@mindrian_os/install 1.13.0-beta.17 → 1.13.0-beta.19

package/lib/core/llm-name-suggester.cjs

@@ -0,0 +1,194 @@
+'use strict';
+/*
+ * Phase 119-01 -- LLM-suggested room name resolver.
+ *
+ * One-shot Haiku 4.5 call seeded with LOCAL Phase 117 auto-explore finding +
+ * Phase 118 MVA brief sentence. Returns a venture-shaped slug suggestion (e.g.
+ * 'acme-robotics', 'quantum-imaging', 'biotech-translation').
+ *
+ * Canon Part 8 invariant: this module MUST NOT invoke any Brain endpoint.
+ * The Brain repository holds GENERIC methodology -- framework chaining rules,
+ * phase progressions -- never user-specific content. A LLM call seeded with
+ * the user's auto-explore output + MVA brief sentence is purely LOCAL: the
+ * model sees the user's content directly via the local Anthropic API path,
+ * and the model's response is consumed locally.
+ *
+ * Canon Part 8 NOTE (REVISION 2026-05-16 Warning 5 fix): this module's fetch
+ * carries user content (the auto_explore_finding summary + the mva_brief_sentence)
+ * to api.anthropic.com. Per the standard plugin LLM usage pattern (precedent:
+ * lib/core/mva-classifier.cjs, lib/agents/mva/*.cjs, lib/chat/fabric-chat.cjs),
+ * this is acceptable: the Anthropic API is the LOCAL LLM transport for the
+ * plugin. The Canon Part 8 boundary covers ONLY the Mindrian-owned Brain MCP
+ * host (the Mindrian-owned methodology repository that must never receive user
+ * data) -- NOT api.anthropic.com (the Anthropic LLM transport). The two are
+ * distinct: Brain is a Mindrian-owned methodology repository that must never
+ * receive user data; api.anthropic.com is a stateless LLM transport.
+ *
+ * Tripwire: scaffold harness Gate 3 + Test 9 grep this module for any Brain-host
+ * substring AND any brain-client require AND any fetch to a brain.* URL; all
+ * three must return 0. This module body therefore avoids the literal Brain-host
+ * hostname string entirely (the scaffold harness uses literal-grep on the
+ * forbidden substring).
+ *
+ * Cost: ~$0.0005 per first-MVA completion (Haiku 4.5 input ~800 tokens,
+ * output ~10 tokens). See CONTEXT.md Architectural Decisions item 1.
+ *
+ * Em-dash discipline: uses `--` never the U+2014 character per memory
+ * feedback_no_emdashes.md.
+ *
+ * Graceful degradation: on LLM error, returns {ok: false, suggested_name:
+ * 'untitled', ...} so the F.1 selector still renders correctly with the
+ * fallback label `[name this room: untitled]`.
+ */
+
+const FALLBACK_SUGGESTION = 'untitled';
+
+// Phase 119-01 REVISION 2026-05-16 (Blocker 2 Option A): HAIKU_MODEL_ID is the
+// project-wide source-of-truth constant. The plan's REVISION text says to
+// import HAIKU_MODEL from lib/core/mva-classifier.cjs::HAIKU_MODEL, BUT
+// inspection of that module's module.exports (verified at lib/core/mva-classifier.cjs
+// line 359-370) shows HAIKU_MODEL is a module-internal const NOT exported. Per
+// Rule 1 deviation, the constant is inlined here with provenance pointing to
+// the source-of-truth declaration at lib/core/mva-classifier.cjs:53. If a
+// future phase exports HAIKU_MODEL, replace the inline literal with a require.
+const HAIKU_MODEL_ID = 'claude-haiku-4-5';
+
+/**
+ * suggestRoomName({auto_explore_finding, mva_brief_sentence, opts})
+ * @returns {Promise<{ok, suggested_name, model_used, latency_ms, error_short?}>}
+ */
+async function suggestRoomName(args) {
+  const opts = (args && typeof args === 'object') ? args : {};
+  const autoExploreFinding = opts.auto_explore_finding || null;
+  const mvaBriefSentence = (typeof opts.mva_brief_sentence === 'string') ? opts.mva_brief_sentence : '';
+  const llmClient = opts.llmClient || null;
+
+  const t0 = Date.now();
+  try {
+    const client = llmClient || _resolveProductionLlmClient();
+    const prompt = _buildLocalPrompt(autoExploreFinding, mvaBriefSentence);
+    const response = await client.complete({
+      model: HAIKU_MODEL_ID,
+      messages: [{ role: 'user', content: prompt }],
+      max_tokens: 20,
+    });
+    const raw = (response && typeof response.content === 'string') ? response.content : '';
+    const normalized = _normalizeSlug(raw);
+    const latency_ms = Date.now() - t0;
+    if (!normalized || normalized.length === 0) {
+      return { ok: false, suggested_name: FALLBACK_SUGGESTION, model_used: HAIKU_MODEL_ID, latency_ms, error_short: 'empty_response' };
+    }
+    return { ok: true, suggested_name: normalized, model_used: HAIKU_MODEL_ID, latency_ms };
+  } catch (err) {
+    const latency_ms = Date.now() - t0;
+    const error_short = String(err && err.message || err).slice(0, 60);
+    return { ok: false, suggested_name: FALLBACK_SUGGESTION, model_used: HAIKU_MODEL_ID, latency_ms, error_short };
+  }
+}
+
+function _buildLocalPrompt(autoExploreFinding, mvaBriefSentence) {
+  // Build a short prompt from LOCAL signals ONLY. The findings array carries
+  // the top whitespace + reverse-salient + cross-domain hits from Phase 117;
+  // the MVA brief sentence is the user's first conversational turn (already
+  // local). NEVER include any Brain-derived suggestion in this prompt.
+  const findingsSummary = _summarizeFindings(autoExploreFinding);
+  return [
+    'You are naming a venture. Suggest a 2-3 word kebab-case slug that captures',
+    'the core domain. Return ONLY the slug -- no prose, no quotes, no markdown.',
+    '',
+    'Brief: ' + (mvaBriefSentence || '(no brief)'),
+    'Findings: ' + findingsSummary,
+    '',
+    'Slug:',
+  ].join('\n');
+}
+
+function _summarizeFindings(autoExploreFinding) {
+  if (!autoExploreFinding || typeof autoExploreFinding !== 'object') return '(none)';
+  const findings = Array.isArray(autoExploreFinding.findings) ? autoExploreFinding.findings : [];
+  if (findings.length === 0) return '(empty)';
+  return findings.slice(0, 3).map(function (f) {
+    const sp = (typeof f.source_pipeline === 'string') ? f.source_pipeline : 'unknown';
+    const hsi = (typeof f.hsi_score === 'number') ? f.hsi_score.toFixed(2) : '?';
+    return sp + ':' + hsi;
+  }).join(', ');
+}
+
+function _normalizeSlug(raw) {
+  if (typeof raw !== 'string') return '';
+  let slug = raw.trim().toLowerCase();
+  // Collapse whitespace to single hyphen; drop everything that's not [a-z0-9-].
+  slug = slug.replace(/\s+/g, '-');
+  slug = slug.replace(/[^a-z0-9-]/g, '');
+  slug = slug.replace(/-{2,}/g, '-');
+  slug = slug.replace(/^-+|-+$/g, '');
+  return slug;
+}
+
+// Phase 119-01 REVISION 2026-05-16 (Blocker 2 Option A): mva-agent-contract.cjs
+// exports {runAgent, validateAgentResult, AGENT_RESULT_SHAPE} ONLY -- no
+// createLlmClient factory exists. The project-wide LLM-call idiom is direct
+// fetch to https://api.anthropic.com/v1/messages with x-api-key header
+// (precedent: lib/core/mva-classifier.cjs::_callHaiku same Haiku 4.5 model,
+// same anthropic-version header pattern, same AbortController timeout).
+//
+// This module mirrors that precedent verbatim. No @anthropic-ai/sdk dependency
+// added. Canon Part 8 invariant preserved: api.anthropic.com is the LOCAL
+// Anthropic API endpoint; the Mindrian-owned Brain MCP host is NEVER contacted.
+const ANTHROPIC_URL = 'https://api.anthropic.com/v1/messages';
+const ANTHROPIC_VERSION = '2023-06-01';
+const LLM_TIMEOUT_MS = 5000;
+
+function _resolveProductionLlmClient() {
+  const apiKey = process.env.ANTHROPIC_API_KEY;
+  if (!apiKey || typeof apiKey !== 'string' || apiKey.length === 0) {
+    throw new Error('anthropic_api_key_missing');
+  }
+  if (typeof fetch !== 'function') {
+    throw new Error('global_fetch_unavailable');
+  }
+  return {
+    complete: async function (req) {
+      const model = req.model || HAIKU_MODEL_ID;
+      const messages = Array.isArray(req.messages) ? req.messages : [];
+      const max_tokens = (typeof req.max_tokens === 'number') ? req.max_tokens : 20;
+      const ctrl = (typeof AbortController === 'function') ? new AbortController() : null;
+      const timer = ctrl ? setTimeout(function () { try { ctrl.abort(); } catch (_e) {} }, LLM_TIMEOUT_MS) : null;
+      try {
+        const res = await fetch(ANTHROPIC_URL, {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            'x-api-key': apiKey,
+            'anthropic-version': ANTHROPIC_VERSION,
+          },
+          body: JSON.stringify({ model: model, max_tokens: max_tokens, messages: messages }),
+          signal: ctrl ? ctrl.signal : undefined,
+        });
+        if (!res || !res.ok) {
+          throw new Error('anthropic_http_' + (res ? res.status : 'no_response'));
+        }
+        const j = await res.json();
+        let text = '';
+        if (j && Array.isArray(j.content)) {
+          for (const blk of j.content) {
+            if (blk && blk.type === 'text' && typeof blk.text === 'string') {
+              text += blk.text;
+            }
+          }
+        }
+        return { content: text };
+      } finally {
+        if (timer) clearTimeout(timer);
+      }
+    },
+  };
+}
+
+module.exports = {
+  suggestRoomName: suggestRoomName,
+  FALLBACK_SUGGESTION: FALLBACK_SUGGESTION,
+  HAIKU_MODEL_ID: HAIKU_MODEL_ID,
+  _normalizeSlug: _normalizeSlug,
+  _buildLocalPrompt: _buildLocalPrompt,
+};

package/lib/core/llm-name-suggester.test.cjs

@@ -0,0 +1,132 @@
+'use strict';
+// Phase 119-01 Task 1 tests for lib/core/llm-name-suggester.cjs.
+// Validates HAIKU_MODEL_ID + FALLBACK_SUGGESTION + suggestRoomName happy path +
+// graceful degradation + Canon Part 8 LOCAL invariant (zero brain.mindrian
+// substrings in module source) + EVENT_TYPES floor + room_discard_partial_failure
+// membership.
+
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const crypto = require('node:crypto');
+
+const suggester = require('./llm-name-suggester.cjs');
+const memoryEvents = require('./navigation/memory-events.cjs');
+
+// ---------------------------------------------------------------------------
+// EVENT_TYPES tests (floor + named membership)
+// ---------------------------------------------------------------------------
+
+test('Test 1: EVENT_TYPES Set size grows by at least 1 above the Plan 119-00 baseline (floor >= 42)', function () {
+  assert.ok(memoryEvents.EVENT_TYPES.size >= 42,
+    'EVENT_TYPES.size must be >= 42 (38 baseline + 3 from Plan 119-00 + 1 from this plan); got ' + memoryEvents.EVENT_TYPES.size);
+});
+
+test('Test 2: room_discard_partial_failure is in EVENT_TYPES; regression check on Plan 119-00 strings preserved', function () {
+  assert.ok(memoryEvents.EVENT_TYPES.has('room_discard_partial_failure'), 'room_discard_partial_failure missing');
+  assert.ok(memoryEvents.EVENT_TYPES.has('room_auto_created'), 'Plan 119-00 string room_auto_created regressed');
+  assert.ok(memoryEvents.EVENT_TYPES.has('room_naming_decided'), 'Plan 119-00 string room_naming_decided regressed');
+  assert.ok(memoryEvents.EVENT_TYPES.has('room_discarded'), 'Plan 119-00 string room_discarded regressed');
+});
+
+test('Test 3: EVENT_TYPES object is Object.frozen (own-properties invariant)', function () {
+  assert.ok(Object.isFrozen(memoryEvents.EVENT_TYPES),
+    'EVENT_TYPES Set must be Object.frozen (own-properties; the internal Set slot is documentation-only frozen per ECMAScript spec)');
+});
+
+test('Test 4: logEvent acceptance round-trip for room_discard_partial_failure', function () {
+  // Use a real tmp room.db via room-db.cjs::openRoomDb (the canonical opener).
+  const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'lln-suggester-test-'));
+  try {
+    const { openRoomDb, closeRoomDb } = require('./room-db.cjs');
+    const db = openRoomDb(tmpRoot);
+    try {
+      const result = memoryEvents.logEvent(db, 'room_discard_partial_failure', {
+        previous_slug: 'untitled-2026-05-16-1845',
+        partial_state: { fs_removed: true, registry_purged: false },
+        error_short: 'EBUSY',
+        source_path: 'system:room-discard-cascade',
+        created_by: 'system',
+      });
+      assert.strictEqual(result.ok, true, 'logEvent must accept room_discard_partial_failure as a valid event_type');
+      assert.match(result.eventId, /^memory_event:room_discard_partial_failure:\d+:[0-9a-f]{8}$/);
+    } finally {
+      closeRoomDb(db);
+    }
+  } finally {
+    try { fs.rmSync(tmpRoot, { recursive: true, force: true }); } catch (_e) {}
+  }
+});
+
+// ---------------------------------------------------------------------------
+// suggestRoomName tests
+// ---------------------------------------------------------------------------
+
+test('Test 5: HAIKU_MODEL_ID constant equals claude-haiku-4-5 (mirrors lib/core/mva-classifier.cjs:53)', function () {
+  assert.strictEqual(suggester.HAIKU_MODEL_ID, 'claude-haiku-4-5');
+});
+
+test('Test 6: FALLBACK_SUGGESTION constant equals untitled (verbatim)', function () {
+  assert.strictEqual(suggester.FALLBACK_SUGGESTION, 'untitled');
+});
+
+test('Test 7: suggestRoomName happy path returns normalized slug', async function () {
+  const stub = { complete: async function () { return { content: 'acme-robotics' }; } };
+  const r = await suggester.suggestRoomName({
+    auto_explore_finding: { findings: [{ source_pipeline: 'whitespace', hsi_score: 0.83 }] },
+    mva_brief_sentence: 'Robotic precision for industrial automation.',
+    llmClient: stub,
+  });
+  assert.strictEqual(r.ok, true);
+  assert.strictEqual(r.suggested_name, 'acme-robotics');
+  assert.strictEqual(r.model_used, 'claude-haiku-4-5');
+  assert.ok(typeof r.latency_ms === 'number' && r.latency_ms >= 0);
+});
+
+test('Test 8: suggestRoomName graceful degradation on LLM error -> FALLBACK_SUGGESTION', async function () {
+  const stub = { complete: async function () { throw new Error('timeout'); } };
+  const r = await suggester.suggestRoomName({
+    auto_explore_finding: null,
+    mva_brief_sentence: '',
+    llmClient: stub,
+  });
+  assert.strictEqual(r.ok, false);
+  assert.strictEqual(r.suggested_name, 'untitled');
+  assert.strictEqual(r.model_used, 'claude-haiku-4-5');
+  assert.ok(typeof r.latency_ms === 'number' && r.latency_ms >= 0);
+  assert.ok(typeof r.error_short === 'string' && r.error_short.length > 0);
+});
+
+test('Test 9: Canon Part 8 LOCAL invariant -- grep tripwire on llm-name-suggester source', function () {
+  const src = fs.readFileSync(require.resolve('./llm-name-suggester.cjs'), 'utf8');
+  // The forbidden Brain coupling regex (from the plan scaffold harness Gate 3):
+  // brain.mindrian | require.+brain-client | fetch.+brain
+  assert.ok(!/brain\.mindrian/.test(src), 'source contains brain.mindrian substring (Canon Part 8 breach)');
+  assert.ok(!/require\([^)]*brain-client[^)]*\)/.test(src), 'source requires a brain-client module (Canon Part 8 breach)');
+  // The fetch.+brain regex would match commentary about "brain" near a fetch
+  // discussion; we narrow to actual fetch() invocations to brain.* hosts:
+  assert.ok(!/fetch\([^)]*['\"][^'\"]*brain[^'\"]*['\"]/.test(src), 'source fetches a brain.* URL (Canon Part 8 breach)');
+});
+
+test('Test 10: Canon Part 8 LOCAL invariant -- payload audit (constructed prompt contains no Brain handle)', function () {
+  const prompt = suggester._buildLocalPrompt({
+    findings: [{ source_pipeline: 'whitespace', hsi_score: 0.5 }],
+  }, 'AI-assisted protein folding for drug discovery.');
+  const serialized = JSON.stringify(prompt);
+  assert.ok(serialized.indexOf('brain.mindrian') === -1, 'prompt must not contain brain.mindrian');
+  assert.ok(serialized.indexOf('brain-client') === -1, 'prompt must not contain brain-client handle');
+});
+
+// ---------------------------------------------------------------------------
+// Em-dash invariant on the test file itself + module source
+// ---------------------------------------------------------------------------
+
+test('Test 11: zero em-dashes in llm-name-suggester source + this test file', function () {
+  const EMDASH = String.fromCharCode(0x2014);
+  const src = fs.readFileSync(require.resolve('./llm-name-suggester.cjs'), 'utf8');
+  const testSrc = fs.readFileSync(__filename, 'utf8');
+  assert.ok(src.indexOf(EMDASH) === -1, 'em-dash present in llm-name-suggester.cjs (HARD RULE)');
+  assert.ok(testSrc.indexOf(EMDASH) === -1, 'em-dash present in llm-name-suggester.test.cjs (HARD RULE)');
+});

package/lib/core/mva-orchestrator.cjs

@@ -303,6 +303,47 @@ async function runPipeline(opts) {
     });
   } catch (_e) { /* best-effort */ }
 
+  // phase-119-01-naming-selector-hook: spawn the post-MVA retroactive-naming F.1
+  // selector as a detached child. The selector runs entirely LOCAL (Canon Part 8);
+  // it surfaces an F.1 selector with the four locked labels from CONTEXT.md D-06
+  // (name this room: <LLM-suggested> / type your own name / keep as untitled /
+  // discard room), validates user choice through the Phase 88.2 dispatcher, and
+  // emits room_naming_decided + room_discarded memory_events via the navigation.cjs
+  // chokepoint.
+  //
+  // Phase 119-01 failure NEVER regresses Phase 118: the spawn is detached + unref'd;
+  // any failure (missing shim, require failure, etc.) is swallowed; runPipeline
+  // returns immediately. The state.json write below is unaffected.
+  try {
+    const cp = require('node:child_process');
+    const hookPath = require('node:path');
+    const hookFs = require('node:fs');
+    const hookOs = require('node:os');
+    const shimPath = hookPath.join(__dirname, '..', '..', 'scripts', 'room-naming-selector.cjs');
+    // Resolve the current room dir via the rooms registry to honor Plan 119-00's
+    // reassignment of the active slug.
+    const roomsHome = process.env.MINDRIAN_ROOMS_HOME ||
+      hookPath.join(process.env.HOME || hookOs.homedir(), 'MindrianRooms');
+    const registryPath = hookPath.join(roomsHome, '.rooms', 'registry.json');
+    let activeRoomDir = null;
+    if (hookFs.existsSync(registryPath)) {
+      const reg = JSON.parse(hookFs.readFileSync(registryPath, 'utf8'));
+      if (reg && typeof reg.active === 'string' && reg.active.length > 0) {
+        activeRoomDir = hookPath.join(roomsHome, reg.active);
+      }
+    }
+    if (activeRoomDir && hookFs.existsSync(shimPath)) {
+      const child = cp.spawn('node', [shimPath, '--room-dir', activeRoomDir, '--sentence-sha256', sha256], {
+        detached: true,
+        stdio: 'ignore',
+      });
+      if (typeof child.unref === 'function') child.unref();
+    }
+  } catch (_e) {
+    // Phase 119-01 failure NEVER regresses Phase 118. Swallow silently; the user's
+    // MVA brief still rendered + deployed + state.json still writes below.
+  }
+
   // CRITICAL-3 wire: atomic state.json manifest after mva_brief_rendered.
   // Only on the rendered path (not on Hebrew short-circuit which returned earlier).
   // Plan 118-04 carries the deck_url into the manifest atomically.

package/lib/core/mva-telemetry.cjs

@@ -1,32 +1,9 @@
 /*
  * Copyright (c) 2026 Mindrian. BSL 1.1.
- *
- * Phase 118-03 Plan 03 -- mva-telemetry.
- *
- * JSONL writer for the 6 Phase 121 MVA event types. Atomic append to
- * ~/.mindrian/telemetry/v1.13/mva.jsonl. Schema-enforced (rejects events
- * with raw user content; per-event ALLOWED_FIELDS is the source of truth
- * for Plan 118-06's Dror harness grep test).
- *
- * Per Plan 118-03 OQ8 (resolved): the 6 event types are
- *   mva_pipeline_started, mva_agent_returned, mva_brief_rendered,
- *   mva_option_selected, mva_brief_deployed, mva_pipeline_failed.
- *
- * CRITICAL invariant (WARN-2 from iteration 2): the mva_brief_rendered
- * event uses `total_duration_ms` (NOT `duration_ms`). Plan 118-06's
- * Dror harness greps ALLOWED_FIELDS.mva_brief_rendered to assert this.
- *
- * Canon Part 8 (LOCAL telemetry):
- *   - Sentence-related identifier is sentence_sha256 ONLY (one-way hash).
- *   - Every string field is capped (sentence_sha256=64 exact, error_short<=60,
- *     other strings<=64) to prevent raw user content from sneaking through.
- *   - Fields not in ALLOWED_FIELDS for the event type are rejected.
- *
- * Atomic append: fs.appendFileSync writes a single short line. POSIX
- * append semantics guarantee atomicity for writes within PIPE_BUF (4096
- * bytes on Linux). Our lines are < 512 bytes, well below the limit.
- *
- * Pure CJS, node built-ins only.
+ * Phase 121-01 -- mva-telemetry shim. Delegates to lib/core/telemetry/writer.cjs
+ * (the Canon Part 9 chokepoint), with a legacy dual-write to the historical
+ * ~/.mindrian/telemetry/v1.13/mva.jsonl path so existing readers keep working.
+ * TODO(v1.14.0): delete this shim; callers must import lib/core/telemetry/writer.cjs directly.
  */
 'use strict';
 
@@ -34,137 +11,48 @@ const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
 
-// ---------- Frozen invariants ----------
+const writer = require('./telemetry/writer.cjs');
+const validator = require('./telemetry/validator.cjs');
+const schema = require('./telemetry/schema.cjs');
 
 const EVENT_TYPES = Object.freeze([
-  'mva_pipeline_started',
-  'mva_agent_returned',
-  'mva_brief_rendered',
-  'mva_option_selected',
-  'mva_brief_deployed',
-  'mva_pipeline_failed'
+  'mva_pipeline_started', 'mva_agent_returned', 'mva_brief_rendered',
+  'mva_option_selected', 'mva_brief_deployed', 'mva_pipeline_failed',
 ]);
 
-// Per-event scalar field schema. Source-of-truth for Plan 118-06 Dror harness.
-// CRITICAL: mva_brief_rendered uses 'total_duration_ms' (NOT 'duration_ms').
 const ALLOWED_FIELDS = Object.freeze({
-  mva_pipeline_started: Object.freeze(['sentence_sha256']),
-  mva_agent_returned:   Object.freeze(['sentence_sha256', 'agent_id', 'duration_ms', 'status', 'error_short']),
-  mva_brief_rendered:   Object.freeze(['sentence_sha256', 'total_duration_ms', 'agent_count_ok', 'agent_count_failed']),
-  mva_option_selected:  Object.freeze(['sentence_sha256', 'option_id', 'time_to_click_ms']),
-  mva_brief_deployed:   Object.freeze(['sentence_sha256', 'vercel_subdomain_hash', 'deploy_duration_ms', 'status', 'error_short']),
-  mva_pipeline_failed:  Object.freeze(['sentence_sha256', 'total_duration_ms', 'error_short'])
+  mva_pipeline_started: schema.ALLOWED_FIELDS.mva_pipeline_started,
+  mva_agent_returned:   schema.ALLOWED_FIELDS.mva_agent_returned,
+  mva_brief_rendered:   schema.ALLOWED_FIELDS.mva_brief_rendered,
+  mva_option_selected:  schema.ALLOWED_FIELDS.mva_option_selected,
+  mva_brief_deployed:   schema.ALLOWED_FIELDS.mva_brief_deployed,
+  mva_pipeline_failed:  schema.ALLOWED_FIELDS.mva_pipeline_failed,
 });
 
-// String-length caps. error_short is special-cased to <= 60.
-// sentence_sha256 must be exactly 64 hex chars.
-const MAX_STRING_LEN = 64;
-const MAX_ERROR_SHORT_LEN = 60;
-const SHA256_LEN = 64;
-
-// ---------- Path resolvers (env-aware for hermetic testing) ----------
-
-function homeDir() {
+function _homeDir() {
   return process.env.HOME || process.env.USERPROFILE || os.homedir();
 }
 
-function telemetryDir() {
-  return path.join(homeDir(), '.mindrian', 'telemetry', 'v1.13');
-}
-
-function telemetryFile() {
-  return path.join(telemetryDir(), 'mva.jsonl');
-}
-
-// ---------- Validation ----------
-
-/**
- * validateEventPayload(event, payload) -> { ok: boolean, error?: string }
- *
- * Returns ok:false if:
- *   - event is not in EVENT_TYPES
- *   - any key in payload is not in ALLOWED_FIELDS[event]
- *   - any string value violates the per-field length cap
- *
- * Numeric fields are not length-checked. The session_id field is added
- * by emit() (not the caller), so it is not validated against ALLOWED_FIELDS.
- */
-function validateEventPayload(event, payload) {
-  if (!EVENT_TYPES.includes(event)) {
-    return { ok: false, error: 'unknown_event' };
-  }
-  if (!payload || typeof payload !== 'object') {
-    return { ok: false, error: 'payload_not_object' };
-  }
-  const allowed = ALLOWED_FIELDS[event];
-  for (const key of Object.keys(payload)) {
-    if (!allowed.includes(key)) {
-      return { ok: false, error: 'unknown_field:' + key };
-    }
-    const v = payload[key];
-    if (typeof v === 'string') {
-      if (key === 'sentence_sha256') {
-        if (v.length !== SHA256_LEN) {
-          return { ok: false, error: 'sha256_length_invalid' };
-        }
-      } else if (key === 'error_short') {
-        if (v.length > MAX_ERROR_SHORT_LEN) {
-          return { ok: false, error: 'error_short_too_long' };
-        }
-      } else {
-        if (v.length > MAX_STRING_LEN) {
-          return { ok: false, error: 'string_too_long:' + key };
-        }
-      }
-    }
-  }
-  return { ok: true };
+function _legacyMvaPath() {
+  return path.join(_homeDir(), '.mindrian', 'telemetry', 'v1.13', 'mva.jsonl');
 }
 
-// ---------- Public emit() ----------
-
-/**
- * emit(event, payload) -> appends one JSONL line to ~/.mindrian/telemetry/v1.13/mva.jsonl
- *
- * Validates first. On invalid payload throws a ValidationError (so callers
- * cannot silently leak). On disk error returns silently (best-effort: the
- * pipeline must not crash because telemetry is unavailable).
- */
 function emit(event, payload) {
-  const v = validateEventPayload(event, payload);
-  if (!v.ok) {
-    const e = new Error('telemetry validation failed: ' + v.error);
-    e.code = 'TELEMETRY_VALIDATION';
-    throw e;
-  }
-
-  const record = Object.assign(
-    {
-      event: event,
-      timestamp: new Date().toISOString(),
-      session_id: (typeof process.env.CLAUDE_SESSION_ID === 'string' && process.env.CLAUDE_SESSION_ID.length > 0)
-        ? process.env.CLAUDE_SESSION_ID.slice(0, MAX_STRING_LEN)
-        : 'default'
-    },
-    payload
-  );
-
+  writer.emit(event, payload); // Canon Part 8 gate + unified events-YYYY-WNN.jsonl append.
   try {
-    fs.mkdirSync(telemetryDir(), { recursive: true });
-    fs.appendFileSync(telemetryFile(), JSON.stringify(record) + '\n', 'utf8');
-  } catch (_e) {
-    // Best-effort. The MVA pipeline must not fail because telemetry disk
-    // is unavailable. Plan 118-06's Dror harness checks for the file's
-    // existence post-run as the success signal.
-  }
+    const sid = (typeof process.env.CLAUDE_SESSION_ID === 'string' && process.env.CLAUDE_SESSION_ID.length > 0)
+      ? process.env.CLAUDE_SESSION_ID.slice(0, schema.MAX_STRING_LEN) : 'default';
+    const record = Object.assign({ event: event, timestamp: new Date().toISOString(), session_id: sid }, payload);
+    fs.mkdirSync(path.dirname(_legacyMvaPath()), { recursive: true });
+    fs.appendFileSync(_legacyMvaPath(), JSON.stringify(record) + '\n', 'utf8');
+  } catch (_) { /* best-effort legacy dual-write */ }
 }
 
 module.exports = {
-  emit,
-  validateEventPayload,
-  EVENT_TYPES,
-  ALLOWED_FIELDS,
-  // Exposed for tests + downstream plans that need the canonical path
-  telemetryDir,
-  telemetryFile,
+  emit: emit,
+  validateEventPayload: validator.validateEventPayload,
+  EVENT_TYPES: EVENT_TYPES,
+  ALLOWED_FIELDS: ALLOWED_FIELDS,
+  telemetryDir: writer.telemetryDir,
+  telemetryFile: writer.telemetryFile,
 };

package/lib/core/navigation/edges.cjs

@@ -33,6 +33,41 @@ const ALLOWED_EDGE_TYPES = Object.freeze(new Set([
   // Phase 125 D7 -- F-selector decision edges (LOCKED LOCAL per Canon Part 8).
   'DEFERRED',
   'REJECTED',
+  // Phase 120-00 Wave 1 extension (Breakthrough Scan / Category G; D-18 HARD FLOOR enforcement
+  //   + D-20 Cypher-provable principle). DERIVED_FROM is the structural enforcement: a
+  //   Breakthrough node CANNOT surface without at least one DERIVED_FROM edge to an
+  //   Artifact node. Mirrors the Phase 125-00 DEFERRED + REJECTED additive idiom.
+  //
+  // Canon Part 4: every choice is graph data. The Breakthrough node + its DERIVED_FROM
+  //   edges are the graph-native artifact of pattern detection.
+  //
+  // Canon Part 8: writeEdge takes (db, params) over a LOCAL room.db handle; DERIVED_FROM
+  //   never crosses to Brain. Cross-room aggregation forbidden (Phase 8 cross-room fence).
+  //
+  // D-20 enforcement: lib/core/breakthrough/schema.cjs::writeBreakthrough wraps the
+  //   Breakthrough node insert + N DERIVED_FROM edge inserts in a single SQLite transaction.
+  //   If any step fails, the transaction rolls back -- partial Breakthrough state CANNOT
+  //   land. The Cypher invariant `MATCH (b:Breakthrough)-[:DERIVED_FROM]->(a:Artifact)
+  //   RETURN count(a)` is guaranteed >= 1 by construction.
+  'DERIVED_FROM',
+  // Phase 120-02 Wave 2 extension (Breakthrough Scan / Category G; D-09 file-as-decision
+  //   bridge). FILED_AS_DECISION is the typed edge that promotes a Breakthrough node into
+  //   the Phase 88 decision-log machinery when the user picks the [File as decision]
+  //   verb on F.7. Mirrors the Phase 120-00 DERIVED_FROM additive idiom verbatim.
+  //
+  // Canon Part 4: every choice is graph data. The Breakthrough -> Decision edge is the
+  //   graph-native bridge that lets future related breakthroughs reference the filed
+  //   decision via ENABLES edges (per CONTEXT.md D-15 "may be referenced as ENABLES in
+  //   future related breakthroughs").
+  //
+  // Canon Part 8: writeEdge takes (db, params) over a LOCAL room.db handle;
+  //   FILED_AS_DECISION never crosses to Brain. Cross-room aggregation forbidden.
+  //
+  // Emitted by: lib/core/breakthrough/verb-dispatch.cjs::handleFileAsDecision.
+  // The destination Decision node id is 'decision:' + breakthroughId by convention;
+  // Phase 88 decision-log machinery (or a future Phase 121 housekeeping pass) is
+  // responsible for materializing the Decision node body when one does not yet exist.
+  'FILED_AS_DECISION',
 ]));
 
 function isPlainObject(v) {