great-cto 3.26.1 → 3.26.4

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 70 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.26.1",
+  "version": "3.26.4",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/packages/board/lib/fleet.mjs

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import path from 'path';
+import { postureOf } from '../../../scripts/lib/agent-posture.mjs';
 import os from 'os';
 import { GREAT_CTO_DIR } from './config.mjs';
 import { readFileSafe } from './util.mjs';
@@ -128,12 +129,34 @@ function getAgentsFleet(projectCwd) {
   const LLM_RATE_PER_HR   = parseFloat(process.env.GREATCTO_LLM_RATE_PER_HR || '0.30');
   const DEFAULT_TASK_MIN  = 30;
 
+/**
+ * The agent's tool grant, in the language of consequence.
+ *
+ * FOUR states, because three of them are not "no grant": an unreadable agent
+ * file, a file with no `tools:` line, a grant that is entirely routine, and a
+ * grant that holds something expensive to undo. The board rendered all of them
+ * identically before, because it never saw any of them.
+ */
+function posture(toolsLine, fileReadable) {
+  if (!fileReadable) return { state: 'unreadable', expensive: [], scopedInNameOnly: [], why: 'the agent file could not be read' };
+  if (toolsLine == null) return { state: 'undeclared', expensive: [], scopedInNameOnly: [], why: 'the agent declares no tools: line' };
+  const r = postureOf(toolsLine);
+  return {
+    state: r.unknownTools.length ? 'unclassified' : r.expensive.length ? 'expensive' : 'routine',
+    expensive: r.expensive,
+    scopedInNameOnly: r.scopedInNameOnly,
+    unknownTools: r.unknownTools,
+    why: r.unknownTools.length ? `unclassified grant(s): ${r.unknownTools.join(', ')}` : '',
+  };
+}
+
   for (const f of files) {
     const slug = f.replace(/^great_cto-/, '').replace(/\.md$/, '');
     const fp = path.join(AGENTS_DIR, f);
     const raw = readFileSafe(fp) || '';
     const descM = raw.match(/^description:\s*"?([^"\n]+)"?/m);
     const modelM = raw.match(/^model:\s*(\S+)/m);
+    const toolsM = raw.match(/^tools:\s*(.*)$/m);
     const colorM = raw.match(/^color:\s*(\S+)/m);
 
     const vs = byAgent.get(slug) || [];
@@ -155,6 +178,11 @@ function getAgentsFleet(projectCwd) {
     // Estimated cost — DEFAULT_TASK_MIN per verdict (no real timing data here).
     const estLlmUsd   = (vs30d.length * DEFAULT_TASK_MIN / 60) * LLM_RATE_PER_HR;
     const estHumanUsd = (vs30d.length * DEFAULT_TASK_MIN / 60) * HUMAN_RATE_PER_HR;
+    // NOT a measurement. Both sides are runs x DEFAULT_TASK_MIN x a rate, so this
+    // ratio is HUMAN_RATE/LLM_RATE for every agent that ran at all — 500 by
+    // construction. metrics.mjs nulls its equivalent for exactly this reason;
+    // this one shipped as a per-agent number and read like one. Kept, because
+    // removing a field breaks the board, but labelled at the source.
     const savingsX = estLlmUsd > 0 ? Math.round(estHumanUsd / estLlmUsd) : null;
     const realLlmUsd = vs30d.reduce((s, v) => s + (v.cost_usd || 0), 0);
 
@@ -167,7 +195,18 @@ function getAgentsFleet(projectCwd) {
     agents.push({
       slug,
       description: descM?.[1]?.trim() || '',
-      model: modelM?.[1]?.trim() || 'sonnet',
+      // THREE states, not a default. `model: modelM || 'sonnet'` reported every
+      // agent with no `model:` line as pinned to sonnet, so "pinned to sonnet"
+      // and "not pinned at all" were the same string — and an unreadable agent
+      // file produced the same answer a third time. The fleet cannot show what
+      // it cannot distinguish.
+      model: raw ? (modelM?.[1]?.trim() ?? null) : null,
+      model_state: !raw ? 'unreadable' : modelM ? 'pinned' : 'undeclared',
+      // The tool grant, named in the language of consequence rather than listed.
+      // `/api/agents-installed` did not read `tools:` at all, so the board had
+      // nowhere to get it — scripts/lib/agent-posture.mjs has classified these
+      // since 3.24.0 and nothing was consuming it.
+      posture: posture(toolsM?.[1] ?? null, Boolean(raw)),
       color: colorM?.[1]?.trim() || null,
       domain: deriveDomain(slug),
       runs_total: vs.length,
@@ -182,6 +221,9 @@ function getAgentsFleet(projectCwd) {
       human_usd_30d_est: Math.round(estHumanUsd),
       llm_usd_30d_real: realLlmUsd > 0 ? Math.round(realLlmUsd * 100) / 100 : null,
       savings_x: savingsX,
+      // 'ratio' = the rate ratio, identical for every agent. 'measured' would
+      // require per-run timing, which no path produces today.
+      savings_source: savingsX == null ? null : 'ratio',
       health,
       retired: isRetired(slug),
       // Four states, and only `exceeded` can hold a dispatch — see

package/board/packages/board/lib/routes.mjs

@@ -1518,14 +1518,26 @@ async function dispatch(req, res, url, cwd) {
     const tasks = getTasks(cwd);
     const nowMs = Date.now();
     const STUCK_H = 48;
-    const stuck = tasks
-      .filter(t => t.status === 'in_progress')
+    // `stuck` was ALWAYS EMPTY and had been since it was written. It read
+    // `t.startedAt`, a field no code path in this repository produces — a task
+    // carries created_at / updated_at / closed_at and nothing else. Every row
+    // got `age_h: null` and was removed by the filter below, so the panel
+    // reported "nothing is stuck" about a question it never asked. There are
+    // seven in-progress tasks here as this is written.
+    //
+    // `updated_at` is the honest proxy: in progress, and unchanged for STUCK_H.
+    // A task whose age cannot be determined is COUNTED, not dropped — an
+    // unmeasurable task is not a healthy one.
+    const inProgress = tasks.filter(t => t.status === 'in_progress');
+    let stuckUnmeasurable = 0;
+    const stuck = inProgress
       .map(t => {
-        const startedAt = t.startedAt ? new Date(t.startedAt).getTime() : null;
-        const ageH = startedAt ? (nowMs - startedAt) / 3600000 : null;
-        return { id: t.id, title: t.title, agent: t.agent, age_h: ageH ? Math.round(ageH) : null };
+        const since = t.updated_at || t.created_at || null;
+        const ms = since ? new Date(since).getTime() : NaN;
+        if (!Number.isFinite(ms)) { stuckUnmeasurable += 1; return null; }
+        return { id: t.id, title: t.title, agent: t.agent, age_h: Math.round((nowMs - ms) / 3600000), since };
       })
-      .filter(t => t.age_h !== null && t.age_h > STUCK_H);
+      .filter(t => t && t.age_h > STUCK_H);
 
     // Per-agent budgets from PROJECT.md
     const projectMdPath = path.join(cwd, '.great_cto', 'PROJECT.md');
@@ -1583,7 +1595,8 @@ async function dispatch(req, res, url, cwd) {
     // line the parser could not read is reported rather than dropped, because a
     // budget silently ignored is a limit its author believes they have.
     res.end(JSON.stringify({
-      stuck, budgets, goal_ancestry: goalAncestry, tool_failure_rate_1h: toolFailureRate1h,
+      stuck, stuck_in_progress: inProgress.length, stuck_unmeasurable: stuckUnmeasurable,
+      budgets, goal_ancestry: goalAncestry, tool_failure_rate_1h: toolFailureRate1h,
       budgets_deprecated_key: budgetsDeprecatedKey,
       budgets_malformed: budgetsMalformed,
       // Three states, not two: read / absent / unreadable. Without these, a

package/board/packages/board/public/index.html

@@ -577,6 +577,8 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 }
 .live-dot { width: 6px; height: 6px; border-radius: 50%; background: var(--status-review); }
 .live-dot.error { background: var(--status-blocked); }
+  /* Neither live nor failed: the handshake has not resolved. Three states. */
+  .live-dot.connecting { background: var(--text3); animation: none; }
 .live-dot.pulse { animation: pulse 2s infinite; }
 @keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.4; } }
 
@@ -648,9 +650,13 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 .tab-btn:hover { background: var(--bg-muted); color: var(--text); }
 .tab-btn.active { background: var(--bg-strong); color: var(--text); font-weight: 500; }
 
-
-}
-/* Period chip-bar — slim version of tab-btn */
+/* A stray `}` stood here, left behind when `.leash-chip` was removed (34657cf5
+   added it, a later cleanup took the rule and not its brace) along with the
+   comment that introduced it. At the top level a `}` opens a qualified rule, so
+   it swallowed everything up to the next `{` — brace, dead comment and the
+   `.icon-btn` selector became one invalid prelude, and `.icon-btn`'s box went
+   with it. The icon buttons had been rendering at the browser's default size,
+   beside a `:hover` rule that still worked. */
 .icon-btn {
   background: transparent; border: 1px solid transparent;
   width: 30px; height: 30px;
@@ -1433,6 +1439,26 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   /* Same shape as `.muted`: the `--mono` token exists and is used 115×, the
      CLASS that applies it did not. */
   .mono { font-family: var(--mono); }
+  /* The board has two text inputs styled in place — `#agent-panel input` and
+     `.fleet-search input[type="search"]` — and a third, the Sessions search box,
+     that asked for the house look by name and got the user agent's. Same values
+     as those two, said once, so the name now means what it says. */
+  .input {
+    background: var(--bg-muted); border: 1px solid var(--border);
+    color: var(--text); font-family: var(--mono); font-size: var(--fs-body);
+    padding: 8px 12px; border-radius: 0;
+  }
+  .input:focus { outline: 2px solid var(--focus-ring); outline-offset: 1px; border-color: transparent; }
+  /* Visually hidden, still read aloud. The one use — the verdict modal's
+     `aria-labelledby` target — carried the whole pattern inline, which is how a
+     second use would have got a heading that is merely invisible to everyone, or
+     merely visible to everyone. `clip-path` over the old `left:-10000px`: an
+     off-screen box still counts as layout, and in an RTL context widens the page. */
+  .sr-only {
+    position: absolute; width: 1px; height: 1px;
+    margin: -1px; padding: 0; border: 0;
+    overflow: hidden; clip-path: inset(50%); white-space: nowrap;
+  }
 .tier-badge { font-size: var(--fs-caption); padding: 1px 8px; border-radius: 999px; margin-left: 6px;
   font-family: var(--mono); white-space: nowrap; }
 .tier-badge:empty { display: none; }
@@ -2115,11 +2141,30 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   background: var(--bg-card); color: var(--text); min-width: 26ch;
 }
 .budgets-table { width: 100%; border-collapse: collapse; font-size: var(--fs-body); }
-.
+/* Restored from ad779c7a~1. That commit — about subagent batching — replaced
+   this selector with a bare `.` and left `id var(--border);`, the tail of a
+   duplicated border-bottom, before the closing brace.
+
+   `.` is not a selector, and CSS does not stop there: the prelude runs on to the
+   next `{`, which is `td`'s, and takes `td`'s block with it. Confirmed against
+   the released 3.26.0 with the browser's own parser — of this region it keeps
+   `.budgets-table`, `.bt-slug`, `.bt-desc`, `.bt-runs`, `.bt-cap`, `.bt-spend`,
+   `.bt-usd`, `th[title]` and `.budgets-idle summary`, and exactly `th` and `td`
+   are gone. So the table has had no header typography AND no cell padding or
+   borders since that commit. `th[title] { cursor: help }` survived, one rule
+   further down, which is part of why nobody looked: the headers still did
+   something on hover.
+
+   `font-weight: 500` is kept deliberately and is NOT a line that crept in. It
+   was ad779c7a's own edit — one of seven in that commit, and its sibling
+   `.cost-table th` took the identical change on the line above and parses fine.
+   The weight normalisation was the point of the commit; only this rule's
+   selector was destroyed while applying it. Dropping it would leave `th` at the
+   UA's 700, the one weight this design says it does not have. */
+.budgets-table th {
   text-align: left; font-family: var(--mono); font-weight: 500; font-size: var(--fs-eyebrow);
   letter-spacing: 0.08em; text-transform: uppercase; color: var(--text2);
   padding: 0 12px 8px 0; border-bottom: 1px solid var(--border);
-id var(--border);
 }
 .budgets-table td { padding: 10px 12px 10px 0; border-bottom: 1px solid var(--border); vertical-align: middle; }
 /* A row has to answer three questions: what is this agent, what does it cost,
@@ -3088,8 +3133,12 @@ id var(--border);
       </div>
     </nav>
     <div class="sidebar-footer">
-      <span class="live-dot pulse" id="live-dot"></span>
-      <span id="live-label">live · synced just now</span>
+      <!-- Ships in the CONNECTING state. This markup used to say "live · synced
+           just now" before any connection existed, so from first paint until the
+           SSE handshake resolved — or forever, if neither handler ever fired —
+           the footer asserted a sync that had not happened. -->
+      <span class="live-dot connecting" id="live-dot"></span>
+      <span id="live-label">connecting…</span>
     </div>
   </aside>
 
@@ -4554,7 +4603,7 @@ async function loadJudgeStatus() {
        <span class="js-where">${esc(s.fingerprint || '')} · from ${esc(String(s.from || '').replace(/^.*\/(?=\.great_cto)/, '~/'))}</span>
        <span class="js-form">
          <input id="judge-key" type="password" autocomplete="off" spellcheck="false" placeholder="replace key (sk-or-…)">
-         <button class="btn" onclick="saveJudgeKey()">Replace</button>
+         <button class="btn-black" onclick="saveJudgeKey()">Replace</button>
        </span>`
     : `<span class="js-dot"></span>
        <span><strong>No judge connected.</strong> Every stage will be scored
@@ -4563,7 +4612,7 @@ async function loadJudgeStatus() {
           ? `<span class="js-where">${esc(s.problems.join('; '))}</span>` : ''}
        <span class="js-form">
          <input id="judge-key" type="password" autocomplete="off" spellcheck="false" placeholder="OpenRouter key (sk-or-…)">
-         <button class="btn" onclick="saveJudgeKey()">Connect</button>
+         <button class="btn-black" onclick="saveJudgeKey()">Connect</button>
        </span>`;
 }
 
@@ -4685,7 +4734,7 @@ async function loadBudgetsPage() {
         <div class="bf-why">${esc(String(err && err.message || err))}</div>
         <div class="bf-note">Caps already set are unaffected — this failed to
           <em>read</em> them, and the pipeline reads them itself, not from here.</div>
-        <button class="btn" onclick="loadBudgetsPage()">Try again</button>
+        <button class="btn-black" onclick="loadBudgetsPage()">Try again</button>
       </div>`;
     return;
   }
@@ -5070,7 +5119,7 @@ function showVerdictDetail(idx) {
   modal.innerHTML = `
     <div class="rdm-backdrop" onclick="document.getElementById('resume-detail-modal').remove()"></div>
     <div class="rdm-card" role="dialog" aria-modal="true" aria-labelledby="rdm-title-verdict">
-      <h2 id="rdm-title-verdict" class="sr-only" style="position:absolute;left:-10000px;width:1px;height:1px;overflow:hidden;">Verdict detail: ${esc(v.agent || 'agent')} ${esc(v.verdict || '')}</h2>
+      <h2 id="rdm-title-verdict" class="sr-only">Verdict detail: ${esc(v.agent || 'agent')} ${esc(v.verdict || '')}</h2>
       <div class="rdm-head">
         <span class="ri-tag ${cls}">${esc(v.agent || 'agent')}</span>
         <span class="rdm-verdict ${cls}">${esc(v.verdict || '')}</span>
@@ -5971,8 +6020,8 @@ async function loadSessions() {
         <span class="muted" style="white-space:nowrap">${ago(s.modified)} · ${fmtMB(s.size_bytes)}</span>
       </div>
       <div style="margin-top:6px">
-        <button class="btn-sm" onclick="openSession('${esc(s.id)}')">transcript</button>
-        <button class="btn-sm" onclick="openEdits('${esc(s.id)}')">edits</button>
+        <button class="btn-ghost-sm" onclick="openSession('${esc(s.id)}')">transcript</button>
+        <button class="btn-ghost-sm" onclick="openEdits('${esc(s.id)}')">edits</button>
       </div>
       <div id="sess-${esc(s.id)}" style="margin-top:8px"></div>
     </div>`).join('');
@@ -6024,12 +6073,12 @@ async function searchTranscripts() {
   if (!d) { body.innerHTML = '<div class="muted">Search failed.</div>'; return; }
   if (!d.hits?.length) {
     body.innerHTML = `<div class="muted">No match for “${esc(q)}”.${d.note ? ' ' + esc(d.note) : ''}
-      <button class="btn-sm" onclick="loadSessions()">back</button></div>`;
+      <button class="btn-ghost-sm" onclick="loadSessions()">back</button></div>`;
     return;
   }
   body.innerHTML =
     `<div class="muted" style="margin-bottom:8px">${d.hits.length} match(es)${d.truncated ? ', capped' : ''}
-      <button class="btn-sm" onclick="loadSessions()">back</button></div>` +
+      <button class="btn-ghost-sm" onclick="loadSessions()">back</button></div>` +
     d.hits.map(h => `
       <div class="card" style="margin-bottom:6px">
         <div class="muted" style="font-size:.8em">${esc(h.title || h.session)} · ${esc(h.role)} · ${h.ts ? ago(h.ts) : ''}</div>
@@ -7163,8 +7212,25 @@ function renderDashboard(m) {
     // how often work bounced. '—' when nothing was accepted in the window — an
     // honest gap, not a zero.
     { v: acc.cost_per_accepted != null ? `$${acc.cost_per_accepted.toFixed(2)}` : absent('none', 'nothing was accepted in this window'), sub: '', label: acc.accepted ? `Cost / accepted (${acc.accepted})` : 'Cost / accepted' },
-    { v: acc.rework_rounds ?? 0, sub: '', label: 'Rework rounds', cls: acc.rework_rounds ? 'amber' : 'green' },
-    { v: m.security?.blocked ?? 0, sub: '', label: 'Open security blocks', cls: m.security?.blocked ? 'red' : 'green' },
+    // `?? 0` here painted a GREEN ZERO over a question nobody asked. The tile one
+    // line above goes out of its way to avoid exactly this, and these two did not:
+    // a project whose acceptance data is missing showed "0 rework rounds" in
+    // green, and — worse — a project where security has NEVER BEEN SCANNED showed
+    // "0 open security blocks" in green, which is a passing security scan that
+    // did not happen. That is this board's governing defect rendered in its most
+    // reassuring colour.
+    {
+      v: acc.rework_rounds != null ? acc.rework_rounds : absent('uncomputable', 'no accepted work in this window, so rework cannot be counted'),
+      sub: '', label: 'Rework rounds',
+      cls: acc.rework_rounds == null ? '' : acc.rework_rounds ? 'amber' : 'green',
+    },
+    {
+      v: m.security?.blocked != null ? m.security.blocked : absent('uncomputable', 'no security scan has run — this is not a clean result'),
+      sub: '', label: 'Open security blocks',
+      // No colour when unmeasured. Green would say "safe"; red would say
+      // "unsafe"; neither is known.
+      cls: m.security?.blocked == null ? '' : m.security.blocked ? 'red' : 'green',
+    },
     { v: m.tasks?.in_progress ?? 0, sub: '', label: 'In progress', cls: 'amber' },
   ];
   document.getElementById('mp-secondary').innerHTML = secondary.map(s => `

package/board/scripts/lib/agent-posture.mjs

@@ -0,0 +1,266 @@
+/**
+ * agent-posture — what does this agent's tool grant actually LET IT DO?
+ *
+ * ADR-009 ends with an instruction nobody had a way to follow: "Ask at design
+ * time, when the capability is added — not after the incident." The question it
+ * asks is about consequence — is this expensive to undo? — while every agent
+ * file answers a different question, in a different language: which tools are on
+ * the `tools:` line. Reviewing the second does not answer the first. `Bash` and
+ * `Bash(node:*)` sit two characters apart and read as careful and careless; in
+ * consequence they are the same grant.
+ *
+ * So this names the grant in the language of the decision. Vocabulary shape
+ * borrowed from OpenFirma's capability postures (`credential.read`,
+ * `communication.external.send`, `code.destructive`) — the idea only; that
+ * project is GPL-3.0 and this one is MIT, so nothing was copied.
+ *
+ * NOTHING here decides anything, exactly as in `gate-reversibility.mjs`, whose
+ * ADR-009 categories it reuses rather than inventing a second vocabulary for the
+ * same axis. It classifies, so a reviewer can see the grant they are approving.
+ */
+
+import { CATEGORIES } from './gate-reversibility.mjs';
+
+/**
+ * The postures. Each cites the ADR-009 category that makes it expensive, or
+ * `null` when the repair is simply to do the thing again.
+ */
+export const POSTURES = Object.freeze({
+  'code.read': {
+    category: null,
+    means: 'read files in the working tree',
+  },
+  'code.write': {
+    category: null,
+    means: 'create or modify files — the repair is another edit',
+  },
+  'code.destructive': {
+    category: 'destroys-evidence',
+    means: 'delete files, rewrite history, or overwrite work that is not in the index',
+  },
+  'credential.read': {
+    category: 'unrevocable-disclosure',
+    means: 'reach secrets on disk or in the environment',
+  },
+  'communication.external.send': {
+    category: 'escapes-the-machine',
+    means: 'send data off this machine — a push, a publish, a request body, a URL',
+  },
+  'network.fetch': {
+    category: null,
+    means: 'pull from the network; nothing of the user\'s leaves except the request',
+  },
+  'process.spawn': {
+    category: null,
+    means: 'start a process or another agent, which then holds its own grant',
+  },
+  payments: {
+    category: 'costs-money',
+    means: 'spend money — paid API capacity or provisioned infrastructure',
+  },
+});
+
+/**
+ * A shell is a shell. Every posture an unrestricted `Bash` confers, in one list,
+ * so the interpreters below cannot drift away from it.
+ */
+const FULL_SHELL = Object.freeze([
+  'code.read', 'code.write', 'code.destructive',
+  'credential.read', 'communication.external.send', 'network.fetch', 'process.spawn',
+]);
+
+/**
+ * Bash sub-grants, by the command they scope to.
+ *
+ * `full: true` marks the ones that scope to a name but not to a capability — an
+ * interpreter, or a command that runs other commands. `Bash(node:*)` is
+ * `node -e '<anything>'`; `Bash(find:*)` is `find . -exec <anything>`;
+ * `Bash(xargs:*)` and `Bash(awk:*)` likewise. These read as restrictions and are
+ * not, which is the reason this file exists.
+ */
+const BASH_SCOPES = Object.freeze({
+  // Scoped in name only — a full shell wearing a command name.
+  node:    { full: true, why: 'node -e runs arbitrary JavaScript, including child_process' },
+  python3: { full: true, why: 'python3 -c runs arbitrary Python, including os.system' },
+  python:  { full: true, why: 'python -c runs arbitrary Python, including os.system' },
+  xargs:   { full: true, why: 'xargs exists to run other commands' },
+  find:    { full: true, why: 'find -exec and -delete run other commands and remove files' },
+  awk:     { full: true, why: 'awk has system() and can redirect print into a file' },
+  sh:      { full: true, why: 'a shell' },
+  bash:    { full: true, why: 'a shell' },
+  zsh:     { full: true, why: 'a shell' },
+  env:     { full: true, why: 'env runs the command that follows it' },
+  eval:    { full: true, why: 'eval runs the string that follows it' },
+
+  // Genuinely narrower.
+  git:    { postures: ['code.read', 'code.write', 'code.destructive', 'communication.external.send'],
+            why: 'push sends the tree to a remote; checkout -- and reset --hard destroy uncommitted work' },
+  npm:    { postures: ['code.read', 'code.write', 'network.fetch', 'communication.external.send', 'process.spawn'],
+            why: 'install runs lifecycle scripts; publish escapes the machine' },
+  bd:     { postures: ['code.read', 'code.write', 'communication.external.send'],
+            why: 'bd sync pushes the task store to its remote' },
+  cat:    { postures: ['code.read', 'credential.read'],
+            why: 'the file it reads may be ~/.great_cto/secrets.env' },
+  source: { postures: ['code.read', 'credential.read'],
+            why: 'sourcing an env file puts its secrets in the environment' },
+  sort:   { postures: ['code.read', 'code.write'], why: 'sort -o writes' },
+  tee:    { postures: ['code.read', 'code.write'], why: 'writes what it reads' },
+  rm:     { postures: ['code.destructive'], why: 'removes files' },
+
+  ls:     { postures: ['code.read'] },
+  grep:   { postures: ['code.read'] },
+  wc:     { postures: ['code.read'] },
+  head:   { postures: ['code.read'] },
+  tail:   { postures: ['code.read'] },
+  date:   { postures: ['code.read'] },
+  echo:   { postures: ['code.read'] },
+  printf: { postures: ['code.read'] },
+  export: { postures: ['code.read'] },
+  mkdir:  { postures: ['code.write'] },
+  touch:  { postures: ['code.write'] },
+});
+
+/** Non-Bash tools. */
+const TOOL_POSTURES = Object.freeze({
+  Read: ['code.read'],
+  Glob: ['code.read'],
+  Grep: ['code.read'],
+  Write: ['code.write'],
+  Edit: ['code.write'],
+  NotebookEdit: ['code.write'],
+  // A URL is a channel. A fetch of `https://evil/?leak=<secret>` is a send, and
+  // an agent that can read a file and reach the network can move it.
+  WebFetch: ['network.fetch', 'communication.external.send'],
+  WebSearch: ['network.fetch', 'communication.external.send'],
+  Agent: ['process.spawn'],
+  Task: ['process.spawn'],
+});
+
+/** MCP and beta tools, matched by prefix — the list of these grows monthly. */
+const PREFIX_POSTURES = Object.freeze([
+  [/^advisor_/,   ['network.fetch', 'communication.external.send', 'payments']],
+  [/^memory_/,    ['code.read', 'code.write']],
+  [/^mcp__great_cto_llm_router__/, ['network.fetch', 'communication.external.send', 'payments']],
+  [/^mcp__grafana__/, ['network.fetch']],
+]);
+
+/**
+ * Split a `tools:` frontmatter value into tokens. `Bash(git:*)` contains a comma
+ * in no case we ship, but the split is on commas outside parentheses anyway, so
+ * a future `Bash(a:*, b:*)` does not silently become two broken tokens.
+ */
+export function splitTools(line) {
+  const out = [];
+  let depth = 0; let cur = '';
+  for (const ch of String(line ?? '')) {
+    if (ch === '(') depth++;
+    if (ch === ')') depth--;
+    if (ch === ',' && depth === 0) { out.push(cur.trim()); cur = ''; continue; }
+    cur += ch;
+  }
+  if (cur.trim()) out.push(cur.trim());
+  return out.filter(Boolean);
+}
+
+/**
+ * @returns {{postures:string[], unknown:boolean, fullShell:boolean, why:string}}
+ *
+ * THREE states for the tool itself, and `unknown` is the one that earns its
+ * keep: a tool this table has never heard of grants `unknown`, never nothing.
+ * A grant nobody classified must not read as a grant that was classified and
+ * found harmless.
+ */
+export function postureOfTool(tool) {
+  const t = String(tool ?? '').trim();
+  if (!t) return { postures: [], unknown: true, fullShell: false, why: 'no tool given' };
+
+  if (t === '*' || t === 'All tools') {
+    return { postures: [...FULL_SHELL, 'payments'], unknown: false, fullShell: true, why: 'every tool' };
+  }
+  if (t === 'Bash') {
+    return { postures: [...FULL_SHELL], unknown: false, fullShell: true, why: 'unrestricted shell' };
+  }
+
+  const scoped = /^Bash\(([^:)]+)/.exec(t);
+  if (scoped) {
+    const cmd = scoped[1].trim();
+    const hit = BASH_SCOPES[cmd];
+    if (!hit) {
+      return {
+        postures: [], unknown: true, fullShell: false,
+        why: `Bash scope '${cmd}' is not in the table — treat as unjudged, not as narrow. Add it to agent-posture.mjs.`,
+      };
+    }
+    if (hit.full) {
+      return { postures: [...FULL_SHELL], unknown: false, fullShell: true, why: hit.why };
+    }
+    return { postures: [...hit.postures], unknown: false, fullShell: false, why: hit.why ?? '' };
+  }
+
+  if (TOOL_POSTURES[t]) {
+    return { postures: [...TOOL_POSTURES[t]], unknown: false, fullShell: false, why: '' };
+  }
+  for (const [re, postures] of PREFIX_POSTURES) {
+    if (re.test(t)) return { postures: [...postures], unknown: false, fullShell: false, why: '' };
+  }
+  return {
+    postures: [], unknown: true, fullShell: false,
+    why: `'${t}' is not in the table — treat as unjudged, not as harmless. Add it to agent-posture.mjs.`,
+  };
+}
+
+/**
+ * The posture of a whole `tools:` line.
+ *
+ * @returns {{postures:string[], expensive:string[], unknownTools:string[],
+ *            fullShellVia:string[], scopedInNameOnly:string[]}}
+ */
+export function postureOf(toolsLine) {
+  const tools = splitTools(toolsLine);
+  const postures = new Set();
+  const unknownTools = [];
+  const fullShellVia = [];
+  const scopedInNameOnly = [];
+
+  for (const t of tools) {
+    const r = postureOfTool(t);
+    if (r.unknown) { unknownTools.push(t); continue; }
+    for (const p of r.postures) postures.add(p);
+    if (r.fullShell) {
+      fullShellVia.push(t);
+      // `Bash` is honest about being a shell. `Bash(node:*)` is not.
+      if (t !== 'Bash' && t !== '*' && t !== 'All tools') scopedInNameOnly.push(t);
+    }
+  }
+
+  const ordered = Object.keys(POSTURES).filter((p) => postures.has(p));
+  return {
+    postures: ordered,
+    expensive: ordered.filter((p) => POSTURES[p].category),
+    unknownTools,
+    fullShellVia,
+    scopedInNameOnly,
+  };
+}
+
+/** One line for a human reviewing a grant, in their words. */
+export function describePosture(r) {
+  const parts = [];
+  if (r.expensive.length) {
+    parts.push(`expensive: ${r.expensive.map((p) => `${p} (${CATEGORIES[POSTURES[p].category]})`).join('; ')}`);
+  } else if (r.postures.length) {
+    parts.push(`routine: ${r.postures.join(', ')}`);
+  }
+  if (r.scopedInNameOnly.length) {
+    parts.push(`scoped in name only: ${r.scopedInNameOnly.join(', ')} — a full shell`);
+  }
+  if (r.unknownTools.length) {
+    parts.push(`NOT CLASSIFIED: ${r.unknownTools.join(', ')} — unjudged, not harmless`);
+  }
+  return parts.join(' · ') || 'no tools granted';
+}
+
+/** Every posture name, for a surface that wants a legend. */
+export function knownPostures() {
+  return Object.keys(POSTURES);
+}

package/board/scripts/lib/doc-links.mjs

@@ -32,13 +32,38 @@
  * authoring work, done deliberately, a few documents at a time.
  */
 
-import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import path from 'node:path';
 
 /** Generated summaries and translations are copies, not documents. */
 const IS_SUMMARY = /\.summary\.md$/;
-const IS_TRANSLATION = /^docs\/[a-z]{2}(-[A-Z]{2})?\//;
 
+/**
+ * A two-letter directory is not evidence of a language.
+ *
+ * This used to be `/^docs\/[a-z]{2}(-[A-Z]{2})?\//`, which reads `docs/qa/`,
+ * `docs/ai/`, `docs/ci/`, `docs/ux/` and `docs/db/` as language codes and drops
+ * every document under them — silently, from the board's docs tab and from the
+ * link graph both, because a dropped document declares nothing that could go
+ * missing. `docs/qa/` was already being eaten; the rest were waiting.
+ *
+ * A whitelist of language codes would rot the first time someone adds one, so
+ * the test is STRUCTURAL instead: a translation MIRRORS a document at the docs
+ * root. `docs/ru/index.md` is a translation because `docs/index.md` exists;
+ * `docs/qa/QA-judge-provenance.md` is not, because `docs/QA-judge-provenance.md`
+ * does not. Measured across all ten two-letter directories here — de, es, fr,
+ * ja, ko, pt-BR, ru, zh-CN, zh-TW each mirror 1 of 1; qa mirrors 0 of 2 — and it
+ * self-corrects when a language is added or removed.
+ *
+ * Consequence worth stating, because it is a visible surface change hiding
+ * inside a classifier fix: `docs/qa/` drafts now APPEAR on the board's docs tab.
+ * That is the intended direction — the board is local and should show drafts —
+ * but it is not what a reader expects from a regex change.
+ */
+const LANG_DIR = /^docs\/[a-z]{2}(?:-[A-Z]{2})?\//;
+
+/** The basename a translation would be a translation OF. */
+const baseName = (rel) => rel.slice(rel.lastIndexOf('/') + 1);
 export function listDocs(root = 'docs') {
   // The translation rule is written against a path that starts at the docs
   // directory. `root` may be relative ('docs') or absolute (the board serves
@@ -47,7 +72,7 @@ export function listDocs(root = 'docs') {
   // matches nothing on an absolute walk and translations count as documents,
   // which is a wrong number that looks like a right one.
   const base = path.dirname(root);
-  const out = [];
+  const found = [];
   const walk = (dir) => {
     let entries;
     try { entries = readdirSync(dir); } catch { return; }
@@ -56,11 +81,24 @@ export function listDocs(root = 'docs') {
       let st;
       try { st = statSync(full); } catch { continue; }
       if (st.isDirectory()) walk(full);
-      else if (e.endsWith('.md') && !IS_SUMMARY.test(e) && !IS_TRANSLATION.test(path.relative(base, full))) out.push(full);
+      else if (e.endsWith('.md') && !IS_SUMMARY.test(e)) found.push({ full, rel: path.relative(base, full) });
     }
   };
   walk(root);
-  return out.sort();
+
+  // Two passes, because whether a file under a two-letter directory is a
+  // TRANSLATION depends on the rest of the tree: it is one when a document of
+  // the same name lives outside every language directory. One pass cannot know
+  // that, and the single-pass version of this rule only looked at the docs
+  // root — which called `docs/ru/ADR-001-a.md` a document because its source
+  // sits in `docs/adr/`.
+  const sources = new Set(
+    found.filter((f) => !LANG_DIR.test(f.rel)).map((f) => baseName(f.rel)),
+  );
+  return found
+    .filter((f) => !(LANG_DIR.test(f.rel) && sources.has(baseName(f.rel))))
+    .map((f) => f.full)
+    .sort();
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.26.1",
+  "version": "3.26.4",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",