kodelyth-ecc 2.9.0 → 2.10.0

package/CHANGELOG.md

@@ -2,6 +2,48 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.10.0 — Arena dashboard tab + docs (phases 5 & 6) (August 2026)
+
+### Added — Arena tab in the dashboard
+
+The tab answers one question: **did the attacker give up?**
+
+- **Convergence trend** per run, drawn as a block-character sparkline — no chart
+  library, no CDN, legible at one round or twenty. Rounds that surface nothing
+  render green; a round worse than the last renders red.
+- **Still open** — confirmed findings GOD has *not* answered for, ranked by real
+  risk (`severity × confidence × exploitability`).
+- **Recurring bug classes** — the same class twice is flagged `recurring`, because
+  one is an incident and several is a process gap.
+- Runs that began with recalled memories are marked `recalled`.
+
+Read-only. The dashboard never writes to your memory store.
+
+`GET /api/arena[?limit=N]` → `{ available, runs, open, classes, totals }`. Raw
+findings are stripped from the wire payload — the page needs counts and the open
+list, not every finding on every run.
+
+### Fixed — a confirmed finding is not the same as an open one
+
+`closeRound` recorded *how many* findings were left outstanding but not *which
+ones*, so nothing downstream could tell a confirmed-and-fixed bug from a
+confirmed-and-ignored one. The dashboard's first draft reported all ten fixed
+findings as open risk — a healthy run reading as alarming, which is exactly
+backwards. Rounds now persist `addressedIds`.
+
+### Added — `docs/arena.md`
+
+A full feature doc: why a loop beats a review pass, what makes a finding count,
+how convergence is decided, the compound-learning return path, guard proposals,
+and cost control. Wired into the sitemap, the docs index, and `dashboard.md`.
+
+### Fixed — stale counts
+
+The README and `CLAUDE.md` advertised 194 skills and 97 commands; the real
+figures are 196 and 102. Both now match what is on disk.
+
+**525 tests passing**, up from 516.
+
 ## v2.9.0 — Compound learning: the arena now remembers (phase 4) (August 2026)
 
 A finished arena run used to be knowledge thrown away. Every new run started from

package/CLAUDE.md

@@ -7,8 +7,8 @@ Guidance for Claude Code when working with this repository.
 **Kodelyth ECC** — a production-grade AI coding toolkit:
 
 - **70 specialist agents** — debug-detective, incident-commander, load-tester, image-architect, kodelyth-memory, security-reviewer, plus 8 adversarial devil-mode agents
-- **194 skills** — domain knowledge, patterns, testing, security, intent routing, local memory, swarm orchestration, MCP integration
-- **97 commands** — slash workflows (`/tdd`, `/plan`, `/code-review`, `/team-review`, `/devil-mode`, `/debug-blitz`, `/security-audit`, ...)
+- **196 skills** — domain knowledge, patterns, testing, security, intent routing, local memory, swarm orchestration, MCP integration
+- **102 commands** — slash workflows (`/tdd`, `/plan`, `/code-review`, `/team-review`, `/devil-mode`, `/debug-blitz`, `/security-audit`, ...)
 - **22+ hooks** — quality gates, memory inject + capture, correction encoding, prompt-injection guard, token-budget enforcer
 - **14 rules** — always-on coding standards + semantic intent routing + memory protocol + self-improvement
 
@@ -18,15 +18,15 @@ Works with Claude Code, Windsurf, Cursor, Codex CLI, Antigravity, OpenCode, Clin
 
 ```
 agents/      → 70 specialist subagents (planner, code-reviewer, debug-detective, devil-mode crew, ...)
-commands/    → 97 slash commands (8 parallel multi-agent, rest single-agent)
-skills/      → 194 workflow + domain knowledge files (loadable via slash commands)
+commands/    → 102 slash commands (8 parallel multi-agent, 1 adversarial loop, rest single-agent)
+skills/      → 196 workflow + domain knowledge files (loadable via slash commands)
 hooks/       → 22+ automations (pre-commit, session memory, prompt-injection guard, token-budget)
 rules/       → 14 always-on guidelines (agent-intent-routing, self-improvement, memory-protocol, ...)
 scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router, memory, supply-chain
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
-docs/        → Feature docs (mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 516 passing tests across 27 test files
+docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
+tests/       → 525 passing tests across 29 test files
 ```
 
 ## Running Tests
@@ -80,6 +80,7 @@ These fire multiple specialist agents simultaneously:
 | `/pre-release` | release-captain + security-reviewer + code-reviewer | Go/no-go verdict before shipping |
 | `/onboard` | code-explorer + architect + doc-updater | Understand any codebase in 15 minutes |
 | `/devil-mode` | prompt-injection-hunter + supply-chain-auditor + secret-hunter + backdoor-hunter | Adversarial sweep (use `--all` for all 8) |
+| `/arena` | GOD crew vs EVIL crew, looped | Ship something that must not break — runs until the attacker gives up |
 
 ## Key Commands
 

package/README.md

@@ -33,7 +33,7 @@
 
 </div>
 
-**Kodelyth ECC** is a production-grade AI coding toolkit — **70 specialist agents (incl. an 8-agent devil-mode adversarial crew), 194 skills, 97 commands**, a god-tier **semantic intent-routing system**, local self-learning memory, MCP server, swarm orchestrator, and an observability dashboard — all local, zero telemetry.
+**Kodelyth ECC** is a production-grade AI coding toolkit — **70 specialist agents (incl. an 8-agent devil-mode adversarial crew), 196 skills, 102 commands**, a god-tier **semantic intent-routing system**, local self-learning memory, MCP server, swarm orchestrator, and an observability dashboard — all local, zero telemetry.
 
 Now bundled with:
 
@@ -73,7 +73,7 @@ You never typed `use debug-detective`. You didn't have to. The toolkit read the
 | **Intent routing** | Plain-language → right specialist via 10-tier priority rules | Mostly missing — you memorize names |
 | **70 agents** | Specialists with playbooks, severity calibration, real commands | Often persona-only ("you are a senior engineer...") |
 | **194 skills** | Domain knowledge files agents read on demand | Rarely separated from agents |
-| **97 commands** | Slash workflows (`/tdd`, `/devil-mode`, `/team-review`) | Limited or none |
+| **102 commands** | Slash workflows (`/tdd`, `/arena`, `/devil-mode`, `/team-review`) | Limited or none |
 | **8 parallel commands** | Fire 3-8 agents simultaneously, aggregate results | Rare |
 | **Compound memory** | BM25 local recall + auto-inject + project lessons | Cloud-only or absent |
 | **22+ hooks** | Quality gates, secret scan, project-DNA detection | Often missing |
@@ -92,6 +92,7 @@ You never typed `use debug-detective`. You didn't have to. The toolkit read the
 | **Local BM25 self-learning memory** | ✅ | ❌ | ❌ | ❌ |
 | **Compound learning from corrections** | ✅ `tasks/lessons.md` | ❌ | ❌ | ❌ |
 | **Adversarial / red-team agents** | ✅ 8 (devil-mode) | ❌ | ❌ | ❌ |
+| **Adversarial build/attack loop** | ✅ `/arena` — scored, verified, converges | ❌ | ❌ | ❌ |
 | Quality hooks | ✅ 22+ | Some | ❌ | ❌ |
 | IDE platforms | **11** (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
 | Telemetry | ❌ none | Varies | ❌ | Varies |
@@ -372,6 +373,7 @@ Eight commands fire multiple specialist agents simultaneously and aggregate thei
 | `/pre-release` | release-captain + security-reviewer + code-reviewer | 30 min → 8 min |
 | `/onboard` | code-explorer + architect + doc-updater | 45 min → 12 min |
 | `/devil-mode` | 8 adversarial agents (see below) | Hours → 20 min |
+| `/arena` | GOD crew vs EVIL crew, looped until the attacker gives up | Days → 1 session |
 
 Each command waits for all agents to complete, then returns a single **Team Review Report** with findings bucketed by severity: CRITICAL → HIGH → MEDIUM → LOW.
 

package/VERSION

@@ -1 +1 @@
-2.9.0
+2.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.9.0",
+  "version": "2.10.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/arena/arena.js

@@ -176,6 +176,10 @@ function closeRound(run) {
   });
 
   // Attach whether GOD actually finished its side of the round.
+  // Persist WHICH findings GOD answered for, not just how many are left over.
+  // Without the ids, nothing downstream can tell a confirmed-and-fixed finding
+  // from confirmed-and-ignored — the dashboard would report every fix as open risk.
+  verdict.addressedIds = [...(run.pending.addressedIds || [])];
   verdict.godComplete = completion.complete;
   verdict.unverifiedArtifacts = completion.unverifiedArtifacts;
   verdict.outstandingFindings = completion.outstandingFindings;

package/scripts/dashboard/data.js

@@ -580,9 +580,120 @@ function tokenBudgetSnapshot({ budgetDir = defaultBudgetDir() } = {}) {
   return { sessions: sessions.slice(0, 50), total_tokens: total };
 }
 
+// ── Arena ────────────────────────────────────────────────────────────────────
+//
+// The dashboard's job here is to make ONE thing legible: did the attacker give
+// up? A run whose new-finding count falls to zero is converging. A flat or
+// rising line means the code has deeper problems, or the scope is too broad for
+// EVIL to ever exhaust — either way, look before shipping.
+
+function arenaSnapshot({ runLimit = 20 } = {}) {
+  let arenaState = null;
+  let learn = null;
+  try { arenaState = require('../arena/state.js'); } catch { /* arena is optional */ }
+  try { learn = require('../arena/learn.js'); } catch { /* */ }
+  if (!arenaState) return { available: false, runs: [], classes: [], open: [], totals: {} };
+
+  let list = [];
+  try { list = arenaState.listRuns() || []; } catch { /* no runs yet */ }
+
+  const runs = list.slice(0, Math.max(1, Math.min(100, runLimit))).map(meta => {
+    let run = null;
+    try { run = arenaState.load(meta.runId); } catch { /* skip unreadable */ }
+    if (!run) return null;
+
+    const rounds = run.rounds || [];
+    const settled = [];
+    const seen = new Set();
+    for (const r of rounds) {
+      for (const f of r.findings || []) {
+        if (seen.has(f.id)) continue;
+        seen.add(f.id);
+        settled.push(f);
+      }
+    }
+
+    return {
+      runId: run.runId,
+      task: run.task,
+      scope: run.scope || '.',
+      status: run.status,
+      stopReason: run.stopReason || null,
+      startedAt: run.startedAt,
+      rounds: rounds.length,
+      tokens: run.spent?.tokens || 0,
+      // The trend IS the story: new findings per round, which should fall to zero.
+      trend: rounds.map(r => r.counts?.new || 0),
+      confirmed: settled.filter(f => f.verdict === 'confirmed').length,
+      refuted: settled.filter(f => f.verdict === 'refuted').length,
+      unverified: settled.filter(f => f.verdict === 'unverified').length,
+      artifacts: rounds.reduce((n, r) => n + (r.artifacts?.length || 0), 0),
+      recalled: run.priorKnowledge ? true : false,
+      findings: settled,
+    };
+  }).filter(Boolean);
+
+  // Still-open risk across every run, worst first. A confirmed finding nobody
+  // fixed is the single most useful thing this page can surface.
+  const open = [];
+  // Findings GOD answered for are not open risk. Counting a confirmed-and-fixed
+  // bug as outstanding would make a healthy run look alarming.
+  const addressed = new Set();
+  for (const meta of list.slice(0, runLimit)) {
+    try {
+      const full = arenaState.load(meta.runId);
+      for (const rd of full?.rounds || []) for (const id of rd.addressedIds || []) addressed.add(id);
+    } catch { /* */ }
+  }
+  for (const r of runs) {
+    for (const f of r.findings) {
+      if (f.verdict !== 'confirmed') continue;
+      if (addressed.has(f.id)) continue;   // GOD answered for this one
+      open.push({
+        runId: r.runId, scope: r.scope, title: f.title,
+        file: f.file, line: f.line, severity: f.severity,
+        risk: f.risk || 0,
+        class: learn ? learn.classify(f) : null,
+      });
+    }
+  }
+  open.sort((a, b) => b.risk - a.risk);
+
+  // Which bug classes keep coming back — the signal that a guard belongs upstream.
+  const classCount = new Map();
+  if (learn) {
+    for (const r of runs) {
+      for (const f of r.findings) {
+        if (f.verdict !== 'confirmed') continue;
+        const c = learn.classify(f);
+        classCount.set(c, (classCount.get(c) || 0) + 1);
+      }
+    }
+  }
+  const classes = [...classCount.entries()]
+    .map(([name, count]) => ({ name, count }))
+    .sort((a, b) => b.count - a.count);
+
+  const totals = {
+    runs: runs.length,
+    converged: runs.filter(r => r.status === 'converged').length,
+    confirmed: runs.reduce((n, r) => n + r.confirmed, 0),
+    refuted: runs.reduce((n, r) => n + r.refuted, 0),
+    artifacts: runs.reduce((n, r) => n + r.artifacts, 0),
+    tokens: runs.reduce((n, r) => n + r.tokens, 0),
+  };
+
+  // Drop the raw findings from the wire payload — the page needs the counts and
+  // the open list, not every finding on every run.
+  const wireRuns = runs.map(({ findings, ...rest }) => rest);
+  return { available: true, runs: wireRuns, open: open.slice(0, 40), classes, totals };
+}
+
 module.exports = {
   // overview
   overview,
+  // arena
+  arenaSnapshot,
   // memory
   memoryStats,
   recentMemories,

package/scripts/dashboard/server.js

@@ -304,6 +304,10 @@ function handleRequest(req, res) {
       return jsonResponse(res, 200, { ok: true, ...s });
     }
 
+    if (p === '/api/arena') {
+      return jsonResponse(res, 200, data.arenaSnapshot({ runLimit: Number(q.get('limit')) || 20 }));
+    }
+
     if (p === '/api/codebase') {
       const cb = require('../codebase/index.js');
       return jsonResponse(res, 200, cb.dashboardSnapshot());

package/scripts/dashboard/static/index.html

@@ -223,6 +223,7 @@
         <button data-tab="rtk">Token Savings</button>
         <button data-tab="memory">Memory</button>
         <button data-tab="codebase">Codebase</button>
+        <button data-tab="arena">Arena</button>
         <button data-tab="evolve">Evolve</button>
         <button data-tab="catalog">Catalog</button>
         <button data-tab="sessions">Sessions</button>
@@ -320,6 +321,50 @@ kodelyth-ecc codebase query detect_changes '{}'</pre>
     </section>
 
     <!-- ───────── EVOLVE ───────── -->
+    <!-- ───────── ARENA ───────── -->
+    <section data-panel="arena" hidden>
+      <div class="grid" id="arenaCards"></div>
+      <hr class="sep">
+      <div class="card">
+        <h2>Did the attacker give up?</h2>
+        <p class="muted" style="font-size:12.5px;margin:-4px 0 14px;">
+          New findings per round. Falling to zero means EVIL ran out of ideas.
+          A flat or rising line means stop and look — either the code has deeper
+          problems, or the scope is too broad to ever exhaust.
+        </p>
+        <div id="arenaRuns">loading…</div>
+      </div>
+      <hr class="sep">
+      <div class="row">
+        <div class="card">
+          <h2>Still open</h2>
+          <p class="muted" style="font-size:12.5px;margin:-4px 0 12px;">
+            Confirmed and not yet answered for, worst risk first.
+          </p>
+          <div id="arenaOpen">loading…</div>
+        </div>
+        <div class="card">
+          <h2>Recurring bug classes</h2>
+          <p class="muted" style="font-size:12.5px;margin:-4px 0 12px;">
+            One is an incident. Several is a process gap — the guard belongs upstream.
+          </p>
+          <div id="arenaClasses">loading…</div>
+        </div>
+      </div>
+      <hr class="sep">
+      <div class="card">
+        <h2>Compound learning</h2>
+        <p class="muted" style="font-size:12.5px;margin:-4px 0 10px;">
+          Store what a run proved so the next run on that scope starts informed:
+        </p>
+        <div><code>kodelyth-ecc arena learn &lt;run-id&gt; --commit</code></div>
+        <p class="muted" style="margin-top:12px;font-size:12.5px;">
+          Nothing is written without <code>--commit</code>. The dashboard NEVER
+          writes to your memory store.
+        </p>
+      </div>
+    </section>
+
     <section data-panel="evolve" hidden>
       <div class="grid" id="evolveCards"></div>
       <hr class="sep">
@@ -527,6 +572,86 @@ kodelyth-ecc codebase query detect_changes '{}'</pre>
   }
 
   // ───── evolve ─────
+  // A compact sparkline made of block characters — no chart library, no CDN,
+  // and it stays legible when the run has one round or twenty.
+  function trendBar(trend) {
+    if (!trend || !trend.length) return '<span class="dim">no rounds yet</span>';
+    const max = Math.max(...trend, 1);
+    const blocks = '▁▂▃▄▅▆▇█';
+    return trend.map((n, i) => {
+      const idx = n === 0 ? 0 : Math.min(blocks.length - 1, Math.ceil((n / max) * (blocks.length - 1)));
+      const colour = n === 0 ? '#22c55e' : (i > 0 && n < trend[i - 1] ? '#eab308' : '#ef4444');
+      return `<span title="round ${i + 1}: ${n} new" style="color:${colour};font-size:18px;line-height:1;">${blocks[idx]}</span>`;
+    }).join('');
+  }
+
+  function arenaStatusPill(status) {
+    const map = {
+      converged: ['ok', 'converged'],
+      running:   ['', 'running'],
+      exhausted: ['pending', 'max rounds'],
+      aborted:   ['pending', 'stopped'],
+    };
+    const [cls, label] = map[status] || ['', status || 'unknown'];
+    return `<span class="pill ${cls}">${escapeHtml(label)}</span>`;
+  }
+
+  async function loadArena() {
+    try {
+      const a = await api('/api/arena');
+      if (!a.available) {
+        $('#arenaCards').innerHTML = '';
+        $('#arenaRuns').innerHTML = '<div class="empty">Arena is not installed.</div>';
+        $('#arenaOpen').innerHTML = '';
+        $('#arenaClasses').innerHTML = '';
+        return;
+      }
+
+      $('#arenaCards').innerHTML = [
+        statCard(a.totals.runs,      'Runs'),
+        statCard(a.totals.confirmed, 'Bugs confirmed'),
+        statCard(a.totals.refuted,   'False positives caught'),
+        statCard(a.open.length,      'Still open'),
+        statCard(a.totals.artifacts, 'Verified fixes'),
+      ].join('');
+
+      $('#arenaRuns').innerHTML = a.runs.length
+        ? `<div class="table-wrap"><table>
+            <thead><tr><th>Run</th><th>Scope</th><th>Trend</th><th>Rounds</th><th>Confirmed</th><th>Refuted</th><th>Tokens</th><th>Status</th></tr></thead>
+            <tbody>${a.runs.map(r => `<tr>
+              <td><span class="strong">${escapeHtml(r.task || r.runId)}</span>${r.recalled ? ' <span class="pill" title="started with recalled memories from past runs">recalled</span>' : ''}</td>
+              <td><code>${escapeHtml(r.scope)}</code></td>
+              <td>${trendBar(r.trend)}</td>
+              <td>${r.rounds}</td>
+              <td>${r.confirmed}</td>
+              <td>${r.refuted}</td>
+              <td>${(r.tokens || 0).toLocaleString()}</td>
+              <td>${arenaStatusPill(r.status)}</td>
+            </tr>`).join('')}</tbody></table></div>`
+        : '<div class="empty">No arena runs yet. Start one with <code>kodelyth-ecc arena start --task "..."</code></div>';
+
+      $('#arenaOpen').innerHTML = a.open.length
+        ? a.open.map(f => `<div style="margin-bottom:12px;">
+            <div class="strong">${escapeHtml(f.title)}</div>
+            <div class="muted" style="font-size:12px;margin-top:3px;">
+              <span class="pill">${escapeHtml(f.severity)}</span>
+              risk ${f.risk}${f.class ? ` · ${escapeHtml(f.class)}` : ''}
+              ${f.file ? ` · <code>${escapeHtml(f.file)}${f.line ? ':' + f.line : ''}</code>` : ''}
+            </div>
+          </div>`).join('')
+        : '<div class="empty">Nothing open. Every confirmed finding was either fixed or refuted.</div>';
+
+      $('#arenaClasses').innerHTML = a.classes.length
+        ? a.classes.map(c => `<div style="display:flex;justify-content:space-between;margin-bottom:8px;">
+            <span>${escapeHtml(c.name)}${c.count > 1 ? ' <span class="pill pending">recurring</span>' : ''}</span>
+            <span class="strong">${c.count}</span>
+          </div>`).join('')
+        : '<div class="empty">No confirmed findings yet.</div>';
+    } catch (err) {
+      $('#arenaRuns').innerHTML = `<div class="empty">Could not load arena data: ${escapeHtml(String(err.message || err))}</div>`;
+    }
+  }
+
   async function loadEvolve() {
     try {
       const e = await api('/api/evolve');
@@ -838,6 +963,7 @@ kodelyth-ecc codebase query detect_changes '{}'</pre>
     if (tab === 'rtk')      loadRtk();
     if (tab === 'memory')   loadMemory();
     if (tab === 'codebase') loadCodebase();
+    if (tab === 'arena')    loadArena();
     if (tab === 'evolve')   loadEvolve();
     if (tab === 'catalog')  loadCatalog();
     if (tab === 'sessions') { loadIdeSessions(); loadSessions(); }