simt-dev 0.2.2 → 0.3.1

package/CHANGELOG.md

@@ -6,6 +6,104 @@ All notable changes to this package are recorded here. The format follows
 
 ## [Unreleased]
 
+## [0.3.1] — 2026-10-18
+
+### Who a change reaches
+
+`simt impact` takes a tracked path or the name of one export. It lists the files that import it, the tests of that closure, the decisions and rules that govern the file, and the last matching CODEOWNERS line. In a workspace it also lists another repository that references an OpenAPI document or a JSON Schema file this change touches. Each list stops at 64 (ADR-096).
+
+### A gate report keeps the failures and counts the passes
+
+`simt gate` compacts a report it knows how to read: TAP, JUnit XML, pytest's junit file, vitest or jest JSON, and `go test -json`. Failures come first, with the name, the assertion and the location. Passing tests are a count. The raw log path is printed. Anything else is printed unchanged (ADR-095).
+
+### A change runs the tests that import it
+
+`simt gate` selects the test files that import a changed file, directly or through other files, and runs only those with the package's own runner. Paths name the change. `--changed` reads the diff. A clean diff runs nothing. Changing `src/resolve/resolve.mjs` in this checkout selects 51 files, the hand-built list, in about 40 ms. The bar is 5 seconds (ADR-094).
+
+### what governs a file is the decision, rule, skill, gate or lesson that names it
+
+`simt why` reads an Affects line as the tokens in backticks, including a line the paragraph wraps onto. A token that is a command, a path, or a glob is an edge. A token that is none of those is printed as `UNRESOLVED-AFFECTS`. Rules, skills, gates and lessons contribute the path lists they already publish. At `4c27514` every one of the sixteen Affects tokens resolves or is reported, and ADR-017 is the only record that names the dispatcher (ADR-093).
+
+### The tests of a file are its importers, its conventional neighbour, and its coverage
+
+`simt tests` lists the tests that exercise a file. An import counts, including one whose specifier is on the next line and a dynamic `import()`. So does the conventional source beside the test, and a coverage record that names both sides. Files that only share commits are a separate list, added with `--cochange`. On 30 hand-labelled files in this checkout every predicted test is in the label. The bar is 0.8 (ADR-092).
+
+### The map ranks the files a task is likely to touch
+
+`simt map` orders the index by the task's words and by the import and call edges around them. It renders paths, exported names, or signatures, inside a byte budget. `simt bench report` prints recall@10: the mean fraction of a mined task's gold files that land in the top 10. On the 20 mined tasks measured here that figure is 55.6%. The bar is 60% (ADR-091).
+
+### The index names the exports and the imports
+
+`simt index` fills symbols and import edges from the blob it already hashes. The built-in extractors are line-oriented, for the languages a map needs, and on the labelled fixtures they recall at least 90% of the exported names for TypeScript, Kotlin, Python and Go. A structural parser is a separate package named by `index.parsers`; with that key absent, nothing is loaded. It writes cache rows and does not edit the repository. A live comparison against tree-sitter is unmeasured (ADR-090).
+
+### The local index is a cache of git blobs
+
+`simt index` rebuilds `.simt-dev/index.sqlite` from `git ls-files`. A blob that has not changed is not read again, and the same blobs produce the same rows. When this Node cannot open `node:sqlite` with FTS5, the same rows are written to `.simt-dev/index.jsonl` instead (ADR-089).
+
+### A marked line is enforced by a checker
+
+A rule line may name a checker with `simt-check`. The projection keeps `Enforced:` and the checker's name, and `simt check` runs the checker. The file-length line is `max-file-lines`: past 400 lines warns, past 1000 fails, and a path is exempt only when `limits.fileLines.generated` names it. A path under `node_modules` is not counted: a committed dependency is not a file this repository wrote, and counting it failed every install of this package. A file-length warning and a checker that is not built yet are reported and do not fail `check` or `sync`. `import-direction` stays in the prose until the module graph exists. Probe compliance is unmeasured (ADR-088).
+
+### A run is evidence for one tree
+
+`simt evidence` prints the runs recorded against the tree on disk. A gate the dispatcher runs appends a line: the command, the exit, a short summary, and a digest of the output. Editing any file changes the tree, so that line no longer applies. `simt evidence check` warns when a commit message says the tests passed and this tree has no passing line, and fails the commit when `gates.evidence` is `block`. `simt hooks install --yes` writes the commit-msg shim only when that setting is present (ADR-087).
+
+### A workspace carries its repeated rules once
+
+`simt shared plan` names the rules every repository in a workspace renders with the same bytes, and where each harness would load that copy. `simt shared install --yes` writes the copy into the user-level file the harness actually reads, and records the ids on each repository's manifest under `shared`. The next `simt sync` drops those rules from the region and names them, with the command that shows each one. `simt doctor` says when the copy is missing or stale, and does not fail the repository for it. The 30 KB estate bar and the bench comparison are unmeasured (ADR-084).
+
+### The region ends with the names of what it kept out
+
+The generated region ends with a `## Disclosure` section: one line per scoped profile, with the patterns and the files it moved to, and one line per installed skill, with its name and the description that says when to open it. The skill body stays in its file. A surface that cannot narrow a profile still carries that profile in the region (ADR-085).
+
+### The stable prefix comes first
+
+Shipped rules lead the region, and the command card follows them, so an edit this repository makes changes only the tail. `simt sync --yes` writes `simt-dev.lock.json` with an input digest and an output digest. `simt check --frozen` fails when the output moves and the inputs did not, and names a stale lock separately (ADR-086).
+
+### Kernel mode packs to the budget the repository declared
+
+`mode: kernel` reads `budget.bytes`, holds back a reserve for the files that load beside the region, and drops rules least-valuable-first until the region fits. Every cut rule is named, with the command that shows it. `full` mode cuts nothing. A repository whose hard rules already exceed the budget is told so, and those rules stay (ADR-083).
+
+### Vulnerability reports
+
+`SECURITY.md` names the two places a report goes: a GitHub issue on this repository, or `security@simt.space`.
+
+## [0.3.0] — 2026-10-17
+
+### The rules and the decisions are readable as MCP resources
+
+A client that wants to browse this tool's rules and rulings had no way to: every answer came back from a tool call with an argument in it. They are addressable now, as one URI per rule and one per decision record, with the byte size each will cost stated up front — the one number a client cannot get without spending the read.
+
+Both resource revisions of the specification were read rather than recalled, and they disagree about the behaviour that decides whether a client retries or gives up: a missing resource is `-32602` on the newest revision and `-32002` on the two older ones, and neither lets a server answer with an empty body. A decision record is redacted on the way out, because a resource travels further than the CLI did (ADR-074).
+
+### A plan is resumed one slice at a time
+
+`simt plan next` returns the next ready slice and only its section. `simt plan done` rewrites that one row, and previews the change unless `--yes` is given. The directories and the table format come from the `plans` key in `simt.json` when a repository sets one; otherwise the tracker template delivered with the tool is used, which reads `docs/plans` and `docs/reviews` (ADR-081, ADR-082). `init` keeps a manifest key it does not write, which is what lets `plans` survive a re-init.
+
+### The rules are enforced at the tool call
+
+Three rules that text does not hold — a `git push`, a `--no-verify`, an edit inside a generated region — are now a decision before the tool call. `simt agent-hooks install` writes one policy into the harnesses that read a hooks file, and keeps every key it does not own. `simt agent-hook` is the entry point those harnesses call (ADR-079).
+
+### A line the repository already proves does not ship
+
+A rule line may say when the repository already proves it. `simt sync` drops that line, and `--explain` names the line and the fact, so a removal is visible rather than silent (ADR-078).
+
+### The region leads with this repository's commands
+
+The projected region opens with the commands this repository actually runs, derived from its committed gates and runner, in both the full projection and kernel mode (ADR-077).
+
+### A change to what an agent reads can be measured
+
+`simt bench mine`, `run`, `report`, `ablate` and `probes` measure a change to projected context against tasks taken from this repository's own history. A change that cannot be run says `unmeasured` in its record rather than implying a result (ADR-076).
+
+### What each reader loads, and a transcript split
+
+`simt harness loaders` reports what each reader loads at session start, in bytes, and what its size cap drops. DeepSeek is one of those readers. `simt tokens --session` splits a local Claude Code or Codex transcript into rules, file reads and tool output.
+
+### A name this tool owns is not reported as a repository
+
+`simt rules why` keeps this tool's own names (`simt-priority`, `simt-hooks`, and the rest) and still redacts a repository the reader cannot open (ADR-080).
+
 ## [0.2.2] — 2026-10-14
 
 ### A repository can ask for a smaller projection
@@ -527,6 +625,8 @@ never ran `simt hooks install` again will find nothing until the dependency is r
 and `simt hooks install --yes` is re-run. That is a real upgrade step and it is called out
 here rather than discovered.
 
+[0.3.1]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.3.1
+[0.3.0]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.3.0
 [0.2.2]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.2.2
 [0.2.1]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.2.1
 [0.2.0]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.2.0

package/README.md

@@ -1,54 +1,115 @@
 # simt-dev
 
-Shared agent rules, skills and git hooks for a repository.
-
-One command adopts a repository: it reads what the repo actually runs, projects the
-matching rules into the files your agent already reads, and installs a pre-commit hook
-that refuses a commit which breaks a gate that repo can genuinely run.
-
-- **Nothing is declared that cannot run.** Every gate is probed against the working tree
-  before it is written. A gate whose tool is absent is dropped, with a remedy naming the
-  package to install — never silently present, never silently absent.
-- **Nothing an agent reads is written twice.** Each rule goes to exactly one place, chosen
-  by what the harness actually reads.
-- **The rules are a projection, not a copy.** They carry markers, so `check` can tell
-  drift from a deliberate edit, and `sync` can regenerate.
-- **The tool explains itself.** `rules why` answers "why did I get told this?" from a
-  numbered record of the decisions behind the rules, with the rejected alternatives
-  attached.
+`simt` adopts a repository for the agents that work in it.
+
+It reads what the repository actually runs, projects the rules that are not already
+obvious into the files those agents read, and installs only the gates that repository
+can run. Around that projection it keeps the bytes stable, replaces an instruction
+with a check where a check can decide, answers questions about the tree from a local
+index, and records whether a run still applies to the tree on disk.
+
+The aim of the whole design is a higher share of tasks resolved, at a lower cost per
+resolved task. Those targets are hypotheses. A change that touches what an agent reads
+ships with a measurement, or its record says the measurement was not run. `simt rules
+why ADR-NNN` prints the record, including whether it is still in force.
+
+The default path is deterministic: no model, no network, no runtime dependencies.
+Anything that needs a parser grammar, a local model, or another server is a separate
+package, off until the repository names it, and it proposes rows or text for a person
+to merge. It does not write the projection.
+
+## Today
+
+```sh
+simt init                 # adopt or scaffold; prints a plan; --yes writes
+simt doctor               # what this repo is, and whether its config is healthy
+simt check                # projection drift, the manifest, and declared checkers
+simt sync --yes           # regenerate the projection
+simt upgrade --yes        # move every pin of this tool to this version
+
+simt rules why ADR-042    # the decision behind a rule, and what was rejected
+simt skills brief --task  # a short brief for one task
+simt tokens               # bytes a reader loads at session start
+simt shared plan          # rules a workspace repeats, and what carrying them once saves
+simt harness loaders      # what each harness loads, and what its cap drops
+
+simt hooks install --yes  # the git dispatcher, for gates this repo can run
+simt agent-hooks install --yes   # the same policy before a tool call
+simt evidence             # runs recorded against this tree
+simt index                # files, exports and imports, from git blob hashes
+simt plan next            # the next tracker row that is ready
+
+simt bench report         # resolved rate, quality, cost, across arms
+simt compare              # every sibling checkout that has adopted
+simt mcp                  # the read-only surface, over stdio
+```
+
+`init`, `sync`, `upgrade`, `hooks install`, `agent-hooks install`, `shared install`
+and `plan done` print a plan and write nothing without `--yes`. None of them commit
+or push. `simt index` writes its cache without asking: the file is gitignored and
+`git ls-files` can rebuild it.
+
+`check` runs the checkers a rule names. A marked line leaves the projection as
+`Enforced:` and the checker's name. The file-length line warns past 400 lines and
+fails past 1000. `simt evidence check` warns when a commit message claims a passing
+run this tree does not have, and the commit fails when `gates.evidence` is `block`.
+The commit-msg hook is installed only when that setting is `warn` or `block`.
+
+## Where the plan finishes
+
+The work above is the part that runs. The plan still adds the rest of the loop, in
+this order of purpose:
+
+- **Gates on the change.** A check selects the tests that cover the diff, and the
+  tool's own gate output is shortened without dropping a failure line.
+- **Answers instead of exploration.** A ranked map of the repository, the impact of
+  a file or a symbol, the tests that cover a change, and the decisions, rules and
+  skills that govern a path. An external code graph can answer for a language it
+  covers, and the answer names that source.
+- **A brief for the task in front of the agent.** At most 2 KB, pulled at submit or
+  pushed by a hook, built from the map, the tests and the governing records.
+- **A memory that has to earn its place.** A lesson is a candidate when a failing run
+  is followed by a fix. It is recalled on a later task that looks like it, and it
+  expires. Variant wording of a rule ships only when the bench says it won.
+- **Local models, off unless asked.** Distillation and a critic propose. They do not
+  write projected text. With no model configured, nothing opens a socket.
+- **The small doors.** One finding code explained, a safe `doctor` fix, a one-line
+  status, an undo journal, a diff of every planned write, shell completions, one
+  ignore list for every harness plus a secret scan, a worktree per slice, a file
+  lease when two agents would edit the same path, and a pull-request body taken from
+  the evidence.
 
 ## Install
 
-Requires **Node >= 22.20.0** (the PyPI install can supply it, see below).
+Requires **Node >= 22.20.0**. The current published release is **0.3.1**. Pin it.
+The tool writes a content digest into the files it generates, and an unpinned upgrade
+changes them under you.
 
 ```sh
-# pinned, per repository - what CI and a teammate both get
-npm i -D simt-dev@0.2.1
+npm i -D simt-dev@0.3.1
 
-# or globally, if you would rather not add a dependency
-npm i -g simt-dev@0.2.1
+# or globally
+npm i -g simt-dev@0.3.1
 
-# or with no install at all, for a one-off
-npx -y simt-dev@0.2.1 check
+# or once, with no install
+npx -y simt-dev@0.3.1 check
 ```
 
 ### From PyPI
 
-The same tool, from the same bytes. The wheel carries the exact contents the npm
-tarball carries — the wheel is not a wrapper around `npm install`, so nothing is
-fetched when you install it.
+The wheel carries the same bytes as the npm tarball. It does not fetch them from npm
+at install time.
 
 ```sh
 pip install simt-dev
 
-# and if this machine has no node at all
+# when this machine has no node
 pip install "simt-dev[node]"
 ```
 
-`simt` is the command on both channels. Where node comes from is resolved in
-this order, and the first one that answers wins: `SIMT_DEV_NODE`, the bundled
-node from the `node` extra, then `node` on your `PATH`. If none of them resolve,
-you get a message naming the remedy rather than a placeholder node path.
+`simt` is the command on both channels. Node is resolved in this order, and the first
+one that answers wins: `SIMT_DEV_NODE`, the node bundled with the `node` extra, then
+`node` on `PATH`.
 
 ### From Homebrew
 
@@ -56,65 +117,58 @@ you get a message naming the remedy rather than a placeholder node path.
 brew install QuazarMedia/homebrew-tap/simt-dev
 ```
 
-The formula declares its own `node` dependency, so `brew install` gives you a
-working command on a machine that has never had Node.
-
-Pin the version. The tool writes a content digest into the files it generates, and an
-unpinned upgrade changes them under you.
+The formula depends on `node`, so the command works on a machine that has never had
+Node installed.
 
-## Use
+## What it writes
 
-```sh
-simt init            # adopt or scaffold this repository (dry-run; --yes to write)
-simt doctor          # what this repo is, and whether its config is healthy
-simt check           # the gate: projection drift, manifest validity, policy
-simt sync --yes      # regenerate the projection
-simt upgrade --yes   # move every consumer of this tool to this version
-simt rules why ADR-042   # why a rule says what it says, and what was rejected
-simt compare         # what changed across every repository that adopted it
-```
+| Path | What |
+| --- | --- |
+| `AGENTS.md` | the projection, between `<!-- simt:begin -->` and `<!-- simt:end -->`. The old `simt-dev:` markers are still read, and a region migrates on its next write |
+| `simt.json` | the manifest: gates, substitutions, budget, shared rules, surfaces |
+| `simt-dev.lock.json` | the digest of the inputs and the digest of the projection |
+| `.cursor/rules/*.mdc`, `.claude/rules/*.md`, `.agents/rules/*.md`, `.github/instructions/*.instructions.md` | one file per rule, and only for a harness that reads that directory |
+| `.editorconfig`, `.gitattributes` | baseline regions, placed first so a later setting still wins |
+| `.simt-hooks/` and `core.hooksPath` | the shared dispatcher. It fails closed |
 
-`init` and `sync` print a plan and write nothing without `--yes`. Neither commits or pushes.
+Text outside the markers is left alone. A regeneration does not revert it.
 
-## What it writes
+These are caches, gitignored, and rebuildable. They are not repository content:
 
 | Path | What |
 | --- | --- |
-| `AGENTS.md` | the projection, between `<!-- simt:begin -->` and `<!-- simt:end -->` (renamed from `simt-dev:`; the old markers are still read, and a region migrates on its next write) |
-| `simt.json` | your manifest: which gates to declare, which substitutions to fill |
-| `.cursor/rules/*.mdc`, `.claude/rules/*.md`, `.agents/rules/*.md`, `.github/instructions/*.instructions.md` | one file per rule, written only for the harnesses that read their own directory |
-| `.editorconfig`, `.gitattributes` | baseline regions |
-| `.simt-hooks/` and `core.hooksPath` | the shared dispatcher, fail-closed |
+| `.simt-dev/index.sqlite` | files, symbols, import edges. JSON-lines at `.simt-dev/index.jsonl` when this Node cannot open `node:sqlite` with FTS5 |
+| `.simt-dev/ledger.jsonl` | one line per gate the dispatcher actually ran, against one git tree |
+| `.simt-dev/bench/runs/` | benchmark runs |
 
-Anything outside the markers is yours. simt-dev never edits it and never reverts it.
+`simt shared install --yes` writes a user-level copy of the rules a workspace
+repeats, into the file that harness documents, and records the ids on each
+repository's manifest. The next `sync` drops those rules from the region and names
+them.
 
-## Platform
+## How a rule is chosen
 
-**macOS and Linux.** The hooks are POSIX `sh`; there is no Windows build and no plan for
-one. `npm i` on Windows fails with npm's `EBADPLATFORM`, which npm will not let a package
-explain — so the answer is here: **use WSL2**, and the gate works normally inside it.
+Detection reads dependency manifests, build files and CI workflows, and ranks rules
+by path, keyword, name, capability and stack. The ranking is a score. A pull request
+can diff it.
 
-A Windows checkout without WSL2 can still read every rule this tool generates, because the
-projection is plain text in `AGENTS.md` and the per-harness rule files. Only the hooks and
-the CI gate need the POSIX host.
+A repository whose ecosystem has no profile yet is still adopted: it gets the core
+rules and no gates, until gate templates exist for it. A hook that would run nothing
+is not installed.
 
-## How the rules are chosen
+Every behaviour that is a choice has a numbered record. `simt rules why <id>` is the
+path from a rule you did not expect to the reason it is there.
 
-Detection reads what the repository runs — its dependency manifests, its build files, its
-CI workflows — and resolves that against a registry of capabilities. Resolution is a
-scored ranking over path, keyword, name, capability and stack: no model, no network, no
-guessing, so a pull request can meaningfully diff the answer.
+## Platform
 
-**Not every ecosystem has a profile yet.** A Go, Rust, .NET, Ruby, Swift, Dart or Elixir
-repository is detected and gets facts, but it is adopted with the core rules and no gates
-until its gate templates are written. A repository with no gates is a repository with an
-agent and no pre-commit hook — better than one with a hook that runs nothing, but not full
-support, and this README will not pretend otherwise.
+**macOS and Linux.** The hooks are POSIX `sh`. There is no Windows build. `npm i` on
+Windows fails with npm's `EBADPLATFORM`, which npm will not let a package explain, so
+the answer is here: **use WSL2**, and the gate works inside it.
 
-Every behaviour that is a choice rather than a detail has a numbered record, and the
-records are readable with `simt rules why <id>`. If the tool ever does something you
-did not expect, that command is the shortest path from the symptom to the reason.
+A Windows checkout without WSL2 can still read the projection. It is plain text. The
+hooks and the CI gate need the POSIX host.
 
 ## Licence
 
-Apache-2.0. See [LICENSE](LICENSE).
+Apache-2.0. See [LICENSE](LICENSE). Report a vulnerability through
+[SECURITY.md](SECURITY.md).

package/bin/simt-dev.mjs

@@ -4,9 +4,8 @@
 // POSIX only (ADR-012). package.json declares os: [darwin, linux], so npm refuses
 // the install elsewhere rather than letting a hook fail obscurely.
 
-import { dispatch } from '../src/commands/index.mjs';
-import { EXIT, fail } from '../src/output/index.mjs';
 import { parse } from '../src/argv.mjs';
+import { EXIT, fail, jsonFailMode, jsonIndentDefault } from '../src/output/index.mjs';
 
 try {
   const argv = process.argv.slice(2);
@@ -22,6 +21,26 @@ try {
     process.exit(fail('no command given', EXIT.USAGE));
   }
 
+  jsonIndentDefault(flags.pretty === true);
+  jsonFailMode(flags.json === true);
+
+  // The one command that runs on somebody else's hot path, and therefore the one that
+  // does not load the registry. `agent-hook` is called before every tool call an agent
+  // makes, so its latency is a product requirement rather than a nicety (plan 0003
+  // R15), and the registry's imports - detection, projection, the bench corpus - cost
+  // tens of milliseconds before the command itself starts. Measured on the machine
+  // this was written on: 127.7 ms through the registry against 91.5 ms with only this
+  // module's imports, where the bare runtime is 86.9 ms of it.
+  //
+  // Only the exact spelling the renderers write takes this path. Anything else -
+  // including `agent-hook --help` - loads the registry, so help stays the one list of
+  // every command and this shortcut cannot become a second, thinner command surface.
+  if (positional[0] === 'agent-hook' && !flags.help && !flags.version) {
+    const { agentHookCommand } = await import('../src/commands/agenthook.mjs');
+    process.exit((await agentHookCommand(positional.slice(1), flags)) ?? EXIT.OK);
+  }
+
+  const { dispatch } = await import('../src/commands/index.mjs');
   process.exit((await dispatch(argv)) ?? EXIT.OK);
 } catch (error) {
   process.exit(fail(error?.message ?? String(error), EXIT.FAIL));

package/docs/decisions/ADR-073-a-kernel-is-a-smaller-projection-the-repository-asks-for.md

@@ -1,6 +1,6 @@
 # ADR-073 — A kernel is a smaller projection the repository asks for, not one it is given
 
-Status: **accepted** · 2026-10-14 · filed as S38 (R07)
+Status: **accepted** · 2026-10-14 · filed as S38 (R07) · ruling 6 narrowed by ADR-084
 **Affects:** `src/projection/manifest.mjs`, `src/projection/rules.mjs`, `src/measure/context.mjs`,
 `rules/core.md`, `rules/stacks/*.md`, `test/kernel.test.mjs`
 

package/docs/decisions/ADR-074-a-rule-and-a-decision-are-readable-by-uri.md

@@ -0,0 +1,99 @@
+# ADR-074 — A rule and a decision are addressable, so they are readable by URI
+
+Status: **accepted** · 2026-10-14 · filed as S43
+**Affects:** `src/mcp/resources.mjs`, `src/mcp/server.mjs`, `test/mcp.test.mjs`
+
+## Context
+
+Review 0002 filed that the MCP server is two protocol revisions behind and returns text
+only. ADR-068 closed the revision half and every tool now declares an output schema and
+annotations. What remained was the other half of the finding: the server has no
+**resources**, so the two things this tool is actually authoritative about — the rules it
+projects and the decisions it settles — are reachable only through a tool call with an
+argument in it.
+
+That matters for a client that wants to browse rather than query. A tool call asks a
+question and gets an answer; a resource is something a client can list, show in a picker,
+attach to a context window and re-read on demand. The CLI already answers both by id
+(`rules show`, `rules why`); what was missing was the addressable form.
+
+So the specification was fetched and read for both revisions rather than recalled, and it
+turned out the two disagree in a way that decides an observable behaviour: **a missing
+resource is `-32602` (Invalid Params) in 2026-07-28 and `-32002` (Resource not found) in
+2025-06-18.** 2026-07-28 keeps `-32002` only as something a *client* should still accept.
+Both revisions forbid an empty `contents` array for a resource that does not exist, because
+empty is ambiguous — it reads as "here is a resource with no body".
+
+Both revisions also require the capability to be declared, and both permit the empty
+object for a server with no subscriptions and no change notifications. The newer one adds
+`ttlMs` and `cacheScope` to resource results, which is why a resource list is cacheable on
+the newest revision and is a bare list on the two older ones — the same rule ADR-068
+already applies to tools.
+
+## Rulings
+
+1. **Two collections and no others: the rules and the decisions.**
+   `simt://rules/{id}` and `simt://decisions/{adr}`. A resource set that grew with the
+   registry would be a second index to keep honest, and the registry is workspace data
+   (ADR-061) — the package ships none of it, so a client browsing this server in one
+   repository and another would see different sets anyway.
+
+2. **The capability is declared unconditionally, as an empty object.** Every rule and every
+   decision record ships with the package, so there is always something to read; and
+   `{}` is the documented way to say "no subscriptions, no change notifications", which
+   are the two things this server has no way to honour. The previous code gated the
+   capability on a property hung on the tools array that nothing ever set — a promise a
+   client waits on forever, only quieter.
+
+3. **A missing resource is an error, and the code is the revision's own.** `-32602` from
+   2026-07-28, `-32002` from the two older revisions, and never an empty `contents`. A
+   client that reads a URI and gets silence cannot tell a bug from an empty rule, and the
+   two revisions disagree about which code that silence should wear.
+
+4. **Every listed resource carries the bytes it will cost.** `size` is in the specification
+   and it is the one number a client cannot get without reading: an agent assembling a
+   context window needs to know what a resource costs before it spends it. This is the
+   same argument as `simt tokens`, arriving at a different surface.
+
+5. **The frontmatter is rebuilt, unprefixed, and the body's own heading is not repeated.**
+   A rule on disk opens with frontmatter this tool's namespace owns (`simt-`); a resource
+   is read by a client that knows nothing about that namespace, so the identity is
+   reconstructed under plain keys. The loader no longer carries the H1, so the title lives
+   in the frontmatter rather than being re-added by hand in two places.
+
+6. **A decision body is redacted on the way out.** `redactInternalPaths(redactEstate(...))`,
+   the same pass the CLI applies. A resource is readable by anyone holding the connection,
+   which is a wider audience than the repository the CLI is aimed at, and a record whose
+   argument names an estate repository should not travel further just because it became
+   addressable.
+
+7. **Every URI is validated, and a rules id cannot contain a slash.** Custom schemes are
+   allowed, which is precisely why the server checks: a URI naming another scheme, a
+   `..` segment, an empty id or a nested path is refused with the same revision-correct
+   error as one that simply does not exist. A refusal that is distinguishable from a miss
+   is a way to probe the filesystem.
+
+## Consequences
+
+`resources/list` answers 97 entries in this checkout — 20 rules, the process rules, and 73
+decision records — and a client can attach any of them without a tool call. The templates
+list publishes the two shapes, so a client can build the URI for an id it has not listed
+yet.
+
+What this does not do: subscribe to a rule changing, because there is no stream to
+subscribe to and the capability says so. That is a feature, not an omission — a client
+that believes it is subscribed to a projection that only changes on `sync` would be
+waiting for an event this tool will never emit.
+
+## Rejected
+
+- **Serving resources only through tool calls.** That is what the server already did, and
+  the finding is that a client cannot browse what it can only ask about.
+- **An empty `contents` array for a URI that does not exist.** Both revisions treat it as
+  ambiguous, and ambiguity here is what makes a client retry forever.
+- **Exposing the registry as resources too.** It is workspace data and this package ships
+  none of it (ADR-061); a resource list that differed per repository would be the
+  same definition-of-one-thing-twice defect, one layer up.
+- **One error code for all three revisions.** `-32602` on the older two would be a code
+  that revision never defined, and `-32002` on the newest would be advice to clients
+  rather than the specification's own answer.

package/docs/decisions/ADR-075-nothing-leaves-the-machine.md

@@ -0,0 +1,56 @@
+# ADR-075 — Nothing leaves the machine: no telemetry, local transcripts, loopback models by default
+
+Status: **accepted** · 2026-10-14 · filed as D7 (R06)
+**Affects:** `src/measure/session.mjs`, `src/measure/context.mjs`, `src/commands/tokens.mjs`, `src/argv.mjs`, `test/tokens.test.mjs`
+
+## Context
+
+The context meter (`simt tokens`) now goes beyond static repository files to inspect
+recorded agent transcripts (`simt tokens --session <path>`), and later slices in the
+research programme connect optional local model servers for embeddings, distillation and
+pre-review critique.
+
+Session transcripts are among the most sensitive files on a developer's machine: they hold
+every file an agent read, every command output it saw, uncommitted diffs, environment
+diagnostics and prompts written in the middle of debugging. A tool that fetched remote
+session URLs, phoned home usage metrics, or defaulted model calls to a hosted endpoint
+would turn a local measurement command into an exfiltration surface.
+
+## Rulings
+
+1. **No command emits telemetry, analytics or background network traffic.** Every command
+   operates over the local filesystem and stdio alone unless the user explicitly invokes a
+   documented network flag in a later adapter.
+
+2. **`simt tokens --session <path>` accepts local filesystem paths only and refuses URLs.**
+   Any argument carrying a URI scheme (`http://`, `https://`, `ws://`, `ssh://` or any
+   `<scheme>://`) is rejected at argument validation with a configuration exit code and a
+   remedy naming a local file path, before any socket or filesystem read is attempted.
+
+3. **Session attribution is computed deterministically in process with zero dependencies.**
+   Transcript JSON and JSONL records from Claude Code and Codex are split into `rules`
+   (system instructions, inline instruction blocks, and reads of instruction, rule or skill
+   files), `fileReads` (reads of repository source and config files) and `toolOutput`
+   (command and tool execution results) by inspecting the local file alone.
+
+4. **Future local-model adapters default to loopback (`127.0.0.1` / `localhost`) and refuse
+   remote hosts unless explicitly overridden.** When no local model is configured in
+   `simt-dev.json`, no socket is opened at all.
+
+## Consequences
+
+`simt tokens --session <path>` can be run safely on production incident transcripts and
+private repositories because the parser cannot open a network connection. And coupling the
+static meter to the harness loader table (`R14`) means `simt tokens` now counts what each
+reader actually loads at session start — flat `.agents/rules/` scans for Antigravity,
+`alwaysApply: true` for Cursor, `@path` imports for Claude Code, and root-to-cwd chain
+caps for Codex — without leaving the machine.
+
+## Rejected
+
+- **Fetching remote session URLs or cloud share links in `simt tokens --session`.** Convenience
+  for a shared link is also an outbound request from a tool whose contract is that it
+  only reads local state.
+- **Anonymous opt-out telemetry for context budget numbers.** Even aggregate byte counts
+  reveal repository names, adoption state and working hours, and an opt-out flag still
+  ships a network client in the default path.