@cleocode/core 2026.10.8 → 2026.10.9

package/migrations/drizzle-cleo-project/20261010170000_t12896b-brain-task-observations/migration.sql

@@ -0,0 +1,37 @@
+-- T12896 — brain_task_observations joins the consolidated project schema.
+--
+-- The table (T1615, the observation/task join `cleo memory find` reads) was
+-- created only by the standalone drizzle-brain migration
+-- 20260601000001_t11522-brain-task-observations, which the consolidated store's
+-- brain reconcile runs AFTER the open-time row-identity heal. A fresh store
+-- therefore lacked it during the heal, so it could not be declared in
+-- ROW_IDENTITY. This migration creates it with the same shape (every statement
+-- IF NOT EXISTS, so a store the reconcile already gave the table keeps its rows
+-- and the reconcile stays a no-op) and adds its row uid column and unique uid
+-- index (natural identity on observation id + task uid, store/row-identity-registry.ts).
+--
+-- The uid column is ADD COLUMN (not part of the CREATE) so a store whose table
+-- predates this migration gains it the same way a fresh one does; the column is
+-- filled by TypeScript at open and by the per-connection TEMP trigger. No row is
+-- touched here, so the gate 36 DML rules do not apply.
+--
+-- @task T12896
+-- @epic T12323
+
+CREATE TABLE IF NOT EXISTS `brain_task_observations` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`observation_id` text NOT NULL,
+	`task_id` text NOT NULL,
+	`link_type` text DEFAULT 'session-completed' NOT NULL,
+	`created_at` text DEFAULT (datetime('now')) NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `idx_brain_task_obs_unique` ON `brain_task_observations` (`observation_id`, `task_id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_brain_task_obs_observation` ON `brain_task_observations` (`observation_id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_brain_task_obs_task` ON `brain_task_observations` (`task_id`);
+--> statement-breakpoint
+ALTER TABLE `brain_task_observations` ADD COLUMN `uid` text;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_brain_task_observations_uid` ON `brain_task_observations` (`uid`);

package/migrations/sync-journal/20261009150000_t13335-capture-pin/migration.sql

@@ -0,0 +1,13 @@
+-- T13335 (journal spec §1.5 N7 rule 3) — the copy reconcile's pinned HLCs.
+--
+-- _sync_capture.pin_json: for a capture of a `rebind` frame the copy
+-- reconcile wrote under rule 3 (a value the original replica sealed but the
+-- stream never saw), the HLCs the sealer must publish unchanged instead of
+-- ticking: `{"h"?: hlc, "fh"?: {column: hlc}}`. `h` is the op's own HLC (a
+-- delete), `fh` the per-field HLCs (an insert or update). NULL for every
+-- other capture. The pin dies with its capture when the capture is sealed.
+--
+-- Local-only.
+--
+-- Do not edit this file once applied: its hash is recorded per store.
+ALTER TABLE _sync_capture ADD COLUMN pin_json TEXT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/core",
-  "version": "2026.10.8",
+  "version": "2026.10.9",
   "description": "CLEO core business logic kernel — tasks, sessions, memory, orchestration, lifecycle, with bundled SQLite store",
   "type": "module",
   "main": "./dist/index.js",
@@ -296,6 +296,11 @@
       "import": "./dist/docs/*.js",
       "require": "./dist/docs/*.js"
     },
+    "./tools/fs.js": {
+      "types": "./dist/tools/fs.d.ts",
+      "import": "./dist/tools/fs.js",
+      "require": "./dist/tools/fs.js"
+    },
     "./*": {
       "types": "./dist/*.d.ts",
       "import": "./dist/*.js",
@@ -491,16 +496,16 @@
     "write-file-atomic": "^7.0.1",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@cleocode/adapters": "2026.10.8",
-    "@cleocode/agents": "2026.10.8",
-    "@cleocode/caamp": "2026.10.8",
-    "@cleocode/contracts": "2026.10.8",
-    "@cleocode/git-shim": "2026.10.8",
-    "@cleocode/lafs": "2026.10.8",
-    "@cleocode/nexus": "2026.10.8",
-    "@cleocode/paths": "2026.10.8",
-    "@cleocode/skills": "2026.10.8",
-    "@cleocode/worktree": "2026.10.8"
+    "@cleocode/adapters": "2026.10.9",
+    "@cleocode/agents": "2026.10.9",
+    "@cleocode/caamp": "2026.10.9",
+    "@cleocode/contracts": "2026.10.9",
+    "@cleocode/git-shim": "2026.10.9",
+    "@cleocode/lafs": "2026.10.9",
+    "@cleocode/nexus": "2026.10.9",
+    "@cleocode/paths": "2026.10.9",
+    "@cleocode/skills": "2026.10.9",
+    "@cleocode/worktree": "2026.10.9"
   },
   "engines": {
     "node": ">=24.16.0"
@@ -526,7 +531,7 @@
     "@types/proper-lockfile": "^4.1.4",
     "@types/tar": "^6.1.13",
     "@types/write-file-atomic": "^4.0.3",
-    "@cleocode/utils": "2026.10.8"
+    "@cleocode/utils": "2026.10.9"
   },
   "repository": {
     "type": "git",
@@ -535,7 +540,7 @@
   },
   "optionalDependencies": {
     "llmtxt": "^2026.5.15",
-    "@cleocode/studio": "^2026.10.8"
+    "@cleocode/studio": "^2026.10.9"
   },
   "scripts": {
     "build": "tsc && node scripts/copy-selfimprove-fixtures.mjs && node scripts/write-build-provenance.mjs",

package/schemas/config.schema.json

@@ -675,6 +675,18 @@
         }
       }
     },
+    "cloud": {
+      "type": "object",
+      "description": "Cleo Nexus cloud sync behaviour on this device.",
+      "additionalProperties": false,
+      "properties": {
+        "autoSync": {
+          "type": "boolean",
+          "default": true,
+          "description": "Start a background push/pull from normal commands in a linked project, at most once per CLEO_AUTO_SYNC_INTERVAL_MIN (T13553). false turns it off; CLEO_DISABLE_AUTO_SYNC=1 does the same per shell."
+        }
+      }
+    },
     "contextAlerts": {
       "type": "object",
       "description": "Context window alert configuration. Controls when and how users are alerted about context window usage approaching thresholds.",

package/schemas/project-context.schema.json

@@ -278,6 +278,11 @@
           "items": { "type": "string", "minLength": 1 },
           "description": "Repo-relative paths or globs that never count as part of a change when evidence decides its scope (runtime state, e.g. .opencode/goals/**). CLEO's own installed hook files are always excluded (T13135)."
         },
+        "runtimePaths": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "description": "Globs of tracked files a harness rewrites during a run (e.g. .opencode/goals/*/run.json), left out of the evidence tree hash and kept tracked (T13554). Read from the default branch only; a glob matching the project context, a goal.yaml, an oracle or a typed gate input is refused."
+        },
         "ciChecks": {
           "type": "object",
           "additionalProperties": false,

package/templates/CLEO-INJECTION.md

@@ -1,6 +1,6 @@
 # CLEO Protocol
 
-Version: 2.24.10 | CLI-only dispatch | `cleo <command> [args]`
+Version: 2.24.11 | CLI-only dispatch | `cleo <command> [args]`
 
 <!-- CLEO-INJECTION:section=session-start -->
 ## Universal protocol
@@ -133,7 +133,7 @@ Before `cleo complete <id>`, every gate requires programmatic evidence validated
 | `securityPassed` | `tool:security-scan` |
 | `cleanupDone` | `note:removed dead branches` |
 
-Name the acceptance criteria each result proves: `cleo verify T1234 --gate implemented --evidence "commit:abc123;files:src/fix.ts;satisfies:T1234#AC1"`. Record `testsPassed` and `qaPassed` separately with actual verification results and explicit criterion links. Documentation-only PRs cannot implement a code-fix task; changed criteria require fresh evidence, and a child waiver does not waive parent criteria. Then `cleo complete T###` re-validates every hard atom (commit reachable, file sha256, test-run hash); tampering → `E_EVIDENCE_STALE`. Typed gates, `pr:` rules, tool timeouts and the audited owner override: `cleo briefing inject --section evidence`.
+Name the acceptance criteria each result proves: `cleo verify T1234 --gate implemented --evidence "commit:abc123;files:src/fix.ts;satisfies:T1234#AC1"`. Record `testsPassed` and `qaPassed` separately with actual verification results and explicit criterion links. Documentation-only PRs cannot implement a code-fix task; changed criteria require fresh evidence, and a child waiver does not waive parent criteria. Then `cleo complete T###` re-validates every hard atom (commit reachable, file sha256, test-run hash); tampering → `E_EVIDENCE_STALE`. Typed gates, `pr:` rules, tool timeouts and the audited owner override: `cleo briefing inject --section evidence`. Typed gates execute only via `cleo verify --run`.
 
 Anti-patterns: completing without running tests · self-attesting without programmatic proof · running tests by hand, then again via `tool:test` · modifying files between `cleo verify` and `cleo complete`.
 <!-- /CLEO-INJECTION:section=pre-complete-gate -->

package/templates/CLEO-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLEO Protocol — on-demand reference
 
-Version: 2.24.10 | Companion to the always-loaded `CLEO-INJECTION.md` core
+Version: 2.24.11 | Companion to the always-loaded `CLEO-INJECTION.md` core
 
 Not injected into agent context. Print one section with `cleo briefing inject --section <name>`; tier-2 spawn prompts embed this whole file. Section names are the `CLEO-INJECTION:section` markers below.
 
@@ -277,13 +277,15 @@ A merged PR and green CI provide provenance. For `implemented`, pair `pr:<number
 
 ### Typed acceptance gates — observe before you attest
 
-Typed gates (`cleo req add <id> --gate '<json>'`) EXECUTE during any `cleo verify … --gate … --evidence …` write on a task that carries them. To run them without recording anything:
+Typed gates (`cleo req add <id> --gate '<json>'`) execute ONLY through `cleo verify <id> --run` (owner decision, T13521). Evidence writes (`cleo verify … --gate … --evidence …`), `cleo done`, `cleo verify --auto` and `cleo complete` read cached passes and execute no typed gate command:
 
 ```bash
-cleo verify T### --run          # executes typed gates, records no verification, caches passes
+cleo verify T### --run                    # executes the typed gates, records no verification, caches passes
+cleo verify T### --run --req REQ-A,REQ-B  # executes only the named gates; the others keep their cached passes
+cleo verify T### --gate testsPassed --evidence "<atoms>"   # reads the cached passes; executes nothing
 ```
 
-`--run` records no verification and cannot be combined with `--gate`/`--all`/`--reset`. Passes are cached (HMAC-sealed per machine) by gate + HEAD + dirty tree + inputs, so the next write reuses them, marked `source: cache` on the result and receipt; add `--no-run` to forbid execution. `evidence.allowCachedGates: false` in `.cleo/project-context.json` disables reuse. A `test` gate with `minCount` needs its OWN command to emit a machine-readable report (`--reporter=json` for vitest, `--json` for jest); an exit code carries no count, and a report file from a separate invocation is not bound to this run — record that as `test-run:<path>` evidence instead.
+`--run` records no verification and cannot be combined with `--gate`/`--all`/`--reset`. Passes are cached (HMAC-sealed per machine) by gate + HEAD + dirty tree + inputs; a write reuses them, marked `source: cache` on the result and receipt. A typed gate the write links (`satisfies:`) with no cached pass refuses the write with `E_GATE_NOT_CACHED`, naming the `--run` command; an unlinked one is recorded as not run, and `cleo complete` still requires it. `--run-typed` on a write (or on `cleo done`) opts back into executing uncached typed gates there. `evidence.allowCachedGates: false` in `.cleo/project-context.json` disables reuse, so writes then need `--run-typed`. Replace a gate's command in place with `cleo req replace <id> <REQ-ID> --gate '<json>'`; prefer a repo-relative command and `cwd`. A `test` gate with `minCount` needs its OWN command to emit a machine-readable report (`--reporter=json` for vitest, `--json` for jest); an exit code carries no count, and a report file from a separate invocation is not bound to this run — record that as `test-run:<path>` evidence instead.
 
 ### Emergency override (audited)
 

package/templates/git-hooks/pre-push

@@ -19,6 +19,17 @@
 # POSIX `/bin/sh` only. No node/pnpm dependency.
 set -e
 
+# Capture once so task-ID validation and project checks receive identical refs.
+REF_INPUT=$(mktemp "${TMPDIR:-/tmp}/cleo-pre-push.XXXXXX") || {
+  printf '%s\n' 'cleo pre-push: cannot capture refs; infrastructure failure, allowing push' >&2
+  exit 0
+}
+trap 'rm -f "$REF_INPUT"' EXIT HUP INT TERM
+if ! cat > "$REF_INPUT"; then
+  printf '%s\n' 'cleo pre-push: cannot read refs; infrastructure failure, allowing push' >&2
+  exit 0
+fi
+
 ZERO_SHA="0000000000000000000000000000000000000000"
 EMPTY_TREE_SHA=""
 FAIL=0
@@ -73,7 +84,7 @@ while read -r local_ref local_sha remote_ref remote_sha; do
 "
     fi
   done
-done
+done < "$REF_INPUT"
 
 if [ "$FAIL" -ne 0 ]; then
   cat >&2 <<EOF
@@ -89,4 +100,21 @@ EOF
   exit 1
 fi
 
+# Existing projects remain unchanged: the shared runner skips disabled hooks.
+if command -v cleo >/dev/null 2>&1; then
+  capability=$(cleo hook run --probe < /dev/null 2>/dev/null) || capability=""
+  if [ "$capability" != "CLEO_PROJECT_HOOK_V1" ]; then
+    printf '%s\n' 'cleo pre-push: project runner unavailable; allowing push' >&2
+    exit 0
+  fi
+  status=0
+  cleo hook run --source git --event pre-push -- "$@" < "$REF_INPUT" || status=$?
+  case "$status" in
+    0) ;;
+    1) exit 1 ;; # An explicit project verdict/checker policy blocks.
+    *) printf '%s\n' 'cleo pre-push: runner infrastructure failure; allowing push' >&2 ;;
+  esac
+else
+  printf '%s\n' 'cleo pre-push: project runner missing; allowing push' >&2
+fi
 exit 0

package/templates/workflows/release-prepare.yml.tmpl

@@ -54,6 +54,7 @@ on:
           - beta
           - alpha
           - rc
+          - canary
       skip-tests:
         description: 'Skip the Linux test shards in Preflight (use when main CI is already green for this commit — `cleo release open` sets it after checking). Lint, typecheck and build still run.'
         type: boolean