return 0;
+  }
+  if (!quiet) {
+    say('');
+    say(`found ${result.tasks.length} ${result.tasks.length === 1 ? 'task' : 'tasks'} in ${result.looked} past changes.`);
+    const skips = skipSummary(result.skipped);
+    if (skips) say(`the rest ${skips}.`);
+    if (!result.tasks.length) {
+      say('');
+      say('if your tests need a command or settings to run, put them in .atris/scorecard.json, for example:');
+      say('  {"tests": [{"match": "^backend/", "dir": "backend", "cmd": "python -m pytest -q {files}", "env": {"ENV": "test"}}]}');
+      return 1;
+    }
+    say('');
+    say('next: atris scorecard run');
+    say(`  tries each task with ${sc.shortModel(sc.DEFAULT_MODELS[0])} on your Claude plan, up to 10 minutes each, 2 at a time.`);
+  }
+  return result.tasks.length ? 0 : 1;
+}
+
+function pickTasks(saved, args) {
+  const only = readFlag(args, '--task', '');
+  if (!only) return saved.tasks;
+  return saved.tasks.filter((task) => task.id === only || task.id.startsWith(only) || task.fix.startsWith(only));
+}
+
+async function run(root, args) {
+  const paths = storePaths(root);
+  const json = hasFlag(args, '--json');
+  const say = (line) => { if (!json) console.log(line); };
+  let saved = readTasks(paths.tasks);
+  if (!saved) {
+    say('no tasks yet, so finding them first.');
+    say('');
+    const code = await find(root, args.filter((a) => a !== '--json'), { quiet: json });
+    if (code !== 0) return code;
+    saved = readTasks(paths.tasks);
+    say('');
+  }
+  const tasks = pickTasks(saved, args);
+  if (!tasks.length) {
+    console.error(saved.tasks.length ? 'no task matches --task.' : 'there are no tasks to run. try atris scorecard find --scan 1000');
+    return 1;
+  }
+  const models = sc.normalizeModels(readFlag(args, '--models', ''));
+  let login;
+  try {
+    login = sc.preflight(models, { allowExtraUsage: hasFlag(args, '--allow-extra-usage') });
+  } catch (err) {
+    console.error(err.message || String(err));
+    return 1;
+  }
+  const tries = Math.max(1, readIntFlag(args, '--tries', 1) || 1);
+  const jobs = Math.max(1, readIntFlag(args, '--jobs', 2) || 2);
+  const minutes = readNumberFlag(args, '--minutes', null);
+  const before = readResults(paths.results);
+  const names = models.map(sc.shortModel).join(', ');
+  say(`atris scorecard run  ${sc.repoName(root)}`);
+  say(`${tasks.length} ${tasks.length === 1 ? 'task' : 'tasks'} x ${names}, ${tries} ${tries === 1 ? 'try' : 'tries'} each, ${jobs} at a time.`);
+  say(`on your ${login.plan}. pay-per-use keys are removed from every run${login.extraUsage ? '' : ', so this bills $0'}.`);
+  say('');
+
+  const scratch = sc.workDir(root);
+  const cleanup = () => {
+    sc.stopAll();
+    fs.rmSync(scratch, { recursive: true, force: true });
+  };
+  const onSignal = () => {
+    cleanup();
+    console.error('\nstopped. finished tries are saved; run the same command to pick up where it left off.');
+    process.exit(130);
+  };
+  process.once('SIGINT', onSignal);
+  process.once('SIGTERM', onSignal);
+  let outcome;
+  try {
+    outcome = await sc.runAll(root, tasks, {
+      models,
+      tries,
+      jobs,
+      minutes,
+      bin: login.bin,
+      withEnv: hasFlag(args, '--with-env'),
+      done: before,
+      workDir: scratch,
+      outDir: paths.dir,
+      onResult: (row) => {
+        fs.appendFileSync(paths.results, `${JSON.stringify(row)}\n`);
+        const task = tasks.find((t) => t.id === row.id) || { fix: row.id, ask: '' };
+        let word = row.passed ? 'pass' : 'fail';
+        let note = row.timed_out ? `${row.limit_minutes} min (time limit)` : `${row.minutes} min`;
+        if (row.engine_error) { word = 'skip'; note = firstLine(row.engine_tail, 50) || 'claude did not finish'; }
+        if (row.harness_error) { word = 'skip'; note = firstLine(row.harness_error, 50); }
+        say(`  ${word}  ${sc.shortModel(row.model).padEnd(10)}  ${task.fix.slice(0, 7)}  ${firstLine(task.ask, 50).padEnd(50)}  ${note}`);
+      },
+    });
+  } finally {
+    process.removeListener('SIGINT', onSignal);
+    process.removeListener('SIGTERM', onSignal);
+    cleanup();
+  }
+  const rows = readResults(paths.results);
+  const summary = sc.summarize(saved.tasks, rows, models);
+  if (json) {
+    console.log(JSON.stringify({ ...summary, stopped: outcome.stopped, ran: outcome.rows.length }, null, 2));
+    return outcome.stopped ? 1 : 0;
+  }
+  if (!outcome.planned) say('every try asked for is already done.');
+  say('');
+  console.log(sc.renderScorecard(summary, { repo: sc.repoName(root), plan: login.plan, extraUsage: login.extraUsage }));
+  if (outcome.stopped) {
+    const billed = outcome.rows.find((row) => row.not_plan);
+    say('');
+    say(billed
+      ? `stopped: ${billed.engine_tail} log in to your Claude plan with \`claude\` then /login, and run it again.`
+      : 'stopped early: your Claude plan hit its usage limit. run the same command after it resets to finish.');
+    return 1;
+  }
+  return 0;
+}
+
+function show(root, args) {
+  const paths = storePaths(root);
+  const saved = readTasks(paths.tasks);
+  if (!saved) {
+    console.error('no scorecard yet. run: atris scorecard find');
+    return 1;
+  }
+  const rows = readResults(paths.results);
+  const summary = sc.summarize(saved.tasks, rows);
+  if (hasFlag(args, '--json')) {
+    console.log(JSON.stringify(summary, null, 2));
+    return 0;
+  }
+  if (!rows.some((row) => saved.tasks.some((task) => task.id === row.id))) {
+    console.log(`atris scorecard  ${saved.repo}`);
+    console.log(`${saved.tasks.length} tasks found, none tried yet:`);
+    for (const task of saved.tasks) console.log(`  ${task.fix.slice(0, 7)}  ${firstLine(task.ask, 80)}`);
+    console.log('');
+    console.log('next: atris scorecard run');
+    return 0;
+  }
+  const login = sc.planLogin();
+  console.log(sc.renderScorecard(summary, { repo: saved.repo, plan: login.ok ? login.plan : '', extraUsage: login.extraUsage }));
+  return 0;
+}
+
+async function scorecardCommand(args = []) {
+  if (hasFlag(args, '--help') || hasFlag(args, '-h') || args[0] === 'help') {
+    console.log(USAGE);
+    return 0;
+  }
+  let root;
+  try {
+    root = sc.repoRoot();
+  } catch {
+    console.error('atris scorecard works inside a git repo. cd into one and try again.');
+    return 1;
+  }
+  const sub = args[0] && !args[0].startsWith('-') ? args[0] : '';
+  const rest = sub ? args.slice(1) : args;
+  if (sub === 'find') return find(root, rest);
+  if (sub === 'run') return run(root, rest);
+  if (sub === 'show') return show(root, rest);
+  if (sub) {
+    console.error(`unknown step "${sub}".\n\n${USAGE}`);
+    return 1;
+  }
+  if (!readTasks(storePaths(root).tasks)) {
+    const code = await find(root, rest);
+    return code;
+  }
+  return show(root, rest);
+}
+
+module.exports = { scorecardCommand, USAGE };

package/commands/spend.js

@@ -0,0 +1,78 @@
+'use strict';
+
+const fs = require('fs');
+const guard = require('../lib/claude-spend-guard');
+
+function showSpendHelp() {
+  console.log('usage: atris spend guard [install|uninstall|status]');
+  console.log('       atris spend log [--limit N]');
+  console.log('');
+  console.log('The guard stops unattended Claude runs on paid models (anything but Haiku)');
+  console.log(`unless ${guard.APPROVAL_ENV}=<model> names the model for that run.`);
+  console.log('It also stops unattended runs that carry a pay-per-use Anthropic key.');
+  console.log('Interactive Claude sessions are never blocked.');
+}
+
+function printStatus(status) {
+  if (!status.readable) {
+    console.log(`guard: unknown, could not read ${status.settings}`);
+    return;
+  }
+  console.log(status.installed ? 'guard: on' : 'guard: off');
+  console.log(`settings: ${status.settings}`);
+  console.log(`hook: ${status.script}`);
+}
+
+function guardCommand(action = 'status') {
+  if (action === 'install') {
+    const status = guard.installGuard();
+    printStatus(status);
+    if (status.installed) {
+      console.log('Unattended Claude runs on paid models now need a yes on this computer.');
+    }
+    return status.installed ? 0 : 1;
+  }
+  if (action === 'uninstall') {
+    printStatus(guard.uninstallGuard());
+    return 0;
+  }
+  if (action === 'status') {
+    const status = guard.guardStatus();
+    printStatus(status);
+    return status.installed ? 0 : 1;
+  }
+  showSpendHelp();
+  return 1;
+}
+
+function logCommand(args) {
+  const i = args.indexOf('--limit');
+  const limit = i >= 0 ? Math.max(1, Number(args[i + 1]) || 20) : 20;
+  const file = guard.ledgerPath();
+  if (!fs.existsSync(file)) {
+    console.log('no guard decisions recorded on this computer.');
+    return 0;
+  }
+  const rows = fs.readFileSync(file, 'utf8').trim().split('\n').slice(-limit);
+  for (const line of rows) {
+    try {
+      const r = JSON.parse(line);
+      console.log(`${r.ts}  ${r.decision}  ${r.model}  ${r.job || ''}  ${r.cwd || ''}`.trimEnd());
+    } catch {}
+  }
+  return 0;
+}
+
+function spendCommand(args = []) {
+  const [sub, ...rest] = args;
+  if (!sub || sub === '--help' || sub === '-h' || sub === 'help') {
+    showSpendHelp();
+    return sub ? 0 : 1;
+  }
+  if (sub === 'guard') return guardCommand(rest[0] || 'status');
+  if (sub === 'log') return logCommand(rest);
+  showSpendHelp();
+  return 1;
+}
+
+module.exports = { spendCommand };