skalpel 4.0.55 → 4.0.56

package/first-run.mjs

@@ -586,7 +586,11 @@ export function assignVariant(home, env = process.env) {
     return forced;
   }
   if (state.variant === "reveal" || state.variant === "holdout") return state.variant;
-  const variant = Math.random() < 0.5 ? "reveal" : "holdout";
+  // DEFAULT: everyone gets the reveal (founder decision 2026-07-14 — "everything off dark, to prod").
+  // The 50/50 holdout A/B is retired for new installs; the SKALPEL_FIRST_RUN_VARIANT override above
+  // still forces either arm (tests / a future re-run of the experiment), and previously-assigned
+  // holdout users keep their recorded arm (the persisted-state branch above) so old data stays clean.
+  const variant = "reveal";
   state.variant = variant;
   state.assigned_at = new Date().toISOString();
   writeState(home, state);

package/insights.mjs

@@ -59,7 +59,7 @@ export function verifyConfigArmed() {
     return null;
   }
 }
-// revealEnabled(env) — is the USER-VISIBLE reveal armed? env override > consented config > default off.
+// revealEnabled(env) — is the USER-VISIBLE reveal armed? env override > consented config > default ON.
 // SKALPEL_VERIFY_SHADOW is deliberately NOT consulted here: it arms only the DARK log-only shadow (no
 // reveal); the spawn gate ORs it in separately (verifySpawnArmed). Wrapped so it can never throw.
 export function revealEnabled(env) {
@@ -67,11 +67,16 @@ export function revealEnabled(env) {
     const envOverride = parseArmToken((env || {}).SKALPEL_VERIFY_REVEAL);
     if (envOverride !== null) return envOverride; // 1) dev/CI env override wins
     const cfg = verifyConfigArmed();
-    if (cfg !== null) return cfg; // 2) consented config
+    if (cfg !== null) return cfg; // 2) consented config (skalpel verify on|off still rules)
   } catch {
     /* fall through to default */
   }
-  return false; // 3) DEFAULT OFF
+  // 3) DEFAULT ON — founder decision 2026-07-14 ("everything off dark, to prod"): the live catch +
+  // reveal ship ARMED out of the box. The safeguards that make this sane are unchanged and still
+  // override this default: `skalpel verify off` (consented config, step 2), the env kill (step 1),
+  // the flake double-confirm before any red, recorded-failure corroboration on Codex, and the
+  // adjudicated auto-darken (precision < 90% over ≥ 10 verdicts silently re-darkens the reveal).
+  return true;
 }
 // verifySpawnArmed(env) — should the per-turn hook SPAWN the detached shadow worker at all? True when the
 // reveal is armed OR the dev log-only shadow (SKALPEL_VERIFY_SHADOW=1) is set. This is the single gate the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.55",
+  "version": "4.0.56",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/verify-safeguards.test.mjs

@@ -37,11 +37,11 @@ beforeEach(() => {
 });
 const writeCfg = (o) => writeFileSync(CLIENT_JSON_PATH, JSON.stringify(o));
 
-// ---- arming resolver precedence: env > config > default off -------------------------------------
-test("arming — default OFF when config absent and env unset", () => {
+// ---- arming resolver precedence: env > config > DEFAULT ON (founder 2026-07-14, off-dark) -------
+test("arming — DEFAULT ON when config absent and env unset (ships armed)", () => {
   assert.equal(verifyConfigArmed(), null);
-  assert.equal(revealEnabled({}), false);
-  assert.equal(verifySpawnArmed({}), false);
+  assert.equal(revealEnabled({}), true);
+  assert.equal(verifySpawnArmed({}), true);
 });
 
 test("arming — consented config on/off", () => {
@@ -59,17 +59,29 @@ test("arming — env override BEATS config in both directions", () => {
   assert.equal(revealEnabled({ SKALPEL_VERIFY_REVEAL: "1" }), true, "env on beats config off");
 });
 
-test("arming — SKALPEL_VERIFY_SHADOW arms the spawn but NOT the reveal", () => {
-  writeCfg({});
-  assert.equal(verifySpawnArmed({ SKALPEL_VERIFY_SHADOW: "1" }), true);
-  assert.equal(revealEnabled({ SKALPEL_VERIFY_SHADOW: "1" }), false);
-});
-
-test("arming — fail-open: a corrupt client.json never throws, resolves OFF", () => {
+test("arming — SKALPEL_VERIFY_SHADOW arms the spawn even when the user turned the reveal OFF", () => {
+  // The meaningful spawn-vs-reveal split now lives on the DECLINED path: with config verify:"off",
+  // the reveal stays dark but the dev/CI log-only shadow env can still arm the spawn.
+  writeCfg({ verify: "off" });
+  assert.equal(
+    revealEnabled({ SKALPEL_VERIFY_SHADOW: "1" }),
+    false,
+    "user's off still rules the reveal",
+  );
+  assert.equal(
+    verifySpawnArmed({ SKALPEL_VERIFY_SHADOW: "1" }),
+    true,
+    "log-only shadow still spawns",
+  );
+});
+
+test("arming — fail-open: a corrupt client.json never throws, resolves to the DEFAULT (on)", () => {
   writeFileSync(CLIENT_JSON_PATH, "{ this is not json");
   assert.doesNotThrow(() => revealEnabled({}));
   assert.equal(verifyConfigArmed(), null);
-  assert.equal(revealEnabled({}), false);
+  // Unreadable config falls through to the ships-armed default. A user who declined keeps OFF via a
+  // VALID config (previous test); the corrupt-file edge resolves like a fresh install.
+  assert.equal(revealEnabled({}), true);
 });
 
 // ---- adjudication ledger + <90% auto-darken derivation ------------------------------------------