@mindrian_os/cli 2.0.0-beta.33 → 2.0.0-beta.37

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mos",
   "description": "MindrianOS -- Your AI innovation co-founder. Larry thinks with you through PWS methodology, builds your Data Room as you explore, and chains frameworks intelligently. Install and go.",
-  "version": "2.0.0-beta.33",
+  "version": "2.0.0-beta.37",
   "author": {
     "name": "Jonathan Sagir",
     "url": "https://mindrian-os.com"

package/CHANGELOG.md

@@ -1,3 +1,91 @@
+## [2.0.0-beta.37] - 2026-09-11
+
+### Fixed - hooks.json no longer prints an unknown-keys warning at every session start (quick task 260911-juq)
+
+- Claude Code 2.1.268 printed, on every session start on every surface that loads the
+  plugin manifest: `hooks.json: unknown keys "_mcpFirst198Migrated",
+  "_firstInstallRouterOrdering" ignored`. Both keys were our own build metadata, never
+  hook configuration, so the loader was correct to ignore them and correct to complain.
+  They now live in `data/hooks-markers.json`, and `hooks/hooks.json`'s top level is
+  exactly one key, `hooks`. No matcher, command, or timeout inside the hooks block
+  changed; the block is byte-identical to the pre-fix file.
+- New guard test `tests/test-quick-260911-juq-hooks-json-top-level.cjs`, registered as
+  a leg of `bash tests/run-all-198.sh`, keeps both halves of this fix honest going
+  forward: the top level cannot silently grow a stray key again, and the sidecar path
+  cannot silently go dead and make the D-06 adapter budget vacuous.
+
+### Added - a per-install opaque header lets Theo bucket without learning who you are (quick task 260911-iko)
+
+- Every Brain call now carries `x-theo-install-id`: a 32-character lowercase hex value
+  minted once from `crypto.randomBytes(16)`, stored at `~/.mindrian/theo-install-id.json`
+  (mode 0600) beside the pre-warm marker. It rides both of `callTool`'s wire requests
+  (the session initialize and the tools/call), and is simply omitted, never an error,
+  when it cannot be minted or read. This lets Theo tell one install calling twice from
+  two installs calling once, with nothing else about the install attached to it.
+- `node scripts/doctor.cjs --reset-install-id` rotates the id on demand, prints exactly
+  `install id rotated`, and never prints the value. The doctor's Brain-smoke layer 0
+  also grows an `install_id_present` boolean, reported the same way: presence only,
+  never the value.
+- Canon Part 8 position, stated once and reproduced in full at
+  `docs/THEO-INSTALL-ID.md`: the id is an opaque CSPRNG handle, never derived from
+  identity, never logged, never printed in full.
+
+## [2.0.0-beta.35] - 2026-09-11
+
+### Added - doctor sees the Tier 0 shadow, Theo's node floor stops rubber-stamping (quick task 260911-axz)
+
+- `node scripts/doctor.cjs --brain-smoke` grows a new layer 0 (`origin_shadow`), ahead of the
+  existing 6-layer probe, closing the exact blind spot a live install hit: on 2026-09-11 a
+  beta.33 install ran Larry at Tier 0 for an entire session because a user-scope
+  `~/.claude.json` `mindrian-brain` entry (type `http`, stale `Authorization` header) shadowed
+  the plugin's own `.mcp.json` stdio shim of the same name and returned HTTP 503. Doctor did not
+  detect it, because the smoke probe runs IN PROCESS through `lib/core/brain-client.cjs`, which
+  resolves to Theo, so every other layer passed. Layer 0 reports, in one row: the resolved Brain
+  origin, whether it is Theo, whether `MINDRIAN_BRAIN_URL` overrode it, Theo's live `mode` and
+  `build_stamp.sha`, and (when present) the exact scope, host, and `claude mcp remove
+  mindrian-brain -s <scope>` fix line for a shadowing connector. It never prints an
+  `Authorization` value or any other header value, and it never short-circuits layers 1-6: a
+  shadow finding is reported alongside their own verdicts, not instead of them.
+- `THEO_NODE_FLOOR` (`lib/core/doctor/class-m-brain-smoke.cjs`) moved from `1000` to `27000`,
+  a 3.4 percent margin under the 27,951 nodes measured live on 2026-09-11. The old floor would
+  have passed a 96 percent content loss without a single not-ok row. `CANON_NODE_FLOOR` (29000,
+  for a rolled-back origin) is unchanged.
+- `data/brain-census.generated.json` and `docs/BRAIN-GRAPH-CENSUS.generated.md` regenerated
+  against the live Theo origin (`https://theo-mcp.onrender.com`), naming the origin and the
+  2026-09-11 run date in the document's own prose. The incumbent census lane still renders
+  byte-identically from the pre-existing incumbent data.
+
+### Changed - Larry's chain leads with a runnable framework, and a cold Theo stops losing the race (quick task 260911-ddd)
+
+- `brain_ask` through the plugin now orders `next_gate.options` command-bearing first: frameworks that
+  at least one `/mos:` command declares come before frameworks that none does, with Theo's own order
+  kept inside each group. Every option carries `theo_rank` (the step Theo returned) and the envelope's
+  `grounding.option_order` reads `command_bearing_first`, so Theo's ranking is reconstructible from the
+  envelope. On the IllDefined chain this puts Red Teaming (`challenge-assumptions`) ahead of Design
+  Thinking, which no command declares; the count of command-less options does not change, only the
+  order. `/mos:act`'s routed confidence now describes the option actually surfaced.
+- The Brain MCP shim fires one content-free `theo_health` probe, detached, when it starts, so the
+  hosted origin is awake before the first real question on every surface (the shim loads on CLI,
+  Desktop and Cowork alike); the CLI `session-start` hook fires the same probe. The probe writes only
+  `{at, ok, origin_host}` to `~/.mindrian/brain-prewarm.json`, never a response body, and nothing on
+  the MCP channel.
+- `/mos:act`'s Tier 3 Brain race bound moved from a frozen 2000 ms literal to one constant,
+  `lib/mcp/brain-route-bound.cjs`, default 6000 ms (the measured 2.034 s cold wake plus two warm
+  follow-on calls, since `ask()` now makes three Theo calls per question), overridable with
+  `MINDRIAN_BRAIN_ROUTE_TIMEOUT_MS`; the composition census reads the same constant. The local
+  heuristic is still computed before the race, so a genuinely down Theo still answers at once.
+
+### Changed
+
+- `docs/339-NOTE-theo-desktop-connector-key.md` gains a new Section 9 scoping the keep-the-name
+  Desktop/Cowork connector advice away from Claude Code: the plugin already provides
+  `mindrian-brain` there through its own stdio shim, so a user-level twin of the same name
+  shadows rather than complements it.
+- `.planning/seeds/SEED-082-bidirectional-command-framework-sync-drift-detection.md` moved to
+  `status: triggered`, carrying the 21-beta command-registry version skew, the zero-Sensor /
+  84-Reach projection gap, the 9-methodology-command framework sync gap, and the Sensor
+  claim-side-versus-existence-side open design question.
+
 ## [2.0.0-beta.33] - 2026-09-10
 
 ### Fixed - Theo answers Larry end to end (quick task 260910-hni)

package/bin/mindrian-brain-mcp-client.cjs

@@ -311,6 +311,20 @@ async function main() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
   process.stderr.write('[mindrian-brain] MCP server v' + version + ' started (stdio)\n');
+
+  // Quick 260911-ddd (DDD-02): fire a content-free Brain pre-warm here,
+  // never awaited and never referenced by any tool handler below. Tri-Polar
+  // point: .mcp.json registers this shim with alwaysLoad: true, so it
+  // starts on Claude Code CLI, Claude Desktop and Cowork alike -- this is
+  // the one surface-neutral pre-warm point (brain-prewarm). The
+  // scripts/session-start detached spawn is a CLI-only extra, never the
+  // only path.
+  try {
+    const { prewarm } = require('../lib/core/brain-prewarm.cjs');
+    prewarm().catch(() => {});
+  } catch (_e) {
+    // Pre-warm is best-effort; it must never block or fail shim startup.
+  }
 }
 
 main().catch((err) => {

package/commands/doctor.md

@@ -2,7 +2,7 @@
 name: doctor
 description: "Diagnose and optionally repair MindrianOS install: install-cache drift, sentinel gaps, active-room guard, surface-verification, ROOM.md drift, UI compliance, statusline visibility, Brain smoke, and a paste-ready command-registration bug report for Anthropic"
 help_jtbd: "Diagnose and optionally repair an off-feeling install."
-argument-hint: "[--fix] [--all] [--cascade-rooms] [--graph-derive-health] [--heal-room] [--verify-surface] [--room-md] [--ui-compliance] [--statusline-visibility] [--card-fire-health] [--install-state] [--stale-first-touch] [--deprecated-usage] [--brain-smoke] [--eureka-smoke] [--drift] [--report-registration-bug] [--acceptance] [--pre-tag] [--pre-flight] [--dogfood-acceptance] [--claims] [--check-rs-engine] [--post-update] [--bind-check] [--simulate-write] [--scan-commands] [--scan-scripts] [--light-npx] [--dry-run] [--json]"
+argument-hint: "[--fix] [--all] [--cascade-rooms] [--graph-derive-health] [--heal-room] [--verify-surface] [--room-md] [--ui-compliance] [--statusline-visibility] [--card-fire-health] [--install-state] [--stale-first-touch] [--deprecated-usage] [--brain-smoke] [--eureka-smoke] [--drift] [--report-registration-bug] [--reset-install-id] [--acceptance] [--pre-tag] [--pre-flight] [--dogfood-acceptance] [--claims] [--check-rs-engine] [--post-update] [--bind-check] [--simulate-write] [--scan-commands] [--scan-scripts] [--light-npx] [--dry-run] [--json]"
 body_shape: E (Action Report)
 hitl_shape: "F.0"
 hitl_why: "It surfaces one diagnosed repair for a single approve-or-defer decision."
@@ -78,7 +78,7 @@ Every check has a stable class letter (or a registry id). The class flag that ac
 - **class J -- deployment-surfaces** (shares `--install-state`; `--fix` supported) -- reconciles every owned surface in `data/deployment-surfaces.json` against disk. Reads topology / active-root / active-version from class I's same-invocation result (self-derives via `shared.cjs` when absent). `--fix` re-stamps `ok:false` session-start-owned surfaces and prunes the marketplace cache.
 - **class K -- stale-first-touch-copy** (`--stale-first-touch`; check-only) -- greeting surfaces declared by `data/first-touch-surfaces.json` (banner, splash, onboard, sessionstart, operator-update, larry-extended) scanned for stale version literals and U+2014 em-dash violations. SEED-007 absorption. Also activated by `--all`.
 - **class L -- deprecated-usage** (`--deprecated-usage`; check-only) -- scans the last 7 days of `~/.claude/projects/.../*.jsonl` session transcripts for `/mos:<deprecated>` patterns and surfaces a per-command "use `/mos:<new>` instead" hint. Pure LOCAL scan; zero network, zero Brain. Also activated by `--all`.
-- **class M -- brain-smoke** (`--brain-smoke`; check-only) -- 5-layer Brain end-to-end probe (plugin root resolver, key resolver, HTTPS schema, MCP stdio handshake, e2e brain_schema via the bundled shim). Diagnostic-only; reports the exact failing layer. This is an async runner and stays special-cased (carve-out, below). Activated by `--all`.
+- **class M -- brain-smoke** (`--brain-smoke`; check-only) -- 7-layer Brain end-to-end probe: layer 0 origin and shadow connector (quick task 260911-axz -- resolved Brain origin, Theo status, `MINDRIAN_BRAIN_URL` override, Theo's live mode/build sha, and any Claude Code `~/.claude.json` entry shadowing the plugin's own `mindrian-brain` shim), then plugin root resolver, key resolver, HTTPS schema, MCP stdio handshake, e2e brain_schema via the bundled shim, and store identity (stale-replica detection). Diagnostic-only; reports the exact failing layer. This is an async runner and stays special-cased (carve-out, below). Activated by `--all`.
 - **class N -- plugin-enabled-state** (no flag; bare run + `--all`; check-only) -- the silent-disable watchdog (DRIFT-12). Reads `~/.claude/settings.json` enabledPlugins + installed_plugins.json; installed && enabled===false is CRITICAL with a re-enable hint. It runs on a bare run and under `--all` precisely because a DISABLED plugin cannot fire its own SessionStart hooks to report itself. LOCAL read only; never writes settings.json.
 - **class P / Q / R -- drift** (`--drift`; opt-in, NOT in `--all`) -- class P is prose-vs-code drift (skill-vs-code + first-touch, report-only even under `--fix`), class Q is gsd-record drift (shells out to `gsd-tools validate health`, parses W007 ROADMAP gaps + I001 missing SUMMARYs; `--fix` writes the DRIFT.md baseline and stubs missing SUMMARYs), class R is runtime-reachability drift (FAILS NON-ZERO when a capability is WIRED in the connector registry but UNREACHABLE by `decide()` at runtime). LOCAL-only, zero network.
 - **class S -- eureka-smoke** (`--eureka-smoke`; check-only) -- 4-layer Eureka local-embedding-stack probe (deps present, vec backend, model cache, graceful degrade). Non-cascading; never downloads a model unless `MINDRIAN_EUREKA_SMOKE_ALLOW_DOWNLOAD=1`; rolls into `--acceptance`. Another async carve-out (below). `--fix eureka` installs the local embedding stack into `~/.mindrian/eureka-deps/` (one-time, about 380 MB), the same action as `/mos:eureka enable`.
@@ -104,7 +104,7 @@ Look at the user's invocation:
 - `/mos:doctor --install-state` -> class I (install-state + topology + 6-way version-of-record) + class J (deployment-surface reconciliation)
 - `/mos:doctor --stale-first-touch` -> class K
 - `/mos:doctor --deprecated-usage` -> class L
-- `/mos:doctor --brain-smoke` -> class M (5-layer Brain probe)
+- `/mos:doctor --brain-smoke` -> class M (7-layer Brain probe)
 - `/mos:doctor --eureka-smoke` -> class S (4-layer Eureka probe; opt-in)
 - `/mos:doctor --drift` -> class P + class Q + class R (opt-in; NOT in `--all`)
 - `/mos:doctor --report-registration-bug` -> READ-ONLY escalation reporter (below). NOT a class flag, NOT part of `--all`, NOT a `--fix`.
@@ -125,6 +125,7 @@ These siblings own their own exit contracts and are not part of the class-flag d
 - `--dogfood-acceptance` -> the Canon Part 6 dog-fooding acceptance pass.
 - `--claims` -> the claims-verification leg.
 - `--check-rs-engine` -> the reason-select engine probe (NOT part of `--all`).
+- `--reset-install-id` -> rotates the opaque per-install bucket key the plugin sends to Theo, prints `install id rotated`, never prints the value, and always exits 0. Full contract: `docs/THEO-INSTALL-ID.md`.
 - `--post-update` -> the post-`claude plugin update` confirmation pass.
 - `--bind-check <roomDir>` -> a lightweight LOCAL room-health check run at BIND-TIME (never per-turn, never a Brain call). NEVER-BLOCK: an unhealthy room degrades to an advisory and STILL exits 0.
 - `--light-npx` -> the lighter npx-roundtrip variant for `--acceptance`.