polymath-society 0.2.11 → 0.2.13

package/dist/engine/peak-demos.js

@@ -530,7 +530,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },
@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-dimension-summary.js

@@ -530,7 +530,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },
@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-facet-lines.js

@@ -530,7 +530,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },
@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-headline.js

@@ -530,7 +530,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },
@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-report.js

@@ -530,7 +530,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },
@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-self-image.js

@@ -616,7 +616,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },
@@ -1096,6 +1096,25 @@ import { spawn } from "child_process";
 import { promises as fs4 } from "fs";
 import path5 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1200,7 +1219,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/public-report.js

@@ -142,6 +142,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -246,7 +265,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -15635,11 +15656,11 @@ var ENGINE_DATA = process.env.POLYMATH_DATA_DIR ? path10.resolve(process.env.POL
 
 // ../../lib/calibration/index.ts
 var DEFAULT_CALIBRATION = {
-  version: "2026-07-14.2",
+  version: "2026-07-15.1",
   // = RUBRIC_FINGERPRINT of the shipped npm rubric (packages/coding-analyzer/
   // src/grade/criteria.ts). A unit test fails loud when the rubric changes
   // without this being updated (and re-pushed to the server).
-  rubricVersion: "f51b3a93a3",
+  rubricVersion: "7983c01d53",
   // Canonical scale = the one the product owner set for the public report
   // (11=0.01% … 8=2%), extended downward from the old report ladder. The old
   // CodeAnalysisView / npm-viewer maps (7→10%/15%, 6→25%/30%) were drift, not
@@ -16180,7 +16201,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },

package/dist/engine/run-analysis.js

@@ -265,6 +265,25 @@ import { spawn } from "child_process";
 import { promises as fs4 } from "fs";
 import path5 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -369,7 +388,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -15797,7 +15818,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },

package/dist/engine/run-tagger.js

@@ -242,6 +242,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -346,7 +365,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/index.js

@@ -1794,6 +1794,25 @@ import path3 from "path";
 // src/grade/cliAdapter.ts
 import { spawn } from "child_process";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base2 = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base2;
+  const present = AUTH_VARS.filter((k) => base2[k]);
+  if (!present.length)
+    return base2;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base2 };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // src/grade/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1945,7 +1964,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(bin, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // children that otherwise orphan and pile up).
@@ -2198,7 +2219,7 @@ var CODING_CRITERIA = [
     label: "Abstraction \u2014 seeing the load-bearing thing, and being right",
     graded: true,
     definition: "Under genuine ambiguity (an obvious path sitting right there, no answer key): did the USER see that the obvious path was subtly wrong \u2014 or that something decisive was invisible \u2014 and do the non-obvious thing that made it right, AND were they right? The graded unit is the whole move: the CATCH (noticing the fork) -> the QUESTION (formulating it) -> the CALL (resolving it). The move surfaces three interchangeable ways, scored identically: a REFRAME (collapse a mess to its real axis), a QUESTION (pose the hard thing nobody posed), or an INSTRUMENT (build the code/chart/structure that makes the truth legible, then read it). Tag the SUBSTANCE, not the medium \u2014 a chart built (technical act) to make a human-intensity call legible is a JUDGMENT catch.",
-    read: "FOUR LEVERS set the height: (1) INVISIBILITY \u2014 how non-obvious there was anything to catch; a sharp operator in the flow drives past it (the DOMINANT lever); (2) DIFFICULTY of forming the catch; (3) STAKES \u2014 'without this, things silently go wrong' is the 9-10 condition; (4) SOUNDNESS \u2014 did the call hold. THREE OVERRIDING GATES: (a) OBVIOUSNESS KILLS IT \u2014 a correct, even load-bearing catch a sharp operator reaches anyway scores LOW ('you're evaluating the person not the AI' is correct but obvious -> ~5; 'compute in the OAuth dead-time' is real but fairly obvious -> ~6). (b) LEVERAGE BEATS INSIGHT \u2014 a move whose payoff is a HIGHER RATE OF FUTURE INSIGHT (building the tool that lets him set his own boundaries; timestamp-by-timestamp structure to instruct the grader precisely) raises the bandwidth of the loop that produces every later catch, and can outrank a clean one-off reframe. (c) SOUNDNESS GATE \u2014 a confident WRONG call to a noticed fork is an ANTI-SIGNAL; an honest 'not sure, here's a range' is NOT penalized. HUNT THE FORK BLIND \u2014 reconstruct what continuing-without-noticing looked like, then check whether/why he diverged; do NOT hand yourself the fork pre-formed or you score everyone's problem-finding a 10. TAG every instance: kind = systems | judgment | both (+ optional register: human/product/measurement). Reasoning and instrument-building are the SAME criterion. ANCHORS: 10 = 'OCEAN won't change, measure effectiveness of actions' (reframe that redefines the measure) / 'don't hurt Natalie, not long-term compatible' (lived judgment, requires being the person) / 'plot it sorted, let me set the boundaries' (leverage \u2014 builds the bandwidth tool); 9 = 'word count IS the proxy \u2014 sitting there is unfakeable focus' / 'uncertainty collapses in that direction'; 8 = 'a better metric is the difficulty of content + original synthesis' (hard opening question); 7 = 'this candidate seems too strong for his judgement to be real' (real non-obvious catch, modest stakes); 6 = 'compute in the OAuth dead-time' / 'why overcomplicate it, single agent' (real but obvious); 5 = 'you're evaluating the person not the AI' (correct but obvious).",
+    read: "FOUR LEVERS set the height: (1) INVISIBILITY \u2014 how non-obvious there was anything to catch; a sharp operator in the flow drives past it (the DOMINANT lever); (2) DIFFICULTY of forming the catch; (3) STAKES \u2014 'without this, things silently go wrong' is the 9-10 condition; (4) SOUNDNESS \u2014 did the call hold. THREE OVERRIDING GATES: (a) OBVIOUSNESS KILLS IT \u2014 a correct, even load-bearing catch a sharp operator reaches anyway scores LOW ('you're evaluating the person not the AI' is correct but obvious -> ~5; 'compute in the OAuth dead-time' is real but fairly obvious -> ~6). (b) LEVERAGE BEATS INSIGHT \u2014 a move whose payoff is a HIGHER RATE OF FUTURE INSIGHT (building the tool that lets him set his own boundaries; timestamp-by-timestamp structure to instruct the grader precisely) raises the bandwidth of the loop that produces every later catch, and can outrank a clean one-off reframe. (c) SOUNDNESS GATE \u2014 a confident WRONG call to a noticed fork is an ANTI-SIGNAL; an honest 'not sure, here's a range' is NOT penalized. HUNT THE FORK BLIND \u2014 reconstruct what continuing-without-noticing looked like, then check whether/why he diverged; do NOT hand yourself the fork pre-formed or you score everyone's problem-finding a 10. TAG every instance: kind = systems | judgment | both (+ optional register: human/product/measurement). Reasoning and instrument-building are the SAME criterion. ANCHORS: 10 = 'OCEAN won't change, measure effectiveness of actions' (reframe that redefines the measure) / a human-stakes call where the person overrode the analytically-clean answer on knowledge only they could have about someone involved, and was right (lived judgment, requires being the person) / 'plot it sorted, let me set the boundaries' (leverage \u2014 builds the bandwidth tool); 9 = 'word count IS the proxy \u2014 sitting there is unfakeable focus' / 'uncertainty collapses in that direction'; 8 = 'a better metric is the difficulty of content + original synthesis' (hard opening question); 7 = 'this candidate seems too strong for his judgement to be real' (real non-obvious catch, modest stakes); 6 = 'compute in the OAuth dead-time' / 'why overcomplicate it, single agent' (real but obvious); 5 = 'you're evaluating the person not the AI' (correct but obvious).",
     rungs: [
       { level: 2, marker: "A fork existed; defers the call to the AI, or takes the obvious branch; vague." },
       { level: 4, marker: "Notices something, but the question is vague or obvious \u2014 anyone in the seat asks it." },
@@ -2650,11 +2671,11 @@ var LocalGradeProvider = class {
 
 // ../../lib/calibration/index.ts
 var DEFAULT_CALIBRATION = {
-  version: "2026-07-14.2",
+  version: "2026-07-15.1",
   // = RUBRIC_FINGERPRINT of the shipped npm rubric (packages/coding-analyzer/
   // src/grade/criteria.ts). A unit test fails loud when the rubric changes
   // without this being updated (and re-pushed to the server).
-  rubricVersion: "f51b3a93a3",
+  rubricVersion: "7983c01d53",
   // Canonical scale = the one the product owner set for the public report
   // (11=0.01% … 8=2%), extended downward from the old report ladder. The old
   // CodeAnalysisView / npm-viewer maps (7→10%/15%, 6→25%/30%) were drift, not
@@ -3263,7 +3284,9 @@ var cliAdapter2 = {
     await new Promise((resolve2, reject) => {
       const child = spawn3(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -19632,7 +19655,7 @@ var growthLens = {
     {
       key: "implementation",
       name: "Observed execution improvement",
-      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament (often OCD-like), so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
+      definition: "The slope itself: whether diagnosed problems get attacked with experiments and whether the change in BEHAVIOR lands and sticks. Graded from dated evidence on ACTIONS, not feelings: a recurring feeling, urge, or complaint is expected base temperament and is NOT a mark against implementation \u2014 only a recurring unchanged behavior is. Credit a changed action even when the underlying feeling repeats verbatim (e.g. still dreads cold outreach but now sends it daily). A COMPULSION OR URGE IS TEMPERAMENT, NOT AN ACTION: a perfectionism / over-analysis / decision-paralysis loop is the behavioral face of base temperament, so if the person INCREASINGLY OVERRIDES it and still ships, that is temperament being managed better over time \u2014 a RISING slope, NOT a recurring unchanged action \u2014 and must NOT cap the score. Only count such a loop against implementation if the ACTION genuinely shows NO improvement across the window (still loses whole days with no rising ability to override and ship). A FIX THAT NEEDED A FORCING FUNCTION STILL COUNTS, FULLY: a change triggered by a deadline, a painful lesson, or 'getting burnt' that then LANDS and STICKS is a real fix on a legitimate route \u2014 learning from consequence is how humans change \u2014 so do NOT dock a landed, sticky fix for needing a catalyst; the catalyst is not a defect. Judge the slope over LONG horizons (weeks\u2192months across the dated record), NEVER within a single day or conversation \u2014 behavior change takes time, so the absence of same-day change is NOT a failure and must NEVER buckle the score. GRADE THE AGGREGATE SLOPE, not the one unfixed thread: humans cannot fix everything, and very few fix anything at all \u2014 so fixing several genuinely hard, DISTINCT stuck-points and making them stick across the window is exceptional and scores HIGH (9-10), and one stubborn temperament loop that is being increasingly overridden does NOT pull an otherwise broad, rising, sticky record down. The real question: across the record, did the problems they identified earlier become LESS of an issue in their later ACTIONS? Internal baselines (neuroticism, needing people to feel happy) are not the unit here \u2014 grade the actions.",
       rungs: [
         { level: 3, marker: "The same BEHAVIORS recur across the window, unchanged \u2014 recognition (if any) never becomes a change in action. (A recurring feeling alongside changed behavior does NOT belong here \u2014 that is a fix, scored higher.)" },
         { level: 5, marker: "Occasionally a fix happens \u2014 intends to solve, and sometimes it lands, but not usually." },
@@ -23367,8 +23390,9 @@ function startServer(opts) {
       if (req.method === "GET" && route === "/auth/callback") {
         try {
           const id = await completeLogin(dataDir, new URL(url, serverUrl).searchParams);
+          const back = host === "127.0.0.1" ? serverUrl.replace("//127.0.0.1:", "//localhost:") : serverUrl;
           res.writeHead(200, { "content-type": MIME[".html"] });
-          res.end(`<!doctype html><meta charset="utf-8"><title>Signed in</title><body style="font-family:system-ui;padding:40px"><p>Signed in as <b>${id.email.replace(/</g, "&lt;")}</b>.</p><p><a href="/">Back to your report</a> (or just close this tab \u2014 the report page picks it up on its own).</p></body>`);
+          res.end(`<!doctype html><meta charset="utf-8"><title>Signed in</title><body style="font-family:system-ui;padding:40px"><p>Signed in as <b>${id.email.replace(/</g, "&lt;")}</b>.</p><p><a href="${back}/">Back to your report</a> (or just close this tab \u2014 the report page picks it up on its own).</p></body>`);
         } catch (e) {
           res.writeHead(400, { "content-type": MIME[".html"] });
           res.end(`<!doctype html><meta charset="utf-8"><title>Sign-in failed</title><body style="font-family:system-ui;padding:40px"><p><b>Sign-in failed.</b></p><p>${String(e.message).replace(/</g, "&lt;")}</p><p><a href="/auth/login">Try again</a></p></body>`);
@@ -23532,7 +23556,12 @@ function startServer(opts) {
       }).catch(() => {
       });
       resolve2({
-        url: serverUrl,
+        // The DISPLAYED/opened URL says localhost — friendlier than 127.0.0.1
+        // (owner call 2026-07-15); same server, same loopback. serverUrl itself
+        // stays on the bound host because the Google sign-in redirect is
+        // allow-listed for http://127.0.0.1:*/** in Supabase — auth flows
+        // through 127.0.0.1 no matter which name the person's tab uses.
+        url: host === "127.0.0.1" ? `http://localhost:${port}` : serverUrl,
         port,
         close: () => new Promise((r) => server.close(() => r())),
         setProfile: (p) => {