redlinegate 0.0.1

package/scripts/build-digest.mjs

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+// Builds the weekly stakeholder digest from collected telemetry and writes an Adaptive
+// Card payload to stdout (or --out <file>).
+//
+// Microsoft retired Office 365 connectors, so the old `{"text": "..."}` webhook shape no
+// longer delivers. The target is a Power Automate "When a Teams webhook request is
+// received" flow, which expects an Adaptive Card.
+//
+// Env: DATA_DIR (default data), DAYS (default 7), ORG, [OPEN_PRS], [STALE_PRS], [CAPPED],
+//      [DASHBOARD_URL], [SEED_SCORES=data/seed-scores.jsonl]
+
+import { writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { loadRecords, aggregate, noisiestRules, pct } from './lib/metrics.mjs';
+
+const {
+  DATA_DIR = 'data',
+  DAYS = '7',
+  ORG = 'org',
+  OPEN_PRS = '',
+  STALE_PRS = '',
+  CAPPED = '',
+  DASHBOARD_URL = '',
+  SEED_SCORES = 'data/seed-scores.jsonl',
+} = process.env;
+
+const outIndex = process.argv.indexOf('--out');
+const outFile = outIndex === -1 ? null : process.argv[outIndex + 1];
+
+const since = new Date(Date.now() - Number(DAYS) * 86400000).toISOString();
+const { records, problems } = loadRecords(DATA_DIR, since);
+const agg = aggregate(records);
+const noisy = noisiestRules(agg);
+
+// Latest seed score per repo, so the digest reports whether review quality is verified
+// rather than assumed.
+const seedScores = [];
+if (existsSync(SEED_SCORES)) {
+  const latest = new Map();
+  for (const line of readFileSync(SEED_SCORES, 'utf8').split('\n')) {
+    if (!line.trim()) continue;
+    try {
+      const score = JSON.parse(line);
+      latest.set(score.repo, score);
+    } catch {
+      problems.push('seed-scores.jsonl has an unparseable line');
+    }
+  }
+  seedScores.push(...latest.values());
+}
+
+const facts = [
+  { title: 'PRs merged (instrumented)', value: `${agg.prs} across ${agg.repos} repo(s)` },
+  { title: 'PRs with findings', value: `${agg.prsWithFindings} (${pct(agg.prsWithFindings, agg.prs)})` },
+  { title: 'Findings', value: `${agg.findings} — ${agg.blocker} BLOCKER, ${agg.high} HIGH` },
+  { title: 'Acted on (thread resolved)', value: `${agg.resolved} (${pct(agg.resolved, agg.findings)})` },
+  { title: 'Ignored (stale + outdated)', value: `${agg.stale} (${pct(agg.stale, agg.findings)})` },
+  { title: 'Gate exemptions used', value: `${agg.exempted} (${pct(agg.exempted, agg.prs)})` },
+];
+if (OPEN_PRS) {
+  facts.push({
+    title: 'Open PRs',
+    value: OPEN_PRS + (STALE_PRS ? ` — ${STALE_PRS} idle over 7 days` : ''),
+  });
+}
+if (seedScores.length) {
+  const worst = seedScores.reduce((a, b) =>
+    a.totals.blocker_recall <= b.totals.blocker_recall ? a : b
+  );
+  facts.push({
+    title: 'Seed validation (worst repo)',
+    value: `${worst.repo}: BLOCKER recall ${Math.round(worst.totals.blocker_recall * 100)}%, ${worst.totals.false_positives_on_clean} false positive(s)`,
+  });
+}
+
+const topRepos = agg.byRepo.slice(0, 5);
+
+const warnings = [];
+if (agg.prs === 0) warnings.push('No telemetry for this window. The collector may be failing — check redline-collect.');
+if (agg.withoutRuleId > 0) {
+  warnings.push(
+    `${agg.withoutRuleId} finding(s) carried no rule id — per-rule tuning is blind for those repos until the current standards land.`
+  );
+}
+if (agg.unknownRuleIds > 0) warnings.push(`${agg.unknownRuleIds} finding(s) cited a rule id that is not in the catalogue.`);
+if (agg.untagged > 0) warnings.push(`${agg.untagged} finding(s) ignored the output contract entirely — severity is a guess for those.`);
+if (agg.findings > 0 && agg.stale / agg.findings > 0.3) {
+  warnings.push('Over 30% of findings are being ignored. Tune the noisiest rules below before adding new ones.');
+}
+if (seedScores.some((s) => s.totals.blocker_recall < 1)) {
+  warnings.push('At least one pilot repo is below 100% BLOCKER recall on the seed corpus. Do not widen the rollout.');
+}
+if (CAPPED) warnings.push('Search result cap was hit during collection — counts are a lower bound.');
+warnings.push(...problems);
+
+const bullets = (rows) => rows.join('\n');
+
+const card = {
+  type: 'message',
+  attachments: [
+    {
+      contentType: 'application/vnd.microsoft.card.adaptive',
+      contentUrl: null,
+      content: {
+        $schema: 'http://adaptivecards.io/schemas/adaptive-card.json',
+        type: 'AdaptiveCard',
+        version: '1.4',
+        body: [
+          { type: 'TextBlock', size: 'Large', weight: 'Bolder', text: `Redline weekly — ${ORG}` },
+          {
+            type: 'TextBlock',
+            isSubtle: true,
+            spacing: 'None',
+            text: `Last ${DAYS} days · generated ${new Date().toISOString().slice(0, 16)}Z`,
+          },
+          { type: 'FactSet', facts },
+          ...(noisy.length
+            ? [
+                { type: 'TextBlock', weight: 'Bolder', text: 'Noisiest rules (tuning queue)', spacing: 'Medium' },
+                {
+                  type: 'TextBlock',
+                  wrap: true,
+                  text: bullets(
+                    noisy.map(
+                      (r) =>
+                        `- \`${r.id}\` — fired ${r.fired}× across ${r.repos} repo(s), ${Math.round(r.ignoredRate * 100)}% ignored`
+                    )
+                  ),
+                },
+              ]
+            : []),
+          ...(topRepos.length
+            ? [
+                { type: 'TextBlock', weight: 'Bolder', text: 'Most findings', spacing: 'Medium' },
+                {
+                  type: 'TextBlock',
+                  wrap: true,
+                  text: bullets(
+                    topRepos.map((r) => `- ${r.repo}: ${r.findings} (${r.blocker} BLOCKER, ${r.stale} ignored)`)
+                  ),
+                },
+              ]
+            : []),
+          ...(warnings.length
+            ? [
+                { type: 'TextBlock', weight: 'Bolder', color: 'Attention', text: 'Needs attention', spacing: 'Medium' },
+                { type: 'TextBlock', wrap: true, color: 'Attention', text: bullets(warnings.map((w) => `- ${w}`)) },
+              ]
+            : []),
+        ],
+        ...(DASHBOARD_URL
+          ? { actions: [{ type: 'Action.OpenUrl', title: 'Open dashboard', url: DASHBOARD_URL }] }
+          : {}),
+      },
+    },
+  ],
+};
+
+const payload = JSON.stringify(card);
+if (outFile) {
+  writeFileSync(outFile, payload);
+  console.error(`digest written to ${outFile} (${agg.prs} PRs, ${agg.findings} findings, ${warnings.length} warning(s))`);
+} else {
+  process.stdout.write(payload);
+}

package/scripts/build-inbox.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+// Zero-infra engineering inbox: aggregates org PRs into one prioritised static page.
+// Run by workflows/inbox.yml on a schedule, deployed to GitHub Pages.
+//
+// NOTE: this page lists PR titles, authors and repo names. Publish it to a PRIVATE or
+// INTERNAL Pages site only. workflows/inbox.yml refuses to build unless the visibility
+// has been acknowledged.
+//
+// Env: GH_TOKEN (org read), ORG, [OUT=dist], [MAX_PAGES=10]
+
+import { mkdirSync, writeFileSync } from 'node:fs';
+
+const { GH_TOKEN, ORG, OUT = 'dist', MAX_PAGES = '10' } = process.env;
+if (!GH_TOKEN || !ORG) throw new Error('GH_TOKEN and ORG are required');
+
+const api = async (path) => {
+  const res = await fetch(`https://api.github.com${path}`, {
+    headers: { Authorization: `Bearer ${GH_TOKEN}`, Accept: 'application/vnd.github+json' },
+  });
+  if (res.status === 403 && res.headers.get('x-ratelimit-remaining') === '0') {
+    const reset = new Date(Number(res.headers.get('x-ratelimit-reset')) * 1000).toISOString();
+    throw new Error(`rate limited until ${reset}`);
+  }
+  if (!res.ok) throw new Error(`${path}: ${res.status} ${await res.text()}`);
+  return res.json();
+};
+
+// The search API caps at 1000 results (10 pages of 100). Paginate to that ceiling and
+// report when a bucket is truncated rather than silently under-reporting.
+async function search(q) {
+  const items = [];
+  let total = 0;
+  for (let page = 1; page <= Number(MAX_PAGES); page++) {
+    const result = await api(
+      `/search/issues?q=${encodeURIComponent(q)}&per_page=100&page=${page}&sort=updated&order=desc`
+    );
+    total = result.total_count ?? 0;
+    items.push(...(result.items ?? []));
+    if (!result.items?.length || items.length >= total) break;
+  }
+  return { items, total, truncated: total > items.length };
+}
+
+const days = (iso) => Math.floor((Date.now() - new Date(iso)) / 86400000);
+const isoDay = (offsetDays) =>
+  new Date(Date.now() - offsetDays * 86400000).toISOString().slice(0, 10);
+
+const base = `org:${ORG} is:pr is:open draft:false`;
+const buckets = [
+  { label: 'Gate failing', priority: 1, q: `${base} status:failure` },
+  { label: 'Changes requested', priority: 2, q: `${base} review:changes_requested` },
+  { label: 'Awaiting review', priority: 3, q: `${base} review:required` },
+  { label: 'Stale (>7d idle)', priority: 4, q: `${base} updated:<${isoDay(7)}` },
+];
+
+const results = await Promise.all(buckets.map((b) => search(b.q)));
+
+const seen = new Set();
+const rows = [];
+const truncated = [];
+buckets.forEach((bucket, i) => {
+  const { items, total, truncated: cut } = results[i];
+  if (cut) truncated.push(`${bucket.label} (${items.length} of ${total})`);
+  for (const item of items) {
+    if (seen.has(item.id)) continue;
+    seen.add(item.id);
+    rows.push({
+      priority: bucket.priority,
+      label: bucket.label,
+      repo: item.repository_url.split('/').slice(-1)[0],
+      number: item.number,
+      title: item.title,
+      author: item.user?.login ?? '?',
+      age: days(item.created_at),
+      idle: days(item.updated_at),
+      url: item.html_url,
+    });
+  }
+});
+rows.sort((a, b) => a.priority - b.priority || b.idle - a.idle);
+
+const esc = (s) =>
+  String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+const badge = { 1: '#b91c1c', 2: '#c2410c', 3: '#1d4ed8', 4: '#6b7280' };
+const counts = buckets.map((b) => `${b.label}: ${rows.filter((r) => r.label === b.label).length}`).join(' · ');
+
+const html = `<!doctype html><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Redline Inbox — ${esc(ORG)}</title>
+<style>
+  :root{color-scheme:dark}
+  body{font:14px/1.5 system-ui,-apple-system,sans-serif;margin:0;background:#0f1115;color:#e5e7eb;padding:2rem}
+  h1{font-size:1.3rem;margin:0 0 .25rem}h1 span{color:#ef4444}
+  table{border-collapse:collapse;width:100%;max-width:1200px}
+  td,th{padding:.5rem .75rem;border-bottom:1px solid #1f2430;text-align:left;vertical-align:top}
+  th{color:#9ca3af;font-weight:600;font-size:.8rem;text-transform:uppercase;letter-spacing:.04em}
+  a{color:#93c5fd;text-decoration:none}a:hover{text-decoration:underline}
+  .b{border-radius:4px;padding:.1rem .5rem;font-size:.75rem;color:#fff;white-space:nowrap;display:inline-block}
+  .meta{color:#6b7280;font-size:.8rem;margin:.25rem 0 1rem}
+  .warn{background:#7f1d1d;color:#fee2e2;padding:.5rem .75rem;border-radius:6px;max-width:1200px;margin:0 0 1rem}
+  input{background:#151922;border:1px solid #2a3140;color:#e5e7eb;border-radius:6px;padding:.4rem .6rem;width:22rem;margin-bottom:1rem}
+  tr[hidden]{display:none}
+</style>
+<h1><span>Redline</span> Inbox — ${esc(ORG)}</h1>
+<p class="meta">Generated ${new Date().toISOString()} · ${rows.length} PRs need attention · ${esc(counts)}</p>
+${truncated.length ? `<p class="warn">Result cap reached — counts are a lower bound for: ${esc(truncated.join(', '))}</p>` : ''}
+${rows.length === 0 ? '<p class="warn">No rows. Either the org has a clean board, or the token lost access — check the workflow run.</p>' : ''}
+<input id="f" placeholder="Filter by repo, author, or title" autocomplete="off">
+<table>
+<thead><tr><th>State</th><th>PR</th><th>Repo</th><th>Author</th><th>Age</th><th>Idle</th></tr></thead>
+<tbody id="rows">
+${rows
+  .map(
+    (r) => `<tr data-k="${esc(`${r.repo} ${r.author} ${r.title}`.toLowerCase())}">
+<td><span class="b" style="background:${badge[r.priority]}">${esc(r.label)}</span></td>
+<td><a href="${esc(r.url)}">#${r.number} ${esc(r.title)}</a></td>
+<td>${esc(r.repo)}</td><td>${esc(r.author)}</td><td>${r.age}d</td><td>${r.idle}d</td></tr>`
+  )
+  .join('\n')}
+</tbody>
+</table>
+<script>
+  const input = document.getElementById('f');
+  const rows = [...document.querySelectorAll('#rows tr')];
+  input.addEventListener('input', () => {
+    const q = input.value.trim().toLowerCase();
+    for (const row of rows) row.hidden = q !== '' && !row.dataset.k.includes(q);
+  });
+</script>`;
+
+mkdirSync(OUT, { recursive: true });
+writeFileSync(`${OUT}/index.html`, html);
+console.log(`inbox: ${rows.length} rows${truncated.length ? ` (truncated: ${truncated.join(', ')})` : ''}`);

package/scripts/build-registry.mjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// Builds registry.json: the derived register of onboarded repositories.
+//
+// Runs in the Redline source repo on a schedule. The register is DERIVED — it is
+// discovered from .redline.json across the org, never hand-edited, and never written
+// by `redline init`. An entry exists exactly as long as the repository's own file
+// does, so a repository that removes Redline leaves the register on its next run.
+//
+// Requires `npm run build` first: it imports the compiled CLI from dist/.
+//
+// Env: GH_TOKEN (read access to org repos), ORG, SOURCE (owner/name of this repo),
+//      [OUT=registry.json]
+
+import { writeFileSync } from 'node:fs';
+import { createGitHubClient } from '../dist/platforms/github/client.js';
+import { discoverGitHub } from '../dist/registry/discover.js';
+import { serializeRegistry } from '../dist/registry/serialize.js';
+
+const { GH_TOKEN, ORG, SOURCE, OUT = 'registry.json' } = process.env;
+if (!GH_TOKEN || !ORG || !SOURCE) throw new Error('GH_TOKEN, ORG and SOURCE are required');
+
+const client = createGitHubClient({ token: GH_TOKEN });
+const { entries, problems } = await discoverGitHub(client, ORG);
+
+for (const problem of problems) console.warn(`  ${problem}`);
+
+// An empty register is indistinguishable from a token that lost access, and
+// publishing it would erase the dashboard's coverage figure and every sync
+// target at once. Refuse rather than overwrite.
+if (entries.length === 0) {
+  console.error(
+    `No onboarded repositories discovered in ${ORG}. Refusing to write an empty register.`
+  );
+  process.exit(1);
+}
+
+writeFileSync(
+  OUT,
+  serializeRegistry({ generatedAt: new Date().toISOString(), source: SOURCE, entries })
+);
+
+console.log(`${OUT}: ${entries.length} onboarded repositories, ${problems.length} problem(s)`);

package/scripts/build-roi.mjs

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+// Builds the one page a finance stakeholder can read: what AI review cost, and
+// what it caught. Sourced entirely from collected data — nothing on it is typed
+// by hand except the spend figure, which no script can read from a vendor for you.
+//
+// The number that matters is cost per BLOCKER caught. A cost-management tool
+// knows spend and has no findings, so it cannot compute value. A DORA tool has
+// neither. Redline knows which findings were acted on, and joining the two is the
+// entire argument — which is also why every figure here refuses rather than
+// approximates: a made-up number in a finance conversation is not a small error.
+//
+// Env: [DATA_DIR=data], [DAYS=90], [OUT=roi.json], [HTML=roi.html],
+//      [SPEND_TOTAL, SPEND_CURRENCY=USD, SPEND_GRAIN=org, SPEND_SOURCE, SPEND_PERIOD]
+
+import { writeFileSync } from 'node:fs';
+import { aggregate, loadRecords } from './lib/metrics.mjs';
+import { dora } from './lib/dora.mjs';
+import { costPerBlocker, readSpend } from './lib/spend.mjs';
+
+const {
+  DATA_DIR = 'data',
+  DAYS = '90',
+  OUT = 'roi.json',
+  HTML = 'roi.html',
+  SPEND_TOTAL,
+  SPEND_CURRENCY = 'USD',
+  SPEND_GRAIN = 'org',
+  SPEND_SOURCE,
+  SPEND_PERIOD,
+} = process.env;
+
+const windowDays = Number(DAYS);
+const since = new Date(Date.now() - windowDays * 86400000).toISOString();
+
+const { records, problems } = loadRecords(DATA_DIR, since);
+for (const problem of problems) console.warn(`  ${problem}`);
+
+const agg = aggregate(records);
+const delivery = dora(records, { windowDays });
+const spend = readSpend(
+  SPEND_TOTAL
+    ? {
+        total: Number(SPEND_TOTAL),
+        currency: SPEND_CURRENCY,
+        grain: SPEND_GRAIN,
+        source: SPEND_SOURCE,
+        period: SPEND_PERIOD,
+      }
+    : null
+);
+
+// Value is what was ACTED ON, not what was reported. A finding nobody acted on
+// caught nothing, and counting it would let the return be inflated by producing
+// more noise — the exact behaviour the guardrails exist to prevent.
+const blockersActedOn = agg.byRule
+  .filter((r) => r.severity === 'BLOCKER')
+  .reduce((n, r) => n + r.resolved, 0);
+
+const cost = costPerBlocker(spend, blockersActedOn, { scope: spend.grain === 'repo' ? 'repo' : 'org' });
+
+const roi = {
+  generatedAt: new Date().toISOString(),
+  windowDays,
+  review: {
+    pullRequests: agg.prs,
+    repositories: agg.repos,
+    findings: agg.findings,
+    blockerFindings: agg.blocker,
+    blockersActedOn,
+    actedOnRate: agg.findings > 0 ? agg.resolved / agg.findings : null,
+  },
+  delivery,
+  spend,
+  costPerBlockerCaught: cost,
+};
+
+writeFileSync(OUT, `${JSON.stringify(roi, null, 2)}\n`);
+
+const show = (label, value, reason) =>
+  console.log(value === null || value === undefined
+    ? `  ${label.padEnd(32)} not available — ${reason}`
+    : `  ${label.padEnd(32)} ${value}`);
+const pct = (v) => (v === null ? null : `${(v * 100).toFixed(1)}%`);
+
+console.log(`Redline ROI — ${windowDays}-day window\n`);
+console.log('WHAT REVIEW CAUGHT');
+show('pull requests reviewed', agg.prs);
+show('BLOCKER findings raised', agg.blocker);
+show('BLOCKER findings acted on', blockersActedOn);
+show('acted-on rate, all severities', pct(roi.review.actedOnRate), 'no findings in the window');
+
+console.log('\nWHAT IT COST');
+show('AI spend', spend.available ? `${spend.total} ${spend.currency} (${spend.grain} grain, ${spend.source})` : null, spend.reason);
+show('cost per BLOCKER caught', cost.value === null ? null : `${cost.value.toFixed(2)} ${cost.currency}`, cost.reason);
+
+console.log('\nDELIVERY (DORA)');
+show('lead time, median hours', delivery.leadTimeHours.median?.toFixed(1) ?? null, delivery.leadTimeHours.reason);
+show('change failure rate', pct(delivery.changeFailureRate.rate), delivery.changeFailureRate.reason);
+show('deployment frequency, per day', delivery.deploymentFrequency.perDay?.toFixed(2) ?? null, delivery.deploymentFrequency.reason);
+show('mean time to restore', null, delivery.meanTimeToRestore.reason);
+
+if (delivery.changeFailureRate.caveat) console.log(`\n  note: ${delivery.changeFailureRate.caveat}`);
+
+// --- the page -----------------------------------------------------------------
+// The roadmap's exit condition for this piece is a single page a finance
+// stakeholder can read, sourced entirely from collected data. Every unavailable
+// figure prints its reason in place of the number: a dash invites the reader to
+// assume zero, and zero is a claim.
+const esc = (v) =>
+  String(v).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+
+const row = (label, value, reason, note) =>
+  `<tr><th scope="row">${esc(label)}</th><td>${
+    value === null || value === undefined
+      ? `<span class="absent">not available</span><span class="why">${esc(reason ?? '')}</span>`
+      : `<b>${esc(value)}</b>${note ? `<span class="why">${esc(note)}</span>` : ''}`
+  }</td></tr>`;
+
+const html = `<!doctype html><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Redline — what AI review cost, and what it caught</title>
+<style>
+  :root { color-scheme: light dark; --ink:#111; --muted:#666; --line:#e4e4e0; --bg:#fbfbf9; --card:#fff; }
+  @media (prefers-color-scheme: dark) { :root { --ink:#eee; --muted:#999; --line:#2a2a2a; --bg:#121211; --card:#1a1a19; } }
+  * { box-sizing: border-box; }
+  body { margin:0; background:var(--bg); color:var(--ink); font:15px/1.6 ui-sans-serif,system-ui,-apple-system,sans-serif; padding:2.5rem 1.25rem 4rem; }
+  main { max-width: 46rem; margin: 0 auto; }
+  h1 { font-size:1.5rem; letter-spacing:-.02em; margin:0 0 .3rem; }
+  .sub { color:var(--muted); margin:0 0 2rem; }
+  h2 { font-size:.78rem; text-transform:uppercase; letter-spacing:.09em; color:var(--muted); margin:2.2rem 0 .6rem; }
+  section { background:var(--card); border:1px solid var(--line); border-radius:10px; padding:.4rem 1.1rem; }
+  table { width:100%; border-collapse:collapse; }
+  th[scope=row] { text-align:left; font-weight:400; color:var(--muted); padding:.62rem 0; vertical-align:top; }
+  td { text-align:right; padding:.62rem 0; border-bottom:1px solid var(--line); }
+  tr:last-child td, tr:last-child th { border-bottom:0; }
+  th[scope=row] { border-bottom:1px solid var(--line); }
+  b { font-variant-numeric: tabular-nums; font-weight:600; }
+  .absent { color:var(--muted); font-style:italic; }
+  .why { display:block; color:var(--muted); font-size:.76rem; font-style:normal; max-width:26rem; margin-left:auto; line-height:1.45; }
+  .lede { border-left:3px solid var(--ink); padding:.1rem 0 .1rem 1rem; margin:0 0 1.6rem; }
+  footer { color:var(--muted); font-size:.78rem; margin-top:2.5rem; border-top:1px solid var(--line); padding-top:1rem; }
+</style>
+<main>
+  <h1>What AI review cost, and what it caught</h1>
+  <p class="sub">Redline · ${esc(windowDays)}-day window · generated ${esc(roi.generatedAt.slice(0, 10))}</p>
+
+  <p class="lede">Every figure below is computed from collected review outcomes. Where a number
+  is not available it says so and why, rather than showing a zero — a zero is a claim, and an
+  absence is not.</p>
+
+  <h2>What review caught</h2>
+  <section><table>
+    ${row('Pull requests reviewed', agg.prs)}
+    ${row('BLOCKER findings raised', agg.blocker)}
+    ${row('BLOCKER findings acted on', blockersActedOn, null, 'Value is what was acted on, not what was reported. A finding nobody acted on caught nothing.')}
+    ${row('Acted-on rate, all severities', pct(roi.review.actedOnRate), 'no findings in the window')}
+    ${row('Repositories measured', agg.repos)}
+  </table></section>
+
+  <h2>What it cost</h2>
+  <section><table>
+    ${row('AI spend', spend.available ? `${spend.total} ${spend.currency}` : null, spend.reason, spend.available ? `${spend.grain} grain — ${spend.source}` : null)}
+    ${row('Cost per BLOCKER caught', cost.value === null ? null : `${cost.value.toFixed(2)} ${cost.currency}`, cost.reason, cost.value === null ? null : 'Spend divided by BLOCKERs acted on. No cost tool can compute this: it has spend and no findings.')}
+  </table></section>
+
+  <h2>Delivery</h2>
+  <section><table>
+    ${row('Lead time, median hours', delivery.leadTimeHours.median?.toFixed(1) ?? null, delivery.leadTimeHours.reason)}
+    ${row('Change failure rate', pct(delivery.changeFailureRate.rate), delivery.changeFailureRate.reason, delivery.changeFailureRate.caveat)}
+    ${row('Deployment frequency, per day', delivery.deploymentFrequency.perDay?.toFixed(2) ?? null, delivery.deploymentFrequency.reason)}
+    ${row('Mean time to restore', null, delivery.meanTimeToRestore.reason)}
+  </table></section>
+
+  <footer>Sourced from <code>${esc(DATA_DIR)}</code>. The spend figure is supplied by the
+  operator from the assistant vendor's own usage reporting — no script here can read a
+  vendor's billing, and none of it is estimated.</footer>
+</main>
+`;
+
+writeFileSync(HTML, html);
+console.log(`\nWritten to ${OUT} and ${HTML}.`);

package/scripts/check-pins.mjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+// Verifies that every SHA-pinned third-party action still resolves to the tag its
+// trailing comment claims, and reports when a newer release exists.
+//
+//   node scripts/check-pins.mjs            # verify pins, warn on updates available
+//   node scripts/check-pins.mjs --strict   # also fail when an update is available
+//
+// A pin without verification rots: the comment says v3.97.1, the SHA says something
+// else, and nobody notices. This is the only check in the bundle that needs network,
+// so it runs as its own CI job and is allowed to be skipped offline.
+
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const STRICT = process.argv.includes('--strict');
+const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+
+const PINNED = /^\s*-?\s*uses:\s*([\w.-]+\/[\w.-]+)@([0-9a-f]{40})\s*#\s*(\S+)/gm;
+
+const api = async (path) => {
+  const res = await fetch(`https://api.github.com${path}`, {
+    headers: {
+      Accept: 'application/vnd.github+json',
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    },
+  });
+  if (res.status === 403 || res.status === 429) {
+    throw new Error(`rate limited on ${path} — set GH_TOKEN`);
+  }
+  if (!res.ok) throw new Error(`${path}: ${res.status}`);
+  return res.json();
+};
+
+const files = [
+  ...readdirSync(join(ROOT, 'workflows')).map((f) => `workflows/${f}`),
+  ...(existsSync(join(ROOT, '.github/workflows'))
+    ? readdirSync(join(ROOT, '.github/workflows')).map((f) => `.github/workflows/${f}`)
+    : []),
+  'templates/redline.yml',
+].filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
+
+const pins = [];
+for (const file of files) {
+  const body = readFileSync(join(ROOT, file), 'utf8');
+  for (const [, repo, sha, tag] of body.matchAll(PINNED)) pins.push({ file, repo, sha, tag });
+}
+
+if (!pins.length) {
+  console.log('no SHA-pinned third-party actions found');
+  process.exit(0);
+}
+
+let errors = 0;
+let updates = 0;
+
+for (const pin of pins) {
+  try {
+    const ref = await api(`/repos/${pin.repo}/git/ref/tags/${pin.tag}`);
+    // An annotated tag points at a tag object; dereference it to the commit.
+    const resolved =
+      ref.object.type === 'tag'
+        ? (await api(`/repos/${pin.repo}/git/tags/${ref.object.sha}`)).object.sha
+        : ref.object.sha;
+
+    if (resolved !== pin.sha) {
+      console.error(
+        `FAIL ${pin.file}: ${pin.repo}@${pin.sha} is commented as ${pin.tag}, but ${pin.tag} resolves to ${resolved}`
+      );
+      errors += 1;
+      continue;
+    }
+    console.log(`ok   ${pin.repo}@${pin.tag} → ${pin.sha.slice(0, 12)}`);
+
+    const latest = await api(`/repos/${pin.repo}/releases/latest`).catch(() => null);
+    if (latest?.tag_name && latest.tag_name !== pin.tag) {
+      console.warn(`     update available: ${pin.tag} → ${latest.tag_name} (${latest.published_at?.slice(0, 10)})`);
+      updates += 1;
+    }
+  } catch (err) {
+    console.error(`FAIL ${pin.file}: could not verify ${pin.repo}@${pin.tag} — ${err.message}`);
+    errors += 1;
+  }
+}
+
+console.log(`\n${pins.length} pin(s), ${errors} error(s), ${updates} update(s) available`);
+process.exit(errors || (STRICT && updates) ? 1 : 0);