@mindrian_os/cli 2.0.0-beta.3 → 2.0.0-beta.31

package/skills/dogfood-flush/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: dogfood-flush
+visibility: admin
+description: Drain the dog-food queue into the mindrian room and regenerate ## Live (auto)
+license: BSL-1.1. See LICENSE for complete terms (Business Source License 1.1, Change Date 2030-04-16 to Apache License 2.0).
+compatibility: Requires Claude Code (or a host implementing disable-model-invocation semantics); Tier-1 hook mechanics referenced in this skill.
+help_jtbd: "Manually flush captured plugin edits into the mindrian dataroom."
+body_shape: E
+hitl_shape: "F.0"
+hitl_why: "It offers one dogfood-flush action to approve or defer."
+# Phase 267.3-06, ruled in 267.3-CLASSIFICATION.md (Row 8): first delivery at commands/dogfood-flush.md:77, an F.0 Action Report of events flushed, the maintainer's own internal bookkeeping.
+interactive_first_reward: "--none (diagnostic surface)"
+argument-hint: ""
+serves_jtbd: ["audit-room"]
+teaching: "When you want the plugin's own venture room to reflect your latest edits immediately, /mos:dogfood-flush drains the PostToolUse queue and regenerates the Live (auto) section in STATE.md. The automatic SessionStart drain handles the steady-state case."
+disable-model-invocation: false
+allowed-tools: Bash(node *), AskUserQuestion
+kind: utility
+frameworks: []
+produces: "~/MindrianRooms/mindrian/STATE.md"
+inputs: []
+autonomous_safe: true
+# --- Phase 172-06 CIRS R1 exclude (Canon Part 11) ---
+connector:
+  excluded: true
+  reason: "Lifecycle command. A dog-fooding maintenance flush the maintainer runs deliberately; an internal upkeep action with no navigator problem-state trigger."
+---
+
+<!-- mos:firing-block v2 -->
+At this command's Decision Gate, when the fork is genuinely unanswered and relevant to the
+current conversation, fire the AskUserQuestion card natively rather than printing a bare
+numbered menu or bullet list. Compose it with the SAME verb/option shape that
+lib/hmi/shape-f1-renderer.cjs (renderShapeF1) produces and that lib/hmi/selector-dispatcher.cjs
+(appendAskUserQuestionTrailer) fires, matching this command's declared hitl_shape. Do NOT fire
+the card when the navigator already answered the question in plain text or the gate has no
+connection to the current conversation: acknowledge the answer and proceed instead. Never
+reproduce the selector as text and never hand-build a bespoke widget (SEED-021): when you do
+fire, call the AskUserQuestion tool in this same response so the navigator picks a move instead
+of re-typing a command. Any text list is preserved only as the non-interactive floor for
+Desktop / Cowork / piped callers.
+<!-- /mos:firing-block -->
+
+# /mos:dogfood-flush
+
+Force-drain the dog-food queue (`~/.mindrian/dogfood-queue.jsonl`) into
+`~/MindrianRooms/mindrian/room.db` via the Phase 109 navigation chokepoint,
+then regenerate the `## Live (auto)` sentinel-bounded section in
+`~/MindrianRooms/mindrian/STATE.md` atomically with the human-authored body
+byte-preserved.
+
+This is the manual knob the user reaches for when the automatic SessionStart
+drain has not run recently -- explicit redraw, drain everything pending right now.
+
+## Admin Identity Check
+
+**A HARD, code-enforced gate already ran before you saw this body.** This command
+carries `visibility: admin`, so the `UserPromptSubmit` hook
+`scripts/admin-command-gate.cjs` (wired in `hooks/hooks.json`) intercepted the
+invocation, ran the deterministic checker `scripts/check-admin-identity.cjs`, and
+BLOCKED (exit 2) any non-admin caller BEFORE this body was expanded. If you are
+reading this, the code gate already PASSED.
+
+Defense in depth (restatement, not the only enforcement): the gate authorizes a
+user when `MOS_ADMIN=true`, when `$USER`/`$USERNAME` contains "jsagi"/"jonathan",
+when `$HOME` is `/home/jsagi`, or when the optional allowlist
+`~/.mindrian/admin-identity.json` names the identity. If, as a soft backstop, none
+of these hold, render `x Command not found: dogfood-flush` and STOP.
+
+## Behavior
+
+Two-step pipeline:
+
+1. `scripts/dogfood-emit.cjs` -- drain the queue file, batch-emit `file_changed`
+   memory_event rows via `lib/core/navigation.cjs::logMemoryEvent`. Truncate
+   the queue on success (atomic .tmp + rename).
+2. `scripts/dogfood-derive.cjs` -- read the last 10 file_changed events,
+   regenerate the `<!-- LIVE_AUTO_START -->` / `<!-- LIVE_AUTO_END -->` block
+   in STATE.md. Log a `feynman_timeline_refreshed` memory_event on success.
+
+## Output
+
+F.0 Action Report:
+
+- **emitted:** N events flushed from the queue.
+- **derived:** STATE.md `## Live (auto)` regenerated at `<iso-timestamp>`.
+- **skipped:** if the target room is missing, both phases soft-warn and exit 0
+  without crashing the parent.
+
+## Invariants
+
+- **Canon Part 8 (Graph Boundary):** zero Brain egress. The grep sweep in
+  `tests/test-dogfood-emit-derive.cjs` is the structural enforcement.
+- **Canon Part 9 (Memory Locality):** every memory_event write goes through
+  `navigation.cjs`. The Phase 109-06 pre-commit hook is the structural
+  enforcement (any direct `require('lib/core/room-db.cjs')` from
+  `dogfood-emit.cjs` / `dogfood-derive.cjs` would fail the hook).
+- **Byte-preservation (Phase 124-02 invariant, reused):** everything in
+  STATE.md outside the sentinel pair has its SHA256 preserved across
+  regeneration (Case A). The integration test
+  (`tests/test-dogfood-emit-derive.cjs`) asserts this.
+
+## Implementation
+
+```bash
+node ${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/dogfood-emit.cjs
+node ${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/dogfood-derive.cjs
+```
+
+## Examples
+
+```
+/mos:dogfood-flush
+```
+
+## Exit codes
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | Success (including soft-fail paths: room.db missing, empty queue, no STATE.md) |
+
+## Cross-surface adaptation
+
+- **CLI:** full power. Slash command resolves via Claude Code's plugin hook
+  substrate and runs the two scripts through the Bash tool. F.0 report
+  renders in the terminal.
+- **Desktop:** the same slash command runs when the plugin is connected.
+  Larry may narrate the result conversationally; the underlying scripts
+  are identical.
+- **Cowork:** same as CLI. Team members see the regenerated STATE.md
+  `## Live (auto)` block through the shared `~/MindrianRooms/mindrian/`
+  snapshot on their next session-start.
+
+No surface-specific code exists anywhere in either script.

package/skills/dominant-designs/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: dominant-designs
+description: Spot dominant designs with Utterback-Abernathy
+license: BSL-1.1. See LICENSE for complete terms (Business Source License 1.1, Change Date 2030-04-16 to Apache License 2.0).
+help_jtbd: "Identify the dominant designs in your market."
+body_shape: "methodology"
+hitl_shape: "F.1"
+hitl_why: "The dominant design is identified as a single next-move call."
+serves_jtbd: ["understand-market"]
+# Phase 265-13 reward-before-investment backfill (field only; grounded in the
+# shipped Session Flow: naming the product category previews the competing-
+# variant census structure before the navigator invests further).
+interactive_first_reward: schema_preview
+teaching: "When you are wondering if the market has settled on a winning design, /mos:dominant-designs runs Utterback-Abernathy to spot it. Tells you whether to ride the wave or break it."
+# --- Phase 122 workflow-layer frontmatter ---
+kind: methodology
+frameworks: ["Dominant Design"]
+produces: "room/**/dominant-designs/*"
+inputs: []
+autonomous_safe: true
+allowed-tools: Read Write Bash Glob AskUserQuestion
+# --- Phase 144.1 connector frontmatter ---
+connector:
+  connects_to_spine: true
+  sensor_triggers: []
+  reach_id: context_block
+  sub_mode: dominant-design
+  framework: "Dominant Design"
+  posture: push_forward
+  hierarchy_rank: 28
+  filing: fileEvidenceWithReadback
+  plan_gated: false
+  web_scope: null
+---
+
+<!-- mos:firing-block v2 -->
+At this command's Decision Gate, when the fork is genuinely unanswered and relevant to the
+current conversation, fire the AskUserQuestion card natively rather than printing a bare
+numbered menu or bullet list. Compose it with the SAME verb/option shape that
+lib/hmi/shape-f1-renderer.cjs (renderShapeF1) produces and that lib/hmi/selector-dispatcher.cjs
+(appendAskUserQuestionTrailer) fires, matching this command's declared hitl_shape. Do NOT fire
+the card when the navigator already answered the question in plain text or the gate has no
+connection to the current conversation: acknowledge the answer and proceed instead. Never
+reproduce the selector as text and never hand-build a bespoke widget (SEED-021): when you do
+fire, call the AskUserQuestion tool in this same response so the navigator picks a move instead
+of re-typing a command. Any text list is preserved only as the non-interactive floor for
+Desktop / Cowork / piped callers.
+<!-- /mos:firing-block -->
+
+# /mos:dominant-designs
+
+You are Larry. This command guides the user through Dominant Designs Analysis.
+
+## Setup
+
+1. Read `${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/references/methodology/dominant-designs.md` for framework details
+2. Read `${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/references/personality/voice-dna.md` for Larry's voice
+3. Read `room/STATE.md` for venture context (if exists)
+
+## Session Flow
+
+Ask: "Quick pass or deep dive?"
+
+Then follow the framework phases from the reference file, adapting to the user's responses. You are NOT following a rigid script -- the phases are a guide. If the user provides rich context, skip ahead. If they need more exploration, slow down.
+
+## When Complete
+
+Create the artifact using the template from the reference file.
+Ask: "File this to competitive-analysis?" before writing.
+
+If the conversation reveals a connection to another methodology, suggest it:
+"The design lifecycle you've mapped connects to /mos:research. Want to explore that next?"

package/skills/eureka/SKILL.md

@@ -0,0 +1,313 @@
+---
+name: eureka
+description: Surface cross-domain opportunity candidates from your room at portfolio scale
+license: BSL-1.1. See LICENSE for complete terms (Business Source License 1.1, Change Date 2030-04-16 to Apache License 2.0).
+help_jtbd: "Rank cross-domain opportunity pairs and surface the weak-signal tail."
+argument-hint: "[run|status|report|html|enable]"
+body_shape: E (Action Report)
+hitl_shape: "F.8"
+hitl_why: "Ranked opportunity candidates are surfaced as an independent any-order set to review and act on in any order."
+# Phase 267.3-06, ruled in 267.3-CLASSIFICATION.md (Row 9, argued in full): first delivery at commands/eureka.md:216, the ranked cross-domain opportunity table with the weak-signal tail flagged, over the navigator's own room content.
+interactive_first_reward: methodology_reframe
+serves_jtbd: ["connect-domains", "explore"]
+teaching: "When you want to see where your room's ideas cross-pollinate into fundable opportunities, /mos:eureka ranks cross-domain pairs and flags the weak-signal tail the top-N sort buries."
+ui_reference: skills/ui-system/SKILL.md
+allowed-tools: Read Bash AskUserQuestion
+# --- Phase 216-03 connector frontmatter (born-wired, Canon Part 11 CIRS R1) ---
+connector:
+  connects_to_spine: true
+  sensor_triggers: []
+  reach_id: context_block
+  sub_mode: eureka-portfolio
+  framework: null
+  posture: hold
+  hierarchy_rank: 3
+  filing: none
+  plan_gated: false
+  web_scope: null
+  surface: F.1
+---
+
+<!-- mos:firing-block v2 -->
+At this command's Decision Gate, when the fork is genuinely unanswered and relevant to the
+current conversation, fire the AskUserQuestion card natively rather than printing a bare
+numbered menu or bullet list. Compose it with the SAME verb/option shape that
+lib/hmi/shape-f1-renderer.cjs (renderShapeF1) produces and that lib/hmi/selector-dispatcher.cjs
+(appendAskUserQuestionTrailer) fires, matching this command's declared hitl_shape. Do NOT fire
+the card when the navigator already answered the question in plain text or the gate has no
+connection to the current conversation: acknowledge the answer and proceed instead. Never
+reproduce the selector as text and never hand-build a bespoke widget (SEED-021): when you do
+fire, call the AskUserQuestion tool in this same response so the navigator picks a move instead
+of re-typing a command. Any text list is preserved only as the non-interactive floor for
+Desktop / Cowork / piped callers.
+<!-- /mos:firing-block -->
+
+# /mos:eureka
+
+You are Larry. This command surfaces cross-domain opportunity candidates from the navigator's OWN active room at portfolio scale. It wraps the shipped Eureka portfolio engine (tri-modal retrieval + AHP criterion weights + 3-dimension scoring + weak-signal tail classifier + Opportunity Statement emitter) and renders the result through **Shape E (Action Report)** in the 4-zone anatomy, closing on an F.8 Decision Gate.
+
+**Voice rules (LOCKED):**
+- Conversational, direct, no filler. Signature openers: "Very simply...", "Here's the thing...", "One thing I've learned..."
+- NO emoji anywhere. NO "I'd be happy to help". NO "Great question!". NO sentences starting with "I".
+- Symbol vocabulary: only these 12 glyphs: ■ ▼ ▶ ▷ ├─ └─ ✓ • ⚠ ⚡ ⬜ →
+- Error pattern: 3 lines only -- What / Why: reason / Fix: /mos:command
+
+## Subcommand Routing
+
+Parse the user's input after `/mos:eureka`. The primary job IS the scan, so **no args behaves as `run`** (unlike the multi-tool help commands).
+
+| Subcommand | Body Shape | Purpose |
+|------------|-----------|---------|
+| `run` (default) | E (Action Report) | Fire the portfolio scan, then render the ranked report |
+| `status` | E (Action Report) | Report the current scan state for this room |
+| `report` | E (Action Report) | Re-render the last completed report without re-scanning |
+| `html` | E (Action Report) | Render the last report to a shareable De Stijl html export (the mode banner rides with it) |
+| `enable` | E (Action Report) | Install the local embedding stack on demand |
+
+## Pre-flight: Room Check
+
+Before any subcommand, resolve the active room. This is the ONE door (SEED-034); never re-guess the path.
+
+```bash
+bash "${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/resolve-room"
+```
+
+When `CLAUDE_PLUGIN_ROOT` is unset, fall back to `./scripts/resolve-room`. The script prints `ROOM_DIR` on stdout and exits 1 when no room is found. On exit 1, render the 3-line error and STOP:
+
+```
+x No Data Room found
+  Why: No room under ~/MindrianRooms/ or legacy room/ in workspace
+  Fix: /mos:new-project
+```
+
+STOP. Never re-guess the room from another resolver.
+
+## Subcommand: run (default)
+
+**Body Shape:** E (Action Report). This is the D-05 fire-and-return flow: start the scan, confirm it is running, and return the rendered report as the durable artifact. A large room must never hold the conversation hostage.
+
+### Step 1: Start the scan
+
+```bash
+node "${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/eureka-command.cjs" ROOM_DIR start
+```
+
+The dispatcher spawns the scan detached and prints the report path plus the status path, then exits immediately. TELL the navigator the scan is running and name the report path it will land at.
+
+Include the first-run honesty note, once:
+
+> Very simply: the first scan downloads the local embedding model once (only the model id crosses the wire, no bytes from your room leave the machine -- Canon Part 8). When the encoder is unavailable (a cold machine) or the graph is too thin, the scan does NOT dead-end: it names the real cause (`encoder_unavailable` or `below_floor`, never the bare "not enough entries" symptom) and degrades to an honest short REASONING-MODE list, upgradeable to embedded mode on a later re-run. See "Reasoning mode (lower-confidence fallback)" below.
+
+### Step 2: Poll for completion (bounded)
+
+Poll status up to 3 times over roughly 15 seconds:
+
+```bash
+node "${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/eureka-command.cjs" ROOM_DIR status
+```
+
+- If the state becomes `done`, proceed to Step 3.
+- If the state is `failed`, render the 3-line error quoting the `error` field from status.json and STOP.
+- If it is still `running` after the third poll, STOP with:
+
+> The scan is running in the background. The report will land at the named path. Run /mos:eureka again in a minute to render it.
+
+Never busy-wait past the third poll (D-05: fire-and-return, not block-and-wait).
+
+### Step 3: Render the report
+
+```bash
+node "${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/eureka-command.cjs" ROOM_DIR report
+```
+
+Read the JSON on stdout and render the 4-zone output (spec below).
+
+## Subcommand: status
+
+**Body Shape:** E (Action Report).
+
+Run the status call:
+
+```bash
+node "${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/eureka-command.cjs" ROOM_DIR status
+```
+
+Render ONE Shape E block translating the reported state:
+
+- `none` -- no scan has run for this room. Suggest `> /mos:eureka run`.
+- `running` -- say so, and name the report path from the status JSON.
+- `failed` -- 3-line error quoting the `error` field from status.json.
+- `done` -- the scan finished. Suggest `> /mos:eureka report`.
+
+## Subcommand: report
+
+**Body Shape:** E (Action Report).
+
+Skip straight to Step 3: run the `report` call and render the 4-zone output. If the dispatcher returns "no eureka report yet", render:
+
+```
+x No eureka report yet
+  Why: No completed scan for this room
+  Fix: /mos:eureka run
+```
+
+## Subcommand: html
+
+**Body Shape:** E (Action Report).
+
+Render the last completed report to a shareable, self-contained De Stijl html export:
+
+```bash
+node "${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/eureka-command.cjs" ROOM_DIR html
+```
+
+The dispatcher reads the existing `portfolio-report.json` (it invents no second data shape), renders `portfolio-report.html` under `.mindrian/eureka/`, and prints the path plus the mode line. The export is zero-network (inline CSS only, no CDN, Canon Part 8) so it never phones home from a second reader's machine.
+
+Tell the navigator: **the mode banner rides WITH the export.** A reasoning-mode html opens with a red `REASONING MODE - LOWER-CONFIDENCE RESULT` banner and the full caveat; an embedded-mode html names its mode verbatim. A second reader who did not run the scan cannot mistake a reasoning result for an embedded one.
+
+## Subcommand: enable
+
+**Body Shape:** E (Action Report).
+
+Install the local embedding stack (about 380 MB, one-time) into `~/.mindrian/eureka-deps/`, platform-scoped so a Mac never downloads a Windows-only binary and vice versa. This subcommand is room-independent -- it never touches the active room -- so it runs the same way whether or not a room is bound:
+
+```bash
+node "${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/eureka-command.cjs" ROOM_DIR enable
+```
+
+Render ONE Shape E block per outcome:
+
+- **Already installed:** "Very simply: the embedding stack is already installed. Nothing to do -- /mos:eureka run will use it directly."
+- **Installed now:** "Very simply: the embedding stack is installed. The model weights download once on the first real embedding call."
+- **Failed:** the 3-line error pattern, quoting the reason the dispatcher printed:
+  ```
+  x Eureka enable failed
+    Why: [reason from the enable command's output]
+    Fix: /mos:eureka enable
+  ```
+
+The SAME install is also reachable through `/mos:doctor --fix eureka` (Task 3 of this plan), so a navigator who meets the gap through the doctor never has to learn a second command.
+
+## Reasoning mode (lower-confidence fallback)
+
+When the local embedding encoder is unavailable or the room's graph is too thin to score, `/mos:eureka run` does NOT dead-end at "not enough entries". It degrades to an HONEST short reasoning-mode list: it names the cause, seeds candidate pairs, and hands Larry a governed loop to answer. This is the SAME command, one mental model -- never a separate fallback command.
+
+You know you are here when `/mos:eureka status` reads `reasoning_await_mappings`. Drive this loop:
+
+1. **Read the seeded pairs.** Open `.mindrian/eureka/reasoning/pairs.json`. Each candidate is a cross-domain pair the degrade proposed from the raw room markdown.
+2. **Write the mappings.** For each candidate, write `.mindrian/eureka/reasoning/mappings.json` keyed by candidate id: a one-line `mappingStatement` naming the shared relational schema WITHOUT either domain's nouns, and a `mechanismText` selected from the pair's own entry prose -- never invented.
+3. **Emit the rubric prompts.**
+
+   ```bash
+   node "${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/eureka-command.cjs" ROOM_DIR reasoning-prompts
+   ```
+
+   This writes a `<id>.neutral.txt` and a `<id>.adversarial.txt` per candidate. Status advances to `reasoning_await_answers`.
+4. **Answer EVERY prompt faithfully** into `.mindrian/eureka/reasoning/answers.json`, keyed by candidate id, shaped `{ "<id>": { neutral: {a..f: "yes"|"no"}, adversarial: {a..f: "yes"|"no"} } }`.
+
+   **The faithful-judge protocol (LOCKED):**
+   - Answer each of the six items **yes or no with one sentence of evidence**.
+   - Take the **skeptical reading** when unsure on the adversarial pass (argue the analogy is generic filler and try to complete a counter-mapping).
+   - **NEVER estimate a semantic-similarity score. NEVER estimate a differential score. NEVER invent a number.** Those fields are structurally null in reasoning mode and the writer refuses to emit a non-null encoder leg. Your job is the six binary structure-mapping items, nothing more. Asking yourself for a made-up similarity number re-opens the exact sycophancy channel the two-pass adversarial rubric was built to close.
+5. **Score.**
+
+   ```bash
+   node "${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/eureka-command.cjs" ROOM_DIR reasoning-score
+   ```
+
+   The runner replays your answers through the REAL rubric (verdict computed by code, biased to reject) and writes the SAME `{ provenance, ranked, tail, statements }` md+json labeled `mode:reasoning`. If it exits with a re-answer request (status `reasoning_await_answers` with `retry:true`), re-answer ONLY the named pairs faithfully and run `reasoning-score` again (one retry allowed) -- never guess to make it pass.
+6. **Render.** Render the report through Shape E with the caveat in the TOP zone (Zone 1), stated once, prominently -- never a footer (SEED req 4). The ranked table shows `lsa_similarity` + `verdict`, never a differential column. Nothing is banked (`banked:false` on every row, Canon Part 9 human-only promotion).
+
+## The 4-Zone Render Spec
+
+Zone 2 reads the report JSON fields by name. Render exactly this anatomy.
+
+**Zone 1 -- Header Panel:**
+```
+-- [Room Name] -- Eureka Portfolio Scan -- [Stage] --
+```
+
+**Zone 2 -- Content Body (Shape E: Action Report):**
+
+(a) Provenance one-liner from the JSON provenance object: the **Mode field renders on EVERY result** (embedded or reasoning), never defaulted, never hidden -- it is the reader's entire calibration signal (D6/G-4). Read it from `provenance.run_mode`.
+
+```
+  Scan: mode=[run_mode]  pairs=[pairs_mode]  encoder=[encoder]  scored=[N] pairs
+```
+
+When `provenance.run_mode` is `reasoning`, render the caveat FIRST, in the TOP zone (Zone 1), stated once, prominently -- never a footer. See the reasoning-mode section below.
+
+(b) Ranked table from `json.ranked` -- one row per pair. The columns depend on the mode:
+
+- **Embedded** (`run_mode` is `live`/`offline`): rank, A title, B title, composite `score`, weak dimensions (or `-`), and a tail-flag glyph (`⚡`) only when the pair is tail-flagged.
+
+```
+  Rank  A                         B                         Score   Weak dims        Tail   Mode
+  1     [A title]                 [B title]                 0.74    validated_demand        embedded
+  2     [A title]                 [B title]                 0.68    -                ⚡      embedded
+```
+
+- **Reasoning** (`run_mode` is `reasoning`): rank, A title, B title, `lsa_similarity` (the ONE surviving Jaccard number), `verdict`, and `mode`. NEVER render a `differential_score` or `semantic_similarity` column -- those legs are structurally null in reasoning mode and a fabricated numeric column would be the D1 lie in render form.
+
+```
+  Rank  A                         B                         lsa_similarity  Verdict        Mode
+  1     [A title]                 [B title]                 0.11            transferable   reasoning
+```
+
+Reasoning and embedded pairs are NEVER merged into one ranked list (D6 never-merge).
+
+(c) Tail read:
+- When `json.tail.insufficient_structure` is true, render EXACTLY this honest line and nothing more for the tail:
+  ```
+  Not enough entries for a tail read (below the 30-entry floor)
+  ```
+- Otherwise render the tail items table from `json.tail`. When the tail carries a `suspect_noise` flag, mark it with a `⚠` signal (surfaced in Zone 3).
+
+(d) Opportunity Statements from `json.statements` -- the statement text plus its honest critic state:
+- A statement whose critic state is `pending` renders as `NOT YET BANKED (critic pending)`. NEVER describe a pending statement as banked (D-03, the Pitfall-4 invariant).
+
+**Zone 3 -- Intelligence Strip** (conditional, max 3 signals, only when real):
+```
+  ⚠ Tail flagged suspect_noise -- attention/growth axes may be degenerate
+  ⚡ [statement] sits in the weak-signal tail -- a gem the top-N sort buries
+```
+Omit the strip entirely when there are no real signals.
+
+**Zone 4 -- Action Footer (NEVER omit):**
+```
+  > /mos:eureka report              Re-render this scan
+  > /mos:find-connections           Trace one pair deeper
+  > /mos:whitespace map             See where the gaps cluster
+```
+Exactly one primary (`▶` in render) -- `> /mos:eureka report` or the strongest follow-up -- plus the two grounded alternates.
+
+## Decision Gate Close (F.8)
+
+After rendering, IF there is a genuine unanswered fork -- which candidate should the navigator pursue -- FIRE the AskUserQuestion card in F.8 form (an unordered basket of options). Build the options from the top Opportunity Statements plus the standard discovery next-steps (trace a pair, map whitespace, defer). Never draw a numbered selector box. Skip the card entirely when the navigator already said which candidate they want -- acknowledge and proceed in prose.
+
+## Report-only note (D-03)
+
+Very simply: in v1 the Opportunity Statements render in the report only. They are NOT written to the room graph as nodes; banking an accepted statement is a later governed phase. Critic state renders honestly as pending, never claimed as banked.
+
+## Error Handling
+
+All errors use the 3-line pattern:
+
+```
+x [What failed]
+  Why: [Specific reason]
+  Fix: [One resolving command]
+```
+
+Common errors:
+
+- **No room:** `x No Data Room found / Why: No room under ~/MindrianRooms/ / Fix: /mos:new-project`
+- **No report yet:** `x No eureka report yet / Why: No completed scan for this room / Fix: /mos:eureka run`
+- **Scan failed:** `x Eureka scan failed / Why: [error field from status.json] / Fix: /mos:eureka run`
+- **Encoder unavailable (offline):** `x Encoder unavailable / Why: The local embedding model is not cached and the machine is offline / Fix: Reconnect once to fetch the model, then /mos:eureka run`
+
+## Cross-Surface Adaptation
+
+- **CLI:** Full power. The dispatcher runs via Bash; the 4-zone output is formatted for the terminal.
+- **Desktop:** Larry renders the SAME report JSON conversationally -- ranked pairs, the tail read, and the Opportunity Statements described in natural language, numbers preserved.
+- **Cowork:** Same as CLI. The report file under `.mindrian/eureka/` is shareable via `00_Context/` for team visibility.

package/skills/explain-decision/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: explain-decision
+description: Show Navigation Engine decision trace for last turn
+license: BSL-1.1. See LICENSE for complete terms (Business Source License 1.1, Change Date 2030-04-16 to Apache License 2.0).
+compatibility: Requires Claude Code (or a host implementing disable-model-invocation semantics); Tier-1 hook mechanics referenced in this skill.
+help_jtbd: "See why Larry recommended what he recommended."
+body_shape: F.1
+hitl_shape: "F.1"
+hitl_why: "It explains a decision and offers one next move to take."
+# Phase 267.3-06, ruled in 267.3-CLASSIFICATION.md (Row 10): first delivery at commands/explain-decision.md:61, a rendered audit trace of a PAST recommendation, read verbatim from a log rather than reasoned fresh.
+interactive_first_reward: "--none (diagnostic surface)"
+argument-hint: "[--last N] [--session SESSIONID]"
+serves_jtbd: ["audit-room"]
+teaching: "When Larry made a recommendation and you want to know why, /mos:explain-decision shows the Navigation Engine trace for the last turn. Every recommendation has a graph path behind it."
+disable-model-invocation: true
+allowed-tools: Bash(node *), AskUserQuestion
+# --- Phase 172-16 CIRS R1 WIRE (Canon Part 11; navigator-directed 2026-06-23) ---
+connector:
+  connects_to_spine: true
+  sensor_triggers: []
+  reach_id: context_block
+  sub_mode: decision-explain
+  framework: null
+  posture: hold
+  hierarchy_rank: 16
+  filing: memory_event_only
+  plan_gated: false
+  web_scope: null
+  surface: F.1
+---
+
+<!-- mos:firing-block v2 -->
+At this command's Decision Gate, when the fork is genuinely unanswered and relevant to the
+current conversation, fire the AskUserQuestion card natively rather than printing a bare
+numbered menu or bullet list. Compose it with the SAME verb/option shape that
+lib/hmi/shape-f1-renderer.cjs (renderShapeF1) produces and that lib/hmi/selector-dispatcher.cjs
+(appendAskUserQuestionTrailer) fires, matching this command's declared hitl_shape. Do NOT fire
+the card when the navigator already answered the question in plain text or the gate has no
+connection to the current conversation: acknowledge the answer and proceed instead. Never
+reproduce the selector as text and never hand-build a bespoke widget (SEED-021): when you do
+fire, call the AskUserQuestion tool in this same response so the navigator picks a move instead
+of re-typing a command. Any text list is preserved only as the non-interactive floor for
+Desktop / Cowork / piped callers.
+<!-- /mos:firing-block -->
+
+# /mos:explain-decision
+
+User-facing audit surface for the Navigation Engine. Reads the decision
+trace JSON written each turn by the UserPromptSubmit hook (Plan 91-02)
+and renders a human-readable explanation of which signals contributed,
+which skill fired, what was suppressed, and what was offered.
+
+This is the answer to "Why did Larry do that?"
+
+## Modes
+
+- `/mos:explain-decision` -- render the most recent decision (default).
+- `/mos:explain-decision --last 5` -- render the last N decisions in this session.
+- `/mos:explain-decision --session SESSIONID` -- render decisions from a specific session (cross-session audit).
+- `/mos:explain-decision --last 3 --session SESSIONID` -- combine both flags.
+
+## Output shape
+
+Per-turn block contains:
+
+- Tier Mode (mode_a, mode_b, or tier_0) with a glyph classifier (check / warn / low).
+- BRAIN.md signal: version, staleness, stale_reason, weight_applied, sections_consumed.
+- RECOMMENDED marker: rendered, highest_confidence (Canon Part 3 Section 6 0.7 floor).
+- Five-Signal Triangulation: ICM scope, SQL signals, Feynman-MINTO health, BRAIN patterns, Intent + Persona.
+- Chosen rationale (the one-line "why this turn" string the engine emitted).
+- Routing source (legacy fallback, engine, or mixed) when Plan 91-03 routing fired.
+- Offer rendered (the exact "Offer:" line Larry surfaced) when Plan 91-04 produced one.
+
+## Session resolution
+
+When `--session` is not supplied, the command resolves the active session in this order:
+
+1. `CLAUDE_SESSION_ID` environment variable.
+2. `.mindrian/current-session.json` pointer file.
+3. Most-recent `.mindrian/decision-traces/*.json` by mtime.
+
+## Graceful fallback
+
+The command never throws. It always exits 0 with one of:
+
+- A rendered trace block (happy path).
+- "No decisions recorded for this session." advisory (no trace file yet).
+- "Decision trace file could not be parsed." advisory (malformed JSON).
+- "No active room found." advisory (registry missing or no active room).
+
+## Canon references
+
+- **Canon Part 3 (Tri-Context Decision Gate, Section 8 trace contract):** every Decision Gate must be explainable. This command IS the audit surface that satisfies that obligation.
+- **Canon Part 4 (Every Choice Is Graph Data):** the command READS from the graph-data surface (decision-traces/*.json). It is a pure audit lens; never writes back.
+- **Canon Part 8 (Graph Boundary):** zero network surface. Reads only LOCAL `.mindrian/decision-traces/`. No Brain calls, no fetch, no shell-out.
+
+## Invocation
+
+Run the dispatcher via Bash:
+
+```bash
+node ${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?MindrianOS install root not found. Set MINDRIAN_OS_ROOT (see lib/core/active-plugin-root.cjs) or run from Claude Code.}}/scripts/explain-decision-command.cjs $ARGUMENTS
+```
+
+## Examples
+
+```
+/mos:explain-decision
+/mos:explain-decision --last 3
+/mos:explain-decision --session abc123def456
+/mos:explain-decision --last 5 --session abc123def456
+```
+
+## Exit codes
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | Always (advisory paths included). The command is a read-only audit surface and never errors. |
+
+## Loop-fires assertion surface (Phase 146)
+
+`/mos:explain-decision` is the loop-fires assertion surface: the per-turn trace
+it renders carries the `routing_source` (legacy vs engine), the fired `reach_id`,
+and the posture -- the exact signals that prove the loop FIRED on a turn.
+
+The Phase 146 loop-fires gate (the milestone gate that certifies the loop fires
+across the full connector surface) is hosted at `doctor --dogfood-acceptance`
+(the 5 ACPT dogfood drivers with their own exit-code contract) and at
+`tests/run-all-146.sh` (the 5 ACPT drivers plus the re-run of
+run-all-144/1441/145 for full-surface certification). Exit 0 there means the
+milestone ships as "Larry Reaches". This command does not host the gate; it is
+the read-only audit surface for inspecting an individual fired turn.
+
+## Cross-surface adaptation
+
+- **CLI:** full power. Shape of output is plain text suitable for terminal rendering.
+- **Desktop:** the same slash command runs when the plugin is connected. Larry may narrate the rendered trace conversationally; the underlying dispatcher is identical.
+- **Cowork:** same as CLI. Each collaborator's session has its own trace file; `--session` allows cross-user audit when collaborators share trace files via the room.