Train 22: quality-delta masking + placeholder, per-definition metrics, --mcp-tools, impact depth, honesty fixes, fn-literal bodies, Ruby #338/#325

.github/pargates-shard-weights.json

@@ -234,6 +234,7 @@
 "htmlhostcheck.sh": 22.5,
 "htmlrendercheck.sh": 22.0,
 "identitycheck.sh": 35.5,
+"impactdepthcheck.sh": 4.0,
 "impactimportcheck.sh": 1.8,
 "impactpartitioncheck.sh": 74.7,
 "importnarrowcheck.sh": 2.8,
@@ -316,7 +317,9 @@
 "mcpstalecheck.sh": 1.3,
 "mcpstdiolinecapcheck.sh": 7.0,
 "mcptoolprunecheck.sh": 4.5,
+"mcptoolsubsetcheck.sh": 3.0,
 "mcptranchecheck.sh": 68.3,
+"mcptwinclaimscheck.sh": 1.3,
 "mcpverbscheck.sh": 10.8,
 "mcpw2fixcheck.sh": 58.7,
 "mcpw3fixcheck.sh": 125.9,
@@ -502,6 +505,7 @@
 "selfcheckcheck.sh": 32.7,
 "selfcontainedcheck.sh": 2.2,
 "shadowcheck.sh": 11.2,
+"shallowhistorycheck.sh": 9.3,
 "shapingflagcheck.sh": 193.7,
 "shellgateindexcheck.sh": 1.2,
 "showcasecapturecheck.sh": 20.9,

CONTRIBUTING.md

@@ -472,6 +472,24 @@ every input the tool ever sees, costs nothing in release, and tells the optimize
   ordered container); and `unordered_dense` invalidates references on insert (values live in one
   vector), so never hold a `T&` into it across an insert.
 
+### Adding a language: common stays common
+
+A new language is **data plus, at most, small per-language pieces for semantics that genuinely differ** —
+never a copy of another language's mechanism. The step-by-step path is `prompts/add-a-language.md`; the
+rules it enforces:
+
+- **Data, not branches.** A `kLangTable` row, a `queries/<lang>/tags.scm` in the shared capture
+  vocabulary, and a row in each exhaustive `switch( Lang )` table. No language-named capture kinds.
+- **Reuse the shared mechanism.** Scope walks, shadowing (`VarDecl` bindings with spans) and imports
+  (`Binding`/`Include`) each exist once. Extend them; a second copy under a new language's name is a
+  review finding, and `--clones` shows it. No language-neutral qualified-call resolver exists yet
+  (`src/elixir_resolve.h` is Elixir-specific); raise generalising it in your PR.
+- **Refuse, don't guess.** A call whose qualifier (`Mod.f`, `ns/f`) cannot be resolved is counted as
+  unresolved, never laddered to every definition of that short name.
+- **Known gap.** Tags-pass predicates (`#eq?`/`#any-of?`) do not run yet, so keyword-headed definitions
+  (Elixir today; a Lisp-style `defn` if one is added) keep a small keyword table in C++. That table belongs in `tags.scm` once the
+  mechanism lands; it is not a pattern to extend.
+
 ### Interfaces
 
 - **Structured-binding returns** over out-params: `auto [ nodes, edges ] = build( … );`.
@@ -526,7 +544,7 @@ contract and well-formedness. The GCC/Clang language extensions this tree uses g
 refuses a new `__builtin_*`, inline asm or `__attribute__` outside that pair, so a Windows break is caught on every
 POSIX leg rather than discovered on Windows.
 
-A green Windows matrix is **not** the same as a validated platform. The 650-gate suite does not run there — it needs
+A green Windows matrix is **not** the same as a validated platform. The 658-gate suite does not run there — it needs
 the harness on #44 — and the ASan flavour is compiled on Windows but never executed.
 
 The **windows-x64 release zip** (a preview from 0.6.3) is built by `.github/workflows/windows-package.yml`, which

README.md

@@ -825,8 +825,9 @@ firing on the same function is corroboration rather than one metric counted twic
 
 That matters most for code an agent wrote. Empty-catch error masking is **+47%** more common in
 AI-authored commits, a function rewritten again inside two weeks **+15%** more likely, and reuse is
-*declining* as AI's share of commits grows (GitClear, *AI Copilot Code Quality*, 2026). Each of
-`--quality-delta`'s 10 kinds targets one measured mode like those, and it reports **only what your
+*declining* as AI's share of commits grows (GitClear, *AI Copilot Code Quality*, 2026). Ten of
+`--quality-delta`'s 11 kinds each target one measured mode like those (the eleventh, `placeholder`,
+lists the stubs and TODOs a change adds, and never gates), and it reports **only what your
 change made worse** — then `--exemplar` shows the pattern in your own repo to copy, and `--test-gate`
 names the tests that must run before "done."
 
@@ -925,9 +926,9 @@ Full retrieval tables — including the MRR figures behind the router numbers ab
 ## What it answers
 
 <details>
-<summary><b>184 long flags</b> across seven families, plus the MCP server — and <code>--help-task</code> names the ONE command a task wants, or abstains honestly when the evidence is too thin</summary>
+<summary><b>185 long flags</b> across seven families, plus the MCP server — and <code>--help-task</code> names the ONE command a task wants, or abstains honestly when the evidence is too thin</summary>
 
-Around the core sit 184 long flags advertised in `--help`, across seven families — plus an MCP
+Around the core sit 185 long flags advertised in `--help`, across seven families — plus an MCP
 server, so a coding agent can call any of them mid-task instead of grepping and reading whole files.
 `--help` prints one line per flag (~4.5K tokens); `--help=--FLAG` prints that flag's full entry with
 every caveat, `--help=SECTION` one family, and `--help=all` the whole catalog.
@@ -2062,9 +2063,9 @@ wrong, and it has. These are the results that say so, all in-tree, all published
 ### In the tests
 
 <details>
-<summary><b>651 gate scripts</b>, five contracts no unit test can hold, and the house rule: write the gate before the code it measures</summary> <!-- gatecount -->
+<summary><b>658 gate scripts</b>, five contracts no unit test can hold, and the house rule: write the gate before the code it measures</summary> <!-- gatecount -->
 
-`test/regression.sh` names **651 gate scripts** and is the authoritative list; <!-- gatecount -->
+`test/regression.sh` names **658 gate scripts** and is the authoritative list; <!-- gatecount -->
 `python3 test/pargates.py . ./build/ripwire -j 6` runs the same set in parallel. On top of them sit the
 contracts that do not fit a unit test: two runs byte-identical, warm output identical to cold, output
 that pipes clean through `xmllint --noout`, a sanitizer build with `-fno-sanitize-recover=all`, and a
@@ -2414,7 +2415,7 @@ same renderer. One computation has one output shape.
 
 | Item | Requirement |
 | --- | --- |
-| Operating system | macOS (arm64 or x86-64) or Linux (arm64 or x86-64). Native Windows x64 **builds** with both clang-cl and MSVC `cl.exe` — CI builds both on `windows-latest` every full matrix and smoke-tests each binary (`--version`, `ctest`, a real crawl, the two-run byte-identical contract, well-formed XML); the 650-gate suite does not run there, and ASan is compiled but never executed, so treat it as a build, not a validated platform. From 0.6.3 a prebuilt `windows-x64` zip ships as a **preview** ([Windows](#windows)): CI unzips it and compares its output with Linux's byte for byte, but no maintainer runs Windows, so WSL2 remains the fully supported way to run it on a Windows machine. |
+| Operating system | macOS (arm64 or x86-64) or Linux (arm64 or x86-64). Native Windows x64 **builds** with both clang-cl and MSVC `cl.exe` — CI builds both on `windows-latest` every full matrix and smoke-tests each binary (`--version`, `ctest`, a real crawl, the two-run byte-identical contract, well-formed XML); the 658-gate suite does not run there, and ASan is compiled but never executed, so treat it as a build, not a validated platform. From 0.6.3 a prebuilt `windows-x64` zip ships as a **preview** ([Windows](#windows)): CI unzips it and compares its output with Linux's byte for byte, but no maintainer runs Windows, so WSL2 remains the fully supported way to run it on a Windows machine. |
 | Prebuilt Linux floor | RHEL 8 or later (glibc 2.28) |
 | Prebuilt macOS floor | macOS 14 or later, Apple silicon. 0.6.1 is the last release with an Intel macOS binary; on an Intel Mac, pin `RIPWIRE_VERSION=v0.6.1` or build from source. |
 | x86-64 floor | x86-64-v3 (Intel Haswell, 2013, or later), for a prebuilt binary and a source build alike |
@@ -2563,6 +2564,13 @@ The server is a standard input and output MCP process. The complete configuratio
 }
 ```
 
+To list fewer tools, add `--mcp-tools=` to the server's arguments: a comma list of tool names and/or the `core`
+profile (explore, batch, from_trace, impact, uses, fetch_body, edit_check, quality_delta, the loop the server's own
+instructions teach). A client that loads every tool schema at session start then pays for 8 schemas instead of 33
+(`tools/list` measured at 13,834 bytes instead of 46,368). A call to a tool that is not listed is refused with the
+flag that enables it. The list is not access control: `batch` sub-queries still reach hidden verbs. `ripwire wrap AGENT --mcp-tools=core` writes the flag
+into the recipe it prints. The default stays the full catalog.
+
 For a socket instead of standard input and output, run `ripwire --listen=HOST:PORT`. A non-loopback
 bind requires `--mcp-token`. The three edit verbs are disabled on a remote bind unless you pass
 `--allow-remote-edits`. The socket speaks plain HTTP with no TLS, so on a non-loopback bind the bearer token and
@@ -2617,7 +2625,7 @@ identity of the index, and says which one is at fault.
 
 ### 5. Command families
 
-The `--help` output groups 184 long flags advertised in `--help` into seven families. The `--help=`
+The `--help` output groups 185 long flags advertised in `--help` into seven families. The `--help=`
 column below is the argument that prints one family: `ripwire --help=navigate`. `ripwire
 --help=--FLAG` prints one flag's full text — the caveats, the units, what it refuses and why.
 `ripwire --help=all` is the whole catalog, about 46,000 tokens.
@@ -2809,7 +2817,7 @@ python3 test/pargates.py . ./build/ripwire -j 6
 A new gate script must be added to `test/regression.sh` in the same change. The gate
 `test/manifestcheck.sh` enforces this rule.
 
-Another gate derives the cap inventory. The tool has 229 compile-time caps and 7 ranking parameters.
+Another gate derives the cap inventory. The tool has 230 compile-time caps and 7 ranking parameters.
 `docs/LIMITS.md` lists each cap, its value, and whether the file discloses a truncation when the cap
 fires, and `python3 docs/limits_build.py --check` proves that list against `src/`. `docs/TUNING.md`
 lists the measured cost of each cap.