@aria_asi/cli 0.2.39 → 0.2.41

package/scripts/check-glm-env-wired.mjs

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+// ── doctrine-self-check-file: M0.SELFREVIEW.12 (2026-05-06) ──
+// File-level acks for trip-vocab in script body:
+// doctrine-self-check-file: \b(?:shadow|proxy|wrapper)\b operator-facing-script-not-shipping-shadows
+// doctrine-self-check-file: no.*manifest|no.*deployment.*yaml|missing.*k8s|kubectl.*not.*found|dep operator-diagnostic-output-naming-the-condition-not-claiming-it
+// doctrine-self-check-file: preferred over|optional|fallback layer regex-string-matches-yaml-key-name-not-doctrine-pattern
+
+/**
+ * GLM env wiring audit (M0.SELFREVIEW.12).
+ *
+ * Phase 0 audit Tier A landed M0.G.X1 — removed hardcoded GLM_API_KEY
+ * from voice-orchestrator.ts + streamV2.ts source. The fix replaced
+ * `process.env.GLM_API_KEY || '<hardcoded>'` with `process.env.GLM_API_KEY`
+ * and throws at module load if env is missing. Self-review item
+ * M0.SELFREVIEW.12: verify GLM_API_KEY is intentionally configured
+ * in the deployment substrate so the post-fix runtime still has access
+ * to a working key.
+ *
+ * This script audits:
+ *   1. All K8s YAML files under k8s/, apps/arias-soul/k8s/, k8s/patches/
+ *      for explicit `GLM_API_KEY` env entries (name + valueFrom)
+ *   2. The presence of `envFrom: secretRef: aria-secrets` (which means
+ *      ANY key in aria-secrets is available — operator must verify
+ *      GLM_API_KEY is in the secret out-of-band)
+ *   3. Reports clearly whether the runtime will have a key on next deploy
+ *
+ * Run:  node packages/aria-connector/scripts/check-glm-env-wired.mjs
+ *
+ * Exit codes:
+ *   0 = GLM_API_KEY explicitly named in at least one deployment + secretRef present
+ *   1 = neither found (deploy will fail at module load — operator must fix)
+ *   2 = secretRef present but GLM_API_KEY not explicitly named (operator
+ *       must verify the key is in the secret manually)
+ */
+
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+const REPO_ROOT = join(import.meta.dirname, '..', '..', '..');
+const SEARCH_DIRS = [
+  join(REPO_ROOT, 'k8s'),
+  join(REPO_ROOT, 'apps/arias-soul/k8s'),
+];
+
+function walk(dir, accum = []) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch (err) {
+    if (err.code === 'ENOENT') return accum;
+    throw err;
+  }
+  for (const e of entries) {
+    const full = join(dir, e);
+    let stat;
+    try {
+      stat = statSync(full);
+    } catch {
+      continue;
+    }
+    if (stat.isDirectory()) {
+      walk(full, accum);
+    } else if (stat.isFile() && (e.endsWith('.yaml') || e.endsWith('.yml'))) {
+      accum.push(full);
+    }
+  }
+  return accum;
+}
+
+const files = SEARCH_DIRS.flatMap((d) => walk(d));
+
+const explicitGlmFiles = [];
+const secretRefAriaSecretsFiles = [];
+
+for (const f of files) {
+  let content;
+  try {
+    content = readFileSync(f, 'utf8');
+  } catch {
+    continue;
+  }
+  if (/(?:^|\n)\s*-?\s*name:\s*GLM_API_KEY\b/m.test(content) || /\bGLM_API_KEY\b/.test(content)) {
+    explicitGlmFiles.push(f.replace(REPO_ROOT + '/', ''));
+  }
+  if (/secretRef:\s*\n\s*name:\s*aria-secrets/.test(content) || /name:\s*aria-secrets\s*\n\s*optional:\s*true/.test(content)) {
+    secretRefAriaSecretsFiles.push(f.replace(REPO_ROOT + '/', ''));
+  }
+}
+
+console.log('=== GLM env wiring audit (M0.SELFREVIEW.12) ===\n');
+
+console.log(`Explicit GLM_API_KEY references in YAML (${explicitGlmFiles.length}):`);
+if (explicitGlmFiles.length === 0) {
+  console.log('  (none)');
+} else {
+  for (const f of explicitGlmFiles) console.log(`  - ${f}`);
+}
+
+console.log(`\nDeployments using envFrom: aria-secrets (${secretRefAriaSecretsFiles.length}):`);
+if (secretRefAriaSecretsFiles.length === 0) {
+  console.log('  (none)');
+} else {
+  for (const f of secretRefAriaSecretsFiles.slice(0, 10)) console.log(`  - ${f}`);
+  if (secretRefAriaSecretsFiles.length > 10) console.log(`  ... and ${secretRefAriaSecretsFiles.length - 10} more`);
+}
+
+console.log('');
+
+if (explicitGlmFiles.length > 0) {
+  console.log('[check-glm-env-wired] OK — GLM_API_KEY explicitly named in deployment manifest(s).');
+  console.log('  Verify the actual value lives in the aria-secrets Kubernetes secret:');
+  console.log('    kubectl -n aria get secret aria-secrets -o jsonpath="{.data.GLM_API_KEY}" | base64 -d | head -c 8');
+  console.log('  (Do not log the full key.)');
+  process.exit(0);
+}
+
+if (secretRefAriaSecretsFiles.length > 0) {
+  console.log('[check-glm-env-wired] PARTIAL — no explicit GLM_API_KEY env entry, but envFrom: aria-secrets is present.');
+  console.log('  The runtime WILL have GLM_API_KEY only if it is present in the aria-secrets Kubernetes secret.');
+  console.log('  Operator must verify out-of-band:');
+  console.log('    kubectl -n aria get secret aria-secrets -o jsonpath="{.data.GLM_API_KEY}" | base64 -d | head -c 8');
+  console.log('  If empty, the M0.G.X1 module-load throw will block voice paths that need GLM.');
+  process.exit(2);
+}
+
+console.log('[check-glm-env-wired] FAIL — no GLM_API_KEY wiring found in any K8s manifest.');
+console.log('  After M0.G.X1 (hardcoded fallback removed), modules that reference');
+console.log('  process.env.GLM_API_KEY will throw at load. Either:');
+console.log('    (a) add a Kubernetes secret entry GLM_API_KEY in aria-secrets, OR');
+console.log('    (b) add an explicit env entry to the relevant deployment YAML.');
+process.exit(1);

package/scripts/check-hive-local-storage-contract.mjs

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const packageRoot = resolve(here, '..');
+const runtimePath = resolve(packageRoot, 'runtime-src', 'service.mjs');
+const runtimeConnectorPath = resolve(packageRoot, 'src', 'connectors', 'runtime.ts');
+const walPublisherPath = resolve(packageRoot, 'runtime-src', 'hive-wal-publisher.mjs');
+const runtime = readFileSync(runtimePath, 'utf8');
+const runtimeConnector = readFileSync(runtimeConnectorPath, 'utf8');
+const walPublisher = readFileSync(walPublisherPath, 'utf8');
+
+function assertIncludes(text, token, label) {
+  assert.ok(text.includes(token), `${label} missing token: ${token}`);
+}
+
+function assertNotIncludes(text, token, label) {
+  assert.ok(!text.toLowerCase().includes(token.toLowerCase()), `${label} must not include ${token}`);
+}
+
+for (const token of [
+  'const HIVE_STORAGE_MODE',
+  'ARIA_HIVE_STORAGE',
+  'ARIA_HIVE_POSTGRES_URL',
+  'firstUsableLocalHivePostgresUrl',
+  'hivePostgresForbiddenReason',
+  'hivePostgresAvailable',
+  'postgres_must_be_localhost',
+  'ensureHivePostgresSchema',
+  'importHiveLocalFilesToPostgres',
+  'GET /api/hive/storage',
+  'POST /api/hive/storage',
+  'HIVE_WAL_PATH',
+  'HIVE_PUBLISH_LEDGER_PATH',
+  'appendHiveWal',
+  'scheduleHiveWalPublish',
+  'queued_only',
+  'HIVE_LEARNING_LEDGER_PATH',
+  'HIVE_LEARNING_ROW_TYPES',
+  'HIVE_LEARNING_PRODUCER_TYPES',
+  'HIVE_LEARNING_TRUST_STATES',
+  'handleHiveLearningRoute',
+  'validateHiveLearningTrust',
+  'llm producer rows cannot set trust_state beyond llm_interpreted',
+  'hypothesis/candidate rows cannot enter evidence_supported or higher without a prior non-LLM evidence row',
+  'hiveLearningRowCanSelfEvidence',
+  "trustState: 'raw_observed'",
+  'promotion or retirement decisions require at least one non-LLM evidence row reference',
+  'GET /api/hive/learning/task-summary',
+]) {
+  assertIncludes(runtime, token, 'runtime Hive local storage contract');
+}
+
+assertIncludes(runtimeConnector, 'firstLocalPostgresUrl(process.env.DATABASE_URL', 'runtime env local Postgres discovery');
+assertIncludes(runtimeConnector, 'ARIA_HIVE_STORAGE=${hiveStorageMode}', 'runtime env storage mode follows local Postgres discovery');
+assertIncludes(runtimeConnector, 'ARIA_HIVE_POSTGRES_URL=${hivePostgresUrl}', 'runtime env Postgres URL follows local Postgres discovery');
+assertIncludes(runtimeConnector, 'verifyMountedRuntimeEnvPostcondition', 'runtime install postcondition');
+assertIncludes(runtimeConnector, 'Restarted aria-mounted-runtime.service to reload runtime.env', 'runtime install postcondition');
+assertIncludes(runtimeConnector, 'Mounted runtime env postcondition failed after restart.', 'runtime install postcondition failure detail');
+assertIncludes(runtime, "DEFAULT_QDRANT_URL = process.env.ARIA_QDRANT_URL || 'http://127.0.0.1:6333'", 'Qdrant remains local semantic memory');
+assertIncludes(runtime, 'function actionRequiresTargetFiles', 'runtime mutation action target-file contract');
+assertIncludes(runtime, 'target-files-or-verify-block', 'runtime rejects targetless mutation-class actions');
+assertIncludes(runtime, 'value.path || value.filePath || value.file_path', 'runtime accepts structured touched-file objects');
+assertIncludes(runtime, "return json(res, 202, {\n    ok: true,\n    queued: true,", 'runtime Hive writes ACK from WAL queue');
+assertIncludes(runtime, "trust_policy: {\n      llm_can_certify: false,", 'Hive learning route exposes anti-fake trust policy');
+assertIncludes(walPublisher, 'hive-wal-publisher-sidecar', 'Hive WAL sidecar publisher identity');
+assertIncludes(walPublisher, 'ARIA_HIVE_WAL_PUBLISH_LIMIT', 'Hive WAL sidecar has bounded publish limit');
+assertIncludes(walPublisher, 'ON CONFLICT (message_id) DO UPDATE', 'Hive WAL sidecar idempotent message publish');
+assertIncludes(walPublisher, 'ON CONFLICT (touch_id) DO UPDATE', 'Hive WAL sidecar idempotent file-touch publish');
+
+console.log(JSON.stringify({
+  ok: true,
+  runtimePath,
+  runtimeConnectorPath,
+  assertions: {
+    fileDefault: true,
+    localPostgresOnly: true,
+    nonLocalPostgresRejected: true,
+    qdrantStillLocalMemory: true,
+    targetlessMutationRejected: true,
+    structuredTouchedFilesAccepted: true,
+    walFirstHiveWrites: true,
+    sidecarPublisher: true,
+    learningKernelRoutes: true,
+    antiFakeLearningPromotion: true,
+  },
+}, null, 2));

package/scripts/check-hook-mirror.mjs

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+// AI-11803-MIRROR-DRIFT-CHECK (2026-05-12) — verifies byte-identical parity
+// between ops/claude-hooks/ (canonical source) and
+// packages/aria-connector/hooks/ (mirror shipped in the npm package).
+//
+// Why this exists: cognitive-block-parser.mjs:23-24 declares the two trees
+// "MUST be byte-identical" but no automated check enforced it. Future edits
+// to ops without aria-connector sync would silently diverge — the connector
+// would ship a stale hook, customers would hit bugs the owner already fixed,
+// and the divergence would only surface during incident triage.
+//
+// Run manually: node packages/aria-connector/scripts/check-hook-mirror.mjs
+// CI integration: add to the connector build pipeline before `npm publish`.
+// Exit code 0 = parity. Exit 1 = drift detected (with file list).
+
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createHash } from 'node:crypto';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(here, '..', '..', '..');
+const opsHooks = resolve(repoRoot, 'ops', 'claude-hooks');
+const connectorHooks = resolve(repoRoot, 'packages', 'aria-connector', 'hooks');
+
+// AI-11803-R1 (2026-05-12) — explicit allowlist of files that legitimately
+// live one-side-only (not regex per predictor recommendation). Pattern-based
+// exclusions risk silently hiding real drift if a future file matches the
+// pattern unexpectedly; the explicit list is fail-safe by design — add to
+// the list with a doc-comment naming WHY the file is one-side-only.
+const ONE_SIDE_ONLY_BASENAMES = new Set([
+  // canonical-settings-block.json — connector-only by design per the file's
+  // own `_meta.purpose` field: "ops/claude-hooks/install.sh reads this file
+  // directly; lives only in packages/aria-connector/hooks/".
+  'canonical-settings-block.json',
+  // aria-pre-tool-use.mjs — Codex-surface pre-tool gate (uses
+  // lib/runtime-client.mjs, wired via packages/aria-connector/src/connectors/
+  // codex.ts). Claude Code uses aria-pre-tool-gate.mjs instead — different
+  // implementation for a different surface. Correctly connector-only.
+  'aria-pre-tool-use.mjs',
+  // Backup files from connector install operations (when connector replaced
+  // an existing ops file, the prior version was preserved with a timestamp
+  // suffix). These are forensic artifacts, never mirrored.
+  // Pattern handled in walk() not here (extension-based).
+]);
+
+// Test files live one-side-only by convention — ops/claude-hooks has its
+// own __tests__/ subdirectory; connector tests are named `test-*.mjs` at
+// the connector/hooks/ top level. Skip both shapes in mirror enforcement.
+const TEST_FILE_RX = /^test-.*\.mjs$|^.*\.test\.mjs$/;
+const BACKUP_FILE_RX = /\.pre-aria-connect\.\d+$|\.before-[a-z-]+$/;
+
+function isOneSideOnly(basename) {
+  if (ONE_SIDE_ONLY_BASENAMES.has(basename)) return true;
+  if (TEST_FILE_RX.test(basename)) return true;
+  if (BACKUP_FILE_RX.test(basename)) return true;
+  return false;
+}
+
+function walk(dir, base = dir) {
+  const out = [];
+  if (!existsSync(dir)) return out;
+  for (const entry of readdirSync(dir)) {
+    const full = join(dir, entry);
+    const stat = statSync(full);
+    if (stat.isDirectory()) {
+      // Skip __tests__ — tests don't ship in the connector package; they
+      // live in ops only and are not required to mirror.
+      if (entry === '__tests__') continue;
+      out.push(...walk(full, base));
+    } else if (stat.isFile() && (entry.endsWith('.mjs') || entry.endsWith('.json'))) {
+      if (isOneSideOnly(entry)) continue;
+      out.push(relative(base, full));
+    }
+  }
+  return out;
+}
+
+function hashFile(pathname) {
+  return createHash('sha256').update(readFileSync(pathname)).digest('hex');
+}
+
+function main() {
+  if (!existsSync(opsHooks)) {
+    console.error(`[check-hook-mirror] FATAL: ops source missing at ${opsHooks}`);
+    process.exit(2);
+  }
+  if (!existsSync(connectorHooks)) {
+    console.error(`[check-hook-mirror] FATAL: connector mirror missing at ${connectorHooks}`);
+    process.exit(2);
+  }
+
+  const opsFiles = walk(opsHooks).sort();
+  const connectorFiles = walk(connectorHooks).sort();
+
+  const opsSet = new Set(opsFiles);
+  const connectorSet = new Set(connectorFiles);
+
+  const missingInConnector = opsFiles.filter((f) => !connectorSet.has(f));
+  const missingInOps = connectorFiles.filter((f) => !opsSet.has(f));
+  const common = opsFiles.filter((f) => connectorSet.has(f));
+
+  const driftedFiles = [];
+  for (const f of common) {
+    const opsHash = hashFile(join(opsHooks, f));
+    const connectorHash = hashFile(join(connectorHooks, f));
+    if (opsHash !== connectorHash) {
+      driftedFiles.push({ file: f, opsHash: opsHash.slice(0, 12), connectorHash: connectorHash.slice(0, 12) });
+    }
+  }
+
+  const totalProblems = missingInConnector.length + missingInOps.length + driftedFiles.length;
+
+  if (totalProblems === 0) {
+    console.log(`[check-hook-mirror] OK — ${common.length} files byte-identical across ops/claude-hooks <-> packages/aria-connector/hooks`);
+    process.exit(0);
+  }
+
+  console.error('[check-hook-mirror] DRIFT DETECTED — ops/claude-hooks and packages/aria-connector/hooks disagree.');
+  console.error('');
+  if (missingInConnector.length > 0) {
+    console.error(`Files in ops/claude-hooks but NOT in packages/aria-connector/hooks (${missingInConnector.length}):`);
+    for (const f of missingInConnector) console.error(`  - ${f}`);
+    console.error('');
+  }
+  if (missingInOps.length > 0) {
+    console.error(`Files in packages/aria-connector/hooks but NOT in ops/claude-hooks (${missingInOps.length}):`);
+    for (const f of missingInOps) console.error(`  - ${f}`);
+    console.error('');
+  }
+  if (driftedFiles.length > 0) {
+    console.error(`Files present in BOTH trees but with different content (${driftedFiles.length}):`);
+    for (const { file, opsHash, connectorHash } of driftedFiles) {
+      console.error(`  - ${file}  ops:${opsHash}  connector:${connectorHash}`);
+    }
+    console.error('');
+  }
+  console.error('Repair: from repo root, run:');
+  console.error('  cp -r ops/claude-hooks/* packages/aria-connector/hooks/');
+  console.error('OR diff each pair and reconcile by hand if both trees diverged for legitimate reasons.');
+  console.error('');
+  console.error('The two trees ship the SAME hooks to two consumers:');
+  console.error('  - ops/claude-hooks/        -> installed into developer ~/.claude/hooks via the install script');
+  console.error('  - packages/aria-connector/ -> shipped via npm to client repos');
+  console.error('Silent divergence means the connector npm package ships stale hooks that lack');
+  console.error('the most recent fixes; clients hit bugs the owner already shipped a fix for.');
+  process.exit(1);
+}
+
+main();

package/scripts/check-install-sh-drift.mjs

@@ -0,0 +1,152 @@
+#!/usr/bin/env node
+/**
+ * install.sh ↔ connector HOOKS_BLOCK drift detector (M1.3 — Bug C fix).
+ *
+ * Doctrine bind:
+ *   - feedback_workaround_vs_path_fix.md — never fork logic to satisfy a
+ *     packaging boundary. install.sh and claude-code.ts must wire the same
+ *     hooks; drift means clients get a different stack than dev does.
+ *   - aria-repo-doctrine — verify path of truth, not pretend.
+ *
+ * Strategy:
+ *   1. canonical-settings-block.json is the SOURCE OF TRUTH.
+ *   2. install.sh now reads canonical JSON directly (M1.3 install.sh edit) so
+ *      it stays in sync by construction. Verified by parsing install.sh.
+ *   3. claude-code.ts HOOKS_BLOCK is INLINE (not yet refactored to import the
+ *      JSON because tsconfig include scope and build dist layout would shift).
+ *      This script structurally compares the inline block against canonical
+ *      JSON: same event keys, same set of hook commands, same matchers.
+ *
+ * Run via: npm run check:hooks (added to packages/aria-connector/package.json
+ *   scripts)
+ */
+
+import assert from 'node:assert/strict';
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+const repoRoot = join(import.meta.dirname, '..', '..', '..');
+const canonicalPath = join(repoRoot, 'packages/aria-connector/hooks/canonical-settings-block.json');
+const claudeCodeTsPath = join(repoRoot, 'packages/aria-connector/src/connectors/claude-code.ts');
+const installShPath = join(repoRoot, 'ops/claude-hooks/install.sh');
+
+assert.ok(existsSync(canonicalPath), `canonical settings JSON missing at ${canonicalPath}`);
+assert.ok(existsSync(claudeCodeTsPath), `claude-code.ts missing at ${claudeCodeTsPath}`);
+assert.ok(existsSync(installShPath), `install.sh missing at ${installShPath}`);
+
+const canonical = JSON.parse(readFileSync(canonicalPath, 'utf8'));
+const claudeCodeTs = readFileSync(claudeCodeTsPath, 'utf8');
+const installSh = readFileSync(installShPath, 'utf8');
+
+// ── 1. install.sh must read the canonical JSON ────────────────────────────
+assert.match(
+  installSh,
+  /CANONICAL_BLOCK="[^"]*canonical-settings-block\.json"/,
+  'install.sh must reference canonical-settings-block.json (M1.3 fix)',
+);
+assert.match(
+  installSh,
+  /python3[\s\S]*?canonical_path[\s\S]*?json\.load\(f\)/,
+  'install.sh python heredoc must load canonical JSON',
+);
+console.log('  ✓ install.sh reads from canonical JSON');
+
+// ── 2. claude-code.ts HOOKS_BLOCK structural extraction ───────────────────
+// Extract all hook command strings from the TS file (each `command: '...'` line)
+const COMMAND_RX = /command:\s*'([^']+)'/g;
+const claudeCodeCommands = new Set();
+for (const m of claudeCodeTs.matchAll(COMMAND_RX)) {
+  claudeCodeCommands.add(m[1]);
+}
+
+// Extract from canonical JSON
+function collectCommands(node, out = new Set()) {
+  if (Array.isArray(node)) {
+    for (const item of node) collectCommands(item, out);
+    return out;
+  }
+  if (node && typeof node === 'object') {
+    if (typeof node.command === 'string') out.add(node.command);
+    for (const v of Object.values(node)) collectCommands(v, out);
+  }
+  return out;
+}
+const canonicalCommands = collectCommands(canonical);
+
+// Compare: both must contain the same set of commands.
+const missingFromTs = [...canonicalCommands].filter((c) => !claudeCodeCommands.has(c));
+const extraInTs = [...claudeCodeCommands].filter((c) => !canonicalCommands.has(c));
+
+if (missingFromTs.length > 0 || extraInTs.length > 0) {
+  console.error('\n  ✗ DRIFT DETECTED between canonical-settings-block.json and claude-code.ts HOOKS_BLOCK\n');
+  if (missingFromTs.length > 0) {
+    console.error(`  Commands in canonical JSON but NOT in claude-code.ts (${missingFromTs.length}):`);
+    for (const c of missingFromTs) console.error(`    - ${c}`);
+  }
+  if (extraInTs.length > 0) {
+    console.error(`  Commands in claude-code.ts but NOT in canonical JSON (${extraInTs.length}):`);
+    for (const c of extraInTs) console.error(`    + ${c}`);
+  }
+  console.error('\n  Resolution: edit packages/aria-connector/hooks/canonical-settings-block.json AND/OR');
+  console.error('  packages/aria-connector/src/connectors/claude-code.ts so the command sets match.');
+  console.error('  The canonical JSON is the source of truth — claude-code.ts must mirror it.\n');
+  process.exit(1);
+}
+console.log(`  ✓ ${canonicalCommands.size} commands match between canonical JSON and claude-code.ts`);
+
+// ── 3. Event keys must match ──────────────────────────────────────────────
+const canonicalEvents = Object.keys(canonical).filter((k) => !k.startsWith('_')).sort();
+// Extract event keys from claude-code.ts HOOKS_BLOCK
+const HOOKS_BLOCK_RX = /const HOOKS_BLOCK\s*=\s*\{([\s\S]*?)\};/;
+const blockMatch = claudeCodeTs.match(HOOKS_BLOCK_RX);
+assert.ok(blockMatch, 'claude-code.ts must contain `const HOOKS_BLOCK = {...};`');
+const blockBody = blockMatch[1];
+const EVENT_KEY_RX = /^\s*(SessionStart|UserPromptSubmit|PreToolUse|PostToolUse|Stop|SubagentStop|PreCompact|Notification):\s*\[/gm;
+const tsEvents = new Set();
+for (const m of blockBody.matchAll(EVENT_KEY_RX)) {
+  tsEvents.add(m[1]);
+}
+const tsEventsSorted = [...tsEvents].sort();
+
+assert.deepEqual(
+  tsEventsSorted,
+  canonicalEvents,
+  `Event keys differ — canonical: [${canonicalEvents}], claude-code.ts: [${tsEventsSorted}]`,
+);
+console.log(`  ✓ ${canonicalEvents.length} event keys match: ${canonicalEvents.join(', ')}`);
+
+// ── 4. Matchers must match for events that have them ─────────────────────
+function collectMatchers(eventBlock) {
+  const matchers = new Set();
+  if (Array.isArray(eventBlock)) {
+    for (const entry of eventBlock) {
+      if (entry && typeof entry.matcher === 'string') matchers.add(entry.matcher);
+    }
+  }
+  return matchers;
+}
+for (const event of canonicalEvents) {
+  const canonicalMatchers = collectMatchers(canonical[event]);
+  if (canonicalMatchers.size === 0) continue;
+  // Extract from TS for this event
+  const eventBlockRx = new RegExp(`${event}:\\s*\\[([\\s\\S]*?)\\],\\s*(?:[A-Z][a-zA-Z]+:|\\}\\s*;)`, 'm');
+  const eventMatch = blockBody.match(eventBlockRx);
+  if (!eventMatch) {
+    console.error(`  ✗ event ${event} block not found in claude-code.ts`);
+    process.exit(1);
+  }
+  const tsMatchers = new Set();
+  const matcherRx = /matcher:\s*'([^']+)'/g;
+  for (const m of eventMatch[1].matchAll(matcherRx)) {
+    tsMatchers.add(m[1]);
+  }
+  const missing = [...canonicalMatchers].filter((x) => !tsMatchers.has(x));
+  const extra = [...tsMatchers].filter((x) => !canonicalMatchers.has(x));
+  if (missing.length > 0 || extra.length > 0) {
+    console.error(`  ✗ ${event} matcher drift — missing in TS: [${missing}], extra in TS: [${extra}]`);
+    process.exit(1);
+  }
+}
+console.log('  ✓ all matchers consistent across canonical JSON and claude-code.ts');
+
+console.log('\nOK check-install-sh-drift (M1.3 drift checks pass)');

package/scripts/check-kernel-sync.mjs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+// check-kernel-sync — drift gate between atlas-side canonical kernel and vendored copy.
+//
+// Compares body-only sha256 of:
+//   atlas:       ~/.aria/atlas/src/kernel/deterministic-cognitive-kernel.mjs
+//   vendor:      packages/aria-connector/runtime-src/lib/kernel/deterministic-cognitive-kernel.mjs
+//   hookMirror:  packages/aria-connector/hooks/lib/kernel/deterministic-cognitive-kernel.mjs
+//   mizan:       apps/aria-telemetry/src/kernel/deterministic-cognitive-kernel.mjs
+// Vendor + hook-mirror files carry a provenance header (consecutive `//` lines
+// + blank separator). Body-only = strip that prelude before hashing.
+// Exits 0 if all match, 1 if any drifts.
+
+import { readFileSync, existsSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const VENDOR_PATH = resolve(HERE, '..', 'runtime-src', 'lib', 'kernel', 'deterministic-cognitive-kernel.mjs');
+const HOOK_MIRROR_PATH = resolve(HERE, '..', 'hooks', 'lib', 'kernel', 'deterministic-cognitive-kernel.mjs');
+const MIZAN_MIRROR_PATH = resolve(HERE, '..', '..', '..', 'apps', 'aria-telemetry', 'src', 'kernel', 'deterministic-cognitive-kernel.mjs');
+const ATLAS_PATH = join(homedir(), '.aria', 'atlas', 'src', 'kernel', 'deterministic-cognitive-kernel.mjs');
+
+function sha256(s) { return createHash('sha256').update(s).digest('hex'); }
+function stripProvenanceHeader(text) {
+  // Vendor prelude is: a run of consecutive lines starting with `//` (the
+  // provenance comment block), optionally followed by blank lines, then the
+  // canonical kernel body. Scan from the top; the first line that is neither
+  // `//`-prefixed nor blank is the body start.
+  const lines = text.split('\n');
+  let bodyStart = 0;
+  let sawComment = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.startsWith('//')) {
+      sawComment = true;
+      continue;
+    }
+    if (sawComment && line.trim() === '') {
+      continue; // blank separator between prelude and body
+    }
+    bodyStart = i;
+    break;
+  }
+  // If we never saw a `//` prelude, treat the whole file as body (no header).
+  if (!sawComment) bodyStart = 0;
+  return lines.slice(bodyStart).join('\n');
+}
+
+if (!existsSync(VENDOR_PATH)) {
+  console.error(`FAIL: vendor missing at ${VENDOR_PATH}`);
+  process.exit(1);
+}
+if (!existsSync(HOOK_MIRROR_PATH)) {
+  console.error(`FAIL: hook-mirror kernel missing at ${HOOK_MIRROR_PATH}`);
+  process.exit(1);
+}
+if (!existsSync(MIZAN_MIRROR_PATH)) {
+  console.error(`FAIL: mizan-mirror kernel missing at ${MIZAN_MIRROR_PATH}`);
+  process.exit(1);
+}
+if (!existsSync(ATLAS_PATH)) {
+  console.error(`SKIP: atlas-side canonical source not present at ${ATLAS_PATH} (atlas may not be installed on this host)`);
+  console.error('vendor + hook-mirror present; cannot verify drift without canonical source');
+  process.exit(0);
+}
+
+const vendorBody = stripProvenanceHeader(readFileSync(VENDOR_PATH, 'utf8'));
+const hookMirrorBody = stripProvenanceHeader(readFileSync(HOOK_MIRROR_PATH, 'utf8'));
+const mizanMirrorBody = stripProvenanceHeader(readFileSync(MIZAN_MIRROR_PATH, 'utf8'));
+const atlasText = readFileSync(ATLAS_PATH, 'utf8');
+const vendorSha = sha256(vendorBody);
+const hookMirrorSha = sha256(hookMirrorBody);
+const mizanMirrorSha = sha256(mizanMirrorBody);
+const atlasSha = sha256(atlasText);
+
+console.log(`vendor        body sha256: ${vendorSha}`);
+console.log(`hook-mirror   body sha256: ${hookMirrorSha}`);
+console.log(`mizan-mirror  body sha256: ${mizanMirrorSha}`);
+console.log(`atlas         body sha256: ${atlasSha}`);
+
+const vendorOk = vendorSha === atlasSha;
+const hookMirrorOk = hookMirrorSha === atlasSha;
+const mizanMirrorOk = mizanMirrorSha === atlasSha;
+
+if (vendorOk && hookMirrorOk && mizanMirrorOk) {
+  console.log('OK: vendor + hook-mirror + mizan-mirror match atlas-side canonical source');
+  process.exit(0);
+}
+
+console.error('');
+console.error('DRIFT DETECTED');
+if (!vendorOk) console.error(`  vendor drifts from atlas: ${VENDOR_PATH}`);
+if (!hookMirrorOk) console.error(`  hook-mirror drifts from atlas: ${HOOK_MIRROR_PATH}`);
+if (!mizanMirrorOk) console.error(`  mizan-mirror drifts from atlas: ${MIZAN_MIRROR_PATH}`);
+console.error(`  atlas canonical: ${ATLAS_PATH}`);
+console.error('');
+console.error('Recovery: re-copy atlas source body into the drifted file, preserving the `//` provenance header + blank-line separator.');
+console.error('Or: if the change is intentional and the connector should lag atlas, document the divergence in the header.');
+process.exit(1);