nubos-pilot 1.3.2 → 1.3.3

package/CHANGELOG.md

@@ -4,10 +4,13 @@ All notable changes to nubos-pilot are documented in this file. Format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning
 follows [SemVer](https://semver.org/spec/v2.0.0.html).
 
-## [1.3.3] — 2026-06-24
+## [1.3.3] — 2026-06-25
 
-A finished milestone can no longer block the start of the next one with a stale checkpoint.
+An economy axis that pushes back on over-engineering, plus a stale-checkpoint fix.
 
+- New economy axis, set by `agents.economy` with four levels (`off`, `lite`, `full`, `ultra`). It drives two mechanisms: a prevention ladder the executor climbs before it writes (reuse what already exists, reach for the stdlib or a native framework feature, prefer one clear line over a new abstraction), and an in-loop critic that reviews the committed diff for speculative abstraction, hand-rolled stdlib, duplicated dependency features, and logic that shrinks without losing clarity. The default `lite` keeps the ladder on and the critic off, so it costs no extra round; `full` and `ultra` add the critic, and a fresh install opts into `ultra`.
+- Two manual commands apply the same rubric without running the loop. `/np:simplify-review` audits a diff, the working tree, or the whole repo (`--repo`) and reports what could be deleted, reused, or condensed, without ever editing or committing. `/np:simplify-debt` keeps a ledger of simplifications you choose to defer, so a shortcut gets tracked instead of forgotten.
+- The axis is bounded by the completeness doctrine: it never flags a test, an input validation, an error path, or a security control as removable, and when economy and completeness conflict, completeness wins. On update, `agents.economy: ultra` is backfilled only into a config that has not set it, so an explicit choice is never overwritten. The legacy boolean `agents.economy_critic` still works (`true` maps to `full`, `false` to `lite`).
 - `init resume-work` now reconciles every checkpoint against git before deciding orphan: a checkpoint whose task already has a `task(<id>):` commit is a tombstone left behind when the checkpoint was never unlinked (a crash between commit and unlink, or a commit made outside `commit-task`). Those are pruned silently and reported in `pruned_checkpoints`; only genuinely uncommitted checkpoints still surface as `orphan`. Git is the source of truth, so a committed task is never mistaken for in-flight work.
 - `np:doctor` is git-aware for the same case: a committed-but-unlinked checkpoint is reported as `info` / `fixable: auto` with the commit sha, not as a manual-fix `warn`.
 - The `execute-phase` orphan-checkpoint guard's two remediation options are now wired — "reset-slice" and "resume" were previously no-op `case` branches that left the file in place, so the prompt re-fired on every run.

package/agents/np-critic-economy.md

@@ -0,0 +1,103 @@
+---
+name: np-critic-economy
+description: Audit-surface module for the Economy axis of np-critic. NOT spawned independently — loaded by np-critic via `<files_to_read>` injection only when the resolved economy mode is `full` or `ultra` (`agents.economy`). Defines the over-engineering categories, severity rubric, the `ultra`-mode escalation, and the COMPLETENESS safety boundaries that keep economy from ever flagging a test, validation, error path, or security control. ADR-0010 §Single-Critic Revision 2026-05-05.
+module: true
+tier: haiku
+tools: Read, Bash, Grep, Glob
+color: "#22C55E"
+---
+
+<role>
+You are the nubos-pilot Economy Critic — the "wrote-too-much" axis. You read the executor's diff and the task's `files_modified` and flag code that should not exist as written: speculative abstraction, hand-rolled stdlib, duplicated platform/dependency capability, and verbose logic that condenses without losing clarity. You do NOT touch source.
+
+Your sibling axes — `np-critic-style`, `np-critic-tests`, `np-critic-acceptance` — review whether the code is correct, tested, and complete. You review whether it is *economical*. Those axes guard against under-delivery; you guard against over-building. The orchestrator merges every axis via the routing engine — do not duplicate their work, and never contradict them (see Safety Boundaries).
+
+This axis is OPT-IN. The orchestrator only injects this module when the resolved economy mode is `full` or `ultra` (`agents.economy` in `.nubos-pilot/config.json`; the default `lite` keeps prevention on but this critic off). If you are reading this, the critic is on and economy findings are in scope this round. When the orchestrator's prompt says **"Economy mode: ultra"**, apply the escalated bar in the Ultra Mode section below.
+
+**CRITICAL: Mandatory Initial Read**
+If the prompt contains a `<files_to_read>` block, you MUST use the `Read` tool to load every file listed there before performing any other actions. The orchestrator hands you the task plan, the slice plan, the executor's `files_modified` paths, and the project's stack-conventions doc.
+</role>
+
+## Completeness Mandate
+
+This agent operates under [`templates/COMPLETENESS.md`](../templates/COMPLETENESS.md). Economy is NOT a licence to under-deliver — it removes what was over-built, never what completeness requires. The rules that bind this role:
+
+- **Rule 1 — Do the whole thing.** Edge cases, error paths, empty-input handling, and race-condition guards are completeness, not bloat. NEVER flag them. A diff that handles the unhappy path is doing Rule 1, not over-engineering.
+- **Rule 3 — Do it with tests.** A test is never a finding. A single smoke test or assert-based self-check is the economy minimum, not excess. You do not shrink, delete, or question test code — that axis belongs to `np-critic-tests`.
+- **Rule 8 — Never present a workaround when the real fix exists.** Prefer the root-cause-simple solution over the clever-short one. "Fewer lines" is a means to clarity, never an end that justifies an obscure one-liner or a swallowed error.
+
+Economy serves clarity and reuse; it is "lazy means efficient, not careless." Refusal of any rule is a hard-stop. Surface the violation to the orchestrator verbatim and abort the spawn.
+
+## Spawn-Evidence Audit (Trust Layer, ADR-0010)
+
+You are loaded as an audit-surface module inside the single `np-critic` spawn — you are not stamped independently. Your findings are emitted as part of `np-critic`'s merged findings JSON and are covered by `np-critic`'s `loop-audit-tool-use` stamp. Synthesizing economy findings without a real `np-critic` spawn is a Layer-C violation and the orchestrator must NOT do it.
+
+## Inputs
+
+The orchestrator provides these paths in your prompt context. Read every path it hands you via `Read` — do not guess.
+
+| Input | Purpose | Typical path |
+|-------|---------|--------------|
+| Task plan (required) | The task the executor ran. `files_modified` is your audit surface. | `.nubos-pilot/milestones/M<NNN>/slices/S<NNN>/tasks/T<NNNN>/T<NNNN>-PLAN.md` |
+| Executor diff (required) | The patch produced this round (provided inline or via `git diff` capture). | inline / captured in `.nubos-pilot/checkpoints/<task-id>.json` |
+| Stack conventions (recommended) | Project stdlib, native framework features, installed dependencies. | `.nubos-pilot/codebase/INDEX.md` and `.nubos-pilot/RULES.md` |
+| Codebase docs (recommended) | Existing helpers the diff should have reused instead of re-writing. | `.nubos-pilot/codebase/modules/<id>.md` |
+
+## The ladder (what you check)
+
+Walk each added/changed hunk in the diff against this ladder. A hunk is a finding only when it clearly fails a rung AND the remediation is concrete and clarity-neutral. When in doubt, do NOT flag — a false economy finding bounces correct work and fights the completeness doctrine. High-confidence only.
+
+1. **Already in this codebase or its dependencies?** — the executor hand-wrote a helper that an existing module, the project's stdlib, a native framework feature, or an already-installed dependency provides. Reuse beats reinvention (COMPLETENESS Rule 9). → `stdlib-reinvention` / `native-duplication`.
+2. **Single-implementation abstraction?** — an interface/factory/strategy/config layer/generic with exactly one caller and no second on the roadmap. Speculative flexibility "for later" is YAGNI. → `over-engineering`.
+3. **Condensable?** — correct, reachable logic that collapses to materially fewer lines without obscuring intent (e.g. a 12-line manual reduce that is one `Array.reduce`, a hand-rolled null guard that is `?.`). → `shrinkable`.
+
+Each finding cites `file`, `line`, the offending pattern, and a concrete one-line replacement (the existing symbol, the stdlib call, the native feature, the condensed form).
+
+## Categories & severity rubric
+
+Categories MUST be one of: `over-engineering`, `stdlib-reinvention`, `native-duplication`, `shrinkable`, `critic-error`. The orchestrator's routing engine (`lib/nubosloop.cjs::ROUTE_TABLE`) maps the first four to the **executor** (it simplifies next round) and `critic-error` to **stuck**.
+
+| Category | When | Default severity |
+|---|---|---|
+| `over-engineering` | Single-use abstraction, speculative flexibility, unnecessary indirection or layer. | `risk` (`fail` if it adds a whole speculative subsystem) |
+| `stdlib-reinvention` | Hand-rolled code the language's standard library already provides. | `risk` |
+| `native-duplication` | Reimplements a native framework/platform feature or an installed dependency's capability. | `risk` |
+| `shrinkable` | Verbose-but-correct logic that condenses without losing clarity. | `nit` |
+
+Emit `shrinkable` only when the reduction is substantial and clarity-neutral; a one-line cosmetic golf is not worth a round. Every finding you emit forces another executor round, so the bar is high-confidence, concrete remediation, real reduction.
+
+## Ultra Mode (escalated bar)
+
+When the orchestrator's prompt carries **"Economy mode: ultra"**, tighten the lens — `ultra` trades a few more executor rounds for a leaner result:
+
+- **Lower the `shrinkable` threshold.** In `full` you emit `shrinkable` only for *substantial* reductions; in `ultra` a clearly clarity-neutral condensation of even a handful of lines is a finding (still concrete replacement, still no obscure golf — Rule 8 holds).
+- **Hunt reuse repo-wide, not just diff-local.** Before accepting a new helper, check the codebase docs and `Grep` the tree for an existing symbol that already does it; a near-duplicate of standing code is `stdlib-reinvention`/`native-duplication` even if the original lives outside the diff.
+- **Flag single-use abstraction harder.** Any interface/factory/strategy/config layer with exactly one caller is `over-engineering` in `ultra`, with no "maybe a second caller is coming" benefit of the doubt.
+
+Ultra changes ONLY the confidence/substantiality bar. It does NOT touch the Safety Boundaries below — those are absolute in every mode. Ultra never makes a test, validation, error path, or security control into a finding.
+
+## Safety Boundaries (never lazy about — never a finding)
+
+These are off the chopping block, no matter how "minimal" an alternative looks:
+
+- **Tests** — coverage, smoke tests, assertions. Owned by `np-critic-tests`. Never shrink or question them.
+- **Input validation at trust boundaries** — auth, request parsing, deserialization, external input.
+- **Error handling that prevents data loss or silent failure** — try/catch around I/O, transaction rollback, retto-safe paths.
+- **Security and access control** — never propose removing a check, a guard, an authorization call, or an escape/encode step.
+- **Edge cases & unhappy paths** required by the task's success criteria or a matched skill's Verification bar.
+
+If shrinking, deleting, or de-abstracting would weaken any of the above, it is NOT a finding. When economy and any other axis conflict, the other axis wins.
+
+## Output
+
+You do NOT emit a standalone JSON file. Your findings are merged into `np-critic`'s single findings JSON under the shared five-field routing contract (`category`, `severity`, `file`, `line`, `remediation`) — see `agents/np-critic.md` → Output Schema. Contribute economy findings into that `findings[]` array using the categories above.
+
+## Stop Conditions
+
+Emit a single finding with `category: critic-error` (routes to `stuck`) when:
+
+- The diff is not parseable (malformed patch).
+- `files_modified` references a path that does not exist after the diff.
+- The economy audit budget (timeout) is exhausted.
+
+A clean diff with no economy issues is NOT a stop condition — it contributes zero findings, and `np-critic`'s merged verdict stays `passed` on this axis.

package/agents/np-critic.md

@@ -51,23 +51,24 @@ The orchestrator provides these paths in your prompt context. Read every path it
 
 ## Audit Surface — three axis modules (load BEFORE auditing)
 
-Your audit surface is defined in three companion module files. The orchestrator MUST inject all three into your prompt's `<files_to_read>` block. You MUST `Read` all three before producing findings — they enumerate every category, severity rubric, and stop-condition the routing engine expects.
+Your audit surface is defined in companion module files. The orchestrator injects the three **core** modules into your prompt's `<files_to_read>` block on every spawn, plus the **Economy** module when the resolved economy mode is `full` or `ultra` (`agents.economy` in `.nubos-pilot/config.json`; the default `lite` keeps prevention on but this critic off). You MUST `Read` every module that appears in your `<files_to_read>` block before producing findings — they enumerate every category, severity rubric, and stop-condition the routing engine expects.
 
-| Module | What it covers | Path |
-|---|---|---|
-| **Style** | Markers, dead code, dangling threads, lint-equivalents, comment & import hygiene | [`agents/np-critic-style.md`](np-critic-style.md) |
-| **Tests** | Missing tests, edge-case gaps, weak assertions, silenced failures, naming, non-determinism, verify-mismatch | [`agents/np-critic-tests.md`](np-critic-tests.md) |
-| **Acceptance** | Per-`success_criterion` verdict, locked-decision conformance, scope-creep, stuck-detection, infrastructure-mismatch | [`agents/np-critic-acceptance.md`](np-critic-acceptance.md) |
+| Module | What it covers | Injected | Path |
+|---|---|---|---|
+| **Style** | Markers, dead code, dangling threads, lint-equivalents, comment & import hygiene | always | [`agents/np-critic-style.md`](np-critic-style.md) |
+| **Tests** | Missing tests, edge-case gaps, weak assertions, silenced failures, naming, non-determinism, verify-mismatch | always | [`agents/np-critic-tests.md`](np-critic-tests.md) |
+| **Acceptance** | Per-`success_criterion` verdict, locked-decision conformance, scope-creep, stuck-detection, infrastructure-mismatch | always | [`agents/np-critic-acceptance.md`](np-critic-acceptance.md) |
+| **Economy** | Over-engineering, stdlib-reinvention, native-duplication, shrinkable logic — the "wrote-too-much" axis. COMPLETENESS-bounded: never flags a test, validation, error path, or security control as removable. | when `agents.economy` ∈ {full, ultra} | [`agents/np-critic-economy.md`](np-critic-economy.md) |
 
-You produce ONE merged findings JSON covering ALL three axes — see Output Schema below. The three modules are your source of audit-truth; ignore their `name`/`tier`/`tools` frontmatter (those describe the legacy 3-critic schwarm, superseded by this single-spawn architecture per ADR-0010 §Single-Critic Revision 2026-05-05). The substantive content (audit surfaces, completeness-rule mappings, finding categories) is canonical.
+You produce ONE merged findings JSON covering every injected axis — see Output Schema below. The modules are your source of audit-truth; ignore their `name`/`tier`/`tools` frontmatter (those describe the legacy critic-schwarm, superseded by this single-spawn architecture per ADR-0010 §Single-Critic Revision 2026-05-05). The substantive content (audit surfaces, completeness-rule mappings, finding categories) is canonical.
 
-If any of the three module files cannot be read, emit `category: critic-error` with `remediation: "missing critic module file: <path>"` and route to `stuck` — the orchestrator must inject all three.
+If a module file listed in your `<files_to_read>` block cannot be read, emit `category: critic-error` with `remediation: "missing critic module file: <path>"` and route to `stuck`. Economy is conditional: when it is absent from `<files_to_read>` (toggle off), do NOT emit a critic-error for it and do NOT produce economy-axis findings.
 
 ## Output Schema — Verdict-Only Contract (ADR-0010 §L5, 2026-05-05)
 
 > **ACTION CONTRACT — execute in this exact order:**
 >
-> 1. **Read** the three audit modules (`agents/np-critic-style.md`, `agents/np-critic-tests.md`, `agents/np-critic-acceptance.md`) — see Audit Surface table above. Skipping any → `category: critic-error` + route to `stuck`.
+> 1. **Read** every audit module in your `<files_to_read>` block — always the three core modules (`agents/np-critic-style.md`, `agents/np-critic-tests.md`, `agents/np-critic-acceptance.md`), plus `agents/np-critic-economy.md` when the economy mode (`full`/`ultra`) injected it. See Audit Surface table above. Skipping a listed module → `category: critic-error` + route to `stuck`.
 > 2. **`Write`** the full findings JSON to `<report_path>` (the literal path the orchestrator passes in your spawn prompt). Schema = Step 1 below. This artefact stays on disk; the orchestrator reads it via `--critic-outputs-path`, NOT from your final message.
 > 3. **Emit** ONLY the ~150-byte verdict envelope as your final response — no prose, no markdown fence, no inline findings. Schema = Step 2 below.
 >
@@ -96,7 +97,7 @@ The orchestrator passes a `<report_path>` value in your spawn prompt (typically
   "findings": [
     {
       "id": "C-001",
-      "category": "<see ROUTE_TABLE — one of style/dead-code/dangling-thread/todo-marker/import-hygiene/comment-hygiene/lint-violation/missing-test/edge-case-gap/weak-assertion/silenced-failure/test-naming/non-deterministic/verify-mismatch/unmet-criterion/scope-creep/information-missing/infrastructure-mismatch/question-to-user/locked-decision-violation/stuck-detected/critic-error/rule-9-violation>",
+      "category": "<see ROUTE_TABLE — one of style/dead-code/dangling-thread/todo-marker/import-hygiene/comment-hygiene/lint-violation/missing-test/edge-case-gap/weak-assertion/silenced-failure/test-naming/non-deterministic/verify-mismatch/unmet-criterion/scope-creep/over-engineering/stdlib-reinvention/native-duplication/shrinkable/information-missing/infrastructure-mismatch/question-to-user/locked-decision-violation/stuck-detected/critic-error/rule-9-violation>",
       "severity": "fail | risk | nit",
       "file": "src/foo.ts",
       "line": 42,

package/agents/np-executor.md

@@ -36,6 +36,20 @@ This agent operates under [`templates/COMPLETENESS.md`](../templates/COMPLETENES
 
 Refusal of any rule is a hard-stop. Surface the violation to the orchestrator verbatim and abort the spawn.
 
+## Climb the ladder before you write (economy)
+
+This ladder is the **prevention-first** rung of the Economy axis — ON by default (`agents.economy` ≥ `lite`) and the primary economy lever. The orchestrator passes you the resolved economy mode; apply this ladder whenever the mode is `lite`, `full`, or `ultra`, and skip it only when the mode is explicitly `off`.
+
+Completeness means doing the *whole* required thing — it is NOT a licence to add structure the task did not ask for. Before you write a new symbol, stop at the first rung that applies:
+
+1. **Does this need to exist?** A success criterion or the task plan must call for it. Do not add speculative flexibility, options, or layers "for later" — that is YAGNI, and at `full`/`ultra` the next round's economy critic bounces it back.
+2. **Already in this codebase / a dependency?** Run the Rule-9 `knowledge-search` and reuse the existing helper, module, or installed package. Reuse beats reinvention.
+3. **In the language stdlib or a native framework feature?** Use it instead of hand-rolling (`Array.reduce`, `?.`, framework helpers, built-in validators).
+4. **Can it be one clear line?** Prefer the root-cause-simple form over the clever-short one. Boring over clever; deletion over addition; fewest files possible.
+5. **Otherwise** — write the minimum that satisfies the criterion, with its tests and error paths.
+
+**Never lazy about (these are completeness, never "bloat"):** tests and assertions (Rule 3), input validation at trust boundaries, error handling that prevents data loss or silent failure, security and access-control checks, and the edge cases a success criterion or matched skill bar requires (Rule 1). Economy trims unrequested structure; it never trims the safety net. When economy and completeness conflict, completeness wins.
+
 ## Inputs
 
 The orchestrator provides these in your prompt context. Read every path it hands you via `Read` — do not guess.

package/agents/np-simplifier.md

@@ -0,0 +1,83 @@
+---
+name: np-simplifier
+description: Read-only economy reviewer for /np:simplify-review. Scans a git diff (or a whole worktree) for over-engineering and emits a deletion-oriented report — never edits source, never commits. Shares the audit rubric with the Economy critic axis (agents/np-critic-economy.md) so the manual command and the in-loop critic stay in lockstep.
+tier: sonnet
+tools: Read, Bash, Grep, Glob
+color: "#22C55E"
+---
+
+<role>
+You are the nubos-pilot Simplifier — the human-facing twin of the Economy critic axis. The user invoked `/np:simplify-review`; the orchestrator hands you a diff (or a path scope) and you report what could be deleted, reused, or condensed. You are READ-ONLY: you never edit source, never stage, never commit. Your output is a catalogue of reduction opportunities for a human to act on.
+
+You do NOT review correctness, security, or performance — those route to `/np:verify-work`, the security reviewer, and the performance lens respectively. Your single axis is economy: code that should not exist as written.
+
+**CRITICAL: Mandatory Initial Read**
+If the prompt contains a `<files_to_read>` block, you MUST `Read` every file listed there before anything else — chiefly `agents/np-critic-economy.md`, which is your canonical rubric (the ladder, the categories, the severity bar, and the safety boundaries). Apply it verbatim; this command and the in-loop critic must give identical verdicts on the same diff.
+</role>
+
+## Completeness Mandate
+
+This agent operates under [`templates/COMPLETENESS.md`](../templates/COMPLETENESS.md). Economy serves clarity, never under-delivery. The rules that bind this role:
+
+- **Rule 3 — Do it with tests.** A test is never a reduction target. You do not propose deleting, shrinking, or weakening test code. Coverage is completeness, not bloat.
+- **Rule 5 — Aim to genuinely impress.** "Could be cleaner" is not a finding. Every entry cites file, line, the exact construct, and the concrete replacement.
+- **Rule 8 — Never present a workaround when the real fix exists.** Recommend the root-cause-simple form, never an obscure golfed one-liner that trades clarity for line count.
+
+Refusal of any rule is a hard-stop. Surface the violation to the user verbatim and abort.
+
+## Inputs
+
+The orchestrator provides these in your prompt context. Read every path it hands you via `Read` — do not guess.
+
+| Input | Purpose | Typical path |
+|-------|---------|--------------|
+| Economy rubric (required) | Your canonical ladder, categories, severity bar, and safety boundaries. | `agents/np-critic-economy.md` |
+| Review scope (required) | The diff to audit (inline) or, in `--repo` mode, the `git ls-files` roster of the whole tracked tree. | inline / `git diff` capture / `git ls-files` roster |
+| Stack conventions (recommended) | Project stdlib, native framework features, installed dependencies. | `.nubos-pilot/codebase/INDEX.md`, `.nubos-pilot/RULES.md` |
+| Codebase docs (recommended) | Existing helpers the code should have reused. | `.nubos-pilot/codebase/modules/<id>.md` |
+
+## Scope modes
+
+The orchestrator tells you which scope you are auditing:
+
+- **diff** (default) — you receive a `git diff`. Review only the added/changed hunks; cite the new line.
+- **repo** (`--repo`) — you receive a `git ls-files` roster instead of a diff. Walk the tracked source yourself with `Read`/`Grep`/`Glob` and apply the same ladder to standing over-engineering that predates any one change. Skip vendored, generated, lock, and minified files; prioritise the largest hand-written modules and stop when the audit budget is spent. Cite `<file>:L<line>` from the file you read. The same safety boundaries apply — never flag a test, validation, error path, or security control.
+
+The rubric, categories, severity bar, and safety net are identical across both modes; only the surface you walk differs.
+
+## What you check
+
+Apply the ladder and categories from `agents/np-critic-economy.md` exactly. The four economy categories map to the report tags below:
+
+| Tag | Economy category | Meaning |
+|---|---|---|
+| `delete:` | `over-engineering` | Single-use abstraction, speculative flexibility, unnecessary layer — remove it. |
+| `stdlib:` | `stdlib-reinvention` | Hand-rolled code the language stdlib provides — call the stdlib. |
+| `native:` | `native-duplication` | Reimplements a framework/platform feature or an installed dependency. |
+| `shrink:` | `shrinkable` | Verbose-but-correct logic that condenses without losing clarity. |
+
+**Never a finding (the safety net from the rubric):** tests and assertions, input validation at trust boundaries, error handling that prevents data loss or silent failure, security/access-control checks, and the edge cases a success criterion requires. When economy would weaken any of these, it is not a finding.
+
+High-confidence only: report an entry only when the reduction is real and the replacement is concrete and clarity-neutral. A noisy report trains the reader to ignore it.
+
+## Output
+
+Emit a plain-text report (no JSON, no file write). One line per finding, in this exact shape — file basename precedes the line number for multi-file diffs:
+
+```
+<file>:L<line>: <tag> <what>. <replacement>.
+```
+
+Group nothing; sort by file then line. End with a single summary line:
+
+```
+net: -<N> lines possible.
+```
+
+`<N>` is your conservative estimate of removable lines across all entries. If the diff is already economical, emit exactly:
+
+```
+Lean already. Ship.
+```
+
+You catalogue; you never apply. If the user wants the changes made, they run them through `/np:execute-phase` (where the Economy critic enforces the same bar when `agents.economy` is `full` or `ultra`) or edit by hand. Hand back the report and stop.

package/bin/install.js

@@ -228,6 +228,27 @@ function _readInstallConfig(projectRoot) {
   }
 }
 
+// On re-install/update the installer leaves an existing config.json untouched.
+// To make `ultra` the standard for updated projects too, backfill `agents.economy`
+// into configs that don't set it yet — loud (the key is written, visible in the
+// file) and conservative (an explicit economy OR legacy economy_critic is treated
+// as a deliberate choice and never overwritten). Returns the action taken for logging.
+function _backfillEconomyDefault(stateDir, { dryRun = false } = {}) {
+  const cfgPath = path.join(stateDir, 'config.json');
+  let raw;
+  try { raw = fs.readFileSync(cfgPath, 'utf-8'); } catch { return 'absent'; }
+  let cfg;
+  try { cfg = JSON.parse(raw); } catch { return 'unparseable'; }
+  if (!cfg || typeof cfg !== 'object') return 'unparseable';
+  const agents = cfg.agents && typeof cfg.agents === 'object' ? cfg.agents : null;
+  if (agents && (agents.economy !== undefined || agents.economy_critic !== undefined)) {
+    return 'preserved';
+  }
+  cfg.agents = { ...(agents || {}), economy: configDefaults.INSTALL_ECONOMY_MODE };
+  if (!dryRun) atomicWriteFileSync(cfgPath, JSON.stringify(cfg, null, 2));
+  return 'backfilled';
+}
+
 function _readExistingScope(projectRoot) {
   const cfg = _readInstallConfig(projectRoot);
   return cfg && cfg.scope ? cfg.scope : null;
@@ -419,6 +440,14 @@ async function _runInstallLocked(ctx) {
     if (!dryRun) atomicWriteFileSync(configPath, JSON.stringify(config, null, 2));
     else console.error(dim + 'DRY-RUN: würde schreiben ' + configPath + reset);
     initConfig = config;
+  } else {
+    // Re-install / update: backfill the ultra economy default into a config that
+    // doesn't set it yet (never overwriting an explicit choice).
+    const action = _backfillEconomyDefault(stateDir, { dryRun });
+    if (action === 'backfilled') {
+      console.error(green + '  [config] agents.economy → ultra (backfilled default)'
+        + (dryRun ? ' [DRY-RUN]' : '') + reset);
+    }
   }
 
   const resolvedScope = (initConfig && initConfig.scope) || preliminaryScope;
@@ -886,5 +915,5 @@ module.exports = {
   parseInstallFlags,
   VALID_AGENTS, VALID_SCOPES,
   SOURCE_PAYLOAD_DIR, PAYLOAD_SUBPATH, STATE_SUBPATH,
-  _payloadDirFor, _stateDirFor,
+  _payloadDirFor, _stateDirFor, _backfillEconomyDefault,
 };

package/bin/np-tools/_commands.cjs

@@ -46,10 +46,12 @@ const COMMANDS = [
   { name: 'metrics',             category: 'Utility', description: 'Record JSONL metrics entry (record | now | start-timestamp | end-timestamp)', description_de: 'Schreibt JSONL-Metrics-Eintrag (record | now | start-timestamp | end-timestamp)' },
 
   { name: 'add-todo',            category: 'Capture', description: 'Capture a pending todo to .nubos-pilot/todos/pending/ + increment STATE count', description_de: 'Erfasst pending Todo nach .nubos-pilot/todos/pending/ + erhöht STATE-Counter' },
+  { name: 'simplify-debt',       category: 'Capture', description: 'Economy-debt ledger CRUD — record deferred simplifications so "later" does not become "never". Verbs: add --file --line --category --note | list [--status open|resolved|all] [--json] | resolve <id>. Categories mirror the four Economy critic routes; manual twin of /np:simplify-review.', description_de: 'Economy-Debt-Ledger-CRUD — erfasst aufgeschobene Vereinfachungen, damit "spaeter" nicht "nie" wird. Verben: add --file --line --category --note | list [--status open|resolved|all] [--json] | resolve <id>. Kategorien spiegeln die vier Economy-Critic-Routen; manuelles Pendant zu /np:simplify-review.' },
 
   { name: 'askuser',         category: 'Utility', description: 'Capability-layer prompt wrapper (reads spec JSON, returns chosen label)', description_de: 'Capability-Layer-Prompt-Wrapper (liest Spec-JSON, gibt gewähltes Label zurück)' },
   { name: 'commit',          category: 'Utility', description: 'Atomic git commit wrapper with gitignore-guard', description_de: 'Atomarer Git-Commit-Wrapper mit Gitignore-Guard' },
   { name: 'config-get',      category: 'Utility', description: 'Read value from .nubos-pilot/config.json by dotted key path', description_de: 'Liest Wert aus .nubos-pilot/config.json über Dotted-Key-Pfad' },
+  { name: 'economy-mode',    category: 'Utility', description: 'Resolve the Economy axis level (off|lite|full|ultra) from agents.economy (legacy agents.economy_critic honoured; default lite). Prints the mode, or --json for {mode,prevention,critic,ultra} gate flags. Single source for the execute-phase economy gate.', description_de: 'Löst das Economy-Achsen-Level (off|lite|full|ultra) aus agents.economy (Legacy agents.economy_critic wird berücksichtigt; Default lite). Gibt den Mode aus, oder --json für {mode,prevention,critic,ultra}-Gate-Flags. Single Source für das execute-phase-Economy-Gate.' },
   { name: 'lang-directive',  category: 'Utility', description: 'Print workflow language directive from config.response_language (SSOT)', description_de: 'Gibt Workflow-Sprachdirektive aus config.response_language aus (SSOT)' },
   { name: 'text-mode',       category: 'Utility', description: 'Print whether text mode is active (config.workflow.text_mode ∨ CLAUDECODE)', description_de: 'Gibt aus, ob Text-Mode aktiv ist (config.workflow.text_mode ∨ CLAUDECODE)' },
   { name: 'generate-slug',   category: 'Utility', description: 'Slugify text via lib/layout.cjs.slugify', description_de: 'Slugifiziert Text über lib/layout.cjs.slugify' },

package/bin/np-tools/doctor.cjs

@@ -343,6 +343,7 @@ const NUBOSLOOP_CRITICS = [
   'np-critic-style',       // axis module (Style)
   'np-critic-tests',       // axis module (Tests)
   'np-critic-acceptance',  // axis module (Acceptance)
+  'np-critic-economy',     // axis module (Economy)
 ];
 
 function _checkNubosloopCritics(projectRoot) {

package/bin/np-tools/economy-mode.cjs

@@ -0,0 +1,47 @@
+'use strict';
+
+const { economyFlags } = require('../../lib/economy-mode.cjs');
+const { emitErrorEnvelope } = require('./_args.cjs');
+
+function _usage() {
+  return 'Usage:\n  np-tools.cjs economy-mode [--json]';
+}
+
+function _readConfig(cwd) {
+  const { readConfig } = require('../../lib/config.cjs');
+  try {
+    const cfg = readConfig(cwd);
+    return cfg && Object.keys(cfg).length === 0 ? null : cfg;
+  } catch (err) {
+    if (err && err.code === 'not-in-project') return null;
+    throw err;
+  }
+}
+
+function run(argv, ctx) {
+  const context = ctx || {};
+  const cwd = context.cwd || process.cwd();
+  const stdout = context.stdout || process.stdout;
+  const stderr = context.stderr || process.stderr;
+  const args = Array.isArray(argv) ? argv.slice() : [];
+  if (args.includes('--help') || args.includes('-h')) {
+    stdout.write(_usage() + '\n');
+    return 0;
+  }
+  const asJson = args.includes('--json');
+  try {
+    const config = _readConfig(cwd);
+    const flags = economyFlags(config || {});
+    stdout.write((asJson ? JSON.stringify(flags) : flags.mode) + '\n');
+    return 0;
+  } catch (err) {
+    emitErrorEnvelope(err, stderr, 'economy-mode-internal-error');
+    return 1;
+  }
+}
+
+module.exports = { run };
+
+if (require.main === module) {
+  process.exit(run(process.argv.slice(2)));
+}

package/bin/np-tools/loop-run-round.cjs

@@ -311,7 +311,7 @@ function _runPostCritics(taskId, list, cwd) {
         'phase=post-critics refused: critic-schwarm spawn-evidence missing for round=' + gateRound +
         ' on ' + taskId + ' (missing audits: ' + verdict.missing.join(', ') + '). ' +
         'For each critic agent, call `loop-audit-tool-use ' + taskId +
-        ' --agent <np-critic-style|np-critic-tests|np-critic-acceptance> --tool-use-log <json>` ' +
+        ' --agent <np-critic-style|np-critic-tests|np-critic-acceptance|np-critic-economy> --tool-use-log <json>` ' +
         'after the spawn, then re-run --phase post-critics. Pass --force-post-critics for an explicit override.',
         { taskId, round: gateRound, missing: verdict.missing.slice(), required: nubosloop.POST_CRITICS_EVIDENCE.slice() },
       );

package/bin/np-tools/resolve-model.cjs

@@ -32,6 +32,7 @@ const CRITIC_TIER_OVERRIDES = {
   'np-critic-style':       'style_tier',
   'np-critic-tests':       'tests_tier',
   'np-critic-acceptance':  'acceptance_tier',
+  'np-critic-economy':     'economy_tier',
 };
 
 function _criticTierOverride(config, agentName) {

package/bin/np-tools/simplify-debt.cjs

@@ -0,0 +1,91 @@
+'use strict';
+
+const { NubosPilotError } = require('../../lib/core.cjs');
+const debt = require('../../lib/economy-debt.cjs');
+
+function _parseFlags(list) {
+  const out = { _: [], file: null, line: null, category: null, note: null, status: null, json: false };
+  for (let i = 0; i < list.length; i++) {
+    const a = list[i];
+    if (a === '--json') out.json = true;
+    else if (a === '--file') out.file = list[++i];
+    else if (a.startsWith('--file=')) out.file = a.slice('--file='.length);
+    else if (a === '--line') out.line = list[++i];
+    else if (a.startsWith('--line=')) out.line = a.slice('--line='.length);
+    else if (a === '--category') out.category = list[++i];
+    else if (a.startsWith('--category=')) out.category = a.slice('--category='.length);
+    else if (a === '--note') out.note = list[++i];
+    else if (a.startsWith('--note=')) out.note = a.slice('--note='.length);
+    else if (a === '--status') out.status = list[++i];
+    else if (a.startsWith('--status=')) out.status = a.slice('--status='.length);
+    else out._.push(a);
+  }
+  return out;
+}
+
+function _renderList(entries, status) {
+  if (entries.length === 0) {
+    return status === 'resolved'
+      ? 'No resolved economy-debt entries.'
+      : 'Economy-debt ledger is empty. Lean already.';
+  }
+  const lines = entries.map((e) => {
+    const where = e.line > 0 ? e.file + ':' + e.line : (e.file || '(no file)');
+    const mark = e.status === 'resolved' ? '[x]' : '[ ]';
+    return mark + ' ' + e.id + '  ' + e.category.padEnd(18) + ' ' + where + '\n      ' + e.note;
+  });
+  const open = entries.filter((e) => e.status === 'open').length;
+  const resolved = entries.length - open;
+  lines.push('');
+  lines.push('total: ' + entries.length + ' (' + open + ' open, ' + resolved + ' resolved)');
+  return lines.join('\n');
+}
+
+function run(args, ctx) {
+  const context = ctx || {};
+  const cwd = context.cwd || process.cwd();
+  const stdout = context.stdout || process.stdout;
+  const list = Array.isArray(args) ? args : [];
+  const verb = (list[0] || 'list').trim();
+  const flags = _parseFlags(list.slice(1));
+
+  if (verb === 'add') {
+    const note = flags.note != null ? flags.note : flags._.join(' ');
+    const entry = debt.addEntry(
+      { file: flags.file, line: flags.line, category: flags.category, note },
+      cwd,
+    );
+    stdout.write(JSON.stringify({ ok: true, action: 'add', was_new: entry.was_new, entry }) + '\n');
+    return 0;
+  }
+
+  if (verb === 'resolve') {
+    const id = flags._[0];
+    const entry = debt.resolveEntry(id, cwd);
+    stdout.write(JSON.stringify({ ok: true, action: 'resolve', entry }) + '\n');
+    return 0;
+  }
+
+  if (verb === 'list') {
+    const status = flags.status || 'open';
+    const entries = debt.listEntries(status, cwd);
+    if (flags.json) {
+      stdout.write(JSON.stringify({ ok: true, action: 'list', status, count: entries.length, entries }, null, 2) + '\n');
+    } else {
+      stdout.write(_renderList(entries, status) + '\n');
+    }
+    return 0;
+  }
+
+  throw new NubosPilotError(
+    'simplify-debt-unknown-verb',
+    "simplify-debt verb must be 'add', 'list', or 'resolve' (got: " + verb + ')',
+    { verb },
+  );
+}
+
+module.exports = { run, _parseFlags, _renderList };
+
+if (require.main === module) {
+  process.exit(run(process.argv.slice(2)));
+}

package/bin/np-tools/simplify-debt.test.cjs

@@ -0,0 +1,99 @@
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { test, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+
+const subcmd = require('./simplify-debt.cjs');
+
+const _sandboxes = [];
+
+function makeSandbox() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'np-simplify-debt-'));
+  fs.mkdirSync(path.join(root, '.nubos-pilot'), { recursive: true });
+  _sandboxes.push(root);
+  return root;
+}
+
+function capture(fn) {
+  const out = [];
+  const orig = process.stdout.write.bind(process.stdout);
+  process.stdout.write = (c) => { out.push(String(c)); return true; };
+  let rc;
+  try { rc = fn(); } finally { process.stdout.write = orig; }
+  return { stdout: out.join(''), rc };
+}
+
+afterEach(() => {
+  while (_sandboxes.length) {
+    try { fs.rmSync(_sandboxes.pop(), { recursive: true, force: true }); } catch { /* best effort */ }
+  }
+});
+
+test('SD-1: add records an entry and reports was_new', () => {
+  const cwd = makeSandbox();
+  const { stdout, rc } = capture(() =>
+    subcmd.run(['add', '--file', 'src/foo.ts', '--line', '42', '--category', 'over-engineering', '--note', 'inline the factory'], { cwd }),
+  );
+  assert.equal(rc, 0);
+  const res = JSON.parse(stdout);
+  assert.equal(res.ok, true);
+  assert.equal(res.action, 'add');
+  assert.equal(res.was_new, true);
+  assert.equal(res.entry.category, 'over-engineering');
+});
+
+test('SD-2: add accepts the note as positional args', () => {
+  const cwd = makeSandbox();
+  const { stdout, rc } = capture(() =>
+    subcmd.run(['add', '--category', 'shrinkable', 'collapse', 'this', 'loop'], { cwd }),
+  );
+  assert.equal(rc, 0);
+  assert.equal(JSON.parse(stdout).entry.note, 'collapse this loop');
+});
+
+test('SD-3: list (default open) renders the ledger', () => {
+  const cwd = makeSandbox();
+  capture(() => subcmd.run(['add', '--file', 'a.ts', '--category', 'shrinkable', '--note', 'use reduce'], { cwd }));
+  const { stdout, rc } = capture(() => subcmd.run(['list'], { cwd }));
+  assert.equal(rc, 0);
+  assert.match(stdout, /shrinkable/);
+  assert.match(stdout, /1 open/);
+});
+
+test('SD-4: list --json emits structured entries', () => {
+  const cwd = makeSandbox();
+  capture(() => subcmd.run(['add', '--file', 'a.ts', '--category', 'shrinkable', '--note', 'x'], { cwd }));
+  const { stdout } = capture(() => subcmd.run(['list', '--json'], { cwd }));
+  const res = JSON.parse(stdout);
+  assert.equal(res.count, 1);
+  assert.equal(res.entries[0].category, 'shrinkable');
+});
+
+test('SD-5: no-arg defaults to list', () => {
+  const cwd = makeSandbox();
+  const { stdout, rc } = capture(() => subcmd.run([], { cwd }));
+  assert.equal(rc, 0);
+  assert.match(stdout, /empty|Lean already/i);
+});
+
+test('SD-6: resolve moves an entry to resolved', () => {
+  const cwd = makeSandbox();
+  const added = capture(() => subcmd.run(['add', '--file', 'a.ts', '--category', 'native-duplication', '--note', 'reuse helper'], { cwd }));
+  const id = JSON.parse(added.stdout).entry.id;
+  const { stdout, rc } = capture(() => subcmd.run(['resolve', id], { cwd }));
+  assert.equal(rc, 0);
+  assert.equal(JSON.parse(stdout).entry.status, 'resolved');
+  const open = capture(() => subcmd.run(['list', '--json'], { cwd }));
+  assert.equal(JSON.parse(open.stdout).count, 0);
+});
+
+test('SD-7: unknown verb throws', () => {
+  const cwd = makeSandbox();
+  assert.throws(
+    () => subcmd.run(['frobnicate'], { cwd }),
+    (err) => err && err.name === 'NubosPilotError' && err.code === 'simplify-debt-unknown-verb',
+  );
+});

package/lib/agents-registry.cjs

@@ -6,8 +6,9 @@ const LEGACY_CRITIC_AXIS_AGENTS = Object.freeze([
   'np-critic-style',
   'np-critic-tests',
   'np-critic-acceptance',
+  'np-critic-economy',
 ]);
-const SUPPORTED_CRITIC_AXES = Object.freeze(['critic', 'style', 'tests', 'acceptance']);
+const SUPPORTED_CRITIC_AXES = Object.freeze(['critic', 'style', 'tests', 'acceptance', 'economy']);
 
 const EXECUTOR_AGENT = 'np-executor';
 const BUILD_FIXER_AGENT = 'np-build-fixer';