Comp Check — API

export API="https://api.skillsafe.ai/v1/app-api"
export TOKEN="YOUR_TOKEN"      # see step 1

# every call looks like:
#   curl -s "$API/..." -H "Authorization: Bearer $TOKEN" [-d '{json}']
# jq is used below to pull fields out of the {"data": ...} envelope

import json, requests

API = "https://api.skillsafe.ai/v1/app-api"
TOKEN = "YOUR_TOKEN"  # see step 1 — read it from your shell environment in real code

def api(method, path, body=None, **headers):
    res = requests.request(method, API + path, json=body,
                           headers={"Authorization": f"Bearer {TOKEN}", **headers})
    payload = res.json()
    if not res.ok:
        raise RuntimeError(payload.get("error", {}).get("message", res.reason))
    return payload["data"]

// Node 18+ (built-in fetch)
const API = "https://api.skillsafe.ai/v1/app-api";
const TOKEN = "YOUR_TOKEN"; // see step 1 — read it from your shell environment in real code

async function api(method, path, body, extraHeaders = {}) {
  const res = await fetch(API + path, {
    method,
    headers: { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json", ...extraHeaders },
    body: body === undefined ? undefined : JSON.stringify(body),
  });
  const json = await res.json();
  if (!res.ok) throw new Error(json.error?.message ?? res.statusText);
  return json.data;
}

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

const API = "https://api.skillsafe.ai/v1/app-api"

var token = os.Getenv("SKILLSAFE_TOKEN") // see step 1

func call(method, path string, body, out any) error {
	var buf bytes.Buffer
	if body != nil {
		json.NewEncoder(&buf).Encode(body)
	}
	req, _ := http.NewRequest(method, API+path, &buf)
	req.Header.Set("Authorization", "Bearer "+token)
	req.Header.Set("Content-Type", "application/json")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		return err
	}
	defer res.Body.Close()
	var env struct {
		Data  json.RawMessage `json:"data"`
		Error *struct{ Message string `json:"message"` } `json:"error"`
	}
	json.NewDecoder(res.Body).Decode(&env)
	if res.StatusCode >= 400 {
		return fmt.Errorf("api %s %s: %s", method, path, env.Error.Message)
	}
	if out == nil {
		return nil
	}
	return json.Unmarshal(env.Data, out)
}

// Java 17+, no dependencies. Pair with your JSON library (Jackson, Gson…)
// to read fields out of the returned envelope.
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class SkillSafe {
    static final String API = "https://api.skillsafe.ai/v1/app-api";
    static final String TOKEN = System.getenv("SKILLSAFE_TOKEN"); // see step 1
    static final HttpClient HTTP = HttpClient.newHttpClient();

    static String api(String method, String path, String jsonBody) throws Exception {
        var req = HttpRequest.newBuilder(URI.create(API + path))
            .header("Authorization", "Bearer " + TOKEN)
            .header("Content-Type", "application/json")
            .method(method, jsonBody == null
                ? HttpRequest.BodyPublishers.noBody()
                : HttpRequest.BodyPublishers.ofString(jsonBody))
            .build();
        var res = HTTP.send(req, HttpResponse.BodyHandlers.ofString());
        if (res.statusCode() >= 400) throw new RuntimeException(res.body());
        return res.body(); // envelope: {"data": …}
    }
}

require "net/http"
require "json"

API = "https://api.skillsafe.ai/v1/app-api"
TOKEN = ENV.fetch("SKILLSAFE_TOKEN") # see step 1

def api(method, path, body = nil)
  uri = URI(API + path)
  req = Net::HTTP.const_get(method.capitalize).new(uri)
  req["Authorization"] = "Bearer #{TOKEN}"
  req["Content-Type"] = "application/json"
  req.body = body.to_json if body
  res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
  payload = JSON.parse(res.body)
  raise (payload.dig("error", "message") || res.message) unless res.is_a?(Net::HTTPSuccess)
  payload["data"]
end

<?php
const API = "https://api.skillsafe.ai/v1/app-api";
$TOKEN = getenv("SKILLSAFE_TOKEN"); // see step 1

function api(string $method, string $path, ?array $body = null): mixed {
    global $TOKEN;
    $ch = curl_init(API . $path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            "Authorization: Bearer $TOKEN",
            "Content-Type: application/json",
        ],
        CURLOPT_POSTFIELDS     => $body === null ? null : json_encode($body),
    ]);
    $payload = json_decode(curl_exec($ch), true);
    $status  = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);
    if ($status >= 400) {
        throw new Exception($payload["error"]["message"] ?? "HTTP $status");
    }
    return $payload["data"];
}

// .NET 8+
using System.Net.Http.Json;
using System.Text.Json;

static class SkillSafe
{
    const string Api = "https://api.skillsafe.ai/v1/app-api";
    static readonly HttpClient Http = new();

    static SkillSafe() =>
        Http.DefaultRequestHeaders.Authorization =
            new("Bearer", Environment.GetEnvironmentVariable("SKILLSAFE_TOKEN")); // see step 1

    public static async Task<JsonElement> ApiAsync(HttpMethod method, string path, object? body = null)
    {
        var req = new HttpRequestMessage(method, Api + path);
        if (body != null) req.Content = JsonContent.Create(body);
        var res = await Http.SendAsync(req);
        var json = await res.Content.ReadFromJsonAsync<JsonElement>();
        if (!res.IsSuccessStatusCode)
            throw new Exception(json.GetProperty("error").GetProperty("message").GetString());
        return json.GetProperty("data");
    }
}

curl -s -X POST "$API/guest" \
  -H "Content-Type: application/json" \
  -d '{"slug":"comp-check"}' | jq -r '.data.token'

token = api("POST", "/guest", {"slug": "comp-check"})["token"]

const { token } = await api("POST", "/guest", { slug: "comp-check" });

var guest struct{ Token string `json:"token"` }
err := call("POST", "/guest", map[string]string{"slug": "comp-check"}, &guest)

String envelope = api("POST", "/guest", """
    {"slug":"comp-check"}""");
// token is at data.token in the returned JSON

token = api("POST", "/guest", { slug: "comp-check" })["token"]

$token = api("POST", "/guest", ["slug" => "comp-check"])["token"];

var guest = await SkillSafe.ApiAsync(HttpMethod.Post, "/guest",
    new { slug = "comp-check" });
var token = guest.GetProperty("token").GetString();

curl -s "$API/me" -H "Authorization: Bearer $TOKEN" | jq '.data'

me = api("GET", "/me")
print(me["subject_type"], me["credits"])

const me = await api("GET", "/me");
console.log(me.subject_type, me.credits);

var me struct {
	SubjectType string `json:"subject_type"`
	Credits     int64  `json:"credits"`
}
err := call("GET", "/me", nil, &me)

String envelope = api("GET", "/me", null);
// data.subject_type, data.credits

me = api("GET", "/me")
puts "#{me["subject_type"]}: #{me["credits"]} credits"

$me = api("GET", "/me");
echo "{$me['subject_type']}: {$me['credits']} credits\n";

var me = await SkillSafe.ApiAsync(HttpMethod.Get, "/me");
Console.WriteLine($"{me.GetProperty("subject_type")}: {me.GetProperty("credits")} credits");

cat > bands.csv <<'BANDS'
role,level,min,mid,max
Software Engineer,L3,140000,155000,170000
Software Engineer,L4,165000,185000,205000
Software Engineer,L5,180000,200000,220000
Software Engineer,L6,215000,240000,265000
Product Manager,L3,135000,150000,165000
Product Manager,L4,162000,180000,198000
Product Manager,L5,195000,216000,237000
BANDS

cat > roster.csv <<'ROSTER'
name,role,level,location,base,bonus_target,equity_annual,start_date
Maya Okonkwo-Reyes,Software Engineer,L3,Austin,148000,8%,40000,2024-06
Devon Ashgrove,Software Engineer,L3,Remote - US,152000,8%,42000,2023-09
Priya Balasundaram,Software Engineer,L4,San Francisco,158000,10%,55000,2021-03
Tomas Villanueva-Kirk,Software Engineer,L4,San Francisco,204000,10%,70000,2026-01
Ines Marchetti,Software Engineer,L4,Remote - US,186000,10%,58000,2023-11
Kwame Adjei-Boateng,Software Engineer,L5,Austin,196000,12%,80000,2022-08
Sunniva Halvorsen,Software Engineer,L5,San Francisco,232000,12%,95000,2026-02
Rafael Quintanilla,Software Engineer,L5,London,205000,12%,85000,2024-02
Hollis Grierson,Software Engineer,L6,San Francisco,248000,15%,130000,2022-01
Anneke Vosloo,Product Manager,L3,Remote - US,149000,10%,40000,2025-04
Bao-Tran Nguyen-Delacroix,Product Manager,L4,Austin,,12%,60000,2024-10
Sergei Kaltenbrunner,Product Manager,L4,London,176000,12%,62000,2023-05
Zuri Mbeki-Lindqvist,Product Manager,L5,San Francisco,221000,15%,100000,2021-11
ROSTER

cat > context.txt <<'CONTEXT'
We are a Series B startup, about 80 people, heading into our annual compensation
review cycle in the next six weeks. We did not buy market benchmark survey data
this year, so these bands were set internally about 18 months ago and have not
been refreshed. Engineering attrition is my main worry - we lost two senior
engineers last quarter and I suspect some of our longer-tenured folks have
fallen behind.
CONTEXT

# the input object goes on the wire directly — there is no {"input": ...} wrapper
jq -n --rawfile bands bands.csv --rawfile roster roster.csv --rawfile context context.txt \
  '{bands: $bands, roster: $roster, context: $context}' > input.json

curl -s -X POST "$API/estimate" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d @input.json | jq '.data | {model, model_alias, markup_bps, hold_credits, min_credits, sponsor_enabled}'

from pathlib import Path

payload = {
    "bands":   Path("bands.csv").read_text(encoding="utf-8"),
    "roster":  Path("roster.csv").read_text(encoding="utf-8"),
    "context": Path("context.txt").read_text(encoding="utf-8"),
    # "compscan" is the browser's band-math summary — omit it from API calls
}

est = api("POST", "/estimate", payload)            # the object itself, unwrapped
print(est["model"], est["model_alias"], est["markup_bps"], "bps")
print("worst case:", est["hold_credits"], "credits; floor:", est["min_credits"])

me = api("GET", "/me")
if me["credits"] < est["min_credits"]:
    raise SystemExit("not enough credits to start this run")
if me["credits"] < est["hold_credits"]:
    print("balance below the full reserve — the run may be cut short")

import { readFileSync } from "node:fs";

const read = (f) => readFileSync(f, "utf8");

const payload = {
  bands: read("bands.csv"),
  roster: read("roster.csv"),
  context: read("context.txt"),
  // "compscan" is the browser's band-math summary — omit it from API calls
};

const est = await api("POST", "/estimate", payload); // the object itself, unwrapped
console.log(est.model, est.model_alias, est.markup_bps, "bps");
console.log("worst case:", est.hold_credits, "credits; floor:", est.min_credits);

const me = await api("GET", "/me");
if (me.credits < est.min_credits) throw new Error("not enough credits to start this run");
if (me.credits < est.hold_credits) console.warn("balance below the full reserve — may be cut short");

read := func(name string) string {
	b, err := os.ReadFile(name)
	if err != nil {
		log.Fatal(err)
	}
	return string(b)
}

payload := map[string]any{
	"bands":   read("bands.csv"),
	"roster":  read("roster.csv"),
	"context": read("context.txt"),
	// "compscan" is the browser's band-math summary — omit it from API calls
}

var est struct {
	Model          string `json:"model"`
	ModelAlias     string `json:"model_alias"`
	MarkupBps      int    `json:"markup_bps"`
	HoldCredits    int64  `json:"hold_credits"`
	MinCredits     int64  `json:"min_credits"`
	SponsorEnabled bool   `json:"sponsor_enabled"`
}
if err := call("POST", "/estimate", payload, &est); err != nil {
	log.Fatal(err)
}
fmt.Printf("%s (%s) markup %d bps — reserve %d, floor %d\n",
	est.Model, est.ModelAlias, est.MarkupBps, est.HoldCredits, est.MinCredits)

import java.nio.file.Files;
import java.nio.file.Path;

String bands   = Files.readString(Path.of("bands.csv"));
String roster  = Files.readString(Path.of("roster.csv"));
String context = Files.readString(Path.of("context.txt"));

// Build the body with your JSON library — the input object goes on the wire
// directly, with no {"input": ...} wrapper. toJsonString() escapes a string.
String jsonPayload = """
    {"bands": %s, "roster": %s, "context": %s}
    """.formatted(toJsonString(bands), toJsonString(roster), toJsonString(context));

String envelope = api("POST", "/estimate", jsonPayload);
// data.model, data.model_alias, data.markup_bps,
// data.hold_credits, data.min_credits, data.sponsor_enabled

payload = {
  bands:   File.read("bands.csv"),
  roster:  File.read("roster.csv"),
  context: File.read("context.txt")
  # "compscan" is the browser's band-math summary — omit it from API calls
}

est = api("POST", "/estimate", payload)          # the object itself, unwrapped
puts "#{est["model"]} (#{est["model_alias"]}) markup #{est["markup_bps"]} bps"
puts "worst case: #{est["hold_credits"]} credits; floor: #{est["min_credits"]}"

me = api("GET", "/me")
abort "not enough credits to start this run" if me["credits"] < est["min_credits"]

$payload = [
    "bands"   => file_get_contents("bands.csv"),
    "roster"  => file_get_contents("roster.csv"),
    "context" => file_get_contents("context.txt"),
    // "compscan" is the browser's band-math summary — omit it from API calls
];

$est = api("POST", "/estimate", $payload);       // the object itself, unwrapped
echo "{$est['model']} ({$est['model_alias']}) markup {$est['markup_bps']} bps\n";
echo "worst case: {$est['hold_credits']} credits; floor: {$est['min_credits']}\n";

$me = api("GET", "/me");
if ($me["credits"] < $est["min_credits"]) {
    throw new Exception("not enough credits to start this run");
}

var payload = new {
    bands   = File.ReadAllText("bands.csv"),
    roster  = File.ReadAllText("roster.csv"),
    context = File.ReadAllText("context.txt"),
    // "compscan" is the browser's band-math summary — omit it from API calls
};

var est = await SkillSafe.ApiAsync(HttpMethod.Post, "/estimate", payload);
Console.WriteLine($"{est.GetProperty("model")} ({est.GetProperty("model_alias")}) " +
                  $"markup {est.GetProperty("markup_bps")} bps");
Console.WriteLine($"reserve {est.GetProperty("hold_credits")}, " +
                  $"floor {est.GetProperty("min_credits")}");

var me = await SkillSafe.ApiAsync(HttpMethod.Get, "/me");
if (me.GetProperty("credits").GetInt64() < est.GetProperty("min_credits").GetInt64())
    throw new Exception("not enough credits to start this run");

KEY="comp-check-$(shasum -a 256 input.json | cut -c1-8)-$(date +%s)"

JOB_ID=$(curl -s -X POST "$API/run" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -H "Idempotency-Key: $KEY" \
  -d @input.json | jq -r '.data.job_id')

while :; do
  JOB=$(curl -s "$API/jobs/$JOB_ID" -H "Authorization: Bearer $TOKEN")
  STATUS=$(echo "$JOB" | jq -r '.data.status')
  [ "$STATUS" = "succeeded" ] || [ "$STATUS" = "failed" ] && break
  sleep 2
done

[ "$STATUS" = "failed" ] && { echo "$JOB" | jq -r '.data.error'; exit 1; }

# the review is plain text at data.output.output — write it straight out
echo "$JOB" | jq -r '.data.output.output' > review.md
echo "$JOB" | jq -r '"charged \(.data.charged_credits) credits, truncated=\(.data.truncated)"'

VERDICT=$(head -n 1 review.md | sed 's/^VERDICT:[[:space:]]*//')
echo "verdict: $VERDICT"
grep -n '^## ' review.md

# gate the cycle checklist on the verdict
[ "$VERDICT" = "Healthy" ] || { echo "comp needs work before the cycle"; exit 1; }

import re, time, uuid

job_id = api("POST", "/run", payload,
             **{"Idempotency-Key": f"comp-check-{uuid.uuid4().hex[:8]}"})["job_id"]

while True:
    job = api("GET", f"/jobs/{job_id}")
    if job["status"] in ("succeeded", "failed"):
        break
    time.sleep(1.5)

if job["status"] == "failed":
    raise RuntimeError(job.get("error", "run failed"))

review = job["output"]["output"]            # plain text, not JSON
if job.get("truncated"):
    print("warning: the run was cut short by the credit reserve")

verdict = re.search(r"^VERDICT:\s*(.+)$", review, re.M).group(1).strip()
scope = re.search(r"^SCOPE:\s*(.+)$", review, re.M).group(1).strip()
confidence = int(re.search(r"^CONFIDENCE:\s*(\d{1,3})\s*$", review, re.M).group(1))
print(f"{verdict} — {scope} (confidence {confidence})")
print("charged:", job["charged_credits"], "credits")

sections = dict(re.findall(r"^## (.+)\n([\s\S]*?)(?=\n## |\Z)", review, re.M))
for name in ("Band placement and outliers", "Retention risks",
             "Recommendations", "Data gaps"):
    bullets = [b.strip() for b in re.findall(r"^- (.+)$", sections[name], re.M)]
    if bullets == ["None."]:
        bullets = []
    print(f"{name}: {len(bullets)}")
    for b in bullets:
        print("   -", b)

with open("review.md", "w", encoding="utf-8") as fh:
    fh.write(review)

if verdict != "Healthy":
    raise SystemExit(f"{verdict} — review before the cycle closes")

import { writeFileSync } from "node:fs";

const { job_id } = await api("POST", "/run", payload,
  { "Idempotency-Key": `comp-check-${crypto.randomUUID().slice(0, 8)}` });

let job;
do {
  await new Promise((r) => setTimeout(r, 1500));
  job = await api("GET", `/jobs/${job_id}`);
} while (job.status !== "succeeded" && job.status !== "failed");

if (job.status === "failed") throw new Error(job.error ?? "run failed");

const review = job.output.output;            // plain text, not JSON
if (job.truncated) console.warn("the run was cut short by the credit reserve");

const tag = (name) => new RegExp(`^${name}:\\s*(.+)$`, "m").exec(review)?.[1].trim();
console.log(`${tag("VERDICT")} — ${tag("SCOPE")} (confidence ${tag("CONFIDENCE")})`);
console.log("charged:", job.charged_credits, "credits");

const sections = Object.fromEntries(
  [...review.matchAll(/^## (.+)\n([\s\S]*?)(?=\n## |$)/gm)].map((m) => [m[1], m[2]]),
);
for (const name of ["Band placement and outliers", "Retention risks",
                    "Recommendations", "Data gaps"]) {
  let bullets = [...sections[name].matchAll(/^- (.+)$/gm)].map((m) => m[1].trim());
  if (bullets.length === 1 && /^none\.?$/i.test(bullets[0])) bullets = [];
  console.log(`${name}: ${bullets.length}`);
  for (const b of bullets) console.log("   -", b);
}

writeFileSync("review.md", review);
if (tag("VERDICT") !== "Healthy") process.exitCode = 1;

// POST /run with an Idempotency-Key needs a header, so build the request by hand
// (or extend call() to take one) — then poll /jobs/{id} exactly as the SDK does.
var started struct{ JobID string `json:"job_id"` }
if err := callWithKey("POST", "/run", payload, "comp-check-3f2a1b7c-mf4k2p1", &started); err != nil {
	log.Fatal(err)
}

var job struct {
	Status         string `json:"status"`
	Error          string `json:"error"`
	ChargedCredits int64  `json:"charged_credits"`
	Truncated      bool   `json:"truncated"`
	Output         struct {
		Output string `json:"output"` // the review, as plain text
	} `json:"output"`
}
for {
	if err := call("GET", "/jobs/"+started.JobID, nil, &job); err != nil {
		log.Fatal(err)
	}
	if job.Status == "succeeded" || job.Status == "failed" {
		break
	}
	time.Sleep(1500 * time.Millisecond)
}
if job.Status == "failed" {
	log.Fatal(job.Error)
}

review := job.Output.Output
verdict := regexp.MustCompile(`(?m)^VERDICT:\s*(.+)$`).FindStringSubmatch(review)[1]
scope := regexp.MustCompile(`(?m)^SCOPE:\s*(.+)$`).FindStringSubmatch(review)[1]
fmt.Printf("%s — %s (charged %d credits, truncated=%v)\n",
	strings.TrimSpace(verdict), strings.TrimSpace(scope), job.ChargedCredits, job.Truncated)

for _, m := range regexp.MustCompile(`(?m)^## (.+)$`).FindAllStringSubmatch(review, -1) {
	fmt.Println("section:", m[1])
}
os.WriteFile("review.md", []byte(review), 0o600)

// Add the Idempotency-Key header to the /run request (extend api() with a
// headers map, or build the HttpRequest inline).
String envelope = api("POST", "/run", jsonPayload);   // + Idempotency-Key
String jobId = /* data.job_id via your JSON library */;

String job;
String status;
while (true) {
    job = api("GET", "/jobs/" + jobId, null);
    status = /* data.status */;
    if (status.equals("succeeded") || status.equals("failed")) break;
    Thread.sleep(1500);
}
// data.output.output is the review as PLAIN TEXT — no JSON parse needed.
// data.charged_credits is what you actually paid; data.truncated is true when
// the reserve cut the reply short; data.error carries the failure message.
//
// String review = /* data.output.output */;
// Matcher m = Pattern.compile("^VERDICT:\\s*(.+)$", Pattern.MULTILINE).matcher(review);
// The five "## " headings — Findings, Band placement and outliers, Retention
// risks, Recommendations, Data gaps — split the body; the last four hold
// "- " bullets, or the single bullet "- None.".
// Files.writeString(Path.of("review.md"), review);

started = api("POST", "/run", payload)   # add the Idempotency-Key header here

job = nil
loop do
  job = api("GET", "/jobs/#{started["job_id"]}")
  break if %w[succeeded failed].include?(job["status"])
  sleep 1.5
end
raise (job["error"] || "run failed") if job["status"] == "failed"

review = job["output"]["output"]         # plain text, not JSON
warn "the run was cut short by the credit reserve" if job["truncated"]

verdict = review[/^VERDICT:\s*(.+)$/, 1].strip
scope   = review[/^SCOPE:\s*(.+)$/, 1].strip
puts "#{verdict} — #{scope} (charged #{job["charged_credits"]} credits)"

sections = review.scan(/^## (.+)\n(.*?)(?=\n## |\z)/m).to_h
["Band placement and outliers", "Retention risks",
 "Recommendations", "Data gaps"].each do |name|
  bullets = sections[name].to_s.scan(/^- (.+)$/).flatten.map(&:strip)
  bullets = [] if bullets.length == 1 && bullets[0] =~ /\Anone\.?\z/i
  puts "#{name}: #{bullets.length}"
  bullets.each { |b| puts "   - #{b}" }
end

File.write("review.md", review)
exit 1 unless verdict == "Healthy"

$started = api("POST", "/run", $payload);   // add the Idempotency-Key header here

do {
    sleep(2);
    $job = api("GET", "/jobs/" . $started["job_id"]);
} while (!in_array($job["status"], ["succeeded", "failed"]));

if ($job["status"] === "failed") {
    throw new Exception($job["error"] ?? "run failed");
}

$review = $job["output"]["output"];          // plain text, not JSON
if (!empty($job["truncated"])) {
    fwrite(STDERR, "the run was cut short by the credit reserve\n");
}

preg_match('/^VERDICT:\s*(.+)$/m', $review, $v);
preg_match('/^SCOPE:\s*(.+)$/m', $review, $s);
echo trim($v[1]) . " — " . trim($s[1]) .
     " (charged {$job['charged_credits']} credits)\n";

preg_match_all('/^## (.+)\n(.*?)(?=\n## |\z)/ms', $review, $secs, PREG_SET_ORDER);
foreach ($secs as $sec) {
    if ($sec[1] === "Findings") { continue; }
    preg_match_all('/^- (.+)$/m', $sec[2], $bs);
    $bullets = array_map("trim", $bs[1]);
    if (count($bullets) === 1 && preg_match('/^none\.?$/i', $bullets[0])) {
        $bullets = [];
    }
    echo "{$sec[1]}: " . count($bullets) . "\n";
    foreach ($bullets as $b) { echo "   - $b\n"; }
}

file_put_contents("review.md", $review);
if (trim($v[1]) !== "Healthy") { exit(1); }

using System.Text.RegularExpressions;

var runReq = new HttpRequestMessage(HttpMethod.Post, "/run");
// send the same payload with an Idempotency-Key header:
//   runReq.Headers.Add("Idempotency-Key", $"comp-check-{hash}-{nonce}");
var started = await SkillSafe.ApiAsync(HttpMethod.Post, "/run", payload);
var jobId = started.GetProperty("job_id").GetString();

JsonElement job;
while (true)
{
    job = await SkillSafe.ApiAsync(HttpMethod.Get, $"/jobs/{jobId}");
    var status = job.GetProperty("status").GetString();
    if (status is "succeeded" or "failed") break;
    await Task.Delay(1500);
}

var review = job.GetProperty("output").GetProperty("output").GetString()!; // plain text
var verdict = Regex.Match(review, "^VERDICT:\\s*(.+)$", RegexOptions.Multiline).Groups[1].Value.Trim();
var scope = Regex.Match(review, "^SCOPE:\\s*(.+)$", RegexOptions.Multiline).Groups[1].Value.Trim();
Console.WriteLine($"{verdict} — {scope} " +
                  $"(charged {job.GetProperty("charged_credits")} credits)");

foreach (Match m in Regex.Matches(review, "^## (.+)$", RegexOptions.Multiline))
    Console.WriteLine("section: " + m.Groups[1].Value);

await File.WriteAllTextAsync("review.md", review);
if (verdict != "Healthy") Environment.ExitCode = 1;

# -N disables buffering so events print as they arrive
curl -N -s -X POST "$API/run-stream" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -H "Idempotency-Key: comp-check-3f2a1b7c-mf4k2p1" \
  -d @input.json

# event: job
# data: {"job_id":"job_...","status":"running"}
#
# event: delta
# data: {"text":"VERDICT: At risk\nSCOPE: Engineering and PM"}
# ...
# event: done
# data: {"job_id":"job_...","status":"succeeded","charged_credits":612,
#        "truncated":false,"output":{"output":"VERDICT: At risk\n..."}}

import json, re, requests

result = None
with requests.post(
    API + "/run-stream",
    headers={"Authorization": f"Bearer {TOKEN}",
             "Idempotency-Key": "comp-check-3f2a1b7c-mf4k2p1"},
    json=payload,
    stream=True,
) as r:
    r.raise_for_status()
    event = None
    for line in r.iter_lines(decode_unicode=True):
        if not line:
            continue
        if line.startswith("event:"):
            event = line[len("event:"):].strip()
        elif line.startswith("data:"):
            data = json.loads(line[len("data:"):].strip())
            if event == "delta":
                print(".", end="", flush=True)          # live progress
            elif event == "done":
                result = data
            elif event == "error":
                raise RuntimeError(data.get("message", "run failed"))

review = result["output"]["output"]                     # authoritative
print("\ncharged:", result["charged_credits"], "credits")
print(re.search(r"^VERDICT:\s*(.+)$", review, re.M).group(1))
with open("review.md", "w", encoding="utf-8") as fh:
    fh.write(review)

const res = await fetch(API + "/run-stream", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${TOKEN}`,
    "Content-Type": "application/json",
    "Idempotency-Key": "comp-check-3f2a1b7c-mf4k2p1",
  },
  body: JSON.stringify(payload),
});

const reader = res.body.getReader();
const decoder = new TextDecoder();
let buf = "", done = null, seen = "";

for (;;) {
  const chunk = await reader.read();
  if (chunk.done) break;
  buf += decoder.decode(chunk.value, { stream: true });
  const frames = buf.split("\n\n");
  buf = frames.pop();
  for (const frame of frames) {
    const name = /^event:\s*(.+)$/m.exec(frame)?.[1];
    const body = /^data:\s*(.+)$/m.exec(frame)?.[1];
    if (!name || !body) continue;
    const data = JSON.parse(body);
    if (name === "delta") { seen += data.text; process.stdout.write("."); }
    if (name === "done") done = data;
    if (name === "error") throw new Error(data.message ?? "run failed");
  }
}

const review = done.output.output;   // trust this, not the concatenated deltas
console.log(`\n${done.charged_credits} credits`);
console.log(/^VERDICT:\s*(.+)$/m.exec(review)[1]);
writeFileSync("review.md", review);

body, _ := json.Marshal(payload)
req, _ := http.NewRequest("POST", API+"/run-stream", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Idempotency-Key", "comp-check-3f2a1b7c-mf4k2p1")

res, err := http.DefaultClient.Do(req)
if err != nil {
	log.Fatal(err)
}
defer res.Body.Close()

var event string
var final map[string]any
sc := bufio.NewScanner(res.Body)
sc.Buffer(make([]byte, 0, 64*1024), 4*1024*1024)
for sc.Scan() {
	line := sc.Text()
	switch {
	case strings.HasPrefix(line, "event:"):
		event = strings.TrimSpace(strings.TrimPrefix(line, "event:"))
	case strings.HasPrefix(line, "data:"):
		var data map[string]any
		json.Unmarshal([]byte(strings.TrimPrefix(line, "data:")), &data)
		switch event {
		case "delta":
			fmt.Print(".") // live progress
		case "done":
			final = data
		case "error":
			log.Fatal(data["message"])
		}
	}
}
// final["output"].(map[string]any)["output"].(string) is the review text —
// write it to review.md and read the VERDICT/SCOPE/CONFIDENCE lines as in step 4.

// Java 17+ — read the stream line by line instead of buffering the body.
var req = HttpRequest.newBuilder(URI.create(API + "/run-stream"))
    .header("Authorization", "Bearer " + TOKEN)
    .header("Content-Type", "application/json")
    .header("Idempotency-Key", "comp-check-3f2a1b7c-mf4k2p1")
    .POST(HttpRequest.BodyPublishers.ofString(jsonPayload))
    .build();

var res = HTTP.send(req, HttpResponse.BodyHandlers.ofLines());
String event = null, done = null;
for (String line : (Iterable<String>) res.body()::iterator) {
    if (line.startsWith("event:")) {
        event = line.substring(6).trim();
    } else if (line.startsWith("data:")) {
        String data = line.substring(5).trim();
        if ("delta".equals(event)) System.out.print(".");   // live progress
        else if ("done".equals(event)) done = data;
        else if ("error".equals(event)) throw new RuntimeException(data);
    }
}
// parse `done`, then read data.output.output — a plain-text review whose first
// line is VERDICT:, followed by SCOPE:, CONFIDENCE:, SUMMARY: and the five
// "## " sections. data.charged_credits is the settled price.

require "net/http"
require "json"

uri = URI(API + "/run-stream")
req = Net::HTTP::Post.new(uri)
req["Authorization"] = "Bearer #{TOKEN}"
req["Content-Type"] = "application/json"
req["Idempotency-Key"] = "comp-check-3f2a1b7c-mf4k2p1"
req.body = payload.to_json

event = nil
done = nil
Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
  http.request(req) do |res|
    res.read_body do |chunk|
      chunk.each_line do |line|
        line = line.strip
        if line.start_with?("event:")
          event = line.delete_prefix("event:").strip
        elsif line.start_with?("data:")
          data = JSON.parse(line.delete_prefix("data:").strip)
          case event
          when "delta" then print "."           # live progress
          when "done"  then done = data
          when "error" then raise (data["message"] || "run failed")
          end
        end
      end
    end
  end
end

review = done["output"]["output"]
puts "\n#{done["charged_credits"]} credits - #{review[/^VERDICT:\s*(.+)$/, 1]}"
File.write("review.md", review)

$event = null;
$done  = null;

$ch = curl_init(API . "/run-stream");
curl_setopt_array($ch, [
    CURLOPT_POST       => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $TOKEN",
        "Content-Type: application/json",
        "Idempotency-Key: comp-check-3f2a1b7c-mf4k2p1",
    ],
    CURLOPT_POSTFIELDS => json_encode($payload),
    CURLOPT_WRITEFUNCTION => function ($ch, $chunk) use (&$event, &$done) {
        foreach (explode("\n", $chunk) as $line) {
            $line = trim($line);
            if (str_starts_with($line, "event:")) {
                $event = trim(substr($line, 6));
            } elseif (str_starts_with($line, "data:")) {
                $data = json_decode(trim(substr($line, 5)), true);
                if ($event === "delta") { echo "."; }        // live progress
                elseif ($event === "done") { $done = $data; }
                elseif ($event === "error") { throw new Exception($data["message"] ?? "run failed"); }
            }
        }
        return strlen($chunk);
    },
]);
curl_exec($ch);
curl_close($ch);

$review = $done["output"]["output"];
preg_match('/^VERDICT:\s*(.+)$/m', $review, $v);
echo "\n{$done['charged_credits']} credits - " . trim($v[1]) . "\n";
file_put_contents("review.md", $review);

var req = new HttpRequestMessage(HttpMethod.Post, Api + "/run-stream") {
    Content = JsonContent.Create(payload),
};
req.Headers.Add("Idempotency-Key", "comp-check-3f2a1b7c-mf4k2p1");

using var res = await Http.SendAsync(req, HttpCompletionOption.ResponseHeadersRead);
using var reader = new StreamReader(await res.Content.ReadAsStreamAsync());

string? evt = null, done = null;
while (await reader.ReadLineAsync() is { } line)
{
    if (line.StartsWith("event:")) evt = line[6..].Trim();
    else if (line.StartsWith("data:"))
    {
        var data = line[5..].Trim();
        if (evt == "delta") Console.Write(".");            // live progress
        else if (evt == "done") done = data;
        else if (evt == "error") throw new Exception(data);
    }
}

using var final = JsonDocument.Parse(done!);
var review = final.RootElement.GetProperty("output").GetProperty("output").GetString()!;
Console.WriteLine();
Console.WriteLine(final.RootElement.GetProperty("charged_credits") + " credits");
Console.WriteLine(Regex.Match(review, "^VERDICT:\\s*(.+)$", RegexOptions.Multiline).Groups[1].Value);
await File.WriteAllTextAsync("review.md", review);