@dzhechkov/keysarium 1.5.34 → 1.5.35

package/.dz-manifest.json

@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "0b1de0c5bd3bde4586c64bab4a3ab90a4313c8659f327bfa774d9fe9d7a268b7"
+        "sha256": "5f1e61279a3f6b18e7db46adab9860d3cc95ed31926b122bc8508bf445f11117"
       },
       {
         "path": "README.ru.md",
@@ -29,7 +29,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "36f43e39204a8d1eb2bddebb20223ff87ef2686ce5f090f00c76752006764ecf"
+        "sha256": "206ba50881c8dc2a62ab44af643f314928b52c0b711757f9e1a3d1b0312724bb"
       },
       {
         "path": "scripts/sync-templates.js",
@@ -509,7 +509,7 @@
       },
       {
         "path": "templates/.claude/skills/goap-research-ed25519/SKILL.md",
-        "sha256": "eb9a58ed3fbfb9b1c6627c563b5ce1b5ac9f1f5fb9d148a79441d94422933687"
+        "sha256": "95459a1566b2f88b6fb0c1d2f096f7631d698b95fa156afa26444a7c06e76451"
       },
       {
         "path": "templates/.claude/skills/goap-research-ed25519/references/ed25519-verification.md",
@@ -545,7 +545,7 @@
       },
       {
         "path": "templates/.claude/skills/goap-research-ed25519/scripts/learning_bridge.py",
-        "sha256": "c9aea90ddfba5990b27405ca66a3f90308afa357e227ddad3877f9eee7df6e36"
+        "sha256": "6980dd654d77e296f1ab20a9b7a7c43741fd4125ee44727183c63587421d5503"
       },
       {
         "path": "templates/.claude/skills/goap-research-ed25519/scripts/source_tiers.py",
@@ -557,7 +557,7 @@
       },
       {
         "path": "templates/.claude/skills/goap-research-ed25519/scripts/test_evidence_provenance.py",
-        "sha256": "1be4f63bbe7e77d599c5f0960d92b20a8f7ea6a6d07b30cb1d728f920b7259f2"
+        "sha256": "6825da92d859a299b86bd9bf9910088a95665e0716346e55f0f117d991d25c9b"
       },
       {
         "path": "templates/.claude/skills/knowledge-extractor/SKILL.md",
@@ -965,5 +965,5 @@
       }
     ]
   },
-  "signature": "PtZE6f5DojsJAIbHGO3jNQqfffcLK078tXUBWNMP4Lt/1O6A6SRmzqMqwy1mmIOtvCgDL9o49urvAsCNHjNLCw=="
+  "signature": "e14W9eecgau7bIlWej75568LWR2BC5IMnjU+T14Tz5Cq/2WOySneuN53xfxl3oFJyCUr+vDAojeq4B1gs7wqDg=="
 }

package/README.md

@@ -6,6 +6,15 @@ Full 7-phase pipeline for AI case studies, hackathons, and casariums. Provides s
 
 ---
 
+
+> **`goap-research-ed25519` — self-learning (optional, since this release).** When
+> [`@dzhechkov/harness-cli`](https://www.npmjs.com/package/@dzhechkov/harness-cli) is on PATH, the
+> bundled research skill recalls prior METHOD lessons at the start of an investigation and records new
+> ones at four named moments. Without it the skill behaves exactly as before and says so once — it is
+> detected, never required. A guard refuses to record anything shaped like personal data: a method
+> lesson is written in lower case, carries no digits, and holds no identifier. See
+> `skills/goap-research-ed25519/SKILL.md`.
+
 ## Quick Start
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/keysarium",
-  "version": "1.5.34",
+  "version": "1.5.35",
   "description": "AI Case Research Toolkit for Claude Code — full 7-phase pipeline with feature-adr, dream cycles, background workers, multi-platform support, reward learning, and Cloud.ru AI Factory mapping (--ai-factory flag)",
   "main": "src/cli.js",
   "bin": {

package/sbom.json

@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0b1de0c5bd3bde4586c64bab4a3ab90a4313c8659f327bfa774d9fe9d7a268b7"
+          "content": "5f1e61279a3f6b18e7db46adab9860d3cc95ed31926b122bc8508bf445f11117"
         }
       ]
     },
@@ -75,7 +75,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "36f43e39204a8d1eb2bddebb20223ff87ef2686ce5f090f00c76752006764ecf"
+          "content": "206ba50881c8dc2a62ab44af643f314928b52c0b711757f9e1a3d1b0312724bb"
         }
       ]
     },
@@ -1275,7 +1275,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "eb9a58ed3fbfb9b1c6627c563b5ce1b5ac9f1f5fb9d148a79441d94422933687"
+          "content": "95459a1566b2f88b6fb0c1d2f096f7631d698b95fa156afa26444a7c06e76451"
         }
       ]
     },
@@ -1365,7 +1365,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c9aea90ddfba5990b27405ca66a3f90308afa357e227ddad3877f9eee7df6e36"
+          "content": "6980dd654d77e296f1ab20a9b7a7c43741fd4125ee44727183c63587421d5503"
         }
       ]
     },
@@ -1395,7 +1395,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1be4f63bbe7e77d599c5f0960d92b20a8f7ea6a6d07b30cb1d728f920b7259f2"
+          "content": "6825da92d859a299b86bd9bf9910088a95665e0716346e55f0f117d991d25c9b"
         }
       ]
     },

package/templates/.claude/skills/goap-research-ed25519/SKILL.md

@@ -97,8 +97,11 @@ The accepted form has three properties, all checkable: **no digits** (spelled-ou
 values count — `eight point zero four` is a value), **no identifiers**, and **lower
 case** after the first word. The last one replaced an attempt to detect names: a name
 is any word, no list of them exists, and the attempt let `John Smith has HIV` through.
-Lower case costs a keystroke and closes that hole. ALL-CAPS and mixed-case acronyms
-(`SHBG`, `TSH`, `apoB`) are unaffected — they are how method lessons speak.
+Lower case costs a keystroke and closes that hole. Acronyms are unaffected — a token
+passes if it is fully upper (`SHBG`, `TSH`) or opens lower (`apoB`, `mmHg`); only Title
+Case is refused, because Title Case is the shape of a name. A token mixing letters with
+a long digit run (`ab1234567`, `NCT04368728`) is an identifier and is refused however it
+is punctuated, while a short lab acronym carrying a digit (`hba1c`) is not.
 
 Pass `--allow-numbers` when the number IS the knowledge (a guideline threshold) and
 you take responsibility for it. It never waves through a person beside a number.

package/templates/.claude/skills/goap-research-ed25519/scripts/learning_bridge.py

@@ -76,7 +76,13 @@ BOOST_NOTE_TAILS = (
 def _boost_note_present(out: str, domain: str = LEARNING_DOMAIN) -> bool:
     """True when THIS dz printed a real domain-boost note (not a lesson quoting one)."""
     head = f'domain "{domain}":'
-    for line in out.splitlines():
+    # split("\n"), NOT splitlines(). Python's splitlines() also breaks on U+2028,
+    # U+0085 and friends, which the CLI does not treat as line breaks — so a lesson
+    # containing one produced a "line" the renderer never emitted, and that forged line
+    # could satisfy this probe. Splitting exactly the way the producer joins keeps a
+    # forged tail stuck on a line that starts with the hit prefix, where the anchor
+    # below rejects it.
+    for line in out.split("\n"):
         stripped = line.strip()
         if stripped.startswith(head) and any(tail in stripped for tail in BOOST_NOTE_TAILS):
             return True
@@ -151,6 +157,13 @@ _IDENTIFIER_PATTERNS: Sequence[Tuple[str, str, bool]] = (
     (r"\+?\d[\d\s().-]{7,}\d", "something shaped like a phone number", True),
     (r"\b(mrn|снилс|полис|истори\w* болезни|medical record (no|number)|record no)\b[:\s#]*\w*",
      "a medical-record identifier", True),
+    # Round 4: the TOKEN check refused `ab1234567`, so the same identifier written
+    # `ab—1234567` or `ab/1234567` was split by the tokenizer into a lower-case word
+    # and a permitted number — laundered by punctuation. This reads the RAW text, where
+    # the joiner is still visible. A SPACE is deliberately not a joiner here, or every
+    # "the 2019 guideline" would be refused.
+    (r"\b[A-Za-zА-Яа-я]{2,}[—–/._-]?\d{4,}\b",
+     "letters sitting against a long run of digits — that is an identifier, however it is punctuated", False),
 )
 
 # THE CAPITALISATION RULE — round 2 forced this rewrite.
@@ -190,8 +203,25 @@ _TOKEN_EDGE_PUNCT = " \t\n\r.,;:!?()[]{}\"'«»„“”‘’—–-/\\|*_`"
 
 
 def _is_acronym(token: str) -> bool:
-    """Two or more capitals in one token: SHBG, HIV, apoB, HbA1c. A name has one."""
-    return sum(1 for ch in token if ch.isupper()) >= 2
+    """An acronym, as opposed to a name.
+
+    Round 4 killed the previous rule ("two or more capitals"), which was wrong in BOTH
+    directions at once: `Anne-Marie` and `McDonald` carry two capitals and sailed
+    through as acronyms, while `apoB` carries one and was refused — contradicting the
+    documentation in the same repository that offered it as the example.
+
+    What actually separates the two is WHERE the first capital sits. A name is Title
+    Case: capital first, lower case after. An acronym is either fully upper (SHBG, HIV,
+    TSH) or starts lower and capitalises later (apoB, mmHg). So: accept a token whose
+    first letter is lower case, or one whose letters are ALL upper case. Refuse
+    anything that opens with a capital and then drops to lower case, whatever it is.
+    """
+    letters = [ch for ch in token if ch.isalpha()]
+    if not letters:
+        return False
+    if not letters[0].isupper():
+        return True   # apoB, mmHg — lower-case opening is never a name
+    return all(ch.isupper() for ch in letters)   # SHBG, HIV, D
 
 
 # Splitting on whitespace ALONE was the last hole round 3 found: `method—John has HIV`
@@ -212,6 +242,13 @@ def _tokens(raw: str) -> List[str]:
 # not a measurement in any unit system; it is a label for one thing.
 _NUMBER_TOKEN_RE = r"^[<>≥≤~±]?\d+([.,]\d+)?[a-zа-яё%°]{0,4}$"
 
+# …but a few real lab acronyms carry a digit (`HbA1c`, `CYP2D6`). What separates them
+# from an accession is SIZE: an identifier has to be long enough to be unique. So a
+# mixed token is an identifier when it is long or digit-heavy, and a lab acronym
+# otherwise. The bound is a judgement call and is stated rather than hidden.
+_IDENTIFIER_MIN_LEN = 7
+_IDENTIFIER_MIN_DIGITS = 4
+
 # A reference to ONE person. Alone it is fine — a method sentence may discuss patients
 # in the abstract. Beside a value it is load-bearing: a person plus a reading is a
 # record, and no --allow-numbers waves that through.
@@ -285,7 +322,9 @@ def check_lesson(text: str, allow_numbers: bool = False) -> LessonVerdict:
     for index, token in enumerate(tokens):
         has_digit = any(ch.isdigit() for ch in token)
         has_alpha = any(ch.isalpha() for ch in token)
-        if has_digit and has_alpha and not re.match(_NUMBER_TOKEN_RE, token):
+        digit_count = sum(1 for ch in token if ch.isdigit())
+        looks_like_id = len(token) >= _IDENTIFIER_MIN_LEN or digit_count >= _IDENTIFIER_MIN_DIGITS
+        if has_digit and has_alpha and looks_like_id and not re.match(_NUMBER_TOKEN_RE, token):
             reasons.append(
                 f"{token!r} mixes letters and digits — that is the shape of an identifier "
                 "(a record number, an accession, a passport), not of a measurement, and no "
@@ -301,7 +340,8 @@ def check_lesson(text: str, allow_numbers: bool = False) -> LessonVerdict:
         reasons.append(
             f"a capitalised word ({token!r}) after the first one — a method lesson is written "
             "in lower case, because one capital is the shape of a name and names cannot be "
-            "listed. Lower-case it (acronyms like SHBG, TSH or apoB carry two capitals and pass)"
+            "listed. Lower-case it — an acronym passes either fully upper (SHBG, TSH) or opening "
+            "lower (apoB); only Title Case is refused"
         )
         break
 

package/templates/.claude/skills/goap-research-ed25519/scripts/test_evidence_provenance.py

@@ -676,7 +676,11 @@ class LearningBridgeTests(unittest.TestCase):
         for ok_text in (
             "total testosterone is uninterpretable without SHBG",
             "a single ferritin cannot separate overload from inflammation, pair it with CRP",
-            "apoB tracks risk better than LDL alone",
+            # NOT first in the sentence — round 4 found this test placed `apoB` at the
+            # start, where the sentence-start exemption made it pass no matter what the
+            # acronym rule did. A test whose subject sits in the one exempt position
+            # proves nothing about the rule it claims to cover.
+            "measure apoB before interpreting LDL alone",
         ):
             with self.subTest(text=ok_text):
                 self.assertTrue(self.lb.check_lesson(ok_text).ok, ok_text)
@@ -766,6 +770,48 @@ class LearningBridgeTests(unittest.TestCase):
                                              allow_numbers=True).ok)
 
 
+    # ---------------------------------------------------------------- round 4
+
+    def test_round4_acronym_vs_name_is_decided_by_WHERE_the_capital_sits(self):
+        """The previous predicate — "two or more capitals" — was wrong in both
+        directions at once: `Anne-Marie` and `McDonald` passed as acronyms while
+        `apoB` was refused, contradicting this repo's own documentation."""
+        for name in ("patient Anne-Marie has HIV", "patient McDonald has HIV"):
+            with self.subTest(name=name):
+                self.assertFalse(self.lb.check_lesson(name).ok, name)
+        for acronym in ("measure apoB before interpreting risk",
+                        "total testosterone is uninterpretable without SHBG"):
+            with self.subTest(acronym=acronym):
+                self.assertTrue(self.lb.check_lesson(acronym).ok, acronym)
+
+    def test_round4_punctuation_cannot_launder_an_identifier(self):
+        """`ab1234567` was refused, so the same identifier written `ab—1234567` was
+        split by the tokenizer into a lower-case word plus a permitted number. The raw
+        text still shows the joiner, so that is where this one is checked."""
+        for leak in ("passport ab—1234567 identifies the holder",
+                     "passport ab/1234567 identifies the holder",
+                     "trial NCT—04368728 enrolled a cohort"):
+            with self.subTest(leak=leak):
+                self.assertFalse(self.lb.check_lesson(leak, allow_numbers=True).ok, leak)
+        # A YEAR is not an identifier: a space is deliberately not a joiner.
+        self.assertTrue(self.lb.check_lesson("the 2019 guideline moved the threshold",
+                                             allow_numbers=True).ok)
+        # …and a short lab acronym carrying a digit still passes.
+        self.assertTrue(self.lb.check_lesson("hba1c drifts with red-cell turnover",
+                                             allow_numbers=True).ok)
+
+    def test_round4_the_probe_cannot_be_forged_by_an_exotic_line_separator(self):
+        """`splitlines()` breaks on U+2028 and U+0085, which the renderer does not treat
+        as line breaks — so a lesson containing one produced a 'line' the CLI never
+        emitted, and that forged line satisfied the capability probe. Splitting exactly
+        the way the producer joins keeps a forged tail on the hit's own line."""
+        tail = 'domain "health-research": order unchanged, nothing was hidden'
+        self.assertFalse(self.lb._boost_note_present("  [0.90] (general) x\u2028" + tail))
+        self.assertFalse(self.lb._boost_note_present("  [0.90] (general) x " + tail))
+        # A REAL note — its own line — is still detected.
+        self.assertTrue(self.lb._boost_note_present("  [0.90] (general) x\n  " + tail))
+
+
     def test_a_real_failure_is_not_disguised_as_an_old_cli(self):
         """A crash, timeout or corrupt store must read as a failure, not as 'upgrade'."""
         original = self.lb._run_dz