@gcunharodrigues/wrxn 0.3.0 → 0.5.0

package/payload/.claude/hooks/recall-surface.cjs

@@ -1,43 +1,48 @@
 #!/usr/bin/env node
 'use strict';
 
-// WRXN recall-surface hook — per-prompt recall nudge (wrxn-kernel-11).
-// UserPromptSubmit. The symmetric RECALL half of reference-detect's CAPTURE: on each prompt it
-// matches the prompt's SALIENT terms against the wiki knowledge tiers (concepts/decisions/gotchas)
-// and, ONLY when a page matches, injects a <recall-surface> nudge — "you already have a page on X,
-// recall it before re-deriving / re-asking the operator". Gated → silent on non-matching prompts.
+// WRXN recall-surface hook — proactive PROSE Recall via the warm Brain door (recon-brain-recall-04).
+// UserPromptSubmit. Replaces the old wiki-substring engine: on each prompt it discovers recon-wrxn's
+// warm serve door, POSTs a prose-scoped hybrid query, and — ONLY when a hit clears the relevance gate
+// — injects a compact <recall-surface> block. Implements ADR 0002.
 //
-// Self-contained: ships into installs, MUST NOT import the kernel lib (node stdlib only). The kernel
-// wiki engine is substring (not BM25) — recall here is a deliberately simple distinct-salient-term
-// count, ranked, top-N. Fail-open: any fault emits {} — the hook NEVER blocks a prompt.
+// The gate (per arm, NEVER the fused RRF score): a prose hit qualifies on the semantic cosine FLOOR
+// (>= 0.4) OR on CONSENSUS (it surfaced in both the BM25 and the dense arm). Nothing clears ⇒ Abstain.
+// Prose only — hits are post-filtered to Page/Section, so code symbols never surface here (they stay
+// on the agent's on-demand recon_* / `wrxn brain query` path).
+//
+// Self-contained: ships into installs, MUST NOT import the kernel lib or recon — node stdlib ONLY
+// (http / fs / path). Fail-open SILENT: a cold/missing/dead door, a slow door, a non-200, malformed
+// JSON, or ANY fault emits {} — the hook NEVER blocks a prompt and never delays it past the hard
+// client timeout. There is NO substring fallback (a weak fallback can itself harm — ADR 0002).
 //
 // Contract: UserPromptSubmit event JSON on stdin → envelope JSON on stdout (exit 0).
+//   inject → { "hookSpecificOutput": { "hookEventName": "UserPromptSubmit", "additionalContext": "<recall-surface>…" } }
+//   abstain → {}
 
 const fs = require('fs');
+const http = require('http');
 const path = require('path');
 
-const TIERS = ['concepts', 'decisions', 'gotchas']; // knowledge tiers; sessions (episodic) excluded
-const TOP_N = 2;
-const MIN_PROMPT_LEN = 8; // skip trivial prompts ("ok", "yes")
-// A page must share >=2 DISTINCT salient terms with the prompt to surface — the substring engine has
-// no BM25 score, so a single shared common word is too weak a signal (anti-noise). Tradeoff: a genuine
-// single-strong-term recall is silenced (fail-silent — a missed nudge is safer than a false one).
-const MIN_DISTINCT = 2;
-const MAX_BLOCK_CHARS = 600;
-
-// Drop stopwords + short tokens so common words don't match common page words (anti-noise).
-const STOPWORDS = new Set(['about', 'after', 'again', 'against', 'because', 'before', 'being', 'between',
-  'could', 'does', 'doing', 'down', 'during', 'each', 'from', 'further', 'have', 'having', 'here', 'how',
-  'into', 'just', 'like', 'more', 'most', 'only', 'other', 'over', 'same', 'should', 'some', 'such',
-  'than', 'that', 'their', 'them', 'then', 'there', 'these', 'they', 'this', 'those', 'through', 'under',
-  'until', 'very', 'want', 'what', 'when', 'where', 'which', 'while', 'with', 'would', 'your', 'today',
-  'tell', 'show', 'give', 'make', 'need', 'know', 'help', 'please', 'thing', 'stuff', 'really', 'going']);
+const MIN_PROMPT_LEN = 8;          // skip trivial prompts ("ok", "yes")
+const MAX_QUERY_CHARS = 512;       // trim the prompt before querying the door
+const FETCH_LIMIT = 15;            // ask the door WIDE — fetch is decoupled from inject so prose ranked
+                                   // below the whole-brain code hits is not truncated before we filter
+const TIMEOUT_MS = 150;            // hard client budget — never delay a prompt past this
+const MAX_RESPONSE_BYTES = 256 * 1024; // hard cap on an accumulated door response body (anti-flood)
+const TOP_N = 3;                   // inject at most 3 hits (the wide fetch is post-filtered down to this)
+const MAX_BLOCK_CHARS = 600;       // injection size cap (ADR 0002: inject little, high-signal)
+const SEMANTIC_FLOOR = 0.4;        // dense cosine floor (reused from P1.5)
+const PROSE_TYPES = new Set(['Page', 'Section']); // prose scope — drop code symbols
+const ENDPOINT_REL = path.join('.recon-wrxn', 'serve-endpoint.json');
+const FIND_PATH = '/api/tools/recon_find';
 
 function emit(envelope) {
   process.stdout.write(JSON.stringify(envelope));
   process.exit(0);
 }
 
+// Walk up from cwd / CLAUDE_PROJECT_DIR to the install root carrying wrxn.install.json.
 function findInstallRoot(startDir) {
   let dir = startDir || process.env.CLAUDE_PROJECT_DIR || process.cwd();
   for (let i = 0; i < 12; i++) {
@@ -49,79 +54,254 @@ function findInstallRoot(startDir) {
   return null;
 }
 
-// De-duped salient content tokens (lowercased, >=4 chars, non-stopword).
-function salientTerms(prompt) {
-  const seen = new Set();
-  for (const tok of (String(prompt || '').toLowerCase().match(/[a-z][a-z0-9]{3,}/g) || [])) {
-    if (!STOPWORDS.has(tok)) seen.add(tok);
+// ── the gate (PURE) ────────────────────────────────────────────────────────────────
+
+function isProse(hit) {
+  return !!hit && PROSE_TYPES.has(hit.type);
+}
+
+// Consensus = the hit surfaced in BOTH the BM25 and the dense arm (the find response's `sources`
+// provenance). A consensus hit qualifies even below the cosine floor.
+function hasConsensus(hit) {
+  const s = hit && hit.sources;
+  return Array.isArray(s) && s.includes('bm25') && s.includes('semantic');
+}
+
+// Qualify on the PER-ARM signal only: the semantic cosine floor OR consensus. NEVER the fused
+// `score` (RRF is a rank-based consensus, not a relevance magnitude — ADR 0002). The floor clause
+// requires the dense arm to actually be PRESENT in `sources` (not just a stray semanticScore) —
+// today these co-occur, but this is a defense against a future producer emitting a score without the
+// 'semantic' tag. An absent/NaN semanticScore can never clear the floor; only consensus rescues it.
+function qualifies(hit) {
+  const sem = Number(hit && hit.semanticScore);
+  const s = hit && hit.sources;
+  const hasSemantic = Array.isArray(s) && s.includes('semantic');
+  const floorOk = Number.isFinite(sem) && sem >= SEMANTIC_FLOOR && hasSemantic;
+  return floorOk || hasConsensus(hit);
+}
+
+function slugify(s) {
+  return String(s || '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 48);
+}
+
+// A stable slug for a hit: the prose file's basename (sans extension), else a slugified name.
+function slugOf(hit) {
+  if (hit.file) {
+    const base = path.basename(String(hit.file)).replace(/\.[^.]+$/, '');
+    if (base) return base.slice(0, 48);
   }
-  return [...seen];
-}
-
-// Score each wiki page by the count of DISTINCT salient terms it contains; keep pages with >=1.
-function recall(root, terms) {
-  const hits = [];
-  for (const tier of TIERS) {
-    const dir = path.join(root, '.wrxn', 'wiki', tier);
-    let names;
-    try {
-      names = fs.readdirSync(dir).filter((n) => n.endsWith('.md'));
-    } catch {
-      continue; // tier absent → skip
-    }
-    for (const name of names) {
-      let text;
-      try {
-        text = fs.readFileSync(path.join(dir, name), 'utf8').toLowerCase();
-      } catch {
-        continue;
-      }
-      const matched = terms.filter((t) => text.includes(t)).length;
-      if (matched >= MIN_DISTINCT) hits.push({ slug: name.replace(/\.md$/, ''), tier, score: matched });
-    }
+  return slugify(hit.name) || 'untitled';
+}
+
+// The one-line descriptor. NOTE: a recon FindHit carries NO body text — only name/file/line/scores —
+// so the snippet is the hit's NAME (the page title / section heading), the most descriptive line
+// available. (Follow-up: if the door later surfaces a per-hit text excerpt, prefer it here.)
+function snippetOf(hit) {
+  const s = String(hit.name || hit.file || '').replace(/\s+/g, ' ').trim();
+  return s.length > 100 ? s.slice(0, 99) + '…' : s;
+}
+
+// Render the qualifying hits into the <recall-surface> block, guaranteed <= MAX_BLOCK_CHARS and
+// always closed. Drops trailing bullets first, then hard-truncates the last line if it still overflows.
+function renderBlock(hits) {
+  const head = '<recall-surface>';
+  const intro = 'Knowledge already in your Brain, recalled for this prompt — read it before re-deriving or re-asking the operator:';
+  const foot = '</recall-surface>';
+  const bullets = hits.map((h) => `- ${slugOf(h)} — ${snippetOf(h)}`);
+  const assemble = (bs) => [head, intro, ...bs, foot].join('\n');
+  const kept = bullets.slice();
+  while (kept.length > 1 && assemble(kept).length > MAX_BLOCK_CHARS) kept.pop();
+  let block = assemble(kept);
+  if (block.length > MAX_BLOCK_CHARS) {
+    block = block.slice(0, MAX_BLOCK_CHARS - foot.length - 1).replace(/\s+\S*$/, '').trimEnd() + '\n' + foot;
+  }
+  return block;
+}
+
+// PURE: prose-filter → gate → top-N → format. Returns the block string, or null (Abstain).
+function decideRecall(hits) {
+  const list = Array.isArray(hits) ? hits : [];
+  const qualified = list.filter((h) => isProse(h) && qualifies(h)).slice(0, TOP_N);
+  if (!qualified.length) return null;
+  return renderBlock(qualified);
+}
+
+// ── the door (IO shell, injectable transport) ───────────────────────────────────────
+
+// A pid is alive unless process.kill(pid,0) throws ESRCH. EPERM means it exists (owned by another
+// user) — still alive. Mirrors the cross-repo discovery contract.
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return !!e && e.code === 'EPERM';
+  }
+}
+
+// Refuse a discovery file another user could have planted, or that is group/world-writable — trusting
+// it would let a hostile workspace point the door host/port at an exfil/injection sink (the hook feeds
+// the door's response into the prompt context). lstat (not stat) so a symlink's OWN ownership/mode is
+// judged. A platform without getuid skips the uid check but still enforces the mode check. Any fault →
+// not trusted (treated as not-warm).
+function endpointTrusted(file) {
+  let st;
+  try {
+    st = fs.lstatSync(file);
+  } catch {
+    return false;
   }
-  // Highest distinct-term count first; ties broken by slug for determinism.
-  hits.sort((a, b) => b.score - a.score || a.slug.localeCompare(b.slug));
-  return hits.slice(0, TOP_N);
+  if (typeof process.getuid === 'function' && st.uid !== process.getuid()) return false; // foreign owner
+  if ((st.mode & 0o022) !== 0) return false; // group/world-writable
+  return true;
 }
 
-function block(hits) {
-  const lines = [
-    '<recall-surface>',
-    'You already have captured page(s) on this topic — READ before answering (do not re-derive, do',
-    'not ask the operator to re-explain). Recall with: node .wrxn/wiki.cjs recall "<slug>"',
-    ...hits.map((h) => `- ${h.slug} (${h.tier})`),
-    '</recall-surface>',
-  ].join('\n');
-  return lines.length <= MAX_BLOCK_CHARS ? lines : `${lines.slice(0, MAX_BLOCK_CHARS - 18)}\n</recall-surface>`;
+// Discover the warm serve door from <root>/.recon-wrxn/serve-endpoint.json = {pid,port}. Returns
+// {pid,port} only when the file is well-owned (not planted), present, well-formed, and the pid is
+// alive — else null (not warm).
+function discoverEndpoint(root) {
+  const file = path.join(root, ENDPOINT_REL);
+  if (!endpointTrusted(file)) return null; // absent, foreign-owned, or loose perms → not warm
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch {
+    return null; // absent (race)
+  }
+  let obj;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    return null; // malformed
+  }
+  const pid = Number(obj && obj.pid);
+  const port = Number(obj && obj.port);
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  if (!Number.isInteger(port) || port <= 0) return null;
+  if (!pidAlive(pid)) return null; // dead pid → not warm
+  return { pid, port };
+}
+
+// Default transport: a real POST over http with a hard timeout. Resolves {statusCode, body}; rejects
+// on socket error or timeout. Injectable so unit tests never touch the network (mirrors connect.cjs).
+function httpTransport({ port, path: reqPath, body, timeoutMs }) {
+  return new Promise((resolve, reject) => {
+    const payload = Buffer.from(JSON.stringify(body));
+    const deadline = timeoutMs || TIMEOUT_MS;
+    let settled = false;
+    let wall = null;
+    const done = (fn, arg) => {
+      if (settled) return;
+      settled = true;
+      if (wall) clearTimeout(wall);
+      fn(arg);
+    };
+    const req = http.request(
+      {
+        host: '127.0.0.1',
+        port,
+        path: reqPath,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Content-Length': payload.length },
+      },
+      (res) => {
+        const chunks = [];
+        let total = 0;
+        res.on('data', (c) => {
+          total += c.length;
+          if (total > MAX_RESPONSE_BYTES) { req.destroy(new Error('recall door response too large')); return; }
+          chunks.push(c);
+        });
+        res.on('end', () => done(resolve, { statusCode: res.statusCode, body: Buffer.concat(chunks).toString('utf8') }));
+        res.on('error', (e) => done(reject, e));
+      }
+    );
+    req.on('error', (e) => done(reject, e));
+    // Idle timeout (no bytes for `deadline`) AND an independent wall-clock: the latter bounds a trickle
+    // attacker that dribbles bytes to keep the idle timer from ever firing past the hook budget.
+    req.setTimeout(deadline, () => req.destroy(new Error('recall door timeout')));
+    wall = setTimeout(() => req.destroy(new Error('recall door wall-clock timeout')), deadline);
+    req.write(payload);
+    req.end();
+  });
 }
 
-function main() {
+// IO shell: discover the door, POST the prose query, gate the hits. Returns the block string or null.
+// `transport` is injected in tests; production uses httpTransport. Sends NO `type` (recon_find takes a
+// single NodeType, not an array) — prose scope is enforced by decideRecall's post-filter.
+async function recallFromDoor(root, prompt, { transport, timeoutMs } = {}) {
+  const door = discoverEndpoint(root);
+  if (!door) return null; // not warm → Abstain (silent)
+  const query = String(prompt || '').trim().slice(0, MAX_QUERY_CHARS);
+  if (!query) return null;
+  let resp;
+  try {
+    resp = await (transport || httpTransport)({
+      port: door.port,
+      path: FIND_PATH,
+      body: { query, limit: FETCH_LIMIT },
+      timeoutMs: timeoutMs || TIMEOUT_MS,
+    });
+  } catch {
+    return null; // timeout / connection refused / abort → silent
+  }
+  if (!resp || resp.statusCode !== 200) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(resp.body);
+  } catch {
+    return null; // malformed body → silent
+  }
+  return decideRecall(Array.isArray(parsed.hits) ? parsed.hits : []);
+}
+
+// ── entrypoint ──────────────────────────────────────────────────────────────────────
+
+async function main() {
   let event = {};
   try {
     const stdin = fs.readFileSync(0, 'utf8');
     if (stdin.trim()) event = JSON.parse(stdin);
   } catch {
-    emit({});
+    return emit({});
   }
 
-  const root = findInstallRoot();
-  if (!root) emit({});
+  const root = findInstallRoot(event.cwd);
+  if (!root) return emit({});
 
   const prompt = typeof event.prompt === 'string' ? event.prompt : '';
-  if (prompt.trim().length < MIN_PROMPT_LEN) emit({});
-
-  const terms = salientTerms(prompt);
-  if (!terms.length) emit({});
+  if (prompt.trim().length < MIN_PROMPT_LEN) return emit({});
 
-  const hits = recall(root, terms);
-  if (!hits.length) emit({}); // no captured page matched → silent (the gate)
+  let block = null;
+  try {
+    block = await recallFromDoor(root, prompt.trim());
+  } catch {
+    return emit({});
+  }
+  if (!block) return emit({}); // nothing cleared the gate → Abstain
 
-  emit({ hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: block(hits) } });
+  return emit({ hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: block } });
 }
 
-try {
-  main();
-} catch {
-  emit({});
+if (require.main === module) {
+  main().catch(() => emit({}));
 }
+
+module.exports = {
+  decideRecall,
+  recallFromDoor,
+  discoverEndpoint,
+  httpTransport,
+  pidAlive,
+  isProse,
+  hasConsensus,
+  qualifies,
+  renderBlock,
+  findInstallRoot,
+  SEMANTIC_FLOOR,
+  PROSE_TYPES,
+};

package/payload/.claude/hooks/synapse-engine.cjs

@@ -257,6 +257,7 @@ function handoffDirective(consumed, pct) {
     '  1. Finish the current request.',
     '  2. Run the handoff skill to write the baton (a compact handoff document).',
     '  3. Tell the operator to /clear and open a fresh session, where the baton injects on resume.',
+    '  Suggestion (optional, before step 2): run the dream skill to consolidate this session\'s durable learnings into wiki memory — a suggestion only; dream never auto-runs, it acts only when you invoke it.',
   ].join('\n');
 }
 

package/payload/.claude/hooks/wiki-lint.cjs

@@ -15,6 +15,9 @@
 const fs = require('fs');
 const path = require('path');
 
+// The human-prose tiers only. The `_`-prefixed tiers (`_rules` and `_slots`) are machine-written by the
+// dream adapter through wiki.cjs — they are deliberately OUTSIDE this human-prose frontmatter lint, not
+// an omission (dream-03: no silent divergence).
 const TIERS = ['concepts', 'decisions', 'gotchas', 'sessions'];
 const REQUIRED_KEYS = ['name', 'description', 'tier'];
 const MAX_FLAGGED = 20;

package/payload/.claude/skills/dream/SKILL.md

@@ -0,0 +1,210 @@
+---
+name: dream
+description: Consolidate the live session into durable wiki memory — reflect on this conversation, draft evidence-backed Proposals (concept/decision/gotcha/rule), gate each through the dream adapter, and on your confirmation write net-new pages the Brain will recall next time. Use when someone says "dream", "consolidate this session", "save what we learned", or wants to capture durable memory before a handoff.
+user-invocable: true
+---
+
+# dream — session consolidation
+
+dream turns what you learned in **this session** into durable wiki pages the **Brain** will recall in
+future sessions. You **propose**; the deterministic adapter **judges**. Every page must quote the
+session that justifies it, and **nothing is written without the operator's confirmation** — so a bad
+proposal can never poison recall. "Bad memory is worse than no memory."
+
+## Indirection contract (MUST)
+
+> Drive the adapters. NEVER write wiki files directly and NEVER re-implement the gate.
+
+- Validate / stage / commit go through **`.wrxn/dream.cjs`** (the Validation gate + audit + writer).
+- Wiki reads (to check what already exists, or to confirm recall) go through **`.wrxn/wiki.cjs`**.
+- The skill is the **semantic** filter (you don't even draft junk); the adapter is the **mechanical**
+  backstop (it rejects what slips through). Run a proposal the gate rejected? It is never written.
+
+## The loop
+
+1. **Reflect** on the live conversation already in your context. Do NOT read transcripts or stored
+   session pages — reflect on what is in front of you, this session only.
+2. **Draft** candidate Proposals (see schema + rubric below), each grounded in a **verbatim quote**
+   from THIS session. If the session yields no durable insight, **abstain** — propose nothing.
+3. **check** the batch through the adapter; drop or fix anything it rejects (never carry a reject
+   forward).
+4. **stage** the validated batch — records it to the audit trail, outside the recalled wiki.
+5. **Present** the staged batch to the operator and wait for confirmation.
+6. **commit** only the operator-approved subset — net-new pages, additively, into their tiers.
+
+If reflection surfaces nothing durable, or the gate rejects every proposal, **stop**: say so, stage
+nothing, commit nothing. Restraint is a success, not a failure.
+
+## FAITHFULNESS — the most important rule
+
+The wiki records *what happened in this project, this session* — not what you know about the topic in
+general. You are not writing tutorials, documentation, or reference material. Every claim in every
+page MUST trace to the session in front of you.
+
+Do NOT:
+- Invent dates, version numbers, commit hashes, author names, file paths, function names, line
+  numbers, or error codes that did not appear in the session.
+- Add "When to use" / "Best practices" / "Alternatives" / "See also" sections that weren't grounded in
+  the session — those are reference-material patterns, not memory.
+- Enumerate options that weren't actually considered, or expand a terse operator comment into an essay.
+- Fabricate code or speculate about consequences the session itself didn't raise.
+- **Write a session secret into a page.** Redact any credential (API key, token, private key) that
+  surfaced in the session — a durable page is recalled forever. The gate also rejects `contains_secret`,
+  but you are the first filter.
+
+Do:
+- Compress the session into well-titled pages with the right `kind`.
+- **Preserve the operator's actual phrasing** for decisions and rules — it is load-bearing.
+- Write each page at the length the session actually warrants — dense fact, no padding, no truncation.
+- If the session yields no durable insight, **abstain**. Resist the urge to manufacture content.
+
+## What to propose — the `kind` rubric
+
+Exactly one kind per Proposal; `tier` must agree with `kind`.
+
+| kind       | tier         | propose when the session produced…                                            |
+|------------|--------------|-------------------------------------------------------------------------------|
+| `decision` | `decisions`  | a choice of X over Y, with its rationale and consequences (why the project is the way it is) |
+| `gotcha`   | `gotchas`    | a reproducible pitfall / failure mode, its root cause, and the mitigation     |
+| `concept`  | `concepts`   | stable architecture or domain knowledge (synthesis, not a task chronology)    |
+| `rule`     | `_rules`     | an always/never project convention the session established — a standing rule, recalled like a concept (NOT a SYNAPSE always-on rule; see Boundaries) |
+
+Two unrelated insights stay **two** pages — never merge them into one. Small pages, stable
+kebab-case names (Karpathy LLM-wiki style). Cap a run at **≤ 5** proposals.
+
+## What NOT to propose — anti-superstition
+
+Do not even draft these. A transient or false "memory", once recalled, hardens into a permanent false
+constraint on every future session. (The adapter rejects them too — but you are the first filter.)
+
+| Reject                          | Why                                                                  |
+|---------------------------------|----------------------------------------------------------------------|
+| "tool X is broken"              | A broad negative tool claim hardens into a permanent false refusal after the tool is fixed. |
+| Transient env / setup failures  | ENOENT, connection refused, timeouts, flaky/intermittent, rate-limits, a missing binary — stale false constraints, not durable truth. |
+| Smoke / sanity / happy-path checks | Operational evidence, not reusable knowledge.                     |
+| Release / version markers       | A one-time event (a version bump, a changelog, an npm publish), not a lesson. |
+| One-off task narratives         | "Renamed a file", "fixed a typo", a trivial chore — episodic, already captured. |
+| **wrxn itself**                 | Never memorialize wrxn's own routing / skills / synapse / hooks / constitution / adapters — the memory system must not pollute itself. |
+
+## Proposal schema
+
+A Proposal is one JSON object. A run is a JSON **array** of them (the batch).
+
+```jsonc
+{
+  "kind":  "concept" | "decision" | "gotcha" | "rule",      // pick one
+  "tier":  "concepts" | "decisions" | "gotchas" | "_rules", // = f(kind); MUST agree
+  "slug":  "kebab-case-page-name",                  // stable name
+  "title": "One-line page title",
+  "body":  "# Title\n\n…markdown… ",                // MUST start with '# '
+  "confidence": 0.0,                                 // honest 0–1; the gate floor is 0.75
+  "rationale": "Why this is durable.",
+  "evidence": [                                      // >= 1, each a VERBATIM quote from THIS session
+    { "quote": "exact words from the session", "source": "file:line | commit | turn-N" }  // source optional
+  ]
+}
+```
+
+## Driving the adapter
+
+Run from inside the install (the adapter walks up to `wrxn.install.json` to find the root — no
+`--root` needed). Write each batch to a **throwaway temp file** (it is scratch input, not a wiki page;
+only the adapter's own `.wrxn/dream/*.jsonl` audit files persist).
+
+**1 — check** (the gate; PROPOSE, then let it JUDGE):
+
+```bash
+node .wrxn/dream.cjs check /tmp/dream-batch.json
+```
+
+A batch returns `{ abstained, accepted[], rejected[ {index, slug, reason} ] }`. Each `reason` is a
+machine code — `confidence_below_threshold`, `missing_evidence`, `missing_rationale`,
+`body_missing_h1`, `body_too_large`, `invalid_slug`, `missing_title`, `invalid_title`,
+`unsupported_tier`, `kind_tier_mismatch`, `contains_secret`, `duplicate_existing_path`,
+`duplicate_existing_title`, `max_proposals_exceeded`, or a `negative_filter_*`. Fix or drop every
+rejected proposal; re-check until the batch is clean. If it returns `{ abstained: true }` (or every
+proposal is rejected), **stop** — write nothing.
+
+If the gate rejects a genuinely durable insight on a `negative_filter_*` **false positive** (e.g. a real
+decision that merely mentions "transient", "synapse", or "release"), **rephrase** the page to drop the
+transient/operational wording — state the durable decision, not the episodic event — then re-check.
+Never write around the gate.
+
+**2 — stage** (record the validated batch to the audit trail; nothing reaches the wiki yet):
+
+```bash
+node .wrxn/dream.cjs stage /tmp/dream-batch.json
+```
+
+**3 — present, then confirm.** Show the operator each staged proposal — its **tier/slug**, **title**,
+**confidence**, the **verbatim evidence quote**, and the one-line rationale — and ask which to approve.
+Never skip this step. If the operator approves none, you are done: commit nothing.
+
+**4 — commit** (write ONLY the operator-approved subset, **by reference**). Build a JSON array of the
+approved **slugs** — NOT a rebuilt Proposal array — and commit it:
+
+```bash
+node .wrxn/dream.cjs commit /tmp/dream-approved.json   # ["slug-a","slug-b"]  (or {"approved":["slug-a",…]})
+```
+
+`commit` reads `.wrxn/dream/staged.jsonl`, finds each approved slug's **staged** proposal, **re-runs the
+gate** on it (confidence, evidence, body H1, kind↔tier, secret-scan, negative filters, identity, dedup —
+everything `check` ran), and writes ONLY the ones that still pass — net-new pages, additively, via
+`wiki.cjs`. It **dedup-skips** any whose path already exists (never clobbers a curated page); a slug not
+staged (`not_staged`) or one that fails re-validation is recorded skipped with the reason. Returns
+`{ written[], skipped[] }`. This binds *committed == staged == presented*: a proposal the gate would
+reject can never be written, even if its slug is force-approved.
+
+**5 — confirm recall (optional).** The committed pages are plain `.md` in the wiki, so the Brain
+recalls them automatically next session. Spot-check with a wiki query:
+
+```bash
+node .wrxn/wiki.cjs query "<a phrase from a page you just wrote>"
+```
+
+## Refreshing the focus slot
+
+`_slots/current-focus.md` is the project's **durable standing focus** — a short statement of what the
+project is centered on right now, recall-surfaced like any other page. It is the **lone updatable wiki
+page**: every knowledge page is additive + dedup-skip, but the focus slot may be **overwritten in
+place**.
+
+This is **not** the knowledge-proposal loop — do not run a focus update through `check` / `stage` /
+`commit` (those are for evidence-backed concept/decision/gotcha/rule pages). The slot has its **own op**:
+
+1. Draft a short standing-focus statement (a few lines of markdown, body starting with `# `).
+2. **Present it to the operator and wait for confirmation** — like every dream write.
+3. On approval, write it via the dedicated op — it overwrites the slot in place:
+
+```bash
+node .wrxn/dream.cjs set-focus /tmp/dream-focus.json   # { "title": "Current focus", "body": "# Current focus\n\n…" }
+```
+
+The focus slot is **gated** too: `set-focus` runs the anti-superstition negative filters and the
+credential secret-scan over the focus body and **refuses** (writing nothing) if either fires. Redact
+secrets and pin durable standing context, not a transient note.
+
+**Continuity doctrine — do not cross these wires.** The focus slot is **disjoint** from the handoff
+**baton** (`.wrxn/continuity/latest.md`): different path, different writer. `set-focus` NEVER reads or
+writes the baton, and the **handoff** skill remains its sole writer. The baton is ephemeral cross-session
+resume; the focus slot is durable standing context. Keeping their paths and writers separate is the
+structural fix that stops a deliberate handoff from being clobbered.
+
+## Boundaries
+
+- **Current session only.** No transcript mining, no cross-session backlog.
+- **Additive only, save one slot.** dream creates net-new knowledge pages; merging or refreshing an
+  existing page is out of scope (that is harvest, a later phase). The **lone exception** is the focus
+  slot `_slots/current-focus.md`, which `set-focus` overwrites in place (see *Refreshing the focus slot*).
+- **Never autonomous.** dream is a deliberate, attended, operator-confirmed skill — never a background
+  run, never a write without confirmation.
+- **`_rules` ≠ SYNAPSE.** A `rule` page is *recalled knowledge* — the Brain surfaces it like a concept
+  or gotcha. It is NOT a SYNAPSE always-on rule. Promoting a `_rules` page into SYNAPSE's curated
+  always-injected set (`.synapse/`) is a separate, deliberate act — **dream NEVER edits `.synapse/`**.
+
+## Source
+
+WRXN Kernel issue dream-02. Adapter: `.wrxn/dream.cjs` (dream-01). Prompts adapted from
+`akitaonrails/ai-memory` (`auto_improve` system prompt, the `batch_consolidate` FAITHFULNESS block,
+the `kind` rubric, the `docs/auto-improvement-loop.md` negative-filter list). ADR 0003; PRD
+`dream-prd`.

package/payload/.claude/skills/handoff/SKILL.md

@@ -6,6 +6,8 @@ argument-hint: "What will the next session be used for?"
 
 Write a handoff document summarising the current conversation so a fresh agent can continue the work.
 
+Before writing the baton, OFFER to run the `dream` skill to consolidate this session's durable learnings into wiki memory (concept/decision/gotcha/rule pages the Brain recalls next session). This is an offer only — run `dream` solely if the operator agrees; never auto-run it. `dream` writes additive wiki pages (and may refresh its own `_slots/current-focus.md`), while this skill remains the SOLE writer of `.wrxn/continuity/latest.md` — the two are disjoint, so neither clobbers the other.
+
 Save it to the install's continuity slot: `.wrxn/continuity/latest.md` (resolve the install root by walking up to the `wrxn.install.json` receipt; create the `.wrxn/continuity/` directory if absent). This slot is the deliberate, intent-carrying baton — the NEXT session's `session-start` hook injects its contents as the resume surface, taking precedence over the automatic episodic session page.
 
 CONTINUITY DOCTRINE: this skill is the SINGLE writer of `.wrxn/continuity/latest.md`. The automatic `session-end` hook writes ONLY dated session pages under `.wrxn/wiki/sessions/` and NEVER touches the baton — so a deliberate handoff is never clobbered by the automatic episodic record. Overwrite the previous baton (the latest deliberate handoff is the live one).

package/payload/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "recon-wrxn": {
       "command": "npx",
-      "args": ["-y", "recon-wrxn@6.0.0-wrxn.2", "serve"]
+      "args": ["-y", "recon-wrxn@6.0.0-wrxn.3", "serve"]
     }
   }
 }