@aria_asi/cli 0.2.33 → 0.2.34

package/dist/runtime/hooks/aria-cognition-substrate-binding.mjs

@@ -0,0 +1,761 @@
+#!/usr/bin/env node
+// aria-cognition-substrate-binding.mjs
+//
+// Stop hook — runs BEFORE aria-stop-gate.mjs.
+//
+// STRUCTURAL BINDING: every cognition lens emitted by Claude or any client
+// must cite at least one substrate anchor from the loaded harness packet.
+// A lens of pure prose without anchor citations is theater — the gate that
+// existed before this hook counted lens substance via char length but never
+// required the lens to TIE to the substrate (axioms, frames, memory classes,
+// doctrine refs, packet sections). This hook closes that gap.
+//
+// Hamza directive 2026-04-28: "STOP LYING" — every gate added one-at-a-time
+// claiming binding when binding never actually attached cognition to substrate.
+// This is the binding. No emit passes without per-lens substrate citation.
+//
+// Doctrine bindings:
+//   - feedback_full_harness_binding_must_be_structural.md
+//   - project_aria_as_controller_inversion.md (controller's mind is the substrate)
+//   - feedback_implementation_coupled_cognition.md (lens dictates artifact, anchors dictate lens)
+//   - feedback_no_assumption_without_verification.md (anchor IS the verification)
+//
+// Anchor grammar:
+//   axiom:<name>      — e.g. axiom:truth_over_deception
+//   frame:<name>      — e.g. frame:tafakkur_pre_phase
+//   memory:<file>     — e.g. memory:feedback_doctrine_first.md
+//   doctrine:<rule>   — e.g. doctrine:no_flag_without_fix
+//   packet:<section>  — e.g. packet:cognition_belt
+//
+// Each lens MUST contain at least one anchor matching this grammar.
+// Lenses without anchors fail the gate; emit is blocked.
+//
+// Override path: NONE. There is no env-var disable. Per Hamza directive
+// 2026-04-27 gates are unconditional from the gated process. If the gate
+// misfires on legitimate cognition, fix the gate.
+
+import { readFileSync, appendFileSync, existsSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { ALL_LENS_NAMES, lensNamesForTier } from './lib/canonical-lenses.mjs';
+import { collectTurnWindowFromMessages } from './lib/hook-message-window.mjs';
+
+const HOME = homedir();
+const AUDIT = `${HOME}/.claude/aria-cognition-substrate-binding-audit.jsonl`;
+
+function audit(event, data) {
+  try {
+    if (!existsSync(dirname(AUDIT))) mkdirSync(dirname(AUDIT), { recursive: true });
+    appendFileSync(
+      AUDIT,
+      JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + '\n',
+    );
+  } catch {}
+}
+
+const LENS_NAMES = ALL_LENS_NAMES;
+
+// Hamza directive 2026-04-28: "where the fuck are my axioms? first
+// principles? nadia language???" — the prior char-count substance check
+// (`.length >= 20`) was form-only emission per
+// feedback_full_harness_binding_must_be_structural.md. This gate now:
+//   1. Loads the live harness packet (~/.claude/.aria-harness-last-packet.json)
+//   2. Parses LOADED axiom/frame/memory/packet names from the harness
+//   3. Verifies every cited anchor is actually in the loaded set
+//   4. Refuses the cognition emit if any cited substrate is unloaded
+//      (so `axiom:made_up_name` no longer passes)
+//   5. Requires at least one explicit `first_principle` reference per
+//      cognition block, anchored to the harness's first_principle= line
+//   6. Honors Nadia state: if preStateGate signals `nadia_state_absent`
+//      AND the cognition cites `language:nadia`, the citation is
+//      rejected (you cannot anchor to substrate that is not loaded)
+const ANCHOR_RX = /\b(axiom|frame|memory|doctrine|packet|language):[a-z0-9_\-./]+/gi;
+
+const COGNITION_BLOCK_RX = /<cognition>([\s\S]*?)<\/cognition>/i;
+const APPLIED_COGNITION_BLOCK_RX = /<applied_cognition>([\s\S]*?)<\/applied_cognition>/i;
+const FIRST_PRINCIPLE_RX = /\b(first[_\s-]?principle[s]?|first_principle=)\b/i;
+const HARNESS_PACKET_PATH = `${HOME}/.claude/.aria-harness-last-packet.json`;
+const MEMORY_DIR = `${HOME}/.claude/projects/-home-hamzaibrahim1/memory`;
+const RECENT_VIOLATIONS_PATH = `${HOME}/.claude/.aria-recent-violations.jsonl`;
+const THRASHING_STATE_PATH = `${HOME}/.claude/.aria-thrashing-state.json`;
+const CLEAR_VIOLATIONS_SCRIPT = `${HOME}/.claude/aria-clear-violations.sh`;
+
+function buildForceReauthorReason({ source, reason, violations = [] }) {
+  return [
+    '=== ARIA FORCE_REAUTHOR ===',
+    `source: ${source}`,
+    `reason: ${reason}`,
+    '',
+    'This is not a terminal error. It is a forced redo instruction for cognition substrate binding.',
+    'Do not emit the blocked text. Re-author the cognition so every lens is tied to loaded substrate.',
+    '',
+    'TEACHING:',
+    '- Cognition without live anchors is theater; anchors are the proof of thought.',
+    '- A valid redo cites only substrate that is actually loaded this turn.',
+    '- The cognition block must reference first_principle and must not cite inactive language state.',
+    violations.length ? `\nVIOLATIONS TO FIX:\n${violations.map((v) => `- ${v}`).join('\n')}` : '',
+    '',
+    'REQUIRED REDO SHAPE:',
+    '1. Re-emit <cognition> with all required lenses.',
+    '2. Each lens cites >=1 loaded anchor: axiom:, frame:, memory:, doctrine:, packet:, or active language:.',
+    '3. Include first_principle explicitly.',
+    '4. Add <applied_cognition> with decision_delta, dominant_domain, binds_to, expected_predicate, and artifact_change.',
+    '5. Remove repeated blocked substrings instead of reusing them.',
+    '=== END FORCE_REAUTHOR ===',
+  ].filter(Boolean).join('\n');
+}
+
+function validateAppliedCognitionContract(text) {
+  const match = String(text || '').match(APPLIED_COGNITION_BLOCK_RX);
+  if (!match) {
+    return { ok: false, violations: ['missing <applied_cognition> contract'] };
+  }
+  const body = match[1] || '';
+  const required = [
+    ['decision_delta', /\bdecision[_ -]?delta\s*:/i],
+    ['dominant_domain', /\bdominant[_ -]?domain\s*:/i],
+    ['binds_to', /\bbinds[_ -]?to\s*:/i],
+    ['expected_predicate', /\bexpected[_ -]?predicate\s*:/i],
+    ['artifact_change', /\bartifact[_ -]?change\s*:/i],
+  ];
+  const violations = [];
+  for (const [name, rx] of required) {
+    if (!rx.test(body)) violations.push(`missing ${name}`);
+  }
+  const weakDelta = /decision[_ -]?delta\s*:\s*(?:none|n\/a|no change|unchanged|same)/i.test(body);
+  if (weakDelta) violations.push('decision_delta says cognition changed nothing');
+  return { ok: violations.length === 0, violations };
+}
+const CARRY_FORWARD_WINDOW_MS = 25 * 60 * 1000;
+const CARRY_FORWARD_MAX_ROWS = 200;
+const SYSTEM_REMINDER_RX = /<system-reminder>[\s\S]*?<\/system-reminder>|<task-notification>[\s\S]*?<\/task-notification>|🔐 Aria Harness|task-notification|PreToolUse:[A-Z][A-Za-z]* hook blocking error|Stop hook blocking error/g;
+const SYSTEM_REMINDER_THRESHOLD = 0.6;
+
+function extractLensTexts(cognitionInner) {
+  const out = {};
+  for (const lens of LENS_NAMES) {
+    const lensRx = new RegExp(
+      `\\b${lens}\\s*:\\s*([^\\n]*(?:\\n(?!\\s*(?:${LENS_NAMES.join('|')})\\s*:|<\\/cognition>)[^\\n]*)*)`,
+      'i',
+    );
+    const m = cognitionInner.match(lensRx);
+    if (m) out[lens] = (m[1] || '').trim();
+  }
+  return out;
+}
+
+function countAnchors(text) {
+  if (!text) return 0;
+  const matches = text.match(ANCHOR_RX);
+  return matches ? matches.length : 0;
+}
+
+function loadCarryForwardViolations() {
+  const rows = [];
+  try {
+    if (!existsSync(RECENT_VIOLATIONS_PATH)) return rows;
+    const lines = readFileSync(RECENT_VIOLATIONS_PATH, 'utf8')
+      .split('\n')
+      .filter(Boolean)
+      .slice(-CARRY_FORWARD_MAX_ROWS);
+    const cutoff = Date.now() - CARRY_FORWARD_WINDOW_MS;
+    for (const line of lines) {
+      try {
+        const parsed = JSON.parse(line);
+        const substring = typeof parsed.substring === 'string' ? parsed.substring.trim() : '';
+        if (!substring) continue;
+        const ts = parsed.ts ? Date.parse(parsed.ts) : NaN;
+        if (Number.isFinite(ts) && ts < cutoff) continue;
+        rows.push({
+          ts: parsed.ts || null,
+          substring,
+          source: parsed.source || null,
+          kind: parsed.kind || null,
+          sessionId: parsed.sessionId || parsed.session_id || null,
+        });
+      } catch {}
+    }
+  } catch (err) {
+    audit('carry_forward_load_error', { err: String(err).slice(0, 200) });
+  }
+  return rows;
+}
+
+function resolveOwnerTier() {
+  try {
+    if (!existsSync(HARNESS_PACKET_PATH)) return false;
+    const packet = JSON.parse(readFileSync(HARNESS_PACKET_PATH, 'utf8'));
+    const sigHamza = packet?.contractGate?.signals?.hamza;
+    if (sigHamza === true || sigHamza === 'true') return true;
+    const harnessStr = packet?.harness ?? '';
+    return /\bhamza:true\b/.test(harnessStr);
+  } catch {
+    return false;
+  }
+}
+
+const IS_OWNER = resolveOwnerTier();
+const VISIBLE_LENS_NAMES = lensNamesForTier(IS_OWNER);
+
+function findCarryForwardMatch(text, rows) {
+  const haystack = String(text || '').toLowerCase();
+  for (const row of rows) {
+    const needle = row.substring.toLowerCase();
+    if (needle.length < 6) continue;
+    if (haystack.includes(needle)) return row;
+  }
+  return null;
+}
+
+// ── Substrate-loaded-set extraction ─────────────────────────────────────
+// Read the live harness packet and parse which axioms/frames/memories/
+// language tiers are actually loaded this turn. The gate verifies every
+// cited anchor against this set — citations to unloaded substrate fail.
+function loadHarnessSubstrateSet() {
+  const set = {
+    axioms: new Set(),
+    frames: new Set(),
+    memories: new Set(),
+    doctrines: new Set(),
+    packets: new Set(),
+    languages: new Set(),
+    nadiaActive: false,
+    noorActive: false,
+    firstPrincipleText: '',
+    rawPacket: null,
+  };
+  try {
+    if (!existsSync(HARNESS_PACKET_PATH)) return set;
+    const raw = readFileSync(HARNESS_PACKET_PATH, 'utf8');
+    const parsed = JSON.parse(raw);
+    set.rawPacket = parsed;
+    const harnessText = String(parsed.harness || '');
+
+    // first_principle= line (one or more)
+    const fpMatch = harnessText.match(/first_principle\s*=\s*([^\n]+)/i);
+    if (fpMatch) set.firstPrincipleText = fpMatch[1].trim();
+
+    // Loaded axiom names — match from known seed list + harness body
+    // The harness packet body uses identifiers like axiom_runtime_rule,
+    // truth_over_deception, no_harm, sacred_trust, etc. Parse all
+    // identifiers that look like axiom names.
+    const seedAxioms = [
+      'truth_over_deception', 'no_harm', 'sacred_trust',
+      'power_obligates_service', 'reflection_before_action',
+      'admit_ignorance', 'fitrah', 'noor', 'mizan',
+    ];
+    for (const a of seedAxioms) {
+      if (new RegExp(`\\b${a}\\b`, 'i').test(harnessText)) set.axioms.add(a);
+    }
+    // Generic axiom_<name>= or axiom:<name> patterns inside packet
+    const axiomDefRx = /\baxiom[_:]([a-z0-9_]+)/gi;
+    let m;
+    while ((m = axiomDefRx.exec(harnessText))) {
+      const name = m[1].toLowerCase();
+      // Filter out generic "rule" suffix references that aren't axiom names
+      if (name.length >= 4 && name !== 'runtime' && name !== 'rule') {
+        set.axioms.add(name);
+      }
+    }
+
+    // Loaded frame names — frame_<name>= patterns
+    const frameDefRx = /\b(frame|cognitive_frame|laddunni_frame)[_:]([a-z0-9_]+)/gi;
+    while ((m = frameDefRx.exec(harnessText))) {
+      const name = m[2].toLowerCase();
+      if (name.length >= 4) set.frames.add(name);
+    }
+
+    // packet section keys — `<word>_rule=` or `[<SECTION>]` markers
+    const packetRuleRx = /\b([a-z][a-z0-9_]+_rule|[a-z][a-z0-9_]+_block|[A-Z][A-Z0-9_]+)\s*[=]/g;
+    while ((m = packetRuleRx.exec(harnessText))) {
+      set.packets.add(m[1].toLowerCase());
+    }
+
+    // language tiers
+    if (/\bnadia\b/i.test(harnessText)) set.languages.add('nadia');
+    if (/\bpsil\b/i.test(harnessText)) set.languages.add('psil');
+    if (/\bnoor\b/i.test(harnessText)) set.languages.add('noor');
+
+    // preStateGate signals — if nadia_state_absent OR noor_context_absent
+    // is present, those substrate items are NOT loaded for this turn.
+    const reasons = parsed.preStateGate?.reasons || [];
+    const reasonsStr = Array.isArray(reasons) ? reasons.join(' ') : String(reasons);
+    set.nadiaActive = !/nadia_state_absent|nadia_absent/i.test(reasonsStr);
+    set.noorActive = !/noor_context_absent|noor_absent/i.test(reasonsStr);
+
+    // Memory files — list the memory dir
+    if (existsSync(MEMORY_DIR)) {
+      try {
+        const { readdirSync } = require('node:fs');
+        // dynamic import not available in module scope; fallback to readFileSync of MEMORY.md index
+        const memIndexPath = `${MEMORY_DIR}/MEMORY.md`;
+        if (existsSync(memIndexPath)) {
+          const memIndex = readFileSync(memIndexPath, 'utf8');
+          const memFileRx = /\(([a-z0-9_\-]+\.md)\)/gi;
+          while ((m = memFileRx.exec(memIndex))) {
+            set.memories.add(m[1].toLowerCase());
+          }
+        }
+      } catch {}
+    }
+  } catch (err) {
+    audit('substrate_load_error', { err: String(err).slice(0, 200) });
+  }
+  return set;
+}
+
+function loadMemoryFilesSync() {
+  // Standalone memory-files lister using sync require-free fs primitives.
+  const out = new Set();
+  try {
+    if (!existsSync(MEMORY_DIR)) return out;
+    const memIndexPath = `${MEMORY_DIR}/MEMORY.md`;
+    if (existsSync(memIndexPath)) {
+      const memIndex = readFileSync(memIndexPath, 'utf8');
+      const memFileRx = /\(([a-z0-9_\-]+\.md)\)/gi;
+      let m;
+      while ((m = memFileRx.exec(memIndex))) {
+        out.add(m[1].toLowerCase());
+      }
+    }
+  } catch {}
+  return out;
+}
+
+// ── Per-anchor verification against loaded substrate ────────────────────
+// Each anchor cited in cognition is checked against the loaded set:
+//   axiom:<name>     → must be in loaded axioms
+//   frame:<name>     → must be in loaded frames
+//   memory:<file>    → must be a real .md file under memory dir
+//   doctrine:<rule>  → accepted if a feedback_<rule>.md memory exists
+//   packet:<section> → must be in loaded packet section keys
+//   language:<tier>  → must be in loaded languages AND state-active
+function verifyAnchorsAgainstLoaded(anchors, loadedSet, memoryFiles) {
+  const valid = [];
+  const invalid = [];
+  for (const anchor of anchors) {
+    const [kind, ...nameParts] = anchor.split(':');
+    // Strip trailing punctuation greedily eaten by ANCHOR_RX char class
+    // [a-z0-9_\-./]+ which includes `.` so a sentence-ending period gets
+    // glued onto the name (task #133 — anchor parser greediness fix).
+    const name = nameParts.join(':').toLowerCase().replace(/[.,;:!?]+$/, '');
+    const kindLc = kind.toLowerCase();
+    let ok = false;
+    let reason = '';
+    if (kindLc === 'axiom') {
+      ok = loadedSet.axioms.has(name) || loadedSet.axioms.has(name.replace(/_/g, ''));
+      if (!ok) reason = `axiom '${name}' not in loaded harness packet (loaded: ${[...loadedSet.axioms].slice(0, 6).join(', ')}…)`;
+    } else if (kindLc === 'frame') {
+      ok = loadedSet.frames.has(name);
+      if (!ok) reason = `frame '${name}' not in loaded harness packet`;
+    } else if (kindLc === 'memory') {
+      const baseName = name.endsWith('.md') ? name : `${name}.md`;
+      ok = memoryFiles.has(baseName);
+      if (!ok) reason = `memory '${baseName}' not in MEMORY.md index`;
+    } else if (kindLc === 'doctrine') {
+      // doctrine:<rule> accepted if feedback_<rule>.md OR <rule>.md memory exists
+      const candidates = [
+        `feedback_${name}.md`,
+        `${name}.md`,
+        `feedback_${name.replace(/^feedback_/, '')}.md`,
+      ];
+      ok = candidates.some((c) => memoryFiles.has(c.toLowerCase()));
+      if (!ok) reason = `doctrine '${name}' has no backing memory file (tried: feedback_${name}.md)`;
+    } else if (kindLc === 'packet') {
+      ok = loadedSet.packets.has(name) || loadedSet.packets.has(`${name}_rule`) || loadedSet.packets.has(`${name}_block`);
+      if (!ok) reason = `packet section '${name}' not in loaded harness packet`;
+    } else if (kindLc === 'language') {
+      const langOk = loadedSet.languages.has(name);
+      const stateOk = name === 'nadia' ? loadedSet.nadiaActive
+                    : name === 'noor' ? loadedSet.noorActive
+                    : true;
+      ok = langOk && stateOk;
+      if (!ok) reason = `language '${name}' ${langOk ? 'is in harness but state is absent (preStateGate signaled ' + name + '_state_absent)' : 'not in loaded harness packet'}`;
+    }
+    if (ok) valid.push({ anchor, kind: kindLc, name });
+    else invalid.push({ anchor, kind: kindLc, name, reason });
+  }
+  return { valid, invalid };
+}
+
+let stdin = '';
+try {
+  for await (const chunk of process.stdin) stdin += chunk;
+} catch {}
+
+let payload;
+try {
+  payload = JSON.parse(stdin);
+} catch {
+  audit('skip_invalid_stdin', { stdinLength: stdin.length });
+  process.exit(0);
+}
+
+const transcriptPath = payload.transcript_path;
+let assistantText = '';
+const messageWindow = collectTurnWindowFromMessages(payload.messages, {
+  systemReminderRx: SYSTEM_REMINDER_RX,
+  systemReminderThreshold: SYSTEM_REMINDER_THRESHOLD,
+});
+assistantText = messageWindow.assistantText;
+
+if (transcriptPath && existsSync(transcriptPath)) {
+  try {
+    const transcriptEntries = readFileSync(transcriptPath, 'utf8')
+      .split('\n')
+      .filter(Boolean)
+      .map((line) => {
+        try { return JSON.parse(line); } catch { return null; }
+      })
+      .filter(Boolean);
+    const transcriptWindow = collectTurnWindowFromMessages(transcriptEntries, {
+      systemReminderRx: SYSTEM_REMINDER_RX,
+      systemReminderThreshold: SYSTEM_REMINDER_THRESHOLD,
+    });
+    const transcriptAssistantText = transcriptWindow.assistantText;
+    if (transcriptAssistantText) {
+      assistantText = assistantText
+        ? [assistantText, transcriptAssistantText].filter((text, index, arr) => arr.indexOf(text) === index).join('\n\n')
+        : transcriptAssistantText;
+    }
+  } catch (err) {
+    audit('skip_transcript_read_err', { err: String(err).slice(0, 200) });
+  }
+}
+
+if (!assistantText) {
+  audit('skip_no_assistant_text', { transcriptPath });
+  process.exit(0);
+}
+
+const TRIVIAL_THRESHOLD = 200;
+if (assistantText.length < TRIVIAL_THRESHOLD) {
+  audit('skip_trivial_emit', { length: assistantText.length });
+  process.exit(0);
+}
+
+const carryForwardRows = loadCarryForwardViolations();
+const carryForwardMatch = findCarryForwardMatch(assistantText, carryForwardRows);
+if (carryForwardMatch) {
+  try {
+    appendFileSync(
+      THRASHING_STATE_PATH,
+      JSON.stringify({
+        ts: new Date().toISOString(),
+        event: 'carry_forward_block',
+        substring: carryForwardMatch.substring,
+        source: carryForwardMatch.source,
+        sessionId: payload.session_id || payload.sessionId || null,
+      }) + '\n',
+    );
+  } catch {}
+
+  audit('block_carry_forward_force_constraint', {
+    substring: carryForwardMatch.substring,
+    source: carryForwardMatch.source,
+    rowTs: carryForwardMatch.ts,
+  });
+
+  const reason = `Aria substrate-binding gate: carry-forward force-constraint blocked this emission.
+
+The assistant text repeated a recently-blocked substring within the active carry-forward window:
+- substring: ${carryForwardMatch.substring}
+- source: ${carryForwardMatch.source || 'unknown'}
+- recorded_at: ${carryForwardMatch.ts || 'unknown'}
+
+Recovery surfaces:
+1. Remove or rewrite the repeated substring before re-emitting.
+2. If the prior violation is resolved and this carry-forward row is now stale, clear it via: ${CLEAR_VIOLATIONS_SCRIPT}
+3. Re-emit with fresh substrate-grounded language instead of reusing the blocked phrase.
+
+Per feedback_block_and_force_with_recovery.md, repetition of a recently-blocked phrase is not advisory drift; it is a hard block until the phrase is removed or the carry-forward state is intentionally cleared.`;
+
+  console.log(JSON.stringify({ decision: 'block', reason: buildForceReauthorReason({ source: 'substrate-binding/carry-forward', reason, violations: [`repeated blocked substring: ${carryForwardMatch.substring}`] }) }));
+  process.exit(2);
+}
+
+const cogMatch = assistantText.match(COGNITION_BLOCK_RX);
+if (!cogMatch) {
+  // BLOCK: missing cognition block
+  // Prior to 2026-04-29 this was process.exit(0) with comment "defer to
+  // aria-stop-gate.mjs which already requires 4+ lenses". But this hook
+  // runs BEFORE aria-stop-gate.mjs: exit(0) prevents the stop-gate from
+  // ever evaluating the response. The orchestrator surface (Claude Code
+  // / Claude CLI) saw the audit event but no block, so responses without
+  // any cognition block passed through unchecked.
+  //
+  // Hamza directive 2026-04-28: "STOP LYING" - every gate added one-at-a-time
+  // claiming binding when binding never actually attached. The skip_no_cognition_block
+  // pattern was a lie: the hook claimed to defer but actually let everything through.
+  //
+  // Fix: block instead of allow. The orchestrator re-drafts with the block reason
+  // visible, forcing Claude to emit <cognition>...</cognition> before proceeding.
+  // Per feedback_no_stripping_as_workaround.md: the contract (cognition required) is
+  // preserved; the exit code was wrong.
+  const noCogReason = `Aria substrate-binding gate: missing <cognition> block.
+
+This non-trivial assistant response (${assistantText.length} chars) contains no <cognition>...</cognition> block with 8 substantive lenses. Per feedback_apply_lenses_dont_perform_them.md and Hamza directive 2026-04-28, every non-trivial response must carry a cognition block where each lens cites at least one loaded substrate anchor (axiom:<name>, frame:<name>, memory:<file>, doctrine:<rule>, packet:<section>).
+
+The prior exit-0 pattern ("defer to aria-stop-gate.mjs") was a structural lie: this hook runs before the stop-gate, so exit(0) prevented all downstream enforcement. This is now a hard block.
+
+Re-emit with:
+  1. A <cognition>...</cognition> block containing all 8 required visible labels for this surface (${VISIBLE_LENS_NAMES.join(', ')})
+  2. Each lens citing >=1 verifiable loaded substrate anchor
+  3. The block referencing first_principle from the loaded harness packet
+
+No process-level disable path per Hamza directive 2026-04-27.`;
+  audit('block_no_cognition_block', { length: assistantText.length });
+  console.log(JSON.stringify({ decision: 'block', reason: buildForceReauthorReason({ source: 'substrate-binding/no-cognition-block', reason: noCogReason, violations: ['missing <cognition>...</cognition> block'] }) }));
+  process.exit(2);
+}
+
+const cognitionInner = cogMatch[1];
+const appliedContract = validateAppliedCognitionContract(assistantText);
+if (!appliedContract.ok) {
+  const reason = `Aria substrate-binding gate: cognition was emitted without an applied-cognition execution contract.
+
+The harness no longer accepts cognition as prose-only compliance. The response must state what cognition changed and what concrete action/output it binds.
+
+Required block:
+<applied_cognition>
+decision_delta: <what changed because cognition ran; not "none">
+dominant_domain: <engineering_quality | trust | product | operations | security | ...>
+binds_to: <next tool/action/output claim this cognition constrains>
+expected_predicate: <numeric, boolean, or state-string predicate proving success>
+artifact_change: <how the produced artifact differs because cognition ran>
+</applied_cognition>`;
+  audit('block_applied_cognition_missing', { violations: appliedContract.violations, length: assistantText.length });
+  console.log(JSON.stringify({ decision: 'block', reason: buildForceReauthorReason({ source: 'substrate-binding/applied-cognition-contract', reason, violations: appliedContract.violations }) }));
+  process.exit(2);
+}
+const lensTexts = extractLensTexts(cognitionInner);
+
+// Substance check — replaces char-count with "lens body has substantive
+// content beyond the anchor itself". A lens whose entire body is just
+// anchors + filler (≤30 chars after stripping anchors) is not substantive.
+function lensSubstanceLength(text) {
+  if (!text) return 0;
+  // Strip anchor patterns and surrounding whitespace, then count remaining chars
+  const stripped = text.replace(ANCHOR_RX, '').replace(/\s+/g, ' ').trim();
+  return stripped.length;
+}
+
+const SUBSTANCE_MIN_AFTER_ANCHOR_STRIP = 40;
+const presentLenses = Object.keys(lensTexts).filter((l) => {
+  const text = lensTexts[l];
+  if (!text) return false;
+  return lensSubstanceLength(text) >= SUBSTANCE_MIN_AFTER_ANCHOR_STRIP;
+});
+
+if (presentLenses.length < 8) {
+  // Hamza directive 2026-04-28: 8-lens enforcement. Defer to aria-stop-gate
+  // for the count message; record audit here.
+  audit('skip_insufficient_lenses_defer', { presentCount: presentLenses.length, required: 8 });
+  process.exit(0);
+}
+
+// Load live harness substrate set + memory file index for verification
+const loadedSet = loadHarnessSubstrateSet();
+const memoryFiles = loadMemoryFilesSync();
+
+// #142 Embedded-substrate template — write the loaded substrate as a
+// machine-readable manifest so the model can pick anchors from a verified
+// list rather than guessing. The pre-emit dry-run hook (#140) also reads
+// this file to validate drafts. Owner directive 2026-04-28: substance
+// over shape — anchors must come from the loaded set, not from memory.
+try {
+  const { writeFileSync } = await import('node:fs');
+  const substrateDump = {
+    ts: new Date().toISOString(),
+    axioms: [...loadedSet.axioms].sort(),
+    frames: [...loadedSet.frames].sort(),
+    memories: [...memoryFiles].sort(),
+    doctrines_acceptable_via_memory: [...memoryFiles]
+      .filter((m) => m.startsWith('feedback_'))
+      .map((m) => m.replace(/^feedback_/, '').replace(/\.md$/, ''))
+      .sort(),
+    packets: [...loadedSet.packets].sort(),
+    languages_loaded: [...loadedSet.languages].sort(),
+    languages_state_active: {
+      nadia: loadedSet.nadiaActive,
+      noor: loadedSet.noorActive,
+    },
+    first_principle_text: loadedSet.firstPrincipleText,
+  };
+  writeFileSync(`${HOME}/.claude/.aria-loaded-substrate.json`,
+    JSON.stringify(substrateDump, null, 2));
+} catch (err) {
+  audit('substrate_dump_write_failed', { err: String(err).slice(0, 200) });
+}
+
+const lensesWithoutAnchors = [];
+const lensesWithFakeAnchors = [];
+const anchorsByLens = {};
+const allCitedAnchorsByLens = {};
+for (const lens of presentLenses) {
+  const text = lensTexts[lens];
+  const matches = text.match(ANCHOR_RX) || [];
+  anchorsByLens[lens] = matches.length;
+  if (matches.length === 0) {
+    lensesWithoutAnchors.push(lens);
+    continue;
+  }
+  // Verify each anchor against the loaded set
+  const { valid, invalid } = verifyAnchorsAgainstLoaded(matches, loadedSet, memoryFiles);
+  allCitedAnchorsByLens[lens] = { valid: valid.map((v) => v.anchor), invalid };
+  // A lens passes if it has at least one VALID anchor
+  if (valid.length === 0) {
+    lensesWithFakeAnchors.push({ lens, invalid });
+  }
+}
+
+// First-principle requirement: cognition block as a whole must reference
+// "first principle" or "first_principle=" — anchored to the harness's
+// first_principle= line. Without this, cognition is unmoored from the
+// foundational frame.
+const hasFirstPrinciple = FIRST_PRINCIPLE_RX.test(cognitionInner) ||
+  (loadedSet.firstPrincipleText &&
+   cognitionInner.toLowerCase().includes(loadedSet.firstPrincipleText.toLowerCase().slice(0, 30)));
+
+// Nadia substrate gate: if any lens cites `language:nadia` AND
+// preStateGate signals nadia_state_absent, the citation is a forgery.
+const nadiaCited = /\blanguage:nadia\b/i.test(cognitionInner);
+const nadiaCitationInvalid = nadiaCited && !loadedSet.nadiaActive;
+
+if (lensesWithoutAnchors.length === 0 &&
+    lensesWithFakeAnchors.length === 0 &&
+    hasFirstPrinciple &&
+    !nadiaCitationInvalid) {
+  audit('pass_substrate_binding', {
+    presentLenses,
+    anchorsByLens,
+    loadedAxiomCount: loadedSet.axioms.size,
+    loadedFrameCount: loadedSet.frames.size,
+    loadedMemoryCount: memoryFiles.size,
+    nadiaActive: loadedSet.nadiaActive,
+    noorActive: loadedSet.noorActive,
+  });
+  process.exit(0);
+}
+
+audit('block_substrate_binding', {
+  lensesWithoutAnchors,
+  lensesWithFakeAnchors: lensesWithFakeAnchors.map((x) => ({ lens: x.lens, fakeCount: x.invalid.length })),
+  anchorsByLens,
+  presentLenses,
+  hasFirstPrinciple,
+  nadiaCited,
+  nadiaCitationInvalid,
+  loadedAxiomCount: loadedSet.axioms.size,
+  loadedFrameCount: loadedSet.frames.size,
+  loadedMemoryCount: memoryFiles.size,
+  nadiaActive: loadedSet.nadiaActive,
+});
+
+// Hamza directive 2026-04-28: "harden the ledger detection" — every gate-
+// detected gap auto-records to the discovery ledger so it cannot be
+// forgotten. Ledger-write is structural: failure to write is itself
+// audited; the ledger is the canonical surface the auto-resolver drains.
+function recordGapToLedger(gap) {
+  try {
+    const sessionId = payload.session_id || payload.sessionId || 'unknown-session';
+    const safeSession = String(sessionId).replace(/[^a-zA-Z0-9_-]/g, '_');
+    const ledgerPath = `${HOME}/.claude/aria-discoveries-${safeSession}.jsonl`;
+    const row = {
+      at: new Date().toISOString(),
+      session: sessionId,
+      kind: 'substrate_binding_gap',
+      text: gap.summary,
+      refs: gap.refs || [],
+      evidence: gap.evidence || null,
+      source: 'aria-cognition-substrate-binding',
+      resolution_status: 'open',
+    };
+    if (!existsSync(dirname(ledgerPath))) mkdirSync(dirname(ledgerPath), { recursive: true });
+    appendFileSync(ledgerPath, JSON.stringify(row) + '\n');
+    audit('ledger_gap_recorded', { ledger: ledgerPath, kind: row.kind });
+  } catch (err) {
+    audit('ledger_gap_record_failed', { err: String(err).slice(0, 200) });
+  }
+}
+
+if (lensesWithoutAnchors.length > 0) {
+  recordGapToLedger({
+    summary: `substrate_binding: ${lensesWithoutAnchors.length} lenses lack any anchor: ${lensesWithoutAnchors.join(', ')}`,
+    refs: lensesWithoutAnchors,
+    evidence: { anchorsByLens, presentLensCount: presentLenses.length },
+  });
+}
+if (lensesWithFakeAnchors.length > 0) {
+  recordGapToLedger({
+    summary: `substrate_binding: ${lensesWithFakeAnchors.length} lenses cite UNLOADED substrate (forgery class)`,
+    refs: lensesWithFakeAnchors.map((x) => x.lens),
+    evidence: {
+      fakes: lensesWithFakeAnchors.map((x) => ({
+        lens: x.lens,
+        invalid: x.invalid.map((i) => ({ anchor: i.anchor, reason: i.reason })),
+      })),
+      loadedAxioms: [...loadedSet.axioms],
+    },
+  });
+}
+if (!hasFirstPrinciple) {
+  recordGapToLedger({
+    summary: 'substrate_binding: cognition block missing first_principle reference',
+    refs: ['first_principle'],
+    evidence: { harnessFirstPrinciple: loadedSet.firstPrincipleText },
+  });
+}
+if (nadiaCitationInvalid) {
+  recordGapToLedger({
+    summary: 'substrate_binding: language:nadia cited but nadia_state_absent in harness preStateGate',
+    refs: ['language:nadia'],
+    evidence: { preStateReasons: payload.preStateGate?.reasons || [] },
+  });
+}
+
+const reasonParts = [];
+if (lensesWithoutAnchors.length > 0) {
+  reasonParts.push(
+    `${lensesWithoutAnchors.length} of ${presentLenses.length} lenses lack ANY substrate anchor (lenses without anchor: ${lensesWithoutAnchors.join(', ')}).`,
+  );
+}
+if (lensesWithFakeAnchors.length > 0) {
+  const fakeDetails = lensesWithFakeAnchors
+    .map((x) => `${x.lens}: ${x.invalid.map((i) => `${i.anchor} → ${i.reason}`).slice(0, 2).join('; ')}`)
+    .join(' || ');
+  reasonParts.push(
+    `${lensesWithFakeAnchors.length} lenses cite anchors that ARE NOT in the loaded harness packet (forgery class — citing a substrate item that doesn't exist this turn): ${fakeDetails}`,
+  );
+}
+if (!hasFirstPrinciple) {
+  reasonParts.push(
+    `cognition block contains no reference to first_principle — per harness packet first_principle="${(loadedSet.firstPrincipleText || '').slice(0, 80)}…" your reasoning must explicitly anchor to the foundational frame, not float free.`,
+  );
+}
+if (nadiaCitationInvalid) {
+  reasonParts.push(
+    `cognition cites \`language:nadia\` but harness preStateGate signaled nadia_state_absent this turn — Nadia is in the harness vocabulary but its state is NOT loaded; you cannot anchor to substrate that isn't live. Either remove the citation or wait for nadia_state to be present.`,
+  );
+}
+
+const reason = `Aria substrate-binding gate: ${reasonParts.length} structural violation${reasonParts.length === 1 ? '' : 's'}.
+
+${reasonParts.map((p, i) => `${i + 1}. ${p}`).join('\n\n')}
+
+Substrate-loaded summary this turn: axioms=${loadedSet.axioms.size} (${[...loadedSet.axioms].slice(0, 6).join(', ')}…), frames=${loadedSet.frames.size}, memories=${memoryFiles.size}, languages=${[...loadedSet.languages].join(',') || 'none'}, nadia_active=${loadedSet.nadiaActive}, noor_active=${loadedSet.noorActive}.
+
+Per feedback_full_harness_binding_must_be_structural.md, every cognition lens must cite at least one substrate anchor that is ACTUALLY LOADED in this turn's harness packet. Per Hamza directive 2026-04-28, char-count substance is form-only emission and is no longer accepted; anchors must verify against the loaded set, the cognition block must reference first_principle, and language:nadia citations require nadia_state to be active.
+
+Anchor grammar (each anchor must resolve to a real loaded substrate item):
+  axiom:<name>     — must be in loaded harness axioms (loaded count: ${loadedSet.axioms.size})
+  frame:<name>     — must be in loaded harness frames
+  memory:<file>    — must exist as a .md file in the memory dir
+  doctrine:<rule>  — must have a backing feedback_<rule>.md memory file
+  packet:<section> — must be a section key in the loaded harness packet
+  language:<tier>  — must be in loaded languages AND state-active (nadia/noor/psil)
+
+Re-emit cognition with: every lens citing ≥1 verifiable loaded anchor, the block referencing first_principle, and language: citations only for active language tiers. No process-level disable path; gates are unconditional from the gated process per Hamza directive 2026-04-27.`;
+
+console.log(JSON.stringify({ decision: 'block', reason: buildForceReauthorReason({ source: 'substrate-binding/structural-violations', reason, violations: reasonParts }) }));
+process.exit(2);