@dzhechkov/harness-core 0.7.4 → 0.7.5

package/src/agentdb-index.ts

@@ -110,7 +110,19 @@ export async function indexPatternsToAgentdb(
     };
     const model = resolveEmbedModel(projectRoot);
     if ('error' in model) return { indexed: 0, error: model.error };
-    const emb = new EmbeddingService({ model: model.model, dimension: model.dim, provider: 'transformers' });
+    const emb = new EmbeddingService({
+      model: model.model,
+      dimension: model.dim,
+      provider: 'transformers',
+      // agentdb >= 3.0.0-alpha.20 refuses UNREGISTERED models without an explicit role policy
+      // (its built-in registry knows all-MiniLM-L6-v2 but not our multilingual variant — grounded
+      // in dist/src/controllers/EmbeddingService.js:53). paraphrase-multilingual-MiniLM is a
+      // SYMMETRIC sentence-transformer (no query/passage instruction prefixes), so the policy is
+      // {kind:'symmetric'} — the same one the registry assigns its own symmetric models. On
+      // alpha.18 the extra field is ignored; without it alpha.20 threw and the vector tier fell
+      // to lexical SILENTLY (mirror writes answered {indexed:0, error} — measured 2026-08-24).
+      rolePolicy: { kind: 'symmetric' },
+    } as never);
     await emb.initialize();
 
     const dbFile = resolveAgentdbPath(projectRoot, opts.dbPath);
@@ -242,7 +254,19 @@ export async function resolveAgentdbEmbedder(
     };
     const model = resolveEmbedModel(projectRoot);
     if ('error' in model) return { error: model.error };
-    const emb = new EmbeddingService({ model: model.model, dimension: model.dim, provider: 'transformers' });
+    const emb = new EmbeddingService({
+      model: model.model,
+      dimension: model.dim,
+      provider: 'transformers',
+      // agentdb >= 3.0.0-alpha.20 refuses UNREGISTERED models without an explicit role policy
+      // (its built-in registry knows all-MiniLM-L6-v2 but not our multilingual variant — grounded
+      // in dist/src/controllers/EmbeddingService.js:53). paraphrase-multilingual-MiniLM is a
+      // SYMMETRIC sentence-transformer (no query/passage instruction prefixes), so the policy is
+      // {kind:'symmetric'} — the same one the registry assigns its own symmetric models. On
+      // alpha.18 the extra field is ignored; without it alpha.20 threw and the vector tier fell
+      // to lexical SILENTLY (mirror writes answered {indexed:0, error} — measured 2026-08-24).
+      rolePolicy: { kind: 'symmetric' },
+    } as never);
     await emb.initialize();
     return { embed: (t: string) => emb.embed(t) };
   } catch (err) {

package/src/amendment-trace.ts

@@ -74,7 +74,12 @@ export const MIN_MATCHABLE_ID_LENGTH = 8;
 export function extractTestTitles(body: string): string[] {
   const code = body.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/(^|[^:])\/\/[^\n]*/g, '$1');
   const out: string[] = [];
-  const re = /\b(?:it|test|describe)(?:\.\w+)*(?:\s*\([^()]{0,200}\))?\s*(?:`[^`]*`)?\s*\(\s*(['"`])([\s\S]{1,300}?)\1/g;
+  // The modifier-argument group admits ONE level of nested parens: `it.skipIf(!existsSync(BIN))`
+  // carries a call inside the guard, and the flat `[^()]{0,200}` failed on it — so every title in
+  // a file whose tests were guarded that way was invisible, and `dz amendment-check` reported
+  // `searched 1 test title(s)` over a nine-test file (MEASURED 2026-08-24 on the name-check
+  // feature; worked around there by de-guarding the tests, fixed here at the extractor).
+  const re = /\b(?:it|test|describe)(?:\.\w+)*(?:\s*\((?:[^()]|\([^()]*\)){0,200}\))?\s*(?:`[^`]*`)?\s*\(\s*(['"`])([\s\S]{1,300}?)\1/g;
   for (let m = re.exec(code); m !== null; m = re.exec(code)) if (m[2]) out.push(m[2]);
   return out;
 }

package/src/cadence.ts

@@ -0,0 +1,227 @@
+/**
+ * `dz cadence` — the "what shipped" aggregator (backlog ef740b44), built on one spine:
+ * A WINDOW DEEPER THAN THE RECORD IS REFUSED (ADR-001). The weekly-digest research (2026-08-22)
+ * caught a «year» digest standing on 174 days of data — scale forgery by aggregation; an
+ * aggregator that silently computes any requested period repeats it mechanically.
+ *
+ * Four sources, every degradation NAMED in the report, never a silent zero:
+ *  - graded shipments: features/<slug>/08_qe_report.md through the hardened readQeGrade
+ *    (prefix-negation aware, all measured real-world grade forms); ungraded reports are a COLUMN;
+ *  - npm publishes: the dz recap registry-time cache (third-party timestamps);
+ *  - guard repeat decay on a FIXED rule set: a rule enters only with events BEFORE the window
+ *    start (the data-driven birth proxy — the no-stubs class of «zero repeats because the rule is
+ *    young» is excluded by construction);
+ *  - knowledge reuse: recall events per bucket from .dz/recall-usage.jsonl.
+ */
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { readQeGrade } from './score.js';
+
+export type CadenceWindow = 'day' | 'week' | 'month' | 'quarter' | 'halfyear' | 'year';
+
+export const CADENCE_WINDOW_DAYS: Record<CadenceWindow, number> = {
+  day: 1, week: 7, month: 30, quarter: 91, halfyear: 182, year: 365,
+};
+
+export interface CadenceWindowDecision {
+  readonly ok: boolean;
+  readonly reason: string;
+  /** The largest window today's record CAN honestly carry, or null when even `day` cannot. */
+  readonly largestAllowed: CadenceWindow | null;
+}
+
+/**
+ * ADR-001: a window is accepted only when the record is at least TWO windows deep — two full units
+ * are the minimum for the word «cadence»; one point has no rhythm.
+ */
+export function decideCadenceWindow(window: CadenceWindow, dataDepthDays: number): CadenceWindowDecision {
+  const need = CADENCE_WINDOW_DAYS[window] * 2;
+  const order: CadenceWindow[] = ['year', 'halfyear', 'quarter', 'month', 'week', 'day'];
+  const largestAllowed = order.find((w) => dataDepthDays >= CADENCE_WINDOW_DAYS[w] * 2) ?? null;
+  if (dataDepthDays >= need) return { ok: true, reason: `record depth ${dataDepthDays}d covers 2×${window}`, largestAllowed };
+  return {
+    ok: false,
+    reason: `REFUSED: the record is ${dataDepthDays} day(s) deep and a ${window} cadence needs ${need} — a cadence computed from under two full windows is a scale forgery, not a number` +
+      (largestAllowed ? `; the largest honest window today is «${largestAllowed}»` : '; even «day» is not established yet'),
+    largestAllowed,
+  };
+}
+
+/** ISO week key (YYYY-Www) for a ms timestamp. */
+export function isoWeekOf(ms: number): string {
+  const d = new Date(ms);
+  const t = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()));
+  const day = t.getUTCDay() === 0 ? 7 : t.getUTCDay();
+  t.setUTCDate(t.getUTCDate() + 4 - day);
+  const yearStart = Date.UTC(t.getUTCFullYear(), 0, 1);
+  const week = Math.ceil(((t.getTime() - yearStart) / 86400000 + 1) / 7);
+  return `${t.getUTCFullYear()}-W${String(week).padStart(2, '0')}`;
+}
+
+export interface CadenceEvent { readonly ts: number; readonly kind: string; readonly detail?: string }
+
+/** Bucket events into ISO weeks inside [windowStart, now]. */
+export function weeklyBuckets(events: readonly CadenceEvent[], windowStartMs: number, nowMs: number): Map<string, CadenceEvent[]> {
+  const out = new Map<string, CadenceEvent[]>();
+  for (const e of events) {
+    if (!isFinite(e.ts) || e.ts < windowStartMs || e.ts > nowMs) continue;
+    const k = isoWeekOf(e.ts);
+    const list = out.get(k) ?? [];
+    list.push(e);
+    out.set(k, list);
+  }
+  return out;
+}
+
+export interface GuardDecayRow { readonly rule: string; readonly before: number; readonly inWindow: number }
+
+/**
+ * Repeat decay over the FIXED set: only rules with at least one event BEFORE the window start
+ * qualify (their existence predates the window); newborn rules are EXCLUDED by construction and
+ * returned separately so the exclusion is visible.
+ */
+export function guardRepeatDecay(
+  events: readonly { ts: number; rule: string }[],
+  windowStartMs: number,
+): { decay: GuardDecayRow[]; excludedNewborn: string[] } {
+  const before = new Map<string, number>();
+  const inWindow = new Map<string, number>();
+  for (const e of events) {
+    if (!isFinite(e.ts) || e.rule === '') continue;
+    if (e.ts < windowStartMs) before.set(e.rule, (before.get(e.rule) ?? 0) + 1);
+    else inWindow.set(e.rule, (inWindow.get(e.rule) ?? 0) + 1);
+  }
+  const decay: GuardDecayRow[] = [...before.entries()]
+    .map(([rule, b]) => ({ rule, before: b, inWindow: inWindow.get(rule) ?? 0 }))
+    .sort((a, b) => b.before - a.before);
+  const excludedNewborn = [...inWindow.keys()].filter((r) => !before.has(r)).sort();
+  return { decay, excludedNewborn };
+}
+
+export interface CadenceReport {
+  readonly window: CadenceWindow;
+  readonly decision: CadenceWindowDecision;
+  readonly depthDays: number;
+  readonly shipments: { graded: Record<string, number>; ungraded: number; gradedTotal: number; byGrade: Record<string, number> };
+  readonly npmPublishes: { weekly: Record<string, number>; degraded: string | null };
+  readonly guard: { decay: GuardDecayRow[]; excludedNewborn: string[]; degraded: string | null };
+  readonly recalls: { weekly: Record<string, number>; degraded: string | null };
+}
+
+function safeJsonl(path: string): unknown[] {
+  const out: unknown[] = [];
+  try {
+    for (const line of readFileSync(path, 'utf-8').split('\n')) {
+      if (line.trim() === '') continue;
+      try { out.push(JSON.parse(line)); } catch { /* torn line — skip, counted nowhere */ }
+    }
+  } catch { /* absent file — callers name the degradation */ }
+  return out;
+}
+
+/** Build the full report. `now` injectable — the refusal decision must be testable. */
+export function buildCadenceReport(root: string, window: CadenceWindow, now?: number): CadenceReport {
+  const nowMs = typeof now === 'number' && isFinite(now) ? now : Date.now();
+
+  // Shipment events: graded 08 reports, dated by the run-cost ledger (fallback: report mtime is
+  // NOT used — an mtime moves on every touch; an undatable report lands in `ungraded`... no: in
+  // its own named bucket via ledger-missing) — v1 keeps the honest subset: ledger-dated only.
+  const ledger = safeJsonl(join(root, '.dz', 'feature-adr', 'run-cost-ledger.jsonl')) as Array<{ slug?: string; date?: string }>;
+  const dateBySlug = new Map<string, number>();
+  let earliest = nowMs;
+  for (const r of ledger) {
+    if (typeof r.slug !== 'string' || typeof r.date !== 'string') continue;
+    const ts = Date.parse(r.date);
+    if (!isFinite(ts)) continue;
+    if (!dateBySlug.has(r.slug) || ts > (dateBySlug.get(r.slug) as number)) dateBySlug.set(r.slug, ts);
+    if (ts < earliest) earliest = ts;
+  }
+  // Record depth is the UNION of sources — the npm registry reaches months past the ledger, and a
+  // refusal computed from the shallowest source alone would under-admit honest windows.
+  let unionEarliest = earliest;
+  try {
+    const cache = JSON.parse(readFileSync(join(root, '.dz', 'recap', 'npm-times.json'), 'utf-8')) as { packages?: Record<string, { versions?: Record<string, string> }> };
+    for (const entry of Object.values(cache.packages ?? {})) for (const iso of Object.values(entry.versions ?? {})) {
+      const ts = Date.parse(iso); if (isFinite(ts) && ts < unionEarliest) unionEarliest = ts;
+    }
+  } catch { /* cache absent — named later */ }
+  for (const row of safeJsonl(join(root, '.dz', 'guard-audit.jsonl')) as Array<{ ts?: string }>) {
+    const ts = Date.parse(String(row.ts ?? '')); if (isFinite(ts) && ts < unionEarliest) unionEarliest = ts;
+  }
+  const depthDays = Math.floor((nowMs - unionEarliest) / 86400000);
+  const decision = decideCadenceWindow(window, depthDays);
+  const windowStart = nowMs - CADENCE_WINDOW_DAYS[window] * 86400000;
+
+  const gradedWeekly: Record<string, number> = {};
+  const byGrade: Record<string, number> = {};
+  let ungraded = 0;
+  let gradedTotal = 0;
+  const featuresDir = join(root, 'features');
+  if (existsSync(featuresDir) && decision.ok) {
+    for (const slug of readdirSync(featuresDir)) {
+      const report = join(featuresDir, slug, '08_qe_report.md');
+      if (!existsSync(report)) continue;
+      const ts = dateBySlug.get(slug);
+      if (ts === undefined || ts < windowStart || ts > nowMs) continue;
+      const grade = readQeGrade(readFileSync(report, 'utf-8')).grade;
+      if (grade === null) { ungraded += 1; continue; }
+      gradedTotal += 1;
+      byGrade[grade] = (byGrade[grade] ?? 0) + 1;
+      const wk = isoWeekOf(ts);
+      gradedWeekly[wk] = (gradedWeekly[wk] ?? 0) + 1;
+    }
+  }
+
+  // npm publishes from the recap cache — third-party registry timestamps.
+  const npmWeekly: Record<string, number> = {};
+  let npmDegraded: string | null = null;
+  const npmCache = join(root, '.dz', 'recap', 'npm-times.json');
+  if (!existsSync(npmCache)) {
+    npmDegraded = 'no npm-times cache — run `dz recap --refresh-publishes` first (registry timestamps are third-party data this command never fetches itself)';
+  } else if (decision.ok) {
+    try {
+      const cache = JSON.parse(readFileSync(npmCache, 'utf-8')) as { packages?: Record<string, { versions?: Record<string, string> }> };
+      for (const entry of Object.values(cache.packages ?? {})) {
+        for (const iso of Object.values(entry.versions ?? {})) {
+          const ts = Date.parse(iso);
+          if (!isFinite(ts) || ts < windowStart || ts > nowMs) continue;
+          const wk = isoWeekOf(ts);
+          npmWeekly[wk] = (npmWeekly[wk] ?? 0) + 1;
+        }
+      }
+    } catch { npmDegraded = 'npm-times cache unreadable — refresh it (`dz recap --refresh-publishes`)'; }
+  }
+
+  // Guard decay on the fixed set.
+  const guardRows = (safeJsonl(join(root, '.dz', 'guard-audit.jsonl')) as Array<{ ts?: string; at?: string; rule?: string; violations?: Array<{ rule?: string }> }>)
+    .flatMap((r) => {
+      const ts = Date.parse(String(r.ts ?? r.at ?? ''));
+      if (!isFinite(ts)) return [];
+      // the live shape: one audit row carries violations[] each naming its rule
+      if (Array.isArray(r.violations)) return r.violations.map((v) => ({ ts, rule: String(v?.rule ?? '') })).filter((x) => x.rule !== '');
+      return typeof r.rule === 'string' && r.rule !== '' ? [{ ts, rule: r.rule }] : [];
+    });
+  const guard = decision.ok ? guardRepeatDecay(guardRows, windowStart) : { decay: [], excludedNewborn: [] };
+  const guardDegraded = guardRows.length === 0 ? 'no guard-audit events on disk — decay has nothing to stand on' : null;
+
+  // Knowledge reuse: recall events.
+  const recallRows = (safeJsonl(join(root, '.dz', 'recall-usage.jsonl')) as Array<{ ts?: string; at?: string }>)
+    .map((r) => Date.parse(String(r.ts ?? r.at ?? '')))
+    .filter((t) => isFinite(t));
+  const recallWeekly: Record<string, number> = {};
+  if (decision.ok) for (const ts of recallRows) {
+    if (ts < windowStart || ts > nowMs) continue;
+    const wk = isoWeekOf(ts);
+    recallWeekly[wk] = (recallWeekly[wk] ?? 0) + 1;
+  }
+  const recallDegraded = recallRows.length === 0 ? 'no recall-usage events — the reuse leg has nothing to stand on' : null;
+
+  return {
+    window, decision, depthDays,
+    shipments: { graded: gradedWeekly, ungraded, gradedTotal, byGrade },
+    npmPublishes: { weekly: npmWeekly, degraded: npmDegraded },
+    guard: { ...guard, degraded: guardDegraded },
+    recalls: { weekly: recallWeekly, degraded: recallDegraded },
+  };
+}

package/src/feature-adr-routing.ts

@@ -188,7 +188,7 @@ export function decideUsageAction(
 // ── Data tables (data-only extensibility — gpt-5.6-ready) ───────────────────
 
 /** Known codex ids. Adding a new id (e.g. `'gpt-5.7'`) is a DATA-ONLY change. */
-export const KNOWN_CODEX: Record<string, number> = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-sol': 1 };
+export const KNOWN_CODEX: Record<string, number> = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-luna': 1, 'gpt-5.6-terra': 1, 'gpt-5.6-sol': 1 };
 
 /** The Claude model names the Workflow runtime accepts as `agent()` `model`. */
 export const CLAUDE_NAMES: Record<string, number> = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };

package/src/index.ts

@@ -331,6 +331,7 @@ export {
   compactRecallUsageLog,
   compactRecallUsageLogChecked,
   appendRecallUsage,
+  countRecallEventsForRun,
   runtimeOf,
   RUNTIMES,
 } from './recall-usage.js';
@@ -461,7 +462,7 @@ export type {
   ChainDefectAge,
   ChainDefectAges,
 } from './event-chain.js';
-export { decideProvenance, environmentCanMintProvenance, publishArgv, discoverPackages, publishPackages, bumpPatch, compareVersions, findUnpackagedSkills, orderByDependencies, syncReadmeVersion } from './publish.js';
+export { decideProvenance, environmentCanMintProvenance, publishArgv, discoverPackages, publishPackages, bumpPatch, compareVersions, findUnpackagedSkills, findUnpublishedWorkspaceFloors, orderByDependencies, syncReadmeVersion } from './publish.js';
 export { fetchAllDownloads } from './downloads.js';
 export type { PackageDownloads, DownloadsReport } from './downloads.js';
 export { discoverInstalled, checkUpgrades } from './upgrade.js';
@@ -818,6 +819,7 @@ export * from './recap.js';
 export * from './provenance.js';
 export * from './name-check.js';
 export * from './cli-flag-notice.js';
+export * from './tg-post.js';
 
 // Mutation gate (feature ha-mutation-gate) — deliberately break each NAMED protection in a scratch
 // copy, run the suite, REQUIRE red. Proves a test DISCRIMINATES, not merely that it is green.
@@ -832,3 +834,7 @@ export * from './backlog.js';
 // no-stubs (backlog 0b403a0106103901) — deterministic unfinished-stub-marker scan over the
 // CHANGE-SET, wired as the `no-stubs` SOFT publish guard rule + the feature-adr Step-8 QE item.
 export * from './no-stubs.js';
+export { quiescenceProbeScript, decideWriterQuiescence, WQ_WINDOW_SECONDS, WQ_MAX_WINDOWS, WQ_REQUIRED_QUIET } from './writer-quiescence.js';
+export type { WriterQuiescenceDecision } from './writer-quiescence.js';
+export { decideCadenceWindow, isoWeekOf, weeklyBuckets, guardRepeatDecay, buildCadenceReport, CADENCE_WINDOW_DAYS } from './cadence.js';
+export type { CadenceWindow, CadenceReport, CadenceWindowDecision } from './cadence.js';

package/src/loop-blobs.generated.ts

@@ -61,11 +61,11 @@ export const BLOBS: Record<string, LoopBlob> = {
   "model-resolver": {
     name: "model-resolver",
     version: "1.0.0",
-    contentHash: "dd4020b613dc3814aaaf5c6a07a82bff844680f3be43d2943754f46b0b1bea3c",
+    contentHash: "e82ac2137279537f5b65725cbd8de5817fcbc89571068e2df843587352fa83f5",
     sourcePath: "packages/@dzhechkov/harness-core/src/feature-adr-routing.ts",
     requires: [],
     exports: ["specToOpts","resolveStageModel","KNOWN_CODEX","mergeOpts","stageLabel","modelLabel"],
-    code: "const OVERRIDE_REASONING = {\n    router: 'high',\n    requirements: 'xhigh',\n    research: 'xhigh',\n    adr: 'xhigh',\n    ideation: 'xhigh',\n    ddd: 'xhigh',\n    architecture: 'xhigh',\n    plan: 'xhigh',\n    code: 'xhigh',\n    qe: 'high',\n    fleet: 'high',\n};\nfunction topCodexId(env) {\n    let top = env.CODEX_MODEL;\n    if (top === 'auto') {\n        const ids = Object.keys(KNOWN_CODEX);\n        for (let i = 0; i < ids.length; i++) {\n            if (ids[i] !== 'auto')\n                top = ids[i] || top;\n        }\n    }\n    return top;\n}\nconst KNOWN_CODEX = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-sol': 1 };\nconst CLAUDE_NAMES = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };\nconst VALID_REASONING = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1 };\nconst DEFAULT_MODELS = {\n    router: 'fable',\n    requirements: 'sonnet',\n    research: 'sonnet',\n    adr: 'opus',\n    ideation: 'sonnet',\n    ddd: 'opus',\n    architecture: 'opus',\n    plan: 'sonnet',\n    code: null,\n    qe: null,\n    fleet: 'sonnet',\n};\nfunction specToOpts(spec, env) {\n    const log = env.log || function () { };\n    if (!spec)\n        return {};\n    const parts = String(spec).split(':');\n    const head = parts[0] || '';\n    if (head === 'codex') {\n        let id = parts[1] || env.CODEX_MODEL;\n        if (id !== 'auto' && !KNOWN_CODEX[id]) {\n            log('models: unknown codex id ' + id + ' — using ' + env.CODEX_MODEL);\n            id = env.CODEX_MODEL;\n        }\n        let reasoning = parts[2] || 'high';\n        if (!VALID_REASONING[reasoning]) {\n            log('models: unknown reasoning ' + reasoning + ' — using high');\n            reasoning = 'high';\n        }\n        return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning };\n    }\n    if (CLAUDE_NAMES[head])\n        return { model: head };\n    log('models: unknown spec ' + spec + ' — session-inherited');\n    return {};\n}\nfunction resolveCoderSpec(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return 'codex:' + env.CODEX_MODEL + ':high';\n    return 'opus';\n}\nfunction coderIsCodex(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return true;\n    const codeSpec = env.MODELS.code;\n    if (codeSpec && String(codeSpec).split(':')[0] === 'codex')\n        return true;\n    return false;\n}\nfunction resolveQeSpec(env) {\n    if (coderIsCodex(env))\n        return 'opus';\n    const CODEX_AVAILABLE = env.codexAvailable !== false;\n    if (!CODEX_AVAILABLE)\n        return 'opus';\n    return 'codex:' + topCodexId(env) + ':high';\n}\nfunction routingRequested(env) {\n    return (Object.keys(env.MODELS).length > 0 ||\n        env.PLANNER === 'codex' ||\n        env.CODER === 'codex' ||\n        env.CODER === 'codex-fallback' ||\n        env.QE_REVIEWER === 'codex' ||\n        env.QE_REVIEWER === 'codex-fallback');\n}\nfunction resolveStageModel(stage, env) {\n    if (env.usageOverride) {\n        const r = (env.usageReasoning && env.usageReasoning[stage]) || OVERRIDE_REASONING[stage] || 'high';\n        const o = specToOpts('codex:' + topCodexId(env) + ':' + r, env);\n        o._usageSwitched = true;\n        return o;\n    }\n    let spec = env.MODELS[stage];\n    if (spec === undefined) {\n        if (!routingRequested(env))\n            return {};\n        spec = DEFAULT_MODELS[stage];\n    }\n    if (stage === 'code' && (spec === null || spec === undefined))\n        return specToOpts(resolveCoderSpec(env), env);\n    if (stage === 'qe' && (spec === null || spec === undefined))\n        return specToOpts(resolveQeSpec(env), env);\n    return specToOpts(spec, env);\n}\nfunction modelLabel(opts) {\n    if (opts && opts.agentType === 'codex:codex-rescue') {\n        const base = 'codex:' + opts.codexModel + ':' + opts._reasoning;\n        return opts._usageSwitched ? base + ' (usage-switched)' : base;\n    }\n    if (opts && opts.model)\n        return opts.model;\n    return 'session';\n}\nfunction stageLabel(base, opts) {\n    const m = modelLabel(opts);\n    return m === 'session' ? base : base + ' · ' + m;\n}\nfunction mergeOpts(base, extra) {\n    const out = {};\n    for (const k in base)\n        out[k] = base[k];\n    for (const k in extra)\n        out[k] = extra[k];\n    return out;\n}",
+    code: "const OVERRIDE_REASONING = {\n    router: 'high',\n    requirements: 'xhigh',\n    research: 'xhigh',\n    adr: 'xhigh',\n    ideation: 'xhigh',\n    ddd: 'xhigh',\n    architecture: 'xhigh',\n    plan: 'xhigh',\n    code: 'xhigh',\n    qe: 'high',\n    fleet: 'high',\n};\nfunction topCodexId(env) {\n    let top = env.CODEX_MODEL;\n    if (top === 'auto') {\n        const ids = Object.keys(KNOWN_CODEX);\n        for (let i = 0; i < ids.length; i++) {\n            if (ids[i] !== 'auto')\n                top = ids[i] || top;\n        }\n    }\n    return top;\n}\nconst KNOWN_CODEX = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-luna': 1, 'gpt-5.6-terra': 1, 'gpt-5.6-sol': 1 };\nconst CLAUDE_NAMES = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };\nconst VALID_REASONING = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1 };\nconst DEFAULT_MODELS = {\n    router: 'fable',\n    requirements: 'sonnet',\n    research: 'sonnet',\n    adr: 'opus',\n    ideation: 'sonnet',\n    ddd: 'opus',\n    architecture: 'opus',\n    plan: 'sonnet',\n    code: null,\n    qe: null,\n    fleet: 'sonnet',\n};\nfunction specToOpts(spec, env) {\n    const log = env.log || function () { };\n    if (!spec)\n        return {};\n    const parts = String(spec).split(':');\n    const head = parts[0] || '';\n    if (head === 'codex') {\n        let id = parts[1] || env.CODEX_MODEL;\n        if (id !== 'auto' && !KNOWN_CODEX[id]) {\n            log('models: unknown codex id ' + id + ' — using ' + env.CODEX_MODEL);\n            id = env.CODEX_MODEL;\n        }\n        let reasoning = parts[2] || 'high';\n        if (!VALID_REASONING[reasoning]) {\n            log('models: unknown reasoning ' + reasoning + ' — using high');\n            reasoning = 'high';\n        }\n        return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning };\n    }\n    if (CLAUDE_NAMES[head])\n        return { model: head };\n    log('models: unknown spec ' + spec + ' — session-inherited');\n    return {};\n}\nfunction resolveCoderSpec(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return 'codex:' + env.CODEX_MODEL + ':high';\n    return 'opus';\n}\nfunction coderIsCodex(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return true;\n    const codeSpec = env.MODELS.code;\n    if (codeSpec && String(codeSpec).split(':')[0] === 'codex')\n        return true;\n    return false;\n}\nfunction resolveQeSpec(env) {\n    if (coderIsCodex(env))\n        return 'opus';\n    const CODEX_AVAILABLE = env.codexAvailable !== false;\n    if (!CODEX_AVAILABLE)\n        return 'opus';\n    return 'codex:' + topCodexId(env) + ':high';\n}\nfunction routingRequested(env) {\n    return (Object.keys(env.MODELS).length > 0 ||\n        env.PLANNER === 'codex' ||\n        env.CODER === 'codex' ||\n        env.CODER === 'codex-fallback' ||\n        env.QE_REVIEWER === 'codex' ||\n        env.QE_REVIEWER === 'codex-fallback');\n}\nfunction resolveStageModel(stage, env) {\n    if (env.usageOverride) {\n        const r = (env.usageReasoning && env.usageReasoning[stage]) || OVERRIDE_REASONING[stage] || 'high';\n        const o = specToOpts('codex:' + topCodexId(env) + ':' + r, env);\n        o._usageSwitched = true;\n        return o;\n    }\n    let spec = env.MODELS[stage];\n    if (spec === undefined) {\n        if (!routingRequested(env))\n            return {};\n        spec = DEFAULT_MODELS[stage];\n    }\n    if (stage === 'code' && (spec === null || spec === undefined))\n        return specToOpts(resolveCoderSpec(env), env);\n    if (stage === 'qe' && (spec === null || spec === undefined))\n        return specToOpts(resolveQeSpec(env), env);\n    return specToOpts(spec, env);\n}\nfunction modelLabel(opts) {\n    if (opts && opts.agentType === 'codex:codex-rescue') {\n        const base = 'codex:' + opts.codexModel + ':' + opts._reasoning;\n        return opts._usageSwitched ? base + ' (usage-switched)' : base;\n    }\n    if (opts && opts.model)\n        return opts.model;\n    return 'session';\n}\nfunction stageLabel(base, opts) {\n    const m = modelLabel(opts);\n    return m === 'session' ? base : base + ' · ' + m;\n}\nfunction mergeOpts(base, extra) {\n    const out = {};\n    for (const k in base)\n        out[k] = base[k];\n    for (const k in extra)\n        out[k] = extra[k];\n    return out;\n}",
   },
   "usage-probes": {
     name: "usage-probes",

package/src/operations.ts

@@ -196,7 +196,12 @@ function enrichEmitForTarget(
       `interface:`,
       `  display_name: "${name}"`,
       `policy:`,
-      `  allow_implicit_invocation: ${risk.level === 'low' || risk.level === 'medium'}`,
+      // MEASURED (hermes research, codex.md §63, twin-test): codex PARSES this file and
+      // `allow_implicit_invocation: false` HIDES the skill from the session entirely — it is a
+      // visibility switch, not an ask-first switch. Risk-gating through it silently disappeared a
+      // compiled pack (the terraform smoke pack never registered, backlog 2b80420f). Visibility is
+      // therefore ALWAYS true; the risk score stays as INFORMATION for the operator below.
+      `  allow_implicit_invocation: true  # false would HIDE the skill from codex entirely (measured); risk is informational, see risk_level`,
       `  risk_level: "${risk.level}"`,
       `  risk_score: ${risk.total.toFixed(2)}`,
       `  risk_axes:`,
@@ -835,24 +840,39 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
   const nodeMajor = Number(process.versions.node.split('.')[0] ?? '0');
   checks.push({ name: 'node >= 20', ok: nodeMajor >= 20, detail: `node ${process.version}` });
 
-  // 2. Key directories
-  for (const dir of ['.claude/skills', 'packages/@dzhechkov/skills-meta']) {
+  // 2/3. MONOREPO-ONLY checks, gated on PROJECT KIND (backlog fcf29728: in a consumer project
+  // skills-meta and the 10 adapters are not there and MUST not be — both checks were red forever
+  // and dz doctor could never exit 0 outside this repository, a standing false BLOCK for any
+  // consumer CI). Kind detection is structural: a checkout that carries packages/@dzhechkov IS the
+  // monorepo (or a fork of it) and owes itself these checks; anything else is a consumer project
+  // and gets a NAMED skip — a skip, never a silent pass and never a fail.
+  const isMonorepo = existsSync(join(root, 'packages', '@dzhechkov'));
+  checks.push({
+    name: '.claude/skills present',
+    ok: existsSync(join(root, '.claude', 'skills')),
+    detail: '.claude/skills',
+  });
+  if (isMonorepo) {
+    checks.push({
+      name: 'packages/@dzhechkov/skills-meta present',
+      ok: existsSync(join(root, 'packages/@dzhechkov/skills-meta')),
+      detail: 'packages/@dzhechkov/skills-meta',
+    });
+    const adapters = ['adapter-claude', 'adapter-codex', 'adapter-opencode', 'adapter-hermes', 'adapter-openclaude', 'adapter-copilot', 'adapter-agents-md', 'adapter-cursor', 'adapter-gemini', 'adapter-windsurf'];
+    const foundAdapters = adapters.filter((a) => existsSync(join(root, 'packages/@dzhechkov', a)));
+    checks.push({
+      name: 'adapters present',
+      ok: foundAdapters.length === adapters.length,
+      detail: `${foundAdapters.length}/${adapters.length} adapters found`,
+    });
+  } else {
     checks.push({
-      name: `${dir} present`,
-      ok: existsSync(join(root, dir)),
-      detail: dir,
+      name: 'monorepo checks',
+      ok: true,
+      detail: 'consumer project (no packages/@dzhechkov) — skills-meta/adapter checks are the MONOREPO\'s own duty and are skipped here by kind, not by silence',
     });
   }
 
-  // 3. Adapter resolvability (one per target platform)
-  const adapters = ['adapter-claude', 'adapter-codex', 'adapter-opencode', 'adapter-hermes', 'adapter-openclaude', 'adapter-copilot', 'adapter-agents-md', 'adapter-cursor', 'adapter-gemini', 'adapter-windsurf'];
-  const foundAdapters = adapters.filter((a) => existsSync(join(root, 'packages/@dzhechkov', a)));
-  checks.push({
-    name: 'adapters present',
-    ok: foundAdapters.length === adapters.length,
-    detail: `${foundAdapters.length}/${adapters.length} adapters found`,
-  });
-
   // 4. Package version consistency
   const pkgsDir = join(root, 'packages/@dzhechkov');
   if (existsSync(pkgsDir)) {
@@ -937,10 +957,17 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
     const skillDirs = readdirSync(skillsDir, { withFileTypes: true })
       .filter((e) => e.isDirectory() && !e.name.startsWith('.'));
     const withSkillMd = skillDirs.filter((e) => existsSync(join(skillsDir, e.name, 'SKILL.md')));
+    // A visible dir with NO SKILL.md is almost never a broken skill — it is a FOREIGN directory
+    // (measured: a 102-file health-advisor/ residue from an old `ha init` read as «27/28», which a
+    // human parses as "one skill is broken" and goes fixing a skill; the true cure is cleanup).
+    // Name the offenders and say which treatment applies (HA-improvements 2026-08, b5ba7b4a).
+    const foreign = skillDirs.filter((e) => !existsSync(join(skillsDir, e.name, 'SKILL.md'))).map((e) => e.name);
     checks.push({
       name: 'skills health',
       ok: withSkillMd.length === skillDirs.length,
-      detail: `${withSkillMd.length}/${skillDirs.length} skill dirs have SKILL.md`,
+      detail: foreign.length === 0
+        ? `${withSkillMd.length}/${skillDirs.length} skill dirs have SKILL.md`
+        : `${withSkillMd.length}/${skillDirs.length} skill dirs have SKILL.md — ${foreign.length} FOREIGN dir(s) in the skills root (not broken skills; the cure is cleanup, not repair): ${foreign.slice(0, 5).join(', ')}${foreign.length > 5 ? ', …' : ''}`,
     });
   }
 
@@ -1007,14 +1034,20 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
         const usageLog = join(root, '.dz', 'recall-usage.jsonl');
         const { newest, hasCodexRow } = newestRecallUsageRuntime(usageLog);
         const fresh = newest !== undefined && Date.now() - Date.parse(newest) < 14 * 24 * 60 * 60 * 1000;
+        // In a CONSUMER project the machine-global hook is wired but a FRESH project has zero rows
+        // by construction — dead-leg and new-project are indistinguishable there, and a permanent
+        // red on arrival is a false CI block (fcf29728). The row degrades to an ADVISORY (ok:true,
+        // wording intact) outside the monorepo; in the monorepo it stays the hard row that killed
+        // the 19-day dark leg.
+        const applyLegOk = hasCodexRow && fresh;
         checks.push({
           name: 'codex apply-leg (recall hook)',
-          ok: hasCodexRow && fresh,
-          detail: hasCodexRow
+          ok: isMonorepo ? applyLegOk : true,
+          detail: (isMonorepo || applyLegOk ? '' : 'advisory (consumer project — a fresh store has no rows by construction): ') + (hasCodexRow
             ? fresh
               ? `codex recall rows present, newest ${newest}`
               : `codex recall hook is WIRED but SILENT: newest recall-usage row is ${String(newest)} — the entry may have lost hook trust (re-run dz hooks-sync --target codex --verify)`
-            : 'codex recall hook is WIRED but has NEVER written a row — a dead leg looks exactly like a correctly-silent one, so this is reported non-OK until one lands',
+            : 'codex recall hook is WIRED but has NEVER written a row — a dead leg looks exactly like a correctly-silent one, so this is reported non-OK until one lands'),
         });
       }
     }

package/src/publish.ts

@@ -89,6 +89,68 @@ function maxPublished(name: string, localVersion: string): string {
   return pub !== undefined && compareVersions(pub, localVersion) > 0 ? pub : localVersion;
 }
 
+// ── workspace-floor preflight (feature workspace-dep-protocol, Codex P1) ─────
+//
+// Sibling deps are declared `workspace:^`, and pnpm rewrites them at pack time to `^<the sibling's
+// DISK version>`. That version is not necessarily PUBLISHED: `--bump-only` stages versions on disk,
+// and a later `--filter`ed publish of just the dependent would ship a floor nobody can install —
+// the publish itself succeeds, and every consumer `npm install` then fails with ETARGET. Staged is
+// not shipped; this preflight makes the difference a refusal instead of a broken release.
+
+/**
+ * Pure half: which `workspace:`-declared deps of a package would pack to a floor that is neither
+ * being published in this batch nor already on the registry?
+ *
+ * Fail-closed by design: a probe that cannot answer (offline, 404) reports the floor as
+ * unpublished — a publish needs the network anyway, and refusing beats shipping ETARGET.
+ */
+export function findUnpublishedWorkspaceFloors(opts: {
+  readonly dependencies: Record<string, string> | undefined;
+  /** pnpm rewrites `workspace:` in peerDependencies at pack time too (Codex P2) — same hazard. */
+  readonly peerDependencies?: Record<string, string> | undefined;
+  /** name → version on DISK, for every package in the workspace (what pnpm packs the floor from). */
+  readonly workspaceVersions: ReadonlyMap<string, string>;
+  /**
+   * Names whose publish has LANDED (or, in a dry-run preview, would land) BEFORE this package.
+   * Static batch membership is not enough (Codex P1): a sibling that failed its own gates earlier
+   * in the batch has no published floor, and its dependents must fall through to the probe.
+   */
+  readonly batch: ReadonlySet<string>;
+  readonly probe: (name: string, version: string) => boolean;
+}): { name: string; version: string }[] {
+  const missing: { name: string; version: string }[] = [];
+  const seen = new Set<string>();
+  // Sections are inspected INDEPENDENTLY, never object-merged: a plain peer range for the same
+  // sibling would overwrite a `workspace:^` dependency entry in a spread, and pnpm still rewrites
+  // the dependency section — the protocol in EITHER section makes the floor pack from disk.
+  const entries = [...Object.entries(opts.dependencies ?? {}), ...Object.entries(opts.peerDependencies ?? {})];
+  for (const [dep, spec] of entries) {
+    if (!String(spec).startsWith('workspace:')) continue;
+    if (seen.has(dep)) continue;
+    seen.add(dep);
+    if (opts.batch.has(dep)) continue; // publishes before this package (deps-first order)
+    const version = opts.workspaceVersions.get(dep);
+    if (version === undefined) {
+      // A workspace: spec naming a package that is not in the workspace — pnpm pack would die on
+      // it anyway, but die HERE with a name, not mid-batch.
+      missing.push({ name: dep, version: '(not in workspace)' });
+      continue;
+    }
+    if (!opts.probe(dep, version)) missing.push({ name: dep, version });
+  }
+  return missing;
+}
+
+/** Registry probe: is exactly `name@version` published? Empty output / 404 / offline ⇒ no. */
+function versionPublished(name: string, version: string): boolean {
+  try {
+    const out = execSync(`npm view ${name}@${version} version`, { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8', timeout: 20000 }).trim();
+    return out === version;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * `execSync` throws an Error whose `.message` is only `Command failed: <cmd>` — the child's real output
  * (the `npm ERR!` lines that say WHY a publish failed) sits on `.stdout` / `.stderr` and was being
@@ -331,6 +393,13 @@ export function publishPackages(
     claimGate?: 'off' | 'warn' | 'error' | undefined;
     /** ADR-001: `auto` (default) decides from the environment; `on` fails where it cannot work. */
     provenance?: ProvenanceMode | undefined;
+    /**
+     * Floor probe injection for the workspace-floor preflight (see
+     * `findUnpublishedWorkspaceFloors`). Default: a real `npm view` probe, which runs only on LIVE
+     * publishes — dry-run stays offline, matching `maxPublished`. Injecting a probe also arms the
+     * preflight under dry-run, which is how the wiring test drives it without network.
+     */
+    probeFloor?: ((name: string, version: string) => boolean) | undefined;
   } = {},
 ): PublishReport {
   // Decide ONCE, before the batch: `--provenance` in an incapable environment must fail here, not on
@@ -346,6 +415,15 @@ export function publishPackages(
   // freshly-bumped version, never a stale one (the harness-cli@0.3.122 breakage).
   const ordered = orderByDependencies(filtered);
 
+  // Workspace-floor preflight inputs: the full workspace version map (what pnpm would pack each
+  // floor from), and the names whose publish has LANDED so far in this run — grown as the loop
+  // proceeds, never assumed from batch membership (Codex P1: a sibling that failed its own gates
+  // has no published floor, and static membership would still have covered its dependents).
+  const workspaceVersions = new Map(packages.map((p) => [p.name, p.version]));
+  const landedInBatch = new Set<string>();
+  const armFloorPreflight = opts.bumpOnly !== true && (opts.dryRun !== true || opts.probeFloor !== undefined);
+  const probeFloor = opts.probeFloor ?? versionPublished;
+
   for (const pkg of ordered) {
     const oldVersion = pkg.version;
     // Bump from max(local, npm-published) so a locally-reverted version can't
@@ -370,6 +448,24 @@ export function publishPackages(
       continue;
     }
 
+    // Workspace-floor preflight (Codex P1, feature workspace-dep-protocol): a `workspace:^` dep
+    // packs to `^<sibling's DISK version>` — refuse if that floor is neither in this batch nor on
+    // the registry, or the publish succeeds and every consumer install dies with ETARGET.
+    if (armFloorPreflight) {
+      const manifest = JSON.parse(readFileSync(join(pkg.dir, 'package.json'), 'utf-8')) as { dependencies?: Record<string, string>; peerDependencies?: Record<string, string> };
+      const unpublishedFloors = findUnpublishedWorkspaceFloors({ dependencies: manifest.dependencies, peerDependencies: manifest.peerDependencies, workspaceVersions, batch: landedInBatch, probe: probeFloor });
+      if (unpublishedFloors.length > 0) {
+        results.push({
+          name: pkg.name,
+          oldVersion,
+          newVersion,
+          status: 'error',
+          error: `workspace floor(s) not published: ${unpublishedFloors.map((f) => `${f.name}@${f.version}`).join(', ')}. Publish the sibling(s) first or include them in --filter — a staged disk version is not a shipped one.`,
+        });
+        continue;
+      }
+    }
+
     // Pre-publish claim-check gate. Default `'warn'` per ADR-001: publishing SURFACES a
     // README's untagged claims by default, but `'warn'` NEVER changes publish status, so the
     // existing publish path is unaffected. `'error'` fails only THIS package when it carries a
@@ -405,6 +501,7 @@ export function publishPackages(
 
     if (opts.dryRun) {
       results.push({ name: pkg.name, oldVersion, newVersion, status: 'skipped', claimCheck: claimCheckSummary });
+      landedInBatch.add(pkg.name); // preview: this package passed its gates and WOULD land
       continue;
     }
 
@@ -511,6 +608,7 @@ export function publishPackages(
       });
 
       results.push({ name: pkg.name, oldVersion, newVersion, status: 'published', claimCheck: claimCheckSummary });
+      landedInBatch.add(pkg.name); // only an ACTUAL publish covers dependents (Codex P1)
     } catch (err) {
       // The version was written BEFORE build+publish; on any failure restore the
       // original package.json (and README, if we rewrote its version) so a failed

package/src/recall-hook-policy.ts

@@ -26,7 +26,9 @@
  *   where an irrelevant English one reaches 0.254. A single floor still works, with a thin 0.032
  *   margin; per-language floors triple it. Hence the defaults below.
  *
- * The turns that must stay silent do: `"спасибо"` scores 0.259, `"какой статус?"` 0.318 — both under
+ * The turns that must stay silent do (2026-07-09 numbers; re-measured 2026-08-24 — «спасибо» rose
+ * to 0.416 but is cut by the SIGNAL gate before any floor, and «какой статус?» rose to 0.386, which
+ * is what forced the recalibration above): both under
  * every floor here.
  *
  * @packageDocumentation
@@ -46,7 +48,18 @@ export interface RecallFloors {
  * slightly closer to any Latin text than two unrelated Latin texts are to each other — the baseline,
  * not the signal, is what shifts.
  */
-export const DEFAULT_RECALL_FLOORS: RecallFloors = { ru: 0.38, en: 0.31 };
+// RECALIBRATED 2026-08-24 on the LIVE 281-pattern store, end to end through `dz recall --json`
+// (the closeness feature made the true cosine visible, which is what exposed the drift): over the
+// probes that actually REACH the floor — the signal gate cuts "спасибо"/"thanks" first —
+//   ru: min(relevant)=0.409, max(irrelevant)=0.386 ("какой статус?", ABOVE the old 0.38 floor);
+//   en: min(relevant)=0.413, max(irrelevant)=0.332 (nonsense scored 0.327, above the old 0.31).
+// The 2026-07-09 floors were calibrated on 103 patterns; at 281 the irrelevant tail rose. The RU
+// window is now THIN (+0.023) — an honest limit, not a solved problem: it narrows again as the
+// store grows, and the next recalibration should follow the next major store growth.
+// en is 0.36 rather than the live midpoint 0.37 because the hermetic fixture's weakest relevant
+// probe sits at 0.369, and a floor above it would fail the calibration test that guards this file.
+// Probe set + raw results: test/fixtures/recall-floor-live-2026-08-24.json.
+export const DEFAULT_RECALL_FLOORS: RecallFloors = { ru: 0.40, en: 0.36 };
 
 /** Max hits injected into a turn. Three is the ADR default; more is noise, not context. */
 export const DEFAULT_RECALL_HOOK_LIMIT = 3;