great-cto 3.59.0 → 3.60.0

package/board/packages/board/public/index.html

@@ -2426,6 +2426,13 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 .usage-table th { text-align: left; font-weight: 500; color: var(--text3); font-size: var(--fs-caption); padding: 4px 6px; border-bottom: 1px solid var(--border); white-space: nowrap; }
 .usage-table td { padding: 6px; border-bottom: 1px solid var(--border); color: var(--text); vertical-align: top; }
 .usage-table td.num, .usage-table th.num { text-align: right; font-family: var(--mono); font-variant-numeric: tabular-nums; white-space: nowrap; }
+.skills-controls { display: flex; flex-wrap: wrap; align-items: center; gap: 12px; margin-bottom: 16px; }
+.skills-controls label { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; font-size: var(--fs-small); color: var(--text2); }
+.skills-controls input, .skills-controls select { min-height: 32px; max-width: 100%; padding: 5px 8px; border: 1px solid var(--border); color: var(--text); background: var(--bg-muted); font: inherit; }
+.skills-controls :is(input, select):focus-visible { outline: 2px solid var(--focus-ring); outline-offset: 2px; }
+#skills-table td { max-width: 320px; overflow-wrap: anywhere; }
+#skills-table code { word-break: break-all; font-family: var(--mono); font-size: var(--fs-caption); }
+@media (max-width: 767px) { .skills-controls :is(input, select) { min-height: 44px; } }
 .usage-title { max-width: 260px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .usage-tag { display: inline-block; font-family: var(--mono); font-size: var(--fs-eyebrow); letter-spacing: 0.04em; padding: 1px 5px; margin-left: 6px; border: 1px solid var(--border-strong); color: var(--text2); }
 .usage-share { display: inline-block; width: 48px; height: 6px; background: var(--bg-muted); margin-right: 6px; vertical-align: 1px; }
@@ -3461,6 +3468,10 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
         <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M4 20V10 M10 20V4 M16 20v-7 M22 20H2"/></svg>
         <span class="nav-label">Usage</span>
       </div>
+      <div class="nav-item" data-tab="skills" role="tab" tabindex="0" aria-label="Skills" title="Skills" onkeydown="navTabKeydown(event, this)" onclick="switchTab('skills', this)">
+        <svg class="icon" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M4 3h6a2 2 0 0 1 2 2v16a3 3 0 0 0-3-3H4V3zM20 3h-6a2 2 0 0 0-2 2v16a3 3 0 0 1 3-3h5V3z"/></svg>
+        <span class="nav-label">Skills</span>
+      </div>
     </nav>
     </details>
     <div class="nav-divider"></div>
@@ -3711,14 +3722,32 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
     <div class="panel" id="panel-usage" role="tabpanel">
       <div class="metrics-page">
         <div class="usage-head">
-          <h1 class="page-title">Usage <span class="muted" style="font-weight:400;font-size:var(--fs-small)">what Claude Code and Codex consumed on this machine</span></h1>
+          <h1 class="page-title">Usage <span class="muted" style="font-weight:400;font-size:var(--fs-small)">what Claude Code and Codex consumed in the selected project</span></h1>
           <div class="usage-chips" role="group" aria-label="Period">
             <button type="button" class="usage-chip" data-days="7" onclick="loadUsage(7)">7D</button>
             <button type="button" class="usage-chip active" data-days="30" onclick="loadUsage(30)">30D</button>
             <button type="button" class="usage-chip" data-days="90" onclick="loadUsage(90)">90D</button>
           </div>
         </div>
-        <div id="usage-body" class="usage-note" role="status">Reading the session logs of Claude Code and Codex on this machine.</div>
+        <div id="usage-body" class="usage-note" role="status">Reading this project's Claude Code and Codex session logs.</div>
+      </div>
+    </div>
+
+    <div class="panel" id="panel-skills" role="tabpanel" aria-label="Skills">
+      <div class="metrics-page">
+        <div class="usage-head">
+          <h1 class="page-title">Skills <span class="muted" style="font-weight:400;font-size:var(--fs-small)">local inventory, not a quality ranking</span></h1>
+          <button type="button" class="usage-chip" onclick="loadSkillsInventory()">Reload</button>
+        </div>
+        <p class="usage-note">Project scope includes only the selected project's skill directories. Machine scope shows local host directories and plugin caches, not other projects' statistics.</p>
+        <div class="skills-controls">
+          <label>Search <input id="skills-search" type="search" aria-label="Filter skills" placeholder="Filter skills…" oninput="renderSkillsInventory()"></label>
+          <label>Host location <select id="skills-host" aria-label="Skill host location" onchange="renderSkillsInventory()"><option value="all">All locations</option><option>Claude Code</option><option>Codex</option><option>Shared</option><option>Registry</option></select></label>
+          <label>Scope <select id="skills-scope" aria-label="Skill scope" onchange="renderSkillsInventory()"><option value="all">Machine + selected project</option><option value="project">Selected project only</option><option value="machine">Machine only</option></select></label>
+        </div>
+        <p id="skills-status" class="usage-note" role="status">Reading local skill metadata.</p>
+        <div id="skills-body" aria-busy="false"></div>
+        <p class="usage-note">A file in a host location is not proof that the host enabled or loaded it. Shared and registry locations do not prove compatibility with either host. SHA-256 covers only the document, not its scripts or reference tree. Upstream trust and task quality are not measured. No installation, execution or upstream network checks. Read snapshots are cached for up to 30 seconds.</p>
       </div>
     </div>
 
@@ -4107,6 +4136,7 @@ window.GctoWork.bind({
 let searchQuery = '';
 let allProjects = [];
 let currentProject = '';
+let serverDefaultProject = false;
 let inboxData = null;
 let activeFilters = { agents: new Set(), priorities: new Set(), labels: new Set() };
 // Period selector for dashboard (1/7/30/90/365 days). Persists in localStorage.
@@ -4114,12 +4144,12 @@ let currentPeriod = parseInt(localStorage.getItem('gcto.period') || '30', 10) ||
 
 // Returns ?project=slug query string for all API calls after init() sets currentProject
 function pqs() {
-  return currentProject ? `?project=${encodeURIComponent(currentProject)}` : '';
+  return currentProject && !serverDefaultProject ? `?project=${encodeURIComponent(currentProject)}` : '';
 }
 // Combined query string: ?project=X&days=Y (for metrics/cost APIs)
 function pqsd() {
   const parts = [];
-  if (currentProject) parts.push(`project=${encodeURIComponent(currentProject)}`);
+  if (currentProject && !serverDefaultProject) parts.push(`project=${encodeURIComponent(currentProject)}`);
   parts.push(`days=${currentPeriod}`);
   return '?' + parts.join('&');
 }
@@ -5130,7 +5160,7 @@ async function loadJudgeScores() {
   const el = document.getElementById('judge-scores');
   if (!el) return;
   let d;
-  try { d = await api(`/api/scores${pqs()}&limit=40`); } catch { d = null; }
+  try { d = await api(`/api/scores?limit=40${pqs().replace('?', '&')}`); } catch { d = null; }
 
   // Three states, and the empty one earns a sentence rather than a blank space:
   // "nothing has been verified yet" and "the panel is broken" look identical
@@ -5885,7 +5915,7 @@ function renderTurns(snap) {
   if (snap.state === 'unreadable') return `<div class="aa-empty aa-bad">Turns not measured: ${esc(snap.why || 'git refused')}</div>`;
   const sessions = Array.isArray(snap.sessions) ? snap.sessions : [];
   if (!sessions.length) return `<div class="aa-empty">No turn snapshots yet — they start with the next agent turn.</div>`;
-  const when = (ms) => { try { return ms ? new Date(ms).toLocaleString([], { hour12: false }) : ''; } catch { return ''; } };
+  const when = (ms) => { try { return ms ? new Date(ms).toLocaleString('en-US', { hour12: false }) : ''; } catch { return ''; } };
   return sessions.map((s) => {
     const count = Math.min(Number(s.turns) || 0, 50);
     const first = Math.max(0, (Number(s.newestTurn) || 0) - count + 1);
@@ -5974,7 +6004,7 @@ function renderAgentActivity(snap) {
     root.innerHTML = `<div class="aa-empty">No agent events recorded yet — they start with the next agent run.</div>`;
     return;
   }
-  const time = (ts) => { try { return new Date(ts).toLocaleTimeString([], { hour12: false }); } catch { return ''; } };
+  const time = (ts) => { try { return new Date(ts).toLocaleTimeString('en-US', { hour12: false }); } catch { return ''; } };
   const what = (e) => {
     if (e.kind === 'tool') {
       const p = Array.isArray(e.paths) && e.paths.length ? ` ${esc(e.paths[0])}${e.paths.length > 1 ? ` +${e.paths.length - 1}` : ''}` : '';
@@ -6000,16 +6030,70 @@ function renderAgentActivity(snap) {
 // The Harnesses card. Four states for the second opinion, and the fourth is
 // the reason the card exists: `unavailable` — declared codex, no codex here —
 // must never look like `none` or like a switch someone turned off.
+// Read-only Skills: keep controls mounted so filtering never steals focus.
+let skillsData = null;
+let _skillsRequest = 0;
+async function loadSkillsInventory() {
+  const request = ++_skillsRequest, project = currentProject;
+  const status = document.getElementById('skills-status');
+  const body = document.getElementById('skills-body');
+  skillsData = null; body.innerHTML = ''; body.setAttribute('aria-busy', 'true');
+  status.textContent = 'Reading local skill metadata.';
+  try {
+    const data = await api(`/api/skills${pqs()}`, { signal: AbortSignal.timeout(10000) });
+    if (request !== _skillsRequest || project !== currentProject) return;
+    if (!data || !Array.isArray(data.skills)) throw new Error('Invalid inventory response');
+    skillsData = data; renderSkillsInventory();
+  } catch {
+    if (request !== _skillsRequest || project !== currentProject) return;
+    status.textContent = 'Could not read skill inventory. No counts or provenance were measured.';
+    body.innerHTML = '';
+  } finally {
+    if (request === _skillsRequest && project === currentProject) body.setAttribute('aria-busy', 'false');
+  }
+}
+function renderSkillsInventory() {
+  if (!skillsData) return;
+  const body = document.getElementById('skills-body');
+  const q = document.getElementById('skills-search').value.trim().toLowerCase();
+  const host = document.getElementById('skills-host').value, scope = document.getElementById('skills-scope').value;
+  const d = skillsData;
+  const rows = d.skills.filter(s => (host === 'all' || s.host === host) && (scope === 'all' || s.scope === scope)
+    && [s.name, s.location, s.declared_source].some(v => String(v || '').toLowerCase().includes(q)));
+  document.getElementById('skills-status').textContent = `${d.state === 'partial' ? 'Partial inventory' : 'Observed inventory'} · ${rows.length} shown · ${d.skills.length} documents listed · ${fmtDate(d.observed_at)}${d.truncated ? ' · scan limit reached' : ''}`;
+  const labels = { 'missing-frontmatter': 'Missing frontmatter', 'name-mismatch': 'Name differs from directory',
+    'description-length': 'Description outside lint limits', 'invalid-frontmatter': 'Invalid frontmatter',
+    'ambiguous-yaml': 'Ambiguous YAML', 'over-context-budget': 'Over 20 KB context budget',
+    'too-large': 'Document too large', 'changed-during-read': 'Document changed during read',
+    unreadable: 'Unreadable', missing: 'Missing', 'outside-root': 'Outside allowed root' };
+  const table = rows.length ? `<div class="usage-table-wrap"><table id="skills-table" class="usage-table"><caption class="usage-note">Local document observations</caption><thead><tr><th scope="col">Skill</th><th scope="col">Location</th><th scope="col">Scope</th><th scope="col">Document integrity</th><th scope="col">Structure</th></tr></thead><tbody>${rows.map(s => `<tr>
+    <td>${esc(s.name)}<div class="usage-sub">${esc(s.host)} location</div></td>
+    <td>${esc(s.location)}${s.declared_source ? `<div class="usage-sub">Registry declaration: ${esc(s.declared_source)}</div>` : ''}${s.cache_version ? `<div class="usage-sub">Cache version: ${esc(s.cache_version)}</div>` : ''}</td>
+    <td>${s.scope === 'project' ? 'Selected project' : 'Machine'}</td>
+    <td>${s.document_sha256 ? `<code>${esc(s.document_sha256)}</code><div class="usage-sub">${esc(s.bytes)} bytes · document only</div>` : esc(labels[s.read_state] || 'Not measured')}<div class="usage-sub">Upstream revision: unknown</div></td>
+    <td>${s.read_state !== 'observed' ? 'Not checked' : s.warnings.length ? s.warnings.map(v => esc(labels[v] || v)).join('<br>') : 'No structural warnings'}<div class="usage-sub">Enabled / loaded: unknown</div></td>
+  </tr>`).join('')}</tbody></table></div>` : `<p class="usage-note">${d.skills.length ? 'No skills match these filters.' : d.state === 'partial' ? 'No documents were observed. Some sources could not be read; this is not a complete empty inventory.' : 'No skill documents found in the scanned local locations.'}</p>`;
+  body.innerHTML = table + `<details class="usage-note" style="margin-top:16px"><summary>Source coverage and registry</summary><p>Registry: ${esc(d.registry.state)} · declared at: ${esc(d.registry.declared_at || 'unknown')} · declared plugin version: ${esc(d.registry.plugin_version || 'unknown')}</p>
+    <ul>${d.sources.map(s => `<li>${esc(s.label)} · ${esc(s.scope === 'project' ? 'selected project' : 'machine')} · ${esc(s.state)}${s.warnings.length ? ' · ' + s.warnings.map(esc).join(', ') : ''}</li>`).join('')}</ul></details>`;
+}
+
 // ── Usage (great_cto-egkw) ─────────────────────────────────────────────────
 // Both hosts, side by side, from /api/usage. Three honesty rules carried from
 // the reader: an unpriced model is n/a, never $0; Claude Code's plan use is not
 // written anywhere, so it is not drawn — only the refusals are; and a host with
-// no logs on this machine says so instead of showing zeros.
+// no logs attributed to this project says so instead of showing zeros.
 let usageDays = 30;
 let usageHost = 'claude';
 let usageData = null;
 let _usageTimer = null;
 let _usageRequest = 0;
+function resetProjectUsage() {
+  clearTimeout(_usageTimer); clearTimeout(_outcomesTimer);
+  ++_usageRequest; ++_outcomesRequest;
+  usageData = null;
+  const body = document.getElementById('usage-body');
+  if (body) { body.className = 'usage-note'; body.textContent = 'Reading the selected project’s statistics…'; }
+}
 const USAGE_HOSTS = { claude: 'Claude Code', codex: 'Codex' };
 const USAGE_LOGS = { claude: '~/.claude/projects', codex: '~/.codex/sessions' };
 const USAGE_FN = { chat: 'Conversations', subagent: 'Subagents', automation: 'Automations', headless: 'Headless runs' };
@@ -6029,16 +6113,17 @@ function fmtUsdEq(n) {
 const fmtPct = (x) => (x == null ? null : `${Math.round(x * 100)}%`);
 
 async function loadUsage(days) {
+  if (!currentProject) return; // init() loads again after resolving the project.
   if (days) usageDays = days;
   document.querySelectorAll('.usage-chip[data-days]').forEach((c) => c.classList.toggle('active', Number(c.dataset.days) === usageDays));
   clearTimeout(_usageTimer);
-  const request = ++_usageRequest, requestedDays = usageDays;
+  const request = ++_usageRequest, requestedDays = usageDays, requestedProject = currentProject;
   const loadingBody = document.getElementById('usage-body');
   if (loadingBody && (!usageData || usageData.window?.days !== requestedDays)) {
     loadingBody.className = 'usage-note'; loadingBody.textContent = 'Loading session statistics…';
   }
-  const d = await api(`/api/usage?days=${usageDays}`);
-  if (request !== _usageRequest || requestedDays !== usageDays || currentTab !== 'usage') return;
+  const d = await api(`/api/usage?days=${requestedDays}${pqs().replace('?', '&')}`);
+  if (request !== _usageRequest || requestedDays !== usageDays || requestedProject !== currentProject || currentTab !== 'usage') return;
   const body = document.getElementById('usage-body');
   if (!body) return;
   if (!d || d.error) {
@@ -6052,9 +6137,9 @@ async function loadUsage(days) {
     _usageTimer = setTimeout(() => { if (currentTab === 'usage') loadUsage(); }, 2000);
     return;
   }
-  if (d.state !== 'counted') {
+  if (d.state !== 'counted' || d.scope?.kind !== 'project') {
     body.className = 'usage-note';
-    body.textContent = `Usage is not available: ${d.why || d.state}`;
+    body.textContent = `Usage is not available: ${d.why || (d.scope?.kind !== 'project' ? 'the server did not confirm project-scoped statistics; update the board' : d.state)}`;
     return;
   }
   usageData = d;
@@ -6083,7 +6168,7 @@ function usageLimitWindow(minutes) {
 function usageHostCard(d, host) {
   const name = USAGE_HOSTS[host];
   if (!d.seen || !d.seen[host]) {
-    return `<section class="usage-card" data-host="${host}"><h3>${name}</h3><p class="usage-note">No ${name} session logs on this machine (${USAGE_LOGS[host]}) — nothing to count, which is not the same as nothing used.</p></section>`;
+    return `<section class="usage-card" data-host="${host}"><h3>${name}</h3><p class="usage-note">No ${name} session logs attributed to this project — nothing to count, which is not the same as nothing used.</p></section>`;
   }
   const h = d.hosts[host];
   const unpricedHere = (d.models || []).filter((m) => m.host === host && m.usd == null).map((m) => m.model);
@@ -6124,6 +6209,10 @@ function usageHostCard(d, host) {
       : `<div class="usage-limit"><div class="usage-limit-head"><span>Plan limit</span>${absent('unloaded', usageRecorderHint(d).short)}</div>
       <div class="usage-sub">${hits.plan} refused at the plan limit · ${hits.server} server-side throttles (not your limit) in ${d.window.days} days · plan percentage: ${d.limits && d.limits.claude && d.limits.claude.recorder === 'on' ? 'from <code>claude</code> in a terminal' : '<code>great-cto statusline install</code>'}</div></div>`;
   }
+  if (d.scope?.kind === 'project') {
+    const hits = h.limitHits || { plan: 0, server: 0 };
+    limit = `<div class="usage-sub">In this project: ${hits.plan} plan-limit refusals · ${hits.server} server-side throttles in ${d.window.days} days.</div>`;
+  }
   return `<section class="usage-card" data-host="${host}">
     <h3><span>${name}</span><span class="muted">${esc(d.window.from)} → ${esc(d.window.to)}</span></h3>
     <div class="usage-big" title="${esc(`${(h.tokens || 0).toLocaleString('en-US')} tokens, cache reads included`)}">${fmtTok(h.tokens)} <span class="muted" style="font-size:var(--fs-small)">tokens</span></div>
@@ -6174,7 +6263,7 @@ function usageTopTable(d, host) {
   const name = USAGE_HOSTS[host];
   const rows = (d.top && d.top[host]) || [];
   const head = `<h3><span>${name}: heaviest conversations</span><span class="muted">share of ${name} tokens</span></h3>`;
-  if (!rows.length) return `<section class="usage-card">${head}<p class="usage-note">${d.seen && d.seen[host] ? 'Nothing in this window.' : 'No logs on this machine.'}</p></section>`;
+  if (!rows.length) return `<section class="usage-card">${head}<p class="usage-note">${d.seen && d.seen[host] ? 'Nothing in this window.' : 'No logs attributed to this project.'}</p></section>`;
   const money = host === 'claude';
   const body = rows.map((r) => {
     const tag = r.fn && r.fn !== 'chat' ? `<span class="usage-tag">${esc(USAGE_FN[r.fn] || r.fn)}</span>` : '';
@@ -6317,10 +6406,11 @@ function usageCodexLimits(d) {
 }
 
 // ── Agents and reviews (great_cto-egkw stage 3) ────────────────────────────
-// Outcomes come from /api/outcomes (verdicts of every registered project, Beads
+// Outcomes come from /api/outcomes (verdicts of the selected project, Beads
 // bugs by priority); hook refusals and failures from /api/usage (Claude Code's
 // own logs). Counts only — no bug title reaches the page.
 let _outcomesTimer = null;
+let _outcomesRequest = 0;
 function fmtSpan(days) {
   if (days == null) return '—';
   const h = days * 24;
@@ -6332,7 +6422,10 @@ function fmtSpan(days) {
 async function loadOutcomes() {
   clearTimeout(_outcomesTimer);
   if (!document.getElementById('usage-outcomes')) return;
-  const d = await api(`/api/outcomes?days=${usageDays}`);
+  const request = ++_outcomesRequest;
+  const requestedProject = currentProject, requestedDays = usageDays, requestedHost = usageHost;
+  const d = await api(`/api/outcomes?days=${requestedDays}${pqs().replace('?', '&')}`);
+  if (request !== _outcomesRequest || requestedProject !== currentProject || requestedDays !== usageDays || requestedHost !== usageHost || currentTab !== 'usage') return;
   // Looked up AFTER the answer: Usage may have re-rendered while it was on the
   // way, and an answer written into the replaced element is an answer nobody sees.
   const el = document.getElementById('usage-outcomes');
@@ -6344,14 +6437,14 @@ async function loadOutcomes() {
     _outcomesTimer = setTimeout(() => { if (currentTab === 'usage') loadOutcomes(); }, 2000);
     return;
   }
-  if (d.state !== 'counted') { el.className = 'usage-note'; el.textContent = `Outcomes are not available: ${d.why || d.state}`; return; }
+  if (d.state !== 'counted' || d.scope?.kind !== 'project') { el.className = 'usage-note'; el.textContent = `Project outcomes are not available: ${d.why || d.state}`; return; }
   el.className = 'usage-grid';
   el.innerHTML = usageAgentsCard(d) + usageFindingsCard(d);
 }
 
 function usageAgentsCard(d) {
   const A = d.agents || { agents: [] };
-  const head = `<h3><span>Agents: what they concluded</span><span class="muted">${d.projects} projects · ${esc(d.window.from)} → ${esc(d.window.to)}</span></h3>`;
+  const head = `<h3><span>Agents: what they concluded</span><span class="muted">this project · ${esc(d.window.from)} → ${esc(d.window.to)}</span></h3>`;
   if (!A.agents.length) return `<section class="usage-card" data-outcomes="agents">${head}<p class="usage-note">No great_cto agent recorded a verdict in this period.</p></section>`;
   const dispatched = Object.fromEntries(((usageData && usageData.lists && usageData.lists.claude && usageData.lists.claude.agents) || []).map((a) => [a.name, a.n]));
   const rows = A.agents.map((a) => {
@@ -6391,7 +6484,7 @@ function usageFindingsCard(d) {
 
 function usageHooksCards(d) {
   const H = d.hooks;
-  if (!d.seen || !d.seen.claude) return '<p class="usage-note">No Claude Code logs on this machine — hook outcomes are read from them.</p>';
+  if (!d.seen || !d.seen.claude) return '<p class="usage-note">No Claude Code logs attributed to this project — hook outcomes are read from them.</p>';
   if (!H) return '';
   const total = (rows) => (rows || []).reduce((n, r) => n + r.n, 0);
   return `<div class="usage-lists">
@@ -6411,8 +6504,7 @@ function renderUsage(d) {
   const hostBtn = (h) => `<button type="button" class="usage-chip${usageHost === h ? ' active' : ''}" aria-pressed="${usageHost === h}" onclick="setUsageHost('${h}')">${USAGE_HOSTS[h]}</button>`;
   body.innerHTML = `
     <div class="usage-grid">${usageHostCard(d, 'claude')}${usageHostCard(d, 'codex')}</div>
-    <h2 class="mp-section-label">Limits</h2>
-    <div class="usage-grid">${usageClaudeLimits(d)}${usageCodexLimits(d)}</div>
+    <p class="usage-note">Statistics attributable to <b>${esc(currentProject || 'the current project')}</b> only, including existing linked Git worktrees. Sessions without a recoverable project identity are excluded; missing history is not proof of no activity. Account-wide subscription quotas are not project statistics and are not shown here.</p>
     <h2 class="mp-section-label">By day, by kind of work</h2>
     <div class="usage-grid">${usageDayChart(d, 'claude')}${usageDayChart(d, 'codex')}</div>
     <h2 class="mp-section-label">Heaviest conversations</h2>
@@ -6427,7 +6519,7 @@ function renderUsage(d) {
       ${usageList('MCP servers', l.mcp, 'No MCP tools were called in this window.')}
     </div>
     <h2 class="mp-section-label">Agents and reviews</h2>
-    <div id="usage-outcomes" class="usage-note" role="status">Reading every project's verdicts and Beads.</div>
+    <div id="usage-outcomes" class="usage-note" role="status">Reading this project's verdicts and Beads.</div>
     <h2 class="mp-section-label">Guards and hooks</h2>
     ${usageHooksCards(d)}
     <p class="usage-note">Read on this machine from ${USAGE_LOGS.claude} and ${USAGE_LOGS.codex}; nothing is sent anywhere. Tokens include cache reads. <b>$ list</b> is the API list-price equivalent from great_cto's price table, not a subscription bill — Claude Code's own estimate can differ for some models. A model without a price shows n/a, never $0.</p>`;
@@ -7372,7 +7464,7 @@ async function searchTranscripts() {
   const body = document.getElementById('sessions-body');
   if (q.length < 3) { loadSessions(); return; }
   body.innerHTML = '<div class="muted">Searching…</div>';
-  const d = await api(`/api/session-search${pqs()}&q=${encodeURIComponent(q)}`);
+  const d = await api(`/api/session-search?q=${encodeURIComponent(q)}${pqs().replace('?', '&')}`);
   if (!d) { body.innerHTML = '<div class="muted">Search failed.</div>'; return; }
   if (!d.hits?.length) {
     body.innerHTML = `<div class="muted">No match for “${esc(q)}”.${d.note ? ' ' + esc(d.note) : ''}
@@ -7621,7 +7713,14 @@ async function switchProject(slug) {
   if (lbl) lbl.textContent = `loading ${slug}…`;
   // Close existing SSE so it doesn't push the wrong project's data
   if (window._gctoSSE) { try { window._gctoSSE.close(); } catch {} window._gctoSSE = null; }
+  serverDefaultProject = false;
   currentProject = slug;
+  document.getElementById('project-name').textContent = slug;
+  document.getElementById('crumb-project').textContent = slug;
+  document.title = `${slug} · great_cto`;
+  resetProjectUsage();
+  if (currentTab === 'usage') loadUsage();
+  if (currentTab === 'skills') loadSkillsInventory();
   window.GctoWork.reset();
   // Optimistic UI clear
   allTasks = [];
@@ -7634,12 +7733,10 @@ async function switchProject(slug) {
     api(`/api/share${pqs()}`),
     api(`/api/inbox${pqs()}`),
   ]);
+  if (slug !== currentProject) return;
   allTasks = tasks || [];
   metrics = met || {};
   shareState = share || { enabled: false, url: null };
-  document.getElementById('project-name').textContent = slug;
-  document.getElementById('crumb-project').textContent = slug;
-  document.title = `${slug} · great_cto`;
   const me = (allProjects || []).find(p => p.slug === slug);
   const arch = me?.archetype || 'default';
   const swIcon = document.getElementById('proj-switch-icon');
@@ -7833,7 +7930,11 @@ async function init() {
     || (allProjects[0]?.slug)
     || fromTaskId
     || 'project';
+  serverDefaultProject = !urlProject && !(allProjects || []).some(p => p.slug === proj);
   currentProject = proj;
+  resetProjectUsage();
+  if (currentTab === 'usage') loadUsage();
+  if (currentTab === 'skills') loadSkillsInventory();
   window.GctoWork.reset();
   document.getElementById('project-name').textContent = proj;
   document.getElementById('crumb-project').textContent = proj;
@@ -8498,7 +8599,7 @@ function renderShareState(state) {
                  : ago < 1440 ? `${Math.floor(ago/60)}h ago`
                  : `${Math.floor(ago/1440)}d ago`;
     const stale = ago > 60 * 24 ? ' · ⚠ data is stale — click ↻ Republish' : '';
-    metaEl.textContent = `Published ${agoStr} (${dt.toLocaleString()})${stale}`;
+    metaEl.textContent = `Published ${agoStr} (${dt.toLocaleString('en-US')})${stale}`;
   } else if (metaEl) {
     metaEl.textContent = '';
   }
@@ -8917,6 +9018,7 @@ function cmdkActions() {
     { group: 'Go', label: 'Fleet — the agents and what they may do', run: () => switchTab('fleet') },
     { group: 'Go', label: 'Harness — host and second opinion', run: () => switchTab('harness') },
     { group: 'Go', label: 'Usage — what Claude Code and Codex consumed', run: () => switchTab('usage') },
+    { group: 'Go', label: 'Skills — local inventory and document integrity', run: () => switchTab('skills') },
     { group: 'Go', label: 'Settings', run: () => switchTab('settings') },
     { group: 'Go', label: 'Tasks board (#/kanban, deep link)', run: () => switchTab('kanban') },
     { group: 'Do', label: 'New issue', run: () => openNewIssueModal() },
@@ -9109,7 +9211,7 @@ try {
 // panels, not keys.
 const DEST = { decisions: 'inbox', ledger: 'budgets', fleet: 'agents', dashboard: 'budgets', share: 'settings', notifications: 'settings' };
 const NAV = { inbox: 'decisions', budgets: 'ledger', agents: 'fleet', dashboard: 'ledger', share: 'settings', notifications: 'settings' };
-const ROUTES = { work: 1, history: 1, decisions: 1, ledger: 1, fleet: 1, harness: 1, usage: 1, settings: 1, kanban: 1 };
+const ROUTES = { work: 1, history: 1, decisions: 1, ledger: 1, fleet: 1, harness: 1, usage: 1, skills: 1, settings: 1, kanban: 1 };
 function switchTab(id, el) {
   const lid = DEST[id] || id;          // the panel's own name
   const navKey = NAV[id] || id;        // the destination to highlight
@@ -9118,7 +9220,7 @@ function switchTab(id, el) {
   currentTab = lid;
   document.getElementById('nav-views-label').hidden = lid !== 'agents';
   document.querySelector('.nav-views').hidden = lid !== 'agents';
-  if (['agents', 'budgets', 'harness', 'usage'].includes(lid)) document.getElementById('tools-nav').open = true;
+  if (['agents', 'budgets', 'harness', 'usage', 'skills'].includes(lid)) document.getElementById('tools-nav').open = true;
   if (lid === 'work' || lid === 'history') window.GctoWork.refresh();
   if (ROUTES[id]) {
     if (location.hash !== `#/${id}`) history.replaceState(null, '', `#/${id}`);
@@ -9141,7 +9243,7 @@ function switchTab(id, el) {
   // crumb — `labels` used to be referenced here but is only ever a function-local in
   // this file, so this threw ReferenceError on every tab switch and skipped the per-tab
   // loaders below (e.g. logs stuck on "Loading…"). Use a local label map.
-  const TAB_LABELS = { work: 'Work', history: 'History', decisions: 'Decisions', ledger: 'Ledger', fleet: 'Fleet', harness: 'Harness', usage: 'Usage', settings: 'Settings', budgets: 'Budgets', docs: 'Docs', dashboard: 'Board', inbox: 'Inbox', tasks: 'Tasks', agents: 'Agents', logs: 'Activity', notifications: 'Notifications', metrics: 'Metrics', share: 'Share' };
+  const TAB_LABELS = { work: 'Work', history: 'History', decisions: 'Decisions', ledger: 'Ledger', fleet: 'Fleet', harness: 'Harness', usage: 'Usage', skills: 'Skills', settings: 'Settings', budgets: 'Budgets', docs: 'Docs', dashboard: 'Board', inbox: 'Inbox', tasks: 'Tasks', agents: 'Agents', logs: 'Activity', notifications: 'Notifications', metrics: 'Metrics', share: 'Share' };
   const crumb = document.getElementById('crumb-here'); if (crumb) crumb.textContent = TAB_LABELS[id] || TAB_LABELS[lid] || 'Board';
   // Budgets render on Metrics, so the heartbeat that feeds them has to be
   // fetched when Metrics opens — not only from the agents drill-in it used to
@@ -9175,6 +9277,7 @@ function switchTab(id, el) {
   if (lid === 'settings') loadSettingsPage();
   if (lid === 'harness') renderHarnesses();
   if (lid === 'usage') loadUsage();
+  if (lid === 'skills') loadSkillsInventory();
 }
 
 // Sidebar tabs: Enter/Space activate, arrows move (WAI-ARIA tablist).
@@ -9983,9 +10086,11 @@ function relTime(iso) {
   if (s < 86400) return `${Math.round(s/3600)}h`;
   return `${Math.round(s/86400)}d`;
 }
-function fmtDate(iso) { return iso ? new Date(iso).toLocaleString() : '—'; }
+// Board-owned copy and formatting stay English; task/document content is rendered
+// in its original language. Locale is fixed, but the operator's timezone is not.
+function fmtDate(iso) { return iso ? new Date(iso).toLocaleString('en-US') : '—'; }
 // Short date+time stamp for cards (full timestamp goes in the title attribute).
-function fmtDT(iso) { return iso ? new Date(iso).toLocaleString(undefined, { day: '2-digit', month: '2-digit', hour: '2-digit', minute: '2-digit' }) : ''; }
+function fmtDT(iso) { return iso ? new Date(iso).toLocaleString('en-US', { day: '2-digit', month: '2-digit', hour: '2-digit', minute: '2-digit' }) : ''; }
 // Money formatting — uses non-breaking thin space (U+202F) as thousands separator
 // to avoid the comma-as-decimal confusion ($195,960 reads as "195.96" in EU/RU
 // locales). Matches SI standard. Returns "1 234" not "1,234".
@@ -10147,7 +10252,7 @@ function renderNotifHistoryInline() {
         <span style="font-size:var(--fs-small);color:var(--text3);margin-left:8px">${esc(n.body)}</span>
       </div>
       <span style="font-size:var(--fs-caption);color:var(--text3);font-family:var(--mono);flex-shrink:0">
-        ${new Date(n.ts).toLocaleTimeString()}
+        ${new Date(n.ts).toLocaleTimeString('en-US')}
       </span>
     </div>`).join('');
 }

package/board/packages/board/public/share.html

@@ -783,7 +783,7 @@ if (paused) {
   // (b) Cost source explicitly comes from plans/verdicts (independent measurement)
   const savingsTrustworthy = realLlmUsd > 0 || (m.cost?.source && m.cost.source !== 'tasks');
   const effectiveSavings  = savingsTrustworthy && effectiveLlmUsd > 0 && effectiveHumanUsd > 0
-    ? Math.round(effectiveHumanUsd / effectiveLlmUsd).toLocaleString() + '×' : null;
+    ? Math.round(effectiveHumanUsd / effectiveLlmUsd).toLocaleString('en-US') + '×' : null;
   const effectiveAiH = totalAiMin > 0 ? totalAiMin / 60 : totalTimeMin / 60;
 
   // Hero narrative — focus on cost difference, not time
@@ -800,7 +800,7 @@ if (paused) {
     // Human equivalent: standard 4h per feature × $150/hr
     const humanCost = done * 4 * 150;
     if (aiCostDisplay && humanCost > 0) {
-      line += `. Human team estimate: $${humanCost.toLocaleString()}.`;
+      line += `. Human team estimate: $${humanCost.toLocaleString('en-US')}.`;
     }
     return line;
   })();
@@ -1037,7 +1037,7 @@ if (paused) {
                 const costRatio = (effectiveHumanUsd > 0 && effectiveLlmUsd > 0)
                   ? effectiveHumanUsd / effectiveLlmUsd : 0;
                 const costRatioStr = costRatio >= 2
-                  ? Math.round(costRatio).toLocaleString() + '×'
+                  ? Math.round(costRatio).toLocaleString('en-US') + '×'
                   : null;
                 if (effectiveSavings) {
                   return `<div class="big">${effectiveSavings} cheaper</div>
@@ -1058,7 +1058,7 @@ if (paused) {
             <div class="cost-bar-row human">
               <div class="cb-name">Humans</div>
               <div class="cb-rail"><div class="cb-fill" style="width:${humanPct.toFixed(1)}%"></div></div>
-              <div class="cb-val">$${Number((effectiveHumanUsd > 0 ? effectiveHumanUsd : humanH * 150).toFixed(0)).toLocaleString()}</div>
+              <div class="cb-val">$${Number((effectiveHumanUsd > 0 ? effectiveHumanUsd : humanH * 150).toFixed(0)).toLocaleString('en-US')}</div>
             </div>
             <div class="cost-bar-row ai">
               <div class="cb-name">AI</div>

package/board/scripts/lib/gate-plan.mjs

@@ -24,8 +24,9 @@ import { fileURLToPath } from 'node:url';
 
 import { classify } from './change-tier.mjs';
 import { selectJudgeModel } from './judge-model.mjs';
-// effectiveGates lives in the built CLI package (TS → dist).
-import { effectiveGates } from '../../packages/cli/dist/archetypes.js';
+// Generated from the canonical CLI policy, but shipped in Git too: marketplace
+// installs do not contain the gitignored CLI build.
+import { effectiveGates } from './gate-policy.mjs';
 
 /** Parse archetype + project_size out of a .great_cto/PROJECT.md body. */
 export function parseProject(text) {

package/board/scripts/lib/gate-policy.mjs

@@ -0,0 +1,97 @@
+// Generated by scripts/build-gate-policy.mjs from packages/cli/src/archetypes.ts.
+// Do not edit; regenerate, then run --check. No CLI build is needed at runtime.
+export const GATES_BY_ARCHETYPE = {
+    "web-service": ["plan", "qa", "ship"],
+    "mobile-app": ["plan", "qa", "ship"],
+    "ai-system": ["plan", "cost", "qa", "security", "ship"],
+    "agent-product": ["plan", "cost", "qa", "security", "ship"],
+    "mlops": ["plan", "cost", "qa", "security", "ship"],
+    "data-platform": ["plan", "qa", "ship"],
+    "streaming": ["plan", "qa", "ship"],
+    "infra": ["plan", "qa", "ship"],
+    "library": ["plan", "qa", "ship"],
+    "cli-tool": ["plan", "qa", "ship"],
+    "commerce": ["plan", "qa", "security", "ship", "compliance"],
+    "marketplace": ["plan", "qa", "security", "ship", "compliance"],
+    "fintech": ["plan", "qa", "security", "ship", "compliance"],
+    "healthcare": ["plan", "qa", "security", "ship", "compliance"],
+    "web3": ["plan", "qa", "oracle-review", "security", "ship"],
+    "iot-embedded": ["plan", "qa", "security", "ship"],
+    "regulated": ["plan", "qa", "security", "ship", "compliance"],
+    "devtools": ["plan", "qa", "ship"],
+    "browser-extension": ["plan", "qa", "ship"],
+    "game": ["plan", "qa", "ship"],
+    "cms": ["plan", "qa", "ship"],
+    "enterprise-saas": ["plan", "qa", "security", "ship", "compliance"],
+    "edtech": ["plan", "qa", "edtech-review", "security", "ship", "compliance"],
+    "gov-public": ["plan", "qa", "gov-review", "security", "ship", "compliance"],
+    "insurance": ["plan", "qa", "insurance-review", "security", "ship", "compliance"],
+    "legal": ["plan", "qa", "upl-review", "security", "ship", "compliance"],
+    "defense-govcon": ["plan", "qa", "cmmc-assessment", "security", "ship", "compliance"],
+    // Product Builder archetypes (A1–A6) — non-regulated baseline; the single CTO gate
+    // emerges at change_tier T1 (effectiveGates → [plan]).
+    "vertical-saas": ["plan", "qa", "ship"],
+    "booking": ["plan", "qa", "ship"],
+    "crm": ["plan", "qa", "ship"],
+    "dashboard": ["plan", "qa", "ship"],
+    "content-platform": ["plan", "qa", "ship"],
+    "marketplace-lite": ["plan", "qa", "ship"],
+    "greenfield": ["plan"],
+};
+/**
+ * Returns the subset of gates the pipeline will actually open for a
+ * given archetype + project_size. Used by the orchestrator before
+ * opening any gate to skip unnecessary human checkpoints on smaller
+ * projects (e.g. nano always skips QA).
+ */
+export function gatesFor(archetype, size) {
+    const all = GATES_BY_ARCHETYPE[archetype] ?? [];
+    if (size === "nano")
+        return all.filter((g) => g === "plan");
+    if (size === "small")
+        return all.filter((g) => g === "plan" || g === "ship");
+    if (size === "medium")
+        return all;
+    // large + enterprise → ensure compliance is included
+    return all.includes("compliance") ? all : [...all, "compliance"];
+}
+/** Gates that form the non-negotiable floor for a *regulated* archetype. */
+const FLOOR_GATES = ["security", "compliance", "ship"];
+/**
+ * The human gates the pipeline opens for a change, given its archetype, the
+ * project size, AND the per-change risk tier. Composes with `gatesFor()`:
+ *
+ *  - T2 (default): the full size baseline, with `ship` guaranteed even if a
+ *    small project_size had stripped it. An irreversible change always gets a
+ *    final go/no-go. Nothing is ever removed → fail-safe for an unknown tier.
+ *  - T1: only `plan` (you review intent) PLUS the regulated floor. The standalone
+ *    qa/security-as-ceremony is dropped because CI + tests cover a reversible change.
+ *  - T0: the regulated floor only — for a plain archetype that is the empty set
+ *    (CI is the gate); for a regulated one, security+compliance+ship still fire.
+ *
+ * An archetype is "regulated" iff its baseline contains `security` or `compliance`.
+ * That is what keeps the downgrade sound: a fintech repo cannot ship an
+ * irreversible change unreviewed even when the change is labelled a fix.
+ *
+ * NOTE: change-specific T2 triggers (a migration, a new write-connector, a prod
+ * deploy) are resolved upstream by the classifier, which escalates such a change
+ * to T2 before this function sees it. Here we only map an already-decided tier.
+ */
+export function effectiveGates(archetype, size, tier = "T2") {
+    const base = gatesFor(archetype, size);
+    // T2 (and any unrecognized tier) → full baseline, never downgraded, ship forced.
+    if (tier !== "T0" && tier !== "T1") {
+        return base.includes("ship") ? base : [...base, "ship"];
+    }
+    // Regulated archetypes carry a floor that survives every downgrade.
+    const isRegulated = base.includes("security") || base.includes("compliance");
+    const floor = isRegulated ? base.filter((g) => FLOOR_GATES.includes(g)) : [];
+    if (tier === "T1") {
+        const keep = new Set(floor);
+        if (base.includes("plan"))
+            keep.add("plan");
+        return base.filter((g) => keep.has(g)); // preserve base order
+    }
+    // T0 — maintenance.
+    return floor;
+}

package/board/scripts/lib/outcomes.mjs

@@ -60,7 +60,7 @@ function verdictFiles(dir) {
  * Per-agent outcomes in the window.
  * @param {{projects:{name:string,path:string}[], globalDir?:string, days?:number, now?:number, roster?:string[]}} opts
  */
-export function agentOutcomes({ projects, globalDir = path.join(os.homedir(), '.great_cto', 'verdicts'), days = 30, now = Date.now(), roster = [] }) {
+export function agentOutcomes({ projects, globalDir = path.join(os.homedir(), '.great_cto', 'verdicts'), days = 30, now = Date.now(), roster = [], projectScope = false }) {
   const from = now - days * DAY;
   const known = new Set(roster);
   const seen = new Set();
@@ -78,6 +78,11 @@ export function agentOutcomes({ projects, globalDir = path.join(os.homedir(), '.
         const p = parseVerdictLine(line);
         if (!p.ok) continue;
         const rec = p.rec;
+        // Local placement supplies attribution only when the record has no tag.
+        // An explicit foreign tag cannot be overridden by a copied local log;
+        // untagged global records remain unattributable.
+        if (projectScope && (project === null || rec.project != null)
+          && !projects.some(p => (p.aliases || [p.name, p.path]).includes(rec.project))) continue;
         const t = Date.parse(rec.ts);
         if (!Number.isFinite(t) || t < from || t > now) continue;
         const key = line.trim();
@@ -207,13 +212,13 @@ export async function bugFindings({ projects, days = 30, now = Date.now(), list
 const sum = (o) => Object.values(o).reduce((a, n) => a + n, 0);
 
 /** Both, for the board. */
-export async function outcomes({ days = 30, now = Date.now(), roster = [], projects = registeredProjects(), globalDir, list } = {}) {
+export async function outcomes({ days = 30, now = Date.now(), roster = [], projects = registeredProjects(), globalDir, list, projectScope = false } = {}) {
   const findings = await bugFindings({ projects, days, now, list });
   return {
     state: 'counted',
     window: { days, from: dayOf(now - (days - 1) * DAY), to: dayOf(now) },
     projects: projects.length,
-    agents: agentOutcomes({ projects, globalDir, days, now, roster }),
+    agents: agentOutcomes({ projects, globalDir, days, now, roster, projectScope }),
     findings,
   };
 }