atris 3.80.0 → 3.82.1

package/lib/security-audit-classes.js

@@ -8,7 +8,7 @@
 // control that should stop them, and the concrete result across the boundary.
 
 const CODE_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.py', '.rb', '.go', '.java', '.php', '.rs', '.sh', '.bash', '.zsh']);
-const WEB_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.html', '.vue', '.svelte']);
+const WEB_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.html', '.vue', '.svelte', '.erb', '.rb']);
 const WORKFLOW_RE = /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/;
 
 const CLASSES = [
@@ -23,6 +23,9 @@ const CLASSES = [
       /\bsubprocess\.(?:run|call|Popen|check_output|check_call)\s*\(/,
       /\bos\.(?:system|popen)\s*\(/,
       /\bshell\s*:\s*true\b/,
+      // Ruby, Go, Java
+      /\b(?:system|spawn|exec)\s*\(?\s*["'][^"'\n]*#\{|%x[{(\[]|\bIO\.popen\b|\bOpen3\.\w+|`[^`\n]*#\{/,
+      /\bexec\.Command(?:Context)?\s*\(|\bRuntime\.getRuntime\(\)\.exec\b|\bnew\s+ProcessBuilder\b/,
     ],
     guide: [
       'Invariant: a lower-trust value never becomes shell syntax, a program name, or an option the caller did not intend.',
@@ -44,6 +47,7 @@ const CLASSES = [
       /\brequire\s*\(\s*(?!['"`])[^)]/,
       /\bimport\s*\(\s*(?!['"`])[^)]/,
       /\b(?:exec|compile)\s*\(\s*(?!['"])/,
+      /\b(?:instance_eval|class_eval|module_eval|instance_exec)\b|\.(?:constantize|safe_constantize)\b|\bconst_get\s*\(|\.(?:public_)?send\s*\(\s*(?![:'\"])/,
     ],
     guide: [
       'Invariant: text from a lower-trust source is never run as code, and a module path is never chosen by it.',
@@ -61,6 +65,7 @@ const CLASSES = [
       /\b(?:readFileSync|writeFileSync|readFile|writeFile|appendFileSync|createReadStream|createWriteStream|unlinkSync|rmSync|rmdirSync|renameSync|copyFileSync|symlinkSync|cpSync)\s*\(\s*(?!['"`])/,
       /\bpath\.(?:join|resolve)\s*\([^)]*\b(?:req|params|query|body|name|slug|id|input|args?|file|target)\b/,
       /\bextract(?:All)?\s*\(|\btar\b.*\bx\b|\bunzip\b/,
+      /\bFile\.(?:read|write|open|binread|binwrite|delete|unlink|rename|symlink)\s*\(\s*(?!['\"])|\bFileUtils\.\w+|\bsend_file\b|\bos\.(?:Open|OpenFile|Create|ReadFile|WriteFile|Remove(?:All)?)\s*\(|\bfilepath\.Join\s*\(/,
     ],
     guide: [
       'Invariant: a path built from a lower-trust value stays inside the directory the code means, after normalization and symlink resolution.',
@@ -81,6 +86,7 @@ const CLASSES = [
       /\baxios(?:\.\w+)?\s*\(/,
       /\brequests\.(?:get|post|put|patch|delete|request)\s*\(/,
       /\burllib\.request\.urlopen\s*\(/,
+      /\bNet::HTTP\b|\bHTTParty\b|\bFaraday\b|\bURI\.open\b|\bRestClient\b|\bhttp\.(?:Get|Post|Head|NewRequest(?:WithContext)?)\s*\(/,
     ],
     guide: [
       'Invariant: a lower-trust value cannot pick the host, scheme, or port of a request made with this process\'s network position or credentials.',
@@ -100,6 +106,10 @@ const CLASSES = [
       /\bcreateServer\s*\(/,
       /\.listen\s*\(\s*(?:\d|port|PORT)/,
       /\b(?:req|request)\.(?:headers|query|params|body)\b/,
+      /\b(?:before_action|skip_before_action|authorize!?|current_user|policy_scope|load_and_authorize_resource)\b|\bparams\[/,
+      /\bdef\s+(?:self\.)?(?:authorized\?|visible\?|scope_items\b|resolve\b)|\bfield\s+:\w+|\bargument\s+:\w+/,
+      /^\s*(?:get|post|put|patch|delete|match|resources?)\s+['\":]/,
+      /\bhttp\.HandleFunc\s*\(|\b\w+\.(?:GET|POST|PUT|PATCH|DELETE|Handle|HandleFunc)\s*\(\s*\"\//,
     ],
     guide: [
       'Invariant: every action that reads or changes another principal\'s data, or spends shared resources, checks who is asking and whether they may.',
@@ -119,6 +129,7 @@ const CLASSES = [
       /os\.environ(?:\.get)?\s*[[(]\s*['"][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)/,
       /\b(?:authorization|x-api-key|api[_-]?key|access[_-]?token|refresh[_-]?token)\b/i,
       /\bcredentials?\.json\b|\bkeychain\b|\.netrc\b/i,
+      /\bENV(?:\.fetch)?\s*[\[(]\s*['\"][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)|\bos\.Getenv\s*\(\s*\"[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)/,
     ],
     guide: [
       'Invariant: a credential reaches only the party it was issued for, and never lands in logs, errors, receipts, prompts, child process environments, or files others can read.',
@@ -155,6 +166,7 @@ const CLASSES = [
       /\b(?:SELECT|INSERT|UPDATE|DELETE)\b[^;\n]*(?:\$\{|['"`]\s*\+|%s|\.format\(|\bf["'])/i,
       /\.(?:query|execute|raw|exec)\s*\(\s*(?:`[^`]*\$\{|f["']|['"][^'"]*['"]\s*\+)/,
       /\$where\b|\.find\s*\(\s*(?:req|request)\./,
+      /\.(?:where|order|group|having|joins|select|pluck|find_by_sql|exec_query|execute)\s*\(\s*\"[^\"\n]*#\{|\.order\s*\(\s*params\b|\.(?:Query|QueryRow|Exec)(?:Context)?\s*\([^)\n]*fmt\.Sprintf/,
     ],
     guide: [
       'Invariant: lower-trust values reach a query only as bound parameters, never as query text, identifiers, or operators.',
@@ -175,6 +187,7 @@ const CLASSES = [
       /\bv-html\b|\{@html\b/,
       /\bpostMessage\s*\(|addEventListener\s*\(\s*['"]message['"]/,
       /\bhref\s*=\s*\{?\s*(?!['"](?:https?:|\/|#))/,
+      /\.html_safe\b|\braw\s*\(|<%==/,
     ],
     guide: [
       'Invariant: text from another user or an outside source renders as text, never as markup or script, and cross-window messages are accepted only from expected origins.',
@@ -194,6 +207,7 @@ const CLASSES = [
       /\bunserialize\s*\(|\bMarshal\.load\b/,
       /\b__proto__\b|\bconstructor\s*\[\s*['"]prototype/,
       /\bObject\.assign\s*\(\s*\{\}\s*,\s*(?:req|body|input|data|JSON\.parse)/,
+      /\bYAML\.(?:load|unsafe_load)\s*\(|\bPsych\.(?:load|unsafe_load)\b|\bOj\.load\b|\bnew\s+ObjectInputStream\b|\bgob\.NewDecoder\b/,
     ],
     guide: [
       'Invariant: parsing lower-trust input never runs code, never changes shared object prototypes, and never produces an object the next step trusts more than the input.',
@@ -212,6 +226,8 @@ const CLASSES = [
       /createHash\s*\(\s*['"](?:md5|sha1)['"]/,
       /\b\w*(?:token|secret|signature|hmac|digest)\w*\s*(?:===|!==|==|!=)\s*\w*(?:token|secret|signature|hmac|digest|expected)/i,
       /\bjwt\.(?:decode|verify)\s*\(|algorithms?\s*:\s*\[?\s*['"]none['"]/,
+      /\bOpenSSL::(?:Cipher|PKey|HMAC|Digest|KDF)\b|\bDigest::(?:MD5|SHA1)\b|\bSecureRandom\b|\bsecure_compare\b|\bJWT\.decode\b/,
+      /\bcrypto\.(?:createCipheriv|createDecipheriv|createSign|createVerify|timingSafeEqual)\b|\b(?:decrypt|encrypt|verify_signature|verify_raw|sign_raw)\s*[(]|\bcrypto\/(?:aes|cipher|rsa|ecdsa|ed25519|hmac|subtle)\b/,
     ],
     guide: [
       'Invariant: secrets, session ids, and one-time codes are unguessable, and checks of them do not leak timing or accept forged values.',
@@ -225,7 +241,7 @@ const CLASSES = [
     boundary: 'install, build, and release',
     weight: 8,
     exts: null,
-    files: (rel) => WORKFLOW_RE.test(rel) || /(?:^|\/)package\.json$/.test(rel) || /(?:^|\/)(?:Dockerfile|Makefile|install\.sh|setup\.py|pyproject\.toml)$/.test(rel),
+    files: (rel) => WORKFLOW_RE.test(rel) || /(?:^|\/)package\.json$/.test(rel) || /(?:^|\/)(?:Dockerfile|Makefile|install\.sh|setup\.py|pyproject\.toml|Gemfile|Rakefile|go\.mod)$/.test(rel) || /\.gemspec$/.test(rel),
     detect: [
       /"(?:preinstall|install|postinstall|prepare|prepublish)"\s*:/,
       /\bpull_request_target\b|\bworkflow_run\b/,
@@ -233,6 +249,7 @@ const CLASSES = [
       /\bcurl\b[^|\n]*\|\s*(?:ba|z)?sh\b|\bwget\b[^|\n]*\|\s*(?:ba|z)?sh\b/,
       /\$\{\{\s*github\.event\.(?:issue|pull_request|comment|head_commit|review)\b/,
       /\bsecrets\.[A-Z0-9_]+/,
+      /^\s*(?:gem|source)\s+['\"][^'\"]+['\"]\s*,\s*(?:git|github|path):|\.add_(?:runtime_)?dependency\b|\bspec\.(?:files|executables)\b/,
     ],
     guide: [
       'Invariant: code from a lower-trust contributor or dependency cannot run with release credentials, change what ships, or execute on a user\'s machine at install time.',
@@ -277,6 +294,7 @@ const CANDIDATE_GATE = [
   'Propose "confirmed" only when the trace is complete, the impact crosses a stated boundary, every condition is listed, and no layer in source prevents it.',
   'Do not strengthen a crash into code execution, ordinary work into an outage, or a same-person action into privilege gain.',
   'If a decisive fact is outside source (deployment, proxy, provider setting, who can write a file), propose "needs_validation" with the exact missing fact. It gets no severity.',
+  'Before calling a library version or behavior unknown, read what is installed in the target: lockfiles, venv or .venv site-packages, node_modules, vendor folders. A fact on disk is not outside source.',
   'A missing best practice with no affected principal or resource goes in "hardening", not in candidates. A candidate disproved by source is dropped.',
   'The fingerprint names the root cause, like "lib/foo.js:runHook/shell-from-task-title". No line numbers, no severity, no verdict in it.',
   'Return an empty candidates array when nothing survives these rules. Most units should end "covered".',

package/lib/security-audit.js

@@ -761,6 +761,7 @@ function verifierPrompt({ candidate, cls }) {
       'Ask who controls the input. If it is the same person who runs the tool, it is self-impact, so reject it.',
       '"confirmed": the full trace holds, the impact crosses the stated boundary, and nothing in source prevents it. Fix the severity if it is overstated; overall can never exceed impact.',
       '"needs_validation": the trace holds in source, but a decisive fact is outside it. Name that fact exactly and give a safe check the owner can run.',
+      'A library version or behavior is not outside source when the target has it installed. Read the lockfile, the venv or .venv site-packages, or node_modules before sending it to the owner.',
       '"rejected": the source disproves it. Name the line that does.',
       'Use "corrected" only for fields you would change. Read-only: do not run the target or touch the network.',
     ]),
@@ -1163,6 +1164,17 @@ function resolveOutDir(root, { out, repo }) {
   return { dir: path.join(outRoot, `run-${next}`), outRoot };
 }
 
+// Same function in the fingerprint and sinks within a few lines of each other:
+// one defect, even when two hunters filed it under different classes.
+function sameRootCause(a, b) {
+  const scope = (fp) => String(fp || '').split('/').slice(0, -1).join('/');
+  const sink = (c) => (Array.isArray(c.trace) && c.trace.length ? c.trace[c.trace.length - 1] : null);
+  const sa = sink(a);
+  const sb = sink(b);
+  if (!sa || !sb || !scope(a.fingerprint) || scope(a.fingerprint) !== scope(b.fingerprint)) return false;
+  return sa.file === sb.file && Math.abs(Number(sa.line) - Number(sb.line)) <= 3;
+}
+
 function budgetPlan(profile, total) {
   const critics = profile === 'quick' ? 1 : 2;
   const verifyReserve = Math.max(1, Math.ceil(0.3 * (total - critics)));
@@ -1256,7 +1268,11 @@ async function runAudit(opts = {}) {
 
   const plan = budgetPlan(profile, total);
   const plannedCount = ledger.filter((u) => u.status === 'planned').length;
-  meta.plan = { ...plan, planned_units: plannedCount, units_per_hunter: UNITS_PER_HUNTER[profile], hunters_needed: Math.ceil(plannedCount / UNITS_PER_HUNTER[profile]) };
+  // Hunters take one class in one subsystem at a time, so count batches per group.
+  const groupSizes = new Map();
+  for (const u of ledger) if (u.status === 'planned') { const k = `${u.attack_class}\0${u.subsystem}`; groupSizes.set(k, (groupSizes.get(k) || 0) + 1); }
+  const huntersNeeded = [...groupSizes.values()].reduce((n, size) => n + Math.ceil(size / UNITS_PER_HUNTER[profile]), 0);
+  meta.plan = { ...plan, planned_units: plannedCount, units_per_hunter: UNITS_PER_HUNTER[profile], hunters_needed: huntersNeeded };
 
   const pendingRecords = [];
   const finish = (status, reason, records = [], carriedPending = []) => {
@@ -1378,9 +1394,23 @@ async function runAudit(opts = {}) {
   const pending = [];
   const toVerify = [];
   const seenFp = new Set();
+  const kept = [];
   for (const cand of queue) {
     if (seenFp.has(cand.fingerprint)) continue;
     seenFp.add(cand.fingerprint);
+    const twin = !cand._carried && kept.find((k) => !k._carried && sameRootCause(k, cand));
+    if (twin) {
+      // Two hunters named one root cause from different classes. Check it once
+      // and point the twin's areas at the surviving fingerprint.
+      twin.coverage_ids = [...new Set([...(twin.coverage_ids || []), ...(cand.coverage_ids || [])])];
+      for (const u of ledger) {
+        if (Array.isArray(u.result_fingerprints) && u.result_fingerprints.includes(cand.fingerprint)) {
+          u.result_fingerprints = [...new Set(u.result_fingerprints.map((fp) => (fp === cand.fingerprint ? twin.fingerprint : fp)))];
+        }
+      }
+      continue;
+    }
+    kept.push(cand);
     if (!cand.attack_class || !CLASS_BY_ID.has(cand.attack_class)) cand.attack_class = cand._unit_class || 'command-injection';
     const errs = citationErrors(root, cand);
     if (errs.length) {

package/lib/task-db.js

@@ -826,6 +826,13 @@ function pidAlive(pid) {
   try { process.kill(pid, 0); return true; } catch (err) { return err.code === 'EPERM'; }
 }
 
+// A claim made by hand (`atris task claim` with no --lease-minutes) has no lease, so before this nothing ever let
+// it go: a session that died holding one kept the job off the board for good. Such a claim is let go once its job
+// has seen no activity (no event of any kind) for this many days, whatever --stale-days says. It is measured by
+// activity, not by a clock set at claim time, so a claim someone is still working on is never taken away, and it
+// is long enough that the narrower --stale-days rule (fleet claims, or one named claimer) still decides first.
+const UNLEASED_CLAIM_STALE_DAYS = 30;
+
 function expireLeases(db, { now = Date.now(), staleDays, claimer, dryRun = false, isAlive = pidAlive } = {}) {
   const timestamp = now instanceof Date ? now.getTime() : typeof now === 'string' ? Date.parse(now) : Number(now);
   if (!Number.isFinite(timestamp)) throw new Error('invalid now');
@@ -846,6 +853,9 @@ function expireLeases(db, { now = Date.now(), staleDays, claimer, dryRun = false
     } else if (!lease && staleDays != null && row.last_seen_at != null && row.last_seen_at < timestamp - Number(staleDays) * 86400000 && (claimer ? row.claimed_by === claimer : String(row.claimed_by || '').startsWith('fleet-'))) {
       reason = `stranded with no activity for over ${staleDays} days`;
       leaseUntil = new Date(row.last_seen_at + 3600000).toISOString();
+    } else if (!lease && row.last_seen_at != null && row.last_seen_at < timestamp - UNLEASED_CLAIM_STALE_DAYS * 86400000) {
+      reason = `stranded with no activity for over ${UNLEASED_CLAIM_STALE_DAYS} days`;
+      leaseUntil = new Date(row.last_seen_at + 3600000).toISOString();
     } else continue;
     const lastSeen = lease && Number.isFinite(until) && Number.isFinite(Number(lease.minutes))
       ? until - Number(lease.minutes) * 60000 : row.last_seen_at;
@@ -1130,7 +1140,7 @@ function reopenTask(db, { id, actor, reason, metadata: metadataPatch, fromReview
   return { reopened: true, event, row: updated };
 }
 
-function doneTask(db, { id, status, actor, allowReview = false, action, proof, autoAccepted = false } = {}) {
+function doneTask(db, { id, status, actor, allowReview = false, action, proof, autoAccepted = false, deferLogs = false } = {}) {
   if (!id) throw new Error('id required');
   const final = status || 'done';
   if (!['done', 'failed'].includes(final)) throw new Error('status must be done|failed');
@@ -1139,18 +1149,22 @@ function doneTask(db, { id, status, actor, allowReview = false, action, proof, a
   // read as a real failure. See archiveTask() below.
   const now = Date.now();
   const allowedStatuses = allowReview ? "'open', 'claimed', 'review'" : "'open', 'claimed'";
-  const result = withBusyRetry(() => db.prepare(`
-    UPDATE tasks
-       SET status = ?, done_at = ?, updated_at = ?
-     WHERE id = ?
-       AND status IN (${allowedStatuses})
-  `).run(final, now, now, id));
-  if (result.changes === 1) {
-    const row = getTask(db, id);
+  const eventActor = actor || process.env.ATRIS_AGENT_ID || process.env.USER || null;
+  // The status change and its event are one write: a crash between them used to leave a done job with no
+  // completed event. The daily log is a file, written only after the write is saved.
+  const row = inWriteTransaction(db, () => {
+    const result = withBusyRetry(() => db.prepare(`
+      UPDATE tasks
+         SET status = ?, done_at = ?, updated_at = ?
+       WHERE id = ?
+         AND status IN (${allowedStatuses})
+    `).run(final, now, now, id));
+    if (result.changes !== 1) return null;
+    const updated = getTask(db, id);
     appendTaskEvent(db, {
       taskId: id,
-      workspaceRoot: row.workspace_root,
-      actor: actor || process.env.ATRIS_AGENT_ID || process.env.USER || null,
+      workspaceRoot: updated.workspace_root,
+      actor: eventActor,
       eventType: final === 'done' ? 'completed' : 'blocked',
       payload: {
         status: final,
@@ -1158,17 +1172,40 @@ function doneTask(db, { id, status, actor, allowReview = false, action, proof, a
         ...(autoAccepted ? { auto_accepted: true } : {}),
       },
     });
-    const logs = appendTaskCompletionLogs(db, row, {
-      status: final,
-      actor: actor || process.env.ATRIS_AGENT_ID || process.env.USER || null,
-      action: action || final,
-      proof,
-    });
+    return updated;
+  });
+  if (row) {
+    const logInput = { status: final, actor: eventActor, action: action || final, proof };
+    // A caller that holds its own transaction (acceptTask) writes the log once that is saved.
+    if (deferLogs) return { updated: true, row, logInput };
+    const logs = appendTaskCompletionLogs(db, row, logInput);
     return { updated: true, logs };
   }
   return { updated: false };
 }
 
+// Accepting a job is two writes, the job marked done and the review that records it as accepted with its
+// reward. They are one transaction: a crash between them used to leave a done job with approval still
+// pending, and nothing scans done jobs to finish the accept (autoland reads only review). The daily log
+// is a file and is written once the transaction is saved.
+function acceptTask(db, { id, actor, proof, reward, lesson = '', nextTask = '', autoAccepted = false, careerXpEligible = true, clearedFields = [] } = {}) {
+  if (!id) throw new Error('id required');
+  const out = inWriteTransaction(db, () => {
+    const done = doneTask(db, { id, status: 'done', actor, allowReview: true, action: 'accepted', proof, autoAccepted, deferLogs: true });
+    if (!done.updated) return { updated: false };
+    const reviewed = reviewTask(db, { id, actor, reward, lesson, nextTask, proof, careerXpEligible, clearedFields, autoAccepted });
+    return { updated: true, reviewed, row: done.row, logInput: done.logInput };
+  });
+  if (!out.updated) return { updated: false };
+  let logs = {};
+  try {
+    logs = appendTaskCompletionLogs(db, out.row, out.logInput);
+  } catch (err) {
+    if (process.env.ATRIS_DEBUG) process.stderr.write(`accept log failed: ${String(err?.message ?? err).replace(/[\r\n]+/g, ' ')}\n`);
+  }
+  return { updated: true, reviewed: out.reviewed, logs };
+}
+
 function reapMissionBlockerTasks(db, { workspaceRoot: ws, missions = [], actor, rows = null, skipLogs = false } = {}) {
   const missionById = new Map((Array.isArray(missions) ? missions : [])
     .filter(mission => mission && mission.id)
@@ -1825,32 +1862,55 @@ function releaseClosedPullRequest(db, { id, actor, workspaceRoot: ws, expected,
   return { released: true, row: out.row, event: out.event };
 }
 
+// Read a job's metadata, change it, and write it back with the write lock held, so two writers that each
+// read the whole JSON cannot drop each other's keys. The mutator gets a copy and changes it in place or
+// returns a new object; returning false writes nothing. Keep the mutator fast and free of I/O: it runs
+// inside BEGIN IMMEDIATE. touch: false leaves updated_at as it was.
+// Returns null when the job does not exist, else { row, metadata, changed }.
+function updateTaskMetadata(db, id, mutator, { touch = true, now = Date.now() } = {}) {
+  if (!id) throw new Error('id required');
+  if (typeof mutator !== 'function') throw new Error('mutator required');
+  return inWriteTransaction(db, () => {
+    const row = getTask(db, id);
+    if (!row) return null;
+    const metadata = row.metadata && typeof row.metadata === 'object' ? { ...row.metadata } : {};
+    const out = mutator(metadata, row);
+    if (out === false) return { row, metadata, changed: false };
+    const next = out && typeof out === 'object' ? out : metadata;
+    const text = JSON.stringify(next);
+    withBusyRetry(() => (touch
+      ? db.prepare('UPDATE tasks SET metadata = ?, updated_at = ? WHERE id = ?').run(text, now, id)
+      : db.prepare('UPDATE tasks SET metadata = ? WHERE id = ?').run(text, id)));
+    return { row, metadata: next, changed: true };
+  });
+}
+
 function setTaskResult(db, { id, actor, result }) {
   if (!id) throw new Error('id required');
   const text = cleanLandingText(result);
   if (!text) throw new Error('result required');
-  const row = getTask(db, id);
-  if (!row) return { saved: false, reason: 'not_found' };
   const now = Date.now();
-  const metadata = row.metadata && typeof row.metadata === 'object' ? { ...row.metadata } : {};
-  metadata.result = text;
-  metadata.result_at = new Date(now).toISOString();
-  metadata.result_by = actor || process.env.ATRIS_AGENT_ID || process.env.USER || null;
-  const updated = withBusyRetry(() => db.prepare(`
-    UPDATE tasks
-       SET metadata = ?,
-           updated_at = ?
-     WHERE id = ?
-  `).run(JSON.stringify(metadata), now, id));
-  if (updated.changes !== 1) return { saved: false, reason: 'stale_task_state' };
-  const latest = getTask(db, id);
-  const event = appendTaskEvent(db, {
-    taskId: id,
-    workspaceRoot: latest.workspace_root,
-    actor: metadata.result_by,
-    eventType: 'result_set',
-    payload: { result: text },
+  const resultBy = actor || process.env.ATRIS_AGENT_ID || process.env.USER || null;
+  // The metadata write and its event are one transaction, and the metadata is read under the lock.
+  const out = inWriteTransaction(db, () => {
+    const saved = updateTaskMetadata(db, id, (metadata) => {
+      metadata.result = text;
+      metadata.result_at = new Date(now).toISOString();
+      metadata.result_by = resultBy;
+    }, { now });
+    if (!saved) return null;
+    const row = getTask(db, id);
+    const written = appendTaskEvent(db, {
+      taskId: id,
+      workspaceRoot: row.workspace_root,
+      actor: resultBy,
+      eventType: 'result_set',
+      payload: { result: text },
+    });
+    return { latest: row, event: written };
   });
+  if (!out) return { saved: false, reason: 'not_found' };
+  const { latest, event } = out;
   return { saved: true, event, row: latest };
 }
 
@@ -3053,6 +3113,11 @@ function taskProjection(db, {
   };
 }
 
+// Status names: the database keeps `failed` (doneTask writes it, its event is `blocked`), and
+// TODO.md shows those rows under "## Blocked". The words differ on purpose and the stored value
+// is not renamed: every reader, filter, and old database already says `failed`, and a person
+// reads "blocked" as "needs someone", which is what a failed job is. `atris task list --status
+// failed` is how to list them.
 function renderTodoMarkdown(rows, { title = 'TODO.md', doneLimit = TODO_RENDER_DONE_LIMIT, failedLimit = TODO_RENDER_FAILED_LIMIT, refRows = rows, preservedSections = [] } = {}) {
   const displayRows = withTaskDisplayRefs(rows, refRows);
   const buckets = {
@@ -3192,6 +3257,7 @@ module.exports = {
   renewLease,
   clearLease,
   expireLeases,
+  UNLEASED_CLAIM_STALE_DAYS,
   previewExpiredLeases,
   sweepExpiredLeases,
   releaseTask,
@@ -3201,6 +3267,7 @@ module.exports = {
   backlogTask,
   clearPlanTasks,
   doneTask,
+  acceptTask,
   reapMissionBlockerTasks,
   archiveTask,
   archiveNotNeeded,
@@ -3212,6 +3279,7 @@ module.exports = {
   landHeldMerge,
   releaseClosedPullRequest,
   setTaskResult,
+  updateTaskMetadata,
   reviseTask,
   stageTask,
   noteTask,

package/lib/taste-notes.js

@@ -0,0 +1,35 @@
+'use strict';
+
+// Taste is personal, so it lives outside the shipped skill: the project's
+// atris/taste/TASTE.md and the person's ~/.atris/taste/TASTE.md. Sync replaces
+// atris/skills/ on every update and never touches either file. Init and update
+// only create the project starter when it is missing.
+
+const fs = require('fs');
+const path = require('path');
+
+const PROJECT_TASTE_FILE = path.join('taste', 'TASTE.md');
+
+const STARTER = `# Taste
+
+How this project should look and read: its brand and its voice. Agents read this before making anything a person will see. The person's own taste in \`~/.atris/taste/TASTE.md\` comes second.
+
+Each line gives the rule in plain words and links to a short note with the reason and real examples. \`atris/skills/taste/notes.md\` shows the shape.
+
+## The list
+
+- (Nothing recorded yet. When someone corrects how something looks or reads, add the rule here.)
+`;
+
+// Returns true when the starter was written (or would be, in a dry run).
+function ensureProjectTasteFile(atrisDir, { dryRun = false } = {}) {
+  const file = path.join(atrisDir, PROJECT_TASTE_FILE);
+  if (fs.existsSync(file)) return false;
+  if (!dryRun) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, STARTER, { flag: 'wx' });
+  }
+  return true;
+}
+
+module.exports = { ensureProjectTasteFile };

package/lib/team-lineup.js

@@ -19,15 +19,15 @@ function orderJobs(rows) {
   return [...builtIn, ...list.filter((row) => !builtIn.includes(row))];
 }
 
-// "opus 5.5" for a claude model, "codex gpt-6-astra" for anything else, and
+// Friendly label for a claude model, "<tool> <model>" for anything else, and
 // just the tool when it runs its own default.
 function shortRuns(view) {
   if (!view || !view.engine) return '';
   const tool = rosterToolLabel(view.engine);
   if (!view.model) return tool;
   const label = modelLabel(view.model);
-  // "atris:fast" on atris fast says the tool twice; "grok 4.7 fast" on grok
-  // already names it.
+  // "atris:fast" on atris fast says the tool twice; a label starting with the
+  // tool name already names it.
   const plain = (text) => String(text).toLowerCase().replace(/[^a-z0-9.]+/g, ' ').trim();
   if (plain(label) === plain(tool)) return tool;
   if (CLAUDE_FAMILY.includes(view.engine) || plain(label).startsWith(`${plain(tool)} `)) return label;

package/lib/todo.js

@@ -61,6 +61,8 @@ function dbBuckets(workspaceRoot) {
     if (r.status === 'open') backlog.push(shaped);
     else if (r.status === 'claimed') inProgress.push(shaped);
     else if (r.status === 'review') review.push(shaped);
+    // `failed` is the stored name for a job TODO.md shows under "Blocked" (see renderTodoMarkdown
+    // in lib/task-db.js); this shim has no blocked bucket, so it files them with the finished rows.
     else if (r.status === 'done' || r.status === 'failed') completed.push(shaped);
   }
   return { backlog, inProgress, review, completed, sourceKeys, sourceRefs };

package/lib/wiki.js

@@ -71,12 +71,17 @@ Turn raw project context into a living memory the next agent can pick up cold.
 - Add cross-references with \`[[${wikiLinkRoot}/...]]\` links.
 - Keep \`index.md\`, \`log.md\`, and \`STATUS.md\` in sync with page changes.
 - If something is unclear or contradictory, say so directly.
+- One idea per page, under about 80 lines, with real examples right under the rule they prove.
+- Each \`index.md\` line gives the rule or answer and says when to open the page. Never a bare topic name.
+- Keep \`index.md\` to one screen. Move text instead of rewriting it, and list anything deleted in \`log.md\`.
 `;
 }
 
 function indexMarkdown() {
   return `# Atris Wiki Index
 
+Each line gives the rule or answer and says when to open the page behind it.
+
 ## People
 
 ## Systems
@@ -874,7 +879,9 @@ Rules:
 - Merge new info into existing pages instead of replacing them
 - Keep index.md, log.md, and STATUS.md current
 - Flag contradictions directly instead of smoothing them over
-- Never modify the raw source documents you ingested`;
+- Never modify the raw source documents you ingested
+- One idea per page, under about 80 lines, with examples under the rule they prove
+- An index line gives the rule or answer, then says when to open the page`;
 }
 
 function buildIngestPrompt(sourceValue, mode = 'public') {
@@ -889,7 +896,7 @@ Workflow:
 3. Extract people, systems, and concepts worth preserving
 4. Create or update pages under ${wikiRoot}/, merging with existing facts instead of replacing them
 5. Add cross-references using [[${wikiLinkRoot}/...]] links
-6. Update ${wikiRoot}/index.md with one-line descriptions of touched pages
+6. Update ${wikiRoot}/index.md with one line per touched page: the rule or answer, then when to open it
 7. Append an INGEST entry to ${wikiRoot}/log.md under today's date
 8. Refresh ${wikiRoot}/STATUS.md in plain English for a non-technical reader
 
@@ -945,7 +952,8 @@ Keep rules:
 - Entries marked as user-stated conventions or explicit remember-this survive.
 - Every kept entry keeps its provenance as a source link or date.
 
-Consolidate overlapping entries, preserve the strongest source-backed version, and leave index.md and page links consistent.`;
+Consolidate overlapping entries, preserve the strongest source-backed version, and leave index.md and page links consistent.
+Split any page over about 80 lines or holding two ideas. Rewrite bare topic lines in index.md so each says when to open the page.`;
 }
 
 module.exports = {