@onlooker-community/ecosystem 0.34.0 → 0.43.0

package/.claude/skills/writing-tests/SKILL.md

@@ -160,6 +160,33 @@ _seed_artifact() {
 }
 ```
 
+## Gate every assertion: non-final `[[ ]]` needs `|| return 1`
+
+`bats` resolves `#!/usr/bin/env bash`, which on macOS is the system bash 3.2.
+Under 3.2 a failing **non-final** `[[ ]]` does **not** fail the test body —
+execution continues and the test reports `ok`. Single-bracket `[ ]`, failing
+commands, and failing command substitutions all gate correctly even there; the
+defect is specific to `[[ ]]`. Under bash 5.x (what CI runs) it gates properly,
+so a broken assertion passes locally and only CI would catch it.
+
+Only the **last** assertion in a test body is safe, because a body's exit
+status is its last command. Any `[[ ]]` before that needs explicit gating:
+
+```bash
+@test "example" {
+  [[ "$output" == *"expected"* ]] || return 1   # non-final — must gate
+  [ "$status" -eq 0 ]                            # final — gates on its own
+}
+```
+
+Do **not** "fix" this by swapping to `[ ]`. Most of these assertions rely on
+`[[ ]]`-only behavior — `==` glob patterns, `=~` regex, internal `&&`/`||` —
+and a blanket swap silently changes what they test.
+
+When you add an assertion, break it on purpose once and confirm the test fails.
+A test that passes whether or not the code is correct is worse than no test,
+because it reports coverage that does not exist.
+
 ## Anti-patterns
 
 Don't hand-roll these — each has bitten the suite before:

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ecosystem",
-  "version": "0.34.0",
+  "version": "0.43.0",
   "description": "Observability substrate for Claude Code. Provides the shared $ONLOOKER_DIR storage root (default $HOME/.onlooker), canonical schema-validated event emission, session and tool tracking hooks, and prompt rules. Required by all other Onlooker plugins.",
   "author": {
     "name": "Onlooker Community",

package/.github/workflows/release.yml

@@ -7,26 +7,16 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  id-token: write
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      # Force release-please's intermediate PR-branch commits to be authored
-      # by github-actions[bot] instead of inheriting whatever identity the
-      # PAT owner happens to have configured on their local machine. The
-      # squash-merge of the release PR already attributes the merge to the
-      # PAT owner correctly, but the intermediate commits would otherwise
-      # leak the maintainer's hostname-shaped author email.
-      - name: Configure bot identity
-        run: |
-          git config --global user.name 'github-actions[bot]'
-          git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
-
       - uses: googleapis/release-please-action@v4
         id: release
         with:
-          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       # Only publish to npm when the ecosystem (root) package was released.
       # Archivist (and future sibling plugins) are distributed via the Claude
@@ -49,7 +39,17 @@ jobs:
       - run: npm ci
         if: ${{ contains(fromJSON(steps.release.outputs.paths_released || '[]'), '.') }}
 
-      - run: npm publish
+      # --provenance is what makes the id-token: write permission above do
+      # anything. Without it npm never requests an OIDC token and the publish
+      # authenticates with NPM_TOKEN alone — a classic automation token, which
+      # this package's 2FA policy rejects with a 403. The permission has been
+      # granted since #175 and inert ever since, so every release from 0.35.0
+      # on tagged cleanly and never reached npm.
+      #
+      # --access public is a no-op on an already-public package; it is here for
+      # parity with onlooker-community/schema's publish-npm.yml, the one
+      # configuration in this org that publishes successfully.
+      - run: npm publish --provenance --access public
         if: ${{ contains(fromJSON(steps.release.outputs.paths_released || '[]'), '.') }}
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.release-please-manifest.json

@@ -1,18 +1,18 @@
 {
-  ".": "0.34.0",
+  ".": "0.43.0",
   "plugins/archivist": "0.3.1",
-  "plugins/tribunal": "1.1.2",
+  "plugins/tribunal": "1.2.7",
   "plugins/echo": "0.3.1",
-  "plugins/cartographer": "0.3.1",
+  "plugins/cartographer": "0.6.0",
   "plugins/governor": "0.3.2",
   "plugins/compass": "0.4.1",
   "plugins/scribe": "0.4.2",
   "plugins/counsel": "0.5.1",
   "plugins/warden": "0.3.1",
-  "plugins/librarian": "0.7.0",
-  "plugins/curator": "0.2.2",
-  "plugins/historian": "0.3.2",
-  "plugins/assayer": "1.1.2",
+  "plugins/librarian": "0.13.2",
+  "plugins/curator": "0.2.3",
+  "plugins/historian": "0.3.3",
+  "plugins/assayer": "1.1.3",
   "plugins/bursar": "0.3.0",
   "plugins/lineage": "0.2.2",
   "plugins/inspector": "0.3.2"

package/AGENTS.md

@@ -47,6 +47,122 @@ cp -rf source dest          # NOT: cp -r source dest
 - `apt-get` - use `-y` flag
 - `brew` - use `HOMEBREW_NO_AUTO_UPDATE=1` env var
 
+<!-- The sections below are mirrored from CLAUDE.md. The two files are
+     independent — not symlinked, not sharing an inode — so an edit to the
+     repository's conventions must land in both or agents get different
+     instructions depending on which file their harness reads. Claude Code
+     reads CLAUDE.md; Codex and several other tools read this one. -->
+
+## Repository layout
+
+```
+ecosystem/                    ← substrate plugin (always-on observability)
+  hooks/                      ← session, tool, and prompt hooks
+  scripts/lib/                ← shared bash helpers and the canonical event emitter
+  skills/                     ← user-invocable slash commands
+  config.json                 ← ecosystem defaults
+
+plugins/
+  archivist/                  ← session memory across context truncation
+  bursar/                     ← multi-session, per-project budget rollup (governor's cross-session view)
+  cartographer/               ← instruction-file auditor (CLAUDE.md, AGENTS.md, rules/)
+  compass/                    ← pre-write alignment gate (design phase)
+  echo/                       ← prompt-change regression detection
+  governor/                   ← resource governance and budget enforcement
+  inspector/                  ← per-edit lint and typecheck gate
+  lineage/                    ← per-change provenance ("why does this line exist?")
+  tribunal/                   ← multi-agent quality gate (Actor → Jury → Meta-Judge → Gate)
+
+docs/
+  architecture.md             ← how plugins compose and share the event bus
+  adr/                        ← ecosystem-level architectural decisions
+
+scripts/lib/onlooker-event.mjs  ← canonical event builder; all plugins route through this
+~/.onlooker/                    ← shared runtime storage (logs, plugin artifacts)
+```
+
+## Plugin map
+
+| Plugin | Hook surface | When it fires |
+|--------|-------------|---------------|
+| ecosystem | SessionStart/End, PreToolUse, PostToolUse, PostToolUseFailure, UserPromptSubmit, UserPromptExpansion, PreCompact, PostCompact, TaskCreated, TaskCompleted, WorktreeCreate, WorktreeRemove | Always — substrate |
+| archivist | PreCompact, SessionStart | Extracts decisions/dead-ends on compaction; reinjects at next SessionStart |
+| cartographer | SessionStart, PostToolUse (Write, Edit, MultiEdit) | Audits instruction files on session start and after instruction-file writes |
+| compass | PreToolUse (Write, Edit, MultiEdit, Bash) | Before any write — alignment check |
+| echo | Stop | Regression-tests prompt changes after each agent stop |
+| governor | SessionStart, PreToolUse (Task), PostToolUse (Task), Stop | Budget gates on subagent spawns; tracks spend per session |
+| tribunal | Stop + skill invocation | Post-task quality gate; also invokable via `/tribunal` |
+| warden | PostToolUse (WebFetch, Read), PreToolUse (Write, Edit, MultiEdit, Bash), SessionStart + skill invocation | Scans ingested content for injection; closes a content gate that blocks write-class tools until cleared via `/warden` |
+| assayer | Stop | Verifies the agent's final-message claims against actual command results in the transcript; advisory |
+| bursar | SessionStart, SessionEnd | Rolls each session's spend into a per-project ledger on SessionEnd; surfaces "this project burned $X this week" at SessionStart. Governor is per-session; bursar is the cross-session rollup |
+| lineage | PostToolUse (Edit, Write, MultiEdit) + skill invocation | Records per-change provenance (session_id/turn + redacted, size-capped snippets) into a per-project ledger; `/lineage <file>:<line>` answers "why does this line exist?" by joining records to historian transcripts to recover prompt context |
+| inspector | PostToolUse (Write, Edit, MultiEdit) | Per-edit verification: runs the project's configured lint + typecheck commands on just the touched file and emits `inspector.check.*` / `inspector.run.completed`. Surfaces issues to the agent for the next turn. Cheaper than the planned proctor (which runs the full project verify at Stop); complements assayer (which catches claims the agent makes without running anything) |
+| librarian | SessionEnd, SessionStart + skill invocation | Consolidation layer between archivist's per-session artifacts and the user's durable typed memory store. At SessionEnd, decides which decisions/dead-ends deserve to outlive the session, classifies them into user/feedback/project/reference, and queues them as proposals; at SessionStart, surfaces a one-line pointer to the queue. Propose-only (its ADR-001) — auto-promotion is opt-in. Also owns the lesson-promotion pipeline under `lessons/`, walked via `/librarian lessons` |
+| historian | SessionEnd, UserPromptSubmit | Episodic memory. Chunks and sanitizes the transcript at SessionEnd into `$ONLOOKER_DIR/historian/<project-key>/sessions/`; on UserPromptSubmit, embeds the prompt and retrieves similar past chunks. Lineage joins these transcripts to recover the prompt context behind a change |
+| counsel | SessionStart + skill invocation | Weekly synthesis across every plugin's event log. Produces a structured improvement brief and injects it at SessionStart when the last one is stale; `/counsel` on demand |
+| curator | SessionStart | Maintenance for the typed auto-memory store. Runs four cheap heuristic checks (date_decayed, path_broken, broken_index, orphaned_memory) inside a wall-clock budget and surfaces findings as a one-line pointer. Never edits the memory store directly. The `/curator review` walkthrough and the LLM contradiction sweep are both deferred — see the plugin's README |
+| scribe | SessionStart, UserPromptSubmit, Stop | Intent documentation from agent activity: captures why changes were made — problem context, decisions, tradeoffs — and distills them into readable artifacts at session end |
+
+Plugins communicate by emitting events to the JSONL log — they do not call each other directly. All plugins depend on the ecosystem substrate; no plugin depends on another plugin directly.
+
+## Compass plugin (design phase)
+
+Compass is the pre-write alignment gate. It has no implementation yet. Design lives in `plugins/compass/docs/design.md`.
+
+**What it does:** Fires on `PreToolUse` for write-class tools. Samples N=5 parallel Haiku evaluators to score intent clarity. Blocks when `confidence < 0.65 OR stddev > 0.20` and surfaces a clarification prompt.
+
+**Critical architectural decision (ADR-001):** The evaluator must see the **prior assistant turn** alongside the current context — not the current context alone. Evaluating a reply in isolation produces a systematic false-positive class: a user answering an agent's enumerated question ("the internal one") looks ambiguous without the question that prompted it.
+
+The pipeline is:
+
+```
+Trigger Gate → Transcript Reader → Symbolic Skip Layer → Sanitizer → N=5 Evaluators → Gate
+```
+
+- **Transcript reader** resolves `prior_assistant_turn` from `transcript_path` in the hook JSON payload (same field tribunal-stop-gate.sh reads). Reads one turn back from that file (already committed before `PreToolUse` fires — no timing-skew risk). If `transcript_path` is absent or unreadable, proceeds with an empty prior turn.
+- **Symbolic skip layer** short-circuits to `confident` when the prior turn is an enumerated question and the current context is an option reference, without an LLM call. Controlled by `skip_patterns.reply_to_question.enabled` (default `true`).
+- **Evaluator prompt** uses a structured pair: `<prior_assistant_turn>` and `<context_excerpt>` as separate XML-delimited slots. The convergence question is: *"Given the prior assistant turn as context, would two independent readers converge on the same interpretation of this write?"*
+
+See `plugins/compass/docs/adr/001-evaluate-prompts-in-context.md` for the full decision record.
+
+## Adding a new plugin
+
+1. Create `plugins/<name>/` with `.claude-plugin/plugin.json`, `config.json`, `hooks/hooks.json`.
+2. Use `scripts/lib/onlooker-event.mjs` for all event emission — never write directly to the JSONL log.
+3. Store runtime artifacts under `${ONLOOKER_DIR:-$HOME/.onlooker}/<name>/<project-key>/`. Always use `$ONLOOKER_DIR` — never hardcode `~/.onlooker` — so the test suite's isolated temp home is respected.
+4. Derive the project key via `tribunal_project_key` (or equivalent) — first 12 hex chars of SHA256(`remote:<origin-url>`), falling back to SHA256(`root:<repo-root>`) for repos without a remote. See `plugins/tribunal/scripts/lib/tribunal-project-key.sh`.
+5. Register event types in `@onlooker-community/schema` before emitting them. The runtime emitter is dependency-free and **fails open**: it validates against the schema package only when that package is resolvable (dev, CI, tests) and emits unconditionally otherwise, because installed marketplace plugins ship no `node_modules`. Schema drift is caught in CI against the published schemas at `schema.onlooker.dev`. See [ADR-005](docs/adr/005-runtime-emitter-fails-open.md).
+6. Fail-soft when `~/.onlooker/` is absent — plugins must not block a session they were not invited to.
+
+## Development
+
+```bash
+mise install          # installs all tools declared in mise.toml
+npm ci
+npm test              # bats + schema validation
+npm run test:ci       # shellcheck + bats + schema + lint
+```
+
+Tests use an isolated temp home; nothing writes to your real `~/.onlooker/`.
+
+## Git workflow
+
+**Always open a PR — never push directly to `main`.** Even though bypass rights allow direct pushes, this repo uses release-please for automated changelogs and versioning, so every change must travel through a PR to be picked up correctly. CI also runs on PRs before merge, catching failures before they land.
+
+Workflow:
+1. Create a feature branch: `git switch -c <type>/<short-description>`
+2. Commit using `/commit`
+3. Push the branch and open a PR using `/git-workflow:pr`
+4. Wait for CI to pass before merging
+
+## Conventions
+
+- All hooks are bash scripts. No Python, no Node entry points in hook scripts (they may shell out to `node` for event emission or heavy lifting).
+- Hook scripts source shared helpers from `scripts/lib/` (or the plugin's own `scripts/lib/`).
+- Event types follow `<plugin>.<noun>.<verb>` — e.g. `compass.check.skipped`, `tribunal.gate.blocked`.
+- ULIDs everywhere for IDs (not UUIDs). Each plugin ships its own `*_ulid` helper (e.g. `archivist-ulid.sh`, `tribunal-ulid.sh`); there is no shared ecosystem helper. Copy `plugins/tribunal/scripts/lib/tribunal-ulid.sh` as a starting point and rename the function prefix.
+- Config defaults live in `config.json`. User overrides go in `~/.claude/settings.json` (global) or `.claude/settings.json` (per-project) under the plugin's namespace key (e.g. `"compass"`, `"tribunal"`). See ADR-004.
+
 <!-- BEGIN BEADS INTEGRATION v:1 profile:minimal hash:970c3bf2 -->
 ## Beads Issue Tracker
 

package/CHANGELOG.md

@@ -1,5 +1,180 @@
 # Changelog
 
+## [0.43.0](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.42.2...ecosystem-v0.43.0) (2026-08-19)
+
+
+### Features
+
+* **cartographer:** announce a finding when its drift is gone :wave: ([#186](https://github.com/onlooker-community/ecosystem/issues/186)) ([f2b57f6](https://github.com/onlooker-community/ecosystem/commit/f2b57f67b3e09f7ec624bce0bb4a306c4e20df8b))
+
+## [0.42.2](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.42.1...ecosystem-v0.42.2) (2026-08-19)
+
+
+### Bug Fixes
+
+* **release:** publish with provenance so npm stops refusing us :unlock: ([#184](https://github.com/onlooker-community/ecosystem/issues/184)) ([0921118](https://github.com/onlooker-community/ecosystem/commit/0921118401a4c165ba07471a5d573dbe21a35119))
+
+## [0.42.1](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.42.0...ecosystem-v0.42.1) (2026-08-19)
+
+
+### Bug Fixes
+
+* **cartographer:** refuse a typeless finding out loud :loudspeaker: ([#182](https://github.com/onlooker-community/ecosystem/issues/182)) ([35ee0af](https://github.com/onlooker-community/ecosystem/commit/35ee0af055fd360a70a77d6ef036bbeb91dcc945))
+
+## [0.42.0](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.41.3...ecosystem-v0.42.0) (2026-08-18)
+
+
+### Features
+
+* **cartographer:** narrow an audit by finding type or subtree :mag: ([#177](https://github.com/onlooker-community/ecosystem/issues/177)) ([94764df](https://github.com/onlooker-community/ecosystem/commit/94764dfc8386521a06c8234bc506cb51a667588d))
+
+
+### Bug Fixes
+
+* **librarian:** put budget skips on the bus at last :satellite: ([#180](https://github.com/onlooker-community/ecosystem/issues/180)) ([bc91749](https://github.com/onlooker-community/ecosystem/commit/bc917495dab053cba825ea28ccdd1993fdacb3e9))
+* **librarian:** stop stage 5 from holding a session open :hourglass: ([#178](https://github.com/onlooker-community/ecosystem/issues/178)) ([4f12a1e](https://github.com/onlooker-community/ecosystem/commit/4f12a1ee25300e0dc372542814e0922df5dbd335))
+
+## [0.41.3](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.41.2...ecosystem-v0.41.3) (2026-08-17)
+
+
+### Bug Fixes
+
+* **cartographer:** make the audit read the settings you gave it :gear: ([#174](https://github.com/onlooker-community/ecosystem/issues/174)) ([dc57731](https://github.com/onlooker-community/ecosystem/commit/dc5773165fe561f77e87101ed1fbe6e13bb34c34))
+* **release:** drop git config --global and switch to GITHUB_TOKEN with id-token:write ([#175](https://github.com/onlooker-community/ecosystem/issues/175)) ([b70668b](https://github.com/onlooker-community/ecosystem/commit/b70668b90cff7d33e012363ede673b0c3e9da29f))
+
+## [0.41.2](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.41.1...ecosystem-v0.41.2) (2026-08-17)
+
+
+### Bug Fixes
+
+* **cartographer:** let a finding you fixed finally go away :wastebasket: ([#172](https://github.com/onlooker-community/ecosystem/issues/172)) ([c8fdcf4](https://github.com/onlooker-community/ecosystem/commit/c8fdcf40b711b68ee5d90e2c4b6408ea38926900))
+
+## [0.41.1](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.41.0...ecosystem-v0.41.1) (2026-08-17)
+
+
+### Bug Fixes
+
+* **cartographer:** put its events on the bus for the first time :mega: ([#170](https://github.com/onlooker-community/ecosystem/issues/170)) ([91be8d2](https://github.com/onlooker-community/ecosystem/commit/91be8d2c9f171006db12842f3e582d001f9d4e27))
+
+## [0.41.0](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.40.8...ecosystem-v0.41.0) (2026-08-16)
+
+
+### Features
+
+* **cartographer:** detect what no instruction file mentions :eyes: ([#168](https://github.com/onlooker-community/ecosystem/issues/168)) ([31efb7b](https://github.com/onlooker-community/ecosystem/commit/31efb7b035665d5a49a37c1e1af21f519850f7bd))
+
+## [0.40.8](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.40.7...ecosystem-v0.40.8) (2026-08-16)
+
+
+### Bug Fixes
+
+* **tribunal:** let every blocking arm name the floor it tripped over :label: ([#166](https://github.com/onlooker-community/ecosystem/issues/166)) ([1819b5f](https://github.com/onlooker-community/ecosystem/commit/1819b5f7ad0348584bcb0e72e28c9af153ba3a4d))
+
+## [0.40.7](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.40.6...ecosystem-v0.40.7) (2026-08-16)
+
+
+### Bug Fixes
+
+* **tribunal:** stop a low criterion from hiding why the panel failed :arrows_counterclockwise: ([#164](https://github.com/onlooker-community/ecosystem/issues/164)) ([a3ec128](https://github.com/onlooker-community/ecosystem/commit/a3ec128f1e2e723e02396580b9ffbcff26f0787f))
+
+## [0.40.6](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.40.5...ecosystem-v0.40.6) (2026-08-16)
+
+
+### Bug Fixes
+
+* **tribunal:** a floor you cannot read is a floor you cannot clear :lock: ([#162](https://github.com/onlooker-community/ecosystem/issues/162)) ([4ff2ec0](https://github.com/onlooker-community/ecosystem/commit/4ff2ec0f772af51ad4b5ea631ae2d3c68d229499))
+
+## [0.40.5](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.40.4...ecosystem-v0.40.5) (2026-08-16)
+
+
+### Bug Fixes
+
+* **tribunal:** refuse a score that is not on the scale it claims :straight_ruler: ([#160](https://github.com/onlooker-community/ecosystem/issues/160)) ([bab2855](https://github.com/onlooker-community/ecosystem/commit/bab28558a68402c1dd67623f469467fd99302ba6))
+
+## [0.40.4](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.40.3...ecosystem-v0.40.4) (2026-08-16)
+
+
+### Bug Fixes
+
+* **tribunal:** stop a verdict nobody scored from voting to approve :no_entry: ([#158](https://github.com/onlooker-community/ecosystem/issues/158)) ([1d6c2dc](https://github.com/onlooker-community/ecosystem/commit/1d6c2dc9c8f5833891732dc7e6637c496ba81f6f))
+
+## [0.40.3](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.40.2...ecosystem-v0.40.3) (2026-08-15)
+
+
+### Bug Fixes
+
+* **librarian:** make proposals the sole dedup source, and say so :broom: ([#156](https://github.com/onlooker-community/ecosystem/issues/156)) ([729d9ea](https://github.com/onlooker-community/ecosystem/commit/729d9ea3e328c2734712cfc5adf556c6798334aa))
+
+## [0.40.2](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.40.1...ecosystem-v0.40.2) (2026-08-15)
+
+
+### Bug Fixes
+
+* **tribunal:** drop scoreless verdicts instead of averaging them in :bug: ([#154](https://github.com/onlooker-community/ecosystem/issues/154)) ([f546757](https://github.com/onlooker-community/ecosystem/commit/f5467574f08094b0369f0bd699983cb41ded2cc3))
+
+## [0.40.1](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.40.0...ecosystem-v0.40.1) (2026-08-15)
+
+
+### Bug Fixes
+
+* **tribunal:** close two ways a criterion floor could still be escaped :relieved: ([#152](https://github.com/onlooker-community/ecosystem/issues/152)) ([5b2ddee](https://github.com/onlooker-community/ecosystem/commit/5b2ddee8a787ba0f3e8656a6522b12f348f74859))
+
+## [0.40.0](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.39.1...ecosystem-v0.40.0) (2026-08-15)
+
+
+### Features
+
+* **tribunal,librarian:** make rubric weights and min_pass floors real :straight_ruler: ([#150](https://github.com/onlooker-community/ecosystem/issues/150)) ([f8f8e28](https://github.com/onlooker-community/ecosystem/commit/f8f8e28b60f6d13d5a2a54e26ca284137b77f99a))
+
+## [0.39.1](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.39.0...ecosystem-v0.39.1) (2026-08-14)
+
+
+### Bug Fixes
+
+* **librarian:** close four follow-up defects from the promotion epic :broom: ([#148](https://github.com/onlooker-community/ecosystem/issues/148)) ([895df74](https://github.com/onlooker-community/ecosystem/commit/895df7430fa8ba75976d38964d061c21bff785d3))
+
+## [0.39.0](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.38.0...ecosystem-v0.39.0) (2026-08-13)
+
+
+### Features
+
+* **librarian:** land judged lessons in the approved pool :package: ([#146](https://github.com/onlooker-community/ecosystem/issues/146)) ([f7adc72](https://github.com/onlooker-community/ecosystem/commit/f7adc7263a985d4cb7695b46d6f9dbab77dce587))
+
+## [0.38.0](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.37.0...ecosystem-v0.38.0) (2026-08-13)
+
+
+### Features
+
+* **librarian:** derive an author identity that cannot be linked across scopes :closed_lock_with_key: ([#144](https://github.com/onlooker-community/ecosystem/issues/144)) ([29b3042](https://github.com/onlooker-community/ecosystem/commit/29b3042ef6cd6e7582206cfea6fcf37ebe661021))
+
+## [0.37.0](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.36.0...ecosystem-v0.37.0) (2026-08-12)
+
+
+### Features
+
+* **librarian:** judge lessons before they leave the machine :balance_scale: ([#142](https://github.com/onlooker-community/ecosystem/issues/142)) ([a877527](https://github.com/onlooker-community/ecosystem/commit/a87752714961613b6b2bb768239c666f78d950f8))
+
+## [0.36.0](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.35.0...ecosystem-v0.36.0) (2026-08-11)
+
+
+### Features
+
+* **librarian:** let a human take back a lesson confirmation :leftwards_arrow_with_hook: ([#139](https://github.com/onlooker-community/ecosystem/issues/139)) ([a4c4ac8](https://github.com/onlooker-community/ecosystem/commit/a4c4ac8ed5b79f5596f4e22abd1d23a8b0d3e834))
+
+## [0.35.0](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.34.1...ecosystem-v0.35.0) (2026-08-11)
+
+
+### Features
+
+* **librarian:** let a human decide what leaves the machine :raised_hand: ([#137](https://github.com/onlooker-community/ecosystem/issues/137)) ([16d7673](https://github.com/onlooker-community/ecosystem/commit/16d76734833aee9c8818f84c1c1f704be4cdfc33))
+
+## [0.34.1](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.34.0...ecosystem-v0.34.1) (2026-08-10)
+
+
+### Bug Fixes
+
+* make the local bats suite tell the truth :mag: ([#135](https://github.com/onlooker-community/ecosystem/issues/135)) ([f0763e0](https://github.com/onlooker-community/ecosystem/commit/f0763e09f3caf2d39c89f28befd12567af0af845))
+
 ## [0.34.0](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.33.1...ecosystem-v0.34.0) (2026-08-09)
 
 

package/CLAUDE.md

@@ -44,6 +44,11 @@ scripts/lib/onlooker-event.mjs  ← canonical event builder; all plugins route t
 | bursar | SessionStart, SessionEnd | Rolls each session's spend into a per-project ledger on SessionEnd; surfaces "this project burned $X this week" at SessionStart. Governor is per-session; bursar is the cross-session rollup |
 | lineage | PostToolUse (Edit, Write, MultiEdit) + skill invocation | Records per-change provenance (session_id/turn + redacted, size-capped snippets) into a per-project ledger; `/lineage <file>:<line>` answers "why does this line exist?" by joining records to historian transcripts to recover prompt context |
 | inspector | PostToolUse (Write, Edit, MultiEdit) | Per-edit verification: runs the project's configured lint + typecheck commands on just the touched file and emits `inspector.check.*` / `inspector.run.completed`. Surfaces issues to the agent for the next turn. Cheaper than the planned proctor (which runs the full project verify at Stop); complements assayer (which catches claims the agent makes without running anything) |
+| librarian | SessionEnd, SessionStart + skill invocation | Consolidation layer between archivist's per-session artifacts and the user's durable typed memory store. At SessionEnd, decides which decisions/dead-ends deserve to outlive the session, classifies them into user/feedback/project/reference, and queues them as proposals; at SessionStart, surfaces a one-line pointer to the queue. Propose-only (its ADR-001) — auto-promotion is opt-in. Also owns the lesson-promotion pipeline under `lessons/`, walked via `/librarian lessons` |
+| historian | SessionEnd, UserPromptSubmit | Episodic memory. Chunks and sanitizes the transcript at SessionEnd into `$ONLOOKER_DIR/historian/<project-key>/sessions/`; on UserPromptSubmit, embeds the prompt and retrieves similar past chunks. Lineage joins these transcripts to recover the prompt context behind a change |
+| counsel | SessionStart + skill invocation | Weekly synthesis across every plugin's event log. Produces a structured improvement brief and injects it at SessionStart when the last one is stale; `/counsel` on demand |
+| curator | SessionStart | Maintenance for the typed auto-memory store. Runs four cheap heuristic checks (date_decayed, path_broken, broken_index, orphaned_memory) inside a wall-clock budget and surfaces findings as a one-line pointer. Never edits the memory store directly. The `/curator review` walkthrough and the LLM contradiction sweep are both deferred — see the plugin's README |
+| scribe | SessionStart, UserPromptSubmit, Stop | Intent documentation from agent activity: captures why changes were made — problem context, decisions, tradeoffs — and distills them into readable artifacts at session end |
 
 Plugins communicate by emitting events to the JSONL log — they do not call each other directly. All plugins depend on the ecosystem substrate; no plugin depends on another plugin directly.
 

package/docs/lesson-promotion-pipeline.md

@@ -175,9 +175,9 @@ From [CLAUDE.md](../CLAUDE.md) — these differ from the onlooker repo:
 - **Event names** follow `<plugin>.<noun>.<verb>`. Likely additions here:
   `librarian.lesson.proposed`, `librarian.lesson.approved`,
   `librarian.lesson.declined`, `tribunal.lesson.judged`.
-- **ULIDs, not UUIDs**, and each plugin ships its own helper. Librarian will need
-  one for lesson ids if it does not have one — copy
-  `plugins/tribunal/scripts/lib/tribunal-ulid.sh` and rename the prefix.
+- **ULIDs, not UUIDs**, and each plugin ships its own helper. Librarian already
+  has one — `plugins/librarian/scripts/lib/librarian-ulid.sh`, exposing
+  `librarian_ulid`. Use it for lesson ids rather than adding a second generator.
 - **Config defaults** live in the plugin's `config.json`; user overrides go under
   the plugin's namespace key in settings. See ADR-004.
 
@@ -201,9 +201,9 @@ what still needs independent judging.
 - **Where the human confirmation surfaces.** Librarian already has a proposal
   queue and a SessionStart surfacer for memory promotions. Reuse it, or keep
   lesson proposals separate so the two kinds of confirmation are not confused?
-- **`author_key` derivation.** The contract pins the format — 32 hex,
-  `HMAC(user_secret, scope)` — but nothing derives it yet. Where does
-  `user_secret` live, and how is it created on first use?
+- **`author_key` derivation.** Resolved: `user_secret` lives at
+  `$ONLOOKER_DIR/author/user_secret`, created on first use, never
+  project-keyed. See `docs/superpowers/specs/2026-08-12-author-key-design.md`.
 - **Whether the transform self-validates** against the published JSON Schema
   before writing to the pool, or leaves all validation to ingest. Validating
   locally catches a bad transform earlier; it also means fetching and caching