skalpel 4.0.27 → 4.0.29

package/catches.mjs

@@ -0,0 +1,413 @@
+#!/usr/bin/env node
+// catches.mjs — the RETROACTIVE first-run "wow": `skalpel catches`.
+//
+// THE PROBLEM (same as verify-shadow): your agent is both the executor AND the reporter of its own
+// work. When it says "done / tests pass / fixed" nothing independent re-checks. verify-shadow closes
+// that loop LIVE, but a brand-new user has no live catches yet — so there is no instant aha on install.
+//
+// THIS closes the aha gap by looking BACKWARD: it scans the user's OWN recent coding transcripts
+// (Claude Code ~/.claude/projects/**/*.jsonl and Codex ~/.codex/{sessions,archived_sessions}) and finds
+// REAL past turns where the agent CLAIMED success while its OWN in-transcript proof — the tool_result of
+// the last test/build/lint it ran before the claim — had ALREADY FAILED at claim time. That is a genuine
+// claim-vs-own-evidence mismatch that is verifiable FROM THE TRANSCRIPT ALONE.
+//
+// HARD RED LINES (why this is safe + instant):
+//   • READ-ONLY. It only READS transcripts already on disk. It NEVER re-runs, spawns, builds, writes,
+//     deploys, or mutates anything. Unlike verify-shadow it does NOT execFile a proof — the pass/fail is
+//     the exit status the transcript ALREADY recorded (Claude's tool_result.is_error / Codex's
+//     "Process exited with code N"). So it is instant and cannot break or slow anything.
+//   • LOCAL ONLY. Imports only node: core + local sibling modules. Opens no socket.
+//   • OPT-IN. User-invoked subcommand; prints and exits. The per-turn hook is untouched (byte-identical).
+//   • NO FABRICATED NUMBERS. Every count is a real tally over real transcripts; every example quotes the
+//     real claim text, the real reconstructed proof command, and the real recorded failure output. If it
+//     finds zero, it SAYS zero honestly — it never invents a catch.
+//
+// REUSE: the detection + classification logic is verify-shadow's, applied to historical turns —
+// detectCompletionClaim (is this a "done" claim?), reconstructProofEntry (the most-recent proof the
+// session actually ran before the claim, + the tool_use id to match its result), and classifyOutcome
+// (PASS / GENUINE_FAIL / HARNESS_ERROR — only a GENUINE_FAIL counts as a lie; a timeout / missing-script
+// / wrong-cwd is harness noise and is NEVER surfaced, so we never cry wolf).
+import { readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+import { tailLines } from "./transcript.mjs";
+import {
+  detectCompletionClaim,
+  reconstructProofEntry,
+  classifyOutcome,
+  extractFailCount,
+} from "./verify-shadow.mjs";
+import { recordInsight } from "./insights.mjs";
+
+const HOME = homedir();
+const CLAUDE_PROJECTS = path.join(HOME, ".claude", "projects");
+const CODEX_DIRS = [
+  path.join(HOME, ".codex", "sessions"),
+  path.join(HOME, ".codex", "archived_sessions"),
+];
+
+// Bounds. We look at RECENT sessions (the aha is about YOUR history, and reading every one of tens of
+// thousands of transcripts would be neither instant nor "recent"). Newest-first by mtime, capped, each
+// read as a bounded tail so a multi-GB transcript can never stall or OOM us.
+const MAX_SESSIONS = 600; // most-recent sessions to scan (across both tools)
+const SESSION_TAIL_BYTES = 4 * 1024 * 1024; // per-file tail — plenty for the last many turns
+const MAX_EXAMPLES = 3; // concrete receipts to print
+
+// ---------- (1) discover recent session files (newest first) ----------
+function walkJsonl(dir, pred, out) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return; // dir missing / unreadable — skip (read-only, fail-open)
+  }
+  for (const e of entries) {
+    const p = path.join(dir, e.name);
+    try {
+      if (e.isDirectory()) walkJsonl(p, pred, out);
+      else if (e.isFile() && pred(e.name)) out.push(p);
+    } catch {
+      /* stat/permission hiccup on one entry — skip it */
+    }
+  }
+}
+
+// Return [{ file, tool, mtime }] for the MAX_SESSIONS most-recently-modified transcripts across tools.
+function discoverSessions() {
+  const files = [];
+  const claude = [];
+  walkJsonl(CLAUDE_PROJECTS, (n) => n.endsWith(".jsonl"), claude);
+  for (const f of claude) files.push({ file: f, tool: "claude" });
+  const codex = [];
+  for (const d of CODEX_DIRS) walkJsonl(d, (n) => /^rollout-.*\.jsonl$/.test(n), codex);
+  for (const f of codex) files.push({ file: f, tool: "codex" });
+
+  const withMtime = [];
+  for (const f of files) {
+    try {
+      withMtime.push({ ...f, mtime: statSync(f.file).mtimeMs });
+    } catch {
+      /* vanished between readdir and stat — skip */
+    }
+  }
+  withMtime.sort((a, b) => b.mtime - a.mtime);
+  return withMtime.slice(0, MAX_SESSIONS);
+}
+
+// ---------- (2) load a session as Claude-shaped entries ----------
+// verify-shadow's reconstructProofEntry + claim detection speak the Claude transcript shape
+// (entry.message.content = [{type:'text'|'tool_use'|'tool_result', ...}], entry.cwd). We parse Claude
+// natively and NORMALIZE Codex rollout events into that same shape so ONE code path handles both.
+
+export function loadClaudeEntries(file) {
+  const entries = [];
+  for (const line of tailLines(file, SESSION_TAIL_BYTES)) {
+    try {
+      entries.push(JSON.parse(line));
+    } catch {
+      /* partial/garbage line — skip */
+    }
+  }
+  return entries;
+}
+
+// Codex output wrapper always carries "Process exited with code N" — the recorded exit status, which is
+// exactly the ground truth we need (no re-run). Returns { exitCode:number|null, body:string }.
+function parseCodexOutput(output) {
+  const s = typeof output === "string" ? output : "";
+  const m = s.match(/Process exited with code\s+(-?\d+)/i);
+  const exitCode = m ? parseInt(m[1], 10) : null;
+  // Prefer the text AFTER "Output:" as the evidence body (drops the Command/Chunk/Wall-time header).
+  const oi = s.indexOf("\nOutput:\n");
+  const body = oi >= 0 ? s.slice(oi + "\nOutput:\n".length) : s;
+  return { exitCode, body };
+}
+
+// Normalize one Codex rollout file into Claude-shaped entries. exec_command → a Bash tool_use; its
+// function_call_output → a tool_result carrying the recorded exit code; assistant messages → text.
+export function loadCodexEntries(file) {
+  const entries = [];
+  for (const line of tailLines(file, SESSION_TAIL_BYTES)) {
+    let e;
+    try {
+      e = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (e.type !== "response_item") continue;
+    const p = e.payload || {};
+    if (p.type === "message") {
+      const role = p.role === "assistant" ? "assistant" : "user";
+      const text = Array.isArray(p.content)
+        ? p.content.map((b) => (b && typeof b.text === "string" ? b.text : "")).join("")
+        : "";
+      if (text.trim())
+        entries.push({ type: role, message: { role, content: [{ type: "text", text }] } });
+    } else if (p.type === "function_call" && p.name === "exec_command" && p.call_id) {
+      let cmd = "";
+      let workdir = null;
+      try {
+        const a = JSON.parse(p.arguments || "{}");
+        cmd = typeof a.cmd === "string" ? a.cmd : Array.isArray(a.cmd) ? a.cmd.join(" ") : "";
+        workdir = typeof a.workdir === "string" ? a.workdir : null;
+      } catch {
+        /* unparseable args — leave cmd empty (no proof) */
+      }
+      if (cmd)
+        entries.push({
+          cwd: workdir,
+          message: {
+            role: "assistant",
+            content: [{ type: "tool_use", name: "Bash", id: p.call_id, input: { command: cmd } }],
+          },
+        });
+    } else if (p.type === "function_call_output" && p.call_id) {
+      const { exitCode, body } = parseCodexOutput(p.output);
+      entries.push({
+        message: {
+          role: "user",
+          content: [
+            {
+              type: "tool_result",
+              tool_use_id: p.call_id,
+              is_error: typeof exitCode === "number" ? exitCode !== 0 : false,
+              exit_code: exitCode,
+              content: body,
+            },
+          ],
+        },
+      });
+    }
+  }
+  return entries;
+}
+
+// ---------- (3) index the recorded proof results (no re-run) ----------
+function resultTextOf(block) {
+  const c = block?.content;
+  if (typeof c === "string") return c;
+  if (Array.isArray(c)) return c.map((x) => (typeof x === "string" ? x : x?.text || "")).join(" ");
+  return "";
+}
+
+// tool_use_id -> { isError, exitCode, text } for every tool_result in the session.
+function indexResults(entries) {
+  const idx = new Map();
+  for (const e of entries) {
+    const c = e?.message?.content;
+    if (!Array.isArray(c)) continue;
+    for (const b of c) {
+      if (b && b.type === "tool_result" && b.tool_use_id) {
+        idx.set(b.tool_use_id, {
+          isError: b.is_error === true,
+          exitCode: typeof b.exit_code === "number" ? b.exit_code : null,
+          text: resultTextOf(b),
+        });
+      }
+    }
+  }
+  return idx;
+}
+
+// Reuse verify-shadow's classifyOutcome by synthesizing the `err` object it expects from the RECORDED
+// result (we never ran the process, so there is no live err). This keeps HARNESS_ERROR vs GENUINE_FAIL
+// identical to the live shadow: a timeout / command-not-found / missing-script is harness noise and is
+// NEVER counted as a lie.
+function classifyRecorded({ isError, exitCode, text }) {
+  if (exitCode === 0) return "PASS";
+  if (exitCode == null && !isError) return "PASS"; // no failure signal recorded → treat as pass (never invent)
+  const ev = String(text || "");
+  let err;
+  if (/\btimed?\s*out\b|timeout after|\bSIGKILL\b|\bSIGTERM\b/i.test(ev)) {
+    err = { killed: true, signal: "SIGTERM" }; // classifyOutcome → HARNESS_ERROR
+  } else if (typeof exitCode === "number" && exitCode !== 0) {
+    err = { code: exitCode }; // real recorded non-zero exit (127/126 → HARNESS_ERROR in classifyOutcome)
+  } else {
+    err = { code: 1 }; // Claude is_error with no numeric code → generic non-zero
+  }
+  return classifyOutcome(err, ev);
+}
+
+// ---------- (4) scan one session for genuine claim-vs-proof mismatches ----------
+// For each assistant turn carrying a completion claim, reconstruct the most-recent proof the session ran
+// BEFORE that claim, look up that proof's RECORDED result, and classify it. A GENUINE_FAIL = a caught
+// "done" over its own already-failing test. Dedup by proof tool_use id so repeated "done"s about the
+// same failing run count once.
+function assistantTextOf(entry) {
+  if (entry?.type !== "assistant" && entry?.message?.role !== "assistant") return "";
+  const c = entry?.message?.content;
+  if (typeof c === "string") return c;
+  if (Array.isArray(c))
+    return c
+      .filter((b) => b && b.type === "text")
+      .map((b) => b.text || "")
+      .join(" ")
+      .trim();
+  return "";
+}
+
+export function scanSession(entries, meta = {}) {
+  const catches = [];
+  if (!Array.isArray(entries) || !entries.length) return catches;
+  const results = indexResults(entries);
+  const seenProof = new Set(); // proof tool_use ids already reported in THIS session
+
+  for (let i = 0; i < entries.length; i++) {
+    const text = assistantTextOf(entries[i]);
+    if (!text) continue;
+    const { claim, text: claimText } = detectCompletionClaim(text);
+    if (!claim) continue;
+
+    // The most-recent proof the session actually ran up to and including this claim turn.
+    const found = reconstructProofEntry(entries.slice(0, i + 1), meta.cwd || null);
+    if (!found || !found.toolUseId) continue;
+    if (seenProof.has(found.toolUseId)) continue;
+
+    const res = results.get(found.toolUseId);
+    if (!res) continue; // proof's result not recorded in the scanned window — can't verify, skip honestly
+
+    const outcome = classifyRecorded(res);
+    if (outcome !== "GENUINE_FAIL") continue; // PASS / HARNESS_ERROR are never a caught lie
+
+    seenProof.add(found.toolUseId);
+    const evidence = String(res.text || "")
+      .replace(/\s+$/, "")
+      .slice(-240);
+    catches.push({
+      tool: meta.tool || "claude",
+      session: meta.session || null,
+      claim_text: claimText,
+      proof_command: [found.proof.cmd, ...found.proof.args].join(" ").slice(0, 160),
+      exit_code: res.exitCode,
+      fail_count: extractFailCount(evidence),
+      evidence,
+    });
+  }
+  return catches;
+}
+
+// ---------- (5) run the scan across recent sessions ----------
+export function runScan() {
+  const sessions = discoverSessions();
+  let scanned = 0;
+  const allCatches = [];
+  for (const s of sessions) {
+    let entries;
+    try {
+      entries = s.tool === "codex" ? loadCodexEntries(s.file) : loadClaudeEntries(s.file);
+    } catch {
+      continue; // unreadable file — skip (read-only, fail-open)
+    }
+    if (!entries.length) continue;
+    scanned++;
+    const sessionId = path.basename(s.file, ".jsonl");
+    let found;
+    try {
+      found = scanSession(entries, { tool: s.tool, session: sessionId });
+    } catch {
+      continue; // a single malformed session must never abort the whole scan
+    }
+    for (const c of found) allCatches.push(c);
+  }
+  return { scanned, catches: allCatches };
+}
+
+// ---------- (6) render the honest report ----------
+function clip(s, n) {
+  const t = String(s || "")
+    .replace(/\s+/g, " ")
+    .trim();
+  return t.length > n ? t.slice(0, n - 1) + "…" : t;
+}
+
+export function renderReport({ scanned, catches }) {
+  const N = scanned;
+  const K = catches.length;
+  const L = [];
+  L.push("");
+  L.push("  🔬 skalpel — retroactive claim check (read-only scan of your own coding history)");
+  L.push("  " + "─".repeat(72));
+  if (N === 0) {
+    L.push("");
+    L.push("  No Claude Code or Codex transcripts found on this machine yet.");
+    L.push("  As you code, skalpel watches live — run me again anytime.");
+    L.push("");
+    return L.join("\n");
+  }
+  if (K === 0) {
+    // HONEST zero-state — we do NOT invent a catch.
+    L.push("");
+    L.push(`  skalpel scanned ${N} of your recent sessions and found`);
+    L.push(`  0 times your agent said "done" while its own test/build was already failing.`);
+    L.push("");
+    L.push("  No caught lies in your history — clean. I'll watch live from here:");
+    L.push("  every turn your agent claims done, I check its own proof against the claim.");
+    L.push("");
+    return L.join("\n");
+  }
+
+  const cmds = [...new Set(catches.map((c) => c.proof_command.split(/\s+/).slice(0, 3).join(" ")))];
+  const cmdPhrase = cmds.length === 1 ? `\`${cmds[0]}\`` : "its own test/build";
+  L.push("");
+  L.push(`  skalpel scanned ${N} of your recent sessions and found`);
+  L.push(
+    `  ${K} time${K === 1 ? "" : "s"} your agent said "done" while ${cmdPhrase} was already failing.`,
+  );
+  L.push("");
+  L.push("  Every one is real — pulled straight from your transcript, no re-run needed:");
+  L.push("");
+
+  const top = catches.slice(0, MAX_EXAMPLES);
+  top.forEach((c, i) => {
+    const failN = c.fail_count != null ? ` (${c.fail_count} failing)` : "";
+    L.push(`  ${i + 1}. [${c.tool}]  your agent said:`);
+    L.push(`       "${clip(c.claim_text, 72)}"`);
+    L.push(`     but its own \`${clip(c.proof_command, 64)}\` had just FAILED${failN}:`);
+    L.push(`       ${clip(c.evidence, 72)}`);
+    L.push("");
+  });
+  if (K > top.length) L.push(`  …and ${K - top.length} more.`);
+  L.push("  " + "─".repeat(72));
+  L.push("  That's the gap skalpel closes. From here I check every claim live, as you code.");
+  L.push("");
+  return L.join("\n");
+}
+
+// ---------- CLI ----------
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+
+if (isMain) {
+  try {
+    const result = runScan();
+    process.stdout.write(renderReport(result) + "\n");
+    // MEASURABLE (local only, no network): record the honest fire-frequency for THIS user — how many
+    // recent sessions were scanned and how many genuine catches were found. Never fabricated.
+    try {
+      recordInsight({
+        kind: "catches_scan",
+        display: `retroactive scan: ${result.catches.length} catch(es) across ${result.scanned} sessions`,
+        catches: result.catches.length,
+        sessions: result.scanned,
+      });
+    } catch {
+      /* insight is a bonus */
+    }
+  } catch {
+    // READ-ONLY + fail-open: never throw at the user.
+    process.stdout.write(
+      "\n  🔬 skalpel — could not read your transcript history on this machine.\n\n",
+    );
+  }
+  process.exit(0);
+}

package/insights.mjs

@@ -24,6 +24,12 @@ export const INSIGHTS_PATH = join(DIR, "insights.ndjson");
 // user-visible bar). Both the flag semantics and the file path live HERE — the one light module both the
 // writer and the reader (and the hook's spawn gate) already import — so they can never drift apart.
 export const REVEAL_PATH = join(DIR, "verify-reveal.json");
+// verify-verdict: the POSITIVE half of the same surface — the quiet green "✓ verified" stamp written on
+// a PASS (the agent claimed done and its OWN proof, re-run, really passed). Same writer (verify-shadow.mjs)
+// and reader (skalpel-statusline.mjs), same opt-in flag as the red reveal. Ambient greens are what let the
+// rare red catch land like a thunderclap — without a stream of honest verified stamps a lone red reads as
+// noise, not a verdict. Path single-sourced HERE alongside REVEAL_PATH so writer + reader never drift.
+export const VERDICT_PATH = join(DIR, "verify-verdict.json");
 // SKALPEL_VERIFY_REVEAL is OPT-IN and OFF BY DEFAULT. Unset / "" / "0" / "off" / "false" / "no" → DARK
 // (byte-identical to the shadow-only behavior). Only an explicit truthy value arms the visible reveal.
 export function revealEnabled(env) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.27",
+  "version": "4.0.29",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-setup.mjs

@@ -60,6 +60,8 @@ const KNOWN_SUBS = new Set([
   "logout",
   "uninstall",
   "autopsy",
+  "xray",
+  "catches",
   "__build",
   "__verify-report",
 ]);
@@ -73,6 +75,8 @@ usage:
   skalpel login                                 (re-)run the Google sign-in
   skalpel logout                                clear the saved session
   skalpel autopsy                               local, read-only receipt of your verified patterns
+  skalpel xray                                  re-run your last session's own proof — did "done" hold up?
+  skalpel catches                               scan your own history for "done" claims over failing tests
   skalpel uninstall [--purge]                   remove the hooks + local data from this machine
 
 options:
@@ -432,6 +436,13 @@ function promptLaunch(targets) {
 
 async function reportLiveAndLaunch(message) {
   console.log(message);
+  // FIRST-RUN X-RAY pointer: offer the user their own first catch — an independent re-run of the proof
+  // from the session they just had. A pointer, not an auto-run (an interactive install must never spawn a
+  // 60s test suite unasked); the command itself does the honest work when they choose to run it.
+  console.log(
+    `   ${D}Want to check the session you just had? Run ${X}${B}skalpel xray${X}${D} — I'll re-run your` +
+      ` agent's own proof and tell you if "done" really held up.${X}\n`,
+  );
   await promptLaunch(detectLaunchers());
 }
 
@@ -859,6 +870,14 @@ async function main() {
     spawnSync("node", [join(__dir, "autopsy.mjs"), ...argv.slice(1)], { stdio: "inherit" });
     return;
   }
+  // `skalpel catches` — the RETROACTIVE first-run "wow": a LOCAL, READ-ONLY, ZERO-NETWORK scan of the
+  // user's OWN recent Claude Code + Codex transcripts for real past turns where the agent claimed "done"
+  // while its OWN test/build had already failed in-transcript. Never re-runs anything (the pass/fail is
+  // the exit status already recorded), so it is instant + safe; prints an honest summary (0 if none).
+  if (sub === "catches") {
+    spawnSync("node", [join(__dir, "catches.mjs"), ...argv.slice(1)], { stdio: "inherit" });
+    return;
+  }
   // `skalpel __verify-report` — the claim-verification SHADOW instrument: reads the local
   // verify-shadow.log and prints the three numbers (claim fire-rate, proof-reconstruction rate, and the
   // headline MISMATCH rate = how often the agent claimed done but its OWN proof, re-run, failed).
@@ -867,6 +886,15 @@ async function main() {
     spawnSync("node", [join(__dir, "verify-shadow.mjs"), "--report"], { stdio: "inherit" });
     return;
   }
+  // `skalpel xray` — the FIRST-RUN X-RAY: independently re-run the session you JUST had. Finds your most
+  // recent Claude Code transcript, reconstructs your agent's OWN last proof (test/build/typecheck/lint),
+  // re-runs it once, and stamps it verified or caught. Local, read-only against ~/.claude/projects; the
+  // only thing it executes is your session's own allowlisted proof. Reports a real verdict from a real
+  // re-run — never a minutes-lost tally, never a fabricated number.
+  if (sub === "xray") {
+    spawnSync("node", [join(__dir, "verify-shadow.mjs"), "--xray"], { stdio: "inherit" });
+    return;
+  }
   // Persist --api/--user to ~/.skalpel/client.json so the hooks can read them without shell-env
   // plumbing (env vars SKALPEL_API / SKALPEL_USER still win at hook runtime).
   if (apiFlag || userFlag) {

package/skalpel-statusline.mjs

@@ -11,9 +11,10 @@ import { readFileSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { tailLines } from "./transcript.mjs";
-import { cleanText, REVEAL_PATH, revealEnabled } from "./insights.mjs";
+import { cleanText, REVEAL_PATH, VERDICT_PATH, revealEnabled } from "./insights.mjs";
 
 const CYAN = "\x1b[36m";
+const GREEN = "\x1b[32m";
 const BOLD = "\x1b[1m";
 const DIM = "\x1b[2m";
 const RESET = "\x1b[0m";
@@ -22,6 +23,11 @@ const RESET = "\x1b[0m";
 // wallpapers). verify-shadow.mjs writes the reveal the moment a GENUINE_FAIL mismatch is re-run; it also
 // retracts it if a later proof re-run PASSES. This TTL covers the abandoned case (user moved on).
 const REVEAL_TTL_MS = 90_000;
+// LIVE VERDICT green stamp — the earned "✓ verified" written on a clean PASS. DELIBERATELY short-lived:
+// it flashes right after the claim, then recedes so a stream of greens stays ambient (quiet trust) and
+// never competes with the loud red catch. Short TTL is the whole point — a green that lingers is clutter;
+// a green that blinks by, turn after turn, is what makes the rare red land like a thunderclap.
+const VERDICT_TTL_MS = 20_000;
 
 // Claude Code pipes a JSON status payload on stdin (transcript_path, session_id, …). Read it ONLY when
 // stdin is actually piped — never block on a TTY (manual invocation) where reading fd 0 would hang.
@@ -116,6 +122,30 @@ function revealNote() {
   }
 }
 
+// The LIVE VERDICT green stamp: read the verdict state verify-shadow.mjs wrote on a clean PASS. Returns
+// the plain "✓ verified" line (fresh + honest — the statusline never invents it, it only renders what the
+// re-run recorded) or null. Auto-clears past its short TTL so a stale green never lingers. GATED entirely
+// on SKALPEL_VERIFY_REVEAL: when off, this is never called and the bar is byte-identical to the original.
+function verdictNote() {
+  try {
+    const r = JSON.parse(readFileSync(VERDICT_PATH, "utf8"));
+    if (!r || typeof r.line !== "string" || !r.line.trim()) return null;
+    const age = Date.now() - Date.parse(r.ts);
+    if (!Number.isFinite(age) || age > VERDICT_TTL_MS) {
+      try {
+        rmSync(VERDICT_PATH, { force: true }); // stale → retract so it never lingers
+      } catch {
+        /* best-effort; a leftover verdict still self-expires by TTL on the next read */
+      }
+      return null;
+    }
+    const clean = cleanText(r.line).trim(); // last-line defense: this goes RAW to the live terminal
+    return clean || null;
+  } catch {
+    return null; // no verdict pending, or unreadable → print nothing (fail-open)
+  }
+}
+
 async function main() {
   const payload = readPayload();
 
@@ -128,6 +158,14 @@ async function main() {
       process.stdout.write(`${BOLD}${reveal}${RESET}`);
       return;
     }
+    // No red catch pending → the quiet green half. A fresh PASS stamp shows dim (ambient, not shouting)
+    // for a short beat. Lower priority than the red catch, higher than the re-ask count: it's the most
+    // recent verdict on the last claim, and it's what earns the trust the red catch spends.
+    const verdict = verdictNote();
+    if (verdict) {
+      process.stdout.write(`${DIM}${GREEN}${verdict}${RESET}`);
+      return;
+    }
   }
 
   // Acute + reproducible: the user has re-asked / interrupted repeatedly this stretch. Surface the count

package/verify-shadow.mjs

@@ -27,6 +27,7 @@
 import {
   appendFileSync,
   mkdirSync,
+  readdirSync,
   readFileSync,
   writeFileSync,
   renameSync,
@@ -42,7 +43,7 @@ import { realpathSync } from "node:fs";
 import { tailLines } from "./transcript.mjs";
 // Local sibling modules only (no sockets — RED LINE #4 holds): recordInsight logs the reveal fire for
 // measurement; REVEAL_PATH/revealEnabled are the single-sourced state-file path + opt-in flag.
-import { recordInsight, REVEAL_PATH, revealEnabled } from "./insights.mjs";
+import { recordInsight, REVEAL_PATH, VERDICT_PATH, revealEnabled } from "./insights.mjs";
 
 const DIR = join(homedir(), ".skalpel");
 export const VERIFY_LOG_PATH = join(DIR, "verify-shadow.log");
@@ -424,11 +425,13 @@ function deniedToolUseIds(entries) {
   return denied;
 }
 
-// reconstructProof(entries, cwd) -> { cmd, args, cwd } | null
-// The MOST RECENT test/build/typecheck/lint command the session actually ran. Scans newest→oldest; the
+// reconstructProofEntry(entries, cwd) -> { proof:{cmd,args,cwd}, toolUseId, command } | null
+// The MOST RECENT test/build/typecheck/lint command the session actually ran, WITH the id of the
+// tool_use it came from (so a caller can match it back to its recorded tool_result — the retroactive
+// `skalpel catches` scanner reads that stored result INSTEAD of re-running). Scans newest→oldest; the
 // entry's own recorded cwd is the base (a `cd` inside the command still overrides it). SHARP-3: a
 // command the user DENIED (never ran) is skipped — we only re-run what the session actually executed.
-export function reconstructProof(entries, cwd) {
+export function reconstructProofEntry(entries, cwd) {
   const list = Array.isArray(entries) ? entries : [];
   const denied = deniedToolUseIds(list);
   for (let i = list.length - 1; i >= 0; i--) {
@@ -441,30 +444,41 @@ export function reconstructProof(entries, cwd) {
       const id = cmds[k].id;
       if (id ? denied.has(id) : denied.size > 0) continue;
       const proof = parseCommandForProof(cmds[k].command, cmds[k].cwd || cwd);
-      if (proof) return proof;
+      if (proof) return { proof, toolUseId: id || null, command: cmds[k].command };
     }
   }
   return null;
 }
 
+// reconstructProof(entries, cwd) -> { cmd, args, cwd } | null — thin wrapper over reconstructProofEntry
+// (the live shadow re-runner only needs the proof itself, not the originating tool_use id).
+export function reconstructProof(entries, cwd) {
+  const found = reconstructProofEntry(entries, cwd);
+  return found ? found.proof : null;
+}
+
 // Classify a re-run into PASS / GENUINE_FAIL / HARNESS_ERROR. This is what keeps the money metric HONEST:
 // only a GENUINE_FAIL (the test/build itself ran and reported failure) may count as "the agent lied".
 // A HARNESS_ERROR (timeout, missing binary/script, wrong cwd — the PROOF machinery broke, not the code)
 // must NEVER be shown as a lie. Real-data measurement showed 6/6 raw "mismatches" were harness noise
 // (a 3-min lint timeout, a missing lint script, a wrong-cwd eslint) — counting those would cry wolf and
 // burn the whole point of an honesty product.
-function classifyOutcome(err, evidence) {
+export function classifyOutcome(err, evidence) {
   if (!err) return "PASS";
   if (err.killed || err.signal === "SIGTERM") return "HARNESS_ERROR"; // hit the timeout
   if (err.code === "ENOENT") return "HARNESS_ERROR"; // binary/cwd does not exist
   const exit = typeof err.code === "number" ? err.code : null;
   if (exit === 127 || exit === 126) return "HARNESS_ERROR"; // command not found / not executable
+  // The proof harness/environment is broken, not the work: a missing script, a `command not found`, or a
+  // tool binary/runtime that simply isn't installed (a Playwright browser not downloaded — "Executable
+  // doesn't exist" / "download new browsers"). Surfacing any of these would cry wolf on setup state, so
+  // they are HARNESS_ERROR, never counted as a lie.
   if (
-    /\bno such file or directory\b|\bENOENT\b|\bcommand not found\b|missing script|no [a-z:-]{1,24} script|npm err!.*missing script/i.test(
+    /\bno such file or directory\b|\bENOENT\b|\bcommand not found\b|missing script|no [a-z:-]{1,24} script|npm err!.*missing script|executable doesn'?t exist|download new browsers/i.test(
       String(evidence || ""),
     )
   )
-    return "HARNESS_ERROR"; // the proof harness itself is broken, not the work
+    return "HARNESS_ERROR";
   return "GENUINE_FAIL"; // a real non-zero exit from the test/build/lint itself
 }
 
@@ -710,12 +724,52 @@ function clearReveal() {
   }
 }
 
+// ---- the POSITIVE half: the quiet green VERDICT STAMP (LIVE VERDICT). On a PASS (claim + the session's
+// OWN proof re-run really exited 0) we write a dim-green "✓ verified" stamp the statusline renders for a
+// short beat. HONESTY: every token traces to the real run — the real reconstructed proof command and the
+// literal fact that its process exited 0. NO number is shown here (a pass has no count to invent). The
+// ambient stream of these earned greens is what makes the rare red catch feel like a verdict, not noise.
+
+// buildVerdictLine(row) → the plain-text green stamp (no ANSI — the statusline styles + re-sanitizes).
+export function buildVerdictLine(row) {
+  const proof = clipText(row.proof_command, 48) || "its own proof";
+  return `✓ skalpel verified — re-ran \`${proof}\`, exit 0. It's real.`;
+}
+
+// writeVerdict(row) — atomic write of the green-stamp state file the statusline reads. Best-effort.
+function writeVerdict(row) {
+  try {
+    mkdirSync(DIR, { recursive: true });
+    const rec = {
+      ts: row.ts,
+      session: row.session || null,
+      proof_command: row.proof_command,
+      line: buildVerdictLine(row),
+    };
+    const tmp = `${VERDICT_PATH}.tmp`;
+    writeFileSync(tmp, JSON.stringify(rec));
+    renameSync(tmp, VERDICT_PATH); // atomic swap — a concurrent statusline never sees a half write
+  } catch {
+    /* the verdict stamp is a bonus; a write failure must never affect the shadow */
+  }
+}
+
+// clearVerdict() — a fresh RED catch supersedes any lingering green (never show both at once).
+function clearVerdict() {
+  try {
+    rmSync(VERDICT_PATH, { force: true });
+  } catch {
+    /* stale verdict self-expires via the statusline's short TTL anyway */
+  }
+}
+
 // maybeSurfaceReveal(row) — the single opt-in branch. OFF by default → does nothing (fully dark).
 function maybeSurfaceReveal(row) {
   try {
     if (!revealEnabled(process.env)) return; // SKALPEL_VERIFY_REVEAL unset/off → dark, no-op
     if (row.outcome === "GENUINE_FAIL" && row.mismatch === true) {
       writeReveal(row);
+      clearVerdict(); // a real catch overrides any stale green — never show a ✓ next to a ✗
       // MEASURABLE: one reveal_shown insight per fire → fire-rate + (later) retention, no fabricated data.
       recordInsight({
         kind: "reveal_shown",
@@ -725,7 +779,15 @@ function maybeSurfaceReveal(row) {
       });
     } else if (row.outcome === "PASS") {
       clearReveal(); // resolved — don't wallpaper a catch the agent already fixed
+      writeVerdict(row); // …and stamp the earned green so the ambient trust-line keeps building
+      recordInsight({
+        kind: "verdict_shown",
+        display: buildVerdictLine(row),
+        proof: row.proof_command,
+        session: row.session || null,
+      });
     }
+    // HARNESS_ERROR / REFUSED: neither a catch nor a clean pass — surface nothing, touch no state file.
   } catch {
     /* reveal surfacing is a bonus; never affect the shadow path */
   }
@@ -883,8 +945,130 @@ export function renderVerifyReport() {
   return L.join("\n");
 }
 
+// ======================= FIRST-RUN X-RAY: `skalpel xray` =======================
+// A one-shot, user-INVOKED replay over the session you JUST had: find your most recent Claude Code
+// transcript, read the agent's last completion claim, reconstruct the session's OWN proof, re-run it
+// once, and stamp it verified or caught. Same engine as the live shadow — the only new thing is finding
+// the newest transcript and printing a human verdict. Explicit invocation IS the opt-in; it re-runs only
+// the session's own allowlisted proof (never anything from prompt/claim CONTENT). It reports ONLY a real
+// verdict from a real re-run — NEVER a minutes-lost tally, never a fabricated number (the banned
+// confession). Local, read-only against ~/.claude/projects; opens no socket. Never throws.
+const CLAUDE_PROJECTS_DIR = join(homedir(), ".claude", "projects");
+
+// newestTranscript() → absolute path of the most-recently-modified *.jsonl under ~/.claude/projects, or
+// null. Bounded: one level of project dirs (Claude's layout), newest mtime wins. Fail-open on any error.
+export function newestTranscript(root = CLAUDE_PROJECTS_DIR) {
+  let best = null;
+  let bestMtime = -Infinity;
+  let dirs;
+  try {
+    dirs = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return null; // no ~/.claude/projects → nothing to x-ray
+  }
+  for (const d of dirs) {
+    if (!d.isDirectory()) continue;
+    const sub = join(root, d.name);
+    let files;
+    try {
+      files = readdirSync(sub);
+    } catch {
+      continue;
+    }
+    for (const f of files) {
+      if (!f.endsWith(".jsonl")) continue;
+      const p = join(sub, f);
+      try {
+        const m = statSync(p).mtimeMs;
+        if (m > bestMtime) {
+          bestMtime = m;
+          best = p;
+        }
+      } catch {
+        /* vanished mid-scan — skip */
+      }
+    }
+  }
+  return best;
+}
+
+// xrayLastSession() → runs the replay and PRINTS the verdict. Returns a small result object (also used by
+// tests). Ansi via the same palette the statusline uses; honest by construction — no derived numbers.
+export async function xrayLastSession({ transcriptPath } = {}) {
+  const RED = "\x1b[38;2;233;38;31m";
+  const GREEN = "\x1b[38;2;124;184;108m";
+  const DIM = "\x1b[2m";
+  const BOLD = "\x1b[1m";
+  const X = "\x1b[0m";
+  const say = (s) => process.stdout.write(s + "\n");
+
+  const tp = transcriptPath || newestTranscript();
+  if (!tp) {
+    say(
+      `\n  ${DIM}No recent Claude Code session found to check (looked in ~/.claude/projects).${X}\n`,
+    );
+    return { status: "no_session" };
+  }
+  const entries = readEntries(tp);
+  if (!entries.length) {
+    say(`\n  ${DIM}Your most recent session had nothing readable to check.${X}\n`);
+    return { status: "empty" };
+  }
+
+  const { claim, text } = detectCompletionClaim(lastAssistantText(entries));
+  say(`\n  ${BOLD}skalpel x-ray${X} ${DIM}· replaying the session you just had${X}`);
+  if (!claim) {
+    // No completion claim in the last turn — nothing was asserted done, so there's nothing to catch.
+    say(
+      `\n  ${DIM}Your agent's last turn didn't claim it was done — nothing to independently verify.${X}\n`,
+    );
+    return { status: "no_claim" };
+  }
+  say(`  ${DIM}claim:${X} "${clipText(text, 72)}"`);
+
+  const proof = reconstructProof(entries, null);
+  if (!proof) {
+    // Honest limit: it claimed done but ran no test/build/typecheck we could re-run out-of-band.
+    say(
+      `\n  ${DIM}It said done, but ran no test/build/typecheck this session — nothing skalpel can` +
+        ` independently re-run. No verdict (and no guess).${X}\n`,
+    );
+    return { status: "no_proof" };
+  }
+  const proofStr = [proof.cmd, ...proof.args].join(" ").slice(0, 120);
+  say(`  ${DIM}re-running its own proof:${X} ${proofStr}${DIM} …${X}`);
+
+  const result = await rerunProof(proof);
+  const outcome = result.outcome || (result.pass ? "PASS" : "GENUINE_FAIL");
+  if (outcome === "PASS") {
+    say(
+      `\n  ${GREEN}✓ verified${X} — re-ran \`${proofStr}\`, exit 0. Your agent's "done" holds up.\n`,
+    );
+    return { status: "pass", proof: proofStr };
+  }
+  if (outcome === "GENUINE_FAIL") {
+    const failN = extractFailCount(result.evidence);
+    const count = failN != null ? ` (${failN} failing)` : "";
+    say(
+      `\n  ${RED}${BOLD}✗ caught${X} — your agent said "${clipText(text, 60)}" but \`${proofStr}\`` +
+        ` just failed${count}. It's not done.`,
+    );
+    if (result.evidence) say(`  ${DIM}real output:${X} ${clipText(result.evidence, 180)}`);
+    say("");
+    return { status: "caught", proof: proofStr, evidence: result.evidence };
+  }
+  // HARNESS_ERROR / REFUSED — the proof machinery broke, NOT the agent's work. Never render this as a
+  // catch (crying wolf on a timeout / missing script / wrong cwd is exactly what kills the trust).
+  say(
+    `\n  ${DIM}Couldn't independently verify — the proof \`${proofStr}\` errored` +
+      `${result.evidence ? ` (${clipText(result.evidence, 120)})` : ""}. Not a catch.${X}\n`,
+  );
+  return { status: "harness_error", proof: proofStr };
+}
+
 // CLI: `node verify-shadow.mjs --run`  → detached worker launched by the per-turn hook.
 //      `node verify-shadow.mjs --report`→ print the instrument (also reachable via `skalpel __verify-report`).
+//      `node verify-shadow.mjs --xray`  → the one-shot FIRST-RUN X-RAY (reachable via `skalpel xray`).
 // Robust main detection (mirrors skalpel-setup.mjs): compare REAL paths, not a hand-built file:// URL —
 // the staged path lives under the home dir, which on macOS/Windows can contain a space that would break
 // `new URL("file://"+path)` and wrongly disable the CLI. Importing this module (tests) never trips it.
@@ -903,6 +1087,10 @@ if (isMain) {
   if (arg === "--report") {
     process.stdout.write(renderVerifyReport() + "\n");
     process.exit(0);
+  } else if (arg === "--xray") {
+    xrayLastSession({ transcriptPath: process.env.SKALPEL_VERIFY_TRANSCRIPT || null })
+      .then(() => process.exit(0))
+      .catch(() => process.exit(0));
   } else if (arg === "--run") {
     recordVerifyShadow({
       transcriptPath: process.env.SKALPEL_VERIFY_TRANSCRIPT || null,