polymath-society 0.2.11 → 0.2.13

package/dist/cli.js

@@ -841,7 +841,19 @@ function aiWindowCutoff(sessions, opts = {}) {
   const floorStart = gradableStarts[floor - 1];
   return floorStart < windowCutoff ? floorStart : windowCutoff;
 }
-var GATE, AI_WINDOW;
+function maxGraded() {
+  const n = Number(process.env.POLYMATH_MAX_GRADED);
+  return Number.isFinite(n) && n >= 0 ? n : MAX_GRADED_DEFAULT;
+}
+function substanceRank(a, b) {
+  return b.humanChars * Math.log1p(b.humanTurns) - a.humanChars * Math.log1p(a.humanTurns);
+}
+function capGradable(gradable) {
+  const sorted = gradable.slice().sort(substanceRank);
+  const cap = maxGraded();
+  return cap > 0 && sorted.length > cap ? sorted.slice(0, cap) : sorted;
+}
+var GATE, AI_WINDOW, MAX_GRADED_DEFAULT;
 var init_gate = __esm({
   "../coding-core/dist/gate.js"() {
     "use strict";
@@ -860,6 +872,7 @@ var init_gate = __esm({
       minSessions: 40
       // extend the window back until this many gradable sessions
     };
+    MAX_GRADED_DEFAULT = 150;
   }
 });
 
@@ -868,10 +881,14 @@ var gate_exports = {};
 __export(gate_exports, {
   AI_WINDOW: () => AI_WINDOW,
   GATE: () => GATE,
+  MAX_GRADED_DEFAULT: () => MAX_GRADED_DEFAULT,
   aiWindowCutoff: () => aiWindowCutoff,
+  capGradable: () => capGradable,
   isGradable: () => isGradable,
   isTrivial: () => isTrivial,
-  partition: () => partition
+  maxGraded: () => maxGraded,
+  partition: () => partition,
+  substanceRank: () => substanceRank
 });
 var init_gate2 = __esm({
   "src/gate.ts"() {
@@ -880,6 +897,31 @@ var init_gate2 = __esm({
   }
 });
 
+// ../coding-core/dist/env.js
+function claudeCliEnv(base2 = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base2;
+  const present = AUTH_VARS.filter((k) => base2[k]);
+  if (!present.length)
+    return base2;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base2 };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+var AUTH_VARS, warned;
+var init_env = __esm({
+  "../coding-core/dist/env.js"() {
+    "use strict";
+    AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+    warned = false;
+  }
+});
+
 // src/grade/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1005,7 +1047,7 @@ var init_backends = __esm({
 });
 
 // src/grade/cliAdapter.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 function toolTarget(input) {
   return String(input.file_path ?? input.path ?? input.pattern ?? input.query ?? input.command ?? "");
 }
@@ -1013,6 +1055,7 @@ var cliAdapter;
 var init_cliAdapter = __esm({
   "src/grade/cliAdapter.ts"() {
     "use strict";
+    init_env();
     init_adapter();
     init_backends();
     cliAdapter = {
@@ -1047,9 +1090,11 @@ var init_cliAdapter = __esm({
         let costUsd;
         let numTurns;
         await new Promise((resolve2, reject) => {
-          const child = spawn(bin, args, {
+          const child = spawn2(bin, args, {
             cwd: inv.cwd ?? inv.addDir,
-            env: process.env,
+            // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+            // claude CLI away from their claude.ai login (coding-core/env.ts)
+            env: claudeCliEnv(),
             stdio: ["ignore", "pipe", "pipe"],
             // Own process group, so a timeout can kill the WHOLE tree (claude spawns
             // children that otherwise orphan and pile up).
@@ -1148,7 +1193,7 @@ var init_cliAdapter = __esm({
 });
 
 // src/grade/codexAdapter.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 function composePrompt(inv, roots) {
   return [
     inv.systemPrompt ? `<system>
@@ -1190,7 +1235,7 @@ var init_codexAdapter = __esm({
         let resultText = "";
         let numTurns = 0;
         await new Promise((resolve2, reject) => {
-          const child = spawn2(bin, args, { cwd, env: process.env, stdio: ["ignore", "pipe", "pipe"] });
+          const child = spawn3(bin, args, { cwd, env: process.env, stdio: ["ignore", "pipe", "pipe"] });
           let buf = "";
           let err = "";
           const timeoutMs = inv.timeoutMs ?? 3e5;
@@ -1496,15 +1541,15 @@ var init_exportLinks = __esm({
 });
 
 // src/notify.ts
-import { spawn as spawn8 } from "node:child_process";
+import { spawn as spawn9 } from "node:child_process";
 function systemNotify(title, body) {
   try {
     const opts = { stdio: "ignore" };
     if (process.platform === "darwin") {
-      spawn8("osascript", ["-e", `display notification ${JSON.stringify(body)} with title ${JSON.stringify(title)} sound name "Glass"`], opts).on("error", () => {
+      spawn9("osascript", ["-e", `display notification ${JSON.stringify(body)} with title ${JSON.stringify(title)} sound name "Glass"`], opts).on("error", () => {
       });
     } else if (process.platform === "linux") {
-      spawn8("notify-send", [title, body], opts).on("error", () => {
+      spawn9("notify-send", [title, body], opts).on("error", () => {
       });
     }
   } catch {
@@ -2458,19 +2503,19 @@ function makeMultiBar(out = process.stderr) {
   const lanes = /* @__PURE__ */ new Map();
   let link = "";
   let paintedRows = 0;
-  const laneText = (name17, l) => {
-    const w = l.within ? ` ${l.within.done}/${l.within.total}` : "";
-    return `${name17} ${l.i}/${l.total} ${l.label.slice(0, 26)}${w}`;
-  };
   const rows = () => {
-    const frac = (l) => l.total ? (l.i - 1 + (l.within && l.within.total ? l.within.done / l.within.total : 0)) / l.total : 0;
-    const parts = [...lanes.entries()].map(([n, l]) => laneText(n, l));
-    const avg2 = lanes.size ? [...lanes.values()].reduce((a, l) => a + frac(l), 0) / lanes.size : 0;
-    const width = 14;
-    const fill = Math.max(0, Math.min(width, Math.round(avg2 * width)));
+    const width = 16;
     const elapsedMin = Math.round((Date.now() - t0) / 6e4);
-    const bar = `[${"\u2588".repeat(fill)}${"\u2591".repeat(width - fill)}] ${parts.join("  \xB7  ")} \xB7 ${elapsedMin}m`;
-    return link ? [bar, `\u21B3 report (live, fills in as stages finish) \u2192 ${link}`] : [bar];
+    const laneRow = ([name17, l]) => {
+      const frac = l.total ? (l.i - 1 + (l.within && l.within.total ? l.within.done / l.within.total : 0)) / l.total : 0;
+      const clamped = Math.max(0, Math.min(1, frac));
+      const fill = Math.round(clamped * width);
+      return `  ${name17.padEnd(6)} [${"\u2588".repeat(fill)}${"\u2591".repeat(width - fill)}] ${String(Math.round(clamped * 100)).padStart(3)}%`;
+    };
+    const out2 = [];
+    if (link) out2.push(`\u21B3 your reports (live, fill in as stages finish) \u2192 ${link} \xB7 ${elapsedMin}m`);
+    out2.push(...[...lanes.entries()].map(laneRow));
+    return out2.length ? out2 : [`(starting\u2026 ${elapsedMin}m)`];
   };
   const clearPinned = () => {
     if (!paintedRows) return;
@@ -2601,7 +2646,19 @@ try {
 import { promises as fs36, existsSync as existsSync7 } from "fs";
 import path41 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
-import { spawn as spawn9 } from "child_process";
+
+// src/openBrowser.ts
+import { spawn } from "child_process";
+function openBrowser(url, cmd) {
+  const bin = cmd ?? (process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open");
+  try {
+    const child = spawn(bin, [url], { stdio: "ignore", detached: true });
+    child.on("error", () => console.log(`  (couldn't open a browser here \u2014 open ${url} yourself)`));
+    child.unref();
+  } catch {
+    console.log(`  (couldn't open a browser here \u2014 open ${url} yourself)`);
+  }
+}
 
 // src/analyze.ts
 init_raw2();
@@ -3545,7 +3602,7 @@ var CODING_CRITERIA = [
     label: "Abstraction \u2014 seeing the load-bearing thing, and being right",
     graded: true,
     definition: "Under genuine ambiguity (an obvious path sitting right there, no answer key): did the USER see that the obvious path was subtly wrong \u2014 or that something decisive was invisible \u2014 and do the non-obvious thing that made it right, AND were they right? The graded unit is the whole move: the CATCH (noticing the fork) -> the QUESTION (formulating it) -> the CALL (resolving it). The move surfaces three interchangeable ways, scored identically: a REFRAME (collapse a mess to its real axis), a QUESTION (pose the hard thing nobody posed), or an INSTRUMENT (build the code/chart/structure that makes the truth legible, then read it). Tag the SUBSTANCE, not the medium \u2014 a chart built (technical act) to make a human-intensity call legible is a JUDGMENT catch.",
-    read: "FOUR LEVERS set the height: (1) INVISIBILITY \u2014 how non-obvious there was anything to catch; a sharp operator in the flow drives past it (the DOMINANT lever); (2) DIFFICULTY of forming the catch; (3) STAKES \u2014 'without this, things silently go wrong' is the 9-10 condition; (4) SOUNDNESS \u2014 did the call hold. THREE OVERRIDING GATES: (a) OBVIOUSNESS KILLS IT \u2014 a correct, even load-bearing catch a sharp operator reaches anyway scores LOW ('you're evaluating the person not the AI' is correct but obvious -> ~5; 'compute in the OAuth dead-time' is real but fairly obvious -> ~6). (b) LEVERAGE BEATS INSIGHT \u2014 a move whose payoff is a HIGHER RATE OF FUTURE INSIGHT (building the tool that lets him set his own boundaries; timestamp-by-timestamp structure to instruct the grader precisely) raises the bandwidth of the loop that produces every later catch, and can outrank a clean one-off reframe. (c) SOUNDNESS GATE \u2014 a confident WRONG call to a noticed fork is an ANTI-SIGNAL; an honest 'not sure, here's a range' is NOT penalized. HUNT THE FORK BLIND \u2014 reconstruct what continuing-without-noticing looked like, then check whether/why he diverged; do NOT hand yourself the fork pre-formed or you score everyone's problem-finding a 10. TAG every instance: kind = systems | judgment | both (+ optional register: human/product/measurement). Reasoning and instrument-building are the SAME criterion. ANCHORS: 10 = 'OCEAN won't change, measure effectiveness of actions' (reframe that redefines the measure) / 'don't hurt Natalie, not long-term compatible' (lived judgment, requires being the person) / 'plot it sorted, let me set the boundaries' (leverage \u2014 builds the bandwidth tool); 9 = 'word count IS the proxy \u2014 sitting there is unfakeable focus' / 'uncertainty collapses in that direction'; 8 = 'a better metric is the difficulty of content + original synthesis' (hard opening question); 7 = 'this candidate seems too strong for his judgement to be real' (real non-obvious catch, modest stakes); 6 = 'compute in the OAuth dead-time' / 'why overcomplicate it, single agent' (real but obvious); 5 = 'you're evaluating the person not the AI' (correct but obvious).",
+    read: "FOUR LEVERS set the height: (1) INVISIBILITY \u2014 how non-obvious there was anything to catch; a sharp operator in the flow drives past it (the DOMINANT lever); (2) DIFFICULTY of forming the catch; (3) STAKES \u2014 'without this, things silently go wrong' is the 9-10 condition; (4) SOUNDNESS \u2014 did the call hold. THREE OVERRIDING GATES: (a) OBVIOUSNESS KILLS IT \u2014 a correct, even load-bearing catch a sharp operator reaches anyway scores LOW ('you're evaluating the person not the AI' is correct but obvious -> ~5; 'compute in the OAuth dead-time' is real but fairly obvious -> ~6). (b) LEVERAGE BEATS INSIGHT \u2014 a move whose payoff is a HIGHER RATE OF FUTURE INSIGHT (building the tool that lets him set his own boundaries; timestamp-by-timestamp structure to instruct the grader precisely) raises the bandwidth of the loop that produces every later catch, and can outrank a clean one-off reframe. (c) SOUNDNESS GATE \u2014 a confident WRONG call to a noticed fork is an ANTI-SIGNAL; an honest 'not sure, here's a range' is NOT penalized. HUNT THE FORK BLIND \u2014 reconstruct what continuing-without-noticing looked like, then check whether/why he diverged; do NOT hand yourself the fork pre-formed or you score everyone's problem-finding a 10. TAG every instance: kind = systems | judgment | both (+ optional register: human/product/measurement). Reasoning and instrument-building are the SAME criterion. ANCHORS: 10 = 'OCEAN won't change, measure effectiveness of actions' (reframe that redefines the measure) / a human-stakes call where the person overrode the analytically-clean answer on knowledge only they could have about someone involved, and was right (lived judgment, requires being the person) / 'plot it sorted, let me set the boundaries' (leverage \u2014 builds the bandwidth tool); 9 = 'word count IS the proxy \u2014 sitting there is unfakeable focus' / 'uncertainty collapses in that direction'; 8 = 'a better metric is the difficulty of content + original synthesis' (hard opening question); 7 = 'this candidate seems too strong for his judgement to be real' (real non-obvious catch, modest stakes); 6 = 'compute in the OAuth dead-time' / 'why overcomplicate it, single agent' (real but obvious); 5 = 'you're evaluating the person not the AI' (correct but obvious).",
     rungs: [
       { level: 2, marker: "A fork existed; defers the call to the AI, or takes the obvious branch; vague." },
       { level: 4, marker: "Notices something, but the question is vague or obvious \u2014 anyone in the seat asks it." },
@@ -4138,11 +4195,11 @@ async function getAccessToken(dataDir) {
 
 // ../../lib/calibration/index.ts
 var DEFAULT_CALIBRATION = {
-  version: "2026-07-14.2",
+  version: "2026-07-15.1",
   // = RUBRIC_FINGERPRINT of the shipped npm rubric (packages/coding-analyzer/
   // src/grade/criteria.ts). A unit test fails loud when the rubric changes
   // without this being updated (and re-pushed to the server).
-  rubricVersion: "f51b3a93a3",
+  rubricVersion: "7983c01d53",
   // Canonical scale = the one the product owner set for the public report
   // (11=0.01% … 8=2%), extended downward from the old report ladder. The old
   // CodeAnalysisView / npm-viewer maps (7→10%/15%, 6→25%/30%) were drift, not
@@ -4360,7 +4417,8 @@ import { readFileSync } from "fs";
 import path13 from "path";
 
 // ../../lib/agents/shared/cliAdapter.ts
-import { spawn as spawn3 } from "child_process";
+init_env();
+import { spawn as spawn4 } from "child_process";
 import { promises as fs7 } from "fs";
 import path7 from "path";
 
@@ -4466,9 +4524,11 @@ var cliAdapter2 = {
     let numTurns;
     let usage;
     await new Promise((resolve2, reject) => {
-      const child = spawn3(CLAUDE_BIN, args, {
+      const child = spawn4(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -4594,7 +4654,7 @@ var cliAdapter2 = {
 };
 
 // ../../lib/agents/shared/codexAdapter.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { existsSync as existsSync4, statSync } from "fs";
 import path9 from "path";
 
@@ -4748,7 +4808,7 @@ var codexAdapter2 = {
     let resultText = "";
     let numTurns = 0;
     await new Promise((resolve2, reject) => {
-      const child = spawn4(bin, args, {
+      const child = spawn5(bin, args, {
         cwd,
         env: process.env,
         stdio: ["ignore", "pipe", "pipe"]
@@ -4826,7 +4886,7 @@ var codexAdapter2 = {
 };
 
 // ../../lib/agents/shared/cursorAdapter.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 function composePrompt3(inv, roots) {
   return [
     inv.systemPrompt ? `<system>
@@ -4849,7 +4909,7 @@ var cursorAdapter = {
     const started = Date.now();
     let out = "";
     await new Promise((resolve2, reject) => {
-      const child = spawn5(bin, args, {
+      const child = spawn6(bin, args, {
         cwd: inv.cwd ?? inv.addDir,
         env: process.env,
         stdio: ["ignore", "pipe", "pipe"]
@@ -20837,7 +20897,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },
@@ -24494,8 +24554,9 @@ function startServer(opts) {
       if (req.method === "GET" && route === "/auth/callback") {
         try {
           const id = await completeLogin(dataDir, new URL(url, serverUrl).searchParams);
+          const back = host === "127.0.0.1" ? serverUrl.replace("//127.0.0.1:", "//localhost:") : serverUrl;
           res.writeHead(200, { "content-type": MIME[".html"] });
-          res.end(`<!doctype html><meta charset="utf-8"><title>Signed in</title><body style="font-family:system-ui;padding:40px"><p>Signed in as <b>${id.email.replace(/</g, "&lt;")}</b>.</p><p><a href="/">Back to your report</a> (or just close this tab \u2014 the report page picks it up on its own).</p></body>`);
+          res.end(`<!doctype html><meta charset="utf-8"><title>Signed in</title><body style="font-family:system-ui;padding:40px"><p>Signed in as <b>${id.email.replace(/</g, "&lt;")}</b>.</p><p><a href="${back}/">Back to your report</a> (or just close this tab \u2014 the report page picks it up on its own).</p></body>`);
         } catch (e) {
           res.writeHead(400, { "content-type": MIME[".html"] });
           res.end(`<!doctype html><meta charset="utf-8"><title>Sign-in failed</title><body style="font-family:system-ui;padding:40px"><p><b>Sign-in failed.</b></p><p>${String(e.message).replace(/</g, "&lt;")}</p><p><a href="/auth/login">Try again</a></p></body>`);
@@ -24659,7 +24720,12 @@ function startServer(opts) {
       }).catch(() => {
       });
       resolve2({
-        url: serverUrl,
+        // The DISPLAYED/opened URL says localhost — friendlier than 127.0.0.1
+        // (owner call 2026-07-15); same server, same loopback. serverUrl itself
+        // stays on the bound host because the Google sign-in redirect is
+        // allow-listed for http://127.0.0.1:*/** in Supabase — auth flows
+        // through 127.0.0.1 no matter which name the person's tab uses.
+        url: host === "127.0.0.1" ? `http://localhost:${port}` : serverUrl,
         port,
         close: () => new Promise((r) => server.close(() => r())),
         setProfile: (p) => {
@@ -24678,7 +24744,7 @@ function startServer(opts) {
 }
 
 // src/pipeline.ts
-import { spawn as spawn6 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 import os8 from "os";
 import path36 from "path";
 import { existsSync as existsSync5, promises as fs31 } from "fs";
@@ -24939,7 +25005,7 @@ function stageInvocation(repoRoot, scriptRel, args) {
 function runStage(repoRoot, st, env, onLine) {
   return new Promise((resolve2, reject) => {
     const { cmd, argv, cwd } = stageInvocation(repoRoot, st.script, st.args);
-    const child = spawn6(cmd, argv, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn7(cmd, argv, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
     const pump = (buf) => {
       if (!onLine) return;
       for (const line of buf.toString().split(/\r?\n/)) if (line.trim()) onLine(line);
@@ -24970,11 +25036,12 @@ function upToDateSkip(i) {
 }
 async function evalUpToDate(codingDir, threshold, regrade) {
   try {
-    const { partition: partition2, aiWindowCutoff: aiWindowCutoff2 } = await Promise.resolve().then(() => (init_gate2(), gate_exports));
+    const { partition: partition2, aiWindowCutoff: aiWindowCutoff2, capGradable: capGradable2 } = await Promise.resolve().then(() => (init_gate2(), gate_exports));
     const sessions = JSON.parse(await fs31.readFile(path36.join(codingDir, "sessions.json"), "utf8"));
     const live = sessions.filter((s) => s.klass === "interactive" && !s.duplicateOf);
     const cutoff = aiWindowCutoff2(live);
-    const { gradable } = partition2(cutoff ? live.filter((s) => (s.start ?? "") >= cutoff) : live);
+    const { gradable: uncapped } = partition2(cutoff ? live.filter((s) => (s.start ?? "") >= cutoff) : live);
+    const gradable = capGradable2(uncapped);
     const graded = new Set(
       (await fs31.readdir(path36.join(codingDir, "grades")).catch(() => [])).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5))
     );
@@ -25002,7 +25069,7 @@ function startKeepAwake(o = {}) {
   const up = () => {
     if (stopped) return;
     try {
-      child = spawn6(cmd, argv, { detached: true, stdio: "ignore" });
+      child = spawn7(cmd, argv, { detached: true, stdio: "ignore" });
       child.unref();
       child.on("error", () => {
         stopped = true;
@@ -25125,7 +25192,7 @@ async function runPipeline(o) {
 
 // src/chatPipeline.ts
 init_manifest();
-import { spawn as spawn7 } from "child_process";
+import { spawn as spawn8 } from "child_process";
 import path37 from "path";
 import { existsSync as existsSync6, promises as fs32 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
@@ -25189,7 +25256,7 @@ async function finalChatArtifacts(dataRoot) {
 function runStage2(repoRoot, st, env, onLine) {
   return new Promise((resolve2, reject) => {
     const { cmd, argv, cwd } = stageInvocation2(repoRoot, st.script, st.args);
-    const child = spawn7(cmd, argv, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn8(cmd, argv, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
     const pump = (buf) => {
       if (!onLine) return;
       for (const line of buf.toString().split(/\r?\n/)) if (line.trim()) onLine(line);
@@ -25824,13 +25891,6 @@ async function maybePrintUpdateNotice(opts) {
     clearTimeout(timer);
   }
 }
-function openBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  try {
-    spawn9(cmd, [url], { stdio: "ignore", detached: true }).unref();
-  } catch {
-  }
-}
 main().catch((e) => {
   console.error(e);
   process.exit(1);

package/dist/engine/chat-loops.js

@@ -551,7 +551,7 @@ var init_growth = __esm({
         {
           key: "implementation",
           name: "Observed execution improvement",
-          definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+          definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
           rungs: [
             { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
             { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },
@@ -1356,6 +1356,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1460,7 +1479,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/exp-allfacets.js

@@ -153,6 +153,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path3 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -257,7 +276,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -16469,7 +16490,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },

package/dist/engine/exp-person.js

@@ -153,6 +153,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path3 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -257,7 +276,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -16391,7 +16412,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },

package/dist/engine/exp-pipeline.js

@@ -148,6 +148,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -252,7 +271,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/ingest-export.js

@@ -661,11 +661,11 @@ var GIFTS = [
 
 // ../../lib/calibration/index.ts
 var DEFAULT_CALIBRATION = {
-  version: "2026-07-14.2",
+  version: "2026-07-15.1",
   // = RUBRIC_FINGERPRINT of the shipped npm rubric (packages/coding-analyzer/
   // src/grade/criteria.ts). A unit test fails loud when the rubric changes
   // without this being updated (and re-pushed to the server).
-  rubricVersion: "f51b3a93a3",
+  rubricVersion: "7983c01d53",
   // Canonical scale = the one the product owner set for the public report
   // (11=0.01% … 8=2%), extended downward from the old report ladder. The old
   // CodeAnalysisView / npm-viewer maps (7→10%/15%, 6→25%/30%) were drift, not