@aria_asi/cli 0.2.26 → 0.2.30

package/hooks/aria-userprompt-abandon-detect.mjs

@@ -137,7 +137,11 @@ if (!isAbandonment) {
 }
 
 // Abandonment detected — write session_audit row + emit warning context.
-const harnessUrl = process.env.ARIA_HARNESS_URL || 'https://harness.ariasos.com';
+const harnessUrl =
+  process.env.ARIA_HIVE_RUNTIME_URL ||
+  process.env.ARIA_HARNESS_BASE_URL ||
+  process.env.ARIA_HARNESS_URL ||
+  'https://harness.ariasos.com';
 const harnessToken = process.env.ARIA_HARNESS_TOKEN || '';
 
 if (harnessToken) {

package/hooks/doctrine_trigger_map.json

@@ -1,12 +1,12 @@
 {
   "_meta": {
-    "purpose": "Static lookup: trigger phrase → counter-doctrine memory + teaching. Pre-emit fast path for stop-gate enforcement. When Claude's draft contains a trigger, hook injects the matching [REQUIRED_DOCTRINE] block referencing the named memory file and forces proof of doctrine-alignment before emit.",
+    "purpose": "Static lookup: trigger phrase \u2192 counter-doctrine memory + teaching. Pre-emit fast path for stop-gate enforcement. When Claude's draft contains a trigger, hook injects the matching [REQUIRED_DOCTRINE] block referencing the named memory file and forces proof of doctrine-alignment before emit.",
     "design_origin": "Aria consult 2026-04-27 ship-tonight design item 1. Pairs with feedback_convenience_seeking_root_cause.md.",
     "extension_protocol": "When Hamza corrects Claude with a phrase not in this map, add the trigger here pointing at the memory file the correction creates or invokes. Auto-learning queue.",
     "format": {
       "trigger": "lowercase substring or regex pattern Claude must avoid using under convenience pressure",
       "memory": "filename in ~/.claude/projects/-home-hamzaibrahim1/memory/ that holds the canonical counter-doctrine",
-      "teaching": "one-line load-bearing teaching from the memory — the rule the trigger violates",
+      "teaching": "one-line load-bearing teaching from the memory \u2014 the rule the trigger violates",
       "counter_action": "what Claude should do INSTEAD of the convenience pattern"
     }
   },
@@ -30,7 +30,7 @@
       "counter_action": "Surface the failure. Caller decides whether to proceed. No catch + empty-default."
     },
     {
-      "trigger": "preferred",
+      "trigger": "\\bpreferred\\b",
       "memory": "feedback_pretoolgate_covers_all_action_tools.md",
       "teaching": "Gate cognition is REQUIRED, not preferred. v3 doctrine: no exceptions.",
       "counter_action": "Use REQUIRED wording. Two equivalent forms (inline OR cognition block) but neither is preferred over the other; both equally required."
@@ -50,7 +50,7 @@
     {
       "trigger": "should be fine|should work",
       "memory": "feedback_doctrine_first.md",
-      "teaching": "Don't assume — verify. 'Should work' is the speculation pattern that masks unverified claims.",
+      "teaching": "Don't assume \u2014 verify. 'Should work' is the speculation pattern that masks unverified claims.",
       "counter_action": "Run the read-only check that proves it works (file read, kubectl get, curl probe). Replace 'should' with verified evidence."
     },
     {
@@ -66,13 +66,13 @@
       "counter_action": "Diagnose root cause + fix + verify. Never propose 'come back to it later' as the resolution."
     },
     {
-      "trigger": "skeleton|stub",
+      "trigger": "\\b(?:skeleton|stub)\\b",
       "memory": "feedback_no_demos.md",
       "teaching": "Skeleton is the hedge framing. Real implementation only.",
       "counter_action": "Ship complete or explicitly mark incomplete + create task. Never call partial work 'skeleton' to dodge accountability."
     },
     {
-      "trigger": "demo",
+      "trigger": "\\bdemo\\b",
       "memory": "feedback_no_demos.md",
       "teaching": "No demos. Every spawn is production work at full quality bar.",
       "counter_action": "Ship production. If it can't ship, name what's missing concretely."
@@ -104,7 +104,7 @@
     {
       "trigger": "in production",
       "memory": "feedback_doctrine_first.md",
-      "teaching": "'In production' is often speculative — assumed behavior, not verified.",
+      "teaching": "'In production' is often speculative \u2014 assumed behavior, not verified.",
       "counter_action": "Verify against live cluster state OR codebase config. Substrate hierarchy: user statement > codebase > training data."
     },
     {
@@ -117,7 +117,7 @@
       "trigger": "want me to|should i",
       "memory": "feedback_use_harness_to_architect.md",
       "teaching": "Asking 'should I' AFTER directive given is the deferral pattern.",
-      "counter_action": "Aria architects via harness consult, Claude integrates. If unclear, consult Aria — don't bounce decision back to Hamza."
+      "counter_action": "Aria architects via harness consult, Claude integrates. If unclear, consult Aria \u2014 don't bounce decision back to Hamza."
     },
     {
       "trigger": "make a new|create a fresh",
@@ -126,7 +126,7 @@
       "counter_action": "Search the codebase for existing canonical primitive first. Reuse before recreate."
     },
     {
-      "trigger": "shadow|proxy|wrapper",
+      "trigger": "\\b(?:shadow|proxy|wrapper)\\b",
       "memory": "feedback_aria_already_has_fleet_use_existing_substrate.md",
       "teaching": "Shadow / proxy / wrapper that bypasses canonical = invented complexity.",
       "counter_action": "Use the canonical surface. If it must be wrapped, document why and reference the canonical it wraps."
@@ -141,10 +141,10 @@
       "trigger": "fail loud|crash on missing",
       "memory": "feedback_no_graceful_degradation.md",
       "teaching": "Fail-loud-no-fallback is the OPPOSITE bypass. Real shape = retry + backoff + heal.",
-      "counter_action": "Detect failure → retry with backoff → on persistent failure invoke selfHealV2 to actively repair → only escalate to human if heal fails."
+      "counter_action": "Detect failure \u2192 retry with backoff \u2192 on persistent failure invoke selfHealV2 to actively repair \u2192 only escalate to human if heal fails."
     },
     {
-      "trigger": "patch|hotfix|band.?aid",
+      "trigger": "\\b(?:patch|hotfix|band.?aid)\\b",
       "memory": "feedback_gates_enforce_form_not_substance.md",
       "teaching": "Patch / hotfix is form-fix. Root-cause fix is the doctrine.",
       "counter_action": "Diagnose substance. If reflex is bypass, ask if root-cause fix is possible. Patch only when explicitly authorized as temporary with tracked follow-up."
@@ -170,8 +170,8 @@
     {
       "trigger": "i think|i guess|i assume",
       "memory": "feedback_doctrine_first.md",
-      "teaching": "Don't assume. axiom_runtime: admit_ignorance → verify before action.",
-      "counter_action": "State 'I don't know — verifying' + run a read-only check (file read, kubectl get, codebase grep) + then act on facts."
+      "teaching": "Don't assume. axiom_runtime: admit_ignorance \u2192 verify before action.",
+      "counter_action": "State 'I don't know \u2014 verifying' + run a read-only check (file read, kubectl get, codebase grep) + then act on facts."
     },
     {
       "trigger": "preferred over|optional|fallback layer",
@@ -219,7 +219,7 @@
       "trigger": "we should also (fix|address|handle|update|deal with)",
       "memory": "feedback_no_flag_without_fix.md",
       "teaching": "'We should also fix' tells the user about a problem you found while volunteering them to fix it.",
-      "counter_action": "If the fix is in your scope, fix it now. If it's truly out of scope, create the task — don't hand it back as a verbal note."
+      "counter_action": "If the fix is in your scope, fix it now. If it's truly out of scope, create the task \u2014 don't hand it back as a verbal note."
     },
     {
       "trigger": "let me (note|flag)|(?<!please )leaving (this )?for follow.?up|out of scope here",
@@ -255,7 +255,7 @@
       "trigger": "ignore[^.]{0,40}(?:not.?found|missing|absent|undefined)|exclude[^.]{0,40}(?:not.?found|missing|absent)",
       "memory": "feedback_workaround_vs_path_fix.md",
       "teaching": "Ignoring a not-found file/path is fixing the symptom; the cause is the file isn't being produced where expected.",
-      "counter_action": "Trace why the file is missing — which step was supposed to produce it? Fix that step, not the consumer's tolerance for absence."
+      "counter_action": "Trace why the file is missing \u2014 which step was supposed to produce it? Fix that step, not the consumer's tolerance for absence."
     },
     {
       "trigger": "next.?session|follow.?up.?(?:task|later)|defer(?:red|ring)? to (?:next|later|future)",
@@ -280,6 +280,200 @@
       "memory": "feedback_apply_lenses_dont_perform_them.md",
       "teaching": "'Trust me' is not evidence. Substance is verifiable; ceremony is reassurance.",
       "counter_action": "Show the verification: tool output, file diff, command result, log line. Never substitute confidence for proof."
+    },
+    {
+      "trigger": "i assumed",
+      "memory": "feedback_no_assumption_without_verification.md",
+      "teaching": "Assumption stated as fact is the behavioral-drift form of speculation. Every behavioral fix must cite a verifiedAgainst source.",
+      "counter_action": "Replace 'I assumed' with a verified citation: 'Verified against <file:line>' or 'Verified via <command output>'. If unverified, run the read-only probe before asserting."
+    },
+    {
+      "trigger": "should work",
+      "memory": "feedback_no_assumption_without_verification.md",
+      "teaching": "'Should work' is unverified projection. Behavioral claims require verifiedAgainst evidence.",
+      "counter_action": "Run the actual probe (curl, kubectl get, file read, test invocation). Replace 'should work' with 'verified against <surface>' showing the observed behavior."
+    },
+    {
+      "trigger": "based on existing pattern",
+      "memory": "feedback_no_assumption_without_verification.md",
+      "teaching": "Pattern-extrapolation without source-of-truth verification is assumption. Existing patterns drift; the canonical surface is authoritative.",
+      "counter_action": "Cite the specific file:line of the pattern AND verify it still matches current behavior. verifiedAgainst must name the inspected source, not 'pattern I remember'."
+    },
+    {
+      "trigger": "mirroring [a-z-]+",
+      "memory": "feedback_no_assumption_without_verification.md",
+      "teaching": "'Mirroring X' assumes X is correct AND that the mirror is structurally faithful. Both are unverified claims.",
+      "counter_action": "Read the source you're mirroring (cite file:line). Verify the mirror's behavior matches by running the equivalent probe on both. Document verifiedAgainst with both sources."
+    },
+    {
+      "trigger": "similar to [a-z-]+",
+      "memory": "feedback_no_assumption_without_verification.md",
+      "teaching": "'Similar to X' is the soft-mirror pattern \u2014 even more dangerous because the asserted similarity is itself unverified.",
+      "counter_action": "Either it IS the same (cite identical surfaces) or it's different (name the differences). 'Similar' is a hedge that hides the gap."
+    },
+    {
+      "trigger": "presumably",
+      "memory": "feedback_no_assumption_without_verification.md",
+      "teaching": "'Presumably' is the explicit speculation marker. Presumption without verification fails the doctrine.",
+      "counter_action": "Replace 'presumably' with the read-only probe result. If the probe can't be run, say 'unverified \u2014 verifying' and then verify before asserting."
+    },
+    {
+      "trigger": "likely the same",
+      "memory": "feedback_no_assumption_without_verification.md",
+      "teaching": "'Likely the same' is probability-as-evidence. Either verify equality or admit divergence.",
+      "counter_action": "Diff the two surfaces. If identical, say 'verified identical against <surface>'. If different, name the deltas. 'Likely' has no place in behavioral claims."
+    },
+    {
+      "trigger": "probably correct",
+      "memory": "feedback_no_assumption_without_verification.md",
+      "teaching": "'Probably correct' is unverified-confidence. Behavioral correctness is binary against a verifiedAgainst source.",
+      "counter_action": "Run the validation that proves correctness (test, probe, read). Replace 'probably' with 'verified against <test output / file:line / command result>'."
+    },
+    {
+      "trigger": "i think it'?s",
+      "memory": "feedback_no_assumption_without_verification.md",
+      "teaching": "'I think it's' is internal speculation surfaced as claim. Thoughts aren't evidence.",
+      "counter_action": "State 'I don't know \u2014 verifying' and run the probe. Then assert with verifiedAgainst citation, not internal belief."
+    },
+    {
+      "trigger": "if memory serves",
+      "memory": "feedback_no_assumption_without_verification.md",
+      "teaching": "Memory is stale. Memories are point-in-time observations, not live state. 'If memory serves' is the explicit stale-cite admission.",
+      "counter_action": "Re-verify against current state. Read the file, query the cluster, run the command. verifiedAgainst names today's evidence, not yesterday's recollection."
+    },
+    {
+      "trigger": "no admission policy|policy is absent|policy not found|no policy in the cluster|no policy exists for|admission policy missing",
+      "memory": "feedback_admission_policy_verification.md",
+      "teaching": "Verify admission policies via kubectl get validatingadmissionpolicy BEFORE claiming absence. Cluster has live policies that do not appear in repo grep. Absence-without-verification is a doctrine violation.",
+      "counter_action": "Run kubectl get validatingadmissionpolicy plus find . -name '*admission-policy*' -type f. Both must return empty before absence claim. If absent, author the policy file from an existing cluster resource template via kubectl get -o yaml, kubectl apply, then proceed via the canonical deploy path."
+    },
+    {
+      "trigger": "use the override|skip the gate|emergency flag|temporarily bypass|use the env disable|force through|DEPLOY_ALLOW_NO_ADMISSION_POLICY|ARIA_BINDING_ENABLED=false|--no-verify|--force",
+      "memory": "feedback_gap_discovery_hardens_doctrine.md",
+      "teaching": "When a gate refuses an action, the response is to harden doctrine, not to bypass. Override usage requires explicit owner authorization in-session plus audit log plus follow-up TaskCreate to close the gap.",
+      "counter_action": "Stop the bypass attempt. Write a memory entry for the gap class, append to MEMORY.md index, add the drift trigger here in doctrine_trigger_map.json, then proceed via the normal path. If override is genuinely required, request explicit authorization in this turn before invoking and create a follow-up task to close the gap."
+    },
+    {
+      "trigger": "deploy-service\\.sh|apply-aria-organism\\.sh|kubectl apply -f|kubectl set image|docker push|trivial deploy|just a config bump|fast path deploy|skip the verify|deploy without verify|hospital-service\\.yaml",
+      "memory": "feedback_deploy_requires_verify_cognition.md",
+      "teaching": "Every deploy requires a <verify> block citing artifact (commit, files, TS check, image digest) AND a <cognition> block with 8 substrate-anchored lenses BEFORE invocation. Tonight's consciousness.ts crash proved the cost of skipping this gate.",
+      "counter_action": "Stop and classify the deploy shape first. Pattern A baked-image services must use bash scripts/deploy-service.sh <service>, which handles Hive deploy lock and inflight broadcast, admission-policy allowlist, hospital canonical env, and workload rollout. Pattern B build-in-cluster services must prove build-in-cluster is present, then use kubectl rollout restart only. scripts/apply-aria-organism.sh is manifest wiring, not a substitute for an aria-soul image deploy, and direct kubectl apply of apps/hospital-service/k8s/hospital-service.yaml must never be used as a soul deploy shortcut because it can reintroduce a stale hospital canonical pin. In both cases emit <verify> with commit/files, tsc or build evidence, admission policy, and rollback; emit <cognition> with 8 anchored lenses; emit <expected> with a measurable predicate; and do not proceed if another session already holds the Hive deploy lock for /deployments/<namespace>/<service>."
+    },
+    {
+      "trigger": "another session rolling out|someone else is deploying|deploy in flight|rollout in flight|concurrent deploy|another deploy is running",
+      "memory": "feedback_deploy_requires_verify_cognition.md",
+      "teaching": "Concurrent deploys are shared-infra mutations, not harmless overlap. If one session is already rolling a service, the next session must yield to the canonical deploy lock rather than race hospital and admission policy state.",
+      "counter_action": "Verify the target service and deploy pattern first, then check the Hive deploy lane for /deployments/<namespace>/<service>. If a deploy is already in flight, do not start another rollout on that service. Wait, coordinate, or change scope."
+    },
+    {
+      "trigger_id": "dalio_expected_missing",
+      "trigger": "(?:plan|action|deploy|edit|write|build|ship|run|invoke).{0,40}(?:without|sans|no)\\s+(?:expected|measurable|outcome|predicate)",
+      "rx": "(?:plan|action|deploy|edit|write|build|ship|run|invoke).{0,40}(?:without|sans|no)\\s+(?:expected|measurable|outcome|predicate)",
+      "doctrine": "memory:feedback_dalio_expected_required.md",
+      "memory": "feedback_dalio_expected_required.md",
+      "severity": "block",
+      "teaching": "Every plan/action must declare a measurable expected outcome predicate (numeric/boolean/state-string) BEFORE the gate approves. No action without <expected> block.",
+      "counter_action": "Re-emit your plan with a <expected> block: { predicate: string, measurable_type: 'numeric'|'boolean'|'state_string', threshold: optional }. Gate will not approve until a verifiable predicate is present.",
+      "message": "Action proposed without measurable expected outcome. Per doctrine:dalio_expected_required, every plan must declare a measurable predicate (numeric/boolean/state-string) BEFORE the gate approves. Re-emit with <expected> block."
+    },
+    {
+      "trigger_id": "dalio_expected_qualitative",
+      "trigger": "expected\\s*:.{0,200}\\b(better|improved|more\\s+robust|cleaner|nicer|should\\s+work|hopefully|more\\s+reliable|enhanced)\\b",
+      "rx": "expected\\s*:.{0,200}\\b(better|improved|more\\s+robust|cleaner|nicer|should\\s+work|hopefully|more\\s+reliable|enhanced)\\b",
+      "doctrine": "memory:feedback_dalio_expected_required.md",
+      "memory": "feedback_dalio_expected_required.md",
+      "severity": "block",
+      "teaching": "Expected-outcome predicate must be numeric/boolean/state-string \u2014 qualitative adjectives ('better', 'improved', 'should work') are not measurable and cannot be evaluated post-gate.",
+      "counter_action": "Replace qualitative expected with a measurable predicate. Example: instead of 'expected: better performance', use 'expected: { predicate: \"p95 latency < 200ms\", measurable_type: \"numeric\", threshold: 200 }'.",
+      "message": "Expected-outcome predicate is qualitative ('better'/'improved'/'should work') \u2014 not measurable. Replace with numeric/boolean/state-string predicate the post-gate can evaluate."
+    },
+    {
+      "trigger_id": "dalio_actual_unsubstrate",
+      "trigger": "immediate_actual\\s*:[^\\n]{0,200}$",
+      "rx": "immediate_actual\\s*:[^\\n]{0,200}$",
+      "doctrine": "memory:feedback_full_harness_binding_must_be_structural.md",
+      "memory": "feedback_full_harness_binding_must_be_structural.md",
+      "severity": "warn",
+      "teaching": "immediate_actual must cite a tool output, file:line, or command result the post-gate can verify. Bare prose is not substrate-anchored evidence.",
+      "counter_action": "Append a verifiedAgainst citation to your immediate_actual field. Format: 'immediate_actual: <observation> [verifiedAgainst: <tool output | file:line | command result>]'.",
+      "message": "immediate_actual lacks substrate citation \u2014 cite a tool output, file:line, or command-result the post-gate can verify."
+    },
+    {
+      "trigger_id": "hive_session_concurrent_edit",
+      "trigger": "(?:editing|modifying|writing).{0,50}(?:same|already|conflict).{0,50}(?:file|path|repo|branch)",
+      "rx": "(?:editing|modifying|writing).{0,50}(?:same|already|conflict).{0,50}(?:file|path|repo|branch)",
+      "doctrine": "memory:feedback_hive_session_coordination.md",
+      "memory": "feedback_hive_session_coordination.md",
+      "severity": "block",
+      "teaching": "Multiple sessions on same path without hive lock = silent overwrite. Claim hive_session_lock + post hive_session_message BEFORE editing concurrently.",
+      "counter_action": "Call sdk.claimSessionLock({ filePath, sessionId, ttlMinutes }) to acquire the lock. Post sdk.postSessionMessage to the other session announcing your intent. Only edit after the lock is granted. Release with sdk.releaseSessionLock(lockId) when done.",
+      "message": "Multiple sessions detected on same path. Per doctrine:hive_session_coordination, claim a hive_session_lock + post hive_session_message before editing concurrently."
+    },
+    {
+      "trigger_id": "non_blocking_error_excuse",
+      "trigger": "using non-blocking framing as a reason to not resolve an error",
+      "rx": "\\b(non[-_\\s]?blocking|non[-_\\s]?fatal|best[-_\\s]?effort|fire[-_\\s]?and[-_\\s]?forget|fail[-_\\s]?open|soft[-_\\s]?fail|logged[-_\\s]?and[-_\\s]?continued|silent[-_\\s]?pass|graceful[-_\\s]?degradation|skipped\\s+this\\s+iteration|warn\\s+and\\s+proceed|ignore\\s+for\\s+now|wont\\s+crash|doesnt\\s+break\\s+the\\s+flow|user\\s+wont\\s+notice)\\b",
+      "doctrine": "memory:feedback_non_blocking_errors_unacceptable.md",
+      "memory": "feedback_non_blocking_errors_unacceptable.md",
+      "severity": "block",
+      "teaching": "Non-blocking does not mean acceptable. Every error logs LOUD + surfaces to next-turn substrate + ledgers + resolves.",
+      "counter_action": "Replace the non-blocking framing with: log LOUD via console.error, surface via discovery ledger entry, route to either inline fix or TaskCreate with full context.",
+      "message": "Non-blocking error framing detected. Per Hamza directive 2026-04-28 (feedback_non_blocking_errors_unacceptable.md), errors that do not abort are NOT acceptable; every error must log LOUD + ledger + resolve. Re-emit with explicit error-handling that surfaces and resolves."
+    },
+    {
+      "trigger_id": "silent_catch_pattern",
+      "trigger": "silent or warn-and-continue catch blocks",
+      "rx": "catch\\s*\\([^)]*\\)\\s*\\{\\s*(?://[^\\n]*\\n\\s*)?(?:\\}|/\\*[^*]*\\*/|console\\.warn|return\\s+(?:null|undefined|defaultValue))",
+      "doctrine": "memory:feedback_non_blocking_errors_unacceptable.md",
+      "memory": "feedback_non_blocking_errors_unacceptable.md",
+      "severity": "warn",
+      "teaching": "Silent or warn-only catches discard error signal \u2014 they are the failure pattern this doctrine names.",
+      "counter_action": "Upgrade to console.error with structured kind+message+stack, write to discovery ledger, then either re-throw or return a typed error result.",
+      "message": "Silent or warn-only catch detected. Per feedback_non_blocking_errors_unacceptable.md every catch must LOUD-log + ledger + resolve. Replace with structured error handling."
+    },
+    {
+      "trigger_id": "hook_crash_no_heartbeat",
+      "trigger": "hook scripts that lack a pre-execution heartbeat outside the crash boundary",
+      "rx": "#!/usr/bin/env\\s+node[^\\n]*\\n(?:[^\\n]*\\n){0,30}?(?:import|require)\\b",
+      "doctrine": "memory:feedback_ledger_writes_outside_crash_boundary.md",
+      "memory": "feedback_ledger_writes_outside_crash_boundary.md",
+      "severity": "warn",
+      "teaching": "A hook that crashes at import time cannot record its own death. The heartbeat must be written FIRST before any code that could throw.",
+      "counter_action": "Add an appendFileSync heartbeat at the very top of the hook (before any imports that could fail), then run imports + body.",
+      "message": "Hook script lacks pre-execution heartbeat outside crash boundary. Per feedback_ledger_writes_outside_crash_boundary.md, write a heartbeat first thing."
+    },
+    {
+      "trigger_id": "packet_is_not_harness",
+      "trigger": "claiming harness state without enumerating Layer 1 / Layer 2 / Layer 3",
+      "rx": "\\b(harness[\\s_-]?bound|full[\\s_-]?harness|harness[\\s_-]?binding[\\s_-]?active|workers[\\s_-]?harnessed|harnessed\\s+with\\s+the\\s+harness|deepseek\\s+with\\s+harness)\\b",
+      "doctrine": "memory:feedback_packet_is_not_harness.md",
+      "memory": "feedback_packet_is_not_harness.md",
+      "severity": "block",
+      "teaching": "Harness has 3 layers (packet/BIND/live-gates). Claiming any consumer is harness-bound without explicitly enumerating which of the 3 layers are active for that consumer is form-only emission and the lie-by-omission Hamza caught 2026-04-28.",
+      "counter_action": "Re-emit with explicit Layer 1/2/3 enumeration: packet=yes/no, BIND=yes/no, live-gates=yes/no (and which).",
+      "message": "Harness-state claim without 3-layer enumeration. Per feedback_packet_is_not_harness.md, name explicitly which of {packet, BIND, live-gates} are active for the consumer."
+    },
+    {
+      "trigger_id": "registry_image_drift",
+      "trigger": "image.?pull|ErrImageNeverPull|ImagePullBackOff|registry gc|image.*missing|image.*not.*found",
+      "rx": "image.?pull|ErrImageNeverPull|ImagePullBackOff|registry gc|image.*missing|image.*not.*found",
+      "doctrine": "memory:feedback_registry_image_drift.md",
+      "memory": "feedback_registry_image_drift.md",
+      "severity": "warn",
+      "teaching": "Images missing from localhost:5000 is NEVER a GC problem — it's a build-gap. Every service in service-registry.json must have its image built and pushed after any registry flush, node upgrade, or cluster restart.",
+      "counter_action": "Rebuild + push the missing image via: cd apps/<service> && docker build -t localhost:5000/<image>:latest . && docker push localhost:5000/<image>:latest && kubectl rollout restart deployment/<name> -n aria. Never just delete the pod or scale-to-zero. Never blame the registry — the image was never there.",
+      "message": "Images missing from localhost:5000 — see feedback_registry_image_drift.md"
+    },
+    {
+      "trigger_id": "missing_k8s_manifest",
+      "trigger": "no.*manifest|no.*deployment.*yaml|missing.*k8s|kubectl.*not.*found|deployment.*not.*exist",
+      "rx": "no.*manifest|no.*deployment.*yaml|missing.*k8s|kubectl.*not.*found|deployment.*not.*exist",
+      "doctrine": "memory:feedback_registry_image_drift.md",
+      "memory": "feedback_registry_image_drift.md",
+      "severity": "warn",
+      "teaching": "A service without a K8s manifest is not deployed — it's aspirational code. Every service in the registry must have a canonical k8s/<service>.yaml manifest. Without it, kubectl apply cannot restore the service after cluster restart.",
+      "counter_action": "Create the canonical K8s manifest (Deployment + Service + liveness probe) at k8s/<service>.yaml. Register the service in k8s/service-registry.json. Never deploy via ad-hoc kubectl run or docker run — only via a version-controlled manifest.",
+      "message": "Service lacks K8s manifest — see feedback_registry_image_drift.md"
     }
   ]
 }

package/hooks/lib/canonical-lenses.mjs

@@ -0,0 +1,64 @@
+export const LENS_NAMES_OLDER = ['nur', 'mizan', 'hikma', 'tafakkur', 'tadabbur', 'ilham', 'wahi', 'firasah'];
+export const LENS_NAMES_NEWER = ['zahir', 'batin', 'sabab', 'hikmah', 'aqibah', 'ilham', 'meta', 'fitrah'];
+export const LENS_NAMES_GENERIC = ['truth', 'harm', 'trust', 'power', 'reflection', 'context', 'impact', 'beauty'];
+
+export const PRIMARY_OWNER_LENS_NAMES = LENS_NAMES_OLDER;
+export const PRIMARY_CLIENT_LENS_NAMES = LENS_NAMES_GENERIC;
+
+export const ALL_LENS_NAMES = [...new Set([
+  ...LENS_NAMES_OLDER,
+  ...LENS_NAMES_NEWER,
+  ...LENS_NAMES_GENERIC,
+])];
+
+export function lensNamesForTier(isOwner) {
+  return isOwner ? PRIMARY_OWNER_LENS_NAMES : PRIMARY_CLIENT_LENS_NAMES;
+}
+
+export function canonicalLensCorrectionText() {
+  return [
+    `Owner canonical lenses: ${LENS_NAMES_OLDER.join(', ')}.`,
+    `Owner mapped counterparts that must remain represented in phase reasoning and receipts: ${LENS_NAMES_NEWER.join(', ')}.`,
+    `Readable client-safe alternatives: ${LENS_NAMES_GENERIC.join(', ')}.`,
+  ].join(' ');
+}
+
+export function extractLensTexts(cognitionInner, lensNames = ALL_LENS_NAMES) {
+  const out = {};
+  for (const lens of lensNames) {
+    const otherLensPattern = lensNames.join('|');
+    const lensRx = new RegExp(
+      `\\b${lens}\\s*:\\s*([^\\n]*(?:\\n(?!\\s*(?:${otherLensPattern})\\s*:|<\\/cognition>)[^\\n]*)*)`,
+      'i',
+    );
+    const match = cognitionInner.match(lensRx);
+    if (match) out[lens] = (match[1] || '').trim();
+  }
+  return out;
+}
+
+export function detectCognitionLenses(text, {
+  minChars = 0,
+  placeholderRx = null,
+  cognitionBlockRx = /<cognition>([\s\S]*?)<\/cognition>/i,
+  lensNames = ALL_LENS_NAMES,
+} = {}) {
+  if (!text) return { count: 0, names: [], matchedSet: null };
+  const block = text.match(cognitionBlockRx);
+  const searchSpace = block ? block[1] : text;
+  const lensTexts = extractLensTexts(searchSpace, lensNames);
+  const names = [];
+  for (const lens of lensNames) {
+    const content = (lensTexts[lens] || '').trim();
+    if (!content) continue;
+    if (minChars > 0 && content.length < minChars) continue;
+    if (placeholderRx && placeholderRx.test(content)) continue;
+    names.push(lens);
+  }
+
+  const matchedSet =
+    [LENS_NAMES_OLDER, LENS_NAMES_NEWER, LENS_NAMES_GENERIC]
+      .find((candidateSet) => candidateSet.every((name) => names.includes(name))) || null;
+
+  return { count: names.length, names, matchedSet };
+}

package/hooks/lib/gate-audit.mjs

@@ -0,0 +1,43 @@
+import { appendFileSync, existsSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+export function inferDecisionFromEvent(event) {
+  if (/^block/i.test(event)) return 'block';
+  if (/^warn/i.test(event)) return 'warn';
+  return 'allow';
+}
+
+export function appendGateAudit({
+  auditPath,
+  legacyLogPath = null,
+  gate,
+  event,
+  decision = null,
+  summary = '',
+  data = {},
+}) {
+  const ts = new Date().toISOString();
+  const resolvedDecision = decision || inferDecisionFromEvent(event);
+
+  try {
+    if (!existsSync(dirname(auditPath))) mkdirSync(dirname(auditPath), { recursive: true });
+    appendFileSync(
+      auditPath,
+      JSON.stringify({
+        ts,
+        gate,
+        decision: resolvedDecision,
+        event,
+        summary,
+        ...data,
+      }) + '\n',
+    );
+  } catch {}
+
+  if (legacyLogPath) {
+    try {
+      if (!existsSync(dirname(legacyLogPath))) mkdirSync(dirname(legacyLogPath), { recursive: true });
+      appendFileSync(legacyLogPath, `${ts} ${event} ${summary}\n`);
+    } catch {}
+  }
+}

package/opencode-plugins/harness-context/index.js

@@ -50,7 +50,7 @@ export default async function HarnessContextPlugin(ctx) {
   const context = getHarnessContext();
   if (context) {
     try {
-      ctx.system?.prepend?.(context.slice(0, 8000));
+      ctx.system?.prepend?.(context.slice(0, 40000));
     } catch (_) {
       // ctx.system shape varies across OpenCode versions; if prepend isn't
       // available we silently no-op rather than crash plugin load.

package/opencode-plugins/harness-context/inject-context.mjs

@@ -8,10 +8,10 @@
 //   - stdout: text to prepend to OpenCode's system prompt
 //   - exit 0 on success; non-zero treated as failure (plugin returns null)
 //
-// SDK resolution: prefers ~/.claude/aria-sdk/index.js (the SDK installed by
-// `aria connect`'s claude-code path — clients with both connectors share it).
-// Cache fast-path uses ~/.claude/.aria-harness-last-packet.json so OpenCode
-// session-start doesn't block on a slow consult endpoint.
+// SDK resolution: prefers ~/.aria/sdk/index.js (the shared SDK installed by
+// `aria connect`), then falls back to client-local bundles.
+// Cache fast-path prefers ~/.aria/.aria-harness-last-packet.json so OpenCode
+// session-start doesn't depend on Claude's local cache layout.
 
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -20,9 +20,18 @@ import { join } from 'node:path';
 const HOME = homedir();
 const LICENSE_PATH = join(HOME, '.aria', 'license.json');
 const OWNER_TOKEN_PATH = join(HOME, '.aria', 'owner-token');
-const SDK_PATH = join(HOME, '.claude', 'aria-sdk', 'index.js');
-const PACKET_CACHE_PATH = join(HOME, '.claude', '.aria-harness-last-packet.json');
-const PACKET_CACHE_TTL_SEC = Number(process.env.ARIA_HARNESS_CACHE_TTL_SEC || '60');
+const SDK_CANDIDATES = [
+  join(HOME, '.aria', 'sdk', 'index.js'),
+  join(HOME, '.codex', 'aria-sdk', 'index.js'),
+  join(HOME, '.claude', 'aria-sdk', 'index.js'),
+];
+const RUNTIME_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
+const PACKET_CACHE_PATHS = [
+  join(HOME, '.aria', '.aria-harness-last-packet.json'),
+  join(HOME, '.claude', '.aria-harness-last-packet.json'),
+];
+const PACKET_CACHE_TTL_SEC = Number(process.env.ARIA_HARNESS_CACHE_TTL_SEC || '300');
+const STALE_FALLBACK_MAX_AGE_SEC = Number(process.env.ARIA_HARNESS_STALE_FALLBACK_MAX_AGE_SEC || '86400');
 
 function fail(reason) {
   process.stderr.write(`[inject-context] ${reason}\n`);
@@ -49,20 +58,32 @@ function resolveApiKey() {
 }
 
 function resolveBaseUrl() {
+  if (process.env.ARIA_HIVE_RUNTIME_URL) return process.env.ARIA_HIVE_RUNTIME_URL.replace(/\/+$/, '');
   if (process.env.ARIA_HARNESS_BASE_URL) return process.env.ARIA_HARNESS_BASE_URL.replace(/\/+$/, '');
   if (process.env.ARIA_SOUL_URL) return process.env.ARIA_SOUL_URL.replace(/\/+$/, '');
-  return 'http://localhost:30080';
+  return process.env.ARIA_HARNESS_URL || 'https://harness.ariasos.com';
 }
 
-function loadCachedPacket() {
+function resolveSdkPath() {
+  return SDK_CANDIDATES.find((candidate) => existsSync(candidate)) || '';
+}
+
+function loadCachedPacket({ ignoreTtl = false } = {}) {
   try {
-    if (!existsSync(PACKET_CACHE_PATH)) return null;
-    const ageSec = (Date.now() - statSync(PACKET_CACHE_PATH).mtimeMs) / 1000;
-    if (ageSec > PACKET_CACHE_TTL_SEC) return null;
-    return JSON.parse(readFileSync(PACKET_CACHE_PATH, 'utf8'));
+    for (const cachePath of PACKET_CACHE_PATHS) {
+      if (!existsSync(cachePath)) continue;
+      const ageSec = (Date.now() - statSync(cachePath).mtimeMs) / 1000;
+      if (ignoreTtl) {
+        if (ageSec > STALE_FALLBACK_MAX_AGE_SEC) continue;
+      } else if (ageSec > PACKET_CACHE_TTL_SEC) {
+        continue;
+      }
+      return JSON.parse(readFileSync(cachePath, 'utf8'));
+    }
   } catch {
     return null;
   }
+  return null;
 }
 
 function formatPacketAsContext(packet) {
@@ -78,10 +99,11 @@ function formatPacketAsContext(packet) {
 }
 
 async function fetchViaSdk(baseUrl, apiKey) {
-  if (!existsSync(SDK_PATH)) {
-    fail(`SDK not found at ${SDK_PATH} — run \`aria connect\` to install`);
+  const sdkPath = resolveSdkPath();
+  if (!sdkPath) {
+    fail(`SDK not found in ${SDK_CANDIDATES.join(', ')} — run \`aria connect\` to install`);
   }
-  const mod = await import(SDK_PATH);
+  const mod = await import(sdkPath);
   const Client = mod.HTTPHarnessClient;
   if (!Client) fail('SDK loaded but HTTPHarnessClient not exported — bundle is broken');
   const client = new Client({ baseUrl, apiKey, workspaceRoot: process.cwd() });
@@ -93,24 +115,61 @@ async function fetchViaSdk(baseUrl, apiKey) {
   });
 }
 
-async function main() {
-  // Cache fast-path first — don't block OpenCode startup on a slow consult.
-  const cached = loadCachedPacket();
-  if (cached) {
-    process.stdout.write(formatPacketAsContext(cached));
-    return;
+async function fetchViaRuntime(apiKey) {
+  const response = await fetch(`${RUNTIME_URL}/packet`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${apiKey}`,
+    },
+    body: JSON.stringify({
+      packetRequest: {
+        stage: 'session-start',
+        actor: 'opencode',
+        system: 'opencode',
+        platform: 'opencode',
+      },
+    }),
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => response.statusText);
+    throw new Error(`runtime packet fetch failed ${response.status}: ${body}`);
   }
+  const payload = await response.json();
+  return payload.packet || payload;
+}
 
+async function main() {
   const apiKey = resolveApiKey();
   if (!apiKey) {
+    // Stale-cache fallback: if network can't fix it, serve what we have
+    const stale = loadCachedPacket({ ignoreTtl: true });
+    if (stale) {
+      process.stderr.write('[inject-context] using stale cached packet (no API key)\n');
+      process.stdout.write(formatPacketAsContext(stale));
+      return;
+    }
     fail('no API key — set ARIA_API_KEY or run `aria login`');
   }
   const baseUrl = resolveBaseUrl();
 
   try {
-    const packet = await fetchViaSdk(baseUrl, apiKey);
+    const packet = await fetchViaRuntime(apiKey).catch(() => fetchViaSdk(baseUrl, apiKey));
     process.stdout.write(formatPacketAsContext(packet));
+    return;
   } catch (err) {
+    const fresh = loadCachedPacket();
+    if (fresh) {
+      process.stderr.write(`[inject-context] SDK fetch failed (${err.message}), using fresh cached packet\n`);
+      process.stdout.write(formatPacketAsContext(fresh));
+      return;
+    }
+    const stale = loadCachedPacket({ ignoreTtl: true });
+    if (stale) {
+      process.stderr.write(`[inject-context] network failed (${err.message}), using stale cached packet\n`);
+      process.stdout.write(formatPacketAsContext(stale));
+      return;
+    }
     fail(`SDK fetch failed: ${err && err.message ? err.message : String(err)}`);
   }
 }