plumbbob 0.9.3 → 0.9.5

package/node_modules/checkride/dist/triage/triage.js

@@ -0,0 +1,131 @@
+/**
+ * Assembling the triage report — everything the skill reasons over, and nothing
+ * it would have to open a file to learn.
+ *
+ * The shape is deliberately a *model*, not text: the run's provenance, one row
+ * per slot with its raw output located and sized, what the run did and did not
+ * cover, and the traps (vacuous green, narrow green, baselined findings, stale
+ * artifacts) each surfaced as its own field. Rendering is `./render.ts`'s job.
+ *
+ * Two facts drive almost all of it. First, the summary is an index, not
+ * evidence: it is overwritten by every run, so triage runs the gate itself and
+ * then checks that the summary on disk is the one that run wrote. Second, sizes
+ * are the product: `mutation.json` is 2.3 MB in this repo, and a reader that
+ * reports contents instead of bytes has spent the context it exists to save.
+ */
+import { join } from 'node:path';
+import { CHECK_DIR, configuredSlots, listArtifacts, readSummary, resolveRawOutput, runWindowStart, statArtifact } from '../artifacts/index.js';
+import { DIGEST_FILE } from '../digest/index.js';
+import { foldDoctor } from './doctor-fold.js';
+import { isHarnessProblem, runGate } from './gate.js';
+/**
+ * mtime can be second-granular on older filesystems, so a summary written a
+ * moment after the gate started could otherwise read as older than it. The
+ * tolerance is far smaller than any real gate run, so it cannot launder a
+ * genuinely stale summary into a fresh one.
+ */
+const MTIME_TOLERANCE_MS = 1000;
+function statusOf(check) {
+    if (check.skipped === true)
+        return 'skipped';
+    return check.ok ? 'pass' : 'fail';
+}
+async function buildRow(checkDir, check, windowStart) {
+    // A skipped slot produced no output; any file under its name is a leftover
+    // from an earlier run, and offering it would be the stale read this module
+    // exists to prevent.
+    const raw = check.skipped === true ? null : await resolveRawOutput(checkDir, check.name, check.output_file, windowStart);
+    return {
+        slot: check.name,
+        adapter: check.adapter,
+        status: statusOf(check),
+        exitCode: check.exit_code,
+        durationMs: check.duration_ms,
+        baselined: check.baselined ?? null,
+        reason: check.reason ?? null,
+        raw,
+    };
+}
+function buildCoverage(cwd, rows) {
+    const configured = configuredSlots(cwd);
+    const present = new Set(rows.map((r) => r.slot));
+    return {
+        ran: rows.filter((r) => r.status !== 'skipped').map((r) => r.slot),
+        skipped: rows.filter((r) => r.status === 'skipped').map((r) => r.slot),
+        configured,
+        uncovered: (configured ?? []).filter((slot) => !present.has(slot)),
+    };
+}
+/** Whether the summary on disk is the one the gate just wrote. */
+function writtenByThisRun(summary, gate) {
+    if (summary.state === 'missing' || summary.state === 'unreadable')
+        return null;
+    if (gate.verdict === 'not-run')
+        return null;
+    return summary.mtimeMs >= gate.startedMs - MTIME_TOLERANCE_MS;
+}
+/** Every stale file the run measured, deduped — a stale read is the classic wrong answer. */
+function collectStale(rows, digest) {
+    const measured = [...rows.flatMap((r) => r.raw?.candidates ?? []), ...(digest ? [digest] : [])];
+    const stale = new Map();
+    for (const file of measured) {
+        if (file.freshness.state === 'stale')
+            stale.set(file.path, file);
+    }
+    return [...stale.values()];
+}
+/**
+ * When the summary is gone, an anchor for judging what in `.check/` is a
+ * leftover. The contract window comes from the summary's own `timestamp`, so an
+ * unparseable summary leaves none — but the reader *ran the gate* and knows
+ * when it started, which is a strictly better anchor than giving up and
+ * labelling every file `?`. Not applied to the parsed path, where the
+ * documented derivation in `../artifacts/freshness.ts` is the contract.
+ */
+function gateAnchor(gate) {
+    return gate.verdict === 'not-run' ? null : gate.startedMs - MTIME_TOLERANCE_MS;
+}
+/** Read everything the run left behind, measuring and never opening. */
+async function readArtifacts(cwd, gate) {
+    const checkDir = join(cwd, CHECK_DIR);
+    const summary = await readSummary(cwd);
+    const parsed = summary.state === 'ok';
+    const windowStart = parsed ? runWindowStart(summary.summary) : null;
+    const anchor = parsed ? windowStart : gateAnchor(gate);
+    const checks = summary.state === 'ok' ? summary.summary.checks : [];
+    const [rows, digest, listing] = await Promise.all([
+        Promise.all(checks.map((check) => buildRow(checkDir, check, windowStart))),
+        statArtifact(checkDir, DIGEST_FILE, anchor),
+        parsed ? Promise.resolve(null) : listArtifacts(checkDir, anchor),
+    ]);
+    return { summary, windowStart, rows, digest, checkDir: listing };
+}
+function isVacuous(summary) {
+    return summary.state === 'ok' && summary.summary.ok && summary.summary.checks_run === 0;
+}
+/**
+ * Run the gate, then read what it wrote. On the broken-harness branch `doctor`
+ * is folded in first, because there the environment is the finding and the
+ * slot table is not evidence of anything.
+ */
+export async function triage(cwd, env) {
+    const gate = await runGate(cwd, env);
+    const doctor = isHarnessProblem(gate.verdict) ? await foldDoctor(cwd, env) : null;
+    const { summary, windowStart, rows, digest, checkDir } = await readArtifacts(cwd, gate);
+    return {
+        cwd,
+        gate,
+        doctor,
+        summary,
+        fromThisRun: writtenByThisRun(summary, gate),
+        windowStart,
+        rows,
+        failing: rows.filter((r) => r.status === 'fail'),
+        coverage: buildCoverage(cwd, rows),
+        vacuous: isVacuous(summary),
+        digest,
+        stale: collectStale(rows, digest),
+        checkDir,
+    };
+}
+//# sourceMappingURL=triage.js.map

package/node_modules/checkride/dist/triage/triage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage.js","sourceRoot":"","sources":["../../src/triage/triage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC/I,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+DtD;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,SAAS,QAAQ,CAAC,KAAmB;IACnC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,KAAmB,EAAE,WAA0B;IACvF,2EAA2E;IAC3E,2EAA2E;IAC3E,qBAAqB;IACrB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACzH,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,KAAK,CAAC,WAAW;QAC7B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,IAAwB;IAC1D,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,UAAU;QACV,SAAS,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,SAAS,gBAAgB,CAAC,OAAoB,EAAE,IAAiB;IAC/D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC;AAChE,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,IAAwB,EAAE,MAA2B;IACzE,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAUD;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAiB;IACnC,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC;AACjF,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,IAAiB;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAA4B,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1E,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC;KACjE,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,OAAoB;IACrC,OAAO,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,GAAc;IACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxF,OAAO;QACL,GAAG;QACH,IAAI;QACJ,MAAM;QACN,OAAO;QACP,WAAW,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC;QAC5C,WAAW;QACX,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAChD,QAAQ,EAAE,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC;QAClC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC;QAC3B,MAAM;QACN,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QACjC,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/node_modules/checkride/package.json

@@ -1,14 +1,14 @@
 {
   "name": "checkride",
-  "version": "0.5.2",
-  "description": "An agent harness for TypeScript repositories: one command that is the definition of done, plus mechanically enforced module boundaries.",
-  "license": "MIT",
+  "version": "0.10.2",
+  "description": "An agent harness for code repositories: one command that is the definition of done, plus mechanically enforced module boundaries. TypeScript-first, not TypeScript-only.",
+  "license": "Apache-2.0",
   "author": "Rob McLarty",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/robmclarty/checkride.git"
   },
-  "homepage": "https://github.com/robmclarty/checkride#readme",
+  "homepage": "https://robmclarty.github.io/checkride/",
   "bugs": "https://github.com/robmclarty/checkride/issues",
   "type": "module",
   "keywords": [
@@ -40,6 +40,8 @@
     "dist",
     "templates",
     "schema",
+    ".claude-plugin",
+    "skills",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
@@ -62,20 +64,20 @@
     "prepublishOnly": "tsc --build && vitest run"
   },
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.4",
-    "@ast-grep/cli": "0.42.1",
+    "@arethetypeswrong/cli": "0.18.5",
+    "@ast-grep/cli": "0.45.0",
     "@stryker-mutator/core": "9.6.1",
     "@stryker-mutator/vitest-runner": "9.6.1",
-    "@types/node": "22.20.0",
-    "@vitest/coverage-v8": "4.1.5",
+    "@types/node": "22.20.1",
+    "@vitest/coverage-v8": "4.1.10",
     "ajv": "8.20.0",
-    "cspell": "10.0.0",
-    "fallow": "3.5.0",
-    "markdownlint-cli2": "0.22.1",
-    "oxlint": "1.61.0",
-    "oxlint-tsgolint": "0.21.1",
-    "publint": "0.3.21",
+    "cspell": "10.0.1",
+    "fallow": "3.9.1",
+    "markdownlint-cli2": "0.23.1",
+    "oxlint": "1.74.0",
+    "oxlint-tsgolint": "0.25.0",
+    "publint": "0.3.22",
     "typescript": "6.0.3",
-    "vitest": "4.1.5"
+    "vitest": "4.1.10"
   }
 }

package/node_modules/checkride/schema/checkride.config.schema.json

@@ -10,6 +10,7 @@
       "type": "string",
       "description": "URL of this JSON Schema, for editor validation and autocompletion."
     },
+    "note": { "$ref": "#/definitions/note" },
     "extends": {
       "description": "Preset(s) to inherit — a file path (./base.json) or package specifier (@acme/preset), or an array of them. Bases merge left-to-right and the local config wins over all; objects deep-merge, arrays and scalars replace (arrays are not concatenated).",
       "oneOf": [
@@ -22,15 +23,41 @@
       "minimum": 0,
       "description": "Default per-check timeout in seconds. Unset, checks fall back to the built-in 600s cap; 0 here or on a check disables the cap."
     },
+    "gate": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "What the agent stop-gate runs, when the full check is too slow to pay for on every turn. The gate then reports the profile in its verdict, so a narrowed green is never mistaken for a full one — keep the full check binding somewhere else (a commit hook, CI).",
+      "properties": {
+        "note": { "$ref": "#/definitions/note" },
+        "only": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Run only these slots in the gate."
+        },
+        "skip": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Run everything but these slots in the gate."
+        },
+        "changed": {
+          "type": "boolean",
+          "description": "Affected-only mode for the gate, as --changed."
+        }
+      }
+    },
     "checks": {
       "type": "object",
-      "description": "Per-slot configuration. A key that matches a catalogue slot (types, format, lint, struct, dead, dupes, health, test, docs, links, spell, mutation, security, publint, attw) configures that slot; any other key is a custom check that runs alongside the catalogue. Naming an opt-in slot (format, dupes, health, mutation, security, publint, attw) here also opts it into the default run.",
+      "description": "Per-slot configuration. A key that matches a catalogue slot (types, format, lint, struct, dead, dupes, health, test, docs, links, spell, mutation, security, publint, attw) configures that slot; any other key is a custom check that runs alongside the catalogue. Naming an opt-in slot (format, dupes, health, mutation, security, publint, attw) here also opts it into the default run — set optIn:true on the entry to configure it without opting in (run it only with --all/--include).",
       "additionalProperties": {
         "$ref": "#/definitions/slotConfig"
       }
     }
   },
   "definitions": {
+    "note": {
+      "type": "string",
+      "description": "Internal documentation for whoever reads this config next. Never rendered in the CLI output or written to .check/summary.json — use description for the user-facing text a run prints beside the check."
+    },
     "slotConfig": {
       "description": "How to fill a slot: an adapter name, false to disable it, an adapter with overrides, or a custom check.",
       "oneOf": [
@@ -58,12 +85,34 @@
         },
         "command": { "type": "string" },
         "args": { "type": "array", "items": { "type": "string" } },
-        "description": { "type": "string" },
+        "description": {
+          "type": "string",
+          "description": "User-facing text rendered beside this check in the CLI output. For maintainer commentary that should not render, use note."
+        },
+        "note": { "$ref": "#/definitions/note" },
         "outputFile": { "type": ["string", "null"] },
         "changedArgs": { "type": "array", "items": { "type": "string" } },
         "fixArgs": { "type": "array", "items": { "type": "string" } },
         "timeout": { "type": "number", "minimum": 0 },
-        "order": { "$ref": "#/definitions/order" }
+        "order": { "$ref": "#/definitions/order" },
+        "optIn": {
+          "type": "boolean",
+          "description": "Override the slot's opt-in status. true configures the slot without opting it into the default run (reach it with --all/--include); false forces it into the default run."
+        },
+        "exclude": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Links slot only: extra directory names to skip while walking for markdown, on top of the built-in exclude set (e.g. docs, research, .ridgeline)."
+        },
+        "allowlist": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Links slot only: regex sources for link targets to treat as always valid (deliberately illustrative links that never resolve on disk)."
+        },
+        "profile": {
+          "type": "string",
+          "description": "attw slot only: append --profile <name> (e.g. esm-only) to the attw invocation — a shortcut for retyping the full args."
+        }
       }
     },
     "order": {
@@ -84,7 +133,11 @@
           "description": "Executable to spawn."
         },
         "args": { "type": "array", "items": { "type": "string" } },
-        "description": { "type": "string" },
+        "description": {
+          "type": "string",
+          "description": "User-facing text rendered beside this check in the CLI output. For maintainer commentary that should not render, use note."
+        },
+        "note": { "$ref": "#/definitions/note" },
         "outputFile": { "type": ["string", "null"] },
         "changedArgs": { "type": "array", "items": { "type": "string" } },
         "fixArgs": { "type": "array", "items": { "type": "string" } },
@@ -95,7 +148,11 @@
           "items": { "type": "string" },
           "description": "Marker files that gate a non-catalogue custom check: it runs only when at least one listed file exists, and is skipped otherwise. Ignored on an entry that fills a catalogue slot."
         },
-        "order": { "$ref": "#/definitions/order" }
+        "order": { "$ref": "#/definitions/order" },
+        "optIn": {
+          "type": "boolean",
+          "description": "true holds this custom check out of the default run — it runs only under --all/--include <name>. Absent runs it by default."
+        }
       }
     }
   }

package/node_modules/checkride/schema/checkride.summary.schema.json

@@ -27,7 +27,7 @@
     "total_duration_ms": {
       "type": "number",
       "minimum": 0,
-      "description": "Sum of all check durations in milliseconds."
+      "description": "Wall-clock duration of the whole execution phase, in milliseconds — not the sum of the per-check durations, which is larger whenever checks ran concurrently. The two are equal only when execution was sequential (including any --bail run). The run STARTED at timestamp - total_duration_ms; readers use that to judge whether an artifact belongs to this run."
     },
     "checks": {
       "type": "array",

package/node_modules/checkride/skills/check/SKILL.md

@@ -0,0 +1,257 @@
+---
+name: check
+description: Triage a red checkride gate and name one root cause. Use whenever `pnpm check` (or `npm/yarn/bun run check`) fails, a checkride gate is red, CI is failing on the gate, or you need to know what to fix first. Runs the gate itself, reads a bounded report instead of megabytes of `.check/` artifacts, and covers the contract corners a plain summary read gets wrong — exit 2 vs exit 1, vacuous green, narrow green, baselined findings, skipped slots, spawn failures and stale artifacts.
+argument-hint: "[repo-path]"
+allowed-tools: Read, Grep, Glob, Bash(node *), Bash(pnpm *), Bash(npm run *), Bash(yarn *), Bash(bun run *), Bash(npx checkride*), Bash(wc *)
+---
+
+# checkride: triage a red gate
+
+checkride's gate is the definition of done: exit 0 means the work is complete,
+anything else means it is not. This skill is the procedure for the "anything
+else" — it turns a red gate into **one named root cause** plus an explicit list
+of what it is deliberately not reading yet.
+
+It replaces reading `.check/summary.json` by hand. That habit is wrong in two
+directions at once: it is unbounded (`mutation.json` runs to 2.3 MB in
+checkride's own repo, `test.json` to 650 KB, and opening one spends the context
+you need for the fix), and it is credulous (every run overwrites `summary.json`,
+so an `ok: true` on disk may describe three of seventeen slots from fourteen
+minutes ago).
+
+## 1. Run the reader
+
+```bash
+pnpm exec checkride triage
+```
+
+Substitute the repo's package manager (`npx checkride`, `yarn checkride`, `bunx
+checkride`). Pass a repo path as the one optional argument to triage somewhere
+other than the current directory.
+
+If checkride is not a dependency of the target repo, run the copy the plugin
+ships instead: `node "${CLAUDE_PLUGIN_ROOT}/dist/triage/cli.js"`. Both entry
+points render the identical report.
+
+What it does, in order: runs the repo's **own** `check` script (that script is
+the definition of done and may carry deliberate `--only` / `--skip` / `--changed`
+that a direct `checkride` invocation would bypass), branches on the promised
+0/1/2 exit split, then reads what the run wrote. On exit 2 it also folds in
+`checkride doctor --json`, so the broken-harness branch arrives with its
+diagnosis attached.
+
+Every artifact is measured, never opened. A green 17-slot run renders in about
+2 KB. It exits 0 whenever it produced a report — the gate's verdict is in the
+Markdown, not in the process status, so a red repo never looks like a broken
+reader.
+
+**Do not open any `.check/` file before this report tells you which one.** That
+is the whole point: the report is the index, and you open exactly one thing from
+it.
+
+## 2. Read the header before you read any finding
+
+The report opens with four lines. They are not preamble — three of the five ways
+to be confidently wrong about a checkride run are visible only here.
+
+```text
+- gate: `pnpm run check` → exit 0 (20.5s)
+- script: `tsc --build && node dist/cli.js`
+- summary: `.check/summary.json` — `schema_version` 1, written by this run, 19.8s
+- covered: 17 slot(s) ran, 0 skipped
+```
+
+- **`script`** — the repo's literal `check` script. If it contains `--only`,
+  `--skip` or `--changed`, this gate narrows the run on purpose and a green is
+  green *for those slots only*. The report says so under `coverage`.
+- **`summary`** — provenance. `written by this run` is the good case. **`left by
+  an EARLIER run`** means the table below describes something else entirely and
+  every row in it is suspect. `schema_version` anything but 1 means **stop**: the
+  reader is pinned to schema 1, additive-only guarantees hold within a version
+  and promise nothing across one, so guessing is how you invent a finding. **`NOT
+  written by checkride`** (no `schema_version` at all) means this repo's gate is
+  a different tool — see below.
+- **`covered`** — how much was verified. Compare it against the `coverage`
+  section, which names the slots `checkride.config.json` configures but this run
+  never touched. **`unknown`** is not `0`: it means no summary could be parsed,
+  so nothing about coverage was measured either way.
+
+**Always open your report with the covered-slot count and the run's age.** A
+finding without its coverage is an assertion about the whole repo built from a
+fraction of it.
+
+## 3. Branch on the verdict
+
+| verdict | what it means | what to do |
+| --- | --- | --- |
+| **harness broken** | exit 2 — checkride reserves it for "the harness broke or was misused" | Read the `doctor` section and the `gate output` tail. **No check result from this run is evidence of anything.** Report *what doctor found* — the named requirement, what was found, what was expected — never just "the harness is broken". |
+| **off-contract exit** | not 0, 1 or 2 (a 127, a signal death, a wrapper that died before checkride ran) | Same posture as exit 2. Read the `gate output` tail: something in the `check` script failed around checkride, not inside it. |
+| **red** | exit 1 — at least one check failed | Go to step 4. This is the normal path. |
+| **red, but no slot explains it** | exit 1 with an empty `failing slots` section | The failure happened *outside* checkride. Read the `gate output` tail, which the report includes on this branch. See below — do not triage the table. |
+| **red, and the summary cannot be read** | exit 1, and `.check/summary.json` exists but this reader cannot parse it | There is **no table at all**, and its absence is not evidence. Read the `gate output` tail and the `.check/ contents` listing; report *only* what those show. See below. |
+| **green, with no index** | exit 0, same unparseable summary | The repo's own gate passed — report that, and nothing more. Attaching a slot count or a "clean" claim to it is inventing coverage. |
+| **vacuous green** | exit 0 with `checks_run: 0` | A failure wearing a pass: nothing was verified. Find out why no check was selected (a typo'd `--only`, an empty config) before believing anything. Treat it as red. |
+| **green, but narrow** | exit 0 over a subset | Say which slots were covered and which were not. Do not report the work as done on this evidence. |
+| **green** | exit 0, full coverage | Still check the caveats for `baselined` and `skipped` before saying clean — see step 7. |
+| **gate not run** | no `check` script in this repo | Nothing here defines done. `checkride init` adds it. Anything in `.check/` is from whatever last wrote it. |
+
+### Red with an empty `failing slots` section
+
+The verdict reads **`red, but no slot explains it`**: the gate exited 1 but
+checkride never ran, so nothing in the table came from this run. `check` scripts
+are compound — `tsc --build && node dist/cli.js` is the standard shape
+`checkride init` writes — and when the command *before* checkride dies, the `&&`
+short-circuits and no summary is written.
+
+The `summary` header line is the second tell: **`left by an EARLIER run`**. The
+table below it describes something else entirely, and the coverage numbers belong
+to that other run too.
+
+**The evidence is already in the report.** On this branch it renders a `gate
+output` section — a capped tail of both captured streams — because that is the
+only record of the failure that exists. Triage it there rather than re-running
+anything.
+
+Read **both** blocks. Which stream carries the diagnosis is the failing tool's
+choice, not a convention you can rely on: `tsc` reports errors on **stdout**
+while `stderr` holds nothing but pnpm's `$ tsc --build && node dist/cli.js`
+command echo. A near-empty `stderr` block is not "no output".
+
+Only if both blocks are absent, re-run the failing prefix directly (`pnpm exec
+tsc --build` for the shape above) and triage what it prints. Either way: do not
+report any slot in the table as passing.
+
+### A summary this reader cannot parse
+
+Distinct from the branch above, and the distinction is the whole point. There
+the summary is **absent** — checkride never ran, so it wrote nothing. Here a
+`.check/summary.json` exists and cannot be parsed, which says *nothing at all*
+about what ran. The verdict reads **`red, and the summary cannot be read`** (or
+**`green, with no index`**), and the header names which of three it is:
+
+- **`NOT written by checkride`** — no `schema_version`. The repo's gate is a
+  homegrown script that writes a checkride-shaped `.check/`. Its artifacts follow
+  no contract, so their names and freshness are all you can trust about them.
+- **`schema_version` is N, not 1** — checkride wrote it, but a newer one.
+- **unreadable** — truncated, or not JSON.
+
+On this branch the report gives you two things and no table: the `gate output`
+tail, and a **`.check/ contents`** listing of every file with its size and age.
+`fresh` there means written after the gate started; `stale` means a leftover that
+describes no part of this run. Triage from those, and open at most one file.
+
+What you must not do is fill the gap. `covered: unknown` is not `covered: 0`;
+`baselined` and `skipped` are both **unknown**, and because a baselined slot
+*passes* and a skipped one reports nothing, "no caveats raised" and "no caveats
+could be raised" look identical. No slot can be reported as passing on this run.
+
+## 4. Order the failures — this is the judgment
+
+The report lists failing slots in **pipeline order** and says explicitly that
+this is not importance order. Re-ranking them is the part no script can do.
+
+When several slots fail at once, most of them are usually one cause and its
+shadows. The cheap tell: **does the failing slot consume something an earlier
+failing slot produces?**
+
+| when this fails | these failures are usually its shadow | because |
+| --- | --- | --- |
+| `types` | `build`, `typecheck-tests`, `test` | `build` is normally the same `tsc` invocation, and a type error is the same defect surfacing at runtime |
+| `types` on a *syntax* error | also `lint`, `struct`, `dead`, `dupes`, `health` | unparseable source breaks every tool that parses it, which a merely semantic type error does not |
+| `build` | `publint`, `attw`, `pack`, `smoke`, `snippets` | they all inspect `dist/`, which is now stale or absent |
+| `test` | nothing | no slot consumes a test result |
+
+Two rules that outrank the table:
+
+1. **A slot with `exit_code: -1` is not a finding.** It failed to spawn or timed
+   out and reported nothing. That is a harness problem wearing a failure's
+   clothes, and it comes first.
+2. **The prose lane is independent.** `docs`, `spell` and `links` never share a
+   cause with the code lane. `types` red *and* `spell` red is two pieces of work,
+   not one — say so rather than folding them together.
+
+Worked shape: `types`, `build` and `test` all red, 41 test failures. That is one
+root cause — the type error — and two shadows. Naming the 41 test failures is
+noise; fixing the type error is the work. Say which one you picked and why the
+others are downstream.
+
+## 5. If everything failing is auto-fixable, say so before proposing edits
+
+`checkride fix` runs every active adapter's fix command. The slots it can fix
+are `format` (prettier, biome), `lint` (oxlint, biome, eslint), `docs`
+(markdownlint) and `dead` (fallow, knip). Nothing else — `types`, `test`,
+`spell`, `links`, `struct` and the packaging slots have no fix command.
+
+- **Every failing slot is in that set** → propose `pnpm exec checkride fix`
+  followed by a re-run, before writing a single hand edit. Hand-editing what a
+  formatter would rewrite is wasted work.
+- **Only some are** → the root cause is elsewhere. Name it first; mention `fix`
+  as cleanup for the rest.
+
+Two caveats to state when you propose it: `fix` writes to files across the whole
+repo, not just the failing slots, so it wants a clean git tree or a reviewed
+diff; and `dead`'s fix *deletes* code it believes is unused — read that part of
+the diff rather than trusting it.
+
+## 6. Open exactly one file
+
+The report's `failing slots` section names each failure's raw output with its
+size. Open the one belonging to your chosen root cause, and nothing else.
+
+- If `.check/digest.md` is listed and **fresh**, read it first — it is
+  checkride's own bounded excerpt of this run's failing slots, capped at 8 KB.
+  Its existence always means the run that wrote it had failures. If it is
+  labelled stale, it belongs to an earlier run; do not read it as this one's.
+- Prefer the file the report chose. When a slot has both a `.json` and a
+  `.stdout.txt`, the reader already picked the small one (`test.stdout.txt` is
+  6 KB against `test.json`'s 650 KB) and the `(+1)` marks the one it passed over.
+- **If the chosen file gives you a count but not a location, open the `(+1)`.**
+  The reader prefers stdout because checkride's own stream discipline puts machine
+  output there and progress on stderr — but not every tool obeys it.
+  markdownlint-cli2 inverts it outright: `docs.stdout.txt` says
+  `Summary: 1 issue in 1 file` while `docs.stderr.txt` carries the
+  `file:line:rule` you actually need. A summary line is not a finding; go get the
+  finding.
+- **Check the size before opening.** Anything past ~50 KB gets `Grep`, not
+  `Read` — search for the error text rather than loading the file.
+- If a failing slot's raw output is `—`, the tool wrote nothing the reader could
+  locate. Do not report "no output": re-run that slot alone
+  (`pnpm exec checkride --only <slot>`) and read what it prints.
+
+## 7. Report
+
+Lead with provenance, then one cause, then what you left closed:
+
+- **Gate** — the verdict, the covered-slot count, and the run's age.
+- **Root cause** — one slot, one sentence, grounded in the file you opened.
+- **Downstream, not read** — the failing slots you believe are shadows of it,
+  and the one-line reason. Naming these is as much the product as the cause is.
+- **Separate work** — failing slots that are genuinely independent (usually the
+  prose lane).
+- **Masked** — every caveat the report raised, because each one means a green is
+  less green than it looks:
+  - `baselined: N` — that many current findings are grandfathered by
+    `checkride.baseline.json`. **A baselined slot passing is not clean, and you
+    must say the count rather than reporting clean.** Never add to a baseline to
+    make a check pass.
+  - `skipped` plus its reason — that slot verified nothing this run.
+  - stale artifacts — leftovers from an earlier run, not this one's output.
+  - uncovered slots — configured in `checkride.config.json`, absent from this run.
+- **Next** — the fix command, or the specific hand edit.
+
+Do not produce a fixed-size list of findings. One cause is the target; two is
+fine when the lanes are genuinely independent; five means you re-ranked nothing.
+
+## What this skill does not do
+
+- **It does not fix.** It runs the gate and reads. Proposing `checkride fix` or a
+  hand edit is the deliverable; applying it is the next request.
+- **It does not normalize tool output.** The raw file is the truth and the
+  summary is only an index — that is checkride's thesis, and reformatting a
+  tool's own bytes into something prettier is how a triage loses the detail that
+  mattered.
+- **It does not read `.check/` contents on spec.** Sizes and locations first,
+  then exactly one file. If you find yourself opening a second artifact before
+  naming a cause, that is exploration, not triage.
+- **It does not touch the baseline.** `checkride baseline` hides findings
+  permanently; that is the human's call, never a triage step.