@getmarrow/install 0.1.32 → 0.1.34

package/README.md

@@ -53,7 +53,7 @@ Verify current claims through the [public evidence manifest](https://getmarrow.a
 ## Install
 
 ```bash
-npx @getmarrow/install --yes
+npx @getmarrow/install activate
 ```
 
 Required secret:
@@ -62,9 +62,19 @@ Required secret:
 export MARROW_API_KEY=mrw_live_...
 ```
 
-## What's New in v0.1.32
+## What's New in v0.1.34
+
+v0.1.34 verifies whether passive governance is actually active after install. Activation now registers a bounded capability profile, a one-way configuration fingerprint, expected and observed hook surfaces, and a server-accepted lifecycle receipt. The Fleet Operator shows activation state, capture coverage, outcome closure, intervention follow-through, drift, and the exact repair:
 
-v0.1.32 adds one machine-readable governance-fit contract across discovery, evidence, and integration surfaces while preserving the server-verified first-run activation introduced in v0.1.29:
+- Claude Code installation includes exact `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, `PostToolUseFailure`, and `Stop` hooks;
+- matching pre-action/result receipts use one tool correlation, and activation fingerprints the exact hook contract without uploading configuration contents;
+- the capability registry distinguishes native hooks, MCP, SDK passive runtime, governed wrappers, and custom event contracts;
+- `activate` fails when the local integration is incomplete or the server does not accept the exact activation profile;
+- `doctor` and `--repair` use the same configuration evidence without exposing configuration contents;
+- the harness certification suite prevents support claims from overstating what is automatic;
+- unavailable coverage remains “insufficient data” instead of a synthetic percentage.
+
+It preserves agent-disagreement visibility from v0.1.33 and the server-verified first-run activation introduced in v0.1.29:
 
 - GitHub and npm now advertise separate signed discovery placements;
 - package metadata identifies the installer as agent governance rather than a general memory utility;
@@ -104,10 +114,13 @@ With a valid key, `activate`:
 4. closes its outcome;
 5. sends the exact self-test decision ID to Marrow for server-side verification;
 6. reads agent status and the one-call runtime;
-7. returns an activation receipt with capture, intervention, closure, first-value state, and the exact next action.
+7. registers the detected capability, expected hooks, and one-way configuration fingerprint;
+8. returns an activation receipt with capture, intervention, closure, first-value state, and the exact next action.
 
 Healthy output confirms the exact decision outcome exists under the authenticated account and agent. A local file write or client-supplied `verified: true` value cannot produce an active receipt.
 
+The installer does not claim identical automation for every harness. Native hooks provide the broadest automatic coverage; MCP covers MCP-routed actions; the SDK covers owned Node processes; the governed runner covers commands launched through it; custom harnesses must map their own lifecycle events.
+
 ## Govern TUI
 
 Open the interactive setup panel:
@@ -160,7 +173,7 @@ npx @getmarrow/install --repair
 npx @getmarrow/install fleet
 ```
 
-The fleet view shows live agents, active workflows, risky actions waiting for proof, stale or failed outcomes, capture health, recent decisions, and exact repair commands. It is an operator surface for the authenticated account, not a public status dashboard.
+The fleet view shows live agents, active workflows, agent disagreements and their latest arbitration receipt, risky actions waiting for proof, stale or failed outcomes, capture health, recent decisions, and exact repair commands. Press Enter on **Agent disagreements** to inspect the bound decision, selected proposal, whether Marrow selected a proposal, synthesized a safe sequence, held the action for owner review, or blocked the conflicting actions. Review-required work must be approved from an authenticated Marrow dashboard session; the TUI does not let an agent approve itself. It is an operator surface for the authenticated account, not a public status dashboard.
 
 ## Integration Paths
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Universal installer and governed runner for Marrow agent fleets.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"

package/src/governed-runner.js

@@ -8,7 +8,7 @@ const readline = require('node:readline');
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const HIGH_RISK_TERMS = /\b(deploy|prod|production|publish|release|merge|migration|migrate|secret|token|key|cloudflare|wrangler|npm publish|gh pr merge|git push|terraform apply|kubectl apply|delete|destroy|drop)\b/i;
 const GOVERN_TUI_ROW_COUNT = 7;
-const FLEET_TUI_ROW_COUNT = 11;
+const FLEET_TUI_ROW_COUNT = 12;
 function usage() {
   return `Usage:
   npx @getmarrow/install run --agent deploy-agent -- npm test
@@ -761,6 +761,38 @@ function normalizeGates(status, report) {
   };
 }
 
+function normalizeArbitrations(status, report, fleet) {
+  const source = firstDefined(
+    report.arbitrations,
+    report.report?.arbitrations,
+    fleet.arbitrations,
+    status.arbitrations,
+    {},
+  ) || {};
+  const receipts = listValue(
+    source.receipts,
+    source.items,
+    report.recent_arbitrations,
+    fleet.recent_arbitrations,
+    status.recent_arbitrations,
+  ).slice(0, 8).map((receipt) => ({
+    id: displayText(firstDefined(receipt?.id, receipt?.receipt_id, 'arbitration'), 80),
+    decision_id: displayText(firstDefined(receipt?.decision_id, ''), 80),
+    resolution: statusLabel(receipt?.resolution, 'unknown'),
+    conflict_type: displayText(firstDefined(receipt?.conflict_type, 'action_conflict'), 60),
+    selected_proposal_id: displayText(firstDefined(receipt?.selected_proposal_id, ''), 80),
+    requesting_agent_id: displayText(firstDefined(receipt?.requesting_agent_id, ''), 80),
+    exact_next_action: displayText(firstDefined(receipt?.exact_next_action, ''), 180),
+    owner_approval_required: Boolean(receipt?.owner_approval_required),
+    created_at: displayText(firstDefined(receipt?.created_at, ''), 80),
+  }));
+  return {
+    open_count: numberValue(firstDefined(source.open_count, source.open, receipts.filter((item) => item.resolution !== 'selected' && item.resolution !== 'synthesized').length), 0),
+    review_required_count: numberValue(firstDefined(source.review_required_count, source.review_required, receipts.filter((item) => item.resolution === 'review_required').length), 0),
+    receipts,
+  };
+}
+
 function normalizeFixCommands(status, capacity) {
   const commands = [];
   const add = (value, commandOnly = false) => {
@@ -774,6 +806,9 @@ function normalizeFixCommands(status, capacity) {
   add(status.route_contract?.exact_fix);
   add(status.auto_outcome_closure?.exact_fix);
   add(status.capture_coverage?.exact_fix);
+  add(status.activation_coverage?.exact_fix);
+  add(status.activation_coverage?.drift?.repair_command, true);
+  add(status.passive_activation?.exact_fix);
   add(capacity.exact_next_action, true);
   add(capacity.next_action, true);
   if (listValue(status.missed_hooks, status.degraded_hooks).length) add('npx @getmarrow/install --repair');
@@ -781,6 +816,52 @@ function normalizeFixCommands(status, capacity) {
   return commands.slice(0, 6);
 }
 
+function normalizeActivationCoverage(status, report, fleet) {
+  const source = firstDefined(
+    status.activation_coverage,
+    status.passive_activation,
+    report.activation_coverage,
+    report.passive_activation,
+    fleet.activation_coverage,
+    {},
+  ) || {};
+  const activation = source.activation || {};
+  const capture = source.capture_coverage || source.capture || source.coverage || {};
+  const closure = source.outcome_closure || source.closure || {};
+  const effectiveness = source.intervention_effectiveness || source.effectiveness || {};
+  const drift = source.drift && typeof source.drift === 'object' ? source.drift : {};
+  const available = source.available === true || capture.available === true;
+  const driftAvailable = available && drift.available === true && typeof drift.detected === 'boolean';
+  const percent = (value) => {
+    const number = Number(value);
+    if (!Number.isFinite(number)) return null;
+    return Math.max(0, Math.min(100, number));
+  };
+  const ratio = (value) => {
+    const number = Number(value);
+    if (!Number.isFinite(number)) return null;
+    return Math.max(0, Math.min(100, number * 100));
+  };
+  const metricPercent = (explicitPercent, rate, fallbackPercent) => {
+    const explicit = firstDefined(explicitPercent, fallbackPercent);
+    return explicit == null ? ratio(rate) : percent(explicit);
+  };
+  return {
+    available,
+    state: statusLabel(firstDefined(source.state, source.status), available ? 'active' : 'warming_up'),
+    capability_level: displayText(firstDefined(activation.capability_level, source.capability_level, source.capability, 'unknown'), 40),
+    capture_percent: metricPercent(capture.percent, capture.rate, source.capture_percent),
+    closure_percent: metricPercent(closure.percent, closure.rate, source.closure_percent),
+    effectiveness_percent: metricPercent(
+      effectiveness.followed_percent,
+      firstDefined(effectiveness.follow_through_rate, effectiveness.rate),
+      source.effectiveness_percent,
+    ),
+    drift: driftAvailable ? drift.detected : null,
+    exact_fix: displayText(firstDefined(drift.repair_command, source.exact_fix, source.repair_command, ''), 180),
+  };
+}
+
 function normalizeFleetSnapshot(raw, options) {
   const status = raw.status?.data || {};
   const capacity = raw.capacity?.data || {};
@@ -840,6 +921,8 @@ function normalizeFleetSnapshot(raw, options) {
   ), raw.capacity?.ok ? 'ok' : 'unknown');
   const recentDecisions = normalizeRecentDecisions(status, report, fleet);
   const gates = normalizeGates(status, report);
+  const arbitrations = normalizeArbitrations(status, report, fleet);
+  const activationCoverage = normalizeActivationCoverage(status, report, fleet);
   const fixCommands = normalizeFixCommands(status, capacity);
   const errors = Object.entries(raw)
     .filter(([, value]) => value && value.ok === false)
@@ -859,6 +942,8 @@ function normalizeFleetSnapshot(raw, options) {
     recent_decisions: recentDecisions,
     degraded_hooks: missedHooks,
     gates,
+    arbitrations,
+    activation_coverage: activationCoverage,
     agents,
     fix_commands: fixCommands.length ? fixCommands : ['npx @getmarrow/install doctor'],
     source_errors: errors,
@@ -898,6 +983,10 @@ function fleetPanel(snapshot) {
     ? snapshot.agents.slice(0, 5).map((agent) => `  - ${agent.id}${agent.role ? ` (${agent.role})` : ''}: ${agent.status}${agent.last_seen_at ? ` last_seen=${agent.last_seen_at}` : ''}`).join('\n')
     : '  - no agent roster returned yet';
   const fixes = snapshot.fix_commands.map((command) => `  - ${command}`).join('\n');
+  const arbitration = snapshot.arbitrations.receipts[0];
+  const arbitrationSummary = arbitration
+    ? `${arbitration.resolution} (${arbitration.conflict_type})${arbitration.exact_next_action ? ` - ${arbitration.exact_next_action}` : ''}`
+    : 'none reported yet';
   return [
     'Marrow Fleet Operator',
     '',
@@ -906,6 +995,10 @@ function fleetPanel(snapshot) {
     '',
     `Live agents: ${snapshot.live_agents ?? 'unknown'}`,
     `Active workflows: ${snapshot.active_workflows ?? 'unknown'}`,
+    `Passive activation: ${snapshot.activation_coverage.state} capability=${snapshot.activation_coverage.capability_level}`,
+    `Passive coverage: ${snapshot.activation_coverage.capture_percent ?? 'insufficient data'}${snapshot.activation_coverage.capture_percent == null ? '' : '%'}; outcome closure=${snapshot.activation_coverage.closure_percent ?? 'insufficient data'}${snapshot.activation_coverage.closure_percent == null ? '' : '%'}; intervention follow-through=${snapshot.activation_coverage.effectiveness_percent ?? 'insufficient data'}${snapshot.activation_coverage.effectiveness_percent == null ? '' : '%'}`,
+    `Agent disagreements: open=${snapshot.arbitrations.open_count} review_required=${snapshot.arbitrations.review_required_count}`,
+    `Latest arbitration: ${arbitrationSummary}`,
     `Risky actions waiting for proof: ${snapshot.proof_waiting}`,
     `Failed/stale outcomes: ${snapshot.failed_stale_outcomes}`,
     `Backpressure/capacity status: ${snapshot.backpressure_status}${snapshot.capacity_next_action ? ` - ${snapshot.capacity_next_action}` : ''}`,
@@ -1321,9 +1414,14 @@ function renderFleetTui(state) {
   const snapshot = state.snapshot;
   const selectedAgent = snapshot.agents[state.agentIndex] || { id: 'no agent returned', status: 'unknown', role: '' };
   const degraded = snapshot.degraded_hooks.length ? snapshot.degraded_hooks.join(', ') : 'none';
+  const activation = snapshot.activation_coverage;
+  const coverageValue = activation.available
+    ? `${activation.state}; capture=${activation.capture_percent ?? 'n/a'}%; closure=${activation.closure_percent ?? 'n/a'}%`
+    : `${activation.state}; insufficient data`;
   const gateSummary = `deploy=${snapshot.gates.deploy} publish=${snapshot.gates.publish} merge=${snapshot.gates.merge}`;
   const fixCommand = snapshot.fix_commands[0] || 'npx @getmarrow/install doctor';
   const recent = snapshot.recent_decisions[0] || 'none reported yet';
+  const arbitration = snapshot.arbitrations.receipts[0];
   const rows = [
     {
       label: 'Live agents',
@@ -1335,6 +1433,13 @@ function renderFleetTui(state) {
       value: String(snapshot.active_workflows ?? 'unknown'),
       hint: 'Current account-scoped workflow pressure from Marrow.',
     },
+    {
+      label: 'Agent disagreements',
+      value: `open=${snapshot.arbitrations.open_count} review_required=${snapshot.arbitrations.review_required_count}`,
+      hint: arbitration
+        ? `${arbitration.resolution}: ${arbitration.exact_next_action || arbitration.conflict_type}`
+        : 'No conflicting fleet proposals reported.',
+    },
     {
       label: 'Risky actions waiting for proof',
       value: String(snapshot.proof_waiting),
@@ -1356,9 +1461,13 @@ function renderFleetTui(state) {
       hint: 'Latest fleet decision signal returned by Marrow.',
     },
     {
-      label: 'Degraded hooks',
-      value: degraded,
-      hint: degraded === 'none' ? 'No missing hooks reported.' : 'Repair hooks before trusting passive coverage.',
+      label: 'Passive activation / coverage',
+      value: coverageValue,
+      hint: activation.drift
+        ? `Configuration drift detected. ${activation.exact_fix || fixCommand}`
+        : degraded === 'none'
+        ? `Capability=${activation.capability_level}; no missing hooks reported.`
+        : `Degraded hooks: ${degraded}. Repair before trusting passive coverage.`,
     },
     {
       label: 'Deploy/publish/merge gates',
@@ -1651,31 +1760,35 @@ async function runFleetInteractive(options, input = process.stdin, output = proc
           state.status = 'Agent selection changed.';
           render();
         } else if (key.name === 'return') {
-          if (state.cursor === 9) {
+          if (state.cursor === 10) {
             cleanup();
             output.write(`\n${state.snapshot.fix_commands[0] || 'npx @getmarrow/install doctor'}\n`);
             resolve();
             return;
           }
-          if (state.cursor === 10) {
+          if (state.cursor === 11) {
             cleanup();
             resolve();
             return;
           }
           const selectedAgent = state.snapshot.agents[state.agentIndex];
-          if (state.cursor === 0 || state.cursor === 8) {
+          if (state.cursor === 0 || state.cursor === 9) {
             state.lastResult = selectedAgent
               ? `Agent ${selectedAgent.id}: status=${selectedAgent.status}${selectedAgent.role ? ` role=${selectedAgent.role}` : ''}${selectedAgent.last_seen_at ? ` last_seen=${selectedAgent.last_seen_at}` : ''}`
               : 'No live agent roster returned yet. Check API key scope or wait for agents to log activity.';
-          } else if (state.cursor === 5) {
+          } else if (state.cursor === 2) {
+            const receipts = state.snapshot.arbitrations.receipts;
+            state.lastResult = receipts.length
+              ? receipts.map((receipt, index) => `${index + 1}. ${receipt.id}: ${receipt.resolution}${receipt.decision_id ? `; decision=${receipt.decision_id}` : ''}${receipt.selected_proposal_id ? `; selected=${receipt.selected_proposal_id}` : ''}; ${receipt.exact_next_action || receipt.conflict_type}${receipt.owner_approval_required ? ' Owner approval must be issued from an authenticated Marrow dashboard session.' : ''}`).join('  ')
+              : 'No agent disagreements or arbitration receipts returned yet.';
+          } else if (state.cursor === 6) {
             state.lastResult = state.snapshot.recent_decisions.length
               ? state.snapshot.recent_decisions.map((decision, index) => `${index + 1}. ${decision}`).join('  ')
               : 'No recent decisions returned yet.';
-          } else if (state.cursor === 6) {
-            state.lastResult = state.snapshot.degraded_hooks.length
-              ? `Degraded hooks: ${state.snapshot.degraded_hooks.join(', ')}. Fix: ${state.snapshot.fix_commands[0]}`
-              : 'No degraded hooks reported.';
           } else if (state.cursor === 7) {
+            const coverage = state.snapshot.activation_coverage;
+            state.lastResult = `Passive activation=${coverage.state}; capability=${coverage.capability_level}; capture=${coverage.capture_percent ?? 'insufficient data'}; closure=${coverage.closure_percent ?? 'insufficient data'}; intervention follow-through=${coverage.effectiveness_percent ?? 'insufficient data'}${coverage.drift ? `. Drift detected. Fix: ${coverage.exact_fix || state.snapshot.fix_commands[0]}` : ''}`;
+          } else if (state.cursor === 8) {
             state.lastResult = `Release gates: deploy=${state.snapshot.gates.deploy}, publish=${state.snapshot.gates.publish}, merge=${state.snapshot.gates.merge}.`;
           } else {
             state.lastResult = fleetPanel(state.snapshot).replace(/\n/g, '  ');

package/src/installer.js

@@ -6,7 +6,38 @@ const crypto = require('node:crypto');
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const MARROW_BLOCK_START = '<!-- marrow:passive-start -->';
 const MARROW_BLOCK_END = '<!-- marrow:passive-end -->';
-const SOURCE_CLIENTS = new Set(['claude-code', 'cursor', 'windsurf', 'openclaw', 'codex', 'gemini', 'grok', 'deepseek', 'qwen', 'kimi', 'minimax', 'cline', 'opencode', 'hermes', 'glm', 'custom', 'unknown']);
+const INSTALLER_ADAPTER_VERSION = '0.1.34';
+const MCP_ADAPTER_VERSION = '3.9.50';
+const SDK_ADAPTER_VERSION = '3.7.49';
+const SDK_ADAPTER_INTEGRITY = 'sha512-9a6pWWACubWTmulG7TwwgMNP/iSzoEh4wCH2oWUyO8XHeD2Eokj1GXrkCyX86md3bV7vGX6kyllfswZDlGj6WA==';
+const SDK_ADAPTER_TARBALL = `https://registry.npmjs.org/@getmarrow/sdk/-/sdk-${SDK_ADAPTER_VERSION}.tgz`;
+const MCP_PACKAGE_SPEC = `@getmarrow/mcp@${MCP_ADAPTER_VERSION}`;
+const MCP_CONTEXT_HOOK_COMMAND = `npx -y ${MCP_PACKAGE_SPEC} context-hook`;
+const MCP_PRE_ACTION_HOOK_COMMAND = `npx -y ${MCP_PACKAGE_SPEC} pre-action-hook`;
+const MCP_ACTION_RESULT_HOOK_COMMAND = `npx -y ${MCP_PACKAGE_SPEC} hook`;
+const MCP_SESSION_END_HOOK_COMMAND = `npx -y ${MCP_PACKAGE_SPEC} session-hook`;
+const NATIVE_HOOK_MATCHER = 'Bash|Edit|Write|MultiEdit|mcp__(?!marrow_).*';
+const NATIVE_EXPECTED_HOOKS = ['prompt', 'pre_action', 'action_result', 'session_end'];
+const SOURCE_CLIENTS = new Set(['claude-code', 'cursor', 'composer', 'windsurf', 'openclaw', 'codex', 'gemini', 'grok', 'deepseek', 'qwen', 'kimi', 'minimax', 'cline', 'opencode', 'hermes', 'glm', 'custom', 'unknown']);
+const HARNESS_CAPABILITY_REGISTRY = Object.freeze([
+  { client: 'claude-code', capability_level: 'native_hooks', automatic: ['prompt', 'pre_action', 'action_result', 'session_end'], install_surface: 'mcp' },
+  { client: 'cursor', capability_level: 'mcp', automatic: ['mcp_tool_calls'], install_surface: 'mcp' },
+  { client: 'composer', capability_level: 'mcp', automatic: ['mcp_tool_calls'], install_surface: 'mcp' },
+  { client: 'cline', capability_level: 'mcp', automatic: ['mcp_tool_calls'], install_surface: 'mcp' },
+  { client: 'windsurf', capability_level: 'mcp', automatic: ['mcp_tool_calls'], install_surface: 'mcp' },
+  { client: 'codex', capability_level: 'governed_wrapper', automatic: ['pre_action', 'action_result', 'outcome_closure'], install_surface: 'runner' },
+  { client: 'opencode', capability_level: 'governed_wrapper', automatic: ['pre_action', 'action_result', 'outcome_closure'], install_surface: 'runner' },
+  { client: 'hermes', capability_level: 'event_contract', automatic: [], install_surface: 'addon' },
+  { client: 'openclaw', capability_level: 'event_contract', automatic: [], install_surface: 'addon' },
+  { client: 'gemini', capability_level: 'governed_wrapper', automatic: ['pre_action', 'action_result', 'outcome_closure'], install_surface: 'runner' },
+  { client: 'grok', capability_level: 'governed_wrapper', automatic: ['pre_action', 'action_result', 'outcome_closure'], install_surface: 'runner' },
+  { client: 'deepseek', capability_level: 'governed_wrapper', automatic: ['pre_action', 'action_result', 'outcome_closure'], install_surface: 'runner' },
+  { client: 'qwen', capability_level: 'governed_wrapper', automatic: ['pre_action', 'action_result', 'outcome_closure'], install_surface: 'runner' },
+  { client: 'kimi', capability_level: 'governed_wrapper', automatic: ['pre_action', 'action_result', 'outcome_closure'], install_surface: 'runner' },
+  { client: 'minimax', capability_level: 'governed_wrapper', automatic: ['pre_action', 'action_result', 'outcome_closure'], install_surface: 'runner' },
+  { client: 'glm', capability_level: 'governed_wrapper', automatic: ['pre_action', 'action_result', 'outcome_closure'], install_surface: 'runner' },
+  { client: 'custom', capability_level: 'event_contract', automatic: [], install_surface: 'event_contract' },
+]);
 
 function sourceClient() {
   const raw = String(process.env.MARROW_CLIENT || process.env.MARROW_HARNESS || process.env.MARROW_AGENT_CLIENT || '').trim().toLowerCase().replace(/\s+/g, '-').replace(/^@/, '');
@@ -15,6 +46,7 @@ function sourceClient() {
     claude_code: 'claude-code',
     'claude-code': 'claude-code',
     cursor: 'cursor',
+    composer: 'composer',
     windsurf: 'windsurf',
     openclaw: 'openclaw',
     codex: 'codex',
@@ -422,38 +454,245 @@ function upsertBlock(content, block) {
   return `${content}${separator}${block}\n`;
 }
 
-function upsertClaudeHooks(settingsPath) {
-  const settings = parseJsonObject(settingsPath);
-  const hooks = settings.hooks && typeof settings.hooks === 'object' && !Array.isArray(settings.hooks)
-    ? settings.hooks
-    : {};
-  const postToolUse = Array.isArray(hooks.PostToolUse) ? [...hooks.PostToolUse] : [];
-  const userPromptSubmit = Array.isArray(hooks.UserPromptSubmit) ? [...hooks.UserPromptSubmit] : [];
-
-  const hasPost = postToolUse.some((entry) => JSON.stringify(entry).includes('npx -y @getmarrow/mcp hook'));
-  const hasPrompt = userPromptSubmit.some((entry) => JSON.stringify(entry).includes('npx -y @getmarrow/mcp context-hook'));
+function exactHookConfigured(settings, eventName, command, matcher) {
+  const entries = settings?.hooks?.[eventName];
+  if (!Array.isArray(entries)) return false;
+  return entries.some((entry) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return false;
+    if (matcher != null && entry.matcher !== matcher) return false;
+    if (!Array.isArray(entry.hooks)) return false;
+    return entry.hooks.some((hook) => (
+      hook
+      && typeof hook === 'object'
+      && !Array.isArray(hook)
+      && hook.type === 'command'
+      && typeof hook.command === 'string'
+      && hook.command.trim() === command
+    ));
+  });
+}
 
-  if (!hasPost) {
-    postToolUse.push({
-      matcher: 'Bash|Edit|Write|MultiEdit|mcp__(?!marrow_).*',
-      hooks: [{ type: 'command', command: 'npx -y @getmarrow/mcp hook' }],
+function exactHookDescriptors(settings, eventName, command, matcher) {
+  const entries = settings?.hooks?.[eventName];
+  if (!Array.isArray(entries)) return [];
+  return entries.flatMap((entry) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return [];
+    if (matcher != null && entry.matcher !== matcher) return [];
+    if (!Array.isArray(entry.hooks)) return [];
+    return entry.hooks.flatMap((hook) => {
+      if (!hook || typeof hook !== 'object' || Array.isArray(hook)
+        || hook.type !== 'command' || typeof hook.command !== 'string'
+        || hook.command.trim() !== command) return [];
+      return [{
+        matcher: typeof entry.matcher === 'string' ? entry.matcher : null,
+        command,
+        timeout: typeof hook.timeout === 'number' && Number.isFinite(hook.timeout)
+          ? hook.timeout
+          : null,
+      }];
     });
+  });
+}
+
+function marrowHookSubcommand(command) {
+  if (typeof command !== 'string') return null;
+  const match = command.trim().match(
+    /^npx\s+(?:-y\s+)?@getmarrow\/mcp(?:@[^\s]+)?\s+(context-hook|pre-action-hook|hook|session-hook)$/,
+  );
+  return match?.[1] || null;
+}
+
+function reconcileMarrowCommandHook(settings, eventName, subcommand, command, matcher) {
+  const original = Array.isArray(settings?.hooks?.[eventName]) ? settings.hooks[eventName] : [];
+  let preferredHandler = null;
+  const retained = [];
+  for (const entry of original) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry) || !Array.isArray(entry.hooks)) {
+      retained.push(entry);
+      continue;
+    }
+    const remaining = [];
+    for (const hook of entry.hooks) {
+      const detected = hook && typeof hook === 'object' && !Array.isArray(hook)
+        && hook.type === 'command' ? marrowHookSubcommand(hook.command) : null;
+      if (detected) {
+        const exactMatcher = matcher == null ? entry.matcher === undefined : entry.matcher === matcher;
+        if (detected === subcommand && (!preferredHandler || (hook.command === command && exactMatcher))) {
+          preferredHandler = hook;
+        }
+        continue;
+      }
+      remaining.push(hook);
+    }
+    if (remaining.length > 0) retained.push({ ...entry, hooks: remaining });
   }
-  if (!hasPrompt) {
-    userPromptSubmit.push({
-      hooks: [{ type: 'command', command: 'npx -y @getmarrow/mcp context-hook' }],
+  const canonical = { hooks: [{ ...(preferredHandler || {}), type: 'command', command }] };
+  if (matcher != null) canonical.matcher = matcher;
+  retained.push(canonical);
+  return retained;
+}
+
+function marrowHookDescriptors(settings, eventName, subcommand) {
+  const entries = settings?.hooks?.[eventName];
+  if (!Array.isArray(entries)) return [];
+  return entries.flatMap((entry) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry) || !Array.isArray(entry.hooks)) return [];
+    return entry.hooks.flatMap((hook) => {
+      if (!hook || typeof hook !== 'object' || Array.isArray(hook)
+        || hook.type !== 'command') return [];
+      const detected = marrowHookSubcommand(hook.command);
+      if (!detected || (subcommand && detected !== subcommand)) return [];
+      return [{
+        matcher: typeof entry.matcher === 'string' ? entry.matcher : null,
+        command: hook.command.trim(),
+        timeout: typeof hook.timeout === 'number' && Number.isFinite(hook.timeout) ? hook.timeout : null,
+      }];
     });
+  });
+}
+
+function safeJsonObject(filePath) {
+  try {
+    return parseJsonObject(filePath);
+  } catch {
+    return {};
   }
+}
+
+function claudeNativeHookFingerprint(settings) {
+  const contract = {
+    schema: 'marrow-claude-native-hooks.v3',
+    adapter_version: MCP_ADAPTER_VERSION,
+    expected_hooks: NATIVE_EXPECTED_HOOKS,
+    configured: {
+      prompt: exactHookConfigured(settings, 'UserPromptSubmit', MCP_CONTEXT_HOOK_COMMAND),
+      pre_action: exactHookConfigured(settings, 'PreToolUse', MCP_PRE_ACTION_HOOK_COMMAND, NATIVE_HOOK_MATCHER),
+      action_result_success: exactHookConfigured(settings, 'PostToolUse', MCP_ACTION_RESULT_HOOK_COMMAND, NATIVE_HOOK_MATCHER),
+      action_result_failure: exactHookConfigured(settings, 'PostToolUseFailure', MCP_ACTION_RESULT_HOOK_COMMAND, NATIVE_HOOK_MATCHER),
+      session_end: exactHookConfigured(settings, 'Stop', MCP_SESSION_END_HOOK_COMMAND),
+    },
+    descriptors: {
+      prompt: exactHookDescriptors(settings, 'UserPromptSubmit', MCP_CONTEXT_HOOK_COMMAND),
+      pre_action: exactHookDescriptors(settings, 'PreToolUse', MCP_PRE_ACTION_HOOK_COMMAND, NATIVE_HOOK_MATCHER),
+      action_result_success: exactHookDescriptors(settings, 'PostToolUse', MCP_ACTION_RESULT_HOOK_COMMAND, NATIVE_HOOK_MATCHER),
+      action_result_failure: exactHookDescriptors(settings, 'PostToolUseFailure', MCP_ACTION_RESULT_HOOK_COMMAND, NATIVE_HOOK_MATCHER),
+      session_end: exactHookDescriptors(settings, 'Stop', MCP_SESSION_END_HOOK_COMMAND),
+    },
+    active_marrow_handlers: {
+      prompt: marrowHookDescriptors(settings, 'UserPromptSubmit'),
+      pre_action: marrowHookDescriptors(settings, 'PreToolUse'),
+      action_result_success: marrowHookDescriptors(settings, 'PostToolUse'),
+      action_result_failure: marrowHookDescriptors(settings, 'PostToolUseFailure'),
+      session_end: marrowHookDescriptors(settings, 'Stop'),
+    },
+  };
+  return crypto.createHash('sha256').update(JSON.stringify(contract)).digest('hex');
+}
+
+function upsertClaudeHooks(settingsPath) {
+  const settings = parseJsonObject(settingsPath);
+  const hooks = settings.hooks && typeof settings.hooks === 'object' && !Array.isArray(settings.hooks)
+    ? settings.hooks
+    : {};
+  const postToolUse = reconcileMarrowCommandHook(
+    settings, 'PostToolUse', 'hook', MCP_ACTION_RESULT_HOOK_COMMAND, NATIVE_HOOK_MATCHER,
+  );
+  const postToolUseFailure = reconcileMarrowCommandHook(
+    settings, 'PostToolUseFailure', 'hook', MCP_ACTION_RESULT_HOOK_COMMAND, NATIVE_HOOK_MATCHER,
+  );
+  const preToolUse = reconcileMarrowCommandHook(
+    settings, 'PreToolUse', 'pre-action-hook', MCP_PRE_ACTION_HOOK_COMMAND, NATIVE_HOOK_MATCHER,
+  );
+  const userPromptSubmit = reconcileMarrowCommandHook(
+    settings, 'UserPromptSubmit', 'context-hook', MCP_CONTEXT_HOOK_COMMAND,
+  );
+  const stop = reconcileMarrowCommandHook(
+    settings, 'Stop', 'session-hook', MCP_SESSION_END_HOOK_COMMAND,
+  );
 
   settings.hooks = {
     ...hooks,
+    PreToolUse: preToolUse,
     PostToolUse: postToolUse,
+    PostToolUseFailure: postToolUseFailure,
     UserPromptSubmit: userPromptSubmit,
+    Stop: stop,
   };
 
   return JSON.stringify(settings, null, 2) + '\n';
 }
 
+function activationProfile(detection, plan, changes, client) {
+  const registry = HARNESS_CAPABILITY_REGISTRY.find((entry) => entry.client === client)
+    || HARNESS_CAPABILITY_REGISTRY.find((entry) => entry.client === 'custom');
+  const sdkDependency = inspectSdkDependency(detection);
+  const capabilityLevel = client === 'custom' && (plan.mode === 'sdk' || plan.mode === 'both')
+    ? 'sdk_passive_runtime'
+    : registry.capability_level;
+  const expectedHooks = capabilityLevel === 'sdk_passive_runtime'
+    ? ['pre_action', 'action_result', 'outcome_closure']
+    : [...registry.automatic];
+  const adapterVersion = capabilityLevel === 'native_hooks' || capabilityLevel === 'mcp'
+    ? MCP_ADAPTER_VERSION
+    : capabilityLevel === 'sdk_passive_runtime'
+    ? SDK_ADAPTER_VERSION
+    : INSTALLER_ADAPTER_VERSION;
+  const observedHooks = [];
+  const claudeSettings = safeJsonObject(detection.paths.claudeSettings);
+  if (capabilityLevel === 'native_hooks'
+    && exactHookConfigured(claudeSettings, 'UserPromptSubmit', MCP_CONTEXT_HOOK_COMMAND)) observedHooks.push('prompt');
+  if (capabilityLevel === 'native_hooks'
+    && exactHookConfigured(claudeSettings, 'PreToolUse', MCP_PRE_ACTION_HOOK_COMMAND, NATIVE_HOOK_MATCHER)) observedHooks.push('pre_action');
+  if (capabilityLevel === 'native_hooks'
+    && exactHookConfigured(claudeSettings, 'PostToolUse', MCP_ACTION_RESULT_HOOK_COMMAND, NATIVE_HOOK_MATCHER)
+    && exactHookConfigured(claudeSettings, 'PostToolUseFailure', MCP_ACTION_RESULT_HOOK_COMMAND, NATIVE_HOOK_MATCHER)) observedHooks.push('action_result');
+  if (capabilityLevel === 'native_hooks'
+    && exactHookConfigured(claudeSettings, 'Stop', MCP_SESSION_END_HOOK_COMMAND)) observedHooks.push('session_end');
+  const passiveRuntime = safeRead(detection.paths.passiveRuntime);
+  if (capabilityLevel === 'sdk_passive_runtime'
+    && sdkDependency.present
+    && /await import\('@getmarrow\/sdk'\)/.test(passiveRuntime)
+    && /runtime\.install\(\)/.test(passiveRuntime)) {
+    for (const hook of ['pre_action', 'action_result', 'outcome_closure']) {
+      if (!observedHooks.includes(hook)) observedHooks.push(hook);
+    }
+  }
+  const mcpConfigs = [detection.paths.mcpJson, detection.paths.cursorMcp]
+    .map((filePath) => safeJsonObject(filePath));
+  if (capabilityLevel === 'mcp' && mcpConfigs.some((config) => (
+    config?.mcpServers?.marrow?.command === 'npx'
+    && Array.isArray(config.mcpServers.marrow.args)
+    && config.mcpServers.marrow.args.join(' ') === `-y ${MCP_PACKAGE_SPEC}`
+  ))) observedHooks.push('mcp_tool_calls');
+  const fingerprintMaterial = changes
+    .filter((change) => change.applied || change.already_present)
+    .map((change) => `${change.label}:${crypto.createHash('sha256').update(safeRead(change.path)).digest('hex')}`)
+    .sort()
+    .join('|');
+  const configFingerprint = capabilityLevel === 'native_hooks'
+    ? claudeNativeHookFingerprint(claudeSettings)
+    : crypto.createHash('sha256')
+      .update(`${client}:${capabilityLevel}:${expectedHooks.join(',')}:${fingerprintMaterial}`)
+      .digest('hex');
+  const complete = expectedHooks.length > 0 && expectedHooks.every((hook) => observedHooks.includes(hook));
+  const exactFix = complete
+    ? null
+    : capabilityLevel === 'sdk_passive_runtime' && !sdkDependency.present
+    ? `${sdkDependency.install_command} && npx @getmarrow/install --repair`
+    : capabilityLevel === 'governed_wrapper'
+    ? `npx @getmarrow/install run --agent <agent-id> -- ${client}`
+    : 'npx @getmarrow/install --repair';
+  return {
+    adapter_version: adapterVersion,
+    capability_level: capabilityLevel,
+    config_fingerprint: configFingerprint,
+    expected_hooks: expectedHooks,
+    observed_hooks: observedHooks,
+    complete,
+    exact_fix: exactFix,
+  };
+}
+
 function upsertMcpServerConfig(filePath) {
   const config = parseJsonObject(filePath);
   const servers = config.mcpServers && typeof config.mcpServers === 'object' && !Array.isArray(config.mcpServers)
@@ -461,7 +700,7 @@ function upsertMcpServerConfig(filePath) {
     : {};
   servers.marrow = {
     command: 'npx',
-    args: ['-y', '@getmarrow/mcp'],
+    args: ['-y', MCP_PACKAGE_SPEC],
     env: {
       MARROW_API_KEY: '${MARROW_API_KEY}',
       MARROW_BASE_URL: '${MARROW_BASE_URL}',
@@ -485,7 +724,7 @@ function inspectSdkDependency(detection) {
     return {
       required: true,
       present: false,
-      install_command: 'npm install @getmarrow/sdk',
+      install_command: `npm install @getmarrow/sdk@${SDK_ADAPTER_VERSION}`,
       warning: 'package.json could not be parsed; verify @getmarrow/sdk manually.',
     };
   }
@@ -496,11 +735,72 @@ function inspectSdkDependency(detection) {
     packageJson.optionalDependencies,
     packageJson.peerDependencies,
   ];
-  const present = dependencyBlocks.some((deps) => deps && Object.prototype.hasOwnProperty.call(deps, '@getmarrow/sdk'));
+  const declaredSpec = dependencyBlocks
+    .map((deps) => deps && typeof deps['@getmarrow/sdk'] === 'string' ? deps['@getmarrow/sdk'] : null)
+    .find(Boolean) || null;
+  const objectTargetsSdk = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+    return Object.entries(value).some(([key, nested]) => (
+      key.includes('@getmarrow/sdk') || objectTargetsSdk(nested)
+    ));
+  };
+  const overrideDetected = objectTargetsSdk(packageJson.overrides)
+    || objectTargetsSdk(packageJson.resolutions)
+    || objectTargetsSdk(packageJson.pnpm?.overrides);
+  let lockVerified = false;
+  try {
+    const lock = JSON.parse(safeRead(path.join(detection.root, 'package-lock.json')) || '{}');
+    const rootLock = lock?.packages?.[''];
+    const lockedSdk = lock?.packages?.['node_modules/@getmarrow/sdk'];
+    const lockedDeclaration = [
+      rootLock?.dependencies,
+      rootLock?.devDependencies,
+      rootLock?.optionalDependencies,
+      rootLock?.peerDependencies,
+    ].map((deps) => deps && typeof deps['@getmarrow/sdk'] === 'string' ? deps['@getmarrow/sdk'] : null)
+      .find(Boolean) || null;
+    lockVerified = [2, 3].includes(lock?.lockfileVersion)
+      && lockedDeclaration === declaredSpec
+      && lockedSdk?.version === SDK_ADAPTER_VERSION
+      && lockedSdk?.resolved === SDK_ADAPTER_TARBALL
+      && lockedSdk?.integrity === SDK_ADAPTER_INTEGRITY;
+  } catch {
+    lockVerified = false;
+  }
+  const installedPackagePath = findUp(
+    detection.root,
+    [path.join('node_modules', '@getmarrow', 'sdk', 'package.json')],
+  );
+  let installedVersion = null;
+  let installedName = null;
+  try {
+    const installedPackage = installedPackagePath ? JSON.parse(safeRead(installedPackagePath)) : null;
+    installedVersion = typeof installedPackage?.version === 'string' ? installedPackage.version : null;
+    installedName = typeof installedPackage?.name === 'string' ? installedPackage.name : null;
+  } catch {
+    installedVersion = null;
+    installedName = null;
+  }
+  const declarationTrusted = typeof declaredSpec === 'string'
+    && declaredSpec.trim().length > 0
+    && /^[v0-9xX*<>=~^|.\s-]+$/.test(declaredSpec.trim());
+  const present = declarationTrusted
+    && !overrideDetected
+    && lockVerified
+    && installedName === '@getmarrow/sdk'
+    && installedVersion === SDK_ADAPTER_VERSION;
   return {
     required: true,
     present,
-    install_command: present ? null : 'npm install @getmarrow/sdk',
+    declared: declaredSpec != null,
+    declared_spec: declaredSpec,
+    declaration_trusted: declarationTrusted,
+    override_detected: overrideDetected,
+    lock_verified: lockVerified,
+    installed_name: installedName,
+    installed_version: installedVersion,
+    expected_version: SDK_ADAPTER_VERSION,
+    install_command: present ? null : `npm install @getmarrow/sdk@${SDK_ADAPTER_VERSION}`,
   };
 }
 
@@ -569,8 +869,7 @@ function buildPlan(detection, options) {
 }
 
 function applyPlan(plan, options) {
-  const changes = [];
-  for (const write of plan.writes) {
+  const prepared = plan.writes.map((write) => {
     const before = safeRead(write.path);
     let after;
     if (write.type === 'file') {
@@ -587,6 +886,11 @@ function applyPlan(plan, options) {
       throw new Error(`Unknown write type: ${write.type}`);
     }
 
+    return { write, before, after };
+  });
+
+  const changes = [];
+  for (const { write, before, after } of prepared) {
     const changed = before !== after;
     const writeApplied = Boolean(options.yes && !options.dryRun && !options.doctor);
     changes.push({
@@ -628,7 +932,6 @@ function isCanonicalTimestamp(value) {
 
 function runtimeGateVerified(runtime) {
   if (!runtime || typeof runtime !== 'object') return false;
-  if (runtime.ok === true) return true;
   const gate = runtime.risk_gate;
   if (!gate || typeof gate !== 'object') return false;
   if (typeof gate.allow === 'boolean' || typeof gate.allowed === 'boolean') return true;
@@ -733,7 +1036,19 @@ async function runSelfTest(options) {
   const installValueMoment = buildInstallValueMoment(firstValueSignal, status, runtime, performance, firstValue, tokenValueProof);
   let activationReceipt = null;
   let activationVerified = false;
+  let activationProfileReceipt = null;
   if (options.activation) {
+    const activationAdapterVersion = options.activation.adapter_version || INSTALLER_ADAPTER_VERSION;
+    const activationCapabilityLevel = options.activation.capability_level || 'event_contract';
+    const activationExpectedHooks = Array.isArray(options.activation.expected_hooks) ? options.activation.expected_hooks : [];
+    const activationConfigFingerprint = options.activation.config_fingerprint || crypto.createHash('sha256')
+      .update(JSON.stringify({
+        harness: options.activation.harness || options.client || 'custom',
+        install_surface: options.activation.install_surface || 'unknown',
+        adapter_version: activationAdapterVersion,
+        expected_hooks: activationExpectedHooks,
+      }))
+      .digest('hex');
     activationReceipt = firstValue && firstValue.activation_receipt;
     const receiptValid = activationReceipt
       && typeof activationReceipt === 'object'
@@ -750,7 +1065,58 @@ async function runSelfTest(options) {
     if (!receiptValid) {
       throw new Error('activation receipt did not verify the exact self-test decision, agent, runtime gate, and closed successful outcome');
     }
-    activationVerified = Boolean(firstValue.active && runtimeGateVerified(runtime) && (status.enabled ?? status.ok));
+    activationProfileReceipt = await requestJson(`${baseUrl}/v1/agent/integrations/events`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({
+        event_id: `activation-${activationConfigFingerprint.slice(0, 32)}`,
+        event_type: 'activation_profile_registered',
+        harness: options.activation.harness,
+        agent_id: options.agentId,
+        session_id: headers['x-marrow-session-id'],
+        adapter_version: activationAdapterVersion,
+        capability_level: activationCapabilityLevel,
+        config_fingerprint: activationConfigFingerprint,
+        expected_hooks: activationExpectedHooks,
+        action: 'passive integration activation profile registered',
+        occurred_at: new Date().toISOString(),
+      }),
+    });
+    const profileCoverage = activationProfileReceipt?.activation_coverage;
+    const profileReceipt = profileCoverage?.profile_receipt;
+    const accountBindingId = profileCoverage?.account_binding_id;
+    const expectedConfigurationBindingId = typeof accountBindingId === 'string'
+      ? crypto.createHash('sha256')
+        .update(`agent-config-receipt:v2:${accountBindingId}:${activationConfigFingerprint}`)
+        .digest('hex')
+      : null;
+    const expectedHooksMatch = Array.isArray(profileCoverage?.capture_coverage?.expected_hooks)
+      && [...profileCoverage.capture_coverage.expected_hooks].sort().join(',') === [...activationExpectedHooks].sort().join(',');
+    const profileBound = Boolean(
+      activationProfileReceipt?.accepted === true
+      && profileCoverage?.agent_id === options.agentId
+      && profileCoverage?.harness === options.activation.harness
+      && profileCoverage?.activation?.adapter_version === activationAdapterVersion
+      && profileCoverage?.activation?.capability_level === activationCapabilityLevel
+      && profileReceipt?.agent_id === options.agentId
+      && profileReceipt?.harness === options.activation.harness
+      && profileReceipt?.adapter_version === activationAdapterVersion
+      && profileReceipt?.capability_level === activationCapabilityLevel
+      && typeof accountBindingId === 'string'
+      && accountBindingId.length === 64
+      && profileReceipt?.account_binding_id === accountBindingId
+      && profileReceipt?.config_fingerprint_verified === true
+      && profileReceipt?.configuration_binding_id === expectedConfigurationBindingId
+      && profileReceipt?.expected_hooks_verified === true
+      && expectedHooksMatch
+    );
+    activationVerified = Boolean(
+      firstValue.active
+      && runtimeGateVerified(runtime)
+      && (status.enabled ?? status.ok)
+      && options.activation.complete === true
+      && profileBound,
+    );
     if (!activationVerified) {
       throw new Error('activation prerequisites were not all verified by the server');
     }
@@ -769,6 +1135,8 @@ async function runSelfTest(options) {
     runtime_before_you_act: runtime.before_you_act || null,
     activation_verified: activationVerified,
     activation_receipt: activationReceipt,
+    activation_profile_receipt: activationProfileReceipt,
+    activation_coverage: status.activation_coverage || firstValue.activation_coverage || null,
     first_value: firstValue && firstValue.ok !== false ? firstValue : null,
     first_value_signal: firstValueSignal,
     install_value_moment: installValueMoment,
@@ -916,7 +1284,7 @@ function printReport(report) {
 
   process.stdout.write('\nPlanned changes:\n');
   for (const change of report.changes) {
-    const marker = change.changed ? (report.writeMode === 'write' ? 'wrote' : 'would write') : 'unchanged';
+    const marker = change.applied ? 'wrote' : change.changed ? 'would write' : 'unchanged';
     process.stdout.write(`- ${marker}: ${change.label} (${change.path})\n`);
   }
 
@@ -1025,6 +1393,9 @@ async function install(options) {
   if (options.activate && options.selfTest === false) {
     throw new Error('activate requires the server self-test');
   }
+  if (options.repair && options.yes !== true && !options.dryRun && !options.doctor) {
+    throw new Error('repair requires explicit write authorization (--yes)');
+  }
   const detection = detectEnvironment(options.cwd);
   const plan = buildPlan(detection, options);
   const writeMode = options.doctor ? 'doctor' : options.dryRun ? 'dry-run' : options.repair ? 'repair' : options.yes ? 'write' : 'dry-run';
@@ -1032,6 +1403,7 @@ async function install(options) {
   const client = detectedClient(detection);
   options.client = client;
   if (!options.agentId) options.agentId = stableAgentId(detection.root, client);
+  const profile = activationProfile(detection, plan, changes, client);
   options.activation = options.activate ? {
     harness: client,
     agent_id: options.agentId,
@@ -1041,14 +1413,20 @@ async function install(options) {
       .filter((change) => change.changed && change.applied && /hook|runtime|rule|instruction|config/i.test(change.label))
       .map((change) => change.label)
       .slice(0, 20),
-    capture_verified: changes.every((change) => change.applied),
+    capture_verified: changes.every((change) => change.applied || change.already_present),
+    adapter_version: profile.adapter_version,
+    capability_level: profile.capability_level,
+    config_fingerprint: profile.config_fingerprint,
+    expected_hooks: profile.expected_hooks,
+    observed_hooks: profile.observed_hooks,
+    complete: profile.complete,
     intervention_verified: false,
     closure_verified: false,
   } : null;
   const configInspection = inspectNpmTokenConfig();
   const sdkDependency = inspectSdkDependency(detection);
   const configDiagnostics = configInspection.safe;
-  const configRepairs = options.repair && !options.dryRun && !options.doctor
+  const configRepairs = options.repair && options.yes && !options.dryRun && !options.doctor
     ? repairConfigDiagnostics(configDiagnostics)
     : [];
   const envHints = options.apiKey ? [] : findLikelyEnvFiles(detection);
@@ -1063,7 +1441,7 @@ async function install(options) {
   if (options.activate && !selfTest.activation_verified) {
     throw new Error('Marrow activation failed: server confirmation was not returned');
   }
-  const changedConfig = changes.some((change) => change.changed) || configRepairs.some((repair) => repair.changed);
+  const changedConfig = changes.some((change) => change.applied) || configRepairs.some((repair) => repair.changed);
   const selfTestPassed = Boolean(!selfTest.skipped && selfTest.active && !selfTest.error);
   const remediation = options.repair
     ? {
@@ -1098,6 +1476,7 @@ async function install(options) {
       agent_id: options.agentId,
       server_confirmed: Boolean(selfTest.activation_verified),
       receipt: selfTest.activation_receipt || null,
+      profile,
     },
     changes,
     doctor: {
@@ -1150,4 +1529,8 @@ module.exports = {
   buildInstallValueMoment,
   buildTokenValueProof,
   stableAgentId,
+  activationProfile,
+  claudeNativeHookFingerprint,
+  printReport,
+  HARNESS_CAPABILITY_REGISTRY,
 };