fdeops 3.9.6 → 3.9.9

package/bin/lib/trust.js

@@ -0,0 +1,197 @@
+'use strict'
+
+function createTrustApi(deps) {
+  const {
+    fs, path, readClean, readEng, parseMdTable, sectionBody, SIGNAL_LEDGER, memoryDirtyManual,
+  } = deps
+
+  // phase / trust / top risk / freshness - identical heuristic for status + dashboard.
+  // Trust resolution: structured [signal:red|amber|green] tokens in stakeholders.md
+  // (written by `fde log contact --signal` and `fde debrief`) win - the latest dated
+  // one. Older than 21 days → stale: shown with a "?" marker + age so a forgotten
+  // signal never silently drives triage. The keyword grep survives only as the
+  // zero-effort floor when NO token exists anywhere - prose like "escalated to CTO,
+  // resolved amicably" must not flip a client amber forever.
+  function stakeholdersMemoryHealth(eng) {
+    // Hostile handoff: binary / unparseable stakeholders must not read as healthy green.
+    let buf
+    try { buf = fs.readFileSync(path.join(eng, 'stakeholders.md')) } catch (_) {
+      return { ok: true, warn: '' }
+    }
+    if (buf.includes(0)) {
+      return { ok: false, warn: 'memory unreadable - verify (binary data in stakeholders.md)' }
+    }
+    const md = buf.toString('utf8')
+    const ledger = readEng(eng, SIGNAL_LEDGER)
+    if (/\[signal:(red|amber|green)\]/i.test(md + '\n' + ledger)) {
+      return { ok: true, warn: '' }
+    }
+    const trustLine = md.match(/\*\*Trust:\*\*\s*([A-Za-z?]+)/i)
+    if (trustLine && !/^(red|amber|green)$/i.test(trustLine[1])) {
+      return { ok: false, warn: 'memory unreadable - verify (invalid trust value)' }
+    }
+    const table = parseMdTable(md)
+    const meaningful = md.split('\n').filter(l => {
+      const t = l.trim()
+      return t && !t.startsWith('#') && !t.startsWith('<!--') && !/^\|?\s*:?-{3,}/.test(t)
+    }).length
+    // Content present but no table and no structured signal → do not invent "green"
+    if (meaningful >= 3 && !table) {
+      return { ok: false, warn: 'memory unreadable - verify (stakeholders.md unparseable)' }
+    }
+    return { ok: true, warn: '' }
+  }
+
+  // Subject key for a signal-history line - first real name word (same spirit as
+  // extractStakeholders). A green about Randy must not clear an amber about Denise.
+  // Strip author tags [@email-local] so attribution never becomes the subject key.
+  function signalSubjectKey(text) {
+    const cleaned = String(text).replace(/\[@[^\]]+\]/g, '').replace(/\([^)]*\)/g, '')
+    const words = cleaned.split(/\s+/).filter(w => w && !/^(dr|mr|mrs|ms)\.?$/i.test(w))
+    const frag = (words[0] || '').replace(/[^a-z0-9]/gi, '').toLowerCase()
+    return frag.length >= 3 ? frag : ('anon:' + cleaned.slice(0, 48).toLowerCase())
+  }
+
+  function parsePhase(ctx) {
+    // Template ships "**Phase:** land | discover | ..." - that is UNSET, not land.
+    const m = ctx.match(/\*\*Phase:\*\*\s*(.+)/i) || ctx.match(/^phase[:\s*]+(.+)$/im)
+    if (!m) return '?'
+    const raw = m[1].replace(/\*/g, '').trim()
+    if (!raw || /\|/.test(raw) || /^unset$/i.test(raw) || /^[\[(]/.test(raw)) return '?'
+    const one = raw.toLowerCase().match(/^(land|discover|plan|build|ship|close)\b/)
+    return one ? one[1] : '?'
+  }
+
+  function countOpenRisks(eng) {
+    const md = readClean(eng, 'risks.md')
+    const body = md.split(/^#{1,6}\s+Retired\b/im)[0] || md
+    let n = 0
+    for (const raw of body.split('\n')) {
+      const t = raw.trim()
+      if (!t || t.startsWith('<!--') || /^#{1,6}\s/.test(t)) continue
+      if (/risk\s*\|\s*status|mitigation/i.test(t) || /^\|?[\s|:-]+$/.test(t)) continue
+      // Bullet risk with substance (skip empty "- " stubs).
+      if (/^[-*]/.test(t)) {
+        if (t.replace(/^[-*]\s+/, '').trim()) n++
+        continue
+      }
+      // Table row: first cell must have risk text (day-1 "| | open | |" placeholders don't count).
+      if (/^\|/.test(t) && t.length > 12) {
+        const riskCell = t.split('|').map(c => c.trim())[1] || ''
+        if (riskCell) n++
+      }
+    }
+    return n
+  }
+
+  function nextActionLine(ctx) {
+    const body = sectionBody(ctx, 'Next action')
+    for (const raw of body.split('\n')) {
+      const t = raw.trim().replace(/^[-*]\s+/, '')
+      if (t) return t.slice(0, 120)
+    }
+    return ''
+  }
+
+  function computeSignals(eng) {
+    // readClean, not readEng: status/dashboard echo topRisk and stakeholder lines
+    // to the terminal and the rendered HTML - a <private> risk must never surface.
+    const ctx = readClean(eng, 'context.md'); const stake = readClean(eng, 'stakeholders.md'); const risks = readClean(eng, 'risks.md')
+    // Prefer structured tokens from stakeholders + CLI ledger (ledger survives wipes)
+    const signalText = stake + '\n' + readClean(eng, SIGNAL_LEDGER)
+    const phase = parsePhase(ctx)
+    // Latest signal PER stakeholder, then worst-of those actives.
+    // Global "latest wins" let a green from person B hide a sponsor crisis on A.
+    const byPerson = new Map()
+    for (const l of signalText.split('\n')) {
+      const sm = l.match(/\[signal:(red|amber|green)\]/i)
+      if (!sm) continue
+      const date = (l.match(/\[(\d{4}-\d{2}-\d{2})\]/) || [])[1] || ''
+      const text = l.replace(/^\s*-\s*/, '')
+        .replace(/\[signal:(red|amber|green)\]/i, '')
+        .replace(/\[\d{4}-\d{2}-\d{2}\]/, '')
+        .replace(/\[@[^\]]+\]/g, '')
+        .trim()
+      const key = signalSubjectKey(text)
+      const prev = byPerson.get(key)
+      if (!prev || date >= prev.date) byPerson.set(key, { date, sig: sm[1].toLowerCase(), text })
+    }
+    const RANK = { red: 0, amber: 1, green: 2 }
+    let worst = null
+    for (const s of byPerson.values()) {
+      if (!worst || RANK[s.sig] < RANK[worst.sig] || (RANK[s.sig] === RANK[worst.sig] && s.date >= worst.date)) {
+        worst = s
+      }
+    }
+    const mem = stakeholdersMemoryHealth(eng)
+    let trust, signalAge = null, stale = false, trustReason = ''
+    if (!mem.ok && !worst) {
+      trust = 'amber'
+      trustReason = mem.warn
+    } else if (worst) {
+      trust = worst.sig === 'red' ? 'RED' : worst.sig
+      trustReason = (worst.text || '').slice(0, 80)
+      if (worst.date) {
+        signalAge = Math.max(0, Math.floor((Date.now() - Date.parse(worst.date)) / 86400000))
+        stale = signalAge > 21
+      }
+    } else {
+      const sLines = stake.split('\n').filter(l => !(/green/i.test(l) && /red|amber/i.test(l)))
+      trust = sLines.some(l => /\bred\b/i.test(l)) ? 'RED'
+        : sLines.some(l => /amber|gone quiet|routing around|escalat/i.test(l)) ? 'amber' : 'green'
+    }
+    const topRisk = (risks.split('\n').find(l => {
+      const t = l.trim()
+      return /^[-|]/.test(t) && t.length > 20 && !/^\|?[-\s|]+$/.test(t) &&
+        !/risk\s*\|\s*status|mitigation/i.test(t) && !t.startsWith('<!--')
+    }) || '').replace(/\|/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 80)
+    // Prefer trust trigger / memory warn over a random risk line; always keep mem.warn available
+    const reason = (trustReason || mem.warn) ? (trustReason || mem.warn) : topRisk
+    const openRisks = countOpenRisks(eng)
+    const nextAction = nextActionLine(ctx)
+    let updated = 'never', ageDays = Infinity
+    try {
+      ageDays = Math.floor((Date.now() - fs.statSync(path.join(eng, 'context.md')).mtimeMs) / 86400000)
+      updated = ageDays === 0 ? 'today' : `${ageDays}d ago`
+    } catch (_) {}
+    const dirty = memoryDirtyManual(eng)
+    return {
+      phase, trust, signalAge, stale, topRisk, reason, memoryWarn: mem.warn,
+      dirtyFiles: dirty, openRisks, nextAction, updated, ageDays,
+    }
+  }
+
+  function resumeTriage(eng) {
+    const s = computeSignals(eng)
+    const label = s.trust + (s.stale ? '?' : '')
+    const phase = s.phase === '?' ? 'unset' : s.phase
+    const lines = [
+      `TRIAGE  [${label.padEnd(6)}]  phase:${phase}  updated:${s.updated}  open risks:${s.openRisks}`,
+    ]
+    if (s.reason) {
+      const age = s.signalAge != null ? ` (${s.signalAge}d old${s.stale ? ', STALE - reconfirm' : ''})` : ''
+      lines.push(`  trust: ${s.reason}${age}`)
+    }
+    // Always surface corruption / unreadable memory - even when trust still reads green
+    if (s.memoryWarn) lines.push(`  memory: ${s.memoryWarn}`)
+    if (s.dirtyFiles && s.dirtyFiles.length) {
+      lines.push(`  ⚠ memory dirty (uncommitted manual edits): ${s.dirtyFiles.slice(0, 5).join(', ')}${s.dirtyFiles.length > 5 ? '…' : ''}`)
+      lines.push('    review before relying on the ledger - fde writes will not auto-commit these')
+    }
+    if (s.nextAction) lines.push(`  next: ${s.nextAction}`)
+    else lines.push('  next: (none set - add under ## Next action in context.md)')
+    return lines.join('\n')
+  }
+
+  return {
+    stakeholdersMemoryHealth,
+    signalSubjectKey,
+    parsePhase,
+    countOpenRisks,
+    nextActionLine,
+    computeSignals,
+    resumeTriage,
+  }
+}
+
+module.exports = { createTrustApi }

package/hooks/session-start

@@ -138,8 +138,9 @@ CONTENT=""
 # Lean pointer only - never cat SKILL.md. Methods load on @fde / skill trigger.
 CONTENT="${CONTENT}fdeops: engagement fieldbook active. Human speaks plain language with @fde - you (the agent) run the local fde CLI for memory plumbing; never ask the human to type fde commands. Load skills/fde/SKILL.md when @fde triggers.\n\n"
 
-# Same TRIAGE block as `fde resume` / `fde triage` - Monday morning must not
-# depend on the model remembering to run a CLI command. Prefer the installed
+# Same TRIAGE block as `fde resume` / `fde triage` (includes proactive hygiene
+# when the fieldbook has doctor issues; silent when clean). Monday morning must
+# not depend on the model remembering to run a CLI command. Prefer the installed
 # fde binary; fall back to the plugin/repo copy of bin/fde.js.
 resolve_fde() {
   if command -v fde >/dev/null 2>&1; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.9.6",
+  "version": "3.9.9",
   "description": "Field kit for engineers embedded in client work - a real CLI (recon, memory, portfolio), one @fde skill with field judgment on top, and hooks that make it automatic. Claude Code plugin and any agent that loads skills.",
   "bin": {
     "fdeops": "bin/install.js",

package/skills/fde/SKILL.md

@@ -76,6 +76,7 @@ When NOT to interrogate or challenge: unambiguous one-liners, mechanical ops, FD
 | "Draft the sponsor update" / how are we doing | `fde status` then follow `references/status.md` for the narrative |
 | "Log that they went quiet" / trust signal | `fde log contact "…" --signal amber\|green\|red` (after FDE confirms the read) |
 | Want the HTML fieldbook | `fde dashboard` |
+| "Clean up the fieldbook" / hygiene / memory feels messy | `fde doctor` - walk issues in plain language; propose fixes; never auto-rewrite without confirm. Contradictions need judgment (brief vs reality) - doctor is structural; you handle meaning. |
 
 **The debrief verb.** Highest-frequency loop. When the FDE shares notes or says "debrief": **you** run the smart path (write notes to a temp file if needed). Show the proposed routing in plain language. Only `--apply` (or pipe prefixed lines) after they confirm. Never ask them to run the CLI. Detail: `references/debrief.md`.
 
@@ -85,23 +86,24 @@ CLI missing → use the manual fallbacks inside each reference (still you write
 
 ## Proactive intelligence (run on every session start)
 
-After loading `context.md` via `fde resume`, run a quick integrity scan and open with a brief state playback - like a senior colleague who reviewed the file before the meeting started.
+Session-start already injects **TRIAGE** (deterministic, zero model tokens). When the fieldbook is dirty, TRIAGE includes a `hygiene:` line - that is the proactive doctor. Silent when clean.
+
+After you see TRIAGE + bounded `context.md`, open with a brief state playback - like a senior colleague who reviewed the file before the meeting started.
 
 **Always open with a 2-3 line state summary:**
 
 > "Last session you shipped the payment retry slice. Plan is 3/5 tasks done. Denise saw the demo Tuesday - signal is green. One thing worth noting: [finding, or 'nothing flagged - where do you want to pick up?']"
 
-**What to scan (in order, surface only what matters):**
+**What to surface (in order, at most ONE finding):**
 
-1. **Artifact staleness.** Any file the current work depends on that's 10+ days stale? Especially stakeholders.md (signals decay fast) and risks.md (unactioned risks compound).
-2. **Plan-success alignment.** Tasks in decisions.md that don't trace to any outcome in success.md - they may have absorbed in as scope creep.
-3. **Open risks overdue.** Critical or high risk open 7+ days with no mitigation.
-4. **Contradictions between files.** Reality.md vs. brief.md. Delivery.md vs. success.md.
+1. **If TRIAGE has `hygiene:`** - that is the finding. Offer: "Fieldbook has N hygiene issues - want me to walk them?" On yes: run `fde doctor`, explain in plain language, propose fixes; never auto-rewrite.
+2. Else optionally note: artifact staleness, open risks overdue, or brief↔reality tension - only if it changes today's move.
+3. If nothing flagged: one line, ask where to pick up.
 
 **Rules:**
-- Surface at most ONE finding alongside the state summary. Don't barrage.
-- If nothing's flagged, say so in one line and ask where they want to pick up.
-- Frame as observation: "I'm noticing stakeholders.md is 12 days old" - not accusation.
+- Don't re-run a second invented audit when hygiene already spoke.
+- Don't barrage. Don't accuse. Don't rewrite memory without confirm.
+- Full contradiction cleanup ("audit the sources before trusting the index") is an `@fde` conversation - doctor is the structural gate; you supply judgment.
 - If the concern is minor and won't change the next 3 moves - skip it.
 
 This is what makes fdeops a peer, not a notebook. The peer reviewed the file before you sat down.