pierre-review 0.1.81 → 0.1.83

package/dist/api/plugins/auth.js

@@ -33,6 +33,7 @@ export function registerAccountContext(app) {
                     plan: 'free',
                     stripeCustomerId: null,
                     aiCreditAllowance: null,
+                    benchmarkOptIn: false,
                 };
         }
     });

package/dist/api/routes/bot-triage.js

@@ -1,5 +1,16 @@
 import { addBotMuteRule, deleteBotMuteRule, getBotAnalytics, getBotVendorPrs, getBotDedupClusters, listBotMuteRules, listDetectedReviewers, resolveScopeRepoIds, setReviewerOverride, } from '../../db/queries.js';
 import { accountIdOf } from '../plugins/auth.js';
+// Parse a comma-separated id list into a positive-int array, or null when empty/absent (so
+// the query layer treats it as "all repos"). Mirrors the parser in activity.ts.
+function parseIntList(raw) {
+    if (raw == null || raw.trim() === '')
+        return null;
+    const ids = raw
+        .split(',')
+        .map((s) => Number.parseInt(s.trim(), 10))
+        .filter((n) => Number.isInteger(n) && n > 0);
+    return ids.length > 0 ? ids : null;
+}
 // PATCH /api/bot-reviewers/:userId — the two-way manual override. `kind`/`label` are left as
 // open strings (nullable) rather than an enum: AutomatedReviewerKind is defined in the
 // types-only shared package the backend can't import at runtime, and the query layer coerces
@@ -34,6 +45,9 @@ const analyticsSchema = {
             },
             // Team scope: 'all' | 'none' | '<teamId>' (see resolveScopeRepoIds). Absent = all.
             scope: { type: 'string' },
+            // Explicit repo scope (comma-separated ids) — the per-repo Bots tab. When present it
+            // WINS over `scope` (a specific repo is the more specific selection).
+            repoIds: { type: 'string' },
         },
     },
 };
@@ -56,6 +70,7 @@ const vendorPrsSchema = {
                 default: 'rolling_14',
             },
             scope: { type: 'string' },
+            repoIds: { type: 'string' },
         },
     },
 };
@@ -116,20 +131,23 @@ export async function botTriageRoutes(app) {
     // untouched + verdict + trend + deterministic tuning suggestions. Cost fields are null here
     // (the client overlays per-vendor cost from Pro settings).
     app.get('/api/bot-analytics', { schema: analyticsSchema }, async (req) => {
-        const { window, scope } = req.query;
+        const { window, scope, repoIds } = req.query;
         const accountId = accountIdOf(req);
-        const repoIds = scope ? await resolveScopeRepoIds(accountId, scope) : null;
-        const resp = await getBotAnalytics(accountId, window, repoIds);
+        // An explicit repoIds list (the per-repo Bots tab) wins over the team scope.
+        const explicit = parseIntList(repoIds);
+        const scopeRepoIds = explicit ?? (scope ? await resolveScopeRepoIds(accountId, scope) : null);
+        const resp = await getBotAnalytics(accountId, window, scopeRepoIds);
         return resp;
     });
     // The per-vendor PR drill-down behind one Bot-ROI row: the PRs that automated reviewer kind
     // touched in the window (threads/comments/acted-on/untouched/bot-only), newest-activity first.
     app.get('/api/bot-analytics/:kind/prs', { schema: vendorPrsSchema }, async (req) => {
         const { kind } = req.params;
-        const { window, scope } = req.query;
+        const { window, scope, repoIds } = req.query;
         const accountId = accountIdOf(req);
-        const repoIds = scope ? await resolveScopeRepoIds(accountId, scope) : null;
-        const resp = await getBotVendorPrs(accountId, kind, window, repoIds);
+        const explicit = parseIntList(repoIds);
+        const scopeRepoIds = explicit ?? (scope ? await resolveScopeRepoIds(accountId, scope) : null);
+        const resp = await getBotVendorPrs(accountId, kind, window, scopeRepoIds);
         return resp;
     });
     // Cross-bot dedup clusters for one PR (≥2 automated reviewers on the same path/line window).

package/dist/api/routes/me.js

@@ -1,5 +1,6 @@
 import { config } from '../../config.js';
-import { accountToLocalUser } from '../../auth/account.js';
+import { accountToLocalUser, setBenchmarkConsent } from '../../auth/account.js';
+import { runBenchmarkRollupForAccount } from '../../sync/benchmark-rollup.js';
 import { accountIdOf } from '../plugins/auth.js';
 import { EMPTY_CAPABILITIES, entitledProCapabilities, } from '../../pro/contract.js';
 import { countNewMyTurnFeedItems } from '../../feed/my-turn.js';
@@ -19,6 +20,14 @@ const dismissSchema = {
         },
     },
 };
+const benchmarkConsentSchema = {
+    body: {
+        type: 'object',
+        required: ['optIn'],
+        additionalProperties: false,
+        properties: { optIn: { type: 'boolean' } },
+    },
+};
 export async function meRoutes(app) {
     app.get('/api/me', async (req) => {
         const accountId = accountIdOf(req);
@@ -52,10 +61,29 @@ export async function meRoutes(app) {
             // Claude Review is now the Pro `claudeReview` capability (in `pro` below).
             deploymentMode: config.deploymentMode,
             pro: entitled,
+            // Cross-org benchmark consent (cloud-only; always false in local). Drives the Settings toggle.
+            benchmarkOptIn: config.isCloud ? req.account?.benchmarkOptIn ?? false : false,
             // Orgs currently SAML-blocked for this account (empty in the normal case + in local).
             authNotices: getAuthNotices(accountId),
         };
     });
+    // Cross-org benchmark consent (CLOUD-ONLY, opt-in). Setting it true seeds the account's
+    // contributions immediately (best-effort, in the background); false withdraws + deletes them
+    // (handled in setBenchmarkConsent). Available to every cloud account — free or paid — because
+    // the network needs volume to be worth anything (viewing the benchmark is the paid part, later).
+    app.post('/api/me/benchmark-consent', { schema: benchmarkConsentSchema }, async (req, reply) => {
+        if (!config.isCloud) {
+            return reply.code(400).send({ error: 'BadRequest', message: 'Benchmark is cloud-only' });
+        }
+        const accountId = accountIdOf(req);
+        const { optIn } = req.body;
+        await setBenchmarkConsent(accountId, optIn);
+        if (optIn) {
+            // Fire-and-forget: don't block the response on the rollup; a failure is logged, not fatal.
+            void runBenchmarkRollupForAccount(accountId, req.log).catch((err) => req.log.error({ err, accountId }, 'benchmark seed after opt-in failed'));
+        }
+        return { status: 'ok', benchmarkOptIn: optIn };
+    });
     app.get('/api/my-turn', async (req) => getMyTurn(accountIdOf(req)));
     app.post('/api/my-turn/dismiss', { schema: dismissSchema }, async (req) => {
         const { kind, refId } = req.body;

package/dist/auth/account.js

@@ -35,6 +35,7 @@ function rowToAccount(row) {
         plan: row.plan === 'pro' ? 'pro' : 'free',
         stripeCustomerId: row.stripeCustomerId,
         aiCreditAllowance: row.aiCreditAllowance ?? null,
+        benchmarkOptIn: row.benchmarkOptIn ?? false,
     };
 }
 // Module cache of the local account, set by ensureLocalAccount() at startup so
@@ -192,6 +193,23 @@ export async function setAccountPlan(accountId, plan, stripeCustomerId) {
         set.stripeCustomerId = stripeCustomerId;
     await db.update(accounts).set(set).where(eq(accounts.id, accountId)).execute();
 }
+/**
+ * Set an account's cross-org benchmark consent (cloud-only feature). Withdrawing (optIn=false)
+ * DELETES the account's contributions — one-click, complete removal, honouring the consent
+ * promise. The caller (the /api/me/benchmark-consent route) seeds contributions on opt-in.
+ */
+export async function setBenchmarkConsent(accountId, optIn) {
+    const { accounts } = schema;
+    await db
+        .update(accounts)
+        .set({ benchmarkOptIn: optIn })
+        .where(eq(accounts.id, accountId))
+        .execute();
+    if (!optIn) {
+        const { deleteBenchmarkContributions } = await import('../db/queries.js');
+        await deleteBenchmarkContributions(accountId);
+    }
+}
 /** Resolve an account by its Stripe customer id (subscription webhooks). */
 export async function getAccountByStripeCustomerId(customerId) {
     const { accounts } = schema;

package/dist/config.js

@@ -133,6 +133,9 @@ export const config = {
     // When the retention sweep runs (node-cron). Daily at 03:00 by default; off-peak so a
     // large delete doesn't contend with the 5-minute sync. RETENTION_CRON overrides.
     retentionCron: process.env.RETENTION_CRON ?? '0 3 * * *',
+    // Cross-org benchmark rollup (CLOUD-ONLY; inert unless an account has opted in). Weekly,
+    // Monday 04:00 UTC — after a fresh ISO week starts, off-peak. BENCHMARK_ROLLUP_CRON overrides.
+    benchmarkRollupCron: process.env.BENCHMARK_ROLLUP_CRON ?? '0 4 * * 1',
     // Disable the periodic scheduler (used by scripts/tests).
     disableScheduler: process.env.DISABLE_SCHEDULER === 'true',
     // ---- Cloud (Railway) — GitHub sign-in + sessions + token encryption ----

package/dist/db/migrations/0032_benchmark_contributions.sql

@@ -0,0 +1,29 @@
+-- Cross-org benchmark network (CORE, cloud-only, opt-in), Phase 0: the opt-in flag on
+-- accounts + the aggregate-only weekly contributions table. See schema.sqlite.ts for the
+-- full rationale (no PII, in_house/pierre excluded, written only by the firewalled rollup).
+-- The Postgres baseline is maintained separately (migrations-pg/0019_*).
+ALTER TABLE `accounts` ADD `benchmark_opt_in` integer DEFAULT false NOT NULL;
+--> statement-breakpoint
+CREATE TABLE `benchmark_contributions` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`vendor_kind` text NOT NULL,
+	`week_start` integer NOT NULL,
+	`threads` integer DEFAULT 0 NOT NULL,
+	`comments` integer DEFAULT 0 NOT NULL,
+	`acted_on` integer DEFAULT 0 NOT NULL,
+	`untouched` integer DEFAULT 0 NOT NULL,
+	`human_follow` integer DEFAULT 0 NOT NULL,
+	`oldest_untouched_days` integer,
+	`org_size_bucket` text NOT NULL,
+	`ml_metrics` text,
+	`schema_version` integer DEFAULT 1 NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `bench_contrib_uniq` ON `benchmark_contributions` (`account_id`,`vendor_kind`,`week_start`);
+--> statement-breakpoint
+CREATE INDEX `bench_contrib_account_idx` ON `benchmark_contributions` (`account_id`);
+--> statement-breakpoint
+CREATE INDEX `bench_contrib_cohort_idx` ON `benchmark_contributions` (`vendor_kind`,`week_start`);

package/dist/db/migrations/meta/_journal.json

@@ -225,6 +225,13 @@
       "when": 1783820880004,
       "tag": "0031_events_pr_idx",
       "breakpoints": true
+    },
+    {
+      "idx": 32,
+      "version": "6",
+      "when": 1783820880005,
+      "tag": "0032_benchmark_contributions",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/migrations-pg/0019_benchmark_contributions.sql

@@ -0,0 +1,22 @@
+ALTER TABLE "accounts" ADD COLUMN "benchmark_opt_in" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+CREATE TABLE "benchmark_contributions" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL,
+	"vendor_kind" text NOT NULL,
+	"week_start" timestamp with time zone NOT NULL,
+	"threads" integer DEFAULT 0 NOT NULL,
+	"comments" integer DEFAULT 0 NOT NULL,
+	"acted_on" integer DEFAULT 0 NOT NULL,
+	"untouched" integer DEFAULT 0 NOT NULL,
+	"human_follow" integer DEFAULT 0 NOT NULL,
+	"oldest_untouched_days" integer,
+	"org_size_bucket" text NOT NULL,
+	"ml_metrics" text,
+	"schema_version" integer DEFAULT 1 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "benchmark_contributions" ADD CONSTRAINT "benchmark_contributions_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "public"."accounts"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "bench_contrib_uniq" ON "benchmark_contributions" USING btree ("account_id","vendor_kind","week_start");--> statement-breakpoint
+CREATE INDEX "bench_contrib_account_idx" ON "benchmark_contributions" USING btree ("account_id");--> statement-breakpoint
+CREATE INDEX "bench_contrib_cohort_idx" ON "benchmark_contributions" USING btree ("vendor_kind","week_start");

package/dist/db/migrations-pg/meta/_journal.json

@@ -134,6 +134,13 @@
       "when": 1784032874644,
       "tag": "0018_fancy_miss_america",
       "breakpoints": true
+    },
+    {
+      "idx": 19,
+      "version": "7",
+      "when": 1784032874645,
+      "tag": "0019_benchmark_contributions",
+      "breakpoints": true
     }
   ]
-}
+}

package/dist/db/queries.js

@@ -30,7 +30,7 @@ import { fingerprintReview } from '../sync/review-fingerprint.js';
 // timestamptz (drizzle binds the Date through the codec), whereas SQLite columns
 // are integer unix-epoch seconds (`mode:'timestamp'`), so we hand it the int.
 const tsBound = (d) => isPg ? d : Math.floor(d.getTime() / 1000);
-const { accounts, repos, users, pullRequests, reviewRequests, reviewThreads, reviewComments, prComments, reviews, commits, commitFiles, events, syncState, prViews, myTurnDismissals, claudeReviews, claudeReviewFindings, ciStatusEvents, botReviewClassification, botMuteRules, teams, teamRepos, } = schema;
+const { accounts, repos, users, pullRequests, reviewRequests, reviewThreads, reviewComments, prComments, reviews, commits, commitFiles, events, syncState, prViews, myTurnDismissals, claudeReviews, claudeReviewFindings, ciStatusEvents, botReviewClassification, botMuteRules, teams, teamRepos, benchmarkContributions, } = schema;
 function iso(d) {
     return d ? d.toISOString() : null;
 }
@@ -5826,6 +5826,230 @@ scopeRepoIds) {
     };
     return { enabled: true, generatedAt, window: win, vendors, totals, suggestions };
 }
+// UTC Monday 00:00 of the ISO week containing `d`.
+export function isoWeekStartUtc(d) {
+    const t = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()));
+    const backToMonday = (t.getUTCDay() + 6) % 7; // getUTCDay: 0=Sun..6=Sat
+    t.setUTCDate(t.getUTCDate() - backToMonday);
+    return t;
+}
+// Contributor-size covariate bucket from a distinct active-author count.
+export function orgSizeBucket(contributors) {
+    if (contributors <= 1)
+        return '1';
+    if (contributors <= 5)
+        return '2-5';
+    if (contributors <= 20)
+        return '6-20';
+    if (contributors <= 50)
+        return '21-50';
+    if (contributors <= 200)
+        return '51-200';
+    return '200+';
+}
+// Distinct PR authors across the account's repos over the last `days` — the org-size proxy
+// (the covariate a cohort conditions on). accountId-scoped.
+export async function getAccountContributorCount(accountId, days = 90) {
+    const since = new Date(Date.now() - days * 86_400_000);
+    const rows = await db
+        .selectDistinct({ id: pullRequests.authorId })
+        .from(pullRequests)
+        .where(and(eq(pullRequests.accountId, accountId), gte(pullRequests.openedAt, since)))
+        .execute();
+    return rows.filter((r) => r.id != null).length;
+}
+// Accounts that have consented to contribute (cloud-only; local never contributes). The rollup
+// loops these. NOT a cross-tenant read of tenant data — just the consent roster.
+export async function getBenchmarkOptedInAccountIds() {
+    const rows = await db
+        .select({ id: accounts.id })
+        .from(accounts)
+        .where(and(eq(accounts.benchmarkOptIn, true), eq(accounts.isLocal, false)))
+        .execute();
+    return rows.map((r) => r.id);
+}
+// Weekly per-known-vendor benchmark aggregates for ONE account over [from, to).
+export async function getBenchmarkContributions(accountId, from, to) {
+    const automatedIds = await automatedReviewerUserIds(accountId);
+    if (automatedIds.length === 0)
+        return [];
+    const kindMap = await classificationKindForUser(accountId);
+    const nowMs = Date.now();
+    // Only KNOWN vendors are comparable across orgs — skip in_house/pierre/unclassified.
+    const vendorKindOf = (userId) => {
+        const k = kindMap.get(userId);
+        if (!k || k === 'in_house' || k === 'pierre')
+            return null;
+        return k;
+    };
+    const acc = new Map();
+    const bucketFor = (vendorKind, at) => {
+        const weekMs = isoWeekStartUtc(at).getTime();
+        const key = `${vendorKind}${weekMs}`;
+        let a = acc.get(key);
+        if (!a) {
+            a = {
+                vendorKind,
+                weekMs,
+                threads: 0,
+                comments: 0,
+                actedOn: 0,
+                untouched: 0,
+                humanFollow: 0,
+                oldestUntouchedMs: null,
+            };
+            acc.set(key, a);
+        }
+        return a;
+    };
+    // Threads opened by an automated reviewer in [from, to).
+    const threadRows = await db
+        .select({
+        id: reviewThreads.id,
+        userId: reviewThreads.originalCommenterId,
+        state: reviewThreads.derivedState,
+        createdAt: reviewThreads.createdAt,
+    })
+        .from(reviewThreads)
+        .innerJoin(pullRequests, eq(pullRequests.id, reviewThreads.prId))
+        .where(and(eq(pullRequests.accountId, accountId), inArray(reviewThreads.originalCommenterId, automatedIds), gte(reviewThreads.createdAt, from), lt(reviewThreads.createdAt, to)))
+        .execute();
+    // Pass 1: volume / untouched / oldest-untouched per (vendor, week); remember each thread's
+    // bucket + base-acted for the merged acted-on definition below.
+    const windowThreads = [];
+    for (const t of threadRows) {
+        if (t.userId == null)
+            continue;
+        const kind = vendorKindOf(t.userId);
+        if (!kind)
+            continue;
+        const bucket = bucketFor(kind, t.createdAt);
+        bucket.threads += 1;
+        const baseActed = t.state === 'resolved' || t.state === 'likely_addressed';
+        if (t.state === 'untouched') {
+            bucket.untouched += 1;
+            const ms = t.createdAt.getTime();
+            if (bucket.oldestUntouchedMs == null || ms < bucket.oldestUntouchedMs) {
+                bucket.oldestUntouchedMs = ms;
+            }
+        }
+        windowThreads.push({ id: t.id, bucket, baseActed });
+    }
+    // Pass 2: human follow-through — a human commented after the bot's last comment on the thread.
+    const wtIds = windowThreads.map((w) => w.id);
+    const humanFollow = new Set();
+    if (wtIds.length > 0) {
+        const ftRows = await db
+            .select({
+            threadId: reviewComments.threadId,
+            authorId: reviewComments.authorId,
+            createdAt: reviewComments.createdAt,
+        })
+            .from(reviewComments)
+            .where(inArray(reviewComments.threadId, wtIds))
+            .execute();
+        const byThread = new Map();
+        for (const r of ftRows) {
+            const arr = byThread.get(r.threadId) ?? [];
+            arr.push({ authorId: r.authorId, at: r.createdAt.getTime() });
+            byThread.set(r.threadId, arr);
+        }
+        const autoSet = new Set(automatedIds);
+        for (const [threadId, comments] of byThread) {
+            let botLastAt = -Infinity;
+            for (const c of comments) {
+                if (c.authorId != null && autoSet.has(c.authorId) && c.at > botLastAt)
+                    botLastAt = c.at;
+            }
+            if (comments.some((c) => c.authorId != null && !autoSet.has(c.authorId) && c.at > botLastAt)) {
+                humanFollow.add(threadId);
+            }
+        }
+    }
+    for (const w of windowThreads) {
+        if (humanFollow.has(w.id))
+            w.bucket.humanFollow += 1;
+        if (w.baseActed || humanFollow.has(w.id))
+            w.bucket.actedOn += 1;
+    }
+    // Comments authored by an automated reviewer in [from, to), per (vendor, week).
+    const commentRows = await db
+        .select({
+        authorId: reviewComments.authorId,
+        createdAt: reviewComments.createdAt,
+    })
+        .from(reviewComments)
+        .innerJoin(pullRequests, eq(pullRequests.id, reviewComments.prId))
+        .where(and(eq(pullRequests.accountId, accountId), inArray(reviewComments.authorId, automatedIds), gte(reviewComments.createdAt, from), lt(reviewComments.createdAt, to)))
+        .execute();
+    for (const c of commentRows) {
+        if (c.authorId == null)
+            continue;
+        const kind = vendorKindOf(c.authorId);
+        if (!kind)
+            continue;
+        bucketFor(kind, c.createdAt).comments += 1;
+    }
+    return [...acc.values()]
+        .filter((a) => a.threads > 0 || a.comments > 0)
+        .map((a) => ({
+        vendorKind: a.vendorKind,
+        weekStart: new Date(a.weekMs),
+        threads: a.threads,
+        comments: a.comments,
+        actedOn: a.actedOn,
+        untouched: a.untouched,
+        humanFollow: a.humanFollow,
+        oldestUntouchedDays: a.oldestUntouchedMs == null
+            ? null
+            : Math.floor((nowMs - a.oldestUntouchedMs) / 86_400_000),
+    }));
+}
+// Idempotent upsert of an account's weekly contributions (one row per vendor+week). The
+// org-size bucket is the account's size at contribution time (denormalized per row).
+export async function upsertBenchmarkContributions(accountId, sizeBucket, rows) {
+    for (const r of rows) {
+        await db
+            .insert(benchmarkContributions)
+            .values({
+            accountId,
+            vendorKind: r.vendorKind,
+            weekStart: r.weekStart,
+            threads: r.threads,
+            comments: r.comments,
+            actedOn: r.actedOn,
+            untouched: r.untouched,
+            humanFollow: r.humanFollow,
+            oldestUntouchedDays: r.oldestUntouchedDays,
+            orgSizeBucket: sizeBucket,
+            schemaVersion: 1,
+        })
+            .onConflictDoUpdate({
+            target: [
+                benchmarkContributions.accountId,
+                benchmarkContributions.vendorKind,
+                benchmarkContributions.weekStart,
+            ],
+            set: {
+                threads: r.threads,
+                comments: r.comments,
+                actedOn: r.actedOn,
+                untouched: r.untouched,
+                humanFollow: r.humanFollow,
+                oldestUntouchedDays: r.oldestUntouchedDays,
+                orgSizeBucket: sizeBucket,
+            },
+        })
+            .execute();
+    }
+}
+// Withdraw consent → delete the account's contributions (one-click, complete removal).
+export async function deleteBenchmarkContributions(accountId) {
+    await db
+        .delete(benchmarkContributions)
+        .where(eq(benchmarkContributions.accountId, accountId))
+        .execute();
+}
 // Item 7 — the per-PR drill-down behind a vendor's Bot-ROI row (GET /api/bot-analytics/:kind/prs).
 // Lists the PRs one automated reviewer KIND touched in the window (its review threads + comments),
 // with per-PR volume, the merged "acted-on" count (item 6: resolved | likely_addressed | a human

package/dist/db/schema.pg.js

@@ -45,6 +45,9 @@ export const accounts = pgTable('accounts', {
     // plan default (2,500 for paid cloud); local/unlimited accounts ignore it. See the sqlite
     // twin. Kept in sync by hand (schema-parity.test.ts).
     aiCreditAllowance: integer('ai_credit_allowance'),
+    // CLOUD-ONLY, opt-in (default OFF): contribute de-identified aggregate weekly review-bot
+    // outcome stats to the cross-org benchmark network. See the sqlite twin + benchmarkContributions.
+    benchmarkOptIn: boolean('benchmark_opt_in').notNull().default(false),
 });
 export const repos = pgTable('repos', {
     id: serial('id').primaryKey(),
@@ -560,4 +563,31 @@ export const teamRepos = pgTable('team_repos', {
     accountIdx: index('team_repos_account_idx').on(t.accountId),
     repoIdx: index('team_repos_repo_idx').on(t.repoId),
 }));
+// ── Cross-org benchmark network (CORE, cloud-only, opt-in) ── the pg twin of the sqlite
+// benchmarkContributions table. See that file for the full rationale (aggregate-only, no PII,
+// in_house/pierre excluded, written only by the firewalled weekly rollup; serving is Phase 1).
+export const benchmarkContributions = pgTable('benchmark_contributions', {
+    id: serial('id').primaryKey(),
+    accountId: integer('account_id')
+        .notNull()
+        .references(() => accounts.id, { onDelete: 'cascade' }),
+    vendorKind: text('vendor_kind').notNull(),
+    weekStart: timestamp('week_start', { withTimezone: true, mode: 'date' }).notNull(),
+    threads: integer('threads').notNull().default(0),
+    comments: integer('comments').notNull().default(0),
+    actedOn: integer('acted_on').notNull().default(0),
+    untouched: integer('untouched').notNull().default(0),
+    humanFollow: integer('human_follow').notNull().default(0),
+    oldestUntouchedDays: integer('oldest_untouched_days'),
+    orgSizeBucket: text('org_size_bucket').notNull(),
+    mlMetrics: text('ml_metrics'),
+    schemaVersion: integer('schema_version').notNull().default(1),
+    createdAt: timestamp('created_at', { withTimezone: true, mode: 'date' })
+        .notNull()
+        .defaultNow(),
+}, (t) => ({
+    uniq: uniqueIndex('bench_contrib_uniq').on(t.accountId, t.vendorKind, t.weekStart),
+    accountIdx: index('bench_contrib_account_idx').on(t.accountId),
+    cohortIdx: index('bench_contrib_cohort_idx').on(t.vendorKind, t.weekStart),
+}));
 //# sourceMappingURL=schema.pg.js.map

package/dist/db/schema.sqlite.js

@@ -57,6 +57,12 @@ export const accounts = sqliteTable('accounts', {
     // use the plan default (2,500 for a paid cloud account); local/unlimited accounts ignore
     // it entirely. A forward hook for top-ups / alternate plans without another migration.
     aiCreditAllowance: integer('ai_credit_allowance'),
+    // CLOUD-ONLY, opt-in (default OFF): whether this account contributes de-identified,
+    // aggregate weekly review-bot outcome stats to the cross-org benchmark network (see
+    // `benchmarkContributions`). Consent is a distinct PURPOSE from running the dashboard,
+    // so it must be explicit + reversible; withdrawing (set false) deletes the account's
+    // contributions. Local accounts never contribute (never phone home) — always false.
+    benchmarkOptIn: integer('benchmark_opt_in', { mode: 'boolean' }).notNull().default(false),
 });
 export const repos = sqliteTable('repos', {
     id: integer('id').primaryKey({ autoIncrement: true }),
@@ -637,4 +643,52 @@ export const teamRepos = sqliteTable('team_repos', {
     accountIdx: index('team_repos_account_idx').on(t.accountId),
     repoIdx: index('team_repos_repo_idx').on(t.repoId),
 }));
+// ── Cross-org benchmark network (CORE, cloud-only, opt-in) ──────────────────────────────
+// Phase 0 of the neutral review-bot benchmark: de-identified, AGGREGATE-ONLY weekly outcome
+// stats per known vendor, contributed by opted-in cloud accounts (see accounts.benchmarkOptIn),
+// so a later paid feature can show "your CodeRabbit is 38% acted-on vs a 45% peer median".
+// NO raw text / logins / repo names / PR titles ever land here — counts only. `in_house` /
+// `pierre` are EXCLUDED at collection (not comparable across orgs / identifying). Written ONLY
+// by the firewalled weekly rollup (sync/benchmark-rollup.ts) from each account's OWN data, so
+// collection stays accountId-scoped; the CROSS-account read is the future serving job (Phase 1),
+// which applies k-anonymity (K>=5). Serving (percentiles/cohorts) lives in the Pro plugin later.
+export const benchmarkContributions = sqliteTable('benchmark_contributions', {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    accountId: integer('account_id')
+        .notNull()
+        .references(() => accounts.id, { onDelete: 'cascade' }),
+    // A known review-bot vendor kind (shared ReviewBotKind). Never in_house/pierre.
+    vendorKind: text('vendor_kind').notNull(),
+    // ISO-week start (UTC Monday 00:00) the aggregates cover.
+    weekStart: integer('week_start', { mode: 'timestamp' }).notNull(),
+    // Deterministic weekly outcome aggregates — counts only.
+    threads: integer('threads').notNull().default(0),
+    comments: integer('comments').notNull().default(0),
+    // "acted-on" = resolved | likely_addressed | a human replied after the bot (the same
+    // heuristic the ROI panel uses; approximate — the UI says so).
+    actedOn: integer('acted_on').notNull().default(0),
+    untouched: integer('untouched').notNull().default(0),
+    humanFollow: integer('human_follow').notNull().default(0),
+    // Oldest still-untouched thread age (days) in the week; null when none untouched.
+    oldestUntouchedDays: integer('oldest_untouched_days'),
+    // Covariate: the account's active-contributor size bucket at contribution time
+    // ('1' | '2-5' | '6-20' | '21-50' | '51-200' | '200+'), so cohorts can condition on size.
+    orgSizeBucket: text('org_size_bucket').notNull(),
+    // RESERVED for FUTURE ML-derived aggregate distributions (category mix / severity mix /
+    // precision-by-category) — populated by the SAME rollup once the classifier ships, still
+    // aggregate-only JSON. Null in Phase 0. Forward hook so ML enrichment needs no new migration.
+    mlMetrics: text('ml_metrics'),
+    // Contribution-format version so the row shape can evolve unambiguously.
+    schemaVersion: integer('schema_version').notNull().default(1),
+    createdAt: integer('created_at', { mode: 'timestamp' })
+        .notNull()
+        .default(sql `(unixepoch())`),
+}, (t) => ({
+    // One row per (account, vendor, week) — the idempotent upsert target. accountId-first so
+    // uniqueness is per-tenant (two accounts contribute the same vendor+week independently).
+    uniq: uniqueIndex('bench_contrib_uniq').on(t.accountId, t.vendorKind, t.weekStart),
+    accountIdx: index('bench_contrib_account_idx').on(t.accountId),
+    // Serving-side cohort scans (Phase 1): all accounts' rows for a vendor across weeks.
+    cohortIdx: index('bench_contrib_cohort_idx').on(t.vendorKind, t.weekStart),
+}));
 //# sourceMappingURL=schema.sqlite.js.map

package/dist/sync/benchmark-rollup.js

@@ -0,0 +1,50 @@
+import { config } from '../config.js';
+import { getAccountContributorCount, getBenchmarkContributions, getBenchmarkOptedInAccountIds, isoWeekStartUtc, orgSizeBucket, upsertBenchmarkContributions, } from '../db/queries.js';
+// Cross-org benchmark rollup (CORE, CLOUD-ONLY, Phase 0). For each account that has CONSENTED
+// (accounts.benchmark_opt_in; local accounts never contribute) it computes de-identified,
+// AGGREGATE-ONLY weekly review-bot outcome stats over the last N complete ISO weeks and upserts
+// them into benchmark_contributions. Idempotent + self-healing: re-processing the same weeks
+// overwrites (so a missed run just backfills on the next). Each iteration reads only that
+// account's OWN data — collection stays accountId-scoped; the cross-account read is the future
+// serving job (Phase 1). Errors are caught per-account so one bad tenant can't abort the sweep.
+const ROLLUP_WEEKS = 12;
+async function rollupAccounts(accountIds, log) {
+    if (accountIds.length === 0)
+        return;
+    // Upper bound = start of the CURRENT (in-progress) week, so we only ever contribute COMPLETE
+    // weeks (an in-progress week's counts would keep changing).
+    const to = isoWeekStartUtc(new Date());
+    const from = new Date(to.getTime() - ROLLUP_WEEKS * 7 * 86_400_000);
+    for (const accountId of accountIds) {
+        try {
+            const rows = await getBenchmarkContributions(accountId, from, to);
+            if (rows.length === 0)
+                continue;
+            const size = orgSizeBucket(await getAccountContributorCount(accountId));
+            await upsertBenchmarkContributions(accountId, size, rows);
+            log.info({ accountId, weeks: ROLLUP_WEEKS, rows: rows.length }, 'benchmark contributions rolled up');
+        }
+        catch (err) {
+            log.error({ err, accountId }, 'benchmark rollup failed for account');
+        }
+    }
+}
+// The scheduled sweep: all opted-in cloud accounts. Inert (returns early) in local mode, when
+// scheduling is disabled, or when nobody has opted in.
+export async function runBenchmarkRollup(log) {
+    if (!config.isCloud || config.disableScheduler)
+        return;
+    await rollupAccounts(await getBenchmarkOptedInAccountIds(), log);
+}
+// Immediate per-account seeding, fired (best-effort) right after an account opts in so the
+// benchmark reflects them without waiting for the weekly cron. Re-checks opt-in (from the
+// consent roster) so it can't contribute for an account that isn't opted in.
+export async function runBenchmarkRollupForAccount(accountId, log) {
+    if (!config.isCloud)
+        return;
+    const optedIn = await getBenchmarkOptedInAccountIds();
+    if (!optedIn.includes(accountId))
+        return;
+    await rollupAccounts([accountId], log);
+}
+//# sourceMappingURL=benchmark-rollup.js.map