@aria_asi/cli 0.2.39 → 0.2.41

package/dist/runtime/gated-ledger.mjs

@@ -1,4 +1,10 @@
 #!/usr/bin/env node
+// ── doctrine-self-check-file: M0.SELFREVIEW.1+2 (2026-05-06) ──
+// Session added comments describing prior antipatterns being migrated.
+// Each comment names a trigger pattern; file-level ack covers them all.
+// doctrine-self-check-file: deterministic|one.?attempt session-added-comments-describing-prior-state-or-migration
+// doctrine-self-check-file: eventually|for now session-added-comments-describing-prior-state-or-migration
+
 /**
  * Gated Ledger — End-to-End Runtime Enforcement
  *
@@ -22,6 +28,18 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
+// M0.F.X2 step 8 (2026-05-06): connector-side runtime-rails registry mirror.
+// Byte-identical to apps/arias-soul/api/lib/runtime-rails/registry.mjs
+// (verified via diff). Mirror enforced via M0.F.X2 step 7 CI guard's
+// allowlist policy + a future check-runtime-rails-connector-mirror step.
+import {
+  INTERNAL_GATE_LABEL_PATTERN,
+  COLLAPSE_PLACEHOLDER_PATTERN,
+  COMPLETION_CLAIM_PATTERN,
+  TEMPLATE_PHRASES_PATTERN,
+  KERNEL_FALLBACK_VOICE,
+  minCharsFor,
+} from './runtime-rails/registry.mjs';
 
 const HOME = homedir();
 const STATE_DIR = join(HOME, '.aria', 'runtime', 'state');
@@ -37,18 +55,29 @@ function appendRecord(record) {
   try {
     appendFileSync(GATED_LEDGER_PATH, `${JSON.stringify(record)}\n`, { mode: 0o600 });
     return true;
-  } catch { return false; }
+  } catch (err) {
+    // M0.H.X3: connector gated-ledger write failure now surfaces.
+    process.stderr.write(`[connector:gated-ledger:append-record] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+    return false;
+  }
 }
 
 function hash(text) {
   return createHash('sha256').update(String(text)).digest('hex').slice(0, 16);
 }
 
-const GATE_LABEL_RX = /\b(?:personal_mouth_[a-z_]+\b|code_no_tests\b|code_fake_implementation\b|code_type_safety\b|ip_infrastructure\b|8lens_[a-z_]+\b|voice_cold_[a-z_]+\b|harness_output_gate_block\b|auto_fix:\s|personal_mouth_harness_[a-z_]+\b|personal_mouth_unsupported_[a-z_]+\b)/i;
-const COLLAPSE_RX = /I need to pause and reconsider\.?/i;
-const COMPLETION_CLAIM_RX = /\b(?:done|complete|completed|ready|verified|fixed|shipped|production-ready|passing|passed|all phases|all done)\b/i;
-const TEMPLATE_RX = /\b(?:Decision: use Owner Runtime kernels|Sequence: contract, Garden Service snapshot|Repair context loaded|Research context loaded|Action kernel engaged|I'm here with you\.\s*No fixing,\s*no task pressure)\b/i;
-const MINIMUM_CHARS = 50;
+// M0.F.X2 (2026-05-06): patterns sourced from registry. Local aliases for
+// readable downstream references.
+const GATE_LABEL_RX = INTERNAL_GATE_LABEL_PATTERN;
+const COLLAPSE_RX = COLLAPSE_PLACEHOLDER_PATTERN;
+const COMPLETION_CLAIM_RX = COMPLETION_CLAIM_PATTERN;
+const TEMPLATE_RX = TEMPLATE_PHRASES_PATTERN;
+// MINIMUM_CHARS preserved here as the connector code still uses the global
+// constant in checkQuality / isTemplateOutput. Per Phase 0 audit M0.F.X2,
+// this is a connector-side legacy check (kernel-aware floor lives on the
+// pod-side gated-ledger). Connector-tier client traffic is bounded by
+// the registry's MIN_CHARS_BY_KERNEL.default (20) — keep both for now.
+const MINIMUM_CHARS = minCharsFor('default');
 
 /** Detect deterministic/templated kernel output */
 function isTemplateOutput(text, kernel) {
@@ -80,14 +109,12 @@ function checkQuality(text) {
   return { passed: reasons.length === 0, reasons };
 }
 
-const SAFE_FALLBACKS = {
-  emotional_presence: "I'm here. Tell me what's with you right now.",
-  architect: "I need more context for a proper architecture answer.",
-  repair: "Let me trace the root cause. What's the specific error?",
-  action: "Action kernel requires confirmation. What would you like to execute?",
-  research: "Let me gather relevant information. What should I research?",
-  default: "Let me try again — that last response wasn't right.",
-};
+// M0.F.X2 (2026-05-06): SAFE_FALLBACKS sourced from canonical registry.
+// Same reconciled Aria-voice strings as apps-side gated-ledger; closes
+// the cross-package drift between apps/arias-soul/api/lib/gated-ledger.mjs
+// and packages/aria-connector/runtime-src/gated-ledger.mjs (which had
+// drifted to slightly different voices for the same kernels).
+const SAFE_FALLBACKS = KERNEL_FALLBACK_VOICE;
 
 /**
  * Enforce all gates on a kernel output.

package/dist/runtime/harness-daemon.mjs

@@ -132,10 +132,36 @@ function extractPacketField(packet, field) {
 function cachedPacketMatchesRequest(envelope, body = {}) {
   const packet = envelope?.packet;
   if (!packet || typeof packet !== 'object') return false;
-  for (const field of ['stage', 'actor', 'system']) {
-    const expected = stableIdentityValue(body[field] || body.packetRequest?.[field]);
+  // Identity dimensions on which a cached packet must match the request body.
+  // Each pair maps a request-body field name to the packet-field name written
+  // into externalLines (the body uses camelCase, the packet uses snake_case).
+  //
+  // Pre-2026-05-17 this list was [stage, actor, system] only; that permissive
+  // match allowed a request for one surface to receive a packet templated for
+  // a different surface during cache hits — see
+  // memory:reference_codex_adapter_is_surface_templated.md (cache-match defect).
+  // Platform + delivery_surface are added so cross-surface consumers refresh
+  // instead of serving a stale per-surface fill from a different consumer.
+  const dims = [
+    { body: 'stage', packet: 'stage' },
+    { body: 'actor', packet: 'actor' },
+    { body: 'system', packet: 'system' },
+    { body: 'platform', packet: 'platform' },
+    { body: 'deliverySurface', packet: 'delivery_surface' },
+    // codex.ts narrows surface from three aliases:
+    //   body.deliverySurface || body.surface || body.platform
+    // Map both alternates also to packet.delivery_surface so a request that
+    // only sets body.surface OR body.platform-as-surface still rejects a
+    // cached envelope templated for a different delivery_surface. The
+    // separate 'platform → platform' check above stays for legitimate
+    // platform-as-platform tracking (e.g., body.platform=kubernetes).
+    { body: 'surface', packet: 'delivery_surface' },
+    { body: 'platform', packet: 'delivery_surface' },
+  ];
+  for (const { body: bodyField, packet: packetField } of dims) {
+    const expected = stableIdentityValue(body[bodyField] || body.packetRequest?.[bodyField]);
     if (!expected) continue;
-    const actual = extractPacketField(packet, field);
+    const actual = extractPacketField(packet, packetField);
     if (actual && actual !== expected) return false;
   }
   return true;
@@ -149,7 +175,12 @@ function loadCachedPacketEnvelope() {
       const parsed = JSON.parse(readFileSync(candidate, 'utf8'));
       const envelope = sanitizePacketEnvelope(parsed);
       if (envelope) return envelope;
-    } catch {}
+    } catch (err) {
+      // Cache file unreadable or corrupt — try the next candidate, but log
+      // so a silently-bad cache file shows up in logs per
+      // feedback_non_blocking_errors_unacceptable.md.
+      console.warn('[aria-harnessd] cached packet candidate unreadable', candidate, err?.message);
+    }
   }
   return null;
 }
@@ -195,7 +226,11 @@ function persistCachedPacketEnvelope(envelope) {
   for (const candidate of LEGACY_PACKET_CACHE_CANDIDATES) {
     try {
       writeFileSync(candidate, JSON.stringify(envelope) + '\n', { mode: 0o600 });
-    } catch {}
+    } catch (err) {
+      // Legacy-path write is best-effort (canonical write at LOCAL_PACKET_CACHE_PATH
+      // already succeeded). Log so dir-not-exist / perm issues are visible.
+      console.warn('[aria-harnessd] legacy cache write failed', candidate, err?.message);
+    }
   }
 }
 
@@ -265,7 +300,13 @@ async function refreshPacket(body = {}, apiKey = '') {
   const cacheKey = requestCacheKey(body, apiKey);
   if (refreshInFlight && refreshInFlightKey === cacheKey) return refreshInFlight;
   if (refreshInFlight) {
-    await refreshInFlight.catch(() => {});
+    // Wait for prior refresh to settle; its error is captured separately
+    // into lastRefreshError by the catch at the refreshPacket level. Log
+    // here so the wait-and-discard is not a silent swallow per
+    // feedback_non_blocking_errors_unacceptable.md.
+    await refreshInFlight.catch((err) => {
+      console.error('[aria-harnessd] prior in-flight refresh settled with error (continuing)', err?.message);
+    });
   }
   if (isLoopedUpstream(UPSTREAM_HARNESS_URL)) {
     throw new Error(`upstream harness URL loops back to local daemon: ${UPSTREAM_HARNESS_URL}`);
@@ -312,7 +353,11 @@ async function refreshPacket(body = {}, apiKey = '') {
 function queuePacketRefresh(body, apiKey) {
   const age = packetAgeMs(cachedPacketEnvelope);
   if (refreshInFlight || age < PACKET_TTL_MS) return;
-  refreshPacket(body, apiKey).catch(() => {});
+  refreshPacket(body, apiKey).catch((err) => {
+    // Background refresh failure: do not propagate (we still have a cached
+    // envelope to serve), but surface LOUD so operators see drift.
+    console.error('[aria-harnessd] background packet refresh failed', err?.message);
+  });
 }
 
 async function resolvePacketEnvelope(packetRequest = {}, apiKey = '', message = '') {
@@ -323,7 +368,13 @@ async function resolvePacketEnvelope(packetRequest = {}, apiKey = '', message =
   if (!isLoopedUpstream(UPSTREAM_HARNESS_URL)) {
     try {
       return await refreshPacket(packetRequest, apiKey);
-    } catch {}
+    } catch (err) {
+      // refreshPacket already wrote err.message into lastRefreshError; emit
+      // LOUD here so the upstream-fallback branch is visible in logs (the
+      // returned local doctrine envelope is silent about WHY upstream was
+      // skipped — log fixes that gap per LOUD-error doctrine).
+      console.error('[aria-harnessd] upstream refresh failed; falling back to local doctrine envelope', err?.message);
+    }
   }
   return buildLocalDoctrineEnvelope(message, lastRefreshError ? 'local-discipline-daemon-upstream-unavailable' : 'local-discipline-daemon');
 }
@@ -493,9 +544,28 @@ const server = createServer(async (req, res) => {
     res.writeHead(proxied.status, { 'content-type': proxied.contentType });
     res.end(proxied.body);
   } catch (error) {
+    // LOUD per feedback_non_blocking_errors_unacceptable.md — surface upstream
+    // URL + error name + cause chain instead of a bare "fetch failed" envelope
+    // that downstream consumers cannot diagnose. Pathname is included so the
+    // proxy hop being routed is visible in the audit trail.
+    const errName = error instanceof Error ? error.name : 'Unknown';
+    const errMsg = error instanceof Error ? error.message : String(error);
+    const cause = error instanceof Error && error.cause ? String(error.cause) : null;
+    const safePathname = (() => {
+      try { return new URL(req.url || '/', DEFAULT_URL).pathname; }
+      catch { return req.url || 'unknown'; }
+    })();
+    const detail = {
+      upstream: UPSTREAM_HARNESS_URL,
+      pathname: safePathname,
+      err_name: errName,
+      cause,
+    };
+    console.error('[aria-harnessd] proxy error', errMsg, JSON.stringify(detail));
     json(res, 500, {
       ok: false,
-      error: error instanceof Error ? error.message : String(error),
+      error: errMsg,
+      detail,
     });
   }
 });
@@ -503,6 +573,11 @@ const server = createServer(async (req, res) => {
 server.listen(DEFAULT_PORT, DEFAULT_HOST, () => {
   console.log(`[aria-harnessd] listening on ${DEFAULT_URL}`);
   if (!cachedPacketEnvelope && !isLoopedUpstream(UPSTREAM_HARNESS_URL)) {
-    refreshPacket({}, process.env.ARIA_API_KEY || process.env.ARIA_MASTER_TOKEN || '').catch(() => {});
+    refreshPacket({}, process.env.ARIA_API_KEY || process.env.ARIA_MASTER_TOKEN || '').catch((err) => {
+      // Startup-time best-effort refresh; daemon continues with whatever
+      // cached/local-doctrine envelope it has. Log LOUD so the cold-start
+      // failure is visible per feedback_non_blocking_errors_unacceptable.md.
+      console.error('[aria-harnessd] startup packet refresh failed', err?.message);
+    });
   }
 });

package/dist/runtime/hive-wal-publisher.mjs

@@ -0,0 +1,292 @@
+#!/usr/bin/env node
+import { existsSync, mkdirSync, readFileSync, appendFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+const STATE_DIR = process.env.ARIA_RUNTIME_STATE_DIR || join(homedir(), '.aria', 'runtime', 'state');
+const WAL_PATH = process.env.ARIA_HIVE_WAL_PATH || join(STATE_DIR, 'hive-ledger-wal.jsonl');
+const PUBLISH_LEDGER_PATH = process.env.ARIA_HIVE_PUBLISH_LEDGER_PATH || join(STATE_DIR, 'hive-ledger-publish.jsonl');
+const QUERY_TIMEOUT_MS = Math.max(250, Number(process.env.ARIA_HIVE_POSTGRES_QUERY_TIMEOUT_MS || 750));
+const LIMIT = Math.max(1, Math.min(500, Number(process.env.ARIA_HIVE_WAL_PUBLISH_LIMIT || process.argv[2] || 100)));
+const POSTGRES_URL =
+  process.env.ARIA_HIVE_POSTGRES_URL ||
+  process.env.DATABASE_URL ||
+  process.env.POSTGRES_URL ||
+  'postgresql://postgres:postgres@127.0.0.1:5432/aria';
+
+function readJsonl(path) {
+  if (!existsSync(path)) return [];
+  return readFileSync(path, 'utf8')
+    .split('\n')
+    .filter(Boolean)
+    .map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        return null;
+      }
+    })
+    .filter(Boolean);
+}
+
+function appendPublish(row, status, detail = {}) {
+  mkdirSync(dirname(PUBLISH_LEDGER_PATH), { recursive: true });
+  appendFileSync(PUBLISH_LEDGER_PATH, `${JSON.stringify({
+    schema: 'aria.hive_ledger_publish.v1',
+    wal_id: row?.wal_id || null,
+    kind: row?.kind || null,
+    status,
+    at: new Date().toISOString(),
+    publisher: 'hive-wal-publisher-sidecar',
+    detail,
+  })}\n`, { mode: 0o600 });
+}
+
+function sqlLiteral(value) {
+  if (value === null || value === undefined) return 'NULL';
+  return `'${String(value).replaceAll("'", "''")}'`;
+}
+
+function sqlJson(value) {
+  return `${sqlLiteral(JSON.stringify(value ?? null))}::jsonb`;
+}
+
+function psql(sql) {
+  const result = spawnSync('psql', ['-X', '-v', 'ON_ERROR_STOP=1', POSTGRES_URL], {
+    input: sql,
+    encoding: 'utf8',
+    timeout: QUERY_TIMEOUT_MS,
+    maxBuffer: 1024 * 1024,
+  });
+  if (result.error || result.signal || result.status !== 0) {
+    const detail = String(result.stderr || result.stdout || result.error?.message || result.signal || `exit ${result.status}`).trim();
+    throw new Error(detail.slice(0, 1000) || 'psql failed');
+  }
+  return result.stdout;
+}
+
+function ensureSchema() {
+  psql(`
+CREATE TABLE IF NOT EXISTS hive_file_touches (
+  touch_id text PRIMARY KEY,
+  session_id text,
+  thread_id text,
+  message_id text,
+  event text,
+  source text,
+  files jsonb NOT NULL DEFAULT '[]'::jsonb,
+  body jsonb NOT NULL DEFAULT '{}'::jsonb,
+  client_identity jsonb,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS hive_file_touches_session_idx ON hive_file_touches(session_id);
+CREATE INDEX IF NOT EXISTS hive_file_touches_thread_idx ON hive_file_touches(thread_id);
+CREATE INDEX IF NOT EXISTS hive_file_touches_created_idx ON hive_file_touches(created_at DESC);
+CREATE INDEX IF NOT EXISTS hive_file_touches_files_gin_idx ON hive_file_touches USING gin(files);
+
+CREATE TABLE IF NOT EXISTS hive_session_messages (
+  message_id text PRIMARY KEY,
+  thread_id text,
+  from_session_id text,
+  to_session_id text,
+  topic text,
+  body jsonb NOT NULL DEFAULT '{}'::jsonb,
+  client_identity jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  read_at timestamptz,
+  read_by_session_ids jsonb NOT NULL DEFAULT '[]'::jsonb,
+  last_read_at timestamptz,
+  source text
+);
+CREATE INDEX IF NOT EXISTS hive_session_messages_thread_idx ON hive_session_messages(thread_id);
+CREATE INDEX IF NOT EXISTS hive_session_messages_to_session_idx ON hive_session_messages(to_session_id);
+CREATE INDEX IF NOT EXISTS hive_session_messages_from_session_idx ON hive_session_messages(from_session_id);
+CREATE INDEX IF NOT EXISTS hive_session_messages_topic_idx ON hive_session_messages(topic);
+CREATE INDEX IF NOT EXISTS hive_session_messages_created_idx ON hive_session_messages(created_at DESC);
+
+CREATE TABLE IF NOT EXISTS hive_session_threads (
+  thread_id text PRIMARY KEY,
+  topic text,
+  status text,
+  intent_summary text,
+  source_artifact text,
+  participants jsonb NOT NULL DEFAULT '[]'::jsonb,
+  file_claims jsonb NOT NULL DEFAULT '[]'::jsonb,
+  latest_client_identity jsonb,
+  latest_message_id text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  source text
+);
+CREATE INDEX IF NOT EXISTS hive_session_threads_topic_idx ON hive_session_threads(topic);
+CREATE INDEX IF NOT EXISTS hive_session_threads_status_idx ON hive_session_threads(status);
+CREATE INDEX IF NOT EXISTS hive_session_threads_updated_idx ON hive_session_threads(updated_at DESC);
+CREATE INDEX IF NOT EXISTS hive_session_threads_participants_gin_idx ON hive_session_threads USING gin(participants);
+`);
+}
+
+function uniqueStrings(values) {
+  return [...new Set(values.filter((value) => typeof value === 'string' && value.trim()).map((value) => value.trim()))];
+}
+
+function publishFileTouch(row) {
+  const payload = row.payload || {};
+  const touchId = `${row.wal_id}_touch`;
+  psql(`
+INSERT INTO hive_file_touches (touch_id, session_id, thread_id, message_id, event, source, files, body, client_identity, created_at)
+VALUES (
+  ${sqlLiteral(touchId)},
+  ${sqlLiteral(payload.sessionId)},
+  ${sqlLiteral(payload.threadId || null)},
+  ${sqlLiteral(payload.messageId || null)},
+  ${sqlLiteral(payload.event || 'touch')},
+  ${sqlLiteral(payload.source || 'hive-wal-publisher-sidecar')},
+  ${sqlJson(Array.isArray(payload.files) ? payload.files : [])},
+  ${sqlJson(payload.body || {})},
+  ${sqlJson(payload.identity || null)},
+  ${sqlLiteral(payload.createdAt || row.created_at || new Date().toISOString())}::timestamptz
+)
+ON CONFLICT (touch_id) DO UPDATE SET
+  session_id = EXCLUDED.session_id,
+  thread_id = EXCLUDED.thread_id,
+  message_id = EXCLUDED.message_id,
+  event = EXCLUDED.event,
+  source = EXCLUDED.source,
+  files = EXCLUDED.files,
+  body = EXCLUDED.body,
+  client_identity = EXCLUDED.client_identity,
+  created_at = EXCLUDED.created_at;
+`);
+  appendPublish(row, 'published', { touch_id: touchId });
+}
+
+function publishLifecycle(row) {
+  const payload = row.payload || {};
+  const messageId = payload.messageId || `${row.wal_id}_message`;
+  const threadId = payload.threadId || `thread-${row.wal_id}`;
+  const participants = uniqueStrings([payload.fromSessionId, payload.toSessionId]);
+  const fileClaims = Array.isArray(payload.fileClaims) ? payload.fileClaims : [];
+
+  psql(`
+INSERT INTO hive_session_messages (message_id, thread_id, from_session_id, to_session_id, topic, body, client_identity, created_at, read_at, read_by_session_ids, last_read_at, source)
+VALUES (
+  ${sqlLiteral(messageId)},
+  ${sqlLiteral(threadId)},
+  ${sqlLiteral(payload.fromSessionId || null)},
+  ${sqlLiteral(payload.toSessionId || null)},
+  ${sqlLiteral(payload.topic || 'session.lifecycle')},
+  ${sqlJson(payload.normalizedBody || {})},
+  ${sqlJson(payload.identity || null)},
+  ${sqlLiteral(payload.createdAt || row.created_at || new Date().toISOString())}::timestamptz,
+  NULL,
+  '[]'::jsonb,
+  NULL,
+  ${sqlLiteral(payload.source || 'aria-mounted-runtime')}
+)
+ON CONFLICT (message_id) DO UPDATE SET
+  thread_id = EXCLUDED.thread_id,
+  from_session_id = EXCLUDED.from_session_id,
+  to_session_id = EXCLUDED.to_session_id,
+  topic = EXCLUDED.topic,
+  body = EXCLUDED.body,
+  client_identity = EXCLUDED.client_identity,
+  created_at = EXCLUDED.created_at,
+  source = EXCLUDED.source;
+
+INSERT INTO hive_session_threads (thread_id, topic, status, intent_summary, source_artifact, participants, file_claims, latest_client_identity, latest_message_id, created_at, updated_at, source)
+VALUES (
+  ${sqlLiteral(threadId)},
+  ${sqlLiteral(payload.topic || 'session.lifecycle')},
+  ${sqlLiteral(payload.threadStatus || payload.lifecycleStatus || 'active')},
+  ${sqlLiteral(payload.intentSummary || null)},
+  ${sqlLiteral(payload.sourceArtifact || null)},
+  ${sqlJson(participants)},
+  ${sqlJson(fileClaims)},
+  ${sqlJson(payload.identity || null)},
+  ${sqlLiteral(messageId)},
+  ${sqlLiteral(payload.createdAt || row.created_at || new Date().toISOString())}::timestamptz,
+  now(),
+  ${sqlLiteral(payload.source || 'aria-mounted-runtime')}
+)
+ON CONFLICT (thread_id) DO UPDATE SET
+  topic = EXCLUDED.topic,
+  status = EXCLUDED.status,
+  intent_summary = EXCLUDED.intent_summary,
+  source_artifact = EXCLUDED.source_artifact,
+  participants = (
+    SELECT COALESCE(jsonb_agg(DISTINCT value), '[]'::jsonb)
+    FROM jsonb_array_elements_text(hive_session_threads.participants || EXCLUDED.participants) AS value
+  ),
+  file_claims = EXCLUDED.file_claims,
+  latest_client_identity = EXCLUDED.latest_client_identity,
+  latest_message_id = EXCLUDED.latest_message_id,
+  updated_at = now(),
+  source = EXCLUDED.source;
+`);
+
+  if (fileClaims.length) {
+    publishFileTouch({
+      ...row,
+      kind: 'file_touch',
+      payload: {
+        sessionId: payload.fromSessionId,
+        threadId,
+        messageId,
+        event: payload.event || 'session.lifecycle',
+        source: 'hive-session-lifecycle-sidecar',
+        files: fileClaims,
+        body: {
+          lifecycle_event: payload.event || null,
+          lifecycle_status: payload.lifecycleStatus || null,
+          intent_summary: payload.intentSummary || null,
+          source_artifact: payload.sourceArtifact || null,
+          message_id: messageId,
+        },
+        identity: payload.identity || null,
+        createdAt: payload.createdAt || row.created_at,
+      },
+    });
+  }
+
+  appendPublish(row, 'published', { message_id: messageId, thread_id: threadId, file_claim_count: fileClaims.length });
+}
+
+function main() {
+  const published = new Set(
+    readJsonl(PUBLISH_LEDGER_PATH)
+      .filter((row) => row.status === 'published')
+      .map((row) => row.wal_id)
+      .filter(Boolean),
+  );
+  const rows = readJsonl(WAL_PATH)
+    .filter((row) => row?.schema === 'aria.hive_ledger_wal.v1')
+    .filter((row) => row.wal_id && !published.has(row.wal_id))
+    .slice(0, LIMIT);
+
+  if (!rows.length) {
+    console.log(JSON.stringify({ ok: true, published: 0, skipped: 0, limit: LIMIT }));
+    return;
+  }
+
+  ensureSchema();
+  let publishedCount = 0;
+  let failedCount = 0;
+  for (const row of rows) {
+    try {
+      if (row.kind === 'file_touch') publishFileTouch(row);
+      else if (row.kind === 'session_lifecycle') publishLifecycle(row);
+      else appendPublish(row, 'skipped', { reason: 'unknown_wal_kind' });
+      publishedCount += row.kind === 'file_touch' || row.kind === 'session_lifecycle' ? 1 : 0;
+    } catch (error) {
+      failedCount += 1;
+      appendPublish(row, 'failed', {
+        error: error instanceof Error ? error.message : String(error),
+        queryTimeoutMs: QUERY_TIMEOUT_MS,
+      });
+    }
+  }
+  console.log(JSON.stringify({ ok: failedCount === 0, published: publishedCount, failed: failedCount, scanned: rows.length, limit: LIMIT }));
+}
+
+main();

package/dist/runtime/hooks/README.md

@@ -0,0 +1,58 @@
+# Claude Code hooks (canonical source of truth)
+
+This directory replaces `~/.claude/hooks/` as the canonical home for
+Claude Code hook scripts. Previously the active hooks lived only on a
+single workstation under `~/.claude/hooks/` and weren't git-tracked,
+so improvements landed by one session never reached other sessions or
+new machines.
+
+## What's here
+
+- `aria-harness-via-sdk.mjs` — SessionStart + UserPromptSubmit hook.
+  Fetches the canonical Aria harness packet from `aria-soul`'s
+  `/api/harness/codex` endpoint via the canonical
+  `@aria_asi/harness-http-client` SDK and injects it into the model's
+  context as `additionalContext`.
+
+  Doctrine-aligned design (refactored 2026-04-26):
+  - **No policy timeouts.** Per `axiom: truth_over_deception` +
+    Hamza's directive that timeouts kill long-running tasks. Real
+    network errors (ECONNREFUSED / ENOTFOUND / EHOSTUNREACH) drive
+    control flow.
+  - **TCP probe per URL** before HTTP fetch — filters dead URLs by
+    actual reachability, not by deadline.
+  - **Parallel race** across all probed-OK URLs via `Promise.any` —
+    fastest healthy responder wins; hung URLs don't block others.
+  - **Stale-cache fallback with no age cutoff** — if the cached
+    packet exists, it's always injected when fresh fetch fails. The
+    header surfaces `(stale Ns — fresh fetch failed: <reason>)` so
+    the model can read its own world-view freshness, but identity /
+    cognition / gates never get stripped to a stub.
+
+## Install
+
+```bash
+bash ops/claude-hooks/install.sh
+```
+
+Idempotent. Symlinks (not copies) into `~/.claude/hooks/` so future
+edits in the repo are picked up automatically. Pre-existing real
+files at the target path are backed up before replacement.
+
+## Wiring
+
+The active wire is in `~/.claude/settings.json`:
+
+```json
+"hooks": {
+  "SessionStart": [{ "hooks": [{
+    "command": "HOOK_EVENT_NAME=SessionStart node $HOME/.claude/hooks/aria-harness-via-sdk.mjs --mode session"
+  }] }],
+  "UserPromptSubmit": [{ "hooks": [{
+    "command": "HOOK_EVENT_NAME=UserPromptSubmit node $HOME/.claude/hooks/aria-harness-via-sdk.mjs --mode turn"
+  }] }]
+}
+```
+
+The `~/.claude/settings.json` file itself is currently per-machine.
+Ship that to the repo separately if/when desired.