@iowarp/clio-coder 0.4.0 → 0.4.1

package/src/domains/resources/skills/evals.ts

@@ -29,7 +29,7 @@ export interface SkillEvalParseResult {
 
 // Tolerates ASCII dash/colon and the en/em dashes older evals.md files used.
 // The canonical prefix is S ("## S1 - title"); discipline skills use other
-// letters (clio-dev's D1), so any single capital letter is accepted.
+// letters (clio-coder-dev's D1), so any single capital letter is accepted.
 const SCENARIO_HEADING = /^##\s+([A-Z])(\d+)\s*[-:–—]\s*(.+?)\s*$/;
 
 export function parseSkillEvals(markdown: string): SkillEvalParseResult {

package/src/domains/resources/skills/install.ts

@@ -140,14 +140,33 @@ interface ProvenanceFields {
 	installedBy?: "worker";
 }
 
+function canonicalizeProductMetadataBlock(lines: ReadonlyArray<string>): string[] {
+	const hasCanonical = lines.some((line) => /^clio-coder:/.test(line));
+	const canonical: string[] = [];
+	let dropLegacyChildren = false;
+	for (const line of lines) {
+		if (/^clio:/.test(line)) {
+			dropLegacyChildren = hasCanonical;
+			if (!hasCanonical) canonical.push(line.replace(/^clio:/, "clio-coder:"));
+			continue;
+		}
+		if (dropLegacyChildren) {
+			if (line.trim().length === 0 || /^[ \t]/.test(line)) continue;
+			dropLegacyChildren = false;
+		}
+		canonical.push(line);
+	}
+	return canonical;
+}
+
 /**
  * Replace install-lifecycle frontmatter with the recorded fields, written
- * nested under the reserved `clio:` block (merged into an existing block-style
- * `clio:` mapping when the skill carries one). Registry identity lines
+ * nested under the reserved `clio-coder:` block (merged into an existing block-style
+ * `clio-coder:` mapping when the skill carries one). Registry identity lines
  * (`registry-id`, `registry-url`) are content, not lifecycle, so they survive
  * the install and keep pinned drift checks working on the installed copy.
  *
- * A flow-style `clio: {...}` value cannot take appended block lines, so that
+ * A flow-style `clio-coder: {...}` value cannot take appended block lines, so that
  * rare shape falls back to the legacy flat stamps, which the hash and loader
  * still understand.
  */
@@ -166,21 +185,24 @@ function injectProvenanceFrontmatter(rawText: string, fields: ProvenanceFields):
 		"audit: unknown",
 		...(fields.installedBy ? [`installed-by: ${yamlQuote(fields.installedBy)}`] : []),
 	];
-	const clioIndex = kept.findIndex((line) => /^clio:/.test(line));
-	if (clioIndex >= 0 && !/^clio:\s*$/.test(kept[clioIndex] as string)) {
-		return `${region.head}${[...kept, ...stamps].join("\n")}${region.tail}`;
+	const canonicalKept = canonicalizeProductMetadataBlock(kept);
+	const clioIndex = canonicalKept.findIndex((line) => /^clio-coder:/.test(line));
+	if (clioIndex >= 0 && !/^clio-coder:\s*$/.test(canonicalKept[clioIndex] as string)) {
+		return `${region.head}${[...canonicalKept, ...stamps].join("\n")}${region.tail}`;
 	}
 	const nested = stamps.map((line) => `  ${line}`);
 	if (clioIndex < 0) {
-		return `${region.head}${[...kept, "clio:", ...nested].join("\n")}${region.tail}`;
+		return `${region.head}${[...canonicalKept, "clio-coder:", ...nested].join("\n")}${region.tail}`;
 	}
 	let blockEnd = clioIndex + 1;
-	while (blockEnd < kept.length) {
-		const line = kept[blockEnd] as string;
+	while (blockEnd < canonicalKept.length) {
+		const line = canonicalKept[blockEnd] as string;
 		if (line.trim().length > 0 && !/^[ \t]/.test(line)) break;
 		blockEnd += 1;
 	}
-	return `${region.head}${[...kept.slice(0, blockEnd), ...nested, ...kept.slice(blockEnd)].join("\n")}${region.tail}`;
+	return `${region.head}${[...canonicalKept.slice(0, blockEnd), ...nested, ...canonicalKept.slice(blockEnd)].join(
+		"\n",
+	)}${region.tail}`;
 }
 
 function resolveSkillDir(target: string): string {
@@ -205,7 +227,7 @@ function fetchSource(spec: SkillSourceSpec): FetchedSource {
 	if (spec.kind === "local") {
 		return { skillDir: resolveSkillDir(spec.path), cleanup: () => {} };
 	}
-	const tmp = mkdtempSync(path.join(tmpdir(), "clio-skill-"));
+	const tmp = mkdtempSync(path.join(tmpdir(), "clio-coder-skill-"));
 	const cleanup = (): void => rmSync(tmp, { recursive: true, force: true });
 	try {
 		execFileSync("git", ["clone", "--depth", "1", "--branch", spec.branch, spec.cloneUrl, tmp], {
@@ -358,7 +380,9 @@ export function installSkillFromSource(input: InstallSkillInput): InstallSkillRe
 function managedSkills(cwd: string, configDir?: string): Skill[] {
 	const list = loadSkills({ cwd, ...(configDir ? { configDir } : {}) });
 	// Only Clio-managed roots are update targets; compat roots belong to other harnesses.
-	return list.items.filter((skill) => skill.source === "clio" && (skill.scope === "user" || skill.scope === "project"));
+	return list.items.filter(
+		(skill) => skill.source === "clio-coder" && (skill.scope === "user" || skill.scope === "project"),
+	);
 }
 
 function updateOne(skill: Skill, force: boolean): SkillUpdateReport {

package/src/domains/resources/skills/loader.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { type Dirent, existsSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
+import { warnLegacyNaming } from "../../../core/naming-compat.js";
 import type { PendingSkillRequest } from "../../../core/skill-activation.js";
 import { type ToolName, ToolNames } from "../../../core/tool-names.js";
 import { clioConfigDir } from "../../../core/xdg.js";
@@ -47,7 +48,7 @@ const CORE_FRONTMATTER_KEYS = new Set([
  * only encodes collision precedence tiers shared across resource kinds.
  */
 export type SkillSource =
-	| "clio"
+	| "clio-coder"
 	| "agents"
 	| "claude"
 	| "codex"
@@ -216,9 +217,20 @@ function defaultPrecedenceForScope(scope: ResourceScope): number {
  * this gate with skills: both substitute another agent's project file into
  * Clio's context, so one opt-in covers both.
  */
+let warnedLegacyProjectTrustEnv = false;
+
 export function projectCompatTrusted(explicit?: boolean): boolean {
 	if (explicit === true) return true;
-	return process.env.CLIO_CODER_TRUST_PROJECT_SKILLS === "1";
+	if (process.env.CLIO_CODER_TRUST_PROJECT_RESOURCES === "1") return true;
+	if (process.env.CLIO_CODER_TRUST_PROJECT_SKILLS !== "1") return false;
+	if (!warnedLegacyProjectTrustEnv) {
+		warnedLegacyProjectTrustEnv = true;
+		process.emitWarning("CLIO_CODER_TRUST_PROJECT_SKILLS is deprecated; use CLIO_CODER_TRUST_PROJECT_RESOURCES instead", {
+			code: "CLIO_CODER_DEPRECATED_ENV",
+			type: "DeprecationWarning",
+		});
+	}
+	return true;
 }
 
 /**
@@ -268,7 +280,7 @@ export function defaultSkillRoots(input: LoadSkillsInput = {}): SkillRoot[] {
 		roots.push({
 			path: path.join(configDir, "skills"),
 			scope: "user",
-			source: "clio",
+			source: "clio-coder",
 			origin: "config",
 			precedence: SKILL_PRECEDENCE.user,
 			trusted: true,
@@ -292,7 +304,7 @@ export function defaultSkillRoots(input: LoadSkillsInput = {}): SkillRoot[] {
 	roots.push({
 		path: path.join(cwd, ".clio-coder", "skills"),
 		scope: "project",
-		source: "clio",
+		source: "clio-coder",
 		origin: "project",
 		precedence: SKILL_PRECEDENCE.project,
 		trusted: true,
@@ -445,24 +457,36 @@ function extractMetadata(frontmatter: Record<string, unknown>): Record<string, u
 	const metadata: Record<string, unknown> = {};
 	for (const [key, value] of Object.entries(frontmatter)) {
 		if (CORE_FRONTMATTER_KEYS.has(key)) continue;
+		if (key === "clio-coder") {
+			metadata.clioCoder = value;
+			continue;
+		}
+		if (key === "clio") {
+			warnLegacyNaming("clio: skill metadata", "clio-coder: skill metadata");
+			if (!("clio-coder" in frontmatter)) metadata.clioCoder = value;
+			continue;
+		}
 		metadata[key] = value;
 	}
 	return metadata;
 }
 
 function extractProvenance(frontmatter: Record<string, unknown>): SkillProvenance | undefined {
-	// Provenance lives nested under the reserved `clio:` block; the flat
+	// Provenance lives nested under the reserved `clio-coder:` block; the flat
 	// top-level keys remain readable for already-installed copies stamped
 	// before the nested form existed.
-	const clioRaw = frontmatter.clio;
-	const clio =
-		clioRaw !== null && typeof clioRaw === "object" && !Array.isArray(clioRaw)
-			? (clioRaw as Record<string, unknown>)
+	const canonicalRaw = frontmatter["clio-coder"];
+	const legacyRaw = frontmatter.clio;
+	if (legacyRaw !== undefined) warnLegacyNaming("clio: skill metadata", "clio-coder: skill metadata");
+	const clioCoderRaw = canonicalRaw ?? legacyRaw;
+	const clioCoder =
+		clioCoderRaw !== null && typeof clioCoderRaw === "object" && !Array.isArray(clioCoderRaw)
+			? (clioCoderRaw as Record<string, unknown>)
 			: undefined;
 	const field = (...keys: string[]): string | null => {
 		for (const key of keys) {
-			if (clio) {
-				const nested = stringField(clio, key);
+			if (clioCoder) {
+				const nested = stringField(clioCoder, key);
 				if (nested !== null) return nested;
 			}
 		}
@@ -621,7 +645,9 @@ function loadSkillFile(
 
 	const pathSubject = validationSubject(filePath);
 	const frontmatterName = stringField(parsed.frontmatter, "name");
-	const name = frontmatterName ?? pathSubject;
+	const rawName = frontmatterName ?? pathSubject;
+	const name = rawName === "clio-dev" ? "clio-coder-dev" : rawName === "clio-test" ? "clio-coder-test" : rawName;
+	if (name !== rawName) warnLegacyNaming(rawName, name);
 	const description = stringField(parsed.frontmatter, "description");
 
 	for (const message of validateDescription(description)) diagnostics.push({ type: "warning", message, path: filePath });
@@ -658,7 +684,7 @@ function loadSkillFile(
 		disableModelInvocation: booleanField(parsed.frontmatter, "disable-model-invocation"),
 		...(allowedTools ? { allowedTools } : {}),
 		...(disallowedTools ? { disallowedTools } : {}),
-		source: root.source ?? "clio",
+		source: root.source ?? "clio-coder",
 		scope,
 		hash: sha256(raw),
 		normalizedHash: normalizedSkillHash(raw),

package/src/domains/resources/skills/marketplace.ts

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { warnLegacyNaming } from "../../../core/naming-compat.js";
 import { resolvePackageRoot } from "../../../core/package-root.js";
 import { clioConfigDir } from "../../../core/xdg.js";
 import {
@@ -55,6 +56,8 @@ export interface MarketplaceSkill {
 	audit?: "pass" | "warn" | "fail" | "unknown";
 	/** Catalog grouping ("git", "research", ...); absent in a flat catalog. */
 	category?: string;
+	/** Trigger phrases from the skill's frontmatter, for local promotion matching. */
+	triggers?: string[];
 	origin: MarketplaceSkillOrigin;
 	requires?: LibraryRequirementRef[];
 }
@@ -131,6 +134,16 @@ function optionalString(value: unknown): string | undefined {
 	return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
 }
 
+/** Non-empty trimmed trigger phrases, or undefined when the field is absent or unusable. */
+function optionalTriggerList(value: unknown): string[] | undefined {
+	if (!Array.isArray(value)) return undefined;
+	const triggers = value
+		.filter((entry): entry is string => typeof entry === "string")
+		.map((entry) => entry.trim())
+		.filter((entry) => entry.length > 0);
+	return triggers.length > 0 ? triggers : undefined;
+}
+
 function indexAudit(value: unknown): MarketplaceSkill["audit"] {
 	return value === "pass" || value === "warn" || value === "fail" || value === "unknown" ? value : undefined;
 }
@@ -151,6 +164,7 @@ function parseMarketplaceIndex(indexPath: string, diagnostics: string[] = []): M
 			const version = optionalString(record.version);
 			const audit = indexAudit(record.audit);
 			const category = optionalString(record.category);
+			const triggers = optionalTriggerList(record.triggers);
 			if (record.kind !== undefined && !["skill", "agent", "prompt", "fleet"].includes(String(record.kind))) {
 				diagnostics.push(`skill marketplace index entry has unsupported kind: ${skill.name}`);
 				return [];
@@ -176,6 +190,7 @@ function parseMarketplaceIndex(indexPath: string, diagnostics: string[] = []): M
 					...(version ? { version } : {}),
 					...(audit ? { audit } : {}),
 					...(category ? { category } : {}),
+					...(triggers ? { triggers } : {}),
 					...(requires ? { requires } : {}),
 					origin: "index" as const,
 				},
@@ -242,6 +257,7 @@ function catalogCategory(catalogDir: string, baseDir: string): string | undefine
 function catalogEntry(skill: Skill, catalogDir: string): MarketplaceSkill {
 	const version = typeof skill.metadata.version === "string" ? skill.metadata.version : undefined;
 	const category = catalogCategory(catalogDir, skill.baseDir);
+	const triggers = optionalTriggerList(skill.metadata.triggers);
 	return {
 		name: skill.name,
 		description: skill.description,
@@ -249,6 +265,7 @@ function catalogEntry(skill: Skill, catalogDir: string): MarketplaceSkill {
 		...(version ? { version } : {}),
 		...(skill.provenance?.audit ? { audit: skill.provenance.audit } : {}),
 		...(category ? { category } : {}),
+		...(triggers ? { triggers } : {}),
 		origin: "catalog",
 		kind: "skill",
 	};
@@ -311,7 +328,9 @@ export function getMarketplaceSkills(options: DiscoverMarketplaceOptions = {}):
  * an existing install always requires an explicit `force: true`.
  */
 export function installSkill(input: InstallSkillInput): InstallSkillResult {
-	const source = input.source.trim();
+	const requested = input.source.trim();
+	const source = requested === "clio-dev" ? "clio-coder-dev" : requested === "clio-test" ? "clio-coder-test" : requested;
+	if (source !== requested) warnLegacyNaming(requested, source);
 	const spec = parseSkillSourceSpec(source);
 	if (spec?.kind === "local" && isSkillName(source) && !existsSync(spec.path)) {
 		const skill = getMarketplaceSkills({ ...(input.cwd ? { cwd: input.cwd } : {}) }).find(
@@ -322,5 +341,5 @@ export function installSkill(input: InstallSkillInput): InstallSkillResult {
 		}
 		return installSkillFromSource({ ...input, source: skill.sourceUrl });
 	}
-	return installSkillFromSource(input);
+	return installSkillFromSource({ ...input, source });
 }

package/src/domains/resources/skills/promotion.ts

@@ -0,0 +1,214 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { safeResourceWrite } from "../../../core/safe-resource-write.js";
+import { clioConfigDir } from "../../../core/xdg.js";
+import type { MarketplaceSkill } from "./marketplace.js";
+
+/**
+ * Marketplace self-promotion: local detection that an uninstalled marketplace
+ * skill serves the operator's current request, plus the two policy pieces the
+ * offer flow needs — the persistent "never offer this skill" store and the
+ * own-marketplace source gate that bounds what a promotion-flow install may
+ * ever fetch.
+ *
+ * Detection is a pure lexical match against the local catalog: no model call,
+ * no network, and no request text ever leaves the process. False positives
+ * cost operator trust, so the matcher is deliberately conservative — a
+ * trigger-phrase hit or a strong distinctive-token overlap fires; anything
+ * weaker stays silent and the broad paths (the first-turn reminder,
+ * context(scope="skills")) remain the fallback.
+ */
+
+export interface PromotionMatch {
+	entry: MarketplaceSkill;
+	score: number;
+	/** The trigger phrase that fired, when the match came from one. */
+	matchedTrigger?: string;
+}
+
+const TOKEN_STOPWORDS = new Set([
+	"the",
+	"a",
+	"an",
+	"and",
+	"or",
+	"for",
+	"with",
+	"this",
+	"that",
+	"when",
+	"what",
+	"how",
+	"into",
+	"from",
+	"use",
+	"used",
+	"using",
+	"one",
+	"not",
+	"skill",
+	"skills",
+	"clio",
+	"please",
+	"can",
+	"you",
+	"should",
+	"would",
+	"about",
+	"need",
+	"want",
+	"help",
+	"make",
+	"file",
+	"files",
+	"code",
+]);
+
+function normalize(text: string): string {
+	return text
+		.toLowerCase()
+		.replace(/[^\p{L}\p{N}\s]/gu, " ")
+		.replace(/\s+/g, " ")
+		.trim();
+}
+
+/** Distinctive tokens: 4+ chars and outside the stopword set. */
+function distinctiveTokens(text: string): Set<string> {
+	return new Set(
+		normalize(text)
+			.split(" ")
+			.filter((token) => token.length >= 4 && !TOKEN_STOPWORDS.has(token)),
+	);
+}
+
+const TRIGGER_SCORE = 4;
+/** Distinct description/name token overlaps required to fire without a trigger. */
+const TOKEN_FIRE_THRESHOLD = 3;
+
+/**
+ * Score one marketplace entry against the operator's request text. A trigger
+ * phrase is a whole-phrase substring match on normalized text; token overlap
+ * is a fallback for skills whose triggers have not been authored yet.
+ */
+export function scorePromotionEntry(userText: string, entry: MarketplaceSkill): PromotionMatch | null {
+	const haystack = ` ${normalize(userText)} `;
+	if (haystack.trim().length === 0) return null;
+	for (const trigger of entry.triggers ?? []) {
+		const phrase = normalize(trigger);
+		if (phrase.length >= 4 && haystack.includes(` ${phrase} `)) {
+			return { entry, score: TRIGGER_SCORE, matchedTrigger: trigger };
+		}
+	}
+	const requestTokens = distinctiveTokens(userText);
+	if (requestTokens.size === 0) return null;
+	const entryTokens = distinctiveTokens(`${entry.name.replace(/-/g, " ")} ${entry.description}`);
+	let overlap = 0;
+	for (const token of requestTokens) if (entryTokens.has(token)) overlap += 1;
+	return overlap >= TOKEN_FIRE_THRESHOLD ? { entry, score: overlap } : null;
+}
+
+/**
+ * The uninstalled marketplace entries that match the request, best first.
+ * `excludedNames` carries installed skills plus every decline scope the
+ * caller tracks; the matcher itself is stateless.
+ */
+export function matchMarketplaceSkills(
+	userText: string,
+	entries: ReadonlyArray<MarketplaceSkill>,
+	excludedNames: ReadonlySet<string>,
+): PromotionMatch[] {
+	const matches: PromotionMatch[] = [];
+	for (const entry of entries) {
+		if (entry.kind !== "skill" || excludedNames.has(entry.name)) continue;
+		const match = scorePromotionEntry(userText, entry);
+		if (match) matches.push(match);
+	}
+	return matches.sort((a, b) => b.score - a.score || a.entry.name.localeCompare(b.entry.name));
+}
+
+/**
+ * The hard runtime gate on promotion-flow installs: only Clio's own
+ * marketplace is ever an acceptable source, whether the install runs on
+ * operator consent or autonomously at full-auto. A local path is the shipped
+ * package catalog (install copies files, no network); the one acceptable URL
+ * shape is this project's own repository tree. Public skill registries and
+ * arbitrary GitHub sources are rejected here, in code — a prompt instruction
+ * is not the enforcement mechanism.
+ *
+ * This gates the promotion flow only. Operator-driven installs through
+ * `clio-coder skills install <url>` keep their existing behavior.
+ */
+export const OWN_MARKETPLACE_URL_PREFIX = "https://github.com/iowarp/clio-coder/";
+
+export function isOwnMarketplaceSource(entry: Pick<MarketplaceSkill, "origin" | "sourceUrl">): boolean {
+	const source = entry.sourceUrl.trim();
+	if (/^(?:https?:\/\/|git@)/.test(source)) return source.startsWith(OWN_MARKETPLACE_URL_PREFIX);
+	// A non-URL source is a local filesystem path; only catalog discovery
+	// produces those, and it resolves them against the shipped package.
+	return entry.origin === "catalog" && path.isAbsolute(source);
+}
+
+export function assertPromotionInstallSource(entry: MarketplaceSkill): void {
+	if (isOwnMarketplaceSource(entry)) return;
+	throw new Error(
+		`skill promotion: refusing to install "${entry.name}" from ${entry.sourceUrl}; ` +
+			"promotion installs only from Clio's own marketplace (local catalog or " +
+			`${OWN_MARKETPLACE_URL_PREFIX}). Install manually with clio-coder skills install if intended.`,
+	);
+}
+
+/**
+ * Persistent "never offer this skill" store. Session-scoped declines live in
+ * the offer registration's memory and die with the session; this file holds
+ * only the explicit fourth option. It is a standalone JSON document in the
+ * config dir rather than a settings key because the settings-v2 manifest is
+ * owned elsewhere this sprint; the proposed key for a later migration is
+ * `skills.promotionDeclines`.
+ */
+export const PROMOTION_DECLINES_FILE = "skill-promotion-declines.json";
+
+export interface PromotionDeclineStore {
+	/** decline key (name@version) -> ISO timestamp of the operator's "never" answer. */
+	never: Record<string, string>;
+}
+
+/**
+ * The decline store key. A "never" answer is scoped to the catalog version the
+ * operator saw, so a later version of the same skill is offerable again while a
+ * re-published identical version stays declined. Absent version keys as
+ * `name@`, distinct from any real version, so it re-offers once a version
+ * appears.
+ */
+export function declineKey(name: string, version?: string): string {
+	return `${name}@${version ?? ""}`;
+}
+
+function declinesPath(configDir?: string): string {
+	return path.join(configDir ?? clioConfigDir(), PROMOTION_DECLINES_FILE);
+}
+
+export function readPromotionDeclines(configDir?: string): PromotionDeclineStore {
+	const file = declinesPath(configDir);
+	if (!existsSync(file)) return { never: {} };
+	try {
+		const parsed = JSON.parse(readFileSync(file, "utf8")) as unknown;
+		const never =
+			parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as { never?: unknown }).never : undefined;
+		if (never && typeof never === "object" && !Array.isArray(never)) {
+			const entries = Object.entries(never as Record<string, unknown>).filter(
+				(pair): pair is [string, string] => typeof pair[1] === "string",
+			);
+			return { never: Object.fromEntries(entries) };
+		}
+	} catch {
+		// An unreadable store means no recorded declines; the worst outcome is
+		// one extra offer, which the operator can re-decline.
+	}
+	return { never: {} };
+}
+
+export function recordPromotionNeverDecline(name: string, version?: string, configDir?: string): void {
+	const store = readPromotionDeclines(configDir);
+	store.never[declineKey(name, version)] = new Date().toISOString();
+	safeResourceWrite(declinesPath(configDir), `${JSON.stringify(store, null, 2)}\n`, { encoding: "utf8" });
+}

package/src/domains/safety/audit.ts

@@ -11,7 +11,7 @@ import type { SafetyPolicyDecision } from "./policy-engine.js";
  * rotation, and on a low-frequency background interval instead of once per
  * row, which kept blocking the admission hot path on disk latency. Write
  * errors never throw back to the caller because safety must not kill the hot
- * path; they are logged to stderr with a `[clio:audit]` prefix for
+ * path; they are logged to stderr with a `[clio-coder:audit]` prefix for
  * post-mortem review.
  *
  * Records are a discriminated union over `kind`:
@@ -404,7 +404,7 @@ interface OpenFile {
 function logAuditError(err: unknown, path?: string): void {
 	const msg = err instanceof Error ? err.message : String(err);
 	const where = path ? ` (${path})` : "";
-	process.stderr.write(`[clio:audit] ${msg}${where}\n`);
+	process.stderr.write(`[clio-coder:audit] ${msg}${where}\n`);
 }
 
 /** Cadence of the background safety flush that bounds how long rows can sit unfsynced. */

package/src/domains/safety/finish-contract.ts

@@ -490,9 +490,10 @@ function bashExecutionEvidence(entry: unknown): FinishContractEvidence | null {
 	if (record.exitCode !== 0) return null;
 	const detected = detectValidationCommand(record.command);
 	if (detected.kind !== "validation") return null;
+	const contextMarker = record.excludeFromContext === true ? " [not sent to model]" : "";
 	const evidence: FinishContractEvidence = {
 		kind: "validation_command",
-		summary: `validation command passed: ${detected.matched}`,
+		summary: `validation command passed: ${detected.matched}${contextMarker}`,
 	};
 	const turnId = turnIdOf(entry);
 	if (turnId !== null) evidence.turnId = turnId;

package/src/domains/safety/run-effects.ts

@@ -140,7 +140,7 @@ const ENUMERABLE_ACTION_CLASSES: ReadonlySet<string> = new Set(["read", "write"]
  * `unknown` and is opaque, which is the fail-closed answer for a tool whose
  * arguments this process has no schema for.
  */
-export function toolWritesOpaquely(toolName: string): boolean {
+function toolWritesOpaquely(toolName: string): boolean {
 	return !ENUMERABLE_ACTION_CLASSES.has(classify({ tool: toolName }).actionClass);
 }
 

package/src/domains/scheduling/extension.ts

@@ -28,14 +28,14 @@ export function createSchedulingBundle(context: DomainContext): DomainBundle<Sch
 	const observability = context.getContract<ObservabilityContract>("observability");
 
 	const settings = config.get();
-	let budget = createBudgetState(settings.budget.sessionCeilingUsd);
+	let budget = createBudgetState(settings.safety.limits.sessionCostUsd);
 	const fleet = createFleetRegistry(() => config.get().fleet?.nodes ?? [], {
-		localMaxWorkers: () => resolveMaxWorkers(config.get().budget.concurrency),
+		localMaxWorkers: () => resolveMaxWorkers(config.get().fleet.concurrency),
 	});
 	const unsubscribes: Array<() => void> = [];
 
 	function syncBudget(): void {
-		const nextCeiling = config.get().budget.sessionCeilingUsd;
+		const nextCeiling = config.get().safety.limits.sessionCostUsd;
 		if (nextCeiling === budget.ceilingUsd) return;
 		budget = createBudgetState(nextCeiling);
 	}
@@ -83,7 +83,7 @@ export function createSchedulingBundle(context: DomainContext): DomainBundle<Sch
 			const { verdict, currentUsd } = evaluate();
 			return { verdict, currentUsd, ceilingUsd: budget.ceilingUsd };
 		},
-		maxWorkers: () => resolveMaxWorkers(config.get().budget.concurrency),
+		maxWorkers: () => resolveMaxWorkers(config.get().fleet.concurrency),
 		fleet,
 	};
 

package/src/domains/session/archive-readers.ts

@@ -42,6 +42,14 @@ export interface SessionLedgerRef {
 	path: string;
 }
 
+const ROUTING_NOTICE_CUSTOM_TYPE = "clio-coder.routing-notice";
+const LEGACY_ROUTING_NOTICE_CUSTOM_TYPE = "clio.routing-notice";
+
+function normalizeReleasedCustomType(entry: SessionEntry): SessionEntry {
+	if (entry.kind !== "custom" || entry.customType !== LEGACY_ROUTING_NOTICE_CUSTOM_TYPE) return entry;
+	return { ...entry, customType: ROUTING_NOTICE_CUSTOM_TYPE };
+}
+
 /**
  * Read every `<stateDir>/audit/<date>.jsonl` row. Malformed lines are skipped
  * and reported in `errors` instead of failing the read.
@@ -157,7 +165,7 @@ export function parseSessionEntries(raw: string, source: string): SessionReadRes
 		}
 		if (isSessionHeader(parsed)) continue;
 		if (isSessionEntry(parsed)) {
-			entries.push(parsed);
+			entries.push(normalizeReleasedCustomType(parsed));
 			continue;
 		}
 		errors.push(

package/src/domains/session/compaction/branch-summary.ts

@@ -162,6 +162,10 @@ export function serializeConversation(entries: ReadonlyArray<SessionEntry>): str
 			continue;
 		}
 		if (entry.kind === "bashExecution") {
+			// `!!` is an operator-private terminal command. Its immutable ledger
+			// entry remains available to transcript replay, but neither its command
+			// nor its output may cross a model boundary through compaction.
+			if (entry.excludeFromContext === true) continue;
 			parts.push(`[Bash]: $ ${entry.command}\n${truncate(entry.output, TOOL_RESULT_MAX_CHARS)}`);
 			continue;
 		}

package/src/domains/session/compaction/compact.ts

@@ -497,7 +497,7 @@ interface TextBlock {
 	text: string;
 }
 
-export function textFromAssistant(message: unknown): string {
+function textFromAssistant(message: unknown): string {
 	if (!message || typeof message !== "object" || !("content" in message)) return "";
 	const content = (message as { content: unknown }).content;
 	if (typeof content === "string") return content;

package/src/domains/session/compaction/tokens.ts

@@ -49,6 +49,10 @@ function estimateMessage(entry: MessageEntry): number {
 }
 
 function estimateBashExecution(entry: BashExecutionEntry): number {
+	// `!!` rows are transcript-only and never become provider input, including
+	// through a later compaction prompt. Charging their bytes to the model
+	// context would make the context meter claim the model can see private output.
+	if (entry.excludeFromContext === true) return 0;
 	return ceilChars(entry.command.length + entry.output.length);
 }
 

package/src/domains/session/context-accounting.ts

@@ -370,7 +370,7 @@ export function lastLoadedContextWindow(meta: SessionMeta, providerId: string, m
 	return null;
 }
 
-export function buildSnapshotCategories(inputs: {
+function buildSnapshotCategories(inputs: {
 	systemPrompt?: string | undefined;
 	promptSegments?: ReadonlyArray<{ id: string; tokenEstimate: number }> | undefined;
 	tools?: ReadonlyArray<unknown> | undefined;

package/src/domains/session/decision-board.ts

@@ -54,7 +54,7 @@ function answeredAtForDecision(policy: AskUserToolPolicy, sourceQuestion: string
  * The policy already keeps last-value-wins decisions; the defensive map also
  * makes conversion deterministic for hand-built policies and older callers.
  */
-export function finalizedInterviewEntryFields(policy: AskUserToolPolicy): DecisionLedgerEntryFields | null {
+function finalizedInterviewEntryFields(policy: AskUserToolPolicy): DecisionLedgerEntryFields | null {
 	if (policy.rounds.length === 0 && policy.decisions.length === 0) return null;
 	if (!policy.turnId) throw new Error(`decision board: interview ${policy.id} has no originating user turn`);
 	if (policy.status !== "complete" && policy.status !== "cancelled") {