patchwork-os 1.2.0-beta.2.canary.655 → 1.2.0-beta.2.canary.657

package/dist/butler/errandOutcomeGrader.d.ts

@@ -87,6 +87,28 @@ export interface ObservedErrandArtifact {
      * have reported `completed: true` may set this.
      */
     stateObserved?: boolean;
+    /**
+     * When THIS artifact first came under observation.
+     *
+     * The staleness rule converts silence into a negative, and it is sound only
+     * where not-acting is a DECISION. That requires the operator to have been in
+     * a loop they knew about. For an errand filed before any observation channel
+     * existed, they were never asked and did not know it was tracked — so its
+     * age says nothing about their judgement.
+     *
+     * Without this, the first real ingest is the worst one: every historical
+     * errand older than the horizon grades `junk` on day one, and `stateObserved`
+     * does NOT catch it, because we genuinely did look. That guard separates
+     * "nobody looked" from "we looked"; this one separates "nobody was asked"
+     * from "somebody declined to act".
+     *
+     * So the clock starts at `max(createdAt, watchedSince)`. A 60-day-old errand
+     * first seen today has been watched for zero days, and is `open-recent`.
+     *
+     * Absent ⇒ falls back to `createdAt`, preserving the old behaviour for
+     * callers that genuinely have been watching since creation.
+     */
+    watchedSince?: number;
 }
 export interface GradeOptions {
     /** Clock. Injected so grading is reproducible in replay. */

package/dist/butler/errandOutcomeGrader.js

@@ -76,7 +76,11 @@ export function gradeErrandOutcome(observed, opts) {
         return { disposition: "unknown", reason: "not-observed" };
     }
     const staleAfter = opts.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
-    const age = opts.now - observed.createdAt;
+    // The clock starts when WE started watching, not when the errand was filed.
+    // An errand that predates observation has not been "ignored for 60 days" —
+    // nobody was asked. See `watchedSince`.
+    const openSince = Math.max(observed.createdAt, observed.watchedSince ?? observed.createdAt);
+    const age = opts.now - openSince;
     if (age >= staleAfter) {
         return { disposition: "junk", reason: "stale-unactioned" };
     }

package/dist/butler/errandOutcomeGrader.js.map

@@ -1 +1 @@
-{"version":3,"file":"errandOutcomeGrader.js","sourceRoot":"","sources":["../../src/butler/errandOutcomeGrader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAoE/D;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgC,EAChC,IAAkB;IAElB,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,yCAAyC;IACzC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC;IAED,yEAAyE;IACzE,mCAAmC;IACnC,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,2EAA2E;QAC3E,2CAA2C;QAC3C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACpC,uEAAuE;QACvE,2EAA2E;QAC3E,uDAAuD;QACvD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC1C,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;QACtB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"errandOutcomeGrader.js","sourceRoot":"","sources":["../../src/butler/errandOutcomeGrader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA0F/D;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgC,EAChC,IAAkB;IAElB,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,yCAAyC;IACzC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC;IAED,yEAAyE;IACzE,mCAAmC;IACnC,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,2EAA2E;QAC3E,2CAA2C;QAC3C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACpC,uEAAuE;QACvE,2EAA2E;QAC3E,uDAAuD;QACvD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAC/D,4EAA4E;IAC5E,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,CAC5C,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC;IACjC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;QACtB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC3D,CAAC"}

package/dist/butler/outcomeIngester.js

@@ -39,7 +39,7 @@
  * rows the grader has not earned the right to be evidence.
  */
 import { gradeErrandOutcome, } from "./errandOutcomeGrader.js";
-import { appendShadowOutcome, summariseShadowLog, } from "./outcomeShadowLog.js";
+import { appendShadowOutcome, firstSeenByRef, summariseShadowLog, } from "./outcomeShadowLog.js";
 /**
  * Grade every observation and append a shadow row per accepted one.
  *
@@ -51,6 +51,11 @@ import { appendShadowOutcome, summariseShadowLog, } from "./outcomeShadowLog.js"
  * an errand going from open to completed.
  */
 export function ingestErrandOutcomes(observations, opts) {
+    // When each ref came under observation, read from the ledger. An errand
+    // first seen in THIS run has been watched for zero time, so the staleness
+    // rule cannot yet convert its silence into a negative — the operator was
+    // never asked. See `watchedSince` in errandOutcomeGrader.
+    const firstSeen = firstSeenByRef({ dir: opts.dir });
     const skipped = [];
     const batch = { confirmed: 0, junk: 0, unknown: 0 };
     const seen = new Set();
@@ -66,7 +71,10 @@ export function ingestErrandOutcomes(observations, opts) {
             continue;
         }
         seen.add(ref);
-        const { disposition, reason } = gradeErrandOutcome(obs, opts);
+        const { disposition, reason } = gradeErrandOutcome({
+            ...obs,
+            watchedSince: obs.watchedSince ?? firstSeen.get(ref) ?? opts.now,
+        }, opts);
         appendShadowOutcome({
             ref,
             disposition,

package/dist/butler/outcomeIngester.js.map

@@ -1 +1 @@
-{"version":3,"file":"outcomeIngester.js","sourceRoot":"","sources":["../../src/butler/outcomeIngester.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAEL,kBAAkB,GAEnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EAEnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAgC/B;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAA0C,EAC1C,IAAmB;IAEnB,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9D,mBAAmB,CACjB;YACE,GAAG;YACH,WAAW;YACX,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG;YAClB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,EACD,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAClB,CAAC;QACF,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,CAAC;IACX,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,KAAK;QACL,MAAM,EAAE,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAgB;IAClD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO;YACL,qCAAqC;YACrC,EAAE;YACF,kEAAkE;YAClE,oDAAoD;SACrD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAClE,OAAO;QACL,mBAAmB,CAAC,CAAC,KAAK,iBAAiB;QAC3C,gBAAgB,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG;QACnD,gBAAgB,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG;QACzC,gBAAgB,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B;QACtE,EAAE;QACF,KAAK,CAAC,CAAC,UAAU,YAAY,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,+BAA+B;QAC7E,EAAE;QACF,0EAA0E;QAC1E,sEAAsE;QACtE,yDAAyD;KAC1D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"outcomeIngester.js","sourceRoot":"","sources":["../../src/butler/outcomeIngester.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAEL,kBAAkB,GAEnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,cAAc,EAEd,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAgC/B;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAA0C,EAC1C,IAAmB;IAEnB,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAChD;YACE,GAAG,GAAG;YACN,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG;SACjE,EACD,IAAI,CACL,CAAC;QACF,mBAAmB,CACjB;YACE,GAAG;YACH,WAAW;YACX,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG;YAClB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,EACD,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAClB,CAAC;QACF,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,CAAC;IACX,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,KAAK;QACL,MAAM,EAAE,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAgB;IAClD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO;YACL,qCAAqC;YACrC,EAAE;YACF,kEAAkE;YAClE,oDAAoD;SACrD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAClE,OAAO;QACL,mBAAmB,CAAC,CAAC,KAAK,iBAAiB;QAC3C,gBAAgB,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG;QACnD,gBAAgB,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG;QACzC,gBAAgB,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B;QACtE,EAAE;QACF,KAAK,CAAC,CAAC,UAAU,YAAY,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,+BAA+B;QAC7E,EAAE;QACF,0EAA0E;QAC1E,sEAAsE;QACtE,yDAAyD;KAC1D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/butler/outcomeShadowLog.d.ts

@@ -68,6 +68,20 @@ export declare function wouldCountAsEvidence(d: OutcomeDisposition): boolean;
 export declare function appendShadowOutcome(row: Omit<ShadowOutcomeRow, "wouldCountAsEvidence">, opts?: {
     dir?: string;
 }): void;
+/**
+ * When each ref was FIRST graded, from the ledger itself.
+ *
+ * No new file: every shadow row already carries `gradedAt`, so the earliest
+ * one for a ref IS the moment it came under observation. A separate
+ * "first seen" store would be a second source of truth that can disagree with
+ * the ledger it describes — and the ledger is the thing a reviewer reads.
+ *
+ * Refs absent from the map have never been observed; the caller supplies
+ * `now`, which is correct: this run is when watching starts.
+ */
+export declare function firstSeenByRef(opts?: {
+    dir?: string;
+}): Map<string, number>;
 export interface ShadowSummary {
     total: number;
     confirmed: number;

package/dist/butler/outcomeShadowLog.js

@@ -62,6 +62,48 @@ export function appendShadowOutcome(row, opts = {}) {
         // turn into an errand failure.
     }
 }
+/**
+ * When each ref was FIRST graded, from the ledger itself.
+ *
+ * No new file: every shadow row already carries `gradedAt`, so the earliest
+ * one for a ref IS the moment it came under observation. A separate
+ * "first seen" store would be a second source of truth that can disagree with
+ * the ledger it describes — and the ledger is the thing a reviewer reads.
+ *
+ * Refs absent from the map have never been observed; the caller supplies
+ * `now`, which is correct: this run is when watching starts.
+ */
+export function firstSeenByRef(opts = {}) {
+    const out = new Map();
+    const p = shadowLogPath(opts.dir);
+    if (!existsSync(p))
+        return out;
+    let text;
+    try {
+        text = readFileSync(p, "utf-8");
+    }
+    catch {
+        return out;
+    }
+    for (const line of text.split("\n")) {
+        if (!line.trim())
+            continue;
+        let row;
+        try {
+            row = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (typeof row.ref !== "string" || typeof row.gradedAt !== "number") {
+            continue;
+        }
+        const prev = out.get(row.ref);
+        if (prev === undefined || row.gradedAt < prev)
+            out.set(row.ref, row.gradedAt);
+    }
+    return out;
+}
 /**
  * Summarise the shadow ledger — the number this phase exists to produce.
  *

package/dist/butler/outcomeShadowLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"outcomeShadowLog.js","sourceRoot":"","sources":["../../src/butler/outcomeShadowLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAEjE,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACrE,CAAC;AAwBD,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAAC,CAAqB;IACxD,OAAO,CAAC,KAAK,SAAS,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAmD,EACnD,OAAyB,EAAE;IAE3B,MAAM,IAAI,GAAqB;QAC7B,GAAG,GAAG;QACN,oBAAoB,EAAE,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC;KAC5D,CAAC;IACF,IAAI,CAAC;QACH,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,+BAA+B;IACjC,CAAC;AACH,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB,EAAE;IAC5D,MAAM,KAAK,GAAkB;QAC3B,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,CAAC;QACZ,IAAI,EAAE,CAAC;QACP,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,CAAC;KACd,CAAC;IACF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,GAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IACE,GAAG,CAAC,WAAW,KAAK,WAAW;YAC/B,GAAG,CAAC,WAAW,KAAK,MAAM;YAC1B,GAAG,CAAC,WAAW,KAAK,SAAS,EAC7B,CAAC;YACD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,oBAAoB;YAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"outcomeShadowLog.js","sourceRoot":"","sources":["../../src/butler/outcomeShadowLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAEjE,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACrE,CAAC;AAwBD,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAAC,CAAqB;IACxD,OAAO,CAAC,KAAK,SAAS,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAmD,EACnD,OAAyB,EAAE;IAE3B,MAAM,IAAI,GAAqB;QAC7B,GAAG,GAAG;QACN,oBAAoB,EAAE,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC;KAC5D,CAAC;IACF,IAAI,CAAC;QACH,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,+BAA+B;IACjC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,GAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpE,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI;YAC3C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB,EAAE;IAC5D,MAAM,KAAK,GAAkB;QAC3B,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,CAAC;QACZ,IAAI,EAAE,CAAC;QACP,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,CAAC;KACd,CAAC;IACF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,GAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IACE,GAAG,CAAC,WAAW,KAAK,WAAW;YAC/B,GAAG,CAAC,WAAW,KAAK,MAAM;YAC1B,GAAG,CAAC,WAAW,KAAK,SAAS,EAC7B,CAAC;YACD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,oBAAoB;YAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/identity/credentialStore.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Where per-member password hashes live — ADR-0020 Phase A.
+ *
+ * `~/.patchwork/credentials.json`, mode 0600, keyed by member id. A separate
+ * file from `members.json`, and that separation is the decision worth
+ * recording, because two other homes were considered and are worse.
+ *
+ * ## Not on the `Member` object
+ *
+ * `Member` is what `actorSnapshot` copies from into decision records. A hash
+ * hanging off it is one careless spread away from an audit log. That is why
+ * `LocalPasswordProvider` takes `credentialFor` injected rather than reading a
+ * field — this module supplies that function and nothing else.
+ *
+ * ## Not in `members.json`
+ *
+ * The roster is a describable, reviewable document: the sort of file somebody
+ * eventually pastes into an issue or commits to share a configuration. The
+ * moment it carries hashes, that is a credential leak by ordinary helpfulness.
+ * Separate files let the roster stay boring.
+ *
+ * A member deactivated rather than deleted (the roster's rule) leaves an
+ * orphaned credential here. That is correct and deliberate: the history stays,
+ * the login does not.
+ *
+ * ## NOT in the connector token store
+ *
+ * `PATCHWORK_TOKEN_DIR` already has 0600 handling and a keychain backend, and
+ * it is the wrong home twice over. Conceptually it holds credentials the
+ * bridge uses to call OUT; these are credentials people use to call IN.
+ * Practically, that path reaches `deleteSecretJsonSync` → an unconditional
+ * `unlink`, which is why `audit-connector-test-isolation` exists at all: in
+ * #1345 a disconnect test deleted a real credential off a developer's machine.
+ * Putting member logins behind that same unlink means a stray `clearTokens()`
+ * in a test can delete them.
+ *
+ * ## Fail CLOSED — the opposite of the roster
+ *
+ * A missing roster yields one implicit owner, so a single-user machine keeps
+ * working: "who may act on your own machine" defaults to the status quo. A
+ * missing credential file yields NOTHING, so nobody authenticates: "who are
+ * you" defaults to nobody. Those defaults are deliberately opposite, and the
+ * asymmetry is the same one ADR-0016 draws — a decision about whether an
+ * action happens defaults to no.
+ *
+ * Concretely: no file, unreadable file, malformed JSON, or an entry that is
+ * not a well-formed scrypt record all produce "no credential for this member",
+ * and `LocalPasswordProvider` then returns UNATTRIBUTED. None of them throw,
+ * because a thrown lookup is something a caller might catch and treat as a
+ * pass.
+ */
+export declare const CREDENTIALS_BASENAME = "credentials.json";
+/** `~/.patchwork/credentials.json`, honouring `PATCHWORK_HOME`. */
+export declare function defaultCredentialsPath(): string;
+export interface CredentialStore {
+    /** The function `LocalPasswordProvider` wants. */
+    credentialFor(memberId: string): string | undefined;
+    /** Ids with a usable credential — for `patchwork members` to report. */
+    ids(): string[];
+    /** Entries that were present but unusable, so nobody is told "no such user"
+     *  when the truth is "your record is corrupt". */
+    malformed: string[];
+    /** True when the file exists but is readable by group or others. */
+    overlyPermissive: boolean;
+}
+/**
+ * Load the credential file.
+ *
+ * Read ONCE at startup, like the roster, and deliberately not re-read per
+ * request: a file re-read on every authentication is a file whose permissions
+ * and contents can change under a running process, and the resulting behaviour
+ * is untestable. Rotation takes a restart, same as the roster.
+ */
+export declare function loadCredentials(path?: string): CredentialStore;

package/dist/identity/credentialStore.js

@@ -0,0 +1,124 @@
+/**
+ * Where per-member password hashes live — ADR-0020 Phase A.
+ *
+ * `~/.patchwork/credentials.json`, mode 0600, keyed by member id. A separate
+ * file from `members.json`, and that separation is the decision worth
+ * recording, because two other homes were considered and are worse.
+ *
+ * ## Not on the `Member` object
+ *
+ * `Member` is what `actorSnapshot` copies from into decision records. A hash
+ * hanging off it is one careless spread away from an audit log. That is why
+ * `LocalPasswordProvider` takes `credentialFor` injected rather than reading a
+ * field — this module supplies that function and nothing else.
+ *
+ * ## Not in `members.json`
+ *
+ * The roster is a describable, reviewable document: the sort of file somebody
+ * eventually pastes into an issue or commits to share a configuration. The
+ * moment it carries hashes, that is a credential leak by ordinary helpfulness.
+ * Separate files let the roster stay boring.
+ *
+ * A member deactivated rather than deleted (the roster's rule) leaves an
+ * orphaned credential here. That is correct and deliberate: the history stays,
+ * the login does not.
+ *
+ * ## NOT in the connector token store
+ *
+ * `PATCHWORK_TOKEN_DIR` already has 0600 handling and a keychain backend, and
+ * it is the wrong home twice over. Conceptually it holds credentials the
+ * bridge uses to call OUT; these are credentials people use to call IN.
+ * Practically, that path reaches `deleteSecretJsonSync` → an unconditional
+ * `unlink`, which is why `audit-connector-test-isolation` exists at all: in
+ * #1345 a disconnect test deleted a real credential off a developer's machine.
+ * Putting member logins behind that same unlink means a stray `clearTokens()`
+ * in a test can delete them.
+ *
+ * ## Fail CLOSED — the opposite of the roster
+ *
+ * A missing roster yields one implicit owner, so a single-user machine keeps
+ * working: "who may act on your own machine" defaults to the status quo. A
+ * missing credential file yields NOTHING, so nobody authenticates: "who are
+ * you" defaults to nobody. Those defaults are deliberately opposite, and the
+ * asymmetry is the same one ADR-0016 draws — a decision about whether an
+ * action happens defaults to no.
+ *
+ * Concretely: no file, unreadable file, malformed JSON, or an entry that is
+ * not a well-formed scrypt record all produce "no credential for this member",
+ * and `LocalPasswordProvider` then returns UNATTRIBUTED. None of them throw,
+ * because a thrown lookup is something a caller might catch and treat as a
+ * pass.
+ */
+import { chmodSync, existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { patchworkHome } from "../patchworkHome.js";
+import { isCredentialRecord } from "./credentials.js";
+export const CREDENTIALS_BASENAME = "credentials.json";
+/** `~/.patchwork/credentials.json`, honouring `PATCHWORK_HOME`. */
+export function defaultCredentialsPath() {
+    const home = process.env.PATCHWORK_HOME?.trim();
+    return join(home && home !== "" ? home : patchworkHome(), CREDENTIALS_BASENAME);
+}
+const EMPTY = {
+    credentialFor: () => undefined,
+    ids: () => [],
+    malformed: [],
+    overlyPermissive: false,
+};
+/**
+ * Load the credential file.
+ *
+ * Read ONCE at startup, like the roster, and deliberately not re-read per
+ * request: a file re-read on every authentication is a file whose permissions
+ * and contents can change under a running process, and the resulting behaviour
+ * is untestable. Rotation takes a restart, same as the roster.
+ */
+export function loadCredentials(path = defaultCredentialsPath()) {
+    if (!existsSync(path))
+        return EMPTY;
+    let overlyPermissive = false;
+    try {
+        const mode = statSync(path).mode & 0o077;
+        if (mode !== 0) {
+            overlyPermissive = true;
+            // Tighten rather than merely complain. A world-readable password file is
+            // a live problem, and an operator who is told about it at startup has
+            // already been running that way for however long.
+            try {
+                chmodSync(path, 0o600);
+            }
+            catch {
+                /* reported via overlyPermissive; nothing else to do */
+            }
+        }
+    }
+    catch {
+        /* stat failed — fall through; the read below decides */
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf-8"));
+    }
+    catch {
+        // Unreadable or malformed ⇒ no credentials ⇒ nobody authenticates.
+        return { ...EMPTY, overlyPermissive };
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return { ...EMPTY, overlyPermissive };
+    }
+    const usable = new Map();
+    const malformed = [];
+    for (const [id, value] of Object.entries(parsed)) {
+        if (isCredentialRecord(value))
+            usable.set(id, value);
+        else
+            malformed.push(id);
+    }
+    return {
+        credentialFor: (memberId) => usable.get(memberId),
+        ids: () => [...usable.keys()],
+        malformed,
+        overlyPermissive,
+    };
+}
+//# sourceMappingURL=credentialStore.js.map

package/dist/identity/credentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialStore.js","sourceRoot":"","sources":["../../src/identity/credentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,mEAAmE;AACnE,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,IAAI,CACT,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,EAC5C,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAcD,MAAM,KAAK,GAAoB;IAC7B,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS;IAC9B,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE;IACb,SAAS,EAAE,EAAE;IACb,gBAAgB,EAAE,KAAK;CACxB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAI,GAAG,sBAAsB,EAAE;IAE/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACzC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,gBAAgB,GAAG,IAAI,CAAC;YACxB,yEAAyE;YACzE,sEAAsE;YACtE,kDAAkD;YAClD,IAAI,CAAC;gBACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,GAAG,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,GAAG,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC5E,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;;YAChD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO;QACL,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjD,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7B,SAAS;QACT,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/dist/index.js

@@ -216,6 +216,7 @@ const KNOWN_SUBCOMMANDS = [
     "gate",
     "outcomes",
     "butler",
+    "members",
     // Dispatched at `process.argv[2] === "tools"` (and `help`) but absent from
     // this array until 2026-08. The comment below calls this "the dispatch
     // source", and it was not: `patchwork tool` could never be corrected to
@@ -4231,6 +4232,116 @@ if (process.argv[2] === "gate") {
         }
     })();
 }
+// Handle members subcommand — the roster and per-member credentials
+// (ADR-0020 Phase A).
+//
+// `set-password` prompts on a TTY and never takes the secret from argv:
+// argv lands in shell history and in `ps` output for every user on the box.
+if (process.argv[2] === "members") {
+    const args = process.argv.slice(3);
+    (async () => {
+        try {
+            const { loadRoster, describeRoster } = await import("./identity/roster.js");
+            const { loadCredentials, defaultCredentialsPath } = await import("./identity/credentialStore.js");
+            if (args[0] === "list" || args.length === 0) {
+                const roster = loadRoster();
+                const creds = loadCredentials();
+                process.stdout.write(`${describeRoster(roster)}\n`);
+                const withCreds = new Set(creds.ids());
+                for (const m of roster.members) {
+                    process.stdout.write(`  ${m.id}  ${withCreds.has(m.id) ? "has a password" : "NO password — cannot authenticate"}\n`);
+                }
+                for (const bad of creds.malformed) {
+                    // "your record is corrupt" and "no such user" are different facts.
+                    process.stdout.write(`  ${bad}  credential present but UNREADABLE — treated as absent\n`);
+                }
+                if (creds.overlyPermissive) {
+                    process.stdout.write(`\n[members] ${defaultCredentialsPath()} was group/world-readable; tightened to 0600.\n`);
+                }
+                process.exit(0);
+            }
+            if (args[0] === "set-password") {
+                const memberId = args[1];
+                if (!memberId) {
+                    process.stderr.write("Usage: patchwork members set-password <memberId>\n");
+                    process.exit(2);
+                }
+                if (!process.stdin.isTTY) {
+                    // Refused rather than read from a pipe. A password arriving on stdin
+                    // from a script is a password in that script.
+                    process.stderr.write("[members] set-password needs an interactive terminal.\n");
+                    process.exit(2);
+                }
+                const { createInterface } = await import("node:readline");
+                const rl = createInterface({
+                    input: process.stdin,
+                    output: process.stdout,
+                });
+                const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
+                // Node's readline cannot suppress echo portably; muting the output
+                // stream is the standard trick and is why this is written by hand.
+                const mute = (on) => {
+                    rl.output.write = on
+                        ? () => { }
+                        : process.stdout.write.bind(process.stdout);
+                };
+                process.stdout.write(`Password for ${memberId}: `);
+                mute(true);
+                const pw = (await ask("")).trim();
+                mute(false);
+                process.stdout.write("\nConfirm: ");
+                mute(true);
+                const again = (await ask("")).trim();
+                mute(false);
+                process.stdout.write("\n");
+                rl.close();
+                if (!pw) {
+                    process.stderr.write("[members] empty password refused.\n");
+                    process.exit(2);
+                }
+                if (pw !== again) {
+                    process.stderr.write("[members] passwords did not match.\n");
+                    process.exit(2);
+                }
+                const { hashPassword } = await import("./identity/credentials.js");
+                const { readFileSync, writeFileSync, existsSync, chmodSync } = await import("node:fs");
+                const file = defaultCredentialsPath();
+                let existing = {};
+                if (existsSync(file)) {
+                    try {
+                        const parsed = JSON.parse(readFileSync(file, "utf-8"));
+                        if (parsed &&
+                            typeof parsed === "object" &&
+                            !Array.isArray(parsed)) {
+                            existing = parsed;
+                        }
+                    }
+                    catch {
+                        // A corrupt file must not be silently replaced — that would
+                        // delete every other member's credential to store one.
+                        process.stderr.write(`[members] ${file} exists but is not readable JSON. Refusing to overwrite it.\n`);
+                        process.exit(2);
+                    }
+                }
+                existing[memberId] = await hashPassword(pw);
+                writeFileSync(file, `${JSON.stringify(existing, null, 2)}\n`, {
+                    mode: 0o600,
+                });
+                // `mode` on writeFileSync only applies at CREATION, so an existing
+                // file keeps its old permissions unless chmod'd explicitly.
+                chmodSync(file, 0o600);
+                process.stdout.write(`[members] password set for ${memberId}.\n`);
+                process.exit(0);
+            }
+            process.stderr.write("Usage: patchwork members <list|set-password <memberId>>\n");
+            process.exit(2);
+        }
+        catch (err) {
+            process.stderr.write(`[members] ${err.message}\n`);
+            process.exit(2);
+        }
+    })();
+}
 // Handle butler subcommand — SHADOW-only errand outcome grading.
 //
 // Operator path, like `outcomes` above and for the same reason: a recipe step