@isaacriehm/cairn-core 0.2.0 → 0.3.0

package/templates/.cairn/config/trust-policy.yaml

@@ -1,14 +1,13 @@
 # Trust policy.
 #
-# Per-command trust posture (WORKFLOW_GUIDE.md §3 + §8). Three classes:
+# Per-command trust posture. Three classes:
 #
 #   read_only            no friction — runs without any operator confirmation
 #   write_creating       light friction — single-tap reaction or button confirm
 #   configuration        heavy friction — operator must edit a config file
 #
-# Auto-merge classes (PRIMER §12.2) live in workflow.md trust_posture_defaults
-# and the project block; this file governs operator INTERACTION friction, not
-# git-push friction.
+# Auto-merge classes live in workflow.md trust_posture_defaults and the project
+# block; this file governs operator INTERACTION friction, not git-push friction.
 
 version: 1
 
@@ -18,12 +17,6 @@ commands:
   - id: status
     posture: read_only
     surface: slash
-  - id: queue
-    posture: read_only
-    surface: slash
-  - id: eval
-    posture: read_only
-    surface: slash
   - id: agent_list
     posture: read_only
     surface: slash
@@ -32,19 +25,6 @@ commands:
     surface: slash
 
   # ── Write-creating — single-tap confirm ────────────────────────────────
-  - id: task
-    posture: write_creating
-    surface: slash
-    confirmation: none           # spec tightener handles ambiguity downstream
-  - id: run
-    posture: write_creating
-    surface: slash
-    confirmation: reaction_if_outside_pilot_scope
-    timeout_seconds: 30
-  - id: oops
-    posture: write_creating
-    surface: slash
-    confirmation: per_step_inline_reaction
   - id: direction
     posture: write_creating
     surface: slash
@@ -60,10 +40,6 @@ commands:
   - id: ship_anyway
     posture: write_creating_logged_override
     surface: slash
-    confirmation: none           # logged for audit; no friction
-  - id: halt
-    posture: write_creating
-    surface: slash
     confirmation: none
 
   # ── Configuration — high-friction by design ─────────────────────────────
@@ -76,12 +52,6 @@ commands:
   - id: change_pilot_module
     posture: configuration
     surface: workflow_yaml_edit
-  - id: change_collaboration_mode
-    posture: configuration
-    surface: workflow_yaml_edit
-  - id: register_frontend_adapter
-    posture: configuration
-    surface: workflow_yaml_edit
   - id: change_off_limits
     posture: configuration
     surface: workflow_yaml_edit
@@ -91,5 +61,3 @@ notification_routing:
   errors: all_registered_adapters
   completions: all_registered_adapters
   paged_events: all_registered_adapters
-  uat_approval_request: first_registered_adapter
-  voice_capable_only: discord

package/templates/.cairn/config/workflow.md

@@ -7,98 +7,15 @@ verified-at: 2026-05-02T13:19:00Z
 source-commits:
   - manual
 
-# ──────────────────────────────────────────────────────────────────────────────
-# Top-level (project-agnostic) configuration.
-# This block is read by Cairn package code; values here are universal defaults.
-# Project-specific overrides go in the `<project_name>:` extension block below.
-# ──────────────────────────────────────────────────────────────────────────────
-
-collaboration_mode: solo                # solo | team — see FILESYSTEM_LAYOUT.md §12
-concurrency: 1                          # single-task FIFO; do not change without re-reviewing PRIMER §5.4
-
-frontend_adapters:
-  - discord                             # discord | notion | cli | web
-  # operator may register additional adapters; first-registered owns approval-request routing
-
-tier_assignment:
-  intent_classifier: 0                  # 0 = Ollama; 1 = Haiku 4.5; 2 = Sonnet 4.6; 3 = Opus 4.7
-  spec_tightener_short: 1
-  spec_tightener_long: 2
-  decision_extractor: 1
-  attestation_check: 0                  # mechanical regex; LLM only on ambiguity
-  implementer_default: 2
-  implementer_high_stakes: 3
-  reviewer: 2                           # same model as implementer; context isolation does the work
-  uat_runner: 2
-  uat_question_agent: 1
-  backprop_author: 2
-  garbage_collector: 1
-  init_mapper: 2                        # one-time at adoption; OK to spend tokens
-
-# Tier-3 (Opus) auto-escalation policy — per Codex audit Finding #9.
-escalation:
-  tier_3_requires_explicit_approval: true
-  max_attempts_per_task: 3              # halt + page operator after this many retries
-  pre_run_cost_projection: true         # block dispatch on > 1% daily plan-headroom estimate
-
-# Run lifecycle thresholds.
-timeouts:
-  stall_event_silence_seconds: 300      # no event in 5 min → kill + retry
-  uat_decision_seconds: 86400           # 24h before auto-deny
-  approval_dialog_seconds: 30           # 🟢/🔴 confirm window
-
-# Anthropic plan-quota self-throttle (per WORKFLOW_GUIDE §2.2).
-plan_quota_floor_percent: 20            # below this remaining → Cairn self-throttles to Tier 1 only
-
-# Spec-tightener gate.
-spec_quality_floor: 7                   # quality_score < floor → operator dialog OR /ship-anyway
-
-# Dialog rules.
-operator_dialog_max_questions_per_turn: 2  # Codex audit Finding #7 — collapse 3+ to single tightened proposal
-
-# Trust posture defaults — overridden in project block as needed.
-trust_posture_defaults:
-  safe_class_auto_merge: true
-  code_class_auto_merge: false
-  high_stakes_auto_merge: false
-
-# Decision capture defaults.
-decision_extractor:
-  auto_propose_threshold_confidence: 0.7
-  require_assertions_at_confirm: true
-
-# Whisper / voice defaults.
-voice:
-  enabled: true
-  model: large-v3-turbo
-  quantization: q5_0
-  language: en
-  confidence_floor: 0.85                # below → operator confirm-heard prompt
-  audio_persistence: forbidden          # never write audio to disk
-
-# Local mirror checkout (Cairn operates here, never user's working tree).
-mirror:
-  base_path: "~/.local/cairn/repos"   # one subdir per adopted project
-  state_path: "~/.local/cairn/state"  # PIDs, sockets, runtime
-  models_path: "~/.local/cairn/models"
-
-# Retention policy.
-retention_days:
-  runs: 90
-  transcripts: 90
-  inbox: 30
-
 # ──────────────────────────────────────────────────────────────────────────────
 # Project-extension placeholder.
 #
-# At adoption (`npx @isaacriehm/cairn init`), the init script REPLACES this
-# block with a real key matching the adopting project's `package.json name`
-# (or directory name, lowercased, with non-alphanumerics → underscores).
+# At adoption, the init script REPLACES this block with a real key matching
+# the adopting project's `package.json name` (or directory name, lowercased,
+# with non-alphanumerics → underscores).
 #
 # Cairn package code reads this block by `Object.keys()` lookup — never by
-# hardcoded project name (per L50 + operator-S1).
-#
-# Example below uses `<project_name>` as the placeholder key.
+# hardcoded project name.
 # ──────────────────────────────────────────────────────────────────────────────
 
 <project_name>:
@@ -115,116 +32,18 @@ retention_days:
     safe_class_auto_merge: true
     code_class_auto_merge: false
     high_stakes_auto_merge: false
-  budget_metric:
-    primary: claude_code_subscription_quota
-    secondary_dollar_record_only: true
-    pre_run_projection: true
-    tier_3_requires_explicit_approval: true
-    max_attempts_per_task: 3
 
 ---
 
-# Per-task prompt template
-
-Below is the rendered-prompt body the orchestrator injects into every agent run. The template engine substitutes `{{var}}` tokens with run-scoped values resolved at dispatch time.
-
-## Identity
-
-You are running inside Cairn as agent role `{{agent_role}}` for project `{{project_name}}`. Your run-id is `{{run_id}}`. The mirror checkout is at `{{mirror_path}}` pinned to `origin/main` SHA `{{sha_pin}}`. Do not modify files outside the mirror. Do not switch branches.
-
-## Task
-
-{{tightened_spec_body}}
-
-## Acceptance criteria
-
-{{#each acceptance_criteria}}
-- {{this}}
-{{/each}}
-
-## Decisions in scope
-
-The following accepted decisions bind your work. You MUST NOT contradict them. Their machine-readable assertions will be evaluated against your diff.
-
-{{#each in_scope_decisions}}
-- **{{id}}** — {{title}}  ({{scope_summary}})
-{{/each}}
-
-If none, this is empty.
-
-## Invariants in scope
-
-The following §V invariants bind your work. They have sensors that will block your commit if violated.
-
-{{#each in_scope_invariants}}
-- **{{id}}** — {{title}}
-{{/each}}
-
-If none, this is empty.
-
-## Off-limits paths
-
-You MUST NOT modify any of these:
-
-{{#each off_limits}}
-- {{this}}
-{{/each}}
-
-## Sensors that will run
-
-After your turn, these sensors will execute against your diff. Their failure messages are remediation prompts — read them and retry.
-
-{{#each scoped_sensors}}
-- `{{id}}` — {{description}}
-{{/each}}
-
-## Honesty contract (Layer B)
-
-When you emit your final response, include a fenced YAML block titled `attestation` with these fields filled:
-
-```yaml
-attestation:
-  delivered:
-    - symbol: "<name>"
-      path: "<path>"
-      behavior: full | partial | scaffolded
-      sensors_passed: [<sensor_ids>]
-  deferred:
-    - symbol: "<name>"
-      reason: "<one line>"
-  known_limitations: []
-  todos_introduced: 0
-  stubs_introduced: 0
-  files_touched: ["<paths>"]
-```
-
-This will be cross-checked against your actual diff. Any mismatch fails the run.
-
-## Tools available
-
-You have the standard Read/Edit/Write/Bash/Glob/Grep tool surface. You also have the Cairn MCP tools — use these for grounding rather than re-reading large files:
-
-- `cairn_decision_get(id)` — full ADR + assertions
-- `cairn_decisions_in_scope(globs[])` — IDs whose scope overlaps your target
-- `cairn_invariant_get(id)` — §V invariant + linked sensor
-- `cairn_canonical_for_topic(topic)` — canonical doc path + verified-at
-- `cairn_query_history(scope, question)` — the ONLY way to read `.archive/`
-
-## Constraints
-
-- Hard cutovers; no backwards-compat shims, no deprecation notices, no transition regex.
-- No `[STALE]` banners — stale docs get archived, not labeled.
-- No model-issued confidence scores in user-visible writes.
-- No commit, no push — Cairn handles git after sensor + reviewer + UAT pass.
-
-## Stop conditions
+# Workflow policy
 
-Stop when the acceptance criteria are met AND the attestation block is complete AND no in-scope assertion or invariant is contradicted.
+This file is the on-disk surface for the **project-extension block** that
+`cairn-core/src/sensors/runner.ts` reads (via `Object.keys()` lookup) and
+that the Phase-3 init mapper patches with discovered globs and sensors.
 
-If you cannot proceed (genuine ambiguity, missing context, contradicting decisions), emit a `blocked_by` field instead of a partial diff:
+The plugin-era cairn does NOT use this file as a per-task prompt template
+— each task's spec lives at `.cairn/tasks/active/<task_id>/spec.tightened.md`
+and is written directly by the `cairn-direction` skill. The reviewer
+subagent reads that spec; nothing renders this markdown body.
 
-```yaml
-blocked_by:
-  reason: "<one line>"
-  needed_from_operator: "<one line>"
-```
+If you're looking for the daily flow, see `docs/SYSTEM_OVERVIEW.md` §4.

package/templates/.cairn/git-hooks/commit-msg

@@ -3,7 +3,7 @@
 #
 # Spec: PLUGIN_ARCHITECTURE §17 Layer 1.
 #
-# Validates DEC/TSK/§V citations in the commit message body when the
+# Validates DEC/TSK/§INV citations in the commit message body when the
 # project's commit policy requires them. The Cairn CLI owns the policy
 # (sensors.yaml `commit_msg_policy`) so the hook stays a thin shim.
 

package/templates/.cairn/ground/canonical-map/topics.yaml

@@ -4,9 +4,7 @@
 # the authoritative path for a topic — no fuzzy match, no hallucinated paths.
 #
 # Adopters extend this registry as their codebase grows. Unknown topics
-# return TOPIC_NOT_REGISTERED — agents must NOT invent topics. Add via
-# /direction confirmation when an operator references a recurring topic
-# the Cairn agents should know about.
+# return TOPIC_NOT_REGISTERED — agents must NOT invent topics.
 #
 # Below is a baseline that ships with `cairn init` so every adoption
 # has a non-empty registry on day one. Trim or extend per project.
@@ -22,33 +20,12 @@ topics:
   - topic: cairn-architecture
     canonical_path: docs/ARCHITECTURE.md
     audience: dual
-  - topic: cairn-primer
-    canonical_path: docs/PRIMER.md
-    audience: dual
   - topic: cairn-mcp-surface
     canonical_path: docs/MCP_SURFACE.md
     audience: dual
   - topic: cairn-filesystem-layout
     canonical_path: docs/FILESYSTEM_LAYOUT.md
     audience: dual
-  - topic: cairn-workflow-guide
-    canonical_path: docs/WORKFLOW_GUIDE.md
-    audience: dual
-  - topic: cairn-uat-pipeline
-    canonical_path: docs/UAT_PIPELINE.md
-    audience: dual
-  - topic: cairn-sessionstart-spec
-    canonical_path: docs/SESSIONSTART_SPEC.md
-    audience: dual
-  - topic: two-zone-separation
-    canonical_path: docs/PRIMER.md
-    audience: dual
-  - topic: backprop-protocol
-    canonical_path: docs/PRIMER.md
-    audience: dual
-  - topic: garbage-collection-cadence
-    canonical_path: docs/PRIMER.md
-    audience: dual
-  - topic: anti-patterns
-    canonical_path: docs/PRIMER.md
+  - topic: cairn-plugin-architecture
+    canonical_path: docs/PLUGIN_ARCHITECTURE.md
     audience: dual

package/templates/.cairn/ground/capabilities/snippets.yaml

@@ -1,3 +1,2 @@
 # Blessed implementations for security-sensitive patterns.
-# See DOCS_SPEC.md §3.5 for shape.
 snippets: []

package/templates/.cairn/ground/manifest.yaml

@@ -1,16 +1,13 @@
 # Ground manifest — read-only for agents.
 #
-# Continuously regenerated by `cairn watch` (the grounding daemon) on filesystem
-# events. Each entry is one canonical-zone file with its hash, classification,
-# audience, verified-at, and (for generated artifacts) the source + generator.
+# Regenerated by the GC sweep and post-commit hook. Each entry is one
+# canonical-zone file with its hash, classification, audience, verified-at,
+# and (for generated artifacts) the source + generator.
 #
-# Agents query the MCP tool surface, NOT this file directly. The daemon is the
-# only writer. Modifying this file by hand is meaningless — the daemon overwrites
-# on next event.
+# Agents query the MCP tool surface, NOT this file directly.
 #
-# Layout per FILESYSTEM_LAYOUT.md §8.
+# Layout per docs/FILESYSTEM_LAYOUT.md §8.
 
 version: 1
 generated: 2026-05-02T13:19:00Z
-generator: cairn-watch
 files: []

package/templates/.cairn/ground/product/personas.yaml

@@ -1,4 +1,3 @@
 # Product personas — who this is for. Read at every SessionStart.
-# See DOCS_SPEC.md §3.4 for shape.
 status: draft
 personas: []

package/dist/context/checkpoint.d.ts

@@ -1,11 +0,0 @@
-/**
- * Checkpoint writer — emits a snapshot of the same handoff block content
- * to `.cairn/tasks/active/<taskId>/checkpoint-<ISO>.md`. Invoked from the
- * Stop hook and by the cairn-direction skill before subagent dispatch.
- *
- * Spec: docs/CONTEXT_CONTINUITY_SPEC.md §2.2.
- *
- * Throws if the task directory is missing — callers should fail loudly when
- * pointed at a stale taskId. Successful writes return the absolute path.
- */
-export declare function writeCheckpoint(repoRoot: string, taskId: string, _runId: string): Promise<string>;

package/dist/context/checkpoint.js

@@ -1,30 +0,0 @@
-/**
- * Checkpoint writer — emits a snapshot of the same handoff block content
- * to `.cairn/tasks/active/<taskId>/checkpoint-<ISO>.md`. Invoked from the
- * Stop hook and by the cairn-direction skill before subagent dispatch.
- *
- * Spec: docs/CONTEXT_CONTINUITY_SPEC.md §2.2.
- *
- * Throws if the task directory is missing — callers should fail loudly when
- * pointed at a stale taskId. Successful writes return the absolute path.
- */
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { buildHandoffBlock } from "./handoff-builder.js";
-export async function writeCheckpoint(repoRoot, taskId, _runId) {
-    const taskDir = join(repoRoot, ".cairn", "tasks", "active", taskId);
-    if (!existsSync(taskDir)) {
-        throw new Error(`writeCheckpoint: task directory not found: ${taskDir}`);
-    }
-    const block = await buildHandoffBlock(repoRoot);
-    const content = block === null ? "(no active run handoff to capture)\n" : block;
-    // Ensure dir exists (defensive — `existsSync` above guarantees parent, but
-    // mkdir recursive is cheap and safe).
-    mkdirSync(taskDir, { recursive: true });
-    const stamp = new Date().toISOString().replace(/:/g, "-");
-    const filename = `checkpoint-${stamp}.md`;
-    const abs = join(taskDir, filename);
-    writeFileSync(abs, content, "utf8");
-    return abs;
-}
-//# sourceMappingURL=checkpoint.js.map

package/dist/context/checkpoint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"checkpoint.js","sourceRoot":"","sources":["../../src/context/checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,MAAc,EACd,MAAc;IAEd,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,KAAK,CAAC;IAEhF,2EAA2E;IAC3E,sCAAsC;IACtC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,cAAc,KAAK,KAAK,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/decision-capture/capture.d.ts

@@ -1,57 +0,0 @@
-/**
- * runDecisionCapture — orchestrates the full flow:
- *
- *   raw_text → extract → write draft → adapter dialog 🟢/🟡/🔴
- *                                  ├── 🟢 commit  → acceptDraft → ledger
- *                                  ├── 🟡 edit    → leave draft + return correction text
- *                                  └── 🔴 reject  → rejectDraft → no record
- *
- * The dialog is supplied by the caller (typically a FrontendAdapter's
- * requestDialog) so this entry point works equally well in tests with the
- * stub adapter, in CLI with a TTY prompt, and in Discord with the real
- * adapter.
- */
-import type { FrontendAdapter } from "../frontend-types.js";
-import type { ClaudeTier } from "../claude/index.js";
-import { runDecisionExtractor } from "./extractor.js";
-import { proposeStrictAssertions } from "./refinement.js";
-import type { DecisionCaptureResult } from "./types.js";
-export interface RunDecisionCaptureArgs {
-    /** Repo root for the mirror checkout. */
-    repoRoot: string;
-    /** Raw operator text. */
-    rawText: string;
-    /** Operator id. */
-    authorId: string;
-    /** Source — `discord:slash:/direction` or `discord:free_text` etc. */
-    source: string;
-    /** ISO timestamp the message was received. Default = now. */
-    receivedAt?: string;
-    /** Tier for the extractor. Default = haiku. */
-    tier?: ClaudeTier;
-    /** Channel id to thread the confirm dialog through. */
-    channelId?: string;
-    /** Adapter that owns the confirm dialog. */
-    adapter: FrontendAdapter;
-    /** Confirm-dialog timeout. Default 60_000 ms. */
-    confirmTimeoutMs?: number;
-    /**
-     * Optional: override the extractor entry point. Smokes inject a stub so
-     * the smoke runs without burning claude quota when only the
-     * draft/confirm/ledger flow needs verifying.
-     */
-    extractorOverride?: typeof runDecisionExtractor;
-    /**
-     * Skip the post-commit refinement step. Defaults to false. The
-     * orchestrator's `bypassRefinement` mirrors this for production runs;
-     * smokes that don't care about refinement can flip it on.
-     */
-    bypassRefinement?: boolean;
-    /** Tier for the refinement proposer. Default = haiku. */
-    refinementTier?: ClaudeTier;
-    /** Refinement dialog timeout. Default 60_000 ms. */
-    refinementDialogTimeoutMs?: number;
-    /** Smokes inject a stub proposer to avoid burning claude quota. */
-    refinementProposerOverride?: typeof proposeStrictAssertions;
-}
-export declare function runDecisionCapture(args: RunDecisionCaptureArgs): Promise<DecisionCaptureResult>;