kairos-chain 3.94.0 → 3.95.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05055bfa3f7c4377e2e88011754c85d8d87c690e07f19837c4dca5a0c1cd033c
-  data.tar.gz: 48b9c8a70d27304e21293440f121ec069cb0c7ec47ed41b01573cdd2e3c80505
+  metadata.gz: 3bce3f299f0bb91ecbb6199e464a2ea24602ede6e9d4e972c1a7b5905ec447c5
+  data.tar.gz: 4986b9e4f8c87ff233b67586791d8b3068aed4decaecb1319f5c0553b4a5445c
 SHA512:
-  metadata.gz: '08ee4ff5f61407bdcc390eb8c4cda6c286472672a6549ded81d5d0b1c7cf29f8203a472f9cfa5d4cfc811b1b8d923d4ee77ee6746decad1893a33c01187ecc1e'
-  data.tar.gz: 0b94dde53ddce2444defb9933515dda0d4e754bb0e6053129927d82032bdb9b73383b5d67234a9b57f3e003e82e1b004c17c94f6e551a45ba2fc5dca412bd340
+  metadata.gz: a4af517774c9e5e90299d4877190d83659932acf7851bf04275d5c3066298411ca628084a490cfef6348b327d550c05d5cc4f96cab086e5c297e2a169e1f72b3
+  data.tar.gz: ba67dc90461e4350615a4ba9e232702efc27b241fa853a2934a80714bb5753c2aa1ebba06921ebe58e4db7145d8f3fb5d747be4ab37f8ad5da25150ab8c7ce8d

data/CHANGELOG.md

@@ -6,6 +6,77 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [3.95.0] - 2026-10-21
+
+### Changed — the `agent` SkillSet is rebuilt (1.0): long runs in the host session, a stand-in instead of terminal approvals
+
+The 0.x agent could not carry the operator's ordinary request (design → design review → implement →
+implementation review): its act route wrote only `docs/drafts/draft_*`, could not reach multi-LLM review or
+tests, and counted only terminal-attested answers (0 counted pairs). Design:
+`log/agent_skillset_rebuild_design_v0.5.1_20261020.md` (five review rounds, frozen as the author's proposal)
+and its delta `log/agent_skillset_rebuild_design_v0.6.3_20261020.md`.
+
+- The host session (Claude Code) is the only body. The SkillSet supplies a plan from a Ruby-DSL template, a
+  stand-in (isolated `claude -p --safe-mode --tools ""`, Opus 5.5) that answers decision points from the
+  operator's own words and the instruction mode, a guard (host hooks: `PreToolUse` on every tool, fail-closed)
+  that lets through only what the run created or its worktree and branch hold, a hash-chained journal, and a
+  report check. Six tools: `agent_start`, `agent_status`, `agent_advance`, `agent_items`, `agent_finish`,
+  `agent_stop`.
+- Runs need an adopted policy (the operator's mandate, `config/policies/*.rb`), adopted by the operator's own
+  typed words naming its digest; the adoption is recorded on the chain.
+- Templates: `dev_cycle`, `impl_cycle`, `design_only`, `doc_cycle` (a document kept in git, revised in place,
+  optional build check), `survey` (versioned survey files from local sources), `general`.
+- A review closes only when no (a)/(b) P0 is open. Each review may take the policy's `review_rounds`
+  (10), counted for that review alone; at the cap it waits for the operator, who grants more rounds or
+  freezes it. Revisions follow L1 multi_llm_review_workflow § Revision
+  Discipline: each round says which new P0s the actor's last addition drew, and the next step is to undo it.
+  Design reviews stay at the design level; implementation-only findings are deferred to the implementation
+  review and are operator items at once.
+- Every run ends with a layered-deck report (`report_kit/`, the kit of L1 `layered_visual_pitch_deck`).
+- `bin/agent_harvest.rb` harvests the operator's own answers from host transcripts (hook output, peer
+  messages and pasted host output excluded).
+- Removed: the in-server OODA loop, act-route table and terminal rulings, shadow judge, distillation,
+  native body, `agent_execute`, `agent_step`, `agent_wait`, `operator_report`, the `agent-monitor` subagent.
+- `agent` is no longer installed automatically in new instances (it needs a policy and projects hooks).
+  An installed 0.x agent becomes 1.0 on upgrade. 1.0 needs `multi_llm_review` and `llm_client` >= 0.3.0 in
+  the same instance; upgrade does not install a missing one (`kairos-chain skillset install multi_llm_review`).
+
+### Added — `removed_files` in `skillset.json`; `system_upgrade` archives them
+
+`upgrade_apply` copied changed files and never deleted one, so a SkillSet that dropped files left them to be
+loaded. A template may now list `removed_files`; upgrade moves each from the installed copy to
+`storage/skillset_removed/<name>/<time>/`, and a forced reinstall no longer restores a retired config file.
+
+### Added — `llm_call` options `no_fallback` and `isolated`
+
+`no_fallback` makes an authentication failure on the configured provider a failure instead of a silent switch
+to `claude_code`. `isolated` (claude_code) runs `claude -p --safe-mode --tools ""` in an empty directory, so
+no CLAUDE.md, skills, plugins, hooks, memory or MCP servers reach the call. An isolated call's payload carries
+`isolation` (`safe_mode`, `tools`, `cwd`, as `claude -p` was spawned); llm_client is 0.3.0. The agent's
+stand-in refuses any reply without that evidence (and refuses to call an llm_client too old to isolate), and the
+agent SkillSet declares `llm_client >= 0.3.0`; upgrade both together.
+
+### Added — `user_level_conflicts` in `skillset.json`; install and upgrade report them
+
+A SkillSet may list files an earlier version left at user level that it cannot remove itself (e.g. a personal
+skill that shadows the project's). `install`, `upgrade_apply`, `system_upgrade` and `kairos-chain skillset
+install/upgrade` print the ones present as warnings, with a command that moves them to a timestamped backup.
+agent 1.0 lists the 0.x personal skill `~/.claude/skills/agent/SKILL.md` and `~/.claude/agents/agent-monitor.md`.
+
+### Changed — the shipped agent policy needs a new adoption
+
+`masa_2026_10_20.rb` sets `review_rounds` to 10 rounds for each review (counted apart, no longer shared by a
+run's reviews) and drops the lookup consent comment (runs never look things up on the web). Its digest
+changed: adopt it with `adopt policy masa_2026_10_20 8846b67e`.
+
+### Changed — L1 `multi_llm_review_workflow` 3.16.0 and `design_to_implementation_workflow` 1.3
+
+A new entry-level clause, § Provisional delegation under a mandate: under a pinned, journaled operator policy a
+named delegate — never the context whose work is judged — answers reserved judgments provisionally, and nothing
+resolves, closes, freezes or demotes beyond the run until the operator confirms it in their own words. Pointers
+from INV-U2, INV-U4, INV-U5, Step 0.25 and § Convergence Rules, and from the merge criteria of
+`design_to_implementation_workflow`. An instance's own L1 copy is not rewritten by upgrade.
+
 ## [3.94.0] - 2026-10-20
 
 ### Added — L0 changes proposed for later approval, L0 restores on the record, L1 body history

data/bin/kairos-chain

@@ -102,6 +102,7 @@ when 'skillset'
     result = manager.install(source, layer_override: layer_override, force: force)
     puts "Installed SkillSet '#{result[:name]}' v#{result[:version]} [#{result[:layer]}]"
     puts "Path: #{result[:path]}"
+    manager.user_level_conflicts(KairosMcp::Skillset.new(result[:path])).each { |w| puts "  [WARNING] #{w}" }
 
   when 'enable'
     name = ARGV.shift
@@ -162,6 +163,7 @@ when 'skillset'
       puts "## SkillSets"
       results.each do |r|
         puts "  [UPGRADED]  #{r[:name].ljust(22)} v#{r[:from]} -> v#{r[:to]} (#{r[:files_updated]} files)"
+        Array(r[:warnings]).each { |w| puts "    [WARNING] #{w}" }
       end
       checkable.reject { |ss| upgraded_names.include?(ss.name) }.each do |ss|
         puts "  [UNCHANGED] #{ss.name.ljust(22)} v#{ss.version}"

data/lib/kairos_mcp/skillset.rb

@@ -87,6 +87,27 @@ module KairosMcp
       @metadata['config_files'] || []
     end
 
+    # Files a release takes out of an installed copy (relative paths). An
+    # upgrade copies changed files and never deletes; a SkillSet that drops
+    # files names them here so system_upgrade archives them instead of
+    # leaving them to be loaded (Skillset#load requires every tools/*.rb).
+    def removed_files
+      Array(@metadata['removed_files']).select do |rel|
+        rel.is_a?(String) && !rel.empty? && !rel.start_with?('/') && !rel.split('/').include?('..')
+      end
+    end
+
+    # Files outside the instance that an earlier version left at user level
+    # and that this version cannot remove itself (e.g. a personal skill that
+    # shadows the project's): each { "path": "~/...", "pattern": "regex",
+    # "note": "..." }. Upgrade reports the ones present; the operator moves
+    # them.
+    def user_level_conflicts
+      Array(@metadata['user_level_conflicts']).select do |c|
+        c.is_a?(Hash) && c['path'].is_a?(String) && c['path'].start_with?('~/') && !c['path'].split('/').include?('..')
+      end
+    end
+
     # Optional fail-closed activation hook: a fully-qualified class name
     # whose `activate_on_load!` runs at skillset-load time, independent of
     # whether any of the SkillSet's tools are instantiated. Used by

data/lib/kairos_mcp/skillset_manager.rb

@@ -89,12 +89,14 @@ module KairosMcp
       dest = File.join(@skillsets_dir, temp_skillset.name)
       if File.directory?(dest)
         if force
-          # Preserve user config files before replacing
+          # Preserve user config files (subdirectories included) before replacing
           config_dir = File.join(dest, 'config')
           saved_configs = {}
           if File.directory?(config_dir)
-            Dir.glob(File.join(config_dir, '*')).each do |f|
-              saved_configs[File.basename(f)] = File.read(f)
+            Dir.glob(File.join(config_dir, '**', '*')).each do |f|
+              next unless File.file?(f)
+
+              saved_configs[f.sub("#{config_dir}/", '')] = File.read(f)
             end
           end
 
@@ -103,12 +105,13 @@ module KairosMcp
           # Copy new version
           FileUtils.cp_r(source_path, dest)
 
-          # Restore user configs
-          unless saved_configs.empty?
-            FileUtils.mkdir_p(File.join(dest, 'config'))
-            saved_configs.each do |name, content|
-              File.write(File.join(dest, 'config', name), content)
-            end
+          # Restore user configs, except those the new version retired
+          retired = temp_skillset.removed_files.select { |r| r.start_with?('config/') }.map { |r| r.sub('config/', '') }
+          saved_configs.reject! { |rel, _| retired.include?(rel) }
+          saved_configs.each do |rel, content|
+            path = File.join(dest, 'config', rel)
+            FileUtils.mkdir_p(File.dirname(path))
+            File.write(path, content)
           end
         else
           raise ArgumentError, "SkillSet '#{temp_skillset.name}' already installed at #{dest}. Use --force to reinstall."
@@ -154,14 +157,16 @@ module KairosMcp
         template_ver = Gem::Version.new(template_ss.version)
 
         changed_files = diff_files(template_path, installed.path)
+        removals = template_ss.removed_files.select { |rel| File.exist?(File.join(installed.path, rel)) }
 
-        if template_ver > installed_ver || changed_files.any?
+        if template_ver > installed_ver || changed_files.any? || removals.any?
           results << {
             name: installed.name,
             installed_version: installed.version,
             available_version: template_ss.version,
             version_bump: template_ver > installed_ver,
             changed_files: changed_files,
+            removed_files: removals,
             new_skillset: false
           }
         end
@@ -194,7 +199,7 @@ module KairosMcp
     # Others (multiuser, service_grant, hestia, mmp, skillset_exchange, mcp_client)
     # require PostgreSQL or networking and must be installed explicitly.
     CORE_SKILLSETS = %w[
-      plugin_projector agent llm_client autoexec autonomos
+      plugin_projector llm_client autoexec autonomos
       skillset_creator knowledge_creator introspection dream
       document_authoring synoptis
     ].freeze
@@ -223,7 +228,8 @@ module KairosMcp
           # Install new SkillSet from template
           result = install(template_path)
           results << { name: info[:name], from: nil, to: info[:available_version],
-                       action: 'installed', files_updated: 0 }
+                       action: 'installed', files_updated: 0,
+                       warnings: user_level_conflicts(Skillset.new(File.join(@skillsets_dir, info[:name]))) }.reject { |_, v| v == [] }
         else
           # Upgrade existing: copy changed files
           dest = File.join(@skillsets_dir, info[:name])
@@ -233,11 +239,13 @@ module KairosMcp
             FileUtils.mkdir_p(File.dirname(dst))
             FileUtils.cp(src, dst) if File.exist?(src)
           end
+          archived = archive_removed_files(info[:name], dest, Array(info[:removed_files]))
 
           installed = Skillset.new(dest)
           record_skillset_event(installed, 'upgrade')
           results << { name: info[:name], from: info[:installed_version], to: info[:available_version],
-                       action: 'upgraded', files_updated: info[:changed_files].size }
+                       action: 'upgraded', files_updated: info[:changed_files].size, files_archived: archived.size,
+                       warnings: user_level_conflicts(installed) }.reject { |_, v| v == [] }
         end
       end
 
@@ -445,8 +453,45 @@ module KairosMcp
       all_skillsets.find { |ss| ss.name == name.to_s }
     end
 
+    # The user-level leftovers a SkillSet declares that are present now, as
+    # warnings with the command that moves them aside (a timestamped backup,
+    # so a second move never overwrites the first).
+    def user_level_conflicts(skillset)
+      skillset.user_level_conflicts.filter_map do |c|
+        path = File.expand_path(c['path'])
+        next unless File.exist?(path)
+        next if c['pattern'] && !File.read(path, encoding: 'UTF-8').match?(Regexp.new(c['pattern']))
+
+        backup = File.expand_path("~/.claude/#{skillset.name}_previous_version_backup/#{Time.now.strftime('%Y%m%d_%H%M%S')}")
+        "#{path}: #{c['note'] || 'left by an earlier version'} (move it aside: mkdir -p #{backup} && mv #{path} #{backup}/)"
+      end
+    rescue StandardError
+      []
+    end
+
     private
 
+    # Move files a release dropped out of the installed copy, into
+    # storage/skillset_removed/<name>/<time>/ (kept, not deleted, so the
+    # operator can read back what the upgrade took out). Paths are checked to
+    # stay inside the installed SkillSet.
+    def archive_removed_files(name, dest, rels)
+      return [] if rels.empty?
+
+      root = File.realpath(dest)
+      stamp = Time.now.utc.strftime('%Y%m%dT%H%M%SZ')
+      archive = File.join(KairosMcp.storage_dir, 'skillset_removed', name.to_s, stamp)
+      rels.filter_map do |rel|
+        src = File.join(root, rel)
+        next unless File.exist?(src) && File.expand_path(src).start_with?("#{root}/")
+
+        to = File.join(archive, rel)
+        FileUtils.mkdir_p(File.dirname(to))
+        FileUtils.mv(src, to)
+        rel
+      end
+    end
+
     # Compare files between template and installed SkillSet
     def diff_files(template_path, installed_path)
       changed = []

data/lib/kairos_mcp/tools/system_upgrade.rb

@@ -361,6 +361,7 @@ module KairosMcp
                 actions[:skillsets_upgraded] = (actions[:skillsets_upgraded] || []) << r[:name]
                 output += "  [UPGRADED] #{r[:name]} v#{r[:from]} → v#{r[:to]} (#{r[:files_updated]} files)\n"
               end
+              Array(r[:warnings]).each { |w| output += "    [WARNING] #{w}\n" }
             end
           end
         rescue => e
@@ -487,6 +488,7 @@ module KairosMcp
           else
             output += "  [UPGRADED] #{r[:name]} v#{r[:from]} → v#{r[:to]} (#{r[:files_updated]} files)\n"
           end
+          Array(r[:warnings]).each { |w| output += "    [WARNING] #{w}\n" }
         end
         output += "\nNo L0 template changes needed.\n"
         output += "Restart the MCP server to load new SkillSet tools.\n"

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.94.0"
+  VERSION = "3.95.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/knowledge/design_to_implementation_workflow/design_to_implementation_workflow.md

@@ -1,7 +1,7 @@
 ---
 name: design_to_implementation_workflow
 description: "Full-lifecycle workflow for complex features: design review, self-review, implementation review, and final merge gate. Derived from Service Grant + Attestation Nudge experiments."
-version: "1.2"
+version: "1.3"
 tags:
   - workflow
   - implementation
@@ -157,6 +157,9 @@ Claude Persona Assembly (4 personas):
 - NOT for intermediate rounds (diminishing returns)
 
 **Merge criteria**: new (a)+(b) P0 = 0, with the freeze declared by the operator.
+Inside an agent run a review closes provisionally (`multi_llm_review_workflow`
+§ Provisional delegation under a mandate) and only the operator freezes one; the
+operator's word at merge settles the merge and confirms only the closures it names.
 A Codex APPROVE is the strongest *reference* signal (see
 `multi_llm_reviewer_evaluation`), and it is not a gate: Codex went 24 of 24
 reviews without reaching APPROVE on one design loop, so a merge waiting on it

data/templates/knowledge/multi_llm_review_workflow/multi_llm_review_workflow.md

@@ -1,7 +1,7 @@
 ---
 name: multi_llm_review_workflow
 description: "Multi-LLM review methodology and execution — workflow pattern, CLI tooling, consensus analysis, Persona Assembly. Applicable to design, implementation, documentation, or any artifact."
-version: "3.15.1"
+version: "3.16.0"
 tags:
   - workflow
   - review
@@ -29,6 +29,21 @@ This skill covers:
 For **WHO** (which LLM is good at what), see: `multi_llm_reviewer_evaluation`
 For **development lifecycle** (design → implement → verify), see: `design_to_implementation_workflow`
 
+## Provisional delegation under a mandate
+
+This clause reaches every judgment that a norm pointing here reserves to a human, or gives to the context
+whose work it judges. Under a human-authored mandate — which may be a standing operator-owned policy,
+pinned by digest and journaled per run — a named delegate, never the context whose work the judgment
+concerns, may answer named classes of such judgments provisionally. Reversible work proceeds within the
+run on such an answer; the answer resolves, closes, freezes and demotes nothing beyond the run until the
+human confirms it in the human's own words. A review closed this way is provisionally closed and is
+reported as such; it is closed in the sense of § Convergence only on that confirmation.
+
+*Why:* runs of the agent SkillSet (1.0) are started by the operator and not answered during them; the
+operator's standing ruling of 2026-10-20 delegates reversible judgment to a stand-in that reads the
+operator's own words. Provisionality keeps what each pointing norm protects — the human's last word —
+without stopping the run at every judgment.
+
 ## Step -1 — Pre-declared review spec (loop hygiene)
 
 > Validation scope: these rules were derived from one non-converging loop
@@ -271,6 +286,8 @@ still in its transient state blocks dispatch until re-triaged.
 orchestrator posing a question and answering it itself does not constitute
 resolution. (Same conceptual line as ACT-1 in L2 attestation — analogical,
 not a shared implementation: judgment-shaped decisions belong to the human.)
+Inside a run under a mandate, a delegate's answer in the interview is a provisional
+declaration, not a resolution (§ Provisional delegation under a mandate).
 
 **INV-U3 (constitutive recording).** The products of the pass — enumerated
 questions, human answers, declared Open Unknowns — are recorded to L2. A
@@ -300,7 +317,9 @@ advisory by default, subject to two bounds:
 
 Findings about the *integrity* of the design — internal contradiction,
 unrealizable invariant, an Open Unknown whose declared deferral is itself
-unsafe — remain (a)/(b) and block as before.
+unsafe — remain (a)/(b) and block as before. A provisional declaration made
+under a mandate carries no demotion power beyond its run until the human
+confirms it (§ Provisional delegation under a mandate).
 
 **INV-U5 (classification authority).** The judgment-shaped /
 non-judgment-shaped classification of an unknown is a human prerogative.
@@ -309,7 +328,9 @@ declining, or judging a question draft-answerable). Unattended, every
 surfaced unknown is judgment-shaped by default; only a human-authored
 mandate may pre-classify named categories as non-judgment-shaped for a given
 run. An orchestrator's self-classification has no force. (Fail-closed:
-unclassified ⇒ judgment-shaped ⇒ stop.)
+unclassified ⇒ judgment-shaped ⇒ stop.) A standing operator-owned policy,
+pinned and journaled per run, is a human-authored mandate (§ Provisional
+delegation under a mandate).
 
 ### Unattended execution (autonomous loops)
 
@@ -334,7 +355,9 @@ same pending question produce no new side effects and no forward motion —
 re-stopping is idempotent; forward motion requires a human answer. The
 mandate's expressive power, the ratification protocol, and the
 pending-question queue mechanism are owned by the Autonomous Growth Loop
-guard track (see the frozen design's §11 backlog).
+guard track (see the frozen design's §11 backlog). Mandates for unattended
+growth loops remain with the Autonomous Growth Loop guard track; operator-started
+agent runs use the policy form of § Provisional delegation under a mandate.
 
 ### Acceptance observation (selective survival)
 
@@ -744,7 +767,9 @@ subtractive — see § Revision Discipline), is a freeze candidate for the
 operator regardless of the numerator. Neither of the two 2026-08 threads
 ever reached its APPROVE ratio; both closed by (a)+(b) exhaustion + operator
 freeze declaration — the intended close described above, now with a
-measurable trigger.
+measurable trigger. Inside a run under a mandate, the labelling and the closure
+declaration are the delegate's, provisionally, and never the orchestrating
+context's when that context did the work (§ Provisional delegation under a mandate).
 
 **Escalating raises the bar.** The rule is a ratio over the observers that
 counted, so adding reserve observers with `escalate: true` raises the number of
@@ -1993,6 +2018,16 @@ Compression ratio: parallel agent raw → Assembly ≈ 2:1
   Upgrading does not rewrite an instance's own `config/multi_llm_review.yml`,
   so an existing instance keeps Opus 4.6 until that entry is edited by hand.
 
+- Provisional delegation under a mandate (v3.16.0, 2026-10-21, operator
+  decision: 「基本1-9はそのように進めて下さい」, adopting the agent SkillSet
+  1.0 L1 clause drafts). A new entry-level clause after § Overview lets a
+  named delegate — never the context whose work is judged — answer reserved
+  judgments provisionally under a pinned, journaled operator policy; nothing
+  resolves, closes, freezes or demotes beyond the run until the human confirms
+  in their own words. Pointers were appended to INV-U2, INV-U4, INV-U5, the
+  Step 0.25 guard-track sentence and § Convergence Rules. Source: design
+  `log/agent_skillset_rebuild_design_v0.5.1_20261020.md` §2 and its delta v0.6.6.
+
 **Key insight**: Design reviews and implementation reviews find
 **categorically different bugs**. Both phases are necessary. The corollary that
 cost eight rounds to learn: **which of the two you are in is readable from the

data/templates/skillsets/agent/bin/agent_harvest.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+# Harvest the operator's own words from host transcripts into the agent's
+# precedent store (design v0.5.1 INV-5). Run it apart from runs, regularly:
+# the host deletes transcripts after 30 days. The operator runs it; the
+# store governs runs, so no run writes it.
+#
+#   ruby .kairos/skillsets/agent/bin/agent_harvest.rb [--data-dir DIR] [--since-days N]
+#                                                     [--import-snapshot SNAPSHOT_DIR] [--no-transcripts]
+
+require_relative '../lib/agent/harvest'
+require_relative '../lib/agent/run'
+
+def arg(name)
+  i = ARGV.index(name)
+  i && ARGV[i + 1]
+end
+
+data_dir = arg('--data-dir') || ENV['KAIROS_DATA_DIR'] || File.join(ENV['CLAUDE_PROJECT_DIR'] || Dir.pwd, '.kairos')
+since = (d = arg('--since-days')) ? Time.now - Integer(d) * 86_400 : nil
+paths = KairosMcp::SkillSets::Agent::Paths.new(data_dir)
+harvest = KairosMcp::SkillSets::Agent::Harvest.new(paths)
+if (snap = arg('--import-snapshot'))
+  puts "imported #{harvest.import_snapshot(File.expand_path(snap))} snapshot records"
+end
+puts "harvested #{harvest.run(since: since)} new records from transcripts" unless ARGV.include?('--no-transcripts')
+total = KairosMcp::SkillSets::Agent::Precedents.new(paths.precedents_dir).all.size
+puts "the store at #{paths.precedents_dir} holds #{total}"

data/templates/skillsets/agent/config/policies/masa_2026_10_20.rb

@@ -0,0 +1,17 @@
+# The operator's policy — the mandate for agent runs (design v0.5.1 §2).
+# A transcription of the operator's ruling of 2026-10-20 (L2
+# ruling_agent_skillset_rebuild_premise_20261020): reduce questions to the
+# minimum by judging autonomously from past logs and the instruction mode;
+# follow the operator's past decisions rather than default recommendations;
+# occasional mistakes are acceptable; claude -p from a host session; never
+# unattended. It binds only after the operator adopts this file's digest in
+# their own typed words; any edit changes the digest and needs a new adoption.
+
+policy "masa_2026_10_20" do
+  stand_in may: [:precedent, :instruction_mode, :novel_reversible]
+  consent review: :configured_providers, of: :project_artifacts
+  free_of_personal_data projects: []
+  # Review rounds for each review, counted apart: the only cap on a review,
+  # which closes only when no P0 is open; at the cap it waits for the operator.
+  spend default: { review_rounds: 10, stand_in_calls: 300 }
+end

data/templates/skillsets/agent/hooks/agent_hook.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+# Host hook entry for the agent SkillSet (design v0.5.1 §4). One script for
+# every event; the event name comes from the hook input. In a session that is
+# not bound to a run it only marks the guard as seen (PreToolUse,
+# SessionStart), tells KairosChain's own agent tools which session calls them,
+# and keeps the operator's words that may later adopt, confirm or correct
+# something; otherwise it returns without output, so ordinary sessions pay one
+# Ruby start and a file stat.
+
+require 'json'
+require 'fileutils'
+
+# The host may start hooks without a UTF-8 locale; journals and transcripts
+# hold the operator's words in UTF-8.
+Encoding.default_external = Encoding::UTF_8
+
+input = begin
+  JSON.parse($stdin.read)
+rescue JSON::ParserError => e
+  # Unreadable input cannot be attributed to a session; on a failing exit
+  # the plugin's PreToolUse command line blocks the call only if the session
+  # id it finds in the input is bound here.
+  warn "agent hook: unreadable hook input (#{e.message[0, 100]})"
+  exit 1
+end
+
+event = input['hook_event_name'].to_s
+sid = input['session_id'].to_s
+data_dir = ENV['KAIROS_DATA_DIR'] || File.join(ENV['CLAUDE_PROJECT_DIR'] || Dir.pwd, '.kairos')
+root = File.join(data_dir, 'storage', 'agent')
+safe = sid.gsub(/[^A-Za-z0-9_.-]/, '_')
+
+bound = !sid.empty? && File.exist?(File.join(root, 'bindings', safe))
+begin
+  if %w[PreToolUse SessionStart].include?(event) && !sid.empty?
+    FileUtils.mkdir_p(File.join(root, 'guard_seen'))
+    FileUtils.touch(File.join(root, 'guard_seen', safe))
+  end
+rescue SystemCallError
+  # The prelude never blocks an ordinary session; a bound one fails closed below.
+  exit 0 unless bound
+end
+
+# KairosChain's own agent tools (a server whose name says kairos, never
+# another server's agent_*) learn the calling session and its project in
+# every session (INV-6), without loading the library (Hooks.agent_tool?).
+AGENT_TOOL = /\Amcp__(.+)__agent_(start|status|advance|items|finish|stop)\z/
+agent_tool = (m = AGENT_TOOL.match(input['tool_name'].to_s)) && m[1].match?(/kairos/i) ? m[2] : nil
+# A bound session goes through the library, which also releases an ended
+# run's guard once the operator has spoken.
+if event == 'PreToolUse' && agent_tool && !bound
+  extra = { '_session_id' => sid, '_project_dir' => ENV['CLAUDE_PROJECT_DIR'] || input['cwd'] }.compact
+  puts JSON.generate('hookSpecificOutput' => { 'hookEventName' => 'PreToolUse', 'permissionDecision' => 'allow',
+                                               'updatedInput' => (input['tool_input'] || {}).merge(extra) })
+  exit 0
+end
+
+# Words that may adopt a policy, or name a decision or item to confirm,
+# correct or resolve (Hooks::REFERENCE).
+REFERENCE = /(?<![A-Za-z0-9])[DI]\d+(?![0-9A-Za-z])|(?i:adopt\s+policy)|採用|訂正|承認|確定(?!申告)|差し戻/
+needs_full = bound ||
+             (event == 'PostToolUse' && agent_tool == 'start') ||
+             (event == 'SessionStart' && Dir.exist?(File.join(root, 'runs'))) ||
+             (event == 'UserPromptSubmit' && input['prompt'].to_s.match?(REFERENCE))
+exit 0 unless needs_full
+
+begin
+  $LOAD_PATH.unshift(ENV['KAIROS_MCP_LIB']) if ENV['KAIROS_MCP_LIB']
+  require_relative '../lib/agent/hooks'
+
+  project_root = ENV['CLAUDE_PROJECT_DIR'] || File.dirname(data_dir)
+  paths = KairosMcp::SkillSets::Agent::Paths.new(data_dir)
+
+  # The operator's own deny and ask rules (user and project). A guard allow
+  # does not suppress the host's prompt for an ask rule, and a run's operator
+  # is not answering, so both are refused and queued (design §8). Bash rules
+  # are matched against every command the original line runs, before it is
+  # wrapped for confinement.
+  deny = []
+  rules = []
+  [File.expand_path('~/.claude/settings.json'),
+   File.join(project_root, '.claude', 'settings.json'),
+   File.join(project_root, '.claude', 'settings.local.json')].each do |path|
+    next unless File.exist?(path)
+
+    perms = JSON.parse(File.read(path))['permissions'] || {}
+    %w[deny ask].each do |kind|
+      Array(perms[kind]).each do |rule|
+        rule = rule.to_s.strip
+        if (m = rule.match(/\ABash\((.+)\)\z/))
+          pat = m[1]
+          prefix = pat.end_with?(':*')
+          # The host's wildcard form: * spans any text, a multi-line command's
+          # newlines too, and a final ' *' also takes the bare command
+          # (Bash(git commit *) names `git commit`).
+          body = Regexp.escape(prefix ? pat[0..-3] : pat).gsub('\\*', '.*').sub(/\\ \.\*\z/) { '(?:\s.*)?' }
+          # A prefix ends at a word: Bash(mv:*) names mv, not mvn.
+          deny << if !prefix then /\A\s*#{body}\s*\z/m
+                  elsif pat[0..-3].match?(/\w\z/) then /\A\s*#{body}(?=\s|\z)/m
+                  else /\A\s*#{body}/m
+                  end
+        elsif rule == 'Bash'
+          deny << /./
+        elsif (m = rule.match(/\A([A-Za-z0-9_*-]+)(?:\((.*)\))?\z/))
+          rules << { 'kind' => kind, 'tool' => m[1], 'spec' => m[2] }
+        end
+      end
+    end
+  rescue JSON::ParserError
+    next
+  end
+
+  stand_in_factory = lambda do |_run, policy|
+    llm_call = File.join(data_dir, 'skillsets', 'llm_client', 'tools', 'llm_call.rb')
+    require 'kairos_mcp/tools/base_tool'
+    require llm_call
+    KairosMcp::SkillSets::Agent::StandIn.new(
+      policy: policy,
+      instruction_mode: KairosMcp::SkillSets::Agent::InstructionMode.load(data_dir),
+      llm: KairosMcp::SkillSets::Agent::StandIn.default_llm(KairosMcp::SkillSets::LlmClient::Tools::LlmCall)
+    )
+  end
+
+  hooks = KairosMcp::SkillSets::Agent::Hooks.new(paths: paths, project_root: project_root,
+                                                 stand_in_factory: stand_in_factory, settings_deny: deny,
+                                                 settings_rules: rules)
+  out = hooks.handle(event, input)
+  puts JSON.generate(out) if out
+  exit 0
+rescue StandardError, ScriptError => e
+  warn "agent hook (#{event}): #{e.class}: #{e.message[0, 300]}"
+  if event == 'PreToolUse' && bound
+    puts JSON.generate('hookSpecificOutput' => { 'hookEventName' => 'PreToolUse', 'permissionDecision' => 'deny',
+                                                 'permissionDecisionReason' => "agent guard failed: #{e.class}" })
+    exit 0
+  end
+  exit 1
+end