@a-company/paradigm 3.46.0 → 5.3.3

package/dist/{symphony-6K3HD7AW.js → symphony-4OCY36AI.js}

@@ -26,7 +26,7 @@ import {
   routeMessage,
   unregisterAgent
 } from "./chunk-S2HO5MLR.js";
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-PDX44BCA.js";
 
 // src/commands/symphony/index.ts
 import chalk from "chalk";
@@ -57,7 +57,7 @@ async function symphonyJoinCommand(options) {
   Tip: Set up polling with: /loop 10s paradigm_symphony_poll`));
 }
 async function symphonyJoinRemote(rootDir, remote) {
-  const { SymphonyRelay } = await import("./symphony-relay-GTAJRCVF.js");
+  const { SymphonyRelay } = await import("./symphony-relay-UJYUXN65.js");
   let address;
   let embeddedCode;
   if (remote.includes("#")) {
@@ -174,7 +174,7 @@ async function symphonyWhoamiCommand() {
 async function symphonyListCommand(options) {
   cleanStaleAgents();
   const agents = listAgents();
-  const { loadPeers } = await import("./symphony-peers-HSY3RI3S.js");
+  const { loadPeers } = await import("./symphony-peers-2ZQYLRNI.js");
   const peers = loadPeers();
   const remoteAgents = [];
   for (const peer of peers) {
@@ -398,7 +398,7 @@ async function symphonyStatusCommand(options) {
   const threads = listThreads("active");
   const pendingRequests = listFileRequests("pending");
   const unread = identity ? readInbox(identity.id) : [];
-  const { loadPeers } = await import("./symphony-peers-HSY3RI3S.js");
+  const { loadPeers } = await import("./symphony-peers-2ZQYLRNI.js");
   const peers = loadPeers();
   const activePeers = peers.filter((p) => !p.revoked);
   if (options.json) {
@@ -443,7 +443,7 @@ async function symphonyStatusCommand(options) {
 async function symphonyServeCommand(options) {
   const port = parseInt(options.port || "3939", 10);
   const rootDir = process.cwd();
-  const { SymphonyRelay } = await import("./symphony-relay-GTAJRCVF.js");
+  const { SymphonyRelay } = await import("./symphony-relay-UJYUXN65.js");
   let identity = getMyIdentity(rootDir);
   if (!identity) {
     identity = registerAgent(rootDir);

package/dist/{symphony-YCHBYN3E.js → symphony-B75X2MME.js}

@@ -19,7 +19,7 @@ import {
   resolveThread,
   routeMessage
 } from "./chunk-S2HO5MLR.js";
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-PDX44BCA.js";
 
 // src/platform-server/routes/symphony.ts
 import { Router } from "express";
@@ -59,7 +59,7 @@ function createSymphonyRouter(projectDir, broadcast) {
   });
   router.get("/peers", async (_req, res) => {
     try {
-      const { loadPeers } = await import("./symphony-peers-HSY3RI3S.js");
+      const { loadPeers } = await import("./symphony-peers-2ZQYLRNI.js");
       const peers = loadPeers();
       const result = peers.map((p) => ({
         id: p.id,

package/dist/{symphony-peers-HSY3RI3S.js → symphony-peers-2ZQYLRNI.js}

@@ -15,7 +15,7 @@ import {
   verifyHmacProof,
   verifyPairingCode
 } from "./chunk-KVDYJLTC.js";
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-PDX44BCA.js";
 export {
   PAIRING_TTL_MS,
   PEERS_FILE,

package/dist/{symphony-peers-APOGJPF4.js → symphony-peers-OL7F6M5S.js}

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import "./chunk-7N7GSU6K.js";
 
 // ../paradigm-mcp/src/utils/symphony-peers.ts
 import * as fs from "fs";

package/dist/{symphony-relay-GTAJRCVF.js → symphony-relay-UJYUXN65.js}

@@ -15,9 +15,10 @@ import {
   listAgents,
   readOutbox
 } from "./chunk-S2HO5MLR.js";
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-PDX44BCA.js";
 
 // ../paradigm-mcp/src/utils/symphony-relay.ts
+import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
 import * as crypto from "crypto";
@@ -309,6 +310,9 @@ var SymphonyRelay = class _SymphonyRelay {
         break;
       case "message_ack":
         break;
+      case "nomination_forward":
+        this.handleNominationForward(ws, frame.nomination, frame.origin);
+        break;
       case "agents_sync":
         this.handleAgentsSync(ws, frame.agents);
         break;
@@ -392,6 +396,29 @@ var SymphonyRelay = class _SymphonyRelay {
     }
     sendFrame(senderWs, { type: "message_ack", messageId: message.id });
   }
+  /**
+   * Forward a nomination from a remote agent to local nomination storage.
+   * Remote nominations are stored in the same nominations.jsonl but tagged with origin.
+   */
+  handleNominationForward(senderWs, nomination, origin) {
+    if (!nomination?.id) return;
+    const tagged = { ...nomination, remote_origin: origin, forwarded_at: (/* @__PURE__ */ new Date()).toISOString() };
+    try {
+      const eventsDir = path.join(os.homedir(), ".paradigm", "events");
+      fs.mkdirSync(eventsDir, { recursive: true });
+      const nomPath = path.join(eventsDir, "nominations.jsonl");
+      fs.appendFileSync(nomPath, JSON.stringify(tagged) + "\n", "utf8");
+    } catch {
+    }
+    if (this.mode === "server") {
+      for (const [peerId, peerWs] of this.connectedPeers) {
+        if (peerWs !== senderWs && peerWs.readyState === WebSocket.OPEN) {
+          sendFrame(peerWs, { type: "nomination_forward", nomination: tagged, origin });
+        }
+      }
+    }
+    sendFrame(senderWs, { type: "nomination_ack", nominationId: nomination.id });
+  }
   /**
    * Update stored agent list for a peer after receiving agents_sync.
    */

package/dist/{sync-ZM4Q3R4U.js → sync-VEHUH4OA.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   syncCommand
-} from "./chunk-RP6TZYGE.js";
-import "./chunk-KB4XJWE3.js";
+} from "./chunk-2IO7JAG2.js";
+import "./chunk-6N3JTACN.js";
 import "./chunk-YO6DVTL7.js";
 import "./chunk-4NCFWYGG.js";
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-PDX44BCA.js";
 export {
   syncCommand
 };

package/dist/{sync-llms-JIPP3XX4.js → sync-llms-YHCFIE6X.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   loadParadigmFiles
-} from "./chunk-KB4XJWE3.js";
+} from "./chunk-6N3JTACN.js";
 import "./chunk-YO6DVTL7.js";
 import {
   log
 } from "./chunk-4NCFWYGG.js";
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-PDX44BCA.js";
 
 // src/commands/sync-llms.ts
 import * as fs from "fs";

package/dist/{task-loader-7M2FCBX6.js → task-loader-LDYWQSLM.js}

@@ -8,6 +8,7 @@ import {
   shelveTask,
   updateTask
 } from "./chunk-CSD7IHSN.js";
+import "./chunk-7N7GSU6K.js";
 export {
   completeTask,
   createTask,

package/dist/{team-HGLJXWQG.js → team-7HG7XK5C.js}

@@ -8,19 +8,19 @@ import {
   teamModelsCommand,
   teamResetCommand,
   teamStatusCommand
-} from "./chunk-HIKKOCXY.js";
-import "./chunk-QWA26UNO.js";
-import "./chunk-J4E6K5MG.js";
+} from "./chunk-EI32ZBE6.js";
+import "./chunk-WQITYKHM.js";
+import "./chunk-LSRABQIY.js";
 import "./chunk-PBHIFAL4.js";
-import "./chunk-FS3WTUHY.js";
+import "./chunk-TXESEO7Y.js";
 import "./chunk-6QC3YGB6.js";
 import "./chunk-PMXRGPRQ.js";
-import "./chunk-MW5DMGBB.js";
 import "./chunk-5JGJACDU.js";
 import "./chunk-ZGUAAVMA.js";
 import "./chunk-EDOAWN7J.js";
 import "./chunk-IRKUEJVW.js";
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-YMDLDELF.js";
+import "./chunk-PDX44BCA.js";
 export {
   teamAcceptCommand,
   teamCheckCommand,

package/dist/{test-WTR5Q33E.js → test-566CP5KC.js}

@@ -2,7 +2,7 @@
 import {
   parseGateConfig
 } from "./chunk-IRKUEJVW.js";
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-PDX44BCA.js";
 
 // src/commands/portal/test.ts
 import * as path3 from "path";

package/dist/{thread-3WM7KKID.js → thread-N754I4D5.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-PDX44BCA.js";
 
 // src/commands/thread.ts
 import * as fs from "fs";

package/dist/{timeline-ANC7LVDL.js → timeline-M3CICQFE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   loadLoreEntries
-} from "./chunk-QIOCFXDQ.js";
-import "./chunk-ZXMDA7VB.js";
+} from "./chunk-EKGMAM62.js";
+import "./chunk-PDX44BCA.js";
 
 // src/commands/lore/timeline.ts
 import chalk from "chalk";

package/dist/{triage-IZ4MDYNB.js → triage-HHYGT3HY.js}

@@ -10,7 +10,7 @@ import {
 import {
   SentinelStorage
 } from "./chunk-FKJUBQU3.js";
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-PDX44BCA.js";
 
 // src/commands/triage/index.ts
 import chalk2 from "chalk";

package/dist/{tutorial-GC6QL4US.js → tutorial-KD22SUNO.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-ZXMDA7VB.js";
+import "./chunk-PDX44BCA.js";
 
 // src/commands/tutorial/index.ts
 import * as path from "path";

package/dist/university-content/courses/.purpose

@@ -244,6 +244,17 @@ components:
     tags: [course-content, para-401]
     references: ["#orchestration", "#mcp-tools", "#paradigm-sync"]
 
+  para-401-agent-identity:
+    description: "Agent Identity & Expertise — .agent files, personality, expertise auto-population, symbol-to-agent routing, orchestration enrichment"
+    file: para-401.json
+    tags: [course-content, para-401]
+    references: ["#agent-loader", "#agent-tools", "#orchestration"]
+
+  para-401-notebooks-permissions:
+    description: "University lesson: Agent Notebooks & Permission Scoping — notebooks, permissions, integrity hashing"
+    type: lesson
+    tags: [university, notebooks, agent-identity, permissions]
+
   # PARA 501: Advanced Systems (10 lessons)
 
   para-501-lore-system:
@@ -311,3 +322,58 @@ components:
     file: para-501.json
     tags: [course-content, para-501]
     references: ["#PlatformServer", "#PlatformWebSocket", "#AgentPresenceManager", "#UserStateTracker", "#AgentCommandRoute", "#PlatformTools", "#AgentStore", "#AgentToast", "#AgentCallout"]
+
+  para-501-review-compliance:
+    description: "University lesson: Automated Review Pipeline — paradigm review, compliance-checker, dynamic tool loading, response format"
+    type: lesson
+    tags: [university, review, compliance, tool-loading]
+
+  # PARA 601: Ambient Coordination (8 lessons)
+
+  para-601-event-stream:
+    description: "Event Stream — append-only JSONL activity log, event types, automatic emission from MCP tools and hooks"
+    file: para-601.json
+    tags: [course-content, para-601]
+    references: ["#event-stream"]
+
+  para-601-attention-scoring:
+    description: "Attention Scoring — four-dimension relevance scoring (symbol, path, concept, signal), max-based scoring, configurable thresholds"
+    file: para-601.json
+    tags: [course-content, para-601]
+    references: ["#agent-loader", "#event-stream"]
+
+  para-601-nominations:
+    description: "Nominations — self-nominated agent contributions, brief/urgency/type/evidence, surfacing and engagement workflow"
+    file: para-601.json
+    tags: [course-content, para-601]
+    references: ["#nomination-engine", "#agent-loader"]
+
+  para-601-knowledge-streams:
+    description: "Knowledge Streams — Work Log, Learning Journal, Team Decisions; different audiences, lifecycles, and storage"
+    file: para-601.json
+    tags: [course-content, para-601]
+    references: ["#event-stream"]
+
+  para-601-trust-rings:
+    description: "Trust Rings — four concentric data sovereignty levels, project-locked default, enforcement boundaries"
+    file: para-601.json
+    tags: [course-content, para-601]
+    references: ["#data-policy"]
+
+  para-601-data-policy:
+    description: "Data Policy — YAML-configured rules, observation control, stream filtering, per-agent overrides, DEFAULT_DATA_POLICY"
+    file: para-601.json
+    tags: [course-content, para-601]
+    references: ["#data-policy"]
+
+  para-601-context-composition:
+    description: "Context Composition — paradigm_context_compose, profile enrichment, decisions, journal insights, nominations into session context"
+    file: para-601.json
+    tags: [course-content, para-601]
+    references: ["#agent-loader", "#nomination-engine"]
+
+  para-601-ambient-review:
+    description: "Ambient Review — comprehensive review of PARA 601 ambient coordination concepts"
+    file: para-601.json
+    tags: [course-content, para-601]
+    references: ["#event-stream", "#nomination-engine", "#data-policy", "#agent-loader"]

package/dist/university-content/courses/para-401.json

@@ -689,6 +689,152 @@
           "explanation": "Token cost estimates enable agents to evaluate tool selection before calling. An agent deciding between paradigm_search (~150 tokens) and reading 5 files (~2500 tokens) can make an informed cost/benefit decision. The goal is efficiency, not restriction."
         }
       ]
+    },
+    {
+      "id": "agent-identity",
+      "title": "Agent Identity & Expertise Profiles",
+      "content": "## Agent Identity & Expertise Profiles\n\nEvery Claude session starts blank. The project remembers — via lore, protocols, aspects — but the agent doesn't. An architect that has successfully designed auth systems 14 times has no memory of that expertise. The orchestrator cannot route tasks to the most qualified agent because qualification is not tracked.\n\nAgent identity files (`.agent`) solve this with persistent YAML profiles that track expertise, personality, and cross-project patterns. They **overlay** the existing `agents.yaml` system and are fully backward compatible — when no `.agent` files exist, everything works exactly as before.\n\n### Storage & Merge Priority\n\nProfiles live in two locations:\n\n- **Global** (`~/.paradigm/agents/architect.agent`) — travels across projects\n- **Project** (`.paradigm/agents/builder.agent`) — project-level overrides\n\nMerge priority: **project `.agent` > global `.agent` > `agents.yaml`**. This means a project can override a global agent's default model or focus areas without modifying the shared identity.\n\n### Profile Structure\n\nEach `.agent` file contains:\n\n- **`id`** — Agent identifier (e.g., \"architect\")\n- **`personality`** — Style (deliberate/rapid/exploratory/methodical), risk tolerance (conservative/balanced/aggressive), and verbosity (minimal/concise/detailed)\n- **`expertise`** — Per-symbol entries with confidence (0.0-1.0), session count, and last touch date\n- **`transferable`** — Cross-project patterns with success rates and linked protocols/lore\n- **`contexts`** — Per-project adaptations: focus areas, preferred model, session count\n\n### Expertise Auto-Population\n\nWhen lore is recorded with `paradigm_lore_record`, the relevant agent's expertise scores update automatically via exponential moving average:\n\n```\nFor each symbol in symbols_touched:\n  if existing entry:\n    sessions++\n    confidence = 0.7 * old_confidence + 0.3 * lore_confidence\n  else:\n    create entry with confidence = lore_confidence (or 0.5 default)\n```\n\nAssessment verdicts from `paradigm_lore_assess` also feed into expertise. A verdict of `correct` nudges confidence up, `incorrect` nudges it down.\n\n### Querying Expertise\n\n`paradigm_agent_expertise` takes a symbol and returns agents ranked by confidence:\n\n```\nparadigm_agent_expertise({ symbol: \"#payment-service\" })\n// Returns: [{ agentId: \"architect\", confidence: 0.92, sessions: 14 }, ...]\n```\n\nThis enables **symbol-to-agent routing** — the orchestrator can prefer the agent most experienced with the symbols a task touches.\n\n### Orchestration Enrichment\n\nWhen `paradigm_orchestrate_inline` builds agent prompts, agents with `.agent` profiles receive a preamble:\n\n```markdown\n## Agent Identity: architect\n**Style:** deliberate | **Risk:** conservative | **Verbosity:** concise\n\n## Your Expertise on Relevant Symbols\n- #auth-middleware: confidence 0.92 (14 sessions)\n- $checkout-flow: confidence 0.88 (8 sessions)\n\n## Transferable Patterns\n- portal-gate-pattern: 95% success (learned in a-paradigm, applied in 2 projects)\n```\n\nThis goes BEFORE the role-specific prompt, giving the agent self-awareness about its strengths.\n\n### CLI Commands\n\n- `paradigm agent list` — Show all profiles with top expertise\n- `paradigm agent show <id>` — Full profile with expertise table\n- `paradigm agent create <id> --global` — Create new identity file\n- `paradigm agent sync <id>` — Bootstrap expertise from existing project lore\n\nAgent identities are a foundation for future capabilities: curated notebooks, model cascading, and knowledge graduation across projects.",
+      "keyConcepts": [
+        ".agent files are persistent YAML profiles that overlay agents.yaml — backward compatible",
+        "Two storage scopes: global (~/.paradigm/agents/) and project (.paradigm/agents/), project wins on merge",
+        "Expertise auto-updates via exponential moving average (70/30) from lore recording",
+        "paradigm_agent_expertise enables symbol-to-agent routing for orchestration",
+        "Orchestration enrichment prepends personality and expertise context to agent prompts"
+      ],
+      "quiz": [
+        {
+          "id": "q1",
+          "question": "You run `paradigm agent create architect --global`. Where is the file stored?",
+          "choices": {
+            "A": "In the project's .paradigm/agents/architect.agent",
+            "B": "In ~/.paradigm/agents/architect.agent",
+            "C": "In .paradigm/agents.yaml as a new entry",
+            "D": "In ~/.paradigm/score/agents/architect.agent",
+            "E": "In the project's .paradigm/config.yaml under agents section"
+          },
+          "correct": "B",
+          "explanation": "The --global flag stores the .agent file in ~/.paradigm/agents/, the global scope that travels across projects. Without --global, it would go in the project's .paradigm/agents/ directory."
+        },
+        {
+          "id": "q2",
+          "question": "Both ~/.paradigm/agents/builder.agent and .paradigm/agents/builder.agent exist with different defaultModel. Which one wins?",
+          "choices": {
+            "A": "The global one (~/.paradigm/agents/) always takes priority",
+            "B": "The one with the newer 'updated' timestamp wins",
+            "C": "Project-level .paradigm/agents/builder.agent takes priority",
+            "D": "agents.yaml overrides both .agent files",
+            "E": "An error is raised for the conflict"
+          },
+          "correct": "C",
+          "explanation": "Merge priority is: project .agent > global .agent > agents.yaml. Project-level overrides exist specifically so a project can customize model preferences or focus areas without changing the global identity."
+        },
+        {
+          "id": "q3",
+          "question": "An agent records lore with confidence: 0.8 touching #auth-middleware. The agent's existing expertise on that symbol is confidence: 0.9, sessions: 10. What's the new confidence?",
+          "choices": {
+            "A": "0.85 (simple average)",
+            "B": "0.87 (exponential moving average: 0.7 * 0.9 + 0.3 * 0.8)",
+            "C": "0.80 (new value replaces old)",
+            "D": "0.90 (existing value preserved)",
+            "E": "0.88 (weighted by session count)"
+          },
+          "correct": "B",
+          "explanation": "Expertise uses exponential moving average with alpha=0.3: new = 0.7 * old + 0.3 * new_observation. So 0.7 * 0.9 + 0.3 * 0.8 = 0.63 + 0.24 = 0.87. This balances stability (70% old) with responsiveness to new data (30% new)."
+        },
+        {
+          "id": "q4",
+          "question": "You want to find which agent is best qualified to modify #payment-service. Which MCP tool do you call?",
+          "choices": {
+            "A": "paradigm_agent_list and manually compare expertise arrays",
+            "B": "paradigm_agent_get with the symbol name",
+            "C": "paradigm_agent_expertise with symbol: \"#payment-service\"",
+            "D": "paradigm_search with query: \"payment-service agents\"",
+            "E": "paradigm_orchestrate_inline with the task description"
+          },
+          "correct": "C",
+          "explanation": "paradigm_agent_expertise takes a symbol and returns all agents with expertise on that symbol, ranked by confidence score. This is the purpose-built tool for symbol-to-agent routing, costing only ~100 tokens."
+        },
+        {
+          "id": "q5",
+          "question": "A project has agents.yaml with 5 agents but no .agent files. What happens during orchestration?",
+          "choices": {
+            "A": "An error: .agent files are required for orchestration",
+            "B": "agents.yaml is ignored and default agents are used",
+            "C": "Empty .agent files are auto-created for each agent",
+            "D": "Everything works exactly as before — .agent files are a pure overlay",
+            "E": "Orchestration runs but warns about missing profiles"
+          },
+          "correct": "D",
+          "explanation": ".agent files are a pure overlay. No files = no enrichment, same behavior as pre-3.47.0. The system is fully backward compatible — agents.yaml continues to work unchanged, and .agent profiles only add capabilities when present."
+        }
+      ]
+    },
+    {
+      "id": "notebooks-permissions",
+      "title": "Agent Notebooks & Permission Scoping",
+      "content": "## Agent Notebooks\n\nAgent notebooks are curated snippet libraries distilled from lore entries. They provide reusable knowledge that agents can apply across sessions and projects.\n\n### NotebookEntry Format\n\nEach entry contains:\n- **context**: When to apply this snippet (retrieval key)\n- **snippet**: The reusable code/knowledge\n- **provenance**: Where it came from (lore, manual, transfer)\n- **concepts[]**: Concept tags for retrieval (e.g., [\"auth\", \"middleware\"])\n- **appliedCount**: How many times used in orchestration\n- **confidence**: 0.0-1.0 reliability score\n\n### Storage\n\n- Global: `~/.paradigm/notebooks/{agent-id}/` — travels across projects\n- Project: `.paradigm/notebooks/{agent-id}/` — project-specific\n\n### MCP Tools\n\n- `paradigm_notebook_search` — find entries by concept, tag, or keyword\n- `paradigm_notebook_add` — create a new curated entry\n- `paradigm_notebook_promote` — extract from lore entry with provenance linking\n\n### Orchestration Integration\n\n`buildProfileEnrichment()` appends a \"Relevant Notebook Entries\" section with context + snippet for matching entries. This enriches the orchestration prompt with reusable patterns.\n\n## Agent Permissions\n\nPermission scoping controls what agents can access:\n\n### Permission Fields\n\n- **paths.read/write**: Glob patterns for file access\n- **paths.deny**: Always-deny patterns (overrides read/write)\n- **tools.allow/deny**: Tool name patterns\n- **dangerous_actions**: Actions requiring explicit approval\n\n### Integrity Hashing\n\nSHA-256 hash of `{id, role, permissions}` stored as `integrityHash`. `verifyIntegrity()` detects tampering — agents must never modify their own config.\n\n### In Orchestration\n\nPermissions appear as constraints in orchestration prompts, informing agents of their boundaries.",
+      "quiz": [
+        {
+          "id": "Q-401-NP-001",
+          "question": "Where are global notebook entries stored for the architect agent?",
+          "options": [
+            "~/.paradigm/notebooks/architect/",
+            ".paradigm/notebooks/architect/",
+            "~/.paradigm/agents/architect/notebooks/",
+            ".paradigm/agents/architect.notebooks"
+          ],
+          "correct": 0,
+          "explanation": "Global notebook entries are stored at ~/.paradigm/notebooks/{agent-id}/ and travel across projects."
+        },
+        {
+          "id": "Q-401-NP-002",
+          "question": "An agent has permissions.paths.deny: [\".paradigm/agents/*\"]. What happens if it tries to write to .paradigm/agents/builder.agent?",
+          "options": [
+            "The write succeeds if there's also a write pattern matching it",
+            "The write is flagged as denied — deny patterns always override allow patterns",
+            "The write succeeds but triggers an advisory",
+            "The agent profile is deleted"
+          ],
+          "correct": 1,
+          "explanation": "Deny patterns always override allow patterns. checkPathPermission() checks deny first."
+        },
+        {
+          "id": "Q-401-NP-003",
+          "question": "You want to extract a reusable pattern from lore entry L-2026-03-10-001 into the architect's notebook. Which MCP tool?",
+          "options": [
+            "paradigm_notebook_add with loreEntryId parameter",
+            "paradigm_lore_promote with agentId parameter",
+            "paradigm_notebook_promote with agentId + loreEntryId",
+            "paradigm_agent_notebook with action: 'promote'"
+          ],
+          "correct": 2,
+          "explanation": "paradigm_notebook_promote takes agentId + loreEntryId and creates a distilled notebook entry with provenance link."
+        },
+        {
+          "id": "Q-401-NP-004",
+          "question": "An architect agent has 3 notebook entries matching #auth-middleware. How does orchestration use them?",
+          "options": [
+            "They replace the agent's expertise section in the prompt",
+            "buildProfileEnrichment() appends a 'Relevant Notebook Entries' section with context + snippet",
+            "They are sent as separate tool calls before the main prompt",
+            "They override the agent's personality settings"
+          ],
+          "correct": 1,
+          "explanation": "buildProfileEnrichment() appends notebook entries (up to 5) with context + truncated snippet to the orchestration prompt."
+        },
+        {
+          "id": "Q-401-NP-005",
+          "question": "A .agent file's integrityHash doesn't match the computed hash. What does this indicate?",
+          "options": [
+            "The file was created before v4.0 and needs migration",
+            "The file was modified without going through saveAgentProfile() — possible tampering",
+            "The agent's expertise has been updated since the hash was computed",
+            "The hash algorithm has changed between versions"
+          ],
+          "correct": 1,
+          "explanation": "verifyIntegrity() returns false when the stored hash doesn't match. The hash covers id+role+permissions, so changes to those fields without saveAgentProfile() indicate tampering."
+        }
+      ]
     }
   ]
 }

package/dist/university-content/courses/para-501.json

@@ -1039,6 +1039,73 @@
           "explanation": "Internet direct connect uses the connection string format: address:port#code. The --public flag on the hub displays this connection string. The spoke parses the embedded code from after the # character and uses it automatically — no interactive prompt needed. Port 3939 must be reachable from the internet (port forward, VPN, or SSH tunnel)."
         }
       ]
+    },
+    {
+      "id": "review-compliance",
+      "title": "Automated Review Pipeline & Compliance Checking",
+      "content": "## paradigm review\n\nThe automated review pipeline uses a two-stage protocol:\n\n### Stage 1: Spec Compliance (always runs)\n\n- **Purpose coverage**: All touched symbols registered in .purpose files\n- **Portal gate compliance**: Routes declared in portal.yaml with gates\n- **Aspect anchors**: Anchor files still exist, no drift\n- **Broken references**: Parent symbols exist\n- **Route coverage**: New routes have portal.yaml entries\n\n### Stage 2: Code Quality (--deep only)\n\n- **Security**: eval() detection, hardcoded secrets\n- **Convention**: console.log usage (use Paradigm logger)\n- **Test coverage**: Gaps in test files\n\n### ReviewFinding Format\n\nEach finding has:\n- **type**: blocking (must fix), improvement (should fix), note (informational)\n- **category**: purpose-coverage, portal-compliance, aspect-anchors, security, convention\n- **message**: Human-readable description\n- **suggestion**: How to fix it\n\n### Usage\n\n```bash\nparadigm review              # Staged changes\nparadigm review --pr 123     # PR via gh CLI\nparadigm review --ci         # Exit 1 on blocking\nparadigm review --deep       # Include code quality\nparadigm review --json       # JSON output\n```\n\n## Dynamic Tool Loading\n\nTools are organized in three tiers:\n- **Core** (~15 tools): Always loaded (search, ripple, status, navigate, etc.)\n- **Feature**: Auto-detected from filesystem (lore → .paradigm/lore/, etc.)\n- **Advanced**: On-demand via `paradigm_tool_activate`\n\n## Response Format\n\n`response_format: 'concise'` on high-traffic tools strips secondary data:\n- paradigm_search: returns only { symbol, type }\n- paradigm_ripple: returns only { symbol, impact, summary }\n- paradigm_status: returns only { project, counts, total }\n\n## compliance-checker.ts\n\nShared logic extracted from pm.ts postflight. Both `paradigm_pm_postflight` and `paradigm review` use the same compliance checks.",
+      "quiz": [
+        {
+          "id": "Q-501-RC-001",
+          "question": "paradigm review --ci finds 2 blocking and 3 improvement findings. What's the exit code?",
+          "options": [
+            "Exit code 0 — improvements are non-blocking",
+            "Exit code 1 — any blocking findings cause non-zero exit in CI mode",
+            "Exit code 2 — one per blocking finding",
+            "Exit code 5 — total findings count"
+          ],
+          "correct": 1,
+          "explanation": "In CI mode, any blocking findings cause exit code 1. Improvements and notes do not affect the exit code."
+        },
+        {
+          "id": "Q-501-RC-002",
+          "question": "A project has no features: section in config.yaml. How many MCP tools are loaded?",
+          "options": [
+            "Only core tools (~15)",
+            "Core + explicitly enabled features",
+            "All of them — auto-detection is generous, defaulting to current behavior",
+            "None — features must be explicitly configured"
+          ],
+          "correct": 2,
+          "explanation": "No features config + generous auto-detection = all tools loaded, matching pre-4.0 behavior for backward compat."
+        },
+        {
+          "id": "Q-501-RC-003",
+          "question": "You call paradigm_search with response_format: 'concise'. What fields are returned?",
+          "options": [
+            "Full results with descriptions, paths, and fuzzy matches",
+            "Only { symbol, type } per result — descriptions and secondary data stripped",
+            "Only symbol names as a flat array",
+            "Compressed binary format"
+          ],
+          "correct": 1,
+          "explanation": "Concise mode strips results to { symbol, type } per entry and removes fuzzyMatched, fuzzyNote, suggestions, workspace data."
+        },
+        {
+          "id": "Q-501-RC-004",
+          "question": "An agent needs the graph generation tool but it's in the advanced tier. What does it do?",
+          "options": [
+            "Request an admin to enable it in config.yaml",
+            "Call paradigm_tool_activate with feature: 'graph'",
+            "Modify the agent's permissions to include graph tools",
+            "Restart the session with --enable-graph flag"
+          ],
+          "correct": 1,
+          "explanation": "paradigm_tool_activate enables advanced-tier modules for the current session. The tools become available immediately."
+        },
+        {
+          "id": "Q-501-RC-005",
+          "question": "What's the relationship between paradigm review Stage 1 and paradigm_pm_postflight?",
+          "options": [
+            "They are completely independent with different checks",
+            "paradigm review calls paradigm_pm_postflight internally",
+            "They share the same compliance logic extracted into compliance-checker.ts",
+            "paradigm_pm_postflight is deprecated in favor of paradigm review"
+          ],
+          "correct": 2,
+          "explanation": "Both use compliance-checker.ts for shared compliance logic — purpose coverage, portal gates, aspect anchors, and broken refs."
+        }
+      ]
     }
   ]
 }