worktrust 0.6.17 → 0.7.0

package/README.md

@@ -145,8 +145,10 @@ nothing it does not:
 | `day`, `started_at`, `ended_at` | the day, and when the measured stretch began and ended |
 | `seconds` | measured time: every gap between stamped events up to five minutes |
 | `model_seconds`, `tool_seconds`, `human_seconds`, `idle_seconds` | what those seconds were: the model answering, tools or an agent run, your own turns, and what a cap cut off |
-| `tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write` | token counts, when the app records them |
+| `tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write` | token counts, when the app records them (one answer counted once, however many lines the app wrote it in) |
 | `agent_runs`, `agent_seconds`, `agent_peak` | subagents: how many ran, their own time, the most open at once (never added to `seconds`) |
+| `interrupts`, `steers` | how often you stopped the agent mid-answer, and how often your message arrived while it was still mid-task (counts, never the words) |
+| `utc_offset` | your computer's offset from UTC when the stretch began, such as +02:00, so a working day reads in your own local time |
 | `model` | the model's name as the app reported it |
 | `kind`, `layer`, `layers` | the kind of work (built, changed, researched) and the area it touched (front end, back end, data …), as the session hook names them |
 | `exchanges` | how many times you and the model took turns |
@@ -156,6 +158,7 @@ nothing it does not:
 | `project` | a one-way hash of the project's name: which days belong together, never which project |
 | `stretch_ref` | a hash of the session's id and the day, so a stretch is archived once |
 | `device_id`, `profile_id` | which computer and which user profile on it, as one-way hashes (the machine's own id never appears) |
+| `signals`, `analyzer_version` | the behaviour signals of that stretch as keys and counts from the local counter's rubric (framing, steering, verification, recovery), and the rubric's version; derived on this computer from your own turns, never a word of them (0.7.0) |
 | `collector_version` | the CLI version that measured it |
 | `seq`, `prev`, `hash` | the line's place, the hash of the line before it, and its own hash |
 
@@ -237,7 +240,7 @@ which would delete every password on the computer, and many people rightly keep
 | **Reads** | Which AI apps are installed (the settings folders of Claude Code, Codex, Cursor, Gemini CLI, Antigravity, VS Code, Windsurf, Hermes Agent, Goose, OpenCode, OpenClaw), and the chats Cursor and Copilot keep (clocks, models and token counts only). Afterwards, the session hook reads Claude Code's, Codex's and Antigravity's session files, the session databases of Hermes, Goose, OpenCode and OpenClaw, and the chats Cursor and Copilot keep, on this computer to measure durations and token counts. |
 | **Writes** | The key file (above). In each AI app's MCP settings (`~/.claude.json` through `claude mcp`, `~/.cursor/mcp.json`, `~/.codex/config.toml`, `~/.gemini/settings.json`, `~/.gemini/config/mcp_config.json` (Antigravity), VS Code's `mcp.json`, Windsurf's `mcp_config.json`, Hermes's and Goose's `config.yaml`, OpenCode's `opencode.json`, OpenClaw through `openclaw mcp set`) a WorkTrust entry that runs the local bridge, with no key in it; three hooks in `~/.claude/settings.json`; the bridge, the hook and the counter in `~/.worktrust/`. |
 | **Sends, to pair** | This computer's system (macOS, Windows, Linux) and host name. WorkTrust also records the network address the request arrives from, as a security record kept 90 days and seen only by WorkTrust staff (to answer a theft or fraud report). |
-| **Sends, afterwards** | Per measured stretch of work, and nothing else: its durations (`seconds`, `duration_basis`, `model_seconds`, `tool_seconds`, `human_seconds`, `idle_seconds`), token counts (`tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write`, `token_basis`), the model's name (`model`), the kind of work and one layer keyword such as frontend or backend (`title`, `kind`, `layer`, `layers`), counts of how you work (`exchanges`, `turn_basis`, `agent_runs`, `agent_seconds`, `agent_peak`), when it ended (`at`), a hash of the session and the day (`stretch_ref`), `steered_from` when it ran over SSH, and, so the work can be matched to GitHub, the repository as its remote's owner/name (`repo`) and the hashes of the commits made in the stretch (`commits`, never their messages). |
+| **Sends, afterwards** | Per measured stretch of work, and nothing else: its durations (`seconds`, `duration_basis`, `model_seconds`, `tool_seconds`, `human_seconds`, `idle_seconds`), token counts (`tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write`, `token_basis`), the model's name (`model`), the kind of work and one layer keyword such as frontend or backend (`title`, `kind`, `layer`, `layers`), counts of how you work (`exchanges`, `turn_basis`, `agent_runs`, `agent_seconds`, `agent_peak`, `interrupts`, `steers`), when it began and ended and your computer's offset from UTC (`started_at`, `at`, `utc_offset`), a hash of the session and the day (`stretch_ref`), `steered_from` when it ran over SSH, and, so the work can be matched to GitHub, the repository as its remote's owner/name (`repo`) and the hashes of the commits made in the stretch (`commits`, never their messages). |
 | **Never sends** | Prompts, answers, code, file names or paths, commit messages, branch names, or the name of your local folder (a repository is named only as its remote's owner/name, above). The door has no field for them and refuses a submission that carries them. |
 
 ## Why you can check it

package/count-behaviour.mjs

@@ -788,6 +788,18 @@ export const isoWeek = (day) => {
   return `${thursday.getUTCFullYear()}-W${String(week).padStart(2, "0")}`;
 };
 const byWeek = new Map(); // "month|week" → Map(signal → count)
+/**
+ * THE WORK STRETCH (0.7.0, the owner's capability framework v4 §13: "work_stretch_id, the stable unit joining AI
+ * activity, verification, failures and delivery"). The same observation is tallied a third time, per stretch: one
+ * session's UTC day, named by the hash the session hook files the stretch under (`stretch_ref` in log-session.mjs), so a
+ * signal and the stretch's clocks, tokens and commits meet on one key. Only sessions read from a file carry it (Claude
+ * Code, Codex, Antigravity); the session's id is hashed with the day and never leaves the computer. Read by `preserve`
+ * through --stretch-signals; nothing of it is sent yet.
+ */
+const byStretch = new Map(); // stretch_ref → { day, signals: { signal: count } }
+let currentStretchBase = null; // the session's own id, as the session hook hashes it — local only
+const stretchBaseOf = (session) => !session.path ? null : /(^|[\\/])brain[\\/][^\\/]+[\\/]\.system_generated[\\/]logs[\\/]transcript\.jsonl$/.test(session.path) ? String(session.path).split(/[\\/]/).at(-4) : String(session.path).split(/[\\/]/).pop().replace(/\.jsonl?$/, "");
+const stretchRefOf = (base, day) => createHash("sha256").update(`worktrust-stretch|${base}|${day}`).digest("base64url");
 const bump = (month, signal, n = 1) => {
   {
     const key = `${month}|${currentDay && currentDay.startsWith(month) ? isoWeek(currentDay) : "U"}`;
@@ -795,6 +807,11 @@ const bump = (month, signal, n = 1) => {
     week.set(signal, (week.get(signal) ?? 0) + n);
     byWeek.set(key, week);
   }
+  if (currentStretchBase && currentDay) {
+    const ref = stretchRefOf(currentStretchBase, currentDay), entry = byStretch.get(ref) ?? { day: currentDay, signals: {} };
+    entry.signals[signal] = (entry.signals[signal] ?? 0) + n;
+    byStretch.set(ref, entry);
+  }
   if (currentUnit) {
     const bag = unitsByMonth.get(month) ?? new Map();
     bag.set(`${currentUnit}|${signal}`, { unit: currentUnit, signal, induced: currentInduced, day: currentDay, context: currentContext });
@@ -827,10 +844,10 @@ const seenLines = new Set(); // v0.10: line identities already counted (a uuid o
 const manifest = [];
 for(const session of sessions())manifest.push(sessionDigest(session));
 exportConversations = 0; copilotSessionCount = 0; codexRolloutCount = 0; antigravityCount = 0; skippedDirs.length = 0; countedDirs.length = 0; skippedConversations.length = 0;
-const checkpoint = flag("no-checkpoint") || LABEL_OUT ? null : checkpointStore(
+const checkpoint = flag("no-checkpoint") || flag("stretch-signals") || LABEL_OUT ? null : checkpointStore(
   value("checkpoint") ?? join(homedir(), ".worktrust", "counter-checkpoint.json"),
   fingerprint({code:readFileSync(new URL(import.meta.url)),version:ANALYZER_VERSION,months:MONTHS_BACK,thisMonth,exclude:EXCLUDE,leaveOut:LEAVE_OUT,exports:EXPORTS}),manifest);
-const checkpointMaps = {byMonth,byWeek,unitsByMonth,contextNames,contextBasenames,byMonthContext,monthToolNames,modelFirstSeen,monthMcpServers,rolePatterns,contextCwds,projectFirstSeen,sessionsByMonth};
+const checkpointMaps = {byMonth,byWeek,byStretch,unitsByMonth,contextNames,contextBasenames,byMonthContext,monthToolNames,modelFirstSeen,monthMcpServers,rolePatterns,contextCwds,projectFirstSeen,sessionsByMonth};
 const checkpointSets = {openingHashes,toolFirstSeen,seenLines};
 if (checkpoint?.saved) {
   for(const [key,map] of Object.entries(checkpointMaps)) for(const [k,v] of checkpoint.saved.state.maps[key] ?? []) map.set(k,v);
@@ -849,6 +866,7 @@ for (const session of sessions()) {
   if(sessionIndex++<resumeAt)continue;
   const streamHash = session.path ? createHash("sha256").update(`file:${session.path}\n`) : null;
   const file = session.key;
+  currentStretchBase = stretchBaseOf(session);
   files += 1;
   // One file is one session: order preserved, so the STRUCTURAL half reads the shape.
   let sessionMonth = null;
@@ -1152,7 +1170,7 @@ for (const session of sessions()) {
     checkpoint?.close();process.exit(0);
   }
 }
-currentUnit = null; currentDay = null; // month-level aggregates carry no unit and no day
+currentUnit = null; currentDay = null; currentStretchBase = null; // month-level aggregates carry no unit, no day and no stretch
 for (const [month, set] of monthToolNames) bump(month, "toolBreadth", set.size);
 for (const [month, set] of monthMcpServers) if (set.size > 0) bump(month, "mcpServersDistinct", set.size);
 for (const [month, byPattern] of rolePatterns) for (const sessions of byPattern.values()) if (sessions.size >= RECURRENCE_FLOOR) bump(month, "recurringPatternCandidate");
@@ -1190,6 +1208,14 @@ for (let i = 0; i < sessionSpans.length; i += 1) {
   if (overlapping.has(i)) { currentUnit = a.unit; currentDay = a.day ?? null; currentContext = a.context ?? null; bump(a.month, "parallelSessions"); currentUnit = null; currentDay = null; currentContext = null; }
 }
 
+// THE STRETCHES, FOR PRESERVE (0.7.0): one JSON line per stretch that carries a signal, the analyzer's version on each,
+// and a closing count so the reader can tell a whole answer from a cut one. Counts and keys only; nothing is sent.
+if (flag("stretch-signals")) {
+  const rows = [...byStretch.entries()].sort(([, a], [, b]) => a.day.localeCompare(b.day)).map(([stretch_ref, entry]) => JSON.stringify({ stretch_ref, day: entry.day, analyzer_version: ANALYZER_VERSION, signals: Object.fromEntries(Object.entries(entry.signals).sort().map(([signal, count]) => [signal, Math.min(COUNT_CEILING, count)])) }));
+  await new Promise((resolve) => process.stdout.write(`${[...rows, JSON.stringify({ stretch_signals_end: rows.length })].join("\n")}\n`, resolve));
+  process.exit(0);
+}
+
 const months = [...byMonth.keys()].sort();
 console.log(`${ANALYZER_VERSION} · ${files} transcript file(s), ${messages} own messages, ${months.length} month(s) with counts`);
 console.log(` projects counted: ${countedDirs.length}${countedDirs.length ? ` (${countedDirs.join(", ")})` : ""}`);

package/log-session.mjs

@@ -342,22 +342,45 @@ function stretchesOf(file, since) {
   }
   if (messages.length === 0) return [];
   messages.sort((a, b) => a.at - b.at);
+  const byDay = byDayOf(messages);
+  const agents = agentsByDay(file, since);
+  return [...byDay.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([day, ofDay]) => { const stretch = measure(cwd, ofDay); return stretch && { ...stretch, ref: stretchRef(file, day), steered, agents: agents.get(day) ?? null }; }).filter(Boolean);
+}
+
+/**
+ * DAYS SPLIT ON THE CLOCK, NOTHING LOST AT MIDNIGHT (0.6.18, audit C14). A stretch is one session's UTC day, and the gap
+ * between a day's last message and the next day's first belonged to neither, so a run through the night lost one gap
+ * per midnight. A day whose first message follows the last one within the tool cap now opens with a BRIDGE: the message
+ * before it, carrying no tokens, no model and no turn, so the gap that crosses midnight is counted once, on the day it
+ * ends, under the same caps as any other.
+ * Messages must arrive sorted.
+ */
+function byDayOf(messages) {
   const byDay = new Map();
+  let prev = null;
   for (const message of messages) {
     const day = new Date(message.at).toISOString().slice(0, 10);
-    if (!byDay.has(day)) byDay.set(day, []);
+    // Only a gap the work could have run through (within the tool cap): a session resumed the next morning opens its day as it always did.
+    if (!byDay.has(day)) byDay.set(day, prev && message.at - prev.at <= TOOL_CAP * 1000 ? [{ ...prev, usage: null, model: null, cumulative: false, bridge: true }] : []);
     byDay.get(day).push(message);
+    prev = message;
   }
-  const agents = agentsByDay(file, since);
-  return [...byDay.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([day, ofDay]) => { const stretch = measure(cwd, ofDay); return stretch && { ...stretch, ref: stretchRef(file, day), steered, agents: agents.get(day) ?? null }; }).filter(Boolean);
+  return byDay;
 }
+/** The first message a day really holds (a bridge is the day before's). */
+const firstOf = (messages) => (messages.find((message) => !message.bridge) ?? messages[0]).at;
+/** The computer's offset from UTC at a moment, as +02:00: what the owner's mirror needs to read a working day in local time. */
+const offsetAt = (ms) => { const minutes = -new Date(ms).getTimezoneOffset(), abs = Math.abs(minutes); return `${minutes < 0 ? "-" : "+"}${String(Math.floor(abs / 60)).padStart(2, "0")}:${String(abs % 60).padStart(2, "0")}`; };
+/** Claude Code's own line when the person stops the agent mid-answer (Esc), read for its marker only. */
+const INTERRUPTED = /^\[Request interrupted by user/;
+const textOf = (content) => (typeof content === "string" ? content : Array.isArray(content) ? content.map((block) => (block && typeof block.text === "string" ? block.text : "")).join("") : "");
 
 /** One transcript line as the measure reads it: the clock, the role, what KIND of message it is (for the layers), its counts. */
 const messageOf = (line, at) => {
   const content = line.message?.content ?? null;
   const blocks = Array.isArray(content) ? content : [];
   return {
-    at, type: line.type, usage: line.message?.usage ?? null, model: line.message?.model ?? null, meta: line.isMeta === true, content,
+    at, type: line.type, usage: line.message?.usage ?? null, model: line.message?.model ?? null, messageId: typeof line.message?.id === "string" ? line.message.id : null, meta: line.isMeta === true, content,
     // A tool's answer comes back on the user role; a line a reader marks `agentic` is an agent run (Copilot's asked → completed).
     kind: line.type === "assistant" ? "assistant" : blocks.some((block) => block && block.type === "tool_result") ? "tool_result" : "user",
     toolUse: line.type === "assistant" && blocks.some((block) => block && block.type === "tool_use"),
@@ -456,12 +479,22 @@ function measure(cwd, messages) {
   const models = new Map();
   let exchanges = 0;
   for (const message of messages) {
-    if (message.type === "user" && !message.meta && isHumanTurn(message.content)) exchanges += 1;
+    if (message.type === "user" && !message.meta && !message.bridge && isHumanTurn(message.content)) exchanges += 1;
     if (message.model) models.set(message.model, (models.get(message.model) ?? 0) + 1);
   }
   const model = [...models.entries()].sort((a, b) => b[1] - a[1])[0]?.[0] ?? null;
   const tokens = tokensOf(messages);
-  return { cwd, seconds: measured, layers: measured !== null ? timeLayers(messages) : null, ...tokens, cumulative: messages.some((message) => message.cumulative), exchanges, model, from: messages[0].at, to: messages[messages.length - 1].at };
+  // HOW THE PERSON STEERED (owner, 2026-10-08): how often they stopped the agent (Claude Code's interruption line), and how
+  // often their next turn arrived while the agent was still mid-task (right after a tool call or its result). Counts only.
+  let interrupts = 0, steers = 0;
+  for (let i = 1; i < messages.length; i += 1) {
+    const message = messages[i], prev = messages[i - 1];
+    if (message.bridge || message.type !== "user" || message.meta || message.kind === "tool_result") continue;
+    if (INTERRUPTED.test(textOf(message.content).trim())) interrupts += 1;
+    else if (isHumanTurn(message.content) && (prev.kind === "tool_result" || prev.toolUse)) steers += 1;
+  }
+  const from = firstOf(messages);
+  return { cwd, seconds: measured, layers: measured !== null ? timeLayers(messages) : null, ...tokens, cumulative: messages.some((message) => message.cumulative), exchanges, interrupts, steers, model, from, to: messages[messages.length - 1].at, offset: offsetAt(from) };
 }
 
 /**
@@ -508,9 +541,14 @@ function usageShapeKnown(usage) {
 }
 function tokensOf(messages) {
   let tokensIn = 0, tokensOut = 0, cacheRead = 0, cacheWrite = 0, counted = 0, shapeKnown = true;
+  // ONE ANSWER, ONE USAGE (0.6.18): Claude Code writes an answer as a line per content block (thinking, text, each tool
+  // call), every one repeating the answer's usage; summed per line, a real session read 2.6 times its output tokens. An
+  // answer with an id is counted once; a line without one (Codex's token events) is its own.
+  const seen = new Set();
   for (const message of messages) {
     const usage = message.usage;
     if (!usage) continue;
+    if (message.messageId) { if (seen.has(message.messageId)) continue; seen.add(message.messageId); }
     if (!usageShapeKnown(usage)) { shapeKnown = false; break; }
     counted += 1;
     tokensIn += (usage.input_tokens ?? 0) + (usage.cache_creation_input_tokens ?? 0);
@@ -565,6 +603,10 @@ function payloadFor(stretch) {
     // THE LAYERS (2026-10-06), only on a measured stretch, each bounded by a day: what the seconds were. `seconds` above is untouched.
     ...(stretch.seconds !== null && stretch.layers ? { model_seconds: Math.min(DAY_SECONDS, stretch.layers.model), tool_seconds: Math.min(DAY_SECONDS, stretch.layers.tool), human_seconds: Math.min(DAY_SECONDS, stretch.layers.human), idle_seconds: Math.min(DAY_SECONDS, stretch.layers.idle) } : {}),
     // THE SUBAGENTS, as agent metadata beside the day: runs, their own seconds, the peak open at once. Never in `seconds`.
+    // WHEN AND HOW (0.6.18): the stretch's first moment and the computer's UTC offset then; the person's interruptions and mid-task turns, counts only.
+    started_at: new Date(stretch.from).toISOString(), utc_offset: stretch.offset,
+    ...(stretch.interrupts > 0 ? { interrupts: Math.min(10000, stretch.interrupts) } : {}),
+    ...(stretch.steers > 0 ? { steers: Math.min(10000, stretch.steers) } : {}),
     ...(stretch.agents && stretch.agents.runs > 0 ? { agent_runs: Math.min(AGENT_RUNS_MAX, stretch.agents.runs), agent_seconds: Math.min(AGENT_SECONDS_MAX, stretch.agents.seconds), agent_peak: Math.min(AGENT_RUNS_MAX, stretch.agents.peak) } : {}),
     at: new Date(stretch.to).toISOString(),
   };
@@ -643,23 +685,22 @@ function historyEntries(floor = null, all = false) {
     const lines = parsedLines(file);
     if (!lines) continue;
     let cwd = null, steered = null;
-    const byDay = new Map();
+    const read = [];
     for (const line of lines) {
       if (typeof line.cwd === "string") cwd = line.cwd;
       if (typeof line.steered === "string") steered = line.steered;
       if (!line.timestamp || (line.type !== "user" && line.type !== "assistant")) continue;
       const at = Date.parse(line.timestamp);
       if (!Number.isFinite(at)) continue;
-      const day = new Date(at).toISOString().slice(0, 10);
-      if (!byDay.has(day)) byDay.set(day, []);
-      byDay.get(day).push(messageOf(line, at));
+      read.push(messageOf(line, at));
     }
+    read.sort((a, b) => a.at - b.at);
+    const byDay = byDayOf(read);
     const agents = agentsByDay(file, null);
     for (const [day, messages] of byDay) {
       if (messages.length === 0) continue;
-      messages.sort((a, b) => a.at - b.at);
       // Under-reporting is the safe side (THE FLOORS): a day that began before the account changed is not offered at all.
-      if (floor !== null && messages[0].at < floor) continue;
+      if (floor !== null && firstOf(messages) < floor) continue;
       const last = messages[messages.length - 1].at;
       // The live window belongs to the hook: a stretch that log_work may still report is not history.
       if (!all && Date.now() - last < WINDOW_HOURS * 3600_000) continue;
@@ -668,7 +709,7 @@ function historyEntries(floor = null, all = false) {
       if (CODEX_ROLLOUT.test(file)) entrySource.set(entry, "codex");
       if (ANTIGRAVITY_TRANSCRIPT.test(file)) entrySource.set(entry, "antigravity");
       if (DATABASE_SESSION.test(file)) entrySource.set(entry, file.slice(0, file.indexOf(":")));
-      entryFile.set(entry, { file, from: messages[0].at, folder: cwd ? String(cwd).split(/[\\/]/).filter(Boolean).pop() ?? null : null });
+      entryFile.set(entry, { file, from: firstOf(messages), folder: cwd ? String(cwd).split(/[\\/]/).filter(Boolean).pop() ?? null : null });
       entries.push(entry);
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "worktrust",
-  "version": "0.6.17",
+  "version": "0.7.0",
   "description": "Couple this computer to WorkTrust: approve a code in your browser, and every AI app here reports what you built. Metadata only, no dependencies.",
   "type": "module",
   "bin": {

package/preserve.mjs

@@ -168,7 +168,7 @@ async function apply(list, agreed = false) {
 }
 
 /** THE ALLOWLIST: what a line may carry, each value checked for its type. A key not named here never reaches the archive. */
-const COUNTS = ["seconds", "tokens_in", "tokens_out", "tokens_cache_read", "tokens_cache_write", "model_seconds", "tool_seconds", "human_seconds", "idle_seconds", "agent_runs", "agent_seconds", "agent_peak"];
+const COUNTS = ["seconds", "tokens_in", "tokens_out", "tokens_cache_read", "tokens_cache_write", "model_seconds", "tool_seconds", "human_seconds", "idle_seconds", "agent_runs", "agent_seconds", "agent_peak", "interrupts", "steers"];
 const ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
 /** The hook's own words for a stretch (work area, kind, how it was steered, the measuring bases), kept as the hook sends them. */
 const WORDS = ["layer", "kind", "steered_from", "duration_basis", "token_basis", "turn_basis"];
@@ -187,7 +187,22 @@ function computerIds() {
   const hash = (text) => createHash("sha256").update(text).digest("base64url");
   return { device_id: hash(`worktrust-machine|${machine.toLowerCase()}`), profile_id: hash(`worktrust-profile|${machine.toLowerCase()}|${homedir()}`) };
 }
-function archiveLine(entry) {
+/**
+ * THE STRETCH'S BEHAVIOUR SIGNALS (0.7.0): the local counter's keys and counts per stretch, joined on `stretch_ref`,
+ * with the rubric's version. Read on this computer by count-behaviour.mjs --stretch-signals, which sends nothing; a
+ * counter that is missing, fails or answers cut leaves the archive without signals and says so, never half of them.
+ */
+function stretchSignals() {
+  const counter = join(HERE, "count-behaviour.mjs");
+  if (!existsSync(counter)) return null;
+  const run = spawnSync(process.execPath, [counter, "--stretch-signals", "--months", "120"], { encoding: "utf8", maxBuffer: 1 << 29, env: { ...process.env, WORKTRUST_MCP_URL: "", WORKTRUST_MCP_TOKEN: "" } });
+  const rows = (run.stdout ?? "").split("\n").filter((text) => text.startsWith("{")).map((text) => { try { return JSON.parse(text); } catch { return null; } });
+  const end = rows.at(-1)?.stretch_signals_end;
+  if (run.status !== 0 || !Number.isInteger(end) || end !== rows.length - 1) { say("  The behaviour counter did not answer whole, so these lines carry no signals; the next run adds them to new lines."); return null; }
+  return new Map(rows.slice(0, -1).filter(Boolean).map((row) => [row.stretch_ref, row]));
+}
+const SIGNAL = /^[a-zA-Z][A-Za-z0-9._-]{1,63}$/;
+function archiveLine(entry, behaviour = null) {
   if (typeof entry?.client !== "string" || !/^[a-z][a-z0-9-]{0,31}$/.test(entry.client) || !ISO.test(entry.started_at ?? "") || !ISO.test(entry.at ?? "") || !/^[A-Za-z0-9_-]{16,128}$/.test(entry.stretch_ref ?? "")) return null;
   const line = { client: entry.client, day: entry.started_at.slice(0, 10), started_at: entry.started_at, ended_at: entry.at };
   for (const key of COUNTS) if (typeof entry[key] === "number" && Number.isFinite(entry[key]) && entry[key] >= 0) line[key] = entry[key];
@@ -195,11 +210,18 @@ function archiveLine(entry) {
   for (const key of WORDS) if (typeof entry[key] === "string" && WORD.test(entry[key])) line[key] = entry[key];
   if (Array.isArray(entry.layers) && entry.layers.length > 1 && entry.layers.every((word) => typeof word === "string" && WORD.test(word))) line.layers = entry.layers.slice(0, 8);
   if (typeof entry.exchanges === "number" && Number.isInteger(entry.exchanges) && entry.exchanges > 0) line.exchanges = entry.exchanges;
+  // The computer's offset from UTC when the stretch began (0.6.18), so a working day can be read in local time.
+  if (typeof entry.utc_offset === "string" && /^[+-]\d{2}:\d{2}$/.test(entry.utc_offset)) line.utc_offset = entry.utc_offset;
   // Commit hashes the stretch made, never a message: what ties AI time to delivered work in the repository.
   if (Array.isArray(entry.commits) && entry.commits.length > 0 && entry.commits.every((sha) => typeof sha === "string" && /^[0-9a-f]{7,40}$/.test(sha))) line.commits = entry.commits.slice(0, 50);
   // The project as a one-way hash of its name (owner/name, else the folder's own name): which days belong together, never which project.
   const name = entry.repo ?? entry.folder;
   if (typeof name === "string" && name) line.project = sha256(`worktrust-project|${name}`);
+  // The behaviour signals of this stretch (0.7.0): keys of the counter's rubric and whole counts, never a word of a turn.
+  if (behaviour && behaviour.signals && typeof behaviour.analyzer_version === "string" && /^counter@\d+\.\d+\.\d+$/.test(behaviour.analyzer_version)) {
+    const kept = Object.entries(behaviour.signals).filter(([key, count]) => SIGNAL.test(key) && Number.isInteger(count) && count > 0).sort();
+    if (kept.length > 0) { line.signals = Object.fromEntries(kept); line.analyzer_version = behaviour.analyzer_version; }
+  }
   return { ...line, stretch_ref: entry.stretch_ref, ...IDS, collector_version: COLLECTOR };
 }
 
@@ -244,6 +266,8 @@ function check(dir) {
   }
   const manifest = readJson(join(dir, "manifest.json")).value;
   if (rows.length > 0 && (!manifest || manifest.count !== lines.length || manifest.head !== lines.at(-1).hash)) return broken("manifest.json", "its count or head does not match the lines (lines were removed or added outside preserve)");
+  // THE MANIFEST'S SEAL (0.6.18, audit C9): a signed count and head, so a cut tail with a manifest edited to match is caught.
+  if (manifest && typeof manifest.signature === "string" && !signedBy(manifest)) return broken("manifest.json", "its signature does not verify with the key named in it (the count or the last line was changed)");
   const days = new Map();
   for (const line of lines) days.set(line.day, [...(days.get(line.day) ?? []), line]);
   const mine = deviceKey()?.publicX ?? null;
@@ -255,15 +279,19 @@ function check(dir) {
     if (!proof || proof.date !== day) return broken(where, "missing or unreadable");
     if (proof.count !== ofDay.length || proof.root !== rootOf(ofDay.map((line) => line.hash))) return broken(where, "the day's root does not match its lines");
     if (proof.signature === null) continue;
-    const { signature, ...body } = proof;
-    let valid = false;
-    try { valid = verify(null, Buffer.from(canonical(body)), createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: body.public_key }, format: "jwk" }), Buffer.from(signature, "base64url")); } catch { valid = false; }
-    if (!valid) return broken(where, "the signature does not verify with the key named in it");
+    if (!signedBy(proof)) return broken(where, "the signature does not verify with the key named in it");
     signed += 1;
-    if (body.public_key === mine) ours += 1;
+    if (proof.public_key === mine) ours += 1;
   }
-  return { lines, days, signed, ours, manifest };
+  return { lines, days, signed, ours, manifest, proofs: new Map([...days.keys()].map((day) => [day, readJson(join(dir, "proofs", `${day}.json`)).value])) };
+}
+/** Whether a signed body (a day's proof, the manifest) verifies under the key it names. */
+function signedBy(document) {
+  const { signature, ...body } = document;
+  try { return verify(null, Buffer.from(canonical(body)), createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: body.public_key }, format: "jwk" }), Buffer.from(signature, "base64url")); } catch { return false; }
 }
+/** Signed with this computer's key, or null: the body as it is signed. */
+const sealed = (body, key) => ({ ...body, signature: key ? sign(null, Buffer.from(canonical(body)), key.privateKey).toString("base64url") : null });
 
 function archive(dir) {
   IDS = computerIds();
@@ -274,11 +302,12 @@ function archive(dir) {
   // A WHOLE ANSWER OR NOTHING: the hook ends with its own count; one line missing or cut is a read to refuse, never part of an archive.
   const rows = hook.stdout.split("\n").filter(Boolean), end = (() => { try { return JSON.parse(rows.at(-1) ?? "").archive_end; } catch { return undefined; } })();
   if (!Number.isInteger(end) || end !== rows.length - 1) { say(`  The session hook's answer came back incomplete (${rows.length - 1} of ${end ?? "an unknown number of"} lines), so nothing was added. Run it again.`); process.exit(1); }
+  const signals = stretchSignals();
   const known = new Set(existing.lines.map((line) => line.stretch_ref)), fresh = [], measured = new Set();
   let waiting = 0;
   for (const text of rows.slice(0, -1)) {
     let entry; try { entry = JSON.parse(text); } catch { continue; }
-    const line = archiveLine(entry);
+    const line = archiveLine(entry, signals?.get(entry.stretch_ref) ?? null);
     if (line && line.day < today()) measured.add(line.stretch_ref); if (!line || known.has(line.stretch_ref)) continue; // a file present twice is one stretch
     if (line.day >= today()) { waiting += 1; continue; }
     known.add(line.stretch_ref);
@@ -297,13 +326,19 @@ function archive(dir) {
     prev = hashed.hash;
   }
   // A day that gained lines gets its root again over all of its lines; the lines themselves are never rewritten.
+  // THIS KEY SIGNS ONLY ITS OWN LINES (0.6.18, audit S7): a day is signed when every earlier line of it was already under
+  // this key's signature (or there were none); a day that came into the folder from elsewhere keeps an unsigned root.
   const key = deviceKey();
+  const ours = (document) => !document || (key && typeof document.signature === "string" && document.public_key === key.publicX);
   mkdirSync(join(dir, "proofs"), { recursive: true });
   for (const day of new Set(fresh.map((line) => line.day))) {
-    const body = proofBody(day, all.filter((line) => line.day === day), key);
-    writeFileSync(join(dir, "proofs", `${day}.json`), `${JSON.stringify({ ...body, signature: key ? sign(null, Buffer.from(canonical(body)), key.privateKey).toString("base64url") : null }, null, 1)}\n`);
+    const own = !existing.days?.has(day) || ours(existing.proofs?.get(day));
+    const body = proofBody(day, all.filter((line) => line.day === day), own ? key : null);
+    writeFileSync(join(dir, "proofs", `${day}.json`), `${JSON.stringify(sealed(body, own ? key : null), null, 1)}\n`);
   }
-  if (fresh.length > 0 || !existing.manifest) writeFileSync(join(dir, "manifest.json"), `${JSON.stringify({ format: "worktrust-ai-evidence/1", collector_version: COLLECTOR, created: existing.manifest?.created ?? new Date().toISOString(), updated: new Date().toISOString(), clients: [...new Set(all.map((line) => line.client))].sort(), ...IDS, count: all.length, head: prev }, null, 1)}\n`);
+  // The manifest is sealed the same way: a new archive, or one whose manifest this key already signed.
+  const manifestKey = !existing.manifest || ours(existing.manifest) ? key : null;
+  if (fresh.length > 0 || !existing.manifest) writeFileSync(join(dir, "manifest.json"), `${JSON.stringify(sealed({ format: "worktrust-ai-evidence/1", collector_version: COLLECTOR, created: existing.manifest?.created ?? new Date().toISOString(), updated: new Date().toISOString(), clients: [...new Set(all.map((line) => line.client))].sort(), ...IDS, count: all.length, head: prev, ...(manifestKey ? { public_key: manifestKey.publicX } : {}) }, manifestKey), null, 1)}\n`);
   say();
   say(`  ✓ ${fresh.length} new day-stretch${fresh.length === 1 ? "" : "es"} archived in ${dir}: it holds ${all.length}, the session hook measures ${measured.size} finished ones here now${key ? ", each day's root signed with this computer's device key" : ", unsigned (no device key on this computer)"}.`);
   if (waiting > 0) say(`    ${waiting} of today wait for tomorrow's run: a day is archived once it is over.`);
@@ -314,8 +349,9 @@ function verifyArchive(dir) {
   const result = check(dir);
   if (result.broken) { say(`  BROKEN  ${result.broken}`); process.exit(1); }
   if (result.lines.length === 0) { say(`  Nothing to verify in ${dir}.`); return; }
-  const signedBy = result.signed === 0 ? "no day signed" : result.ours === result.signed ? `${result.signed} signed by this computer's key` : `${result.signed} signed (${result.ours} by this computer's key, ${result.signed - result.ours} by another key named in them)`;
-  say(`  OK  ${result.lines.length} stretches · ${result.days.size} days · the chain is whole · every day's root matches · ${signedBy}`);
+  const daySeal = result.signed === 0 ? "no day signed" : result.ours === result.signed ? `${result.signed} signed by this computer's key` : `${result.signed} signed (${result.ours} by this computer's key, ${result.signed - result.ours} by another key named in them)`;
+  const seal = typeof result.manifest?.signature !== "string" ? "manifest unsigned" : result.manifest.public_key === deviceKey()?.publicX ? "manifest signed by this computer's key" : "manifest signed by another key named in it";
+  say(`  OK  ${result.lines.length} stretches · ${result.days.size} days · the chain is whole · every day's root matches · ${daySeal} · ${seal}`);
 }
 
 /** --summary: what a person or a team reads from the archive, counted locally (preserve-summary.mjs) once the chain checks out. */

package/worktrust.mjs

@@ -71,7 +71,7 @@ const command = args.find((arg, at) => !arg.startsWith("--") && !(at > 0 && VALU
 const flag = (name) => { const at = args.indexOf(`--${name}`); return at >= 0 ? args[at + 1] : undefined; };
 const has = (name) => args.includes(`--${name}`);
 /** This CLI's version, said to the door so the app can tell which computer runs an old one (check-cli-package holds it equal to package.json). */
-const CLI_VERSION = "0.6.17";
+const CLI_VERSION = "0.7.0";
 const ORIGIN = (flag("origin") ?? process.env.WORKTRUST_ORIGIN ?? "https://app.worktrust.io").replace(/\/$/, "");
 const MCP = flag("url") ?? process.env.WORKTRUST_MCP_URL ?? `${ORIGIN}/api/mcp`;
 const HOME_DIR = join(homedir(), ".worktrust");
@@ -670,7 +670,8 @@ async function offerRebuild(previousVersion, paths, key) {
   if (!previousVersion || previousVersion === CLI_VERSION) return;
   say();
   say(`  This computer's earlier lines in WorkTrust were measured by worktrust ${previousVersion}. Version ${CLI_VERSION} measures`);
-  say("  differently (what the seconds were, your own turns, tokens with the cache, more AI apps). You can re-measure the");
+  say("  differently (each answer's tokens counted once, nothing lost at midnight, when each stretch began, how you steered");
+  say("  the agent, what the seconds were, more AI apps). You can re-measure the");
   say("  sessions still on this computer and have WorkTrust replace this computer's earlier lines, day by day, never counting");
   say("  a day twice. Later: npx worktrust@latest history --rebuild");
   if (!(await ask("Show the plan and rebuild now?", false))) { say("  Not now."); return; }