skalpel 4.0.55 → 4.0.57

package/first-run.mjs

@@ -586,7 +586,11 @@ export function assignVariant(home, env = process.env) {
     return forced;
   }
   if (state.variant === "reveal" || state.variant === "holdout") return state.variant;
-  const variant = Math.random() < 0.5 ? "reveal" : "holdout";
+  // DEFAULT: everyone gets the reveal (founder decision 2026-07-14 — "everything off dark, to prod").
+  // The 50/50 holdout A/B is retired for new installs; the SKALPEL_FIRST_RUN_VARIANT override above
+  // still forces either arm (tests / a future re-run of the experiment), and previously-assigned
+  // holdout users keep their recorded arm (the persisted-state branch above) so old data stays clean.
+  const variant = "reveal";
   state.variant = variant;
   state.assigned_at = new Date().toISOString();
   writeState(home, state);

package/insights.mjs

@@ -59,7 +59,7 @@ export function verifyConfigArmed() {
     return null;
   }
 }
-// revealEnabled(env) — is the USER-VISIBLE reveal armed? env override > consented config > default off.
+// revealEnabled(env) — is the USER-VISIBLE reveal armed? env override > consented config > default ON.
 // SKALPEL_VERIFY_SHADOW is deliberately NOT consulted here: it arms only the DARK log-only shadow (no
 // reveal); the spawn gate ORs it in separately (verifySpawnArmed). Wrapped so it can never throw.
 export function revealEnabled(env) {
@@ -67,11 +67,16 @@ export function revealEnabled(env) {
     const envOverride = parseArmToken((env || {}).SKALPEL_VERIFY_REVEAL);
     if (envOverride !== null) return envOverride; // 1) dev/CI env override wins
     const cfg = verifyConfigArmed();
-    if (cfg !== null) return cfg; // 2) consented config
+    if (cfg !== null) return cfg; // 2) consented config (skalpel verify on|off still rules)
   } catch {
     /* fall through to default */
   }
-  return false; // 3) DEFAULT OFF
+  // 3) DEFAULT ON — founder decision 2026-07-14 ("everything off dark, to prod"): the live catch +
+  // reveal ship ARMED out of the box. The safeguards that make this sane are unchanged and still
+  // override this default: `skalpel verify off` (consented config, step 2), the env kill (step 1),
+  // the flake double-confirm before any red, recorded-failure corroboration on Codex, and the
+  // adjudicated auto-darken (precision < 90% over ≥ 10 verdicts silently re-darkens the reveal).
+  return true;
 }
 // verifySpawnArmed(env) — should the per-turn hook SPAWN the detached shadow worker at all? True when the
 // reveal is armed OR the dev log-only shadow (SKALPEL_VERIFY_SHADOW=1) is set. This is the single gate the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.55",
+  "version": "4.0.57",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-statusline.mjs

@@ -9,22 +9,31 @@
 //     that verifiably happened; else
 //   • the current steer's plain-English label (what skalpel is doing now) — a description, not a number;
 //     else
-//   • the ALWAYS-ON presence line, "skalpel · N steers[ · <time clause>]".
-//     N = steers ACTUALLY applied (fired + not suppressed), counted from the append-only
-//     ~/.skalpel/steers.ndjson — a fresh install reads "0 steers", present, never blank. The optional
-//     TIME clause is chosen by BASELINE_TIME_MODE (Ryan flips one constant):
-//       · <Xm> caught — the CUMULATIVE LIFETIME sum of every real MEASURED red→green delta (each caught
-//         false "done" and the moment that SAME proof, that SAME session, was later logged PASS — real
-//         timestamps; reuses ledger.mjs's buildFixDeltas logic). ALWAYS-ON once real catches exist (it is
-//         skalpel's terminal presence — never gated/hidden). A measured total, NEVER an estimate; a catch
-//         with no later PASS adds 0. Cumulative framing (not present-tense) keeps it honest for old data.
-//       · ~Xm saved — Raahil's #609 estimate: (applied steers) × (the user's OWN median loop cost from
-//         their causal graph). A `~`-prefixed ESTIMATE grounded in their own data, shown only when
-//         saved_min > 0. Never a server wall-clock number; never "skalpel saved you X" as a fact.
+//   • the ALWAYS-ON AMBIENT line: the `🔬 skalpel` wordmark, a dim em-dash, then a COMPOSED body of only
+//     the clauses that have real value (see THE INSTRUMENT LINE below). Nothing yet reads
+//     "🔬 skalpel — watching your agent's claims" — present, quiet, never "0 steers".
+//
+// THE INSTRUMENT LINE (redesign, 2026-07-14 — founder: "the bottom of my terminal is ugly, zero
+// aesthetic, zero gratifying feeling" about `skalpel · 0 steers`). Typography + hierarchy, not
+// decoration. The ambient body composes, in order, ONLY the clauses whose value exists:
+//     clean   → "N claims verified[ · Xm caught][ · N steers]"
+//     caught  → "N checked · M false[ · Xm caught][ · N steers]"
+//     nothing → "watching your agent's claims"   (dim — quiet confidence, NOT a dead zero)
+//   · <Xm> caught — the CUMULATIVE LIFETIME sum of every real MEASURED red→green delta (each caught
+//     false "done" and the moment that SAME proof, that SAME session, was later logged PASS — real
+//     timestamps; reuses ledger.mjs's buildFixDeltas logic). A measured total, NEVER an estimate; a
+//     catch with no later PASS adds 0. Cumulative framing (not present-tense) keeps it honest.
+//   · N steers — steers ACTUALLY applied (fired + not suppressed), counted from the append-only
+//     ~/.skalpel/steers.ndjson.
+// IMMUTABLE ALWAYS-ON COUNTER (owner product decision — unchanged in substance): the counter surfaces
+// (`N steers` when > 0, the measured `Xm caught` whenever it has a value) remain ALWAYS-ON on the
+// ambient line — never gated, never hidden. This redesign only removes DEAD ZEROS: a zero-value clause
+// is omitted, and the always-on presence is carried by the wordmark + the watching line instead of a
+// literal "0 steers". "0 steers" never renders again.
+// COLOR DISCIPLINE (Ive restraint): wordmark bold; live numbers cyan; chrome words dim. The skalpel red
+// is ONE accent used ONCE — only on the `M false` clause when lies > 0. Semantic color only.
 // Every value here is a real count or a real measured timestamp delta (or a clearly `~`-marked estimate).
-// NOTE: this always-on presence line is a DELIBERATE new behavior — origin/main's clean-idle bar emitted
-// ZERO bytes; this emits "skalpel · 0 steers" (Ryan: always-on presence, non-negotiable). Byte-identical
-// to origin/main is preserved ONLY for the untouched reveal / verdict / re-ask surfaces, not clean-idle.
+// Byte-identical to origin/main is preserved for the untouched reveal / verdict surfaces.
 // Fail-open: any error → print nothing (or just the presence line), exit 0. Never blocks the bar.
 import { readFileSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
@@ -37,14 +46,22 @@ const GREEN = "\x1b[32m";
 const BOLD = "\x1b[1m";
 const DIM = "\x1b[2m";
 const RESET = "\x1b[0m";
+// The skalpel red — the ONE accent, used ONCE per line at most (only on `M false` when lies > 0).
+const RED = "\x1b[38;2;233;38;31m";
+
+// The composed wordmark + separators of the instrument line. Em-dash after the wordmark (it breathes);
+// dim mid-dots between clauses. ANSI only, one line, no animation — the bar re-invokes this command.
+const WORDMARK = `🔬 ${BOLD}skalpel${RESET}`;
+const EMDASH = `${DIM} — ${RESET}`;
+const MIDDOT = ` ${DIM}·${RESET} `;
 
-// ── RENDER MODE — the ONE constant Ryan flips. Governs the optional TIME clause on the always-on
-// `skalpel · N steers` baseline. The steers count + Raahil's #609 BOLD/CYAN styling are ALWAYS present,
-// unchanged, in every mode. Nothing else on the bar (reveal / verdict / re-ask / steer label) is affected.
-//   "steers"   → skalpel · N steers
-//   "measured" → skalpel · N steers · 38m caught          (DEFAULT — cumulative lifetime MEASURED red→green)
-//   "saved"    → skalpel · N steers · ~7m saved           (Raahil's own-graph ESTIMATE, from steers.ndjson)
-//   "both"     → skalpel · N steers · 38m caught · ~7m saved
+// ── RENDER MODE — the ONE constant Ryan flips. Governs the optional TIME clause(s) on the ambient
+// instrument line. The heartbeat (claims verified / checked · false) and the `N steers` clause are
+// mode-independent. Nothing else on the bar (reveal / verdict / re-ask / steer label) is affected.
+//   "steers"   → no time clause
+//   "measured" → · 38m caught          (DEFAULT — cumulative lifetime MEASURED red→green)
+//   "saved"    → · ~7m saved           (Raahil's own-graph ESTIMATE, from steers.ndjson)
+//   "both"     → · 38m caught · ~7m saved
 const BASELINE_TIME_MODE = "measured";
 const SHOW_MEASURED = BASELINE_TIME_MODE === "measured" || BASELINE_TIME_MODE === "both";
 const SHOW_SAVED = BASELINE_TIME_MODE === "saved" || BASELINE_TIME_MODE === "both";
@@ -423,7 +440,7 @@ function main() {
   const n = reaskCount(payload.transcript_path);
   if (n >= 2) {
     process.stdout.write(
-      `${BOLD}skalpel${RESET} · ${CYAN}${n} re-asks/interrupts this stretch${RESET} · ${DIM}run: skalpel autopsy${RESET}`,
+      `${WORDMARK}${EMDASH}${CYAN}${n}${RESET} ${DIM}re-asks/interrupts this stretch${RESET}${MIDDOT}${DIM}run: skalpel autopsy${RESET}`,
     );
     return;
   }
@@ -431,44 +448,49 @@ function main() {
   // Otherwise, if a steer is live, name what it's doing — a description, no number.
   const label = steerLabel();
   if (label) {
-    process.stdout.write(`${BOLD}skalpel${RESET} · ${CYAN}${label}${RESET}`);
+    process.stdout.write(`${WORDMARK}${EMDASH}${CYAN}${label}${RESET}`);
     return;
   }
 
-  // ALWAYS-ON baseline presence line — skalpel's terminal presence (owner product decision: never gated,
-  // never hidden). `N steers` is ALWAYS shown (fresh install reads "0 steers" — honest, present, never
-  // blank; the user's own applied-steer count). Then the ONE optional time clause selected by
-  // BASELINE_TIME_MODE, each an AGGREGATE number only (never per-catch claim text / proof — those live in
-  // the opt-in reveal + the TUI), shown only when its real value exists:
-  //   • MEASURED "· Xm caught" — the CUMULATIVE LIFETIME sum of every real measured red→green delta
-  //     (measuredCaughtTotalMs). Always-on once real catches exist; a MEASURED wall-clock, never an
-  //     estimate. Cumulative framing (not present-tense "just caught"), so it stays honest for old catches.
-  //   • Raahil's `~`-prefixed saved ESTIMATE ("· ~7m saved") — shown only when saved_min > 0 (its data is
-  //     the user's own steers.ndjson credit, not the shadow log, so it keeps his always-on #609 behavior).
+  // THE AMBIENT INSTRUMENT LINE — skalpel's always-on terminal presence (owner product decision: never
+  // gated, never hidden). The wordmark leads; the body composes ONLY the clauses with real value, each
+  // an AGGREGATE number (never per-catch claim text / proof — those live in the opt-in reveal + the TUI):
+  //   • THE HEARTBEAT (founder: "I only see 0 steers — the product is invisible while it works"):
+  //       clean so far → "3 claims verified"   (the earned-silence receipt — real verdicts only)
+  //       lies caught  → "31 checked · 2 false" (the honest split; `M false` carries the one red accent)
+  //   • MEASURED "Xm caught" — the CUMULATIVE LIFETIME sum of every real measured red→green delta
+  //     (shadowTally). IMMUTABLE product surface: rendered whenever it has a value; a MEASURED
+  //     wall-clock, never an estimate. Cumulative framing keeps it honest for old catches.
+  //   • "N steers" — the user's own applied-steer count, whenever > 0 (always-on WHEN IT HAS VALUE;
+  //     the redesign only removed the dead "0 steers" zero — presence is now the wordmark itself).
+  //   • Raahil's `~`-prefixed saved ESTIMATE ("~7m saved") — mode-gated, shown only when saved_min > 0
+  //     (its data is the user's own steers.ndjson credit, not the shadow log — #609 behavior preserved).
+  // Nothing yet (no verdicts, no steers, no measured) → the quiet watching line, never a dead zero.
   const { steers, savedMin } = readState();
-  const tally = SHOW_MEASURED ? shadowTally() : { totalMs: 0, checked: 0, lies: 0 };
-  let line = `${BOLD}skalpel${RESET} · ${CYAN}${steers} steers${RESET}`;
+  const tally = shadowTally();
+  const clauses = [];
+  if (tally.checked > 0) {
+    if (tally.lies > 0) {
+      clauses.push(`${CYAN}${tally.checked}${RESET} ${DIM}checked${RESET}`);
+      clauses.push(`${RED}${tally.lies} false${RESET}`); // the ONE red accent, used once
+    } else {
+      clauses.push(
+        `${CYAN}${tally.checked}${RESET} ${DIM}claim${tally.checked === 1 ? "" : "s"} verified${RESET}`,
+      );
+    }
+  }
   if (SHOW_MEASURED) {
     const caught = compactMeasured(tally.totalMs); // null when < 1s of real measured catches
-    if (caught) line += ` · ${CYAN}${caught} caught${RESET}`;
-    // THE HEARTBEAT (founder: "I only see 0 steers — the product is invisible while it works").
-    // Once the armed shadow has genuinely CHECKED at least one claim, the line SHOWS the work:
-    //   clean so far → "· 3 claims verified"    (the earned-silence receipt — real verdicts only)
-    //   lies caught  → "· 31 checked · 2 false" (the honest split; the measured clause carries the time)
-    // Real counts from the same single log pass. A fresh install (checked = 0) emits EXACTLY the
-    // baseline line — byte-identical, nothing invented.
-    if (tally.checked > 0) {
-      line +=
-        tally.lies > 0
-          ? ` · ${CYAN}${tally.checked} checked · ${tally.lies} false${RESET}`
-          : ` · ${CYAN}${tally.checked} claim${tally.checked === 1 ? "" : "s"} verified${RESET}`;
-    }
+    if (caught) clauses.push(`${CYAN}${caught}${RESET} ${DIM}caught${RESET}`);
   }
+  if (steers > 0)
+    clauses.push(`${CYAN}${steers}${RESET} ${DIM}steer${steers === 1 ? "" : "s"}${RESET}`);
   if (SHOW_SAVED) {
     const phrase = savedPhrase(savedMin);
-    if (phrase) line += ` · ${CYAN}${phrase}${RESET}`;
+    if (phrase) clauses.push(`${CYAN}${phrase}${RESET}`);
   }
-  process.stdout.write(line);
+  const body = clauses.length ? clauses.join(MIDDOT) : `${DIM}watching your agent's claims${RESET}`;
+  process.stdout.write(`${WORDMARK}${EMDASH}${body}`);
 }
 
 // Fail-open: wrap the whole render so a thrown error can never spill a stack trace into the live status

package/verify-safeguards.test.mjs

@@ -37,11 +37,11 @@ beforeEach(() => {
 });
 const writeCfg = (o) => writeFileSync(CLIENT_JSON_PATH, JSON.stringify(o));
 
-// ---- arming resolver precedence: env > config > default off -------------------------------------
-test("arming — default OFF when config absent and env unset", () => {
+// ---- arming resolver precedence: env > config > DEFAULT ON (founder 2026-07-14, off-dark) -------
+test("arming — DEFAULT ON when config absent and env unset (ships armed)", () => {
   assert.equal(verifyConfigArmed(), null);
-  assert.equal(revealEnabled({}), false);
-  assert.equal(verifySpawnArmed({}), false);
+  assert.equal(revealEnabled({}), true);
+  assert.equal(verifySpawnArmed({}), true);
 });
 
 test("arming — consented config on/off", () => {
@@ -59,17 +59,29 @@ test("arming — env override BEATS config in both directions", () => {
   assert.equal(revealEnabled({ SKALPEL_VERIFY_REVEAL: "1" }), true, "env on beats config off");
 });
 
-test("arming — SKALPEL_VERIFY_SHADOW arms the spawn but NOT the reveal", () => {
-  writeCfg({});
-  assert.equal(verifySpawnArmed({ SKALPEL_VERIFY_SHADOW: "1" }), true);
-  assert.equal(revealEnabled({ SKALPEL_VERIFY_SHADOW: "1" }), false);
-});
-
-test("arming — fail-open: a corrupt client.json never throws, resolves OFF", () => {
+test("arming — SKALPEL_VERIFY_SHADOW arms the spawn even when the user turned the reveal OFF", () => {
+  // The meaningful spawn-vs-reveal split now lives on the DECLINED path: with config verify:"off",
+  // the reveal stays dark but the dev/CI log-only shadow env can still arm the spawn.
+  writeCfg({ verify: "off" });
+  assert.equal(
+    revealEnabled({ SKALPEL_VERIFY_SHADOW: "1" }),
+    false,
+    "user's off still rules the reveal",
+  );
+  assert.equal(
+    verifySpawnArmed({ SKALPEL_VERIFY_SHADOW: "1" }),
+    true,
+    "log-only shadow still spawns",
+  );
+});
+
+test("arming — fail-open: a corrupt client.json never throws, resolves to the DEFAULT (on)", () => {
   writeFileSync(CLIENT_JSON_PATH, "{ this is not json");
   assert.doesNotThrow(() => revealEnabled({}));
   assert.equal(verifyConfigArmed(), null);
-  assert.equal(revealEnabled({}), false);
+  // Unreadable config falls through to the ships-armed default. A user who declined keeps OFF via a
+  // VALID config (previous test); the corrupt-file edge resolves like a fresh install.
+  assert.equal(revealEnabled({}), true);
 });
 
 // ---- adjudication ledger + <90% auto-darken derivation ------------------------------------------