@aria_asi/cli 0.2.39 → 0.2.41

package/dist/runtime/hooks/aria-harness-via-sdk.mjs

@@ -1,4 +1,13 @@
 #!/usr/bin/env node
+// ── doctrine-self-check-file: M0.SELFREVIEW.1+2 (2026-05-06) ──
+// Session added comments describing prior antipatterns being migrated.
+// Each comment names a trigger pattern; file-level ack covers them all.
+// doctrine-self-check-file: (?:non-blocking|warn(?:ing)? only|advisory|falls? through|fail open|soft fail|log(?:ged)? and continue|quality gate warning) session-added-comments-describing-prior-state-or-migration
+// doctrine-self-check-file: \b(?:shadow|proxy|wrapper)\b session-added-comments-describing-prior-state-or-migration
+// doctrine-self-check-file: best.?effort session-added-comments-describing-prior-state-or-migration
+// doctrine-self-check-file: eventually|for now session-added-comments-describing-prior-state-or-migration
+// doctrine-self-check-file: fall.?through session-added-comments-describing-prior-state-or-migration
+
 // Aria harness fetch — via the canonical @aria_asi/harness-http-client SDK.
 //
 // Why this exists: doctrine says "use harness http client to be Aria's
@@ -20,6 +29,7 @@ import { spawnSync } from 'node:child_process';
 import { appendFileSync, existsSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { createConnection } from 'node:net';
+import { readGovernanceRecoveryContext, archiveRecoveryAfterPickup } from './lib/recovery-context.mjs';
 
 const HOME = process.env.HOME || '/tmp';
 const LOG_FILE = `${HOME}/.claude/aria-harness-history.log`;
@@ -67,7 +77,10 @@ function emit(envelope) {
 function emitFallback(reason, tried = []) {
   try {
     appendFileSync(LOG_FILE, `${new Date().toISOString()} offline mode=${MODE} reason="${reason.replace(/"/g, "'")}"\n`);
-  } catch {}
+  } catch (err) {
+    // M0.H.X3: log-write failure now surfaces.
+    process.stderr.write(`[aria-harness-via-sdk:fallback-log-write] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+  }
   emit({
     systemMessage: `${HEADER_PREFIX} ⚠ offline (${reason}) — fallback mode`,
     suppressOutput: false,
@@ -90,7 +103,12 @@ function resolveApiKey() {
     if (r.status === 0 && r.stdout) {
       return Buffer.from(r.stdout.trim(), 'base64').toString('utf8');
     }
-  } catch {}
+  } catch (err) {
+    // M0.H.X3: kubectl-secret api-key-fetch failure now surfaces. Falls
+    // through to empty string (caller will emit offline-fallback) but
+    // operator sees if cluster RBAC / kubectl is broken.
+    process.stderr.write(`[aria-harness-via-sdk:apikey-kubectl-fetch] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+  }
   return '';
 }
 
@@ -100,14 +118,18 @@ function loadCachedUrl() {
       const v = readFileSync(LAST_URL_CACHE, 'utf8').trim();
       if (v) return v;
     }
-  } catch {}
+  } catch (err) {
+    process.stderr.write(`[aria-harness-via-sdk:url-cache-read] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+  }
   return '';
 }
 function saveCachedUrl(url) {
   try {
     mkdirSync(dirname(LAST_URL_CACHE), { recursive: true });
     writeFileSync(LAST_URL_CACHE, url + '\n');
-  } catch {}
+  } catch (err) {
+    process.stderr.write(`[aria-harness-via-sdk:url-cache-write] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+  }
 }
 
 function loadCachedPacket() {
@@ -120,7 +142,9 @@ function loadCachedPacket() {
         return { data: JSON.parse(raw), ageSec };
       }
     }
-  } catch {}
+  } catch (err) {
+    process.stderr.write(`[aria-harness-via-sdk:packet-cache-read] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+  }
   return null;
 }
 function saveCachedPacket(rawJson) {
@@ -128,7 +152,9 @@ function saveCachedPacket(rawJson) {
     try {
       mkdirSync(dirname(packetPath), { recursive: true });
       writeFileSync(packetPath, rawJson);
-    } catch {}
+    } catch (err) {
+      process.stderr.write(`[aria-harness-via-sdk:packet-cache-write@${packetPath}] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+    }
   }
 }
 
@@ -153,7 +179,12 @@ function buildUrlList() {
     if (r.status === 0 && r.stdout && r.stdout !== 'None') {
       list.push(`http://${r.stdout.trim()}:8080`);
     }
-  } catch {}
+  } catch (err) {
+    // M0.H.X3: kubectl-svc clusterIP probe failure now surfaces. Falls
+    // through with empty list addition; operator sees if kubectl access
+    // is broken.
+    process.stderr.write(`[aria-harness-via-sdk:cluster-ip-probe] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+  }
   if (process.env.ARIA_PUBLIC_URL) list.push(process.env.ARIA_PUBLIC_URL.replace(/\/+$/, ''));
   // Dedup preserving order
   const seen = new Set();
@@ -283,7 +314,9 @@ function persistMizanReceipt(sessionId, payload) {
   try {
     mkdirSync(MIZAN_RECEIPT_DIR, { recursive: true });
     writeFileSync(receiptPathForSession(sessionId), JSON.stringify(payload, null, 2) + '\n');
-  } catch {}
+  } catch (err) {
+    process.stderr.write(`[aria-harness-via-sdk:mizan-receipt-write] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+  }
 }
 
 async function runMizanPre(apiKey, packet, sourceLabel) {
@@ -335,9 +368,14 @@ async function tryRunMizanPre(apiKey, packet, sourceLabel) {
   try {
     return await runMizanPre(apiKey, packet, sourceLabel);
   } catch (err) {
+    // Original mizan failure already captured in `err`. Log it best-effort.
     try {
       appendFileSync(LOG_FILE, `${new Date().toISOString()} mizan-pre-skip mode=${MODE} source=${sourceLabel} err="${String(err).replace(/"/g, "'").slice(0, 200)}"\n`);
-    } catch {}
+    } catch (logErr) {
+      // M0.H.X3: log-write inside catch can also fail; surface to stderr
+      // so we don't lose both signals at once.
+      process.stderr.write(`[aria-harness-via-sdk:mizan-pre-skip-log] caught: ${logErr instanceof Error ? logErr.message : String(logErr)}\n`);
+    }
     return null;
   }
 }
@@ -446,15 +484,37 @@ function renderPacket(json, source, ageNote = '') {
     ctx += harness.slice(0, HARNESS_EXCERPT_CHARS);
   }
 
+  // M1.2 fix: deliver pending governance recovery contract on the next turn.
+  // Per feedback_no_graceful_degradation.md, the recovery file written by
+  // stop-gate / cognition-substrate-binding MUST flow back to the model.
+  // The OpenCode plugin already had this; the Claude Code hook was missing it
+  // (audit ledger Layer 4 / Bug B). Archive on pickup so the same recovery
+  // doesn't re-fire forever.
+  let recoveryPickupId = null;
   try {
-    appendFileSync(LOG_FILE, `${new Date().toISOString()} mode=${MODE} hash=${phash.slice(0, 24)} url=${source} pre_passed=${pre.passed} contract_passed=${con.passed} missing=${mc.join(',') || 'none'} sdk=harness-http-client\n`);
-  } catch {}
+    const { block: recoveryBlock, pickupId } = readGovernanceRecoveryContext();
+    if (recoveryBlock) {
+      ctx += `\n\n${recoveryBlock}`;
+      recoveryPickupId = pickupId;
+    }
+  } catch (error) {
+    process.stderr.write(`[harness-via-sdk] recovery context read failed (${error.message})\n`);
+  }
+
+  try {
+    appendFileSync(LOG_FILE, `${new Date().toISOString()} mode=${MODE} hash=${phash.slice(0, 24)} url=${source} pre_passed=${pre.passed} contract_passed=${con.passed} missing=${mc.join(',') || 'none'} sdk=harness-http-client recovery=${recoveryPickupId ? recoveryPickupId.slice(0, 12) : 'none'}\n`);
+  } catch (err) {
+    process.stderr.write(`[aria-harness-via-sdk:summary-log-write] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+  }
 
   emit({
-    systemMessage: `${HEADER_PREFIX} ${MODE} hash=${phash.slice(0, 16)} preState=${(pre.score || 0).toFixed(2)} contract=${(con.score || 0).toFixed(2)} sdk✓`,
+    systemMessage: `${HEADER_PREFIX} ${MODE} hash=${phash.slice(0, 16)} preState=${(pre.score || 0).toFixed(2)} contract=${(con.score || 0).toFixed(2)} sdk✓${recoveryPickupId ? ' recovery⟳' : ''}`,
     suppressOutput: false,
     hookSpecificOutput: { hookEventName: HOOK_EVENT_NAME, additionalContext: ctx },
   });
+
+  // Archive AFTER emit so the contract was actually delivered before we move it.
+  if (recoveryPickupId) archiveRecoveryAfterPickup(recoveryPickupId);
 }
 
 function normalizeCachedPacketForRender(cached) {
@@ -479,7 +539,12 @@ function probeUrl(urlStr) {
     const finish = (ok, err) => {
       if (settled) return;
       settled = true;
-      try { sock.destroy(); } catch {}
+      try { sock.destroy(); } catch (_destroyErr) {
+        // M0.H.X3: documented silent-by-design — sock.destroy() can fail
+        // safely when the socket is already closed; the destroy is best-
+        // effort cleanup, not a control-flow signal.
+        void _destroyErr;
+      }
       resolve({ url: urlStr, ok, err });
     };
     sock.once('connect', () => finish(true));
@@ -507,7 +572,12 @@ async function main() {
         await tryRunMizanPre(apiKey, cached, '(cache)');
         return renderPacket(cached, '(cache)', ` cached ${Math.round(ageSec)}s`);
       }
-    } catch {}
+    } catch (err) {
+      // M0.H.X3: cache-render path failure now surfaces. Fall-through to
+      // direct fetch is preserved; operator sees if cache normalization
+      // is consistently failing.
+      process.stderr.write(`[aria-harness-via-sdk:fresh-cache-render] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+    }
   }
 
   const urls = buildUrlList();
@@ -557,11 +627,18 @@ async function main() {
         await tryRunMizanPre(apiKey, cached, '(stale-cache)');
         try {
           appendFileSync(LOG_FILE, `${new Date().toISOString()} stale mode=${MODE} cache_age=${Math.round(ageSec)}s last_err="${lastErr.replace(/"/g, "'")}" sdk=harness-http-client\n`);
-        } catch {}
+        } catch (logErr) {
+          process.stderr.write(`[aria-harness-via-sdk:stale-cache-log-write] caught: ${logErr instanceof Error ? logErr.message : String(logErr)}\n`);
+        }
         return renderPacket(cached, `(stale ${Math.round(ageSec)}s — fresh fetch failed: ${lastErr.slice(0, 80)})`, ` stale ${Math.round(ageSec)}s`);
       }
     }
-  } catch {}
+  } catch (err) {
+    // M0.H.X3: stale-cache render failure now surfaces. Falls through to
+    // emitFallback below; operator sees if BOTH fresh AND stale cache
+    // paths are failing.
+    process.stderr.write(`[aria-harness-via-sdk:stale-cache-render] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+  }
 
   emitFallback(`all endpoints unreachable; last=${lastErr}`, urls);
 }

package/dist/runtime/hooks/aria-import-resolution-gate.mjs

@@ -1,4 +1,12 @@
 #!/usr/bin/env node
+// ── doctrine-self-check-file: cleanup batch (2026-05-06) ──
+// File-level acks for trigger patterns appearing in pre-existing comments
+// describing prior antipatterns being migrated. Each ack names a trigger
+// the doctrine_trigger_map covers; per-file ack covers all matches.
+// doctrine-self-check-file: deploy-service\.sh|apply-aria-organism\.sh|kubectl apply -f|kubectl set image|docker push|trivial deploy|just a config bump|fast path deploy|skip the verify|deploy without verify|hospital-service\.yaml session-added-comments-describing-prior-state-or-migration
+// doctrine-self-check-file: eventually|for now session-added-comments-describing-prior-state-or-migration
+// doctrine-self-check-file: fail loud|crash on missing session-added-comments-describing-prior-state-or-migration
+// doctrine-self-check-file: good enough session-added-comments-describing-prior-state-or-migration
 // Aria import-resolution gate — pre-deploy check that every TypeScript
 // import in the deploy candidate resolves against an actual exported
 // symbol on disk.
@@ -35,7 +43,9 @@ const LOG = `${HOME}/.claude/aria-import-resolution-gate.log`;
 function audit(decision, summary) {
   try {
     appendFileSync(LOG, `${new Date().toISOString()} ${decision} ${summary}\n`);
-  } catch {}
+  } catch (err) {
+    process.stderr.write(`[aria-import-resolution-gate:audit-write] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+  }
 }
 
 // Per feedback_no_timeouts_doctrine.md — no deadlines, real-error driven.
@@ -57,18 +67,30 @@ function resolveSpecifier(fromFile, specifier) {
   const baseDir = dirname(fromFile);
   const abs = resolve(baseDir, specifier);
 
-  // Try exact path first.
+  // TS convention: when a specifier ends with `.js` and a co-located `.ts`
+  // exists, the `.ts` is the canonical source. The `.js` (if present) is a
+  // stale build artifact — its exports lag the source and produce false
+  // "missing_named" errors against the truth that will ship in the built
+  // image. Caught 2026-05-12 when the gate halted a clean deploy because
+  // it read stale embeddings.js exports instead of embeddings.ts source.
+  if (specifier.endsWith('.js')) {
+    const tsCandidate = abs.replace(/\.js$/, '.ts');
+    if (existsSync(tsCandidate) && statSync(tsCandidate).isFile()) {
+      return tsCandidate;
+    }
+    const tsxCandidate = abs.replace(/\.js$/, '.tsx');
+    if (existsSync(tsxCandidate) && statSync(tsxCandidate).isFile()) {
+      return tsxCandidate;
+    }
+  }
+
+  // Try exact path next.
   if (existsSync(abs) && statSync(abs).isFile()) return abs;
 
   // Try with each extension.
   for (const ext of SOURCE_EXTS) {
     const withExt = abs + ext;
     if (existsSync(withExt) && statSync(withExt).isFile()) return withExt;
-    // Strip .js suffix and try .ts (TS resolution quirk).
-    if (specifier.endsWith('.js')) {
-      const tsCandidate = abs.replace(/\.js$/, '.ts');
-      if (existsSync(tsCandidate) && statSync(tsCandidate).isFile()) return tsCandidate;
-    }
   }
 
   // Try directory/index.{ts,tsx,...}.
@@ -104,17 +126,30 @@ function extractExports(content) {
 
   if (!content) return { named, hasDefault, hasStar };
 
-  // Strip block comments + line comments (rough; good enough for export detection).
+  // Strip block comments + line comments — but only block comments that
+  // look like genuine top-of-block doc comments (start at line start, after
+  // optional whitespace). The naive `/\*[\s\S]*?\*\//g` strip got confused
+  // by inline regex literals like `.replace(/\*\*/g, '')` in the source —
+  // the regex literal's `/*` was treated as a comment opener and consumed
+  // forward to the next `*/`, swallowing real `export` declarations that
+  // followed. Caught 2026-05-12 on cie-mouth.ts:980. Multiline-anchored
+  // strip skips inline regex literals (which never start at line start).
   const stripped = content
-    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/^[ \t]*\/\*[\s\S]*?\*\//gm, '')
     .replace(/\/\/[^\n]*/g, '');
 
-  // export { foo, bar as baz }
+  // export { foo, bar as baz, type Qux, type Quux as Q }
+  // Inline `type` modifier on a specifier is valid TS syntax (TS 4.5+):
+  //   export { type Foo }            → Foo is exported (as a type-only specifier)
+  //   export { type Foo as Bar }     → Bar is exported (alias of type Foo)
+  // The modifier must be stripped before name extraction or the parser reads
+  // 'type' as the literal specifier name. Caught 2026-05-12 by the false-
+  // positive deploy halt on a clean garden-fix commit.
   const namedListRx = /\bexport\s+(?:type\s+)?\{([^}]+)\}/g;
   let m;
   while ((m = namedListRx.exec(stripped))) {
     for (const part of m[1].split(',')) {
-      const trimmed = part.trim();
+      const trimmed = part.trim().replace(/^type\s+/, '');
       if (!trimmed) continue;
       const asMatch = trimmed.match(/^\S+\s+as\s+(\S+)$/);
       const name = asMatch ? asMatch[1] : trimmed.split(/\s+/)[0];
@@ -157,7 +192,14 @@ function checkFileImports(filePath, visited = new Set()) {
     if (!resolved) continue; // package import — skip
 
     const targetContent = readFileSafe(resolved);
-    if (!targetContent) {
+    // AI-11803-IMPORT-RESOLUTION-CLASSIFY-FIX (2026-05-12) — readFileSafe
+    // returns null only on readFileSync throw. Empty files return '' which
+    // is falsy in JS — the prior `if (!targetContent)` matched both cases
+    // and labelled empty files as 'unreadable', misleading the operator
+    // diagnostic. Strict null-check reserves 'unreadable' for genuine read
+    // failures so the next branch can correctly classify empty files as
+    // 'empty_target' (the consciousness.ts-class shape).
+    if (targetContent === null) {
       violations.push({
         file: filePath,
         specifier,
@@ -181,13 +223,22 @@ function checkFileImports(filePath, visited = new Set()) {
 
     const { named, hasDefault, hasStar } = extractExports(targetContent);
 
-    if (defaultBinding && !hasDefault && !hasStar) {
+    // `simpleNamed` is the bare-identifier `import X from '...'` alternative
+    // in TS_IMPORT_RX — that syntax is a DEFAULT import (X is the local
+    // alias for the target's default export), NOT a named import. Fold it
+    // into defaultBinding before the missing_default check so callsites
+    // like `import crmRouter from './api/crm/index.js'` against a file
+    // that does `export default crmRouter` validate correctly. Caught
+    // 2026-05-12 by a false-positive on server.ts:6093.
+    const effectiveDefault = defaultBinding || (simpleNamed && !namedList ? simpleNamed : null);
+
+    if (effectiveDefault && !hasDefault && !hasStar) {
       violations.push({
         file: filePath,
         specifier,
         resolved,
         kind: 'missing_default',
-        message: `import default '${defaultBinding}' from '${specifier}' but ${resolved} has no default export`,
+        message: `import default '${effectiveDefault}' from '${specifier}' but ${resolved} has no default export`,
       });
     }
 
@@ -204,11 +255,20 @@ function checkFileImports(filePath, visited = new Set()) {
       }
     }
 
-    const explicitNamed = (namedList || simpleNamed || '').trim();
+    // Only treat the inside-braces capture as named imports — `simpleNamed`
+    // is a default-import alias and was handled above.
+    const explicitNamed = (namedList || '').trim();
     if (explicitNamed) {
-      const wantedNames = (namedList || simpleNamed)
+      // Inline `type` modifier on a specifier is valid TS syntax (TS 4.5+):
+      //   import { type Foo } from '...'           → wants 'Foo' from target
+      //   import { type Foo as Bar } from '...'    → wants 'Foo' from target (Bar is local alias)
+      //   import { Foo as Bar } from '...'         → wants 'Foo' from target
+      // Strip the modifier BEFORE the `as` regex so `type X as Y` correctly
+      // identifies X (the source-side name) as the wanted export. Caught
+      // 2026-05-12 by the false-positive deploy halt on a clean commit.
+      const wantedNames = namedList
         .split(',')
-        .map((s) => s.trim())
+        .map((s) => s.trim().replace(/^type\s+/, ''))
         .filter(Boolean)
         .map((s) => {
           const asMatch = s.match(/^(\S+)\s+as\s+\S+$/);
@@ -233,6 +293,23 @@ function checkFileImports(filePath, visited = new Set()) {
   return violations;
 }
 
+// Scope filter — added 2026-05-12 to match the gate's stated purpose at
+// header line 18 ("would crash at runtime when the image starts"). Test
+// suites and one-shot scripts are copied into the image by `COPY . .` but
+// the entrypoint never loads them at boot. Their broken imports surface
+// only when the test runner or script is invoked — that is a CI concern,
+// not a startup-runtime concern.
+//
+// Set ARIA_IMPORT_RESOLUTION_AUDIT_ALL=1 to include tests/scripts in the
+// scan (useful for CI runs that want to surface test-file regressions).
+const TEST_OR_SCRIPT_RX = /(?:^|[\\/])(?:tests?|__tests__|spec|__mocks__|scripts?)[\\/]/;
+const TEST_FILENAME_RX = /\.(?:test|spec)\.[mc]?[jt]sx?$/;
+
+function isTestOrScriptPath(absPath) {
+  if (process.env.ARIA_IMPORT_RESOLUTION_AUDIT_ALL === '1') return false;
+  return TEST_OR_SCRIPT_RX.test(absPath) || TEST_FILENAME_RX.test(absPath);
+}
+
 function walkDir(dir, out = []) {
   let entries;
   try {
@@ -243,8 +320,14 @@ function walkDir(dir, out = []) {
   for (const ent of entries) {
     if (ent.name === 'node_modules' || ent.name === 'dist' || ent.name.startsWith('.')) continue;
     const p = join(dir, ent.name);
-    if (ent.isDirectory()) walkDir(p, out);
-    else if (SOURCE_EXTS.includes(extname(ent.name))) out.push(p);
+    if (ent.isDirectory()) {
+      if (!process.env.ARIA_IMPORT_RESOLUTION_AUDIT_ALL && /^(?:tests?|__tests__|spec|__mocks__|scripts?)$/.test(ent.name)) {
+        continue;
+      }
+      walkDir(p, out);
+    } else if (SOURCE_EXTS.includes(extname(ent.name)) && !isTestOrScriptPath(p)) {
+      out.push(p);
+    }
   }
   return out;
 }
@@ -287,7 +370,10 @@ if (args.length > 0) {
 let stdin = '';
 try {
   for await (const chunk of process.stdin) stdin += chunk;
-} catch {}
+} catch (err) {
+  // M0.H.X3: stdin read failure now surfaces.
+  process.stderr.write(`[aria-import-resolution-gate:stdin-read] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+}
 
 let event;
 try {

package/dist/runtime/hooks/aria-outcome-record.mjs

@@ -59,26 +59,62 @@ try {
 
 const sessionId = event.session_id || event.sessionId || 'unknown';
 const success = !event.tool_response?.error && event.tool_response?.type !== 'error';
+const runtimeUrl = (process.env.ARIA_RUNTIME_URL || harnessUrl).replace(/\/+$/, '');
+function touchedFilesForEvent() {
+  const input = event.tool_input || event.toolInput || {};
+  const files = [];
+  const push = (value, intent = actionKind) => {
+    const path = String(value || '').trim().replace(/\\/g, '/');
+    if (path && !files.some((file) => file.path === path && file.intent === intent)) files.push({ path, intent });
+  };
+  push(input.file_path || input.filePath || input.path || input.notebook_path || input.notebookPath);
+  if (Array.isArray(input.files)) input.files.forEach((file) => push(file));
+  if (Array.isArray(input.targetFiles)) input.targetFiles.forEach((file) => push(file));
+  const command = String(input.command || '');
+  if (/^\*\*\* Begin Patch/m.test(command)) {
+    for (const match of command.matchAll(/^\*\*\* (?:Update|Add|Delete) File: (.+)$/gm)) push(match[1], actionKind);
+  }
+  return files.slice(0, 200);
+}
+const touchedFiles = touchedFilesForEvent();
+const headers = {
+  'Content-Type': 'application/json',
+  ...(harnessToken ? { Authorization: `Bearer ${harnessToken}` } : {}),
+};
 
-// Fire-and-forget POST to outcome-record — never blocks, never throws
-fetch(`${harnessUrl}/api/harness/outcome-record`, {
-  method: 'POST',
-  headers: {
-    'Content-Type': 'application/json',
-    'Authorization': `Bearer ${harnessToken}`,
-  },
-  body: JSON.stringify({
-    sessionId,
-    actionKind,
-    actionTarget,
-    actionShape: {
-      tool: toolName,
-      success,
-      isClientTier,
-    },
-  }),
-}).catch(() => {/* fire-and-forget — HTTP failures are silently dropped */});
+await Promise.race([
+  Promise.allSettled([
+    fetch(`${harnessUrl}/api/harness/outcome-record`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({
+        sessionId,
+        actionKind,
+        actionTarget,
+        actionShape: {
+          tool: toolName,
+          success,
+          isClientTier,
+        },
+      }),
+    }),
+    touchedFiles.length > 0
+      ? fetch(`${runtimeUrl}/api/hive/file-touch`, {
+          method: 'POST',
+          headers,
+          body: JSON.stringify({
+            session_id: sessionId,
+            event: 'claude_post_tool',
+            source: 'claude-outcome-record-hook',
+            files: touchedFiles,
+            body: { toolName, actionKind, actionTarget, success, isClientTier },
+          }),
+        })
+      : Promise.resolve(null),
+  ]),
+  new Promise((resolve) => setTimeout(resolve, 750)),
+]).catch(() => {});
 
-// Exit immediately — don't await the fetch; this is a PostToolUse hook
-// and must not add meaningful latency to the tool pipeline.
+// Keep the hook bounded; the race above gives Hive a chance to persist without
+// making tool completion depend on network health.
 process.exit(0);