promptwheel 0.7.15 → 0.8.0

package/INTEGRATE.md

@@ -72,11 +72,7 @@ truncated SHA-256 fingerprint of the gate definition (metrics, guards, `evaluato
 and lists any guard the change dropped to hide a regression; a non-empty `gate.weakened`
 forces `gamed`, so an agent cannot pass by disabling the guard it is judged by.
 
-Self-check your implementation against this schema (see Section 4 below):
-
-```bash
-your-tool --json | promptwheel conformance -
-```
+Self-check your implementation against this schema with `conformsToContract` (see Section 4 below).
 
 ---
 
@@ -135,7 +131,6 @@ Returns the Section 2 verdict object (identical to `run --json`). Reproducible f
 | `repeat` | number | `config.repeat ?? 1` | measurement repeats for the noise band |
 | `detectGaming` | boolean | `true` | run the Section 3 source-only re-proof |
 | `allow` | string | none | a declared override reason (the same as `--allow` / a `Promptwheel-Allow:` trailer): a would-be `gamed`, or an `unprovable` win (its source-only re-run could not be applied), reads `pass` with the reason recorded in `report.allowed` |
-| `record` | boolean | `false` | append the run to `.promptwheel/outcomes.jsonl` |
 
 Preconditions throw (they do not exit the host): not inside a git repository; `auto: false`
 with no `promptwheel.config.json` and no `config` option; a `config` with no non-empty
@@ -173,22 +168,19 @@ of truth instead of hardcoding the strings.
 
 ---
 
-## 4. Self-check with `promptwheel conformance`
+## 4. Self-check with `conformsToContract`
 
 Prove your own check, loop, or CI step speaks the Contract.
 
-```bash
-# validate a verdict JSON (from a file or stdin) against the Section 2 schema
-promptwheel conformance report.json
-cat report.json | promptwheel conformance -
+```js
+import { conformsToContract, verdictExitCode } from 'promptwheel';
 
-# run a command, then validate BOTH its --json stdout (Section 2)
-# AND that its exit code matches the verdict (Section 1)
-promptwheel conformance --cmd "your-tool --json"
+const { ok, errors } = conformsToContract(JSON.parse(reportJson));   // Section 2
+const exitMatches = exitCode === verdictExitCode(report.verdict);    // Section 1
 ```
 
-Exit `0` if it conforms, `1` otherwise, listing every problem. This is how a third-party
-implementation earns the right to say "Verified-Outcome Contract compatible."
+`ok` is `true` when the report conforms; otherwise `errors` lists every problem. This is how a
+third-party implementation earns the right to say "Verified-Outcome Contract compatible."
 
 ---
 

package/README.md

@@ -6,7 +6,7 @@
 
 ![PromptWheel catching an agent game the metric, then passing an honest fix](demo/promptwheel.gif)
 
-## Catch your agent cheating, in 60 seconds
+## See it in 60 seconds
 
 A hand-built cheat, so you can watch the mechanism fire (illustrative, not evidence):
 
@@ -54,18 +54,11 @@ npx promptwheel run --working             # gate UNCOMMITTED changes (incl. newl
 npx promptwheel run --repeat 5 --json     # measure 5× to establish a noise band, emit JSON
 
 npx promptwheel init                      # optional: write promptwheel.config.json (guarded tests + antihack tripwires, + lint if eslint is set up)
-npx promptwheel init --list               # presets: tests-pass · lint · bundle-size · security · llm-eval · antihack · no-ai-tells · security-antihack · supply-chain
-
-# the loop: run any agent/script, keep the change ONLY if a metric improved, else revert
-npx promptwheel improve --attempt "claude -p 'reduce lint errors'"
-#   exit 0 = kept a real win · 1 = guarded regression (reverted) · 2 = gamed (reverted) · 3 = plateau / inconclusive (reverted) · add --json
-while npx promptwheel improve --attempt "<your agent command>"; do :; done     # converges: stops on the first non-zero
-
-npx promptwheel insights                  # which metrics actually respond in this repo (counts from .promptwheel/outcomes.jsonl)
-npx promptwheel guards                    # the effective guardrails, including ones inherited through extends
+npx promptwheel init --list               # presets: antihack · no-ai-tells · supply-chain
+npx promptwheel lock                      # write promptwheel.lock.json, the shape of this repo; the supply-chain preset holds it
 ```
 
-Gaming detection is on by default in `run` and `improve`; `--no-detect-gaming` gives you the bare outcome gate.
+Gaming detection is on by default in `run`; `--no-detect-gaming` gives you the bare outcome gate.
 
 **Give your agent the gate.** `promptwheel init` writes this into your `AGENTS.md` (and `CLAUDE.md` / `.cursorrules` if present; `--no-agent-block` to skip), so the coding agent runs the gate itself. To paste it yourself:
 
@@ -74,7 +67,7 @@ Gaming detection is on by default in `run` and `improve`; `--no-detect-gaming` g
     config, or grader, not the source, so revert and earn it in the source. Exit 1 means a guarded
     metric regressed, revert that too. Never weaken, skip, or delete a test to go green.
 
-**Two callers, by design.** Your *agent* consumes the verdict as a per-turn signal (`improve`, or `run --working --json`). The *harness* (a Stop-hook, or CI) runs the same check as an audit the agent cannot self-clear, because the check re-proves from the source alone and never asks the code to grade itself. See [docs/ENFORCEMENT.md](docs/ENFORCEMENT.md) for the three places to enforce it.
+**Two callers, by design.** Your *agent* consumes the verdict as a per-turn signal (`run --working --json`). The *harness* (a Stop-hook, or CI) runs the same check as an audit the agent cannot self-clear, because the check re-proves from the source alone and never asks the code to grade itself. See [docs/ENFORCEMENT.md](docs/ENFORCEMENT.md) for the three places to enforce it.
 
 ## Config, `promptwheel.config.json`
 
@@ -119,7 +112,7 @@ Teams keep one shared base config and have every repo inherit it via `extends`:
   "metrics": [ { "name": "cost_per_run_usd", "guard": false } ] }   // loosen one inherited guard, locally
 ```
 
-`extends` takes a path (or array of paths) to base configs: a repo **inherits** their guardrails, and a local metric of the same name **overrides** the inherited one (tighten, loosen, or disable). `promptwheel guards` shows the effective set with provenance (`inherited ← base.json`, `local`, or `local override`) plus each guard's flag record from the outcome record. Read this way, `extends` is the set of shared invariants your agents are held to, enforced as measured guards rather than advisory text. Natural-language conventions belong in `AGENTS.md`; only deterministic, measurable guards belong here.
+`extends` takes a path (or array of paths) to base configs: a repo **inherits** their guardrails, and a local metric of the same name **overrides** the inherited one (tighten, loosen, or disable). Read this way, `extends` is the set of shared invariants your agents are held to, enforced as measured guards rather than advisory text. Natural-language conventions belong in `AGENTS.md`; only deterministic, measurable guards belong here.
 
 ### Mandates (protected paths)
 
@@ -173,7 +166,7 @@ The Action runs straight from its own checkout, no npm install, no build. See [`
 /plugin install promptwheel@promptwheel-ai
 ```
 
-Then `/promptwheel:setup` (write a config) · `/promptwheel:gate` (gate uncommitted changes) · `/promptwheel:improve <cmd>` (keep-if-improved) · `/promptwheel:insights` · `/promptwheel:logbook`. See [`plugins/promptwheel/`](plugins/promptwheel/). A Stop-hook that refuses to let an agent end a turn on a `GAMED` win ships at [`examples/detect-gaming-stop.sh`](examples/detect-gaming-stop.sh).
+Then `/promptwheel:setup` (write a config) · `/promptwheel:gate` (gate uncommitted changes). See [`plugins/promptwheel/`](plugins/promptwheel/). A Stop-hook that refuses to let an agent end a turn on a `GAMED` win ships at [`examples/detect-gaming-stop.sh`](examples/detect-gaming-stop.sh).
 
 ## Trust model
 
@@ -194,7 +187,7 @@ Then `/promptwheel:setup` (write a config) · `/promptwheel:gate` (gate uncommit
 
 A check runs your metric commands in two throwaway worktrees (before and after) plus a source-only re-run when a metric improved, so one check takes roughly 2 to 3× your metric command's runtime plus about 40ms of worktree overhead. Point the per-turn gate at a *fast* metric (a lint count, a quick test subset, a build-size check) and leave the slow full suite for CI: a 50ms check is invisible in a loop, a two-minute one is not. A deterministic metric (a test exit, a count) is accurate at the default `repeat: 1`; only a noisy metric (latency, timing) needs `repeat: 3` or more, which multiplies the cost.
 
-**Footprint.** It never touches your working tree: every measurement runs in a throwaway git worktree in your system temp dir (one at a time; configured `linkDirs` are symlinked, not copied), removed when the run finishes. The only thing PromptWheel writes to your repo is the optional `.promptwheel/outcomes.jsonl` record; commit it, `.gitignore` it, or pass `--no-record`. A hard-killed run cannot leave clutter behind: the next run self-heals any orphaned worktree.
+**Footprint.** It never touches your working tree: every measurement runs in a throwaway git worktree in your system temp dir (one at a time; configured `linkDirs` are symlinked, not copied), removed when the run finishes. A run writes nothing to your repo; only `init` and `lock` write files, the ones you commit. A hard-killed run cannot leave clutter behind: the next run self-heals any orphaned worktree.
 
 ## Portability
 
@@ -202,9 +195,9 @@ The core gamed-win check is git only and runs anywhere git does: it classifies t
 
 ## Docs
 
-- [INTEGRATE.md](INTEGRATE.md), the integration surface: the exit-code and verdict-JSON contract, shelling `--json`, `import { check }`, and `promptwheel conformance` for self-checking a third-party implementation.
+- [INTEGRATE.md](INTEGRATE.md), the integration surface: the exit-code and verdict-JSON contract, shelling `--json`, `import { check }`, and `conformsToContract` for self-checking a third-party implementation.
 - [docs/DETECTION-LAYERS.md](docs/DETECTION-LAYERS.md), how the source-only re-run fits as the deterministic layer alongside held-out tests, LLM judges, and human review: the coverage matrix and the honest in/out-of-scope boundary.
-- [docs/ENFORCEMENT.md](docs/ENFORCEMENT.md), making "the agent can't skip it" real: the three places to enforce (loop-revert, CI + branch protection, a Claude Code Stop-hook), the exact wiring, and the protect-the-gate's-own-config caveat.
+- [docs/ENFORCEMENT.md](docs/ENFORCEMENT.md), making "the agent can't skip it" real: the two places to enforce (CI + branch protection, a Claude Code Stop-hook), the exact wiring, and the protect-the-gate's-own-config caveat.
 - [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md), how the engine works: schemas, extract modes, the trust/noise model.
 - [CHANGELOG.md](CHANGELOG.md), what shipped in each version.
 - [CLAUDE.md](CLAUDE.md), the working notes for anyone (human or agent) changing this repo.

package/bin/promptwheel.d.ts

@@ -85,8 +85,6 @@ export interface Config {
   env?: Record<string, string>;
   /** A per-ref build or install, run in the worktree before measuring (a failed setup leaves the metric inert, never a false green). */
   setup?: string;
-  /** `false` never appends to `.promptwheel/outcomes.jsonl`. */
-  record?: boolean;
   /** Fraction of a gain that must survive the source-only re-run; below it the win is `gamed`. Default 0.5. */
   gamingThreshold?: number;
   /** Extra files that define the gate (a threshold, a budget); a change to one alongside a win is gamed by declaration. Same glob rules as `Mandate.paths`. */
@@ -120,8 +118,6 @@ export interface CheckOptions {
   detectGaming?: boolean;
   /** A declared override reason (the same as `--allow` or a `Promptwheel-Allow:` commit trailer): a would-be `gamed`, or an `unprovable` win (its source-only re-run could not be applied), reads `pass`, recorded in `report.allowed`. */
   allow?: string;
-  /** Append the run to `.promptwheel/outcomes.jsonl`. Default `false`. */
-  record?: boolean;
 }
 
 // ---------------------------------------------------------------------------

package/bin/promptwheel.mjs

@@ -14,7 +14,7 @@
 
 import { execSync, execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { readFileSync, writeFileSync, existsSync, mkdtempSync, symlinkSync, rmSync, mkdirSync, appendFileSync, realpathSync, readdirSync, statSync, copyFileSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, mkdtempSync, symlinkSync, rmSync, mkdirSync, realpathSync, readdirSync, statSync, copyFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname, isAbsolute, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -68,7 +68,7 @@ const relOf = (repo, p) => { try { return relative(repo, p) || p; } catch { retu
 // resolve a config + its `extends` chain into a flat, provenance-tagged metric list.
 // `extends` is a path (or array of paths) to base configs, relative to the config file:
 // a repo INHERITS their guardrails, and a local metric of the same name overrides the inherited one.
-function resolveConfig(p, repo, label, seen) {
+function resolveConfig(p, repo, seen) {
   const abs = realpathSync(p);
   if (seen.has(abs)) bad(`config inheritance cycle at ${relOf(repo, p)}`);
   seen.add(abs);
@@ -80,16 +80,16 @@ function resolveConfig(p, repo, label, seen) {
     for (const ref of [].concat(cfg.extends || [])) {
       const bp = isAbsolute(ref) ? ref : join(dirname(p), ref);
       if (!existsSync(bp)) bad(`extends target not found: ${ref} (from ${relOf(repo, p)})`);
-      const base = resolveConfig(bp, repo, relOf(repo, bp), seen);
+      const base = resolveConfig(bp, repo, seen);
       for (const m of base.metrics) byName.set(m.name, m);
       for (const md of (base.mandates || [])) if (md && md.name) mandatesByName.set(md.name, md);
-      for (const k of ['repeat', 'linkNodeModules', 'linkDirs', 'env', 'setup', 'record', 'gamingThreshold', 'evaluatorPaths', 'allowTrailer']) if (base[k] !== undefined) scalars[k] = base[k];
+      for (const k of ['repeat', 'linkNodeModules', 'linkDirs', 'env', 'setup', 'gamingThreshold', 'evaluatorPaths', 'allowTrailer']) if (base[k] !== undefined) scalars[k] = base[k];
     }
     for (const m of (cfg.metrics || [])) {
-      byName.set(m.name, { ...m, __src: label, __override: byName.has(m.name) });
+      byName.set(m.name, m);
     }
-    for (const md of (cfg.mandates || [])) if (md && md.name) mandatesByName.set(md.name, { ...md, __src: label });
-    for (const k of ['repeat', 'linkNodeModules', 'linkDirs', 'env', 'setup', 'record', 'gamingThreshold', 'evaluatorPaths', 'allowTrailer']) if (cfg[k] !== undefined) scalars[k] = cfg[k];
+    for (const md of (cfg.mandates || [])) if (md && md.name) mandatesByName.set(md.name, md);
+    for (const k of ['repeat', 'linkNodeModules', 'linkDirs', 'env', 'setup', 'gamingThreshold', 'evaluatorPaths', 'allowTrailer']) if (cfg[k] !== undefined) scalars[k] = cfg[k];
     return { ...scalars, metrics: [...byName.values()], mandates: [...mandatesByName.values()] };
   } finally {
     seen.delete(abs); // only ACTIVE ancestors are a cycle, a diamond (a base reached two ways) is fine
@@ -99,7 +99,7 @@ function resolveConfig(p, repo, label, seen) {
 function loadConfig(repo) {
   const p = join(repo, 'promptwheel.config.json');
   if (!existsSync(p)) bad('no promptwheel.config.json, run: promptwheel init   (writes one for your stack)');
-  const cfg = resolveConfig(p, repo, 'local', new Set());
+  const cfg = resolveConfig(p, repo, new Set());
   if (!Array.isArray(cfg.metrics) || cfg.metrics.length === 0) bad('config.metrics must be a non-empty array');
   return cfg;
 }
@@ -279,7 +279,7 @@ const NON_SOURCE = [
   // promptwheel's OWN evaluator surface: the config that defines the gate
   // and any pack copied into the repo by `init --preset`. Editing these is
   // moving the goalposts, never a production improvement, an agent that
-  // "improved" security_findings by deleting pattern rules must show 0%
+  // "improved" a scanner count by deleting its rules must show 0%
   // retained in the source-only re-run, not 100%.
   /(^|\/)promptwheel\.config\.json$/i,
   /(^|\/)\.promptwheel\//i,
@@ -457,7 +457,7 @@ function judgeGaming(m, srcResult, threshold = 0.5) {
 // main
 // ---------------------------------------------------------------------------
 // snapshot the working tree (tracked + untracked) into a dangling commit WITHOUT
-// touching the real index or files, so a gate/improve sees a file an agent just added.
+// touching the real index or files, so a gate sees a file an agent just added.
 // Returns 'HEAD' when nothing changed.
 function workingSnapshot(repo) {
   const idxDir = mkdtempSync(join(tmpdir(), tmpPrefix(repo, 'pw-idx')));
@@ -731,7 +731,7 @@ function detectGamingPass(repo, base, head, cfg, metrics, repeat) {
 // (or a weakened gate) is GAMED; INCONCLUSIVE when nothing could be certified. A guard that never
 // runs (inert: a pass/fail metric stuck at 0 across both refs) verifies nothing, so a bare no-op
 // run is not laundered into a green PASS, BUT an inert guard must not bury a genuine, measured win
-// elsewhere (that would make `improve` revert good changes and misread them as a plateau). And a
+// elsewhere (a loop reading the verdict would throw away a good change). And a
 // win whose source-only re-run could not be applied (`unprovable`) is never a PASS either: a green
 // the engine could not re-prove is exactly the green it exists to doubt.
 export function deriveVerdict(metrics, gateInfo = null, mandated = false) {
@@ -854,7 +854,6 @@ function gate(repo, opts) {
     configHash: gateFingerprint(cfg.metrics, cfg),
     verdictHash: verdictFingerprint(report),
   };
-  if (!opts.noRecord && cfg.record !== false) recordOutcome(repo, report);
   return report;
 }
 
@@ -866,115 +865,18 @@ function run(argv) {
     config = autoConfig(repo);
     console.error(`no promptwheel.config.json, auto-gating the detected test command: ${config.metrics[0].cmd}  (promptwheel init to customize; --no-auto to require a config)`);
   }
-  const report = gate(repo, { base: args.base, head: args.head, working: args.working, repeat: args.repeat, noRecord: args.noRecord, detectGaming: args.detectGaming, allow: args.allow, config });
+  const report = gate(repo, { base: args.base, head: args.head, working: args.working, repeat: args.repeat, detectGaming: args.detectGaming, allow: args.allow, config });
   if (args.json) console.log(JSON.stringify(report, null, 2));
   else if (args.markdown) console.log(renderMarkdown(report));
   else printHuman(report);
   process.exit(verdictExitCode(report.verdict));
 }
 
-// persisted record: append every gated run to a per-repo outcome record (best-effort, never fails the gate)
-function recordOutcome(repo, report) {
-  try {
-    const dir = join(repo, '.promptwheel');
-    mkdirSync(dir, { recursive: true });
-    appendFileSync(join(dir, 'outcomes.jsonl'), JSON.stringify({ ts: new Date().toISOString(), ...report }) + '\n');
-  } catch { /* recording must never break the gate */ }
-}
-
-// keep-if-improved: run any agent/script, gate the result, keep the change ONLY if a metric improved
-function improve(argv) {
-  const args = parseArgs(argv);
-  if (!args.attempt) die('improve requires --attempt "<command that changes the repo>"');
-  const repo = repoRoot(process.cwd());
-  const dirty = git(['status', '--porcelain'], repo).split('\n').filter((l) => l.trim() && !l.includes('.promptwheel'));
-  if (dirty.length) die('working tree not clean, commit or stash first (improve needs a clean base to revert to)');
-
-  console.error(`▶ attempt: ${args.attempt}`);
-  try { execSync(args.attempt, { cwd: repo, stdio: 'inherit' }); }
-  catch (e) { console.error(`  (attempt exited ${e.status ?? 1}, gating whatever it changed)`); }
-
-  const report = gate(repo, { working: true, repeat: args.repeat, noRecord: args.noRecord, detectGaming: args.detectGaming });
-  const noChange = report.metrics.every((m) => m.delta === 0 || m.delta == null);
-  const improvedNames = report.metrics.filter((m) => m.status === 'improved').map((m) => m.name);
-
-  // result + exit code express loop progress so `while improve; do :; done` converges, with the
-  // same codes as `run`: 0 = kept a real win · 1 = guarded regression (reverted) · 2 = gamed
-  // (reverted) · 3 = plateau/no-op OR inconclusive (reverted)
-  let result, exit, note;
-  if (report.verdict === 'fail') { result = 'regression'; exit = 1; revert(repo); note = '✗ guarded regression, reverted'; }
-  else if (report.verdict === 'gamed') { result = 'gamed'; exit = 2; revert(repo); note = '🚩 gamed, a metric "improved" by editing tests/config, not source, reverted'; }
-  else if (report.verdict === 'inconclusive') { result = 'inconclusive'; exit = 3; revert(repo); note = '≈ inconclusive, a guard measured nothing (inert); reverted'; }
-  else if (noChange || improvedNames.length === 0) {
-    result = 'plateau'; exit = 3; revert(repo);
-    note = noChange ? '= no metric moved, reverted' : '= nothing improved beyond noise, reverted';
-  } else {
-    git(['add', '-A'], repo);
-    execFileSync('git', ['commit', '-qm', `promptwheel: ${args.attempt} [improved ${improvedNames.join(', ')}]`], { cwd: repo });
-    result = 'kept'; exit = 0;
-    note = `✓ kept, committed ${git(['rev-parse', '--short', 'HEAD'], repo)} (improved ${improvedNames.join(', ')})`;
-  }
-
-  // stdout carries the value (JSON report or the human table); the decision line goes to
-  // stderr so a loop driver can consume clean stdout.
-  if (args.json) console.log(JSON.stringify({ result, ...report }, null, 2));
-  else printHuman(report);
-  console.error(`  ${note}`);
-  process.exit(exit);
-}
-
-// discard the attempt's changes; keep the .promptwheel outcome record
-function revert(repo) {
-  git(['reset', '--hard', 'HEAD'], repo);
-  try { git(['clean', '-fd', '-e', '.promptwheel'], repo); } catch { /* best effort */ }
-}
-
-// insights: honest aggregation of the per-repo outcome record (.promptwheel/outcomes.jsonl)
-// into per-metric counts. No model, no decay, no claims: just which metrics actually respond.
-// The reader is tolerant of older records that carry extra fields (cohort, label, subsystems).
-function insights(argv) {
-  const args = parseArgs(argv);
-  const repo = repoRoot(process.cwd());
-  const f = join(repo, '.promptwheel', 'outcomes.jsonl');
-  if (!existsSync(f)) die('no outcome record yet, run the gate a few times first (.promptwheel/outcomes.jsonl)');
-  const runs = readFileSync(f, 'utf8').split('\n').filter(Boolean).map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
-  const agg = {};
-  for (const r of runs) for (const m of (r.metrics || [])) {
-    const a = agg[m.name] ??= { runs: 0, improved: 0, regressed: 0, inconclusive: 0, unchanged: 0, net: 0, last: null };
-    a.runs++; if (a[m.status] != null) a[m.status]++;
-    if (typeof m.delta === 'number') a.net = +(a.net + m.delta).toFixed(6);
-    a.last = m.after;
-  }
-  // "lever score" = how reliably acting on this metric yields a real improvement
-  const rows = Object.entries(agg).map(([name, a]) => ({ name, ...a, lever: a.runs ? a.improved / a.runs : 0 }))
-    .sort((x, y) => y.lever - x.lever);
-  if (args.json) { console.log(JSON.stringify({ runs: runs.length, metrics: rows }, null, 2)); return; }
-  console.log(`\nPromptWheel insights, ${runs.length} gated runs recorded\n`);
-  console.log(`  ${'metric'.padEnd(18)} ${'runs'.padStart(5)} ${'impr'.padStart(5)} ${'regr'.padStart(5)} ${'inconc'.padStart(6)} ${'net Δ'.padStart(9)}  lever`);
-  for (const r of rows) {
-    console.log(`  ${r.name.padEnd(18)} ${String(r.runs).padStart(5)} ${String(r.improved).padStart(5)} ${String(r.regressed).padStart(5)} ${String(r.inconclusive).padStart(6)} ${String(r.net).padStart(9)}  ${(r.lever * 100).toFixed(0)}%`);
-  }
-  console.log('\n  lever = improved/runs, how reliably this metric actually responds. The');
-  console.log('  highest-lever metrics are where an agent loop should spend its attempts.\n');
-}
-
 // ---------------------------------------------------------------------------
 // init, write a starter config so a newcomer isn't staring at a blank page
 // ---------------------------------------------------------------------------
 const LINT_CMD = 'npx eslint . -f unix 2>/dev/null | grep -c " error " || true';
 const PRESETS = {
-  'tests-pass': { desc: 'gate: your test suite still passes (command auto-detected)', metrics: null },
-  'lint': { desc: 'track: lint error count does not climb',
-    metrics: [{ name: 'lint_errors', cmd: LINT_CMD, extract: 'number', direction: 'down', guard: false }] },
-  'bundle-size': { desc: 'track: build output size in kB',
-    metrics: [{ name: 'bundle_kb', cmd: 'du -sk dist 2>/dev/null | cut -f1 || echo 0', extract: 'number', direction: 'down', guard: false }] },
-  'security': { desc: 'gate: security-invariant violations must not climb (CORS, secrets, cookies, payment; see packs/security)',
-    metrics: [{ name: 'security_findings', cmd: 'node packs/security/scan.mjs .', extract: 'number', direction: 'down', guard: true }] },
-  'llm-eval': { desc: 'gate: AI-feature eval pass-rate + est $/run (see examples/reliability-sprint)',
-    metrics: [
-      { name: 'eval_pass_rate', cmd: 'node eval.mjs', extract: 'number', direction: 'up', guard: true },
-      { name: 'cost_per_run_usd', cmd: 'node estimate-cost.mjs', extract: 'number', direction: 'down', guard: true },
-    ] },
   'antihack': { desc: 'catch reward-hacking: a target + tripwires; pairs with `run --detect-gaming` (source-only re-run)',
     metrics: [
       { name: 'tests_pass', cmd: '__TESTCMD__', extract: 'exit', direction: 'pass', guard: true },
@@ -1017,21 +919,6 @@ const PRESETS = {
     ] },
 };
 
-// security-antihack = the security-invariant findings gate + the SAME antihack tripwires
-// (so an agent that suppresses a security rule, # noqa / # nosec / eslint-disable, or
-// skips a security test is caught), PLUS a starter `evaluatorPaths` that protects common
-// security-gate config files (a ruleset or a budget the agent could otherwise loosen to
-// pass). The scanner pack installs into `.promptwheel/` (already evaluator-protected). It
-// is the "guard the guards" preset: pairs with --detect-gaming so a win that only moved by
-// loosening the security gate, not by fixing the code, is GAMED. Blind spot (by design,
-// not this tool's job): a source-resident backdoor that behaves safely only under test;
-// that needs held-out/behavioral analysis, not a source-only re-run.
-PRESETS['security-antihack'] = {
-  desc: 'gate security-invariant findings + antihack tripwires + evaluatorPaths so an agent cannot loosen the security gate to pass it (pairs with --detect-gaming)',
-  evaluatorPaths: ['.semgrep.yml', '.semgrep.yaml', '.bandit', 'bandit.yaml', '.ruff.toml', 'ruff.toml', '.snyk', 'security-budget.json'],
-  metrics: [{ name: 'security_findings', cmd: 'node packs/security/scan.mjs .', extract: 'number', direction: 'down', guard: true }, ...PRESETS.antihack.metrics.slice(1)],
-};
-
 function detectTestCmd(repo) {
   const has = (f) => existsSync(join(repo, f));
   if (has('go.mod')) return 'go test ./...';
@@ -1104,10 +991,9 @@ function init(argv) {
   if (presetName) {
     const p = PRESETS[presetName];
     if (!p) die(`unknown preset "${presetName}", try: promptwheel init --list`);
-    evaluatorPaths = p.evaluatorPaths;   // a preset may ship a starter evaluator allowlist (e.g. security-antihack)
+    evaluatorPaths = p.evaluatorPaths;   // a preset may ship a starter evaluator allowlist (supply-chain: the contract)
     mandates = p.mandates; allowTrailer = p.allowTrailer;               // a preset may ship hard rules (supply-chain: workflows, registries, publish scripts, hooks)
-    metrics = p.metrics || [{ name: 'tests_pass', cmd: detectTestCmd(repo), extract: 'exit', direction: 'pass', guard: true }];
-    metrics = metrics.map((m) => m.cmd === '__TESTCMD__' ? { ...m, cmd: detectTestCmd(repo) } : m); // fill the preset's target
+    metrics = p.metrics.map((m) => m.cmd === '__TESTCMD__' ? { ...m, cmd: detectTestCmd(repo) } : m); // fill the preset's target
     // pack-backed presets: the referenced scripts live in THIS package, not
     // the user's repo, copy them in so the generated config is
     // self-contained and committable (a bare reference silently 404'd)
@@ -1123,8 +1009,7 @@ function init(argv) {
       const files = readdirSync(src);
       for (const f of files) copyFileSync(join(src, f), join(dst, f));
       console.log(`  ✓ installed ${pk[2]} → .promptwheel/${pk[2]} (commit it with the config)`);
-      // the gate measures in clean worktrees, so a pack that git ignores (common: the outcome
-      // record lives in .promptwheel/ too) is absent at both refs and the metric reads
+      // the gate measures in clean worktrees, so a pack that git ignores is absent at both refs and the metric reads
       // unmeasurable, failing the guard with no hint why. Say so now, while it is one edit.
       if (files.length && gitIgnores(repo, `.promptwheel/${pk[2]}/${files[0]}`))
         console.log(`  ⚠ .promptwheel/${pk[2]} is gitignored: the gate measures in clean worktrees, so an ignored pack is absent at both refs and ${m.name} reads unmeasurable (the guard fails). Replace ".promptwheel/" in .gitignore with ".promptwheel/*" and "!.promptwheel/packs/", then commit the pack`);
@@ -1154,7 +1039,7 @@ function init(argv) {
     if (wrote.length) console.log(`✓ wrote the agent guide (when to run the gate) to ${wrote.join(', ')}`);
   }
   console.log('\n  next:  promptwheel run --working   # gate your uncommitted changes');
-  console.log('         promptwheel init --list     # other presets (llm-eval, bundle-size, …)');
+  console.log('         promptwheel init --list     # other presets (antihack, no-ai-tells, supply-chain)');
 }
 
 // Write (or refresh) a short agent-orienting block so the coding AGENT runs the gate itself, not just
@@ -1177,34 +1062,6 @@ function writeAgentBlock(repo) {
   return done;
 }
 
-// observability: list the EFFECTIVE guardrails (incl. inherited) + each one's flag record
-function guards(argv) {
-  const args = parseArgs(argv);
-  const repo = repoRoot(process.cwd());
-  const cfg = loadConfig(repo);
-  const hist = {};
-  const f = join(repo, '.promptwheel', 'outcomes.jsonl');
-  if (existsSync(f)) for (const line of readFileSync(f, 'utf8').split('\n').filter(Boolean)) {
-    let r; try { r = JSON.parse(line); } catch { continue; }
-    for (const m of (r.metrics || [])) {
-      const h = hist[m.name] ??= { runs: 0, flagged: 0, last: null };
-      h.runs++; if (m.guard && m.ok === false) h.flagged++; h.last = m.status;
-    }
-  }
-  const rows = cfg.metrics.map((m) => ({
-    name: m.name, direction: m.direction || 'up', guard: !!m.guard,
-    source: m.__src, override: !!m.__override, ...(hist[m.name] || { runs: 0, flagged: 0, last: null }),
-  }));
-  if (args.json) { console.log(JSON.stringify({ guards: rows }, null, 2)); return; }
-  console.log('\nPromptWheel guardrails, effective set for this repo\n');
-  for (const r of rows) {
-    const prov = r.override ? 'local override' : (r.source === 'local' ? 'local' : `inherited ← ${r.source}`);
-    const rec = r.guard ? (r.runs ? `· ${r.flagged} flagged / ${r.runs} runs` : '· no runs yet') : '';
-    console.log(`  ${r.guard ? '🛡️  GUARD' : '·   info '}  ${r.name.padEnd(18)} better=${r.direction.padEnd(5)}  [${prov}]  ${rec}`);
-  }
-  console.log('\n  🛡️ = enforced (a trusted regression fails the gate) · info = tracked only\n');
-}
-
 const short = (repo, ref) => { try { return git(['rev-parse', '--short', ref], repo); } catch { return ref; } };
 
 function printHuman(r) {
@@ -1224,7 +1081,7 @@ function printHuman(r) {
   console.log(`\n  VERDICT: ${r.verdict.toUpperCase()}${r.verdict === 'fail' ? failReason : r.verdict === 'gamed' ? ', a metric "improved" by editing the goalposts, not the source' : r.verdict === 'inconclusive' ? ', a guard is inert (measured nothing); a pass cannot be certified' : ''}`);
   if (r.verdict === 'fail' && r.mandates) console.log('  a mandate is a hard rule; if the change is truly intended, edit the mandate in promptwheel.config.json (a tracked, tamper-evident change), do not work around it');
   else if (r.verdict === 'fail' && r.metrics.some((m) => m.allowable)) console.log(`  intentional? this guard accepts a person's declared reason: promptwheel run --allow "<reason>" passes with the reason on the record (${r.metrics.filter((m) => m.allowable).map((m) => m.name).join(', ')})`);
-  else if (r.verdict === 'fail') console.log('  intentional? loosen that guard locally in promptwheel.config.json (guard:false, or override the inherited metric by name), `promptwheel guards` shows the effective set');
+  else if (r.verdict === 'fail') console.log('  intentional? loosen that guard locally in promptwheel.config.json (guard:false, or override the inherited metric by name)');
   if (r.allowed) console.log(`  ✓ allowed: ${r.allowed.cleared.join(', ')} acknowledged as an intentional change, recorded (Promptwheel-Allow: ${r.allowed.reason})`);
   console.log('');
 }
@@ -1271,13 +1128,13 @@ function renderMarkdown(r) {
     '',
     `\`${r.base} → ${r.head}\` · ${r.mode} mode${r.repeat > 1 ? ` · ×${r.repeat}` : ''}`,
     '',
-    ...(r.mandates ? [r.mandates.map((md) => `> ⛔ **Mandate violated:** \`${md.name}\`${md.reason ? ': ' + md.reason : ''} (touched \`${md.files.join('`, `')}\`)${md.removed ? ' (deleted in this same change; it stays in force for the change that removes it)' : md.edited ? ' (edited in this same change; the version before the change stays in force for the change that edits it)' : ''}`).join('\n'), ''] : []),
+    ...(r.mandates ? [r.mandates.map((md) => `> ⛔ **Protected path touched:** \`${md.name}\`${md.reason ? ': ' + md.reason : ''} (touched \`${md.files.join('`, `')}\`)${md.removed ? ' (deleted in this same change; it stays in force for the change that removes it)' : md.edited ? ' (edited in this same change; the version before the change stays in force for the change that edits it)' : ''}`).join('\n'), ''] : []),
     ...(r.explained ? [...r.explained.map((x) => `> ${x.noted ? 'ℹ️ **Note:**' : '✋ **Needs a look:**'} ${x.what}${x.items ? ': `' + x.items.join('`, `') + '`' : ''}`), ...(r.explained.some((x) => !x.noted && x.allowable) ? ['>', '> To accept this, comment `sawbuck-allow: <your reason>` on this PR and re-run the check.'] : []), ''] : []),
     '| metric | before | after | Δ | status | confidence |',
     '|---|--:|--:|--:|---|---|',
     rows,
     '',
-    r.verdict === 'gamed' ? '> 🚩 A metric "improved" only because the agent edited tests/config/grader, not the source. The win does not survive a source-only re-run.' : r.verdict === 'fail' ? (r.mandates ? '> ⛔ A mandate was violated: a protected path changed. This is a hard rule, enforced before any metric.' : '> ❌ A 🛡️ guarded metric regressed beyond the noise band.') : r.verdict === 'inconclusive' ? '> 🟡 A 🛡️ guarded check is **inert**, it never runs, so nothing was actually verified. Fix its command before trusting a pass.' : '> ✅ No guarded metric regressed.',
+    r.verdict === 'gamed' ? '> 🚩 A metric "improved" only because the agent edited tests/config/grader, not the source. The win does not survive a source-only re-run.' : r.verdict === 'fail' ? (r.mandates ? '> ⛔ A protected path changed. This is a hard rule, enforced before any metric.' : '> ❌ A 🛡️ guarded metric regressed beyond the noise band.') : r.verdict === 'inconclusive' ? '> 🟡 A 🛡️ guarded check is **inert**, it never runs, so nothing was actually verified. Fix its command before trusting a pass.' : '> ✅ No guarded metric regressed.',
     ...(r.gate && r.gate.weakened ? ['', `> 🚩 **Gate weakened:** ${r.gate.weakened.map((w) => `\`${w.name}\` ${w.change === 'guard-removed' ? 'removed' : 'disabled'} (would have ${w.status} at head)`).join('; ')}. The pass was bought by dropping a guard, not by earning it.`] : []),
     ...(r.gate && r.gate.changed ? ['', `> ⚠ **Gate definition changed** in this diff (fingerprint \`${r.gate.fingerprint.base}\` -> \`${r.gate.fingerprint.head}\`): a metric, guard, evaluatorPath or mandate was added, removed or edited. Review the config change with the code.`] : []),
     '',
@@ -1292,12 +1149,10 @@ function parseArgs(argv) {
     else if (argv[i] === '--head') a.head = argv[++i];
     else if (argv[i] === '--repeat') a.repeat = parseInt(argv[++i], 10);
     else if (argv[i] === '--working') a.working = true;
-    else if (argv[i] === '--no-record') a.noRecord = true;
     else if (argv[i] === '--no-auto') a.noAuto = true;
     else if (argv[i] === '--allow') a.allow = argv[++i];
     else if (argv[i] === '--detect-gaming') a.detectGaming = true;
     else if (argv[i] === '--no-detect-gaming') a.detectGaming = false;
-    else if (argv[i] === '--attempt') a.attempt = argv[++i];
     else if (argv[i] === '--json') a.json = true;
     else if (argv[i] === '--markdown') a.markdown = true;
   }
@@ -1351,7 +1206,6 @@ export function verdictExitCode(verdict) {
 //   repeat        number   measurement repeats for the noise band (default: config.repeat ?? 1)
 //   detectGaming  boolean  run the Section 3 source-only re-proof (default: true)
 //   allow         string   a declared override reason (same as --allow / a Promptwheel-Allow: trailer)
-//   record        boolean  append the run to .promptwheel/outcomes.jsonl (default: false)
 export function check(options = {}) {
   // `repo` may name a subdirectory: the gate runs at the toplevel (that is where the config lives
   // and where .promptwheel/ is written), exactly as the CLI does from the same directory
@@ -1376,7 +1230,6 @@ export function check(options = {}) {
     repeat: options.repeat,
     detectGaming: options.detectGaming ?? true,
     allow: options.allow,
-    noRecord: options.record !== true,
   });
 }
 
@@ -1466,67 +1319,21 @@ export function conformsToContract(report) {
   return { ok: errors.length === 0, errors };
 }
 
-// `promptwheel conformance [file.json | -] [--cmd "<command>"]`
-// Self-check a Contract implementation. With a file or stdin, validate that verdict JSON
-// against the Section 2 schema. With --cmd, run the command, then validate its --json
-// stdout (Section 2) AND that its exit code matches the verdict per Section 1. Exit 0 if
-// it conforms, 1 otherwise, listing every problem.
-function conformance(argv) {
-  let cmd = null, src = null;
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] === '--cmd') cmd = argv[++i];
-    else if (argv[i] === '-' || !argv[i].startsWith('-')) src = argv[i];
-  }
-
-  let text, exitCode = null;
-  if (cmd) {
-    try { text = execFileSync('sh', ['-c', cmd], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }); exitCode = 0; }
-    catch (e) {
-      text = (e.stdout || '').toString();
-      exitCode = typeof e.status === 'number' ? e.status : null;
-      if (!text) { console.error(`conformance: command produced no stdout (exit ${exitCode}): ${e.message}`); process.exit(1); }
-    }
-  } else {
-    const file = src && src !== '-' ? src : 0; // fd 0 = stdin
-    try { text = readFileSync(file, 'utf8'); }
-    catch (e) { console.error(`conformance: cannot read ${!src || src === '-' ? 'stdin' : src}: ${e.message}`); process.exit(1); }
-  }
-
-  let report;
-  try { report = JSON.parse(text); }
-  catch (e) { console.error(`conformance: not valid JSON: ${e.message}`); process.exit(1); }
-
-  const { errors } = conformsToContract(report);
-  const problems = [...errors];
-  if (cmd && exitCode !== null && VERDICTS.includes(report.verdict)) {
-    const want = verdictExitCode(report.verdict);
-    if (exitCode !== want) problems.push(`exit code ${exitCode} does not match verdict '${report.verdict}' (Section 1 requires ${want})`);
-  }
-
-  if (problems.length === 0) {
-    console.log(`ok, conforms to the Verified-Outcome Contract v${CONTRACT_VERSION} (verdict: ${report.verdict}${cmd ? `, exit ${exitCode}` : ''})`);
-    process.exit(0);
-  }
-  console.error(`does NOT conform to the Contract (${problems.length} problem${problems.length > 1 ? 's' : ''}):`);
-  for (const p of problems) console.error(`  - ${p}`);
-  process.exit(1);
-}
-
 // the flags each command accepts. An unknown --flag is a usage error (exit 64), never silently
 // ignored: a typo in a CI step must not turn `--no-detect-gaming` into the default gate or `--allow`
 // into nothing, and INTEGRATE.md promises a bad flag exits 64. A flag that takes a value consumes
-// the next argument; anything not starting with `-` (or a bare `-`, stdin for conformance) is positional.
+// the next argument; anything not starting with `-` is positional. --no-record does nothing now that
+// no record is written, and stays accepted because Sawbuck and existing CI steps pass it.
 const GATE_FLAGS = ['--base', '--head', '--repeat', '--working', '--no-record', '--no-auto', '--allow', '--detect-gaming', '--no-detect-gaming', '--json', '--markdown'];
 const COMMAND_FLAGS = {
-  run: GATE_FLAGS, improve: [...GATE_FLAGS, '--attempt'], insights: ['--json'], guards: ['--json'],
-  init: ['--preset', '--list', '--force', '--no-agent-block'], conformance: ['--cmd'], lock: [],
+  run: GATE_FLAGS, init: ['--preset', '--list', '--force', '--no-agent-block'], lock: [],
 };
-const VALUED_FLAGS = new Set(['--base', '--head', '--repeat', '--allow', '--attempt', '--preset', '--cmd']);
+const VALUED_FLAGS = new Set(['--base', '--head', '--repeat', '--allow', '--preset']);
 function checkFlags(cmd, argv) {
   const known = new Set(COMMAND_FLAGS[cmd]);
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
-    if (a === '-' || !a.startsWith('-')) continue;
+    if (!a.startsWith('-')) continue;
     if (!known.has(a)) bad(`promptwheel ${cmd}: unknown flag ${a} (see promptwheel --help)`);
     if (VALUED_FLAGS.has(a)) i++;
   }
@@ -1546,12 +1353,8 @@ function dispatch() {
   const cmd = (rest.includes('--help') || rest.includes('-h')) ? 'help' : first;   // `promptwheel run --help` is a help request, not a gate run
   if (cmd in COMMAND_FLAGS) checkFlags(cmd, rest);
   if (cmd === 'run') run(rest);
-  else if (cmd === 'improve') improve(rest);
   else if (cmd === 'pr-allow') { let c = []; try { c = JSON.parse(readFileSync(0, 'utf8') || '[]'); } catch { /* no comments, no approval */ } process.stdout.write(allowFromComments(c)); }
-  else if (cmd === 'insights') insights(rest);
   else if (cmd === 'init') init(rest);
-  else if (cmd === 'guards') guards(rest);
-  else if (cmd === 'conformance') conformance(rest);
   else if (cmd === 'lock') lock(rest);
   else {
     const help = !cmd || cmd === '--help' || cmd === '-h' || cmd === 'help';
@@ -1568,15 +1371,9 @@ function dispatch() {
       '       exit 2, when a metric only moved by editing tests/config/grader). Use --no-detect-gaming for the bare gate.',
       '  promptwheel run --working                    gate uncommitted changes (incl. newly added files)',
       '  promptwheel run --allow "<reason>"           acknowledge an intentional test/config change (or a `Promptwheel-Allow: <reason>` commit trailer; `Sawbuck-Allow:` is an alias): recorded, not flagged GAMED',
-      '  promptwheel improve --attempt "<cmd>"        run an agent/script; keep only if a metric improved',
-      '                                               exit 0=kept · 1=regression · 2=gamed · 3=plateau/inconclusive (all but 0 reverted) · add --json',
-      '  promptwheel insights [--json]                which metrics actually respond (raw counts from .promptwheel/outcomes.jsonl)',
-      '  promptwheel guards [--json]                  show the effective guardrails (incl. inherited) + flag record',
-      '  promptwheel conformance [file|-] [--cmd C]   check a verdict JSON (or a command) against the Contract (exit 0 = conforms)',
       '',
       'Exit codes: 0 pass · 1 fail (a guarded metric regressed, or a mandate was violated) · 2 gamed · 3 inconclusive · 64 usage or config error (never a verdict).',
       'Integrate (library / conform / shell / MCP): see INTEGRATE.md. Import: `import { check } from \'promptwheel\'`.',
-      'Loop it:  while promptwheel improve --attempt "$AGENT"; do :; done   # stops on plateau/regression',
       'Config:   promptwheel.config.json → { extends?, metrics:[{ name, cmd, direction, extract?, guard? }] }   (or: promptwheel init)',
       '          extends: a path (or array) to a shared base config, repos INHERIT its guardrails; local metrics override by name.',
     ].join('\n'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "promptwheel",
-  "version": "0.7.15",
+  "version": "0.8.0",
   "description": "A deterministic, zero-LLM check for your coding loop. A win must survive a re-run from the agent's source edits alone, so a test that went green by editing the test reads GAMED. Runs in CI or a Claude Code plugin.",
   "type": "module",
   "bin": {

package/packs/security/README.md

@@ -1,62 +0,0 @@
-# PromptWheel security guard-pack
-
-Gate your AI coding loop on **security invariants**, not just tests. When an agent
-writes backend code, "tests pass" says nothing about whether it shipped a CORS
-wildcard, a client-controlled payment amount, or a hardcoded secret. This pack
-adds a `security_findings` metric that must not climb - and because it's a
-PromptWheel metric, the win has to survive `--detect-gaming`: an agent can't
-lower the count by editing the pattern file or a config, only by fixing the code.
-
-## Use it
-
-The pack ships inside the `promptwheel` package, not in your repo, so install it with the
-preset:
-
-```bash
-promptwheel init --preset security            # or --preset security-antihack, which adds the tripwires
-```
-
-`init` copies the pack into `.promptwheel/packs/security/` and writes a `security_findings`
-metric that runs it from there. Commit the pack with the config: the gate measures in clean
-git worktrees, so a pack that is not in git is absent at both refs and the metric reads
-`unmeasurable` (init warns when `.promptwheel/` is gitignored; change that rule to
-`.promptwheel/*` plus `!.promptwheel/packs/`, since git cannot re-include a file under an
-ignored directory). Then gate as usual:
-
-```bash
-promptwheel run --working          # fails if security_findings increased
-```
-
-`pack.json` is the same metric as a config fragment for `extends`
-(`{ "extends": ["packs/security/pack.json"] }`); its command is relative to a repo that
-holds the pack at `packs/security/`, such as a vendored copy or this repository.
-
-A finding-count that drops because you fixed the code is a `PASS`; a "fix" that
-only survives with test/config/pattern edits reverted is `GAMED`.
-
-## What it checks (v0.1 - 8 high-precision invariants)
-
-Decanted from [securitychecks](https://securitychecks.ai)' "recommended" tier - 
-the regex-portable subset, chosen for near-zero false positives:
-
-| Invariant | Severity |
-| --- | --- |
-| CORS wildcard origin | P0 |
-| CORS origin reflection | P0 |
-| Insecure session cookie (`secure:false`) | P0 |
-| Payment amount from client input | P0 |
-| Hardcoded secret in a sensitive variable | P0 |
-| NPM token committed in `.npmrc` | P0 |
-| Template autoescape disabled (XSS) | P0 |
-| S3 presigned upload without content validation | P2 |
-
-Each pattern ships with its own false-positive guards (the `exclude` regexes).
-
-## Scope, honestly
-
-This is the **regex-portable** slice. The other ~75 recommended invariants
-(auth-enforcement, authz-revocation, tenant-isolation, dataflow-tainted sinks)
-need an AST + dataflow engine and are a possible follow-up, not part of this
-pack. The point of v0.1 is the architecture: security invariants are
-now a first-class, un-gameable PromptWheel metric. Zero dependencies; the scanner
-is one file (`scan.mjs`).

package/packs/security/pack.json

@@ -1,12 +0,0 @@
-{
-  "$comment": "PromptWheel security guard-pack. Decanted from securitychecks (recommended tier). Use via { \"extends\": [\"packs/security/pack.json\"] } in your promptwheel.config.json. Gates on the count of security-invariant violations (direction: down = lower is better; guard: true = fail if it climbs). Because it's a promptwheel metric, the win must survive --detect-gaming: an agent can't lower the count by editing the pattern file or a config, only by fixing the code.",
-  "metrics": [
-    {
-      "name": "security_findings",
-      "cmd": "node packs/security/scan.mjs .",
-      "extract": "number",
-      "direction": "down",
-      "guard": true
-    }
-  ]
-}

package/packs/security/patterns.json

@@ -1,209 +0,0 @@
-{
-  "pack": "security",
-  "version": "0.1.0",
-  "source": "securitychecks recommended tier (regex-portable subset)",
-  "patterns": [
-    {
-      "id": "DATAFLOW.UNTRUSTED.XSS",
-      "name": "Template Engine Autoescape Disabled",
-      "severity": "P0",
-      "match": "autoescape\\s*:\\s*false",
-      "exclude": [],
-      "message": "Template engine autoescape disabled \u2014 enables stored XSS attacks",
-      "fix": "Enable autoescape or sanitize all user input before rendering",
-      "files": [
-        "**/*.ts",
-        "**/*.js",
-        "!**/__tests__/**",
-        "!**/*.test.*",
-        "!**/*.spec.*",
-        "!**/test/**",
-        "!**/tests/**",
-        "!**/__mocks__/**",
-        "!**/fixtures/**",
-        "!**/www/**",
-        "!**/docs/**",
-        "!**/documentation/**"
-      ]
-    },
-    {
-      "id": "SESSION.INSECURE_COOKIE",
-      "name": "Insecure Session Cookie",
-      "severity": "P0",
-      "match": "secure\\s*:\\s*false",
-      "exclude": [],
-      "message": "Session cookies must have secure and httpOnly flags",
-      "fix": "Verify this is not a false positive",
-      "files": [
-        "**/*.ts",
-        "**/*.js",
-        "**/*.tsx",
-        "**/*.jsx",
-        "!**/__tests__/**",
-        "!**/*.test.*",
-        "!**/*.spec.*",
-        "!**/test/**",
-        "!**/tests/**",
-        "!**/__mocks__/**",
-        "!**/fixtures/**",
-        "!**/e2e/**",
-        "!**/playwright/**",
-        "!**/cypress/**",
-        "!**/test-utils/**",
-        "!**/*.e2e.*",
-        "!**/e2e-*/**"
-      ]
-    },
-    {
-      "id": "AUTHZ.CORS_WILDCARD",
-      "name": "CORS Wildcard Origin",
-      "severity": "P0",
-      "match": "Access-Control-Allow-Origin.*\\*|origin\\s*:\\s*\\*|origin:\\s*true",
-      "exclude": [
-        "!credentials"
-      ],
-      "message": "Wildcard origin with credentials exposes user data",
-      "fix": "Verify this is not a false positive",
-      "files": [
-        "**/*.ts",
-        "**/*.js",
-        "**/*.tsx",
-        "**/*.jsx",
-        "!**/__tests__/**",
-        "!**/*.test.*",
-        "!**/*.spec.*",
-        "!**/test/**",
-        "!**/tests/**",
-        "!**/__mocks__/**",
-        "!**/fixtures/**",
-        "!**/*.tsx",
-        "!**/*.jsx",
-        "!**/components/**"
-      ]
-    },
-    {
-      "id": "AUTHZ.CORS_REFLECT",
-      "name": "CORS Origin Reflection",
-      "severity": "P0",
-      "match": "(?:Access-Control-Allow-Origin|res\\.(?:set|setHeader|header)\\(['\"]Access-Control).*(?:req\\.headers\\.origin|headers\\.get\\(['\"]origin['\"]\\))",
-      "exclude": [],
-      "message": "Reflecting origin is equivalent to wildcard \u2014 validate against allowlist",
-      "fix": "Verify this is not a false positive",
-      "files": [
-        "**/*.ts",
-        "**/*.js",
-        "**/*.tsx",
-        "**/*.jsx",
-        "!**/__tests__/**",
-        "!**/*.test.*",
-        "!**/*.spec.*",
-        "!**/test/**",
-        "!**/tests/**",
-        "!**/__mocks__/**",
-        "!**/fixtures/**"
-      ]
-    },
-    {
-      "id": "PAY.CLIENT_AMOUNT",
-      "name": "Payment Amount From Client",
-      "severity": "P0",
-      "match": "amount.*req\\.body|price.*req\\.body|total.*body\\.amount",
-      "exclude": [
-        "server|database|catalog"
-      ],
-      "message": "Calculate payment amounts server-side, not from client input",
-      "fix": "Verify this is not a false positive",
-      "files": [
-        "**/*.ts",
-        "**/*.js",
-        "**/*.tsx",
-        "**/*.jsx",
-        "!**/__tests__/**",
-        "!**/*.test.*",
-        "!**/*.spec.*",
-        "!**/test/**",
-        "!**/tests/**",
-        "!**/__mocks__/**",
-        "!**/fixtures/**"
-      ]
-    },
-    {
-      "id": "CONFIG.NPMRC_TOKEN",
-      "name": "NPM Token in .npmrc",
-      "severity": "P0",
-      "match": "_authToken=|//registry.*:_auth",
-      "exclude": [
-        "\\$\\{NPM_TOKEN\\}|process\\.env"
-      ],
-      "message": "NPM tokens should come from environment variables",
-      "fix": "Verify this is not a false positive",
-      "files": [
-        "**/*",
-        "!**/__tests__/**",
-        "!**/*.test.*",
-        "!**/*.spec.*",
-        "!**/test/**",
-        "!**/tests/**",
-        "!**/__mocks__/**",
-        "!**/fixtures/**"
-      ]
-    },
-    {
-      "id": "VALID.UPLOAD_NOCHECK",
-      "name": "S3 Presigned Upload Without Content Validation",
-      "severity": "P2",
-      "match": "(?:createPresignedPost|getSignedUrl|PutObjectCommand)\\s*\\(",
-      "exclude": [
-        "ContentType|content-type|Content-Length|content-length|Conditions|conditions",
-        "allowedTypes|fileFilter|mimetype|maxSize|maxFileSize",
-        "@example|Example:|```|description:|guidance",
-        "GetObjectCommand|getObject|HeadObjectCommand|DeleteObjectCommand|download|Download|read|Read",
-        "generateSignedUrl.*get|getSignedUrl.*getObject"
-      ],
-      "message": "S3 presigned upload URL has no content type or size conditions \u2014 any file type/size can be uploaded",
-      "fix": "Add Conditions to presigned POST or ContentType/ContentLength constraints",
-      "files": [
-        "**/*.ts",
-        "**/*.js",
-        "!**/*.tsx",
-        "!**/*.jsx",
-        "!**/components/**",
-        "!**/frontend/**",
-        "!**/public/**",
-        "!**/__tests__/**",
-        "!**/*.test.*",
-        "!**/*.spec.*",
-        "!**/test/**",
-        "!**/tests/**",
-        "!**/__mocks__/**",
-        "!**/fixtures/**"
-      ]
-    },
-    {
-      "id": "SECRETS.HARDCODED",
-      "name": "Hardcoded Secret in Sensitive Variable",
-      "severity": "P0",
-      "match": "(?:const|let|var)\\s+(?:[A-Z_]*(?:SECRET|JWT_SECRET|API_KEY|AUTH_TOKEN|PRIVATE_KEY|SIGNING_KEY|ENCRYPTION_KEY)[A-Z_]*)\\s*=\\s*['\"][^'\"]{8,}['\"]",
-      "exclude": [
-        "process\\.env|import\\.meta\\.env|getenv|\\$\\{|placeholder|changeme|YOUR_|TODO|FIXME|example|EXAMPLE"
-      ],
-      "message": "Secret value hardcoded in source code \u2014 use environment variables",
-      "fix": "Verify this is not a placeholder or example value",
-      "files": [
-        "**/*.ts",
-        "**/*.js",
-        "!**/__tests__/**",
-        "!**/*.test.*",
-        "!**/*.spec.*",
-        "!**/test/**",
-        "!**/tests/**",
-        "!**/__mocks__/**",
-        "!**/fixtures/**",
-        "!**/sample/**",
-        "!**/samples/**",
-        "!**/example/**",
-        "!**/examples/**"
-      ]
-    }
-  ]
-}

package/packs/security/scan.mjs

@@ -1,57 +0,0 @@
-#!/usr/bin/env node
-// PromptWheel security guard-pack scanner — zero-dep.
-// Decanted from securitychecks' "recommended" tier (the regex-portable subset).
-// Emits the count of security-invariant violations to stdout (the metric value).
-// The full AST+dataflow engine (the other 75 recommended patterns) is the follow-up.
-//
-// Usage: node scan.mjs [path]            → prints the finding count (for `promptwheel` metrics)
-//        node scan.mjs [path] --list     → prints each finding (file:line · id · message)
-import { readFileSync, readdirSync, statSync } from 'node:fs';
-import { join, extname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const ROOT = process.argv[2] && !process.argv[2].startsWith('--') ? process.argv[2] : '.';
-const LIST = process.argv.includes('--list');
-const PACK = JSON.parse(readFileSync(join(fileURLToPath(new URL('.', import.meta.url)), 'patterns.json'), 'utf8'));
-
-const SKIP = /(^|\/)(node_modules|\.git|dist|build|\.next|coverage|vendor)(\/|$)/;
-const CODE = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
-const CONFIG_FILES = /(^|\/)\.npmrc$/;
-
-function* walk(dir) {
-  let entries;
-  try { entries = readdirSync(dir); } catch { return; }
-  for (const e of entries) {
-    const p = join(dir, e);
-    if (SKIP.test(p)) continue;
-    let st;
-    try { st = statSync(p); } catch { continue; }
-    if (st.isDirectory()) yield* walk(p);
-    else if (CODE.has(extname(p)) || CONFIG_FILES.test(p)) yield p;
-  }
-}
-
-const findings = [];
-for (const file of walk(ROOT)) {
-  let text;
-  try { text = readFileSync(file, 'utf8'); } catch { continue; }
-  const lines = text.split('\n');
-  for (const pat of PACK.patterns) {
-    let re;
-    try { re = new RegExp(pat.match, 'i'); } catch { continue; }
-    const excludes = (pat.exclude || []).map((x) => { try { return new RegExp(x, 'i'); } catch { return null; } }).filter(Boolean);
-    for (let i = 0; i < lines.length; i++) {
-      const line = lines[i];
-      if (!re.test(line)) continue;
-      if (excludes.some((ex) => ex.test(line))) continue;       // pattern's own false-positive guards
-      findings.push({ file, line: i + 1, id: pat.id, sev: pat.severity, msg: pat.message });
-    }
-  }
-}
-
-if (LIST) {
-  for (const f of findings) console.error(`  [${f.sev}] ${f.file}:${f.line} · ${f.id} · ${f.msg}`);
-  console.error(`\n${findings.length} security-invariant violation(s)`);
-}
-// the metric value: lower is better, 0 is clean
-process.stdout.write(String(findings.length) + '\n');