@gcunharodrigues/wrxn 0.10.0 → 0.12.0

package/lib/protect.cjs

@@ -0,0 +1,195 @@
+'use strict';
+
+// WRXN protect — the server-side hard gate (gate-redesign gate-02).
+//
+// A client-side hook can never be hard enforcement (it gates one tool surface, not the repository).
+// The only control that survives every bypass — human terminal, IDE, MCP, API, `--no-verify`, the
+// 2026-06-19 settings.local.json disarm bug — is a SERVER-SIDE GitHub branch ruleset. This module
+// builds and applies the `wrxn-main-gate` ruleset on a repo's `origin`: block direct push to the
+// default branch, require a PR (0 approvals — a solo account auto-merges its own PR), require the
+// `wrxn-ci` status check, require the branch up to date (race-safety), and NO bypass actor.
+//
+// Application is idempotent (create-or-update BY NAME — re-run = no-op) and fail-soft (no `gh`, not a
+// repo admin, no remote, or any non-zero exit → a clear message and exit 0, never a throw, so it can
+// never break `wrxn update` on a remote-less install). REUSE of lib/connect.cjs's injectable-invoker
+// shape: an injected `invoker` makes unit tests deterministic; the real `spawnSync gh`/`git` runs only
+// when no invoker is injected (the CLI layer) — that is what makes the application "validated by
+// invocation". The ruleset is repo-agnostic via `~DEFAULT_BRANCH`, so the SAME spec protects any
+// default-main repo (the kernel, every install, and the recon-wrxn sibling — gate-06).
+//
+// lib/protect.cjs is package code (invoked via bin/wrxn.cjs), NOT payload — no manifest entry,
+// consistent with lib/connect.cjs / lib/ship.cjs / lib/executor.cjs / lib/onboard.cjs.
+
+const { spawnSync } = require('child_process');
+
+const RULESET_NAME = 'wrxn-main-gate';
+const DEFAULT_CHECK = 'wrxn-ci';
+
+/**
+ * Build the `wrxn-main-gate` GitHub repository-ruleset payload. PURE — a fresh, independent object
+ * each call, no side effects. The authoritative payload (gate-02 API contract): block direct push to
+ * the default branch, require a PR with 0 approvals, require `requiredCheck` strict (up-to-date), no
+ * bypass actor. `~DEFAULT_BRANCH` keeps it repo-agnostic (no hard-coded `main`).
+ * @param {{ requiredCheck?: string }} [opts]
+ * @returns {object} the ruleset payload for POST/PUT `/repos/{slug}/rulesets`
+ */
+function buildRulesetSpec({ requiredCheck = DEFAULT_CHECK } = {}) {
+  return {
+    name: RULESET_NAME,
+    target: 'branch',
+    enforcement: 'active',
+    bypass_actors: [],
+    conditions: { ref_name: { include: ['~DEFAULT_BRANCH'], exclude: [] } },
+    rules: [
+      { type: 'deletion' },
+      { type: 'non_fast_forward' },
+      {
+        type: 'pull_request',
+        parameters: {
+          required_approving_review_count: 0,
+          dismiss_stale_reviews_on_push: false,
+          require_code_owner_review: false,
+          require_last_push_approval: false,
+          required_review_thread_resolution: false,
+        },
+      },
+      {
+        type: 'required_status_checks',
+        parameters: {
+          strict_required_status_checks_policy: true,
+          required_status_checks: [{ context: requiredCheck }],
+        },
+      },
+    ],
+  };
+}
+
+/**
+ * The real command invoker — a single spawnSync (mirrors lib/ship.cjs / lib/connect.cjs defaultInvoke).
+ * Captures stdout (needed to parse the ruleset list) and passes a body on stdin (the create/update).
+ * The CLI layer wires this implicitly (no injected invoker) — that is what makes the apply real.
+ * @returns {{ ok:boolean, status:number|null, stdout:string, stderr:string }}
+ */
+function defaultInvoke({ cmd, args, input }) {
+  const r = spawnSync(cmd, args, { encoding: 'utf8', input: input || undefined });
+  // Judge a child by its EXIT STATUS, not by whether we finished writing its stdin. The real `gh api
+  // ... --input -` reads the body from stdin; if it (or a stub) exits before draining it, spawnSync's
+  // stdin write races the child's exit and surfaces an EPIPE in `r.error` — yet it still captures the
+  // real `status`/`stdout`. Only a spawn that NEVER ran (e.g. ENOENT — `status` stays null) is a true
+  // failure here; an EPIPE on a child that exited 0 is a success, not a "command not found" skip.
+  if (r.error && r.status == null) {
+    return { ok: false, status: null, stdout: '', stderr: r.error.code || r.error.message };
+  }
+  return { ok: r.status === 0, status: r.status, stdout: r.stdout || '', stderr: r.stderr || '' };
+}
+
+/** A fail-soft skip result — a logged-elsewhere reason, never a throw, so it never breaks `wrxn update`. */
+function softSkip(reason) {
+  return { ok: false, action: 'skipped', reason };
+}
+
+/** One-line failure detail from an invoker result (status + first stderr line). */
+function detailOf(r) {
+  const status = r.status == null ? 'no exit (command not found?)' : `exit ${r.status}`;
+  const err = String(r.stderr || '').trim().split('\n')[0];
+  return err ? `${status}: ${err}` : status;
+}
+
+/**
+ * Apply the `wrxn-main-gate` ruleset to `slug`'s repo via `gh api`. Idempotent (list → create-or-update
+ * BY NAME, so a re-run converges to a no-op) and fail-soft (no gh / not admin / no remote / any
+ * non-zero exit → a skipped result carrying a clear reason; NEVER throws). The invoker is injectable so
+ * unit tests are deterministic; the CLI layer uses the real `gh` spawn.
+ * @param {{ invoker?:Function, slug?:string, requiredCheck?:string }} [opts]
+ * @returns {{ ok:boolean, action:'created'|'updated'|'skipped', slug?:string, name?:string, detail?:string, reason?:string }}
+ */
+function applyProtection({ invoker, slug, requiredCheck = DEFAULT_CHECK } = {}) {
+  const run = invoker || defaultInvoke;
+
+  if (!slug || typeof slug !== 'string' || slug.trim() === '') {
+    return softSkip('no origin remote — the wrxn-main-gate ruleset is not applied (a remote-less install is unprotected here; protection lands when it gains a GitHub origin)');
+  }
+
+  // 1. list existing rulesets — the idempotency lookup (find one named wrxn-main-gate).
+  const list = run({ cmd: 'gh', args: ['api', `/repos/${slug}/rulesets`] });
+  if (!list.ok) {
+    return softSkip(`could not list rulesets on ${slug} (${detailOf(list)}) — is gh installed, authenticated, and admin on the repo? skipping (exit 0)`);
+  }
+  let rulesets;
+  try {
+    rulesets = JSON.parse(list.stdout || '[]');
+  } catch {
+    return softSkip(`unexpected gh output listing rulesets on ${slug} — skipping`);
+  }
+  const existing = Array.isArray(rulesets) ? rulesets.find((r) => r && r.name === RULESET_NAME) : null;
+  const body = JSON.stringify(buildRulesetSpec({ requiredCheck }));
+
+  // 2. update in place (PUT to the existing id) if present, else create (POST) — re-run = no-op.
+  if (existing) {
+    const put = run({ cmd: 'gh', args: ['api', '--method', 'PUT', `/repos/${slug}/rulesets/${existing.id}`, '--input', '-'], input: body });
+    if (!put.ok) {
+      return softSkip(`could not update the ${RULESET_NAME} ruleset on ${slug} (${detailOf(put)}) — skipping`);
+    }
+    return { ok: true, action: 'updated', slug, name: RULESET_NAME, detail: `${RULESET_NAME} updated on ${slug}` };
+  }
+  const post = run({ cmd: 'gh', args: ['api', '--method', 'POST', `/repos/${slug}/rulesets`, '--input', '-'], input: body });
+  if (!post.ok) {
+    return softSkip(`could not create the ${RULESET_NAME} ruleset on ${slug} (${detailOf(post)}) — is the token a repo admin? skipping`);
+  }
+  return { ok: true, action: 'created', slug, name: RULESET_NAME, detail: `${RULESET_NAME} created on ${slug}` };
+}
+
+/** A well-formed GitHub `owner/repo` slug: owner starts alphanumeric, repo is alnum/`.`/`_`/`-`. */
+const SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9._-]+$/;
+
+/**
+ * Parse an `owner/repo` slug from a git remote URL (ssh `git@host:owner/repo.git`, https
+ * `https://host/owner/repo.git`, with or without the `.git` suffix / a trailing slash) or a bare
+ * `owner/repo`. The captured slug is then VALIDATED against the GitHub owner/repo grammar (gate-02
+ * LOW-1, defense-in-depth): `..` traversal, spaces, `;`, `$()`, backticks, and `--flag`-looking text
+ * are rejected → null, so a malformed remote fail-soft-skips instead of reaching `gh` as data. Returns
+ * null when no well-formed slug can be read — protection then fail-soft-skips.
+ */
+function parseSlug(url) {
+  const s = String(url || '').trim();
+  if (!s) return null;
+  const m = s.match(/(?:^|[:/])([^/:]+\/[^/:]+?)(?:\.git)?\/?$/);
+  const slug = m ? m[1] : null;
+  return slug && SLUG_RE.test(slug) ? slug : null;
+}
+
+/**
+ * Derive the `owner/repo` slug of a repo's `origin` remote. Injectable git invoker for tests; the
+ * real `git` spawn runs at the CLI/update/migration layer. Returns null on no origin / parse failure
+ * (→ applyProtection soft-skips) — never throws.
+ */
+function originSlug(root, { invoker } = {}) {
+  const run = invoker || defaultInvoke;
+  const r = run({ cmd: 'git', args: ['-C', root, 'remote', 'get-url', 'origin'] });
+  if (!r.ok) return null;
+  return parseSlug(r.stdout);
+}
+
+/**
+ * Derive the origin slug of the install at `root` and apply the ruleset to it. The single entry point
+ * the CLI (`wrxn protect`), `wrxn update`, and migration 005 share. Repo-agnostic (the slug is read
+ * from origin, so it works for the kernel, any install, and recon-wrxn) and fail-soft end-to-end (a
+ * remote-less root → applyProtection's no-remote skip; never throws). Both invokers are injectable.
+ * @param {string} root install/repo root
+ * @param {{ gitInvoker?:Function, ghInvoker?:Function, requiredCheck?:string }} [opts]
+ */
+function protectOrigin(root, { gitInvoker, ghInvoker, requiredCheck } = {}) {
+  const slug = originSlug(root, { invoker: gitInvoker });
+  return applyProtection({ slug, invoker: ghInvoker, requiredCheck });
+}
+
+module.exports = {
+  RULESET_NAME,
+  DEFAULT_CHECK,
+  buildRulesetSpec,
+  defaultInvoke,
+  applyProtection,
+  parseSlug,
+  originSlug,
+  protectOrigin,
+};

package/lib/release.cjs

@@ -0,0 +1,51 @@
+'use strict';
+
+/**
+ * The CD type-gate: decide whether a merge to main publishes, and at what bump, by conventional-commit
+ * type. Pure — no I/O. The release.yml workflow reads commit messages from the merged range and gates
+ * the OIDC publish on `release`.
+ */
+
+// Bump precedence: a mixed set releases at the highest applicable bump.
+const RANK = { major: 3, minor: 2, patch: 1 };
+
+/** Classify one commit message → 'major' | 'minor' | 'patch' | null (no release). */
+function classify(message) {
+  const text = String(message);
+  // A `BREAKING CHANGE:`/`BREAKING-CHANGE:` footer is a breaking change regardless of type — major.
+  // Spec-correct: it starts a footer line, so anchor to a line start to avoid prose false-positives.
+  if (/^BREAKING[ -]CHANGE:/m.test(text)) return 'major';
+  const subject = text.split('\n')[0];
+  const m = subject.match(/^([a-z]+)(\([^)]*\))?(!)?:/i);
+  if (!m) return null;
+  const type = m[1].toLowerCase();
+  // The `!` marker (feat!, fix(api)!, refactor!) is a breaking change on ANY type — major.
+  if (m[3] === '!') return 'major';
+  if (type === 'feat') return 'minor';
+  if (type === 'fix' || type === 'perf') return 'patch';
+  return null;
+}
+
+/**
+ * shouldRelease(commits) → { release, bump }. Given the merged commit messages, return whether a merge
+ * publishes and the highest applicable bump.
+ */
+function shouldRelease(commits) {
+  const list = Array.isArray(commits) ? commits : [];
+  let best = null;
+  for (const c of list) {
+    const bump = classify(c);
+    if (bump && (best === null || RANK[bump] > RANK[best])) best = bump;
+  }
+  return { release: best !== null, bump: best };
+}
+
+/**
+ * Split NUL-delimited `git log --format=%B%x00 <range>` output into trimmed commit messages. Pure: the
+ * git read stays at the CLI layer; this just parses what it returns. Empty/blank entries are dropped.
+ */
+function parseLog(raw) {
+  return String(raw).split('\0').map((s) => s.trim()).filter(Boolean);
+}
+
+module.exports = { shouldRelease, parseLog };

package/lib/ship.cjs

@@ -0,0 +1,76 @@
+'use strict';
+
+// WRXN ship — the autonomous promote path (gate-redesign gate-03).
+//
+// Replaces the WRXN_ACTIVE_AGENT / settings.local.json env-flag dance (a 2026-06-19 audit proved
+// it a live no-op) with ONE command that pushes a reviewed branch, opens a PR, and arms
+// auto-merge — GitHub then merges the instant the server-enforced CI gate is green. No env flag,
+// no settings.local.json, no GitHub clicks.
+//
+// buildShipPlan() is PURE: branch/title in → the ordered git + gh command list out (no side
+// effects). It mirrors lib/connect.cjs's split of a pure description from its invocation.
+//
+// lib/ship.cjs is package code (invoked via bin/wrxn.cjs), NOT payload — no manifest entry,
+// consistent with lib/connect.cjs / lib/executor.cjs / lib/onboard.cjs.
+
+const { spawnSync } = require('child_process');
+
+const REMOTE = 'origin';
+const DEFAULT_BASE = 'main';
+
+/**
+ * Build the ordered promote command list for a reviewed branch. PURE — no side effects.
+ * branch → push (publish the branch to origin) → gh pr create → gh pr merge --auto --squash.
+ * @returns {{ label:string, cmd:string, args:string[] }[]}
+ * @throws when branch or title is missing/blank — a malformed promote is never runnable.
+ */
+function buildShipPlan({ branch, title, base = DEFAULT_BASE, body = '' } = {}) {
+  const errors = [];
+  if (typeof branch !== 'string' || branch.trim() === '') errors.push('branch is required (the reviewed branch to promote)');
+  if (typeof title !== 'string' || title.trim() === '') errors.push('title is required (the PR title)');
+  if (errors.length) throw new Error(`cannot build ship plan: ${errors.join('; ')}`);
+  // CF-6 (SEC-LOW-1): the branch is a bare positional in `git push` and `gh pr merge`, so a
+  // dash-leading branch name could be misread as a flag. Fence it behind an end-of-options `--`.
+  // For `gh pr merge` the real flags (--auto/--squash) MUST precede `--` so they still parse as
+  // flags; everything after `--` is positional. (`gh pr create` carries the branch as the value of
+  // --head/--base, not a bare positional, so it needs no separator.)
+  return [
+    { label: 'push', cmd: 'git', args: ['push', '-u', REMOTE, '--', branch] },
+    { label: 'pr-create', cmd: 'gh', args: ['pr', 'create', '--base', base, '--head', branch, '--title', title, '--body', body || ''] },
+    { label: 'auto-merge', cmd: 'gh', args: ['pr', 'merge', '--auto', '--squash', '--', branch] },
+  ];
+}
+
+/**
+ * The real command invoker — a single spawnSync, mirroring lib/connect.cjs's defaultInvoke. The
+ * CLI layer wires this (a real git/gh invocation), which is what makes the promote "validated by
+ * invocation". A step succeeds iff it actually ran (not ENOENT) and exited 0.
+ * @returns {{ ok:boolean, detail:string, status?:number }}
+ */
+function defaultInvoke(step) {
+  const r = spawnSync(step.cmd, step.args, { encoding: 'utf8' });
+  if (r.error) {
+    return { ok: false, detail: `${step.cmd} ${step.args.join(' ')} did not run: ${r.error.code || r.error.message}` };
+  }
+  const tail = r.stderr ? `: ${String(r.stderr).trim()}` : '';
+  return { ok: r.status === 0, status: r.status, detail: `${step.cmd} ${step.args[0]} exited ${r.status}${tail}` };
+}
+
+/**
+ * Run the promote plan through the injected invoker (defaults to the real defaultInvoke at the CLI
+ * layer). Reuses lib/connect.cjs's injectable-invoker shape so unit tests stay deterministic.
+ * @returns {{ ok:boolean, steps:{step:string,ok:boolean,detail:string}[], failed?:string }}
+ */
+function ship({ invoker, branch, title, base, body } = {}) {
+  const plan = buildShipPlan({ branch, title, base, body });
+  const run = invoker || defaultInvoke;
+  const steps = [];
+  for (const step of plan) {
+    const r = run(step);
+    steps.push({ step: step.label, ok: !!r.ok, detail: r.detail });
+    if (!r.ok) return { ok: false, steps, failed: step.label };
+  }
+  return { ok: true, steps };
+}
+
+module.exports = { buildShipPlan, defaultInvoke, ship, REMOTE, DEFAULT_BASE };

package/lib/update.cjs

@@ -7,6 +7,7 @@ const { loadManifest, inProfile } = require('./manifest.cjs');
 const { RECEIPT, MCP_PATH, packageVersion, mergeMcpServer } = require('./install.cjs');
 const { compareVersions } = require('./semver.cjs');
 const { runMigrations } = require('./migrate.cjs');
+const protect = require('./protect.cjs');
 
 /**
  * Pull-based update honoring the three file classes:
@@ -84,7 +85,20 @@ function update(opts) {
   // the next `wrxn update` resumes from the failed migration. See lib/migrate.cjs.
   const migrationsRan = runMigrations(pkgRoot, target, { fromVersion: from, toVersion: to });
 
-  return { from, to, updated, preserved, migrationsRan };
+  // Apply the server-side hard gate (gate-redesign gate-02): the wrxn-main-gate ruleset on the
+  // install's origin. Idempotent (create-or-update by name → a re-update on a protected repo is a
+  // no-op) and fail-soft (no gh / not admin / no remote → a skipped result, never a throw), so it can
+  // never break an update on a remote-less install. The git/gh invokers are injectable for tests.
+  let protection;
+  try {
+    protection = protect.protectOrigin(target, { gitInvoker: opts.gitInvoker, ghInvoker: opts.ghInvoker });
+  } catch (err) {
+    // protection is fail-soft by construction; this is a belt-and-braces guard so a defect there can
+    // never break an `update`.
+    protection = { ok: false, action: 'skipped', reason: `protection error (skipped): ${err.message}` };
+  }
+
+  return { from, to, updated, preserved, migrationsRan, protection };
 }
 
 function readReceipt(target) {

package/manifest.json

@@ -69,17 +69,12 @@
       "profile": "project"
     },
     {
-      "path": ".claude/hooks/enforce-push-authority.cjs",
+      "path": ".claude/hooks/enforce-pipeline-adherence.cjs",
       "class": "managed",
       "profile": "project"
     },
     {
-      "path": ".claude/hooks/enforce-review-marker.cjs",
-      "class": "managed",
-      "profile": "project"
-    },
-    {
-      "path": ".claude/hooks/enforce-tests-on-push.cjs",
+      "path": ".claude/hooks/memory-synth-spawn.cjs",
       "class": "managed",
       "profile": "project"
     },
@@ -153,11 +148,6 @@
       "class": "managed",
       "profile": "project"
     },
-    {
-      "path": ".claude/skills/handoff/SKILL.md",
-      "class": "managed",
-      "profile": "project"
-    },
     {
       "path": ".claude/skills/harvest/SKILL.md",
       "class": "managed",
@@ -438,6 +428,11 @@
       "class": "seeded",
       "profile": "workspace"
     },
+    {
+      "path": ".github/workflows/wrxn-ci.yml",
+      "class": "managed",
+      "profile": "project"
+    },
     {
       "path": ".mcp.json",
       "class": "managed",
@@ -493,6 +488,16 @@
       "class": "state",
       "profile": "project"
     },
+    {
+      "path": ".wrxn/memory-synth.cjs",
+      "class": "managed",
+      "profile": "project"
+    },
+    {
+      "path": ".wrxn/memory.config.json",
+      "class": "seeded",
+      "profile": "project"
+    },
     {
       "path": ".wrxn/sync.cjs",
       "class": "managed",

package/migrations/005-protect-main-gate.cjs

@@ -0,0 +1,32 @@
+'use strict';
+
+const protect = require('../lib/protect.cjs');
+
+/**
+ * 005 — apply the wrxn-main-gate ruleset on existing installs (gate-redesign gate-02).
+ *
+ * The server-side hard gate (block direct push to the default branch, require a PR + the wrxn-ci check,
+ * require the branch up-to-date, no bypass actor) replaces the disarmable settings.local.json env-flag
+ * gate (ADR 0007). `wrxn update` now applies the ruleset to an install's origin as part of its run, but
+ * a pre-0.11.0 install never ran that step — so this migration performs the FIRST application on an
+ * existing install once it reaches the release that carries the gate.
+ *
+ * up() delegates to protect.protectOrigin(ctx.target): derive the install's origin slug and idempotently
+ * create-or-update the ruleset via `gh api`. Repo-agnostic (the slug comes from origin, so the SAME
+ * logic protects the kernel, every install, and the recon-wrxn sibling) and fail-soft by construction —
+ * no gh / not admin / no remote → a skipped result, never a throw. A remote-less install derives no slug
+ * and is a pure no-op (no `gh` call). Defensive like 003/004: the try/catch is belt-and-braces so the
+ * migration can never fail the runner even if protection somehow threw. `version` 0.11.0 = the release
+ * that carries the push-gate redesign (the same release whose `update` gained the protect step).
+ */
+module.exports = {
+  id: '005',
+  version: '0.11.0',
+  up(ctx) {
+    try {
+      protect.protectOrigin(ctx.target);
+    } catch {
+      // protection is fail-soft by design — swallow defensively so the migration never breaks `update`.
+    }
+  },
+};

package/migrations/006-refresh-routing-rule.cjs

@@ -0,0 +1,56 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * 006 — seeded-routing refresh to the PR + CI + auto-merge gate (gate-redesign gate-04).
+ *
+ * `.synapse/routing` is a SEEDED file: `wrxn update` refreshes the managed `.synapse/global`, the
+ * constitution, and the synapse skill docs (all moved to the PR + CI + auto-merge model in gate-04),
+ * but it NEVER overwrites the operator-owned routing seed. So the existing installs keep their OLD
+ * ROUTING_RULE_0 — the retired WRXN_ACTIVE_AGENT=devops confirmation-flag dance, the exact text
+ * migration 002 last wrote — leaving one doctrine echo out of step with the rest of the install.
+ *
+ * up() rewrites ONLY a ROUTING_RULE_0 line that still carries the WRXN_ACTIVE_AGENT marker, replacing
+ * it with the frozen 0.11.0 rule below. The marker is the retired mechanism's own identifier: it is
+ * absent from the new rule (so a second run / an already-refreshed install is a no-op) and from any
+ * operator doctrine (a rule that never named the kernel-internal flag is left untouched). The
+ * startsWith('ROUTING_RULE_0=') clause scopes the rewrite to rule 0 alone — sibling rules, the comment
+ * header, and operator-added ROUTING_RULE_N lines are preserved verbatim, and the split/join
+ * round-trip keeps the trailing newline. A missing or unreadable routing is a clean no-op (the fs work
+ * is wrapped defensively, like 005, so a cosmetic doctrine refresh can never break `wrxn update`).
+ *
+ * The new rule is EMBEDDED as a frozen 0.11.0 constant: a migration is a historical transform of the
+ * release it ships with, not a re-read of the evolving seeded template (ctx carries no pkgRoot, by
+ * design). Idempotency falls out of the gate — after the rewrite the marker is gone. Runs via
+ * `wrxn update` once the install reaches 0.11.0.
+ */
+
+// The PR + CI + auto-merge ROUTING_RULE_0 — mirrors the seeded `.synapse/routing` template at 0.11.0.
+const NEW_ROUTING_RULE_0 =
+  'ROUTING_RULE_0=git push, PR creation, and release tags promote through `wrxn ship` (push the branch → open a PR → arm auto-merge); a server-enforced GitHub ruleset is the gate — it blocks direct pushes to the trunk and merges only when CI is green, so never push directly to the trunk.';
+
+module.exports = {
+  id: '006',
+  version: '0.11.0',
+  up(ctx) {
+    const routingPath = path.join(ctx.target, '.synapse', 'routing');
+    try {
+      if (!fs.existsSync(routingPath)) return;
+      const lines = fs.readFileSync(routingPath, 'utf8').split('\n');
+      let changed = false;
+      const out = lines.map((line) => {
+        if (line.startsWith('ROUTING_RULE_0=') && line.includes('WRXN_ACTIVE_AGENT')) {
+          changed = true;
+          return NEW_ROUTING_RULE_0;
+        }
+        return line;
+      });
+      if (changed) fs.writeFileSync(routingPath, out.join('\n'));
+    } catch {
+      // Defensive (belt-and-braces, like 005): an unreadable/odd routing is a clean no-op — a cosmetic
+      // doctrine refresh must never fail `wrxn update`.
+    }
+  },
+};

package/migrations/007-auto-memory-transition.cjs

@@ -0,0 +1,136 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * 007 — transition existing installs onto auto-memory (auto-memory-05).
+ *
+ * The auto-memory release makes memory automatic: a SessionEnd hook (memory-synth-spawn.cjs) spawns a
+ * background synth that writes the continuity baton and consolidates dream pages — so the manual
+ * `handoff` skill is removed (the synth is the sole baton writer) and the stale `_slots/current-focus`
+ * slot + its `set-focus` op are dropped. The new payload stops shipping the handoff skill and now wires
+ * SessionEnd + ships a seeded `memory.config.json`. But `wrxn update` overwrites managed files in place —
+ * it never PRUNES a removed one — and a seeded file already present is preserved, so a pre-0.12.0 install
+ * still carries the old `handoff` skill files and the stale focus slot, and may lack the new wiring/seed
+ * (e.g. a hand-edited settings.json the managed overwrite left alone, or an install that never had a
+ * config). up() transitions it.
+ *
+ * Steps: (1) remove the install's `handoff` skill dir; (2) wire SessionEnd → memory-synth-spawn.cjs into
+ * the install settings.json IDEMPOTENTLY (add only if absent — if update's managed overwrite already laid
+ * it, this is a safe no-op); a corrupt settings.json is left untouched; (3) seed `memory.config.json` if
+ * absent (the slice-02 default shape); (4) remove the stale `_slots/current-focus.md` focus slot;
+ * (5) backfill the install `.gitignore` for the `.env` secret and the continuity runtime temps the synth/
+ * dream now write (`.wrxn/continuity/.pending`, `.pending-handoff`, the baton `.tmp`, `.dream.*.tmp`) —
+ * slice-02 added `.env` for NEW installs; this closes the gap for OLD ones (slice-04 reviewer F1).
+ *
+ * Defensive like 004: every step is existence-guarded and best-effort (force-rm ignores a missing file),
+ * a missing/clean target is a no-op, a corrupt settings.json is left untouched (never clobber a hand-
+ * edited file — the other steps still run), and the gitignore backfill adds each line at most once.
+ * Idempotent (a second run finds nothing to do) and never throws on an already-clean install. `version`
+ * 0.12.0 = the auto-memory release that carries the transition (the same release whose payload stops
+ * shipping the handoff skill and starts wiring the SessionEnd synth).
+ */
+
+// The .gitignore lines auto-memory needs an install to carry: the `.env` secret (slice-02 added it for
+// NEW installs — backfilled here for OLD ones) + the continuity runtime markers/temps the synth and dream
+// write and clean in a finally, which a SIGKILL could leave behind UNTRACKED (slice-04 reviewer F1). The
+// tracked baton `latest.md` is deliberately NOT ignored — only its dot-prefixed `.tmp` is.
+const GITIGNORE_LINES = [
+  '.env',
+  '.wrxn/continuity/.pending*', // the .pending + .pending-handoff synth markers
+  '.wrxn/continuity/.dream.*.tmp', // dream's per-call blob/batch/stage/approved temps
+  '.wrxn/continuity/.latest.md.*.tmp', // the atomic baton-write temp (rename-over target)
+];
+
+/** Append `line` to `<target>/.gitignore` (create if absent) exactly once — mirrors install.cjs. */
+function ensureGitignoreLine(target, line) {
+  const giPath = path.join(target, '.gitignore');
+  let body = '';
+  try {
+    body = fs.readFileSync(giPath, 'utf8');
+  } catch {
+    body = '';
+  }
+  if (body.split('\n').some((l) => l.trim() === line)) return; // already ignored
+  const prefix = body.length && !body.endsWith('\n') ? '\n' : '';
+  fs.writeFileSync(giPath, body + prefix + line + '\n');
+}
+
+// The SessionEnd spawn hook the auto-memory payload wires (must match payload/.claude/settings.json).
+const SPAWN_HOOK_BASENAME = 'memory-synth-spawn.cjs';
+const SPAWN_HOOK_COMMAND = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/memory-synth-spawn.cjs"';
+
+// Idempotently wire SessionEnd → the spawn hook into a parsed settings config. Adds the hook ONLY if no
+// existing hook command across any event already references it — so a config the managed overwrite already
+// laid (or a prior run) is a safe no-op. Returns true iff the config changed. Preserves every other event.
+function wireSessionEndSpawn(cfg) {
+  if (!cfg || typeof cfg !== 'object') return false;
+  cfg.hooks = cfg.hooks && typeof cfg.hooks === 'object' ? cfg.hooks : {};
+  // already wired anywhere? (mirror unwireHook's whole-config scan) → no-op.
+  for (const groups of Object.values(cfg.hooks)) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      if (!group || !Array.isArray(group.hooks)) continue;
+      if (group.hooks.some((h) => h && typeof h.command === 'string' && h.command.includes(SPAWN_HOOK_BASENAME))) {
+        return false;
+      }
+    }
+  }
+  const event = Array.isArray(cfg.hooks.SessionEnd) ? cfg.hooks.SessionEnd : [];
+  event.push({ hooks: [{ type: 'command', command: SPAWN_HOOK_COMMAND }] });
+  cfg.hooks.SessionEnd = event;
+  return true;
+}
+
+module.exports = {
+  id: '007',
+  version: '0.12.0',
+  up(ctx) {
+    const target = ctx.target;
+
+    // 1. remove the retired `handoff` skill dir (the synth is the sole baton writer now). recursive +
+    //    force = an absent dir is a no-op.
+    fs.rmSync(path.join(target, '.claude', 'skills', 'handoff'), { recursive: true, force: true });
+
+    // 2. wire SessionEnd → memory-synth-spawn.cjs into the install settings.json, idempotently. A corrupt
+    //    file is left untouched (never clobber a hand-edited config); an absent file is left absent (the
+    //    managed overwrite lays the wired settings — the migration only backfills a hand-edited one).
+    const settingsPath = path.join(target, '.claude', 'settings.json');
+    if (fs.existsSync(settingsPath)) {
+      let cfg = null;
+      try {
+        cfg = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+      } catch {
+        cfg = null; // hand-corrupted operator file → never clobber, never crash
+      }
+      if (cfg && typeof cfg === 'object' && wireSessionEndSpawn(cfg)) {
+        fs.writeFileSync(settingsPath, JSON.stringify(cfg, null, 2) + '\n');
+      }
+    }
+
+    // 3. seed memory.config.json if absent (the slice-02 default). Copied from THIS package's payload so
+    //    the seeded shape can never drift from what a fresh install ships. Already present ⇒ preserved
+    //    (it is a seeded, operator-owned file). A missing payload source is swallowed (best-effort).
+    const cfgPath = path.join(target, '.wrxn', 'memory.config.json');
+    if (!fs.existsSync(cfgPath)) {
+      const seedSrc = path.join(__dirname, '..', 'payload', '.wrxn', 'memory.config.json');
+      try {
+        const seed = fs.readFileSync(seedSrc, 'utf8');
+        fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
+        fs.writeFileSync(cfgPath, seed);
+      } catch {
+        // no payload seed reachable → skip (the managed/seeded update path lays it anyway)
+      }
+    }
+
+    // 4. remove the stale `_slots/current-focus.md` focus slot (the slot + its set-focus op are dropped).
+    //    Only the slot PAGE goes — the empty `_slots` tier dir + its gitkeep stay (the tier is retained).
+    //    force = an absent slot is a no-op.
+    fs.rmSync(path.join(target, '.wrxn', 'wiki', '_slots', 'current-focus.md'), { force: true });
+
+    // 5. gitignore backfill — add the `.env` secret + continuity runtime-temp lines (each at most once).
+    //    Closes the gap for installs created before slice-02 added `.env` / before the synth wrote temps.
+    for (const line of GITIGNORE_LINES) ensureGitignoreLine(target, line);
+  },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gcunharodrigues/wrxn",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "WRXN Kernel — installable AI operating system. Two profiles (project | workspace), pull-based updates, managed/seeded/state file classes.",
   "bin": {
     "wrxn": "bin/wrxn.cjs"

package/payload/.claude/agents/builder.md

@@ -26,7 +26,8 @@ you add no behavior the harness does not already define.
 
 ## Constraints (hard)
 - **Never `git push`** — only the devops executor may. Integration happens downstream.
-- Do **not** edit managed (kernel-owned) files without the managed-confirm token.
+- Edit managed (kernel-owned) files only as a deliberate kernel change that lands through the PR + CI
+  gate — a local edit raises a non-blocking advisory; the server-side CI managed-integrity check is the teeth.
 - A review marker (`review-<id>.md`) is required downstream before this work is pushed — do not
   fabricate it.
 - Stay inside the one slice. No scope creep, no speculative features.