atris 3.74.4 → 3.74.6

package/lib/gm-phone.js

@@ -317,6 +317,18 @@ function checkRequest(req, { token, hosts = [] }) {
     return { ok: false, status: 400, reason: 'url' };
   }
   if (!hosts.includes(host)) return { ok: false, status: 403, reason: 'host' };
+  // Another site is refused on every route, reads too: a page in the owner's
+  // browser that holds the key could otherwise read his cards. A fetch says
+  // where it came from in Origin or Sec-Fetch-Site; a scan or a typed link
+  // says none, and a plain client says nothing. The one exception is a
+  // top-level open of the page itself (a link tapped in a mail or chat app):
+  // a navigation cannot read anything, and the page load starts no work.
+  if (req.headers.origin != null && String(req.headers.origin) !== `http://${host}`) return { ok: false, status: 403, reason: 'origin' };
+  const site = String(req.headers['sec-fetch-site'] || '').toLowerCase();
+  const pageOpen = req.method === 'GET' && url.pathname === '/'
+    && String(req.headers['sec-fetch-mode'] || '').toLowerCase() === 'navigate'
+    && String(req.headers['sec-fetch-dest'] || '').toLowerCase() === 'document';
+  if (site && site !== 'same-origin' && site !== 'none' && !pageOpen) return { ok: false, status: 403, reason: 'site' };
   const header = req.headers['x-gm-token'];
   if (req.method === 'GET') {
     if (!tokenMatches(url.searchParams.get('t') || header, token)) return { ok: false, status: 403, reason: 'token' };
@@ -501,34 +513,21 @@ function createPhoneHandler(deps) {
     return { status: ok ? 200 : 500, body: { ok, ack: ok ? 'undone, target back how it was' : 'could not undo' } };
   }
 
-  // think shows the next card at once (a choice of ideas, one idea, or a
-  // question when none is ready); pick opens one idea from a choice; sharper
-  // asks for a new bet; answer saves the owner's answer to the question on
-  // screen; do it needs a second tap because it starts
-  // agents; not now only marks the bet skipped.
-  async function betAction(p, body) {
-    let out;
-    if (p === '/bet/think') out = bet.next({ sharper: body.sharper === true });
-    // typed words in something else are read first, like say something: a
-    // question back or confusion is explained and nothing is saved
-    else if (p === '/bet/answer' && body.choice === 'other') out = await bet.say({ text: String(body.text || ''), card: String(body.card || '') });
-    else if (p === '/bet/answer') out = bet.answer({ choice: String(body.choice || ''), text: String(body.text || ''), card: String(body.card || '') });
-    else if (p === '/bet/report') out = bet.report({ value: body.value });
-    else if (p === '/bet/pick') out = bet.pick({ id: String(body.id || '') });
-    else if (p === '/bet/steer') out = await bet.talk({ member: String(body.member || ''), text: String(body.text || ''), confirm: body.confirm === true, note: body.note === true });
-    else if (p === '/bet/say') out = await bet.say({ text: String(body.text || ''), confirm: body.confirm === true, note: body.note === true, card: String(body.card || '') });
-    else if (p === '/bet/skip') out = bet.skip();
-    else if (p === '/bet/do') {
-      if (body.confirm !== true) return { status: 409, body: { ok: false, reason: 'needs_confirm', confirm_ms: CONFIRM_MS } };
-      out = await bet.doIt();
-    } else if (p === '/bet/nice') {
-      out = bet.nice();
-    } else if (p === '/bet/yes') {
-      // a yes unblocks agents, so it needs a second tap
-      if (body.confirm !== true) return { status: 409, body: { ok: false, reason: 'needs_confirm', confirm_ms: CONFIRM_MS } };
-      out = await bet.answerYes();
-    } else return { status: 404, body: { ok: false, reason: 'not_found' } };
-    return { status: out.ok ? 200 : 409, body: out };
+  // The one route for the card on screen (lib/gm-card.js): the card's id and
+  // one option on it, or typed words for its box, or the orb's next card, or
+  // the team or the job deck from the footer. The desk checks the card id
+  // and the option, and refuses anything else. A second tap is the page
+  // sending confirm on an option that asks for one.
+  function cardAction(body) {
+    const clean = {
+      card_id: typeof body.card_id === 'string' ? body.card_id.slice(0, 300) : null,
+      option_id: typeof body.option_id === 'string' ? body.option_id.slice(0, 120) : null,
+      confirm: body.confirm === true,
+      orb: body.orb === true,
+      open: body.open === 'team' || body.open === 'deck' ? body.open : null,
+    };
+    if (typeof body.text === 'string') clean.text = body.text.slice(0, 1000);
+    return Promise.resolve(bet.act(clean));
   }
 
   // A typed send carries its own id, made on the phone when the words are
@@ -539,11 +538,11 @@ function createPhoneHandler(deps) {
   const sends = new Map();
   function sendOnce(p, body) {
     const id = typeof body.send === 'string' && SEND_ID.test(body.send) ? `${p} ${body.send}` : null;
-    if (!id) return betAction(p, body);
+    if (!id) return cardAction(body);
     const seen = sends.get(id);
     if (seen && now() - seen.at < SENDS_MS) return seen.out;
     sends.delete(id);
-    const out = betAction(p, body);
+    const out = cardAction(body);
     sends.set(id, { at: now(), out });
     const forget = () => { if (sends.get(id) && sends.get(id).out === out) sends.delete(id); };
     out.then(r => { if (!r.body || r.body.ok !== true) forget(); }, forget);
@@ -576,9 +575,9 @@ function createPhoneHandler(deps) {
         });
       }
       if (req.method === 'GET' && check.path === '/state') return send(res, 200, state());
-      if (req.method === 'GET' && check.path === '/bet') return bet ? send(res, 200, bet.warm()) : send(res, 404, { ok: false, reason: 'not_found' });
-      if (req.method === 'GET' && check.path === '/bet/team') return bet ? send(res, 200, bet.teamTable()) : send(res, 404, { ok: false, reason: 'not_found' });
-      if (req.method === 'POST' && (check.path === '/action' || check.path === '/undo' || (bet && check.path.startsWith('/bet/')))) {
+      // the card on screen now; a read starts no work
+      if (req.method === 'GET' && check.path === '/card') return bet ? send(res, 200, bet.card()) : send(res, 404, { ok: false, reason: 'not_found' });
+      if (req.method === 'POST' && (check.path === '/action' || check.path === '/undo' || (bet && check.path === '/act'))) {
         if (String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase() !== 'application/json') return send(res, 415, { ok: false, reason: 'json_only' });
         let body;
         try {
@@ -587,7 +586,7 @@ function createPhoneHandler(deps) {
         } catch (err) {
           return send(res, err.message === 'too_large' ? 413 : 400, { ok: false, reason: 'bad_body' });
         }
-        if (check.path.startsWith('/bet/')) {
+        if (check.path === '/act') {
           const out = await sendOnce(check.path, body || {});
           return send(res, out.status, out.body);
         }

package/lib/gm-season.js

@@ -58,6 +58,19 @@ function ovr(outcomes) {
   return Math.round(60 + 39 * landed / finished);
 }
 
+// Each member's rating over one window of plays, the board's own numbers:
+// ovr is 60 to 99, or null for a rookie under 3 finished. A member with no
+// plays in the window is not in the map.
+function memberRatings(outcomes = []) {
+  const groups = new Map();
+  for (const o of outcomes || []) {
+    if (!o || !o.member) continue;
+    if (!groups.has(o.member)) groups.set(o.member, []);
+    groups.get(o.member).push(o);
+  }
+  return new Map([...groups].map(([name, list]) => [name, { ovr: ovr(list), finished: tally(list).finished }]));
+}
+
 // Last n finished jobs, oldest on the left, newest on the right.
 function form(outcomes, n = 5) {
   return [...(outcomes || [])]
@@ -1146,6 +1159,7 @@ module.exports = {
   form,
   lastPlays,
   loadSeason,
+  memberRatings,
   outcomesFromEvents,
   ovr,
   ownerMood,

package/lib/headless-chrome.js

@@ -0,0 +1,39 @@
+'use strict';
+
+// One place for how this CLI launches headless Chrome. Every spot that starts
+// Chrome builds its args here so a new launch can't forget the rules:
+//
+//   --use-mock-keychain   Chrome never touches the macOS keychain, so nobody
+//   --password-store=basic gets a "Chrome Safe Storage" prompt
+//   --user-data-dir       a throwaway profile under the system temp folder,
+//                         never the person's real Chrome profile
+//
+// Make the profile with makeProfileDir, build args with headlessArgs, and
+// remove the profile with removeProfileDir when the launch is done.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const KEYCHAIN_FLAGS = Object.freeze(['--use-mock-keychain', '--password-store=basic']);
+
+function makeProfileDir(prefix = 'atris-chrome-') {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+
+function removeProfileDir(dir) {
+  try { fs.rmSync(dir, { recursive: true, force: true, maxRetries: 3 }); } catch { /* best effort */ }
+}
+
+// Args for one headless launch. `profileDir` must sit under the system temp
+// folder; anything else throws, so a real profile can't be passed by mistake.
+function headlessArgs(profileDir, extra = []) {
+  const tmpRoot = path.resolve(os.tmpdir());
+  const dir = profileDir ? path.resolve(String(profileDir)) : '';
+  if (!dir || !dir.startsWith(tmpRoot + path.sep)) {
+    throw new Error('headless chrome needs a throwaway profile under the temp folder (makeProfileDir)');
+  }
+  return ['--headless=new', ...KEYCHAIN_FLAGS, `--user-data-dir=${dir}`, ...extra];
+}
+
+module.exports = { KEYCHAIN_FLAGS, makeProfileDir, removeProfileDir, headlessArgs };

package/lib/idea-gate.js

@@ -0,0 +1,33 @@
+'use strict';
+
+// The two gates every idea passes before it lands, kept apart from the tick
+// so the loop cannot loosen them: a built change that edits this file is
+// refused before landing (see JUDGE_PATHS in lib/idea-inbox.js).
+
+const FORBIDDEN_SHIP_FLAGS = Object.freeze(['--force', '--force-with-lease', '--no-verify', '-f']);
+
+// The builder and the reviewer must be two different engines, and the
+// reviewer must have passed the change. One-lap enforces this already; the
+// tick checks it again so a change can never land on its builder's word.
+function secondReviewerSignedOff(lap) {
+  const validator = lap && lap.result && lap.result.validator_result;
+  return Boolean(validator
+    && validator.passed === true
+    && validator.independent === true
+    && validator.engine
+    && validator.executor_engine
+    && validator.engine !== validator.executor_engine);
+}
+
+// Landing never force-pushes and never skips hooks.
+function assertSafeShipArgs(args) {
+  for (const flag of FORBIDDEN_SHIP_FLAGS) {
+    if (args.includes(flag)) throw new Error(`refusing to land with ${flag}`);
+  }
+  return args;
+}
+
+module.exports = {
+  assertSafeShipArgs,
+  secondReviewerSignedOff,
+};

package/lib/idea-inbox.js

@@ -0,0 +1,220 @@
+'use strict';
+
+// The idea inbox: the owner drops a plain sentence, walks away, and a tick
+// later turns the oldest one into a normal Atris task (through the one-lap
+// path) and builds it. This file holds only the raw sentences and what
+// happened to each one. The work itself lives in the task DB like any other
+// task; an idea that was picked up records its task id.
+//
+// Storage is an append-only JSONL log in the repo's own `.atris/state/`, so a
+// tick and a new `atris idea "..."` can write at the same time without one
+// clobbering the other.
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+const STATUSES = Object.freeze(['waiting', 'building', 'landed', 'refused']);
+
+// Version 1 safety rails are plain keyword and path checks, on purpose. They
+// refuse too much rather than too little: a refused idea stays on the list as
+// "needs owner" with the reason, and nothing is lost. A smarter check can
+// replace these later; until then the rule is easy to read and easy to test.
+const REFUSE_RULES = Object.freeze([
+  {
+    area: 'money',
+    text: /\b(pay|payments?|payouts?|paid|billing|invoices?|charges?|charging|refunds?|stripe|pricing|prices?|credit\s+cards?|wire\s+transfers?|bank(?:ing)?|payroll|subscriptions?|checkout|trades?|trading)\b/i,
+    path: /(?:^|[\/_.-])(?:billing|payments?|payouts?|stripe|invoices?|refunds?|checkout|pricing|wallet|payroll|mercury|brex|robinhood)(?:[\/_.-]|$)/i,
+  },
+  {
+    area: 'sending messages or email',
+    text: /\b(send|sends|sending|sent|resend|e-?mails?\s+(?:to|out|users|customers|people|everyone|them|him|her)|e-?mailing|mass\s+e-?mail|cold\s+e-?mail|sms|imessage|text\s+messages?|notify|dm|dms|tweet|tweets|post\s+(?:to|on)|outreach|newsletter)\b/i,
+    path: /(?:^|[\/_.-])(?:send|sender|outreach|mailer|smtp|ses|sms|imessage|outbox|notify)(?:[\/_.-]|$)/i,
+  },
+  {
+    area: 'auth',
+    text: /\b(auth|oauth|authn|authz|authentication|authori[sz]ation|log\s?in|logins?|sign\s?in|sign\s?up|passwords?|credentials?|secrets?|api\s+keys?|tokens?|sessions?|permissions?|2fa|mfa|sso|jwt|cookies?)\b/i,
+    path: /(?:^|[\/_.-])(?:auth|oauth|login|signin|password|passwords|credentials?|secrets?|tokens?|sessions?|sso|jwt|permissions?|keychain|env)(?:[\/_.-]|$)/i,
+  },
+  {
+    area: 'deleting user data',
+    text: /\b(?:delete|deleting|drop|dropping|purge|purging|wipe|wiping|truncate|erase|destroy)\b.{0,40}\b(?:users?|customers?|accounts?|data|database|db|tables?|records?|rows?|history|files?)\b|\b(?:drop\s+table|truncate\s+table|delete\s+from|rm\s+-rf)\b/i,
+    path: null,
+    added: /\b(?:DROP\s+TABLE|TRUNCATE\s+TABLE|DELETE\s+FROM)\b|\brm\s+-rf\s+[~\/$]/i,
+  },
+  {
+    area: 'database migrations',
+    text: /\b(migrations?|migrate|migrating|schema\s+changes?|alter\s+table|alembic|add\s+(?:a\s+)?column|drop\s+column)\b/i,
+    path: /(?:^|\/)(?:migrations?|alembic)\/|\.sql$/i,
+    added: /\bALTER\s+TABLE\b/i,
+  },
+]);
+
+// The files that judge the idea loop: the refuse rules above, the landing
+// gates in lib/idea-gate.js, and the score in lib/idea-ledger.js, with their
+// tests. A built change that edits any of them is refused before landing,
+// whatever the idea said, so the loop never edits the rules that judge it.
+// This list lives in a file it protects.
+const JUDGE_PATHS = Object.freeze([
+  /^lib\/idea-inbox\.js$/,
+  /^lib\/idea-gate\.js$/,
+  /^lib\/idea-ledger\.js$/,
+  /^test\/idea-inbox\.test\.js$/,
+  /^test\/idea-ledger\.test\.js$/,
+]);
+const JUDGE_TEXT = /\brefus\w*\s+(?:list|rules?)\b|\bidea\s+(?:score|scoring|ledger)\b|\bscoring\s+code\b/i;
+
+function stateFile(root) {
+  return path.join(path.resolve(root || '.'), '.atris', 'state', 'ideas.jsonl');
+}
+
+function cleanText(value) {
+  return String(value || '').replace(/\s+/g, ' ').trim();
+}
+
+function oneLine(value, limit = 160) {
+  const text = cleanText(value);
+  return text.length > limit ? `${text.slice(0, limit - 3).trimEnd()}...` : text;
+}
+
+// Why an idea in plain words is not safe to build alone, or '' when it is.
+function ideaRefusal(text) {
+  const words = cleanText(text);
+  for (const rule of REFUSE_RULES) {
+    const hit = words.match(rule.text);
+    if (hit) return `touches ${rule.area} ("${cleanText(hit[0]).toLowerCase()}"), needs owner`;
+  }
+  const judge = words.match(JUDGE_TEXT);
+  if (judge) return `touches the rules that judge the idea loop ("${cleanText(judge[0]).toLowerCase()}"), needs owner`;
+  return '';
+}
+
+// Why a built change is not safe to land alone, or '' when it is. `paths` are
+// the changed file paths; `addedLines` are the added lines of the diff.
+function changeRefusal({ paths = [], addedLines = [] } = {}) {
+  const judged = paths.find((entry) => JUDGE_PATHS.some((rule) => rule.test(String(entry || ''))));
+  if (judged) return `the change edits the rules that judge the idea loop (${judged}), needs owner`;
+  for (const rule of REFUSE_RULES) {
+    if (rule.path) {
+      const file = paths.find((entry) => rule.path.test(String(entry || '')));
+      if (file) return `the change touches ${rule.area} (${file}), needs owner`;
+    }
+    if (rule.added) {
+      const line = addedLines.find((entry) => rule.added.test(String(entry || '')));
+      if (line) return `the change touches ${rule.area} (${oneLine(line, 60)}), needs owner`;
+    }
+  }
+  return '';
+}
+
+function readEvents(root) {
+  let text = '';
+  try {
+    text = fs.readFileSync(stateFile(root), 'utf8');
+  } catch {
+    return [];
+  }
+  const events = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try {
+      const row = JSON.parse(line);
+      if (row && typeof row === 'object' && row.id) events.push(row);
+    } catch {}
+  }
+  return events;
+}
+
+function appendEvent(root, event) {
+  const file = stateFile(root);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.appendFileSync(file, `${JSON.stringify(event)}\n`, 'utf8');
+  return event;
+}
+
+// Ideas in the order they arrived, each with its latest status folded in.
+function readIdeas(root) {
+  const byId = new Map();
+  const order = [];
+  for (const event of readEvents(root)) {
+    if (event.kind === 'idea') {
+      if (byId.has(event.id)) continue;
+      const idea = {
+        id: event.id,
+        n: order.length + 1,
+        text: cleanText(event.text),
+        at: event.at || null,
+        status: 'waiting',
+        reason: '',
+        attempts: 0,
+        ...(event.verify ? { verify: event.verify } : {}),
+        ...(event.tag ? { tag: event.tag } : {}),
+        ...(event.cause_key ? { cause_key: event.cause_key } : {}),
+      };
+      byId.set(event.id, idea);
+      order.push(idea);
+    } else if (event.kind === 'update' && byId.has(event.id)) {
+      const idea = byId.get(event.id);
+      const { kind, id, ...patch } = event;
+      Object.assign(idea, patch);
+      if (patch.status && patch.status !== 'refused' && !('reason' in patch)) idea.reason = '';
+    }
+  }
+  return order;
+}
+
+function newIdeaId(now = new Date()) {
+  return `idea-${now.getTime().toString(36)}${crypto.randomBytes(2).toString('hex')}`;
+}
+
+// Saves one idea. A sentence that trips a rail is saved as refused right away,
+// so the owner sees it on the list with its reason instead of losing it. The
+// tick files its own ideas through here too (tag 'loop'), under the same rails.
+function addIdea(root, text, { verify = '', tag = '', causeKey = '', now = new Date() } = {}) {
+  const sentence = cleanText(text);
+  if (!sentence) throw new Error('an idea needs a sentence');
+  const id = newIdeaId(now);
+  const at = now.toISOString();
+  appendEvent(root, {
+    kind: 'idea',
+    id,
+    text: sentence,
+    at,
+    ...(verify ? { verify: cleanText(verify) } : {}),
+    ...(tag ? { tag: cleanText(tag) } : {}),
+    ...(causeKey ? { cause_key: causeKey } : {}),
+  });
+  const refusal = ideaRefusal(sentence);
+  if (refusal) appendEvent(root, { kind: 'update', id, at, status: 'refused', reason: refusal });
+  return readIdeas(root).find((idea) => idea.id === id);
+}
+
+function updateIdea(root, id, patch = {}, { now = new Date() } = {}) {
+  if (patch.status && !STATUSES.includes(patch.status)) throw new Error(`unknown idea status: ${patch.status}`);
+  appendEvent(root, { kind: 'update', id, at: now.toISOString(), ...patch });
+  return readIdeas(root).find((idea) => idea.id === id) || null;
+}
+
+function findIdea(ideas, ref) {
+  const key = String(ref || '').trim().replace(/^#/, '');
+  if (!key) return null;
+  if (/^\d+$/.test(key)) return ideas.find((idea) => idea.n === Number(key)) || null;
+  return ideas.find((idea) => idea.id === key) || null;
+}
+
+// The oldest idea still waiting to be built.
+function nextWaitingIdea(ideas) {
+  return (ideas || []).find((idea) => idea.status === 'waiting') || null;
+}
+
+module.exports = {
+  addIdea,
+  changeRefusal,
+  findIdea,
+  ideaRefusal,
+  nextWaitingIdea,
+  oneLine,
+  readIdeas,
+  stateFile,
+  updateIdea,
+};

package/lib/idea-ledger.js

@@ -0,0 +1,196 @@
+'use strict';
+
+// The idea outcome ledger and the score read from it.
+//
+// Every idea tick that picks up an idea appends one JSON line here saying how
+// it ended: landed, refused (a safety rail said no), failed (the build, the
+// review, the checks, or the push did not get through), or reverted. The
+// score `atris idea` prints comes only from these lines, and the tick reads
+// the same lines to notice a failure that keeps coming back.
+//
+// This file judges the loop. A built change that edits it is refused before
+// landing (see JUDGE_PATHS in lib/idea-inbox.js), so the loop can never raise
+// its own score by rewriting how the score is counted.
+//
+// Storage follows the usual `.atris/state/<name>.jsonl` convention: append
+// only, one `atris.idea_outcome.v1` row per line, gitignored.
+
+const fs = require('fs');
+const path = require('path');
+
+const OUTCOMES = Object.freeze(['landed', 'refused', 'failed', 'reverted']);
+const STAGES = Object.freeze(['intake', 'build', 'review', 'checks', 'push']);
+const DAY_MS = 24 * 60 * 60 * 1000;
+const SCORE_WINDOW_DAYS = 7;
+const REPEAT_COUNT = 2;
+
+function outcomesFile(root) {
+  return path.join(path.resolve(root || '.'), '.atris', 'state', 'idea_outcomes.jsonl');
+}
+
+function short(value, limit = 60) {
+  const text = String(value || '').replace(/\s+/g, ' ').trim();
+  return text.length > limit ? `${text.slice(0, limit - 3).trimEnd()}...` : text;
+}
+
+function timeMs(value) {
+  const ms = Date.parse(value || '');
+  return Number.isFinite(ms) ? ms : null;
+}
+
+function minutesBetween(from, to) {
+  const a = timeMs(from);
+  const b = timeMs(to);
+  if (a === null || b === null || b < a) return null;
+  return Math.round(((b - a) / 60000) * 10) / 10;
+}
+
+// Appends one outcome row. `idea` is the inbox row the tick worked on.
+function recordOutcome(root, {
+  idea,
+  outcome,
+  stage = null,
+  cause = '',
+  started = null,
+  finished = new Date().toISOString(),
+  taskId = null,
+  link = null,
+} = {}) {
+  if (!idea || !idea.id) throw new Error('an outcome needs the idea it belongs to');
+  if (!OUTCOMES.includes(outcome)) throw new Error(`unknown idea outcome: ${outcome}`);
+  if (stage !== null && !STAGES.includes(stage)) throw new Error(`unknown idea stage: ${stage}`);
+  const repo = path.resolve(root || '.');
+  const row = {
+    schema: 'atris.idea_outcome.v1',
+    id: idea.id,
+    n: idea.n || null,
+    repo,
+    idea_at: idea.at || null,
+    started: started || finished,
+    finished,
+    minutes: minutesBetween(started || finished, finished),
+    outcome,
+    cause: short(cause) || null,
+    stage: outcome === 'landed' ? null : stage,
+    attempt: Number(idea.attempts || 0) || null,
+    ...(taskId ? { task_id: taskId } : {}),
+    ...(link ? { link } : {}),
+    ...(idea.tag ? { tag: idea.tag } : {}),
+  };
+  const file = outcomesFile(repo);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.appendFileSync(file, `${JSON.stringify(row)}\n`, 'utf8');
+  return row;
+}
+
+function readOutcomes(root) {
+  let text = '';
+  try {
+    text = fs.readFileSync(outcomesFile(root), 'utf8');
+  } catch {
+    return [];
+  }
+  const rows = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try {
+      const row = JSON.parse(line);
+      if (row && row.schema === 'atris.idea_outcome.v1' && row.id && OUTCOMES.includes(row.outcome)) rows.push(row);
+    } catch {}
+  }
+  return rows;
+}
+
+// Two failures are "the same" when they stopped at the same stage and their
+// causes read the same once paths, numbers, quotes, and ids are taken out.
+// Plain on purpose, like the refuse rules: easy to read, easy to test.
+function causeKey(stage, cause) {
+  const words = String(cause || '').toLowerCase()
+    .replace(/"[^"]*"|'[^']*'|`[^`]*`/g, ' ')
+    .replace(/\S*[\/\\]\S*/g, ' ')
+    .replace(/\b[0-9a-f]{7,}\b/g, ' ')
+    .replace(/[^a-z]+/g, ' ')
+    .trim()
+    .split(/\s+/)
+    .filter(Boolean)
+    .slice(0, 6);
+  return `${stage || 'none'}|${words.join(' ')}`;
+}
+
+function median(values) {
+  const sorted = values.filter((value) => Number.isFinite(value)).sort((a, b) => a - b);
+  if (!sorted.length) return null;
+  const mid = Math.floor(sorted.length / 2);
+  const value = sorted.length % 2 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2;
+  return Math.round(value);
+}
+
+// The score: ideas landed in the last 24 hours, the share of ideas that
+// landed on their first build, and the median minutes from dropping an idea
+// to it landing. The last two look back 7 days so a quiet day still says
+// something. Intake refusals are not builds and do not count as tries.
+function ideaScore(rows, { now = Date.now() } = {}) {
+  const nowMs = typeof now === 'number' ? now : timeMs(now);
+  const inLast = (row, ms) => {
+    const at = timeMs(row.finished);
+    return at !== null && nowMs - at < ms;
+  };
+  const builds = (rows || []).filter((row) => row.stage !== 'intake');
+  const landed24h = builds.filter((row) => row.outcome === 'landed' && inLast(row, DAY_MS)).length;
+  const firstById = new Map();
+  for (const row of builds) {
+    const prior = firstById.get(row.id);
+    if (!prior || (timeMs(row.finished) || 0) < (timeMs(prior.finished) || 0)) firstById.set(row.id, row);
+  }
+  const windowMs = SCORE_WINDOW_DAYS * DAY_MS;
+  const firsts = [...firstById.values()].filter((row) => inLast(row, windowMs));
+  const firstLanded = firsts.filter((row) => row.outcome === 'landed').length;
+  const toLanded = builds
+    .filter((row) => row.outcome === 'landed' && inLast(row, windowMs))
+    .map((row) => minutesBetween(row.idea_at, row.finished));
+  return {
+    landed_24h: landed24h,
+    first_try_landed: firstLanded,
+    first_try_tried: firsts.length,
+    first_try_rate: firsts.length ? Math.round((firstLanded / firsts.length) * 100) : null,
+    median_minutes_to_landed: median(toLanded),
+    window_days: SCORE_WINDOW_DAYS,
+    builds: builds.length,
+  };
+}
+
+function scoreLine(score) {
+  if (!score || !score.builds) return 'score: nothing built yet.';
+  const parts = [`score: ${score.landed_24h} landed in the last 24h.`];
+  if (score.first_try_tried) {
+    parts.push(`${score.first_try_landed} of ${score.first_try_tried} landed first try (${score.first_try_rate}%, last ${score.window_days} days).`);
+  }
+  parts.push(score.median_minutes_to_landed === null
+    ? 'no landings yet to time.'
+    : `median ${score.median_minutes_to_landed} min from idea to landed.`);
+  return parts.join(' ');
+}
+
+// The failure that keeps coming back: the latest failed row, when at least
+// REPEAT_COUNT failures in the last 24 hours share its stage and cause.
+function repeatedFailure(rows, { now = Date.now(), count = REPEAT_COUNT } = {}) {
+  const nowMs = typeof now === 'number' ? now : timeMs(now);
+  const recent = (rows || []).filter((row) => {
+    const at = timeMs(row.finished);
+    return row.outcome === 'failed' && at !== null && nowMs - at < DAY_MS;
+  });
+  if (!recent.length) return null;
+  const latest = recent[recent.length - 1];
+  const key = causeKey(latest.stage, latest.cause);
+  const same = recent.filter((row) => causeKey(row.stage, row.cause) === key);
+  if (same.length < count) return null;
+  return { key, stage: latest.stage, cause: latest.cause, count: same.length };
+}
+
+module.exports = {
+  ideaScore,
+  readOutcomes,
+  recordOutcome,
+  repeatedFailure,
+  scoreLine,
+};