canary-test-cli 7.0.0 → 7.2.0

package/agents/skills/claude-code/canary-strix/scripts/scanner.mjs

@@ -0,0 +1,252 @@
+// canary-strix -- the scanner. Deterministic: no LLM, no network, no execution.
+//
+// Two surfaces, because a company identifier reaches a public repo two ways and
+// only one of them is in a file:
+//
+//   FILES       tracked file contents (the obvious half)
+//   AUTHORSHIP  the author, committer and `Co-authored-by:` trailers of the
+//               commits a change adds -- metadata, so a tree can scan perfectly
+//               clean while every commit in it is stamped with a company email
+//
+// Ported from canary's own repo-internal gate, which had no way to reach a
+// consumer: `scripts/` is not in the published package's `files`, so the only
+// callers were canary's CI and its pre-commit hook.
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+/** Findings carry a stable id so a consumer can filter or waive by rule. */
+export const RULES = {
+  FILE: 'STRIX-001',
+  AUTHOR: 'STRIX-002',
+};
+
+/** Identities that appear in a `Name <email>` trailer. */
+const TRAILER =
+  /^(?:co-authored|signed-off|reviewed|acked|tested|reported|suggested|helped|mentored)-by:\s*(.+)$/gim;
+
+/** A range `git log` will read as a range rather than as a flag. */
+const RANGE_SHAPE = /^[\w./^~-]+\.{2,3}[\w./^~-]+$/;
+
+/** Suffixes worth reading. Prose and config leak names as readily as code. */
+export const SCANNED_SUFFIXES = new Set([
+  '.md',
+  '.txt',
+  '.py',
+  '.ts',
+  '.tsx',
+  '.js',
+  '.mjs',
+  '.cjs',
+  '.json',
+  '.yml',
+  '.yaml',
+  '.html',
+  '.svg',
+]);
+
+function reEscape(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Compile a term into a matcher.
+ *
+ * Terms are authored as prose ("Acme Health", "Acme Inc."), and an identity or
+ * a domain has a different grammar. A naive `\b<term>\b` silently never matches
+ * three common shapes, and it fails OPEN, which is the worst direction:
+ *
+ *   term          subject                     \b-anchored
+ *   Acme Health   dev@acmehealth.example      MISS  (separator dropped)
+ *   Acme Health   dev@acme-health.example     MISS  (separator changed)
+ *   Acme Inc.     Acme Inc. <a@b>             MISS  (\b after `.` wants \w)
+ *   Café         Café <a@b>                 MISS  (\b is ASCII-only)
+ *
+ * So: split into alphanumeric tokens, allow any run of separators between them,
+ * and bound with unicode-aware lookarounds. Boundaries still hold, so `Acme`
+ * does not match `acmecorp`.
+ */
+export function compileTerms(terms) {
+  return terms
+    .map((t) => String(t).trim())
+    .filter(Boolean)
+    .map((term) => ({
+      term,
+      tokens: term.split(/[^\p{L}\p{N}]+/u).filter(Boolean),
+    }))
+    .filter(({ tokens }) => tokens.length)
+    .map(({ term, tokens }) => {
+      const body = tokens.map(reEscape).join('[^\\p{L}\\p{N}]*');
+      return {
+        term,
+        re: new RegExp(`(?<![\\p{L}\\p{N}])${body}(?![\\p{L}\\p{N}])`, 'iu'),
+      };
+    });
+}
+
+function git(args, cwd) {
+  return execFileSync('git', args, {
+    cwd,
+    encoding: 'utf-8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+}
+
+/** Tracked files, so an untracked scratch file is never a finding. */
+export function trackedFiles(root) {
+  try {
+    return git(['ls-files'], root).split('\n').filter(Boolean);
+  } catch {
+    return null;
+  }
+}
+
+function suffixOf(rel) {
+  const dot = rel.lastIndexOf('.');
+  return dot === -1 ? '' : rel.slice(dot);
+}
+
+/**
+ * Scan tracked file CONTENTS.
+ *
+ * Returns the denominator alongside the findings. A caller that reports
+ * findings without the count cannot tell "clean" from "read nothing".
+ */
+export function scanFiles(root, matchers, { exclude = [] } = {}) {
+  const files = trackedFiles(root);
+  if (files === null)
+    return { unavailable: 'not a git repository', findings: [] };
+
+  const findings = [];
+  let scanned = 0;
+  for (const rel of files.sort()) {
+    if (!SCANNED_SUFFIXES.has(suffixOf(rel))) continue;
+    if (exclude.some((rx) => rx.test(rel))) continue;
+    const abs = resolve(root, rel);
+    if (!existsSync(abs) || !statSync(abs).isFile()) continue;
+    scanned += 1;
+    const lines = readFileSync(abs, 'utf-8').split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      for (const { term, re } of matchers) {
+        if (re.test(lines[i])) {
+          findings.push({
+            rule: RULES.FILE,
+            file: rel,
+            line: i + 1,
+            term,
+            // Deliberately NOT the matched line. On a public repo the CI log is
+            // world-readable, so echoing it publishes the identifier this scan
+            // exists to keep off the record -- on exactly the lines that trip.
+            detail: 'company identifier in a tracked file',
+          });
+          break;
+        }
+      }
+    }
+  }
+  return { scanned, findings };
+}
+
+/**
+ * pull_request. The range ends at the PR HEAD, not `HEAD`: actions/checkout
+ * has `refs/pull/N/merge` checked out, an ephemeral commit GitHub synthesises
+ * per event and authors with the PR author's ACCOUNT email. It is discarded at
+ * merge, so scanning it reports a leak that cannot reach the branch.
+ */
+function prRange(env) {
+  const base = (env.GITHUB_BASE_REF ?? '').trim();
+  if (!base) return null;
+  const head = (env.GITHUB_PR_HEAD_SHA ?? '').trim();
+  return `origin/${base}..${head || 'HEAD'}`;
+}
+
+/** push. `before` is all-zeroes on a branch's first push: no usable range. */
+function pushRange(env) {
+  const before = (env.GITHUB_EVENT_BEFORE ?? '').trim();
+  return before && !/^0+$/.test(before) ? `${before}..HEAD` : null;
+}
+
+function rangeFromEvent(env) {
+  return prRange(env) ?? pushRange(env);
+}
+
+export function resolveRange(env, explicit) {
+  const given = String(explicit ?? '').trim();
+  return given || rangeFromEvent(env);
+}
+
+/**
+ * Scan the AUTHORSHIP of the commits a range adds.
+ *
+ * Not `--no-merges`: "Merge branch 'main' into <feature>" made in a clone that
+ * inherited a global `user.email` is one of the likeliest ways an identity
+ * reaches a shared branch, and skipping merges would leave exactly that commit
+ * unread while still reporting a confident count.
+ */
+/** Read the commits in `range`, or say why not. */
+function readCommits(root, range) {
+  if (!RANGE_SHAPE.test(range) || range.startsWith('-')) {
+    return { unavailable: `${range} (not a well-formed commit range)` };
+  }
+  let records;
+  try {
+    records = git(
+      ['log', '--format=%H%x00%an <%ae>%x00%cn <%ce>%x00%B%x1e', range],
+      root,
+    )
+      .split('\x1e')
+      .map((r) => r.replace(/^\n/, ''))
+      .filter((r) => r.trim());
+  } catch (err) {
+    const detail = String(err?.stderr ?? '')
+      .trim()
+      .split('\n')[0];
+    return { unavailable: detail || `cannot read ${range}` };
+  }
+  // Zero commits is not a clean scan, it is no scan.
+  if (!records.length) {
+    return { unavailable: `${range} (resolved, but held no commits)` };
+  }
+  return { records };
+}
+
+/** The identities one commit puts on the record, and which ones matched. */
+function commitFinding(record, matchers) {
+  const [sha, author, committer, body = ''] = record.split('\0');
+  const roles = [
+    ['author', author],
+    ['committer', committer],
+    ...[...body.matchAll(TRAILER)].map((m) => ['trailer', m[1].trim()]),
+  ];
+  const hit = roles.filter(([, id]) => matchers.some(({ re }) => re.test(id)));
+  if (!hit.length) return null;
+  // One row per commit, not per field: `user.email` sets author and committer
+  // together, so the common case matches twice.
+  const short = sha.slice(0, 9);
+  return {
+    rule: RULES.AUTHOR,
+    commit: short,
+    fields: hit.map(([who]) => who),
+    // Not the identity itself -- see scanFiles.
+    detail: `company identity on a commit (inspect: git log -1 --format='%an <%ae> %cn <%ce>' ${short})`,
+  };
+}
+
+/**
+ * Scan the AUTHORSHIP of the commits a range adds.
+ *
+ * Not `--no-merges`: "Merge branch 'main' into <feature>" made in a clone that
+ * inherited a global `user.email` is one of the likeliest ways an identity
+ * reaches a shared branch, and skipping merges would leave exactly that commit
+ * unread while still reporting a confident count.
+ */
+export function scanAuthorship(root, matchers, range) {
+  if (!range) return { skipped: 'no commit range' };
+  const { records, unavailable } = readCommits(root, range);
+  if (unavailable) return { unavailable, findings: [] };
+  const findings = records
+    .map((r) => commitFinding(r, matchers))
+    .filter(Boolean);
+  return { scanned: records.length, findings };
+}

package/agents/skills/claude-code/canary-strix/scripts/terms.mjs

@@ -0,0 +1,132 @@
+// Where a consumer's denylist terms come from.
+//
+// Three sources, unioned, because a consumer's repo may be public or private
+// and the right answer differs:
+//
+//   1. CANARY_PROPRIETARY_DENYLIST env   -- a CI secret. The only source that
+//      never lands in the repo, so it is the one a PUBLIC repo must use.
+//   2. .proprietary-denylist (gitignored) -- the same list at the desk, so the
+//      pre-commit path catches a term before a push rather than after one.
+//   3. .canary/company.json               -- committed, and therefore only
+//      appropriate for a PRIVATE repo.
+//
+// (3) is the convenient one and the one to warn about: a committed denylist on
+// a public repo publishes precisely the list of things being hidden. The loader
+// reports which sources it read so a caller can say so out loud.
+//
+// Separators: comma OR newline. Newline matters — GitHub masks a multi-line
+// secret line by line, so one term per line means each term is masked
+// individually in a log. A comma-joined value is masked only as the whole
+// string, which is not the form that ever appears in output.
+
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+export const DENYLIST_ENV = 'CANARY_PROPRIETARY_DENYLIST';
+export const DENYLIST_FILE = '.proprietary-denylist';
+export const COMPANY_FILE = '.canary/company.json';
+/** The company.json key. Array of strings. */
+export const COMPANY_KEY = 'proprietary_denylist';
+
+/**
+ * Terms from a comma- or newline-separated source.
+ *
+ * Comments are stripped PER LINE, before the comma split. The order matters
+ * and getting it wrong is #818: splitting on `[,\n]` first meant a comment
+ * line containing a comma survived in part — the fragment before the comma
+ * starts with `#` and is dropped, but every fragment after one does not, and
+ * was kept as a denylist term. This repo's own `.proprietary-denylist` has a
+ * commented header, so 8 of the 15 terms it appeared to declare were
+ * fragments of its own prose. One of them was `and on a`, which matched three
+ * innocent files and reported them as company identifiers.
+ *
+ * Two harms, and the second is worse: a leak gate that cries wolf on the word
+ * "and" is an alarm nobody reads, and the run summary said `15 term(s)` when
+ * seven were real — an inflated denominator on the last line of defence
+ * before a company name reaches a public repo.
+ */
+function split(raw) {
+  return String(raw)
+    .split('\n')
+    .map((line) => line.trim())
+    .filter((line) => line && !line.startsWith('#'))
+    .flatMap((line) => line.split(','))
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+/**
+/**
+ * Terms that do not look like an identifier anyone would need to hide.
+ *
+ * Defence in depth for #818, independent of the parser that produced it: the
+ * eight phantom terms leaked from comment prose were all three-or-more
+ * all-lowercase words, and this would have caught every one of them without
+ * knowing anything about comments. A company, client or consumer name is one
+ * or two tokens, or carries capitals; `and from this file at the` is neither.
+ *
+ * Reported, never dropped. A consumer could legitimately declare an odd
+ * phrase, and silently discarding a term from a leak gate is a worse failure
+ * than flagging a suspicious one. The caller surfaces the COUNT and shape, not
+ * the values -- these are the names the scan exists to keep out of a public
+ * repo, and the warning goes to a CI log.
+ */
+function implausibleTerms(terms) {
+  return terms.filter((t) => {
+    const words = t.split(/\s+/).filter(Boolean);
+    return words.length >= 3 && t === t.toLowerCase();
+  });
+}
+
+/**
+ * @returns {{terms: string[], sources: string[], committedSource: boolean, implausible: string[]}}
+ *   `committedSource` is true when a term came from a file that is tracked,
+ *   which is the shape a caller should warn about on a public repo.
+ */
+export function loadTerms(root, env = process.env) {
+  const terms = new Set();
+  const sources = [];
+
+  const fromEnv = split(env[DENYLIST_ENV] ?? '');
+  if (fromEnv.length) {
+    fromEnv.forEach((t) => terms.add(t));
+    sources.push(DENYLIST_ENV);
+  }
+
+  const file = resolve(root, DENYLIST_FILE);
+  if (existsSync(file)) {
+    const fromFile = split(readFileSync(file, 'utf-8'));
+    if (fromFile.length) {
+      fromFile.forEach((t) => terms.add(t));
+      sources.push(DENYLIST_FILE);
+    }
+  }
+
+  let committedSource = false;
+  const company = resolve(root, COMPANY_FILE);
+  if (existsSync(company)) {
+    try {
+      const parsed = JSON.parse(readFileSync(company, 'utf-8'));
+      const raw = parsed?.[COMPANY_KEY];
+      const fromCompany = Array.isArray(raw) ? split(raw.join('\n')) : [];
+      if (fromCompany.length) {
+        fromCompany.forEach((t) => terms.add(t));
+        sources.push(COMPANY_FILE);
+        committedSource = true;
+      }
+    } catch {
+      // A malformed company.json is the consuming repo's problem to surface,
+      // not this scan's to guess at. Recorded as a source that yielded nothing
+      // rather than silently treated as absent.
+      sources.push(`${COMPANY_FILE} (unreadable)`);
+    }
+  }
+
+  const sorted = [...terms].sort();
+  return {
+    terms: sorted,
+    sources,
+    committedSource,
+    implausible: implausibleTerms(sorted),
+  };
+}

package/agents/skills/claude-code/canary-test-pipeline/SKILL.md

@@ -0,0 +1,159 @@
+---
+name: canary-test-pipeline
+description: >
+  Multi-phase orchestrator that composes canary-ci-ready, canary-critical-areas,
+  canary-edge-case-discovery, canary-failure-impact, and canary-write-test into
+  a sequential pipeline with a convergence loop and health report.
+---
+
+# Canary: Test Pipeline
+
+Runs the full test intelligence pipeline from risk assessment to verified CI
+readiness. Follows the same pattern as `harness:docs-pipeline` and
+`harness:knowledge-pipeline` — sequential phases, convergence loop, qualitative
+health report on exit.
+
+## When to Use
+
+- Starting a new test suite from scratch
+
+- Improving a suite that is not yet CI-ready
+
+- After a major feature lands and test coverage needs updating
+
+- When asked to "bring this suite to CI-ready"
+
+## Phases
+
+### Phase 0 — Probe, then gate (`/canary-ci-ready`)
+
+**Probe for the harness MCP exactly once, here, and thread the result through
+every later phase.** Several sub-skills (`canary-critical-areas`,
+`canary-failure-impact`, `canary-ci-ready`) each adapt to whether harness
+primitives are available. Left alone they rediscover that independently, which
+is wasted work and — worse — can yield an inconsistent run where one phase
+scores against the graph and another silently falls back.
+
+Record the probe result once:
+
+```text
+harness: available    → phases may call get_impact, get_critical_paths,
+                        get_perf_baselines, ask_graph
+harness: unavailable  → every phase uses its documented fallback
+```
+
+Pass that verdict to each phase rather than letting it re-probe. If the probe is
+ambiguous, treat harness as **unavailable** — a consistent weaker run beats a
+run whose fidelity varies by phase, because a mixed run's health report cannot
+be compared against any previous one.
+
+Then run `canary-ci-ready` as a baseline.
+
+- If **CI-READY**: inform the user and offer to exit or run an improvement sweep
+  anyway.
+
+- If **NOT CI-READY**: show the score, continue to Phase 1.
+
+### Phase 1 — Assess (`/canary-critical-areas`)
+
+Run `canary-critical-areas` on the repo (or `--diff` if provided). Save
+`critical-areas.json` automatically (no `--save` required when run inside the
+pipeline).
+
+Present the top 5 areas and ask the user to confirm or trim the list before
+continuing.
+
+### Phase 2 — Discover (`/canary-edge-cases`)
+
+For each confirmed critical area from Phase 1, run `canary-edge-case-discovery`
+with the area as context (passed via `critical-areas.json`).
+
+Group edge cases by critical area. Present the full list before Phase 3 so the
+user can review.
+
+### Phase 3 — Impact (`/canary-failure-impact`)
+
+For each high-risk path (risk_score ≥ 0.7 from Phase 1), run
+`canary-failure-impact`. Use `critical-areas.json` as context.
+
+Annotate each gap with its severity (Critical / High / Medium / Low).
+
+### Phase 4 — Generate (`/canary-write-test`)
+
+Present the consolidated gap list sorted by: severity (Critical first) then
+depth (0 before 1 before 2). Include edge cases from Phase 2 as test variant
+suggestions for each gap.
+
+For each gap, ask the user to confirm before invoking `canary-write-test`. Do
+not generate tests silently.
+
+After generation, show a summary of files written before proceeding to Phase 5.
+
+### Phase 5 — Verify (`/canary-ci-ready`)
+
+Re-run `canary-ci-ready`. Show the delta — which checks improved, which remain
+failing.
+
+If any check still fails, investigate using the same user-catalog logic defined
+in `canary-ci-ready`: auth/config failures get a catalog lookup before being
+declared blockers.
+
+## Convergence
+
+After Phase 5:
+
+- **ci-ready passes** → emit health report and exit
+
+- **no new gaps found** (Phase 1 produces empty list) → emit health report, note
+  remaining gaps are outside current signal, suggest manual review
+
+- **gaps remain and user confirms** → loop back to Phase 1
+
+- **user stops** → emit health report with current state
+
+## Health Report
+
+Emit on every exit (convergence or user stop):
+
+```text
+Test Pipeline — run complete
+
+  Areas assessed:   N   →  N now at depth 3+  (+N this run)
+  Tests written:    N   →  N critical paths now covered
+  Gaps remaining:   N   →  <top gap names>
+  CI-Ready:         CI-READY  or  NOT CI-READY (N/5 checks)
+
+  <if not ready> Next: /canary-test-pipeline --continue, or address manually.
+```
+
+Also **write the report to `.harness/analyses/`** on every exit, so harness's
+pre-merge tooling can cite the pipeline's verdict instead of it living only in
+session scrollback. Record the harness-availability verdict from Phase 0 in the
+record: a run that used fallbacks throughout is not comparable to one scored
+against the graph, and a reader needs to know which they are looking at.
+
+If the analyses channel is unavailable, say so loudly and still emit the report
+to the session — degrade, never drop. (Same producer contract the guardian's
+`--emit-analysis` follows.)
+
+## Flags
+
+- `--continue` — skip the Phase 0 **baseline** (resume a prior run). The Phase 0
+  **probe still runs** — it is what every later phase depends on, so skipping it
+  would leave the resumed run with no availability verdict at all.
+
+- `--diff <ref>` — pass to `canary-critical-areas` to scope assessment to a diff
+
+- `--threshold <n>` — pass to `canary-ci-ready` (default: 2)
+
+## Related skills
+
+- `/canary-ci-ready` — Phase 0 and convergence gate
+
+- `/canary-critical-areas` — Phase 1
+
+- `/canary-edge-cases` — Phase 2
+
+- `/canary-failure-impact` — Phase 3
+
+- `/canary-write-test` — Phase 4

package/agents/skills/claude-code/canary-test-pipeline/skill.yaml

@@ -0,0 +1,19 @@
+name: canary-test-pipeline
+version: '1.0.0'
+description:
+  Multi-phase orchestrator chaining canary-critical-areas, edge-case-discovery,
+  failure-impact, ci-ready, and write-test into a convergence loop with a health
+  report.
+stability: static
+triggers:
+  - manual
+platforms:
+  - claude-code
+type: rigid
+tools: []
+tier: 1
+depends_on:
+  - canary-ci-ready
+  - canary-critical-areas
+  - canary-edge-case-discovery
+  - canary-failure-impact

package/agents/skills/claude-code/canary-test-reporter/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: canary-test-reporter
+description:
+  Playwright JSON results → Markdown + JSON test report. Summarises passed,
+  failed, flaky, and skipped counts with a per-failure error block and a summary
+  table. Exits non-zero when any test failed so the CI step fails on real
+  failures. Complements canary-fail-fast (which aborts early); this skill
+  summarises the full run at the end.
+cli: scripts/cli.mjs
+requires: [node>=20]
+---
+
+# Canary Test Reporter
+
+Turn a Playwright JSON results file into a human-readable **Markdown** report
+and/or a machine-readable **JSON** artifact. Designed to run after the
+Playwright step in CI (`if: always()`) and upload both files as job artifacts.
+
+## Invocation
+
+```bash
+# Markdown to stdout:
+canary skills run canary-test-reporter -- --results test-results/results.json
+
+# Markdown to file:
+canary skills run canary-test-reporter -- \
+  --results test-results/results.json \
+  --markdown-out test-results/report.md
+
+# JSON to file:
+canary skills run canary-test-reporter -- \
+  --results test-results/results.json \
+  --json-out test-results/report.json
+
+# Both at once (recommended for CI):
+canary skills run canary-test-reporter -- \
+  --results test-results/results.json \
+  --markdown-out test-results/report.md \
+  --json-out test-results/report.json
+
+# Usage and the full flag list (exits 0):
+canary skills run canary-test-reporter -- --help
+```
+
+**Exit code:** `1` when any test failed; `0` otherwise. Flaky tests and skipped
+tests never affect the exit code.
+
+## Output formats
+
+### Markdown
+
+````text
+# Test Report
+
+**2 failed** · **1 flaky** · **14 passed** · **1 skipped** · 18 tests · 12.4s
+
+## Failed (2)
+
+### suite > spec > test title
+`tests/auth.spec.ts:42`
+
+```
+Expected: 401
+Received: 200
+```
+
+## Flaky (1)
+
+- `tests/search.spec.ts:17` — search > autocomplete > debounce
+
+## Summary
+
+| Status | Count |
+| --- | --- |
+| Passed | 14 |
+| Failed | 2 |
+| Flaky | 1 |
+| Skipped | 1 |
+| **Total** | **18** |
+````
+
+### JSON
+
+```json
+{
+  "version": 1,
+  "generated_at": "2026-07-13T20:07:00Z",
+  "summary": {
+    "total": 18,
+    "passed": 14,
+    "failed": 2,
+    "flaky": 1,
+    "skipped": 1,
+    "duration_ms": 12400
+  },
+  "results": [
+    {
+      "title": "suite > spec > test",
+      "status": "failed",
+      "file": "tests/auth.spec.ts",
+      "line": 42,
+      "duration_ms": 1823,
+      "error": "Expected: 401\nReceived: 200"
+    }
+  ]
+}
+```
+
+The `version` field pins the contract for downstream tooling. `results` includes
+**all** tests so external tools can compute their own views.
+
+## CI wiring (GitHub Actions)
+
+```yaml
+- name: Run Playwright
+  run:
+    npx playwright test --reporter=json --output-file=test-results/results.json
+
+- name: Test report
+  if: always()
+  run: |
+    canary skills run canary-test-reporter --allow-executable-skills -- \
+      --results test-results/results.json \
+      --markdown-out test-results/report.md \
+      --json-out test-results/report.json
+
+- name: Upload test report
+  if: always()
+  uses: actions/upload-artifact@v4
+  with:
+    name: test-report
+    path: test-results/report.*
+```
+
+## Related skills
+
+- `canary-fail-fast` — aborts the run early and emits `::error` annotations; use
+  with this skill for complete CI coverage (abort fast + summarise at end)