@onlooker-community/ecosystem 0.43.4 → 0.43.5

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ecosystem",
-  "version": "0.43.4",
+  "version": "0.43.5",
   "description": "Observability substrate for Claude Code. Provides the shared $ONLOOKER_DIR storage root (default $HOME/.onlooker), canonical schema-validated event emission, session and tool tracking hooks, and prompt rules. Required by all other Onlooker plugins.",
   "author": {
     "name": "Onlooker Community",

package/.release-please-manifest.json

@@ -1,19 +1,19 @@
 {
-  ".": "0.43.4",
-  "plugins/archivist": "0.3.1",
-  "plugins/tribunal": "1.2.7",
-  "plugins/echo": "0.3.1",
-  "plugins/cartographer": "0.6.0",
-  "plugins/governor": "0.3.2",
-  "plugins/compass": "0.4.1",
-  "plugins/scribe": "0.4.2",
-  "plugins/counsel": "0.5.1",
-  "plugins/warden": "0.3.1",
-  "plugins/librarian": "0.13.2",
-  "plugins/curator": "0.2.3",
-  "plugins/historian": "0.3.3",
-  "plugins/assayer": "1.1.3",
-  "plugins/bursar": "0.3.0",
-  "plugins/lineage": "0.2.2",
-  "plugins/inspector": "0.3.2"
+  ".": "0.43.5",
+  "plugins/archivist": "0.3.2",
+  "plugins/tribunal": "1.2.8",
+  "plugins/echo": "0.3.2",
+  "plugins/cartographer": "0.6.1",
+  "plugins/governor": "0.3.3",
+  "plugins/compass": "0.4.2",
+  "plugins/scribe": "0.4.3",
+  "plugins/counsel": "0.5.2",
+  "plugins/warden": "0.3.2",
+  "plugins/librarian": "0.13.3",
+  "plugins/curator": "0.2.4",
+  "plugins/historian": "0.3.4",
+  "plugins/assayer": "1.1.4",
+  "plugins/bursar": "0.3.1",
+  "plugins/lineage": "0.2.3",
+  "plugins/inspector": "0.3.3"
 }

package/AGENTS.md

@@ -136,6 +136,11 @@ See `plugins/compass/docs/adr/001-evaluate-prompts-in-context.md` for the full d
    a test drives the branch that emits it, `excluded` with a reason when not.
    `npm run test:bus` fails on any registered type that appears in neither list.
 7. Fail-soft when `~/.onlooker/` is absent — plugins must not block a session they were not invited to.
+8. In `plugins/<name>/scripts/lib/<name>-config.sh`, locate `config-loader.sh` from the file's own
+   `${BASH_SOURCE[0]}`, never from a caller-supplied `$PLUGIN_ROOT`. That variable is read at source
+   time from whatever scope did the sourcing, so a sub-shell that inherits `CLAUDE_PLUGIN_ROOT` but not
+   `PLUGIN_ROOT` loses every accessor while still exiting 0 — config silently falls back to defaults.
+   `test/bats/config-lib-self-locating.bats` enforces this across every plugin.
 
 ## Development
 

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.43.5](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.43.4...ecosystem-v0.43.5) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+* **librarian:** key the declined-ledger guard on the proposal, not the artifact :bug: ([#199](https://github.com/onlooker-community/ecosystem/issues/199)) ([47a195d](https://github.com/onlooker-community/ecosystem/commit/47a195da98a3a565018c35e9e5c6dde2405520de))
+
 ## [0.43.4](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.43.3...ecosystem-v0.43.4) (2026-08-22)
 
 

package/CLAUDE.md

@@ -83,6 +83,11 @@ See `plugins/compass/docs/adr/001-evaluate-prompts-in-context.md` for the full d
    a test drives the branch that emits it, `excluded` with a reason when not.
    `npm run test:bus` fails on any registered type that appears in neither list.
 7. Fail-soft when `~/.onlooker/` is absent — plugins must not block a session they were not invited to.
+8. In `plugins/<name>/scripts/lib/<name>-config.sh`, locate `config-loader.sh` from the file's own
+   `${BASH_SOURCE[0]}`, never from a caller-supplied `$PLUGIN_ROOT`. That variable is read at source
+   time from whatever scope did the sourcing, so a sub-shell that inherits `CLAUDE_PLUGIN_ROOT` but not
+   `PLUGIN_ROOT` loses every accessor while still exiting 0 — config silently falls back to defaults.
+   `test/bats/config-lib-self-locating.bats` enforces this across every plugin.
 
 ## Development
 

package/docs/lesson-promotion-pipeline.md

@@ -153,7 +153,7 @@ a floor a strong weighted mean cannot average away.
 ```
 ~/.onlooker/librarian/<project-key>/
   lessons/approved/<ulid>.json   jury passed; awaiting sync
-  lessons/declined.jsonl         artifact_id + verdict + reason
+  lessons/declined.jsonl         artifact_id + lesson_id + verdict + reason
 ```
 
 The declined ledger matters more than it looks. The watermark advances past a
@@ -161,6 +161,14 @@ rejected artifact, so without a record a drop is either silently permanent or
 on a rescan — re-pays Opus tokens to re-judge the same failures every session.
 Append-only, never re-judged automatically.
 
+`lesson_id` names the proposal a verdict came from, and is null when there is
+none — the transform declines an artifact before any proposal exists. Promote's
+double-write guard keys on it so two distinct proposals that share an
+artifact_id each get their own row; keyed on artifact_id it dropped the second
+verdict silently. `librarian_lesson_seen` deliberately stays keyed on
+artifact_id, because it asks a different question: was this *artifact* already
+handled?
+
 **"Judged and failed" is not "could not judge."** Only real verdicts go in
 `declined.jsonl`. A tribunal API error, or a jury below quorum, leaves the
 candidate in proposals untouched. Conflating them lets one transient outage

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlooker-community/ecosystem",
-  "version": "0.43.4",
+  "version": "0.43.5",
   "description": "Agents, skills, hooks, commands, rules, and MCP configurations that power [Onlooker](https://onlooker.dev)",
   "author": {
     "name": "Onlooker Community",

package/plugins/archivist/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "archivist",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Structured session memory across context truncation: extracts decisions, dead ends, and open questions on PreCompact and reinjects the most important items at SessionStart. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/archivist/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.3.2](https://github.com/onlooker-community/ecosystem/compare/archivist-v0.3.1...archivist-v0.3.2) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.3.1](https://github.com/onlooker-community/ecosystem/compare/archivist-v0.3.0...archivist-v0.3.1) (2026-08-01)
 
 

package/plugins/archivist/scripts/lib/archivist-config.sh

@@ -15,8 +15,12 @@
 # Settings overlay only touches the `archivist.*` subtree of settings.json so it
 # coexists with other plugins' configuration.
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_ARCHIVIST_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_ARCHIVIST_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _ARCHIVIST_CONFIG="{}"
 

package/plugins/assayer/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "assayer",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "Claim verification. At session end, parses the agent's final message for testable claims (\"I ran the tests, they pass\", \"the build is green\") and checks each against the actual command results in the session transcript, classifying it corroborated, contradicted, or unverifiable. Catches lying-without-malice. Advisory by default. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/assayer/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.1.4](https://github.com/onlooker-community/ecosystem/compare/assayer-v1.1.3...assayer-v1.1.4) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [1.1.3](https://github.com/onlooker-community/ecosystem/compare/assayer-v1.1.2...assayer-v1.1.3) (2026-08-10)
 
 

package/plugins/assayer/scripts/lib/assayer-config.sh

@@ -13,8 +13,12 @@
 #   assayer_config_get <jq-path>       # echoes string value (empty if unset)
 #   assayer_config_get_json <jq-path>  # echoes JSON value (null if unset)
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_ASSAYER_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_ASSAYER_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _assayer_CONFIG="{}"
 

package/plugins/bursar/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bursar",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Multi-session, per-project budget accounting for the Onlooker ecosystem. Rolls each session's spend into a per-project ledger on SessionEnd and surfaces \"this project burned $X this week\" at SessionStart. Where governor regulates a single session, bursar is the cross-session rollup: it reads governor.session.complete off the shared event bus and emits bursar.* events for audit. Named for the officer who keeps the accounts. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/bursar/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.3.1](https://github.com/onlooker-community/ecosystem/compare/bursar-v0.3.0...bursar-v0.3.1) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.3.0](https://github.com/onlooker-community/ecosystem/compare/bursar-v0.2.2...bursar-v0.3.0) (2026-08-02)
 
 

package/plugins/bursar/scripts/lib/bursar-config.sh

@@ -16,8 +16,12 @@
 #   bursar_config_surface_enabled      # 0 if bursar.surface_at_session_start is true
 #   bursar_config_week_start           # echoes "monday" or "sunday"
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_BURSAR_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_BURSAR_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _BURSAR_CONFIG="{}"
 

package/plugins/cartographer/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cartographer",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Proactive periodic auditor of the persistent instruction layer (CLAUDE.md, AGENTS.md, .claude/rules/). Discovers all instruction files in the repo, extracts semantic maps, and surfaces contradictions, shadowing, gaps, and drift before they cause expensive agent misbehavior. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/cartographer/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to the Cartographer plugin are documented here.
 
+## [0.6.1](https://github.com/onlooker-community/ecosystem/compare/cartographer-v0.6.0...cartographer-v0.6.1) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.6.0](https://github.com/onlooker-community/ecosystem/compare/cartographer-v0.5.1...cartographer-v0.6.0) (2026-08-19)
 
 

package/plugins/cartographer/scripts/lib/cartographer-config.sh

@@ -12,8 +12,12 @@
 #   cartographer_config_load <repo_root>
 #   cartographer_config_get_json ".cartographer.exclude_paths"
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_CARTOGRAPHER_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_CARTOGRAPHER_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _CARTOGRAPHER_CONFIG=""
 

package/plugins/compass/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "compass",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Pre-write intent clarity gate. Intercepts write-class tool calls and requires a confidence threshold before allowing them to proceed. Evaluates the pending write against the prior assistant turn as context to avoid false positives on question-answer turns. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/compass/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.4.2](https://github.com/onlooker-community/ecosystem/compare/compass-v0.4.1...compass-v0.4.2) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.4.1](https://github.com/onlooker-community/ecosystem/compare/compass-v0.4.0...compass-v0.4.1) (2026-08-01)
 
 

package/plugins/compass/scripts/lib/compass-config.sh

@@ -13,8 +13,12 @@
 #   compass_config_get <jq-path>       # echoes string value (empty if unset)
 #   compass_config_get_json <jq-path>  # echoes JSON value (null if unset)
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_COMPASS_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_COMPASS_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _compass_CONFIG="{}"
 

package/plugins/counsel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "counsel",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Weekly synthesis and recommendations from the full observability stack. Reads all plugin event logs, produces a structured improvement brief, and injects it at session start when the last brief is stale.",
   "author": {
     "name": "Onlooker Community",

package/plugins/counsel/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.5.2](https://github.com/onlooker-community/ecosystem/compare/counsel-v0.5.1...counsel-v0.5.2) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.5.1](https://github.com/onlooker-community/ecosystem/compare/counsel-v0.5.0...counsel-v0.5.1) (2026-08-01)
 
 

package/plugins/counsel/scripts/lib/counsel-config.sh

@@ -13,8 +13,12 @@
 #   counsel_config_get <jq-path>       # echoes string value (empty if unset)
 #   counsel_config_get_json <jq-path>  # echoes JSON value (null if unset)
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_COUNSEL_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_COUNSEL_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _counsel_CONFIG="{}"
 

package/plugins/curator/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "curator",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Maintenance layer for the user's typed auto-memory store. At every SessionStart, runs four cheap heuristic checks (date_decayed, path_broken, broken_index, orphaned_memory) against the memories at ~/.claude/projects/<encoded>/memory/ inside a wall-clock budget. Surfaces findings as a one-line pointer to /curator review; never edits the memory store directly. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/curator/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.2.4](https://github.com/onlooker-community/ecosystem/compare/curator-v0.2.3...curator-v0.2.4) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.2.3](https://github.com/onlooker-community/ecosystem/compare/curator-v0.2.2...curator-v0.2.3) (2026-08-10)
 
 

package/plugins/curator/scripts/lib/curator-config.sh

@@ -13,8 +13,12 @@
 #   curator_config_get <jq-path>       # echoes string value (empty if unset)
 #   curator_config_get_json <jq-path>  # echoes JSON value (null if unset)
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_CURATOR_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_CURATOR_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _curator_CONFIG="{}"
 

package/plugins/echo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "echo",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Prompt-change regression detection. When a watched agent file is modified, Echo runs a single-judge quality pass via claude -p and compares the score against a stored baseline to report improved, degraded, or neutral. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/echo/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.3.2](https://github.com/onlooker-community/ecosystem/compare/echo-v0.3.1...echo-v0.3.2) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.3.1](https://github.com/onlooker-community/ecosystem/compare/echo-v0.3.0...echo-v0.3.1) (2026-08-01)
 
 

package/plugins/echo/scripts/lib/echo-config.sh

@@ -13,8 +13,12 @@
 #   echo_config_get <jq-path>       # echoes string value (empty if unset)
 #   echo_config_get_json <jq-path>  # echoes JSON value (null if unset)
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_ECHO_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_ECHO_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _echo_CONFIG="{}"
 

package/plugins/governor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "governor",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Resource governance and budget enforcement for the Onlooker ecosystem. Tracks per-session token and cost spend, gates Task spawns before they exceed a configurable budget ceiling, and emits governor.* events for audit. Named for the steam-engine governor — a device that regulates output. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/governor/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.3.3](https://github.com/onlooker-community/ecosystem/compare/governor-v0.3.2...governor-v0.3.3) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.3.2](https://github.com/onlooker-community/ecosystem/compare/governor-v0.3.1...governor-v0.3.2) (2026-08-02)
 
 

package/plugins/governor/scripts/lib/governor-config.sh

@@ -14,8 +14,12 @@
 #   governor_config_get_json <jq-path>   # echoes JSON value (null if unset)
 #   governor_config_enforcement          # echoes "soft" or "hard"
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_GOVERNOR_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_GOVERNOR_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _GOVERNOR_CONFIG="{}"
 

package/plugins/historian/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "historian",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Episodic memory layer. At SessionEnd, chunks and sanitizes the session transcript and stores chunks under $ONLOOKER_DIR/historian/<project-key>/sessions/ (default $HOME/.onlooker). On UserPromptSubmit, embeds the prompt and performs similarity retrieval over stored chunks to surface relevant past context. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/historian/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.3.4](https://github.com/onlooker-community/ecosystem/compare/historian-v0.3.3...historian-v0.3.4) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.3.3](https://github.com/onlooker-community/ecosystem/compare/historian-v0.3.2...historian-v0.3.3) (2026-08-10)
 
 

package/plugins/historian/scripts/lib/historian-config.sh

@@ -14,8 +14,12 @@
 #
 # Settings overlay only touches the `historian.*` subtree of settings.json.
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_HISTORIAN_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_HISTORIAN_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _HISTORIAN_CONFIG="{}"
 

package/plugins/inspector/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "inspector",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Per-edit lint and typecheck gate. Runs the project's configured checks on just the touched file after every Write / Edit / MultiEdit, so the agent sees its own type errors before claiming success. Cheaper than proctor (which runs project-wide verification at Stop); complements assayer (which catches the agent lying about claims). Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/inspector/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.3.3](https://github.com/onlooker-community/ecosystem/compare/inspector-v0.3.2...inspector-v0.3.3) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.3.2](https://github.com/onlooker-community/ecosystem/compare/inspector-v0.3.1...inspector-v0.3.2) (2026-08-02)
 
 

package/plugins/inspector/scripts/lib/inspector-config.sh

@@ -13,8 +13,12 @@
 #   inspector_config_get <jq-path>       # echoes string value (empty if unset)
 #   inspector_config_get_json <jq-path>  # echoes JSON value (null if unset)
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_INSPECTOR_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_INSPECTOR_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _inspector_CONFIG="{}"
 

package/plugins/librarian/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "librarian",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Consolidation layer between archivist's per-session artifacts and the user's durable typed memory store. Detects which session decisions, dead-ends, and open questions deserve to live across sessions, classifies them into the user/feedback/project/reference types, and queues them as proposals for explicit confirmation. Auto-promotion is opt-in. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/librarian/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.13.3](https://github.com/onlooker-community/ecosystem/compare/librarian-v0.13.2...librarian-v0.13.3) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+* **librarian:** key the declined-ledger guard on the proposal, not the artifact :bug: ([#199](https://github.com/onlooker-community/ecosystem/issues/199)) ([47a195d](https://github.com/onlooker-community/ecosystem/commit/47a195da98a3a565018c35e9e5c6dde2405520de))
+
 ## [0.13.2](https://github.com/onlooker-community/ecosystem/compare/librarian-v0.13.1...librarian-v0.13.2) (2026-08-18)
 
 

package/plugins/librarian/scripts/lib/librarian-config.sh

@@ -16,8 +16,12 @@
 # Settings overlay only touches the `librarian.*` subtree of settings.json so
 # it coexists with other plugins' configuration.
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_LIBRARIAN_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_LIBRARIAN_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _LIBRARIAN_CONFIG="{}"
 

package/plugins/librarian/scripts/lib/librarian-lesson-promote.sh

@@ -183,19 +183,39 @@ librarian_lesson_promote() {
 		# declined.jsonl, double-counting a rejected artifact in the
 		# rubric-tuning signal the ledger exists to carry.
 		#
+		# Keyed on lesson_id, not artifact_id. The approved branch's guard is
+		# approved/<lesson_id>.json — per-proposal by construction — and this
+		# one has to match it. Keyed on artifact_id it could not tell "this
+		# artifact was already declined" from "a DIFFERENT proposal for the
+		# same artifact was already declined", so the second of two colliding
+		# proposals skipped its append and returned 0: both stamped, one
+		# verdict on disk. That is the inverse of the double-write this guard
+		# exists to stop, and still loses the per-judge detail (ecosystem-bkj).
+		#
+		# The artifact_id clause is the fallback for rows that legitimately
+		# carry no lesson_id: those written before this change, and those the
+		# transform writes for an artifact rejected before any proposal
+		# existed. Dropping it would leave an unstamped pre-change proposal
+		# double-writing on re-run — trading this bug for the older one.
+		#
 		# Same scan shape as librarian_lesson_seen: -R/fromjson? survives a
 		# truncated trailing line from a process killed mid-append, and
 		# `objects` stops a valid-but-non-object line from erroring the whole
 		# invocation.
 		already_declined=false
 		if [[ -f "$declined_path" ]] \
-			&& jq -Re --arg a "$artifact_id" 'fromjson? | objects | select(.artifact_id == $a)' \
+			&& jq -Re --arg a "$artifact_id" --arg l "$lesson_id" \
+				'fromjson? | objects
+				 | select(
+				     ($l != "" and .lesson_id == $l)
+				     or ((.lesson_id // null) == null and .artifact_id == $a)
+				   )' \
 				"$declined_path" >/dev/null 2>&1; then
 			already_declined=true
 		fi
 
 		if [[ "$already_declined" == false ]]; then
-			librarian_lesson_append_declined "$key" "$artifact_id" "$reason" "" "$verdict" || {
+			librarian_lesson_append_declined "$key" "$artifact_id" "$reason" "" "$verdict" "$lesson_id" || {
 				printf 'Lesson %s: cannot append to the declined ledger.\n' "$lesson_id" >&2
 				return 1
 			}

package/plugins/librarian/scripts/lib/librarian-lesson-storage.sh

@@ -83,13 +83,27 @@ librarian_lesson_write_proposal() {
 # written by the transform have no verdict and simply lack the key — a format
 # failure has no jury.
 #
-# Usage: librarian_lesson_append_declined <key> <artifact_id> <reason> [detail] [verdict_json]
+# `lesson_id` names the PROPOSAL this verdict came from, and is null when there
+# is no proposal to name. The transform declines an artifact before any proposal
+# exists (transform_invalid, schema_invalid, and friends), so its rows carry
+# null here and are identified by artifact_id alone.
+#
+# It exists so promote's double-write guard can key on the proposal rather than
+# the artifact. Keyed on artifact_id, that guard could not tell "this artifact
+# was already declined" from "a DIFFERENT proposal for the same artifact was
+# already declined", and silently dropped the second verdict — see
+# ecosystem-bkj. Note this is the opposite of what librarian_lesson_seen wants:
+# that function asks "was this ARTIFACT already handled?" and correctly stays
+# keyed on artifact_id.
+#
+# Usage: librarian_lesson_append_declined <key> <artifact_id> <reason> [detail] [verdict_json] [lesson_id]
 librarian_lesson_append_declined() {
 	local key="$1"
 	local artifact_id="$2"
 	local reason="$3"
 	local detail="${4:-}"
 	local verdict="${5:-}"
+	local lesson_id="${6:-}"
 	[[ -z "$key" || -z "$artifact_id" || -z "$reason" ]] && return 1
 
 	librarian_lesson_storage_init "$key" || return 1
@@ -99,12 +113,14 @@ librarian_lesson_append_declined() {
 	if [[ -n "$verdict" ]]; then
 		line=$(jq -cn \
 			--arg artifact_id "$artifact_id" \
+			--arg lesson_id "$lesson_id" \
 			--arg reason "$reason" \
 			--arg detail "$detail" \
 			--arg at "$now" \
 			--argjson verdict "$verdict" \
 			'{
 				artifact_id: $artifact_id,
+				lesson_id: (if $lesson_id == "" then null else $lesson_id end),
 				reason: $reason,
 				detail: (if $detail == "" then null else $detail end),
 				declined_at: $at,
@@ -113,11 +129,13 @@ librarian_lesson_append_declined() {
 	else
 		line=$(jq -cn \
 			--arg artifact_id "$artifact_id" \
+			--arg lesson_id "$lesson_id" \
 			--arg reason "$reason" \
 			--arg detail "$detail" \
 			--arg at "$now" \
 			'{
 				artifact_id: $artifact_id,
+				lesson_id: (if $lesson_id == "" then null else $lesson_id end),
 				reason: $reason,
 				detail: (if $detail == "" then null else $detail end),
 				declined_at: $at

package/plugins/lineage/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lineage",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Per-change provenance for the Onlooker ecosystem. Records session/turn metadata plus a secret-redacted, size-capped snippet for every Edit/Write/MultiEdit at PostToolUse, then answers \"why does this line exist?\" via /lineage by joining change records to historian-preserved transcripts. Emits lineage.* events for audit. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/lineage/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.2.3](https://github.com/onlooker-community/ecosystem/compare/lineage-v0.2.2...lineage-v0.2.3) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.2.2](https://github.com/onlooker-community/ecosystem/compare/lineage-v0.2.1...lineage-v0.2.2) (2026-08-02)
 
 

package/plugins/lineage/scripts/lib/lineage-config.sh

@@ -13,8 +13,12 @@
 #   lineage_config_get <jq-path>       # echoes string value (empty if unset)
 #   lineage_config_get_json <jq-path>  # echoes JSON value (null if unset)
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_LINEAGE_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_LINEAGE_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _lineage_CONFIG="{}"
 

package/plugins/scribe/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "scribe",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Intent documentation from agent activity. Captures why changes were made — problem context, decisions, tradeoffs — and distills them into readable artifacts at session end.",
   "author": {
     "name": "Onlooker Community",

package/plugins/scribe/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.4.3](https://github.com/onlooker-community/ecosystem/compare/scribe-v0.4.2...scribe-v0.4.3) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.4.2](https://github.com/onlooker-community/ecosystem/compare/scribe-v0.4.1...scribe-v0.4.2) (2026-08-02)
 
 

package/plugins/scribe/scripts/lib/scribe-config.sh

@@ -13,8 +13,12 @@
 #   scribe_config_get <jq-path>       # echoes string value (empty if unset)
 #   scribe_config_get_json <jq-path>  # echoes JSON value (null if unset)
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_SCRIBE_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_SCRIBE_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _scribe_CONFIG="{}"
 

package/plugins/tribunal/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tribunal",
-  "version": "1.2.7",
+  "version": "1.2.8",
   "description": "Multi-agent execution with LLM-as-a-Judge quality gates. An Actor performs work; a jury of typed Judges scores it against a project-overridable rubric; a Meta-Judge reviews the jury for bias; the gate decides accept, retry, or exhaust. Grounded in LLM-as-a-Judge (Zheng et al. 2023) and LLM-as-a-Meta-Judge (Wu et al. 2024). Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/tribunal/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.2.8](https://github.com/onlooker-community/ecosystem/compare/tribunal-v1.2.7...tribunal-v1.2.8) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [1.2.7](https://github.com/onlooker-community/ecosystem/compare/tribunal-v1.2.6...tribunal-v1.2.7) (2026-08-16)
 
 

package/plugins/tribunal/scripts/lib/tribunal-config.sh

@@ -13,8 +13,12 @@
 #   tribunal_config_get <jq-path>       # echoes string value (empty if unset)
 #   tribunal_config_get_json <jq-path>  # echoes JSON value (null if unset)
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_TRIBUNAL_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_TRIBUNAL_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _TRIBUNAL_CONFIG="{}"
 

package/plugins/warden/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "warden",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Untrusted-content gate. Scans content flowing in through WebFetch and Read for prompt-injection patterns, and when a threat is detected closes a session-scoped gate that blocks Write, Edit, and Bash until the user explicitly clears it. Grounded in Meta's Agents Rule of Two: an agent should hold no more than two of {private data, external actions, untrusted content} at once — warden removes the external-actions property while untrusted content is in play. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/warden/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.3.2](https://github.com/onlooker-community/ecosystem/compare/warden-v0.3.1...warden-v0.3.2) (2026-08-22)
+
+
+### Bug Fixes
+
+* **config:** let every config lib find the loader from its own path :broom: ([#198](https://github.com/onlooker-community/ecosystem/issues/198)) ([249fe41](https://github.com/onlooker-community/ecosystem/commit/249fe41bf191db48239c2028ba77a10b3dcb03af))
+
 ## [0.3.1](https://github.com/onlooker-community/ecosystem/compare/warden-v0.3.0...warden-v0.3.1) (2026-08-01)
 
 

package/plugins/warden/scripts/lib/warden-config.sh

@@ -13,8 +13,12 @@
 #   warden_config_get <jq-path>       # echoes string value (empty if unset)
 #   warden_config_get_json <jq-path>  # echoes JSON value (null if unset)
 
-# shellcheck source=../../../scripts/lib/config-loader.sh
-source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+# Resolve the shared loader from this file's own location. $PLUGIN_ROOT is
+# whatever the sourcing scope happened to set, so a sub-shell that inherits
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT would lose every accessor silently.
+_WARDEN_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/config-loader.sh
+source "${_WARDEN_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
 
 _warden_CONFIG="{}"
 

package/scripts/lib/config-loader.sh

@@ -6,8 +6,21 @@
 # across the ecosystem.
 #
 # Usage:
-#   # In your plugin's config loader (e.g., plugins/bursar/scripts/lib/bursar-config.sh):
-#   source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+#   # In your plugin's config loader (e.g., plugins/bursar/scripts/lib/bursar-config.sh).
+#   # Locate this file from the sourcing file's OWN path, never from a
+#   # caller-supplied $PLUGIN_ROOT: that variable is read at source time from
+#   # whatever scope did the sourcing, so a sub-shell that inherits
+#   # CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT loses every accessor below while
+#   # still exiting 0 (see ecosystem-88v, ecosystem-7bj). Four levels up from
+#   # plugins/<name>/scripts/lib is the repo root.
+#   _BURSAR_CONFIG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+#   # shellcheck source=scripts/lib/config-loader.sh
+#   source "${_BURSAR_CONFIG_LIB_DIR}/../../../../scripts/lib/config-loader.sh"
+#
+#   The shellcheck directive is repo-root-relative, not file-relative: shellcheck
+#   resolves source= against its own working directory, and `npm run
+#   test:shellcheck` runs it from the repo root. A file-relative path there
+#   silently degrades to SC1091 "not following", which `-S error` hides.
 #   config_load_plugin "bursar" "$repo_root" "_BURSAR_CONFIG"
 #   config_get "_BURSAR_CONFIG" '.bursar.window'  # returns value or empty string
 #

package/test/bats/config-lib-self-locating.bats

@@ -0,0 +1,124 @@
+#!/usr/bin/env bats
+#
+# Guards that every plugin config lib locates config-loader.sh from its OWN
+# path, not from a caller-supplied $PLUGIN_ROOT.
+#
+# These libs used to open with:
+#
+#   source "${PLUGIN_ROOT}/../../scripts/lib/config-loader.sh"
+#
+# PLUGIN_ROOT is read at source time from whatever scope did the sourcing. From
+# a scope that never set it, the path collapses to
+# /../../scripts/lib/config-loader.sh, the source fails, and config_load_plugin
+# and config_get never get defined. The caller then gets empty strings from
+# every accessor while the script keeps going and exits 0 — the config silently
+# falls back to defaults instead of failing loudly.
+#
+# Cartographer hit exactly this (ecosystem-88v): run-audit.sh and both hooks
+# sourced the config lib inside `bash -c` sub-shells that inherited
+# CLAUDE_PLUGIN_ROOT but not PLUGIN_ROOT. It went unnoticed for months because
+# the analyzers take their settings as positional parameters and kept working.
+#
+# The sweep in ecosystem-7bj made every lib self-locating via BASH_SOURCE, which
+# is correct regardless of caller scope, cwd, or sub-shell nesting. These tests
+# cover all 16 at once so plugin 17 cannot quietly reintroduce the pattern.
+
+setup() {
+  source "${BATS_TEST_DIRNAME}/../helpers/setup.bash"
+  setup_test_env
+}
+
+# Every plugins/<name>/scripts/lib/<name>-config.sh in the repo.
+_config_libs() {
+  find "${REPO_ROOT}/plugins" -path '*/scripts/lib/*-config.sh' -type f | sort
+}
+
+# Without this, a typo in _config_libs would make every test below pass over an
+# empty list and report coverage that does not exist. Not pinned to 16, so
+# adding or removing a plugin does not fail it.
+@test "the config-lib glob matches at least one file" {
+  local count
+  count=$(_config_libs | wc -l | tr -d ' ')
+  [ "$count" -gt 0 ]
+}
+
+@test "no config lib resolves config-loader.sh through \$PLUGIN_ROOT" {
+  local offenders=""
+  local lib
+  while IFS= read -r lib; do
+    if grep -q 'source "\${PLUGIN_ROOT}' "$lib"; then
+      offenders+="${lib#"${REPO_ROOT}/"}"$'\n'
+    fi
+  done < <(_config_libs)
+
+  [ -z "$offenders" ] || {
+    printf 'config libs still sourcing through $PLUGIN_ROOT:\n%s' "$offenders" >&2
+    return 1
+  }
+}
+
+@test "every config lib derives its own directory from BASH_SOURCE" {
+  local missing=""
+  local lib
+  while IFS= read -r lib; do
+    grep -q 'BASH_SOURCE\[0\]' "$lib" || missing+="${lib#"${REPO_ROOT}/"}"$'\n'
+  done < <(_config_libs)
+
+  [ -z "$missing" ] || {
+    printf 'config libs not self-locating via BASH_SOURCE:\n%s' "$missing" >&2
+    return 1
+  }
+}
+
+# The behavioral test the source-text guards above stand in for. Sources each
+# lib in a sub-shell with PLUGIN_ROOT unset and asserts the shared accessors it
+# depends on actually got defined.
+@test "every config lib yields working accessors with PLUGIN_ROOT unset" {
+  local failures=""
+  local lib
+  while IFS= read -r lib; do
+    local plugin_dir plugin_name out
+    plugin_dir="${lib%/scripts/lib/*}"
+    plugin_name="$(basename "$plugin_dir")"
+
+    # CLAUDE_PLUGIN_ROOT is set because config_load_plugin genuinely needs it to
+    # find the plugin's own config.json; PLUGIN_ROOT is deliberately absent,
+    # which is the exact shape of the sub-shell that broke cartographer.
+    out=$(env -u PLUGIN_ROOT CLAUDE_PLUGIN_ROOT="$plugin_dir" HOME="$HOME" \
+      bash -c '
+        set -u
+        source "$1" 2>&1 || exit 1
+        type -t config_load_plugin >/dev/null 2>&1 || { echo "config_load_plugin undefined"; exit 1; }
+        type -t config_get >/dev/null 2>&1 || { echo "config_get undefined"; exit 1; }
+        config_load_plugin "$2" "" _PROBE || { echo "config_load_plugin failed"; exit 1; }
+        # A plugin ships a config.json, so the merged config must be a non-empty
+        # JSON object. "{}" here would mean the load degraded to defaults.
+        printf "%s" "$_PROBE" | jq -e "type == \"object\" and (length > 0)" >/dev/null \
+          || { echo "merged config empty: $_PROBE"; exit 1; }
+      ' _ "$lib" "$plugin_name" 2>&1) \
+      || failures+="${plugin_name}: ${out}"$'\n'
+  done < <(_config_libs)
+
+  [ -z "$failures" ] || {
+    printf 'config libs broken when PLUGIN_ROOT is unset:\n%s' "$failures" >&2
+    return 1
+  }
+}
+
+# Regression guard for the specific reported failure, kept separate so a break
+# names cartographer directly rather than appearing in a list of 16.
+@test "cartographer config survives the sub-shell shape that broke it" {
+  local plugin_dir="${REPO_ROOT}/plugins/cartographer"
+  run env -u PLUGIN_ROOT CLAUDE_PLUGIN_ROOT="$plugin_dir" bash -c '
+    source "'"${plugin_dir}"'/scripts/lib/cartographer-config.sh"
+    cartographer_config_load ""
+    cartographer_config_audit_interval_hours
+  '
+  [ "$status" -eq 0 ] || return 1
+  # The shipped default. Under the old pattern this came back empty, because
+  # the accessor was never defined and the failure was swallowed.
+  [[ -n "$output" ]] || return 1
+  [[ "$output" != *"No such file or directory"* ]] || return 1
+  [[ "$output" != *"command not found"* ]] || return 1
+  [ "$output" -eq "$output" ] 2>/dev/null
+}

package/test/bats/librarian-lesson-promote.bats

@@ -47,14 +47,20 @@ STUB
 _dir() { printf '%s' "$(librarian_lessons_dir "$PROJECT_KEY")"; }
 
 # A judged proposal. $1 = id, $2 = visibility, $3 = status,
-# $4 = verdict judges JSON array.
+# $4 = verdict judges JSON array, $5 = artifact_id (defaults to "art-<id>").
+#
+# $5 exists so a test can seed two DISTINCT proposals that share one
+# artifact_id. The default derives the artifact from the id, which makes that
+# collision unreachable — and the collision is the whole subject of the
+# declined-ledger guard tests below (ecosystem-bkj).
 _seed_judged() {
 	local id="$1" visibility="$2" status="$3" judges="$4"
+	local artifact_id="${5:-art-$1}"
 	local now
 	now=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 	jq -n --arg id "$id" --arg v "$visibility" --arg s "$status" \
-		--arg t "$now" --argjson j "$judges" \
-		'{ id: $id, artifact_id: "art-\($id)", status: $s, visibility: $v,
+		--arg t "$now" --argjson j "$judges" --arg aid "$artifact_id" \
+		'{ id: $id, artifact_id: $aid, status: $s, visibility: $v,
 		   confirmed_at: $t, judged_at: $t,
 		   candidate: { claim: "Prefer jq -c for compact output",
 		                rationale: "Readable diffs",
@@ -550,3 +556,83 @@ _promote_refuses_shape() {
 	[ "$status" -eq 0 ]
 	[ -f "$(_dir)/approved/skill01.json" ]
 }
+
+# ── declined-ledger guard: per-proposal, not per-artifact (ecosystem-bkj) ─────
+#
+# The guard that stops a double-write into declined.jsonl used to key on
+# artifact_id. That cannot tell "this artifact was already declined" apart from
+# "a DIFFERENT proposal for the same artifact was already declined", so the
+# second of two colliding proposals found a matching row, skipped its append,
+# and returned 0 — both proposals stamped, one verdict on disk. The inverse of
+# the double-write the guard exists to prevent, and still data loss in the
+# per-judge detail declined.jsonl carries for rubric tuning.
+#
+# The approved branch never had this: its guard is approved/<lesson_id>.json,
+# which is per-proposal by construction. These tests hold the declined branch
+# to the same standard.
+
+@test "two rejected proposals sharing an artifact_id both reach the ledger" {
+	_seed_judged "dupa" "public" "rejected" "$(_split)" "art-shared"
+	_seed_judged "dupb" "public" "rejected" "$(_split)" "art-shared"
+
+	run librarian_lesson_promote "$PROJECT_KEY" "dupa"
+	[ "$status" -eq 0 ] || return 1
+	run librarian_lesson_promote "$PROJECT_KEY" "dupb"
+	[ "$status" -eq 0 ] || return 1
+
+	# Two distinct proposals were judged and rejected, so two verdicts are
+	# owed. Under the artifact_id-keyed guard this was 1.
+	[ "$(grep -c 'art-shared' "$(_dir)/declined.jsonl")" -eq 2 ] || return 1
+
+	# And they are distinguishable — a row per proposal, not two identical
+	# rows, which is what makes the ledger usable for rubric tuning.
+	local ids
+	ids=$(jq -r '.lesson_id' "$(_dir)/declined.jsonl" | sort | tr '\n' ' ')
+	[ "$ids" = "dupa dupb " ]
+}
+
+@test "the declined guard still blocks a true double-write for one proposal" {
+	# The behavior the guard was added for, which the re-key must not lose:
+	# a stamp that fails AFTER the declined row lands, then a standalone
+	# re-run. Same chmod shape as the artifact_id-keyed test above.
+	_seed_judged "rekey01" "public" "rejected" "$(_split)"
+
+	chmod 0500 "$(_dir)/proposals"
+	run --separate-stderr librarian_lesson_promote "$PROJECT_KEY" "rekey01"
+	chmod 0700 "$(_dir)/proposals"
+	[ "$status" -ne 0 ] || return 1
+	[ "$(grep -c 'art-rekey01' "$(_dir)/declined.jsonl")" -eq 1 ] || return 1
+
+	run librarian_lesson_promote "$PROJECT_KEY" "rekey01"
+	[ "$status" -eq 0 ] || return 1
+	[ "$(grep -c 'art-rekey01' "$(_dir)/declined.jsonl")" -eq 1 ]
+}
+
+@test "a legacy declined row without lesson_id still dedups by artifact_id" {
+	# Rows written before this change carry no lesson_id. Keying purely on
+	# lesson_id would make them match nothing, so an unstamped proposal left
+	# over from a historical stamp failure would double-write on re-run —
+	# trading this bug for the one the guard was built to stop. The fallback
+	# keeps the old artifact_id behavior for exactly those rows.
+	_seed_judged "legacy01" "public" "rejected" "$(_split)"
+	printf '%s\n' '{"artifact_id":"art-legacy01","reason":"rejected","detail":null,"declined_at":"2020-01-01T00:00:00Z"}' \
+		>> "$(_dir)/declined.jsonl"
+
+	run librarian_lesson_promote "$PROJECT_KEY" "legacy01"
+	[ "$status" -eq 0 ] || return 1
+	[ "$(grep -c 'art-legacy01' "$(_dir)/declined.jsonl")" -eq 1 ]
+}
+
+@test "librarian_lesson_seen still matches on artifact_id, not lesson_id" {
+	# seen() answers "was this ARTIFACT already handled?", which is correctly
+	# artifact-scoped — it is what stops transform from re-proposing. Adding
+	# lesson_id to the row must not perturb it.
+	_seed_judged "seen01" "public" "rejected" "$(_split)" "art-seen-shared"
+	run librarian_lesson_promote "$PROJECT_KEY" "seen01"
+	[ "$status" -eq 0 ] || return 1
+
+	run librarian_lesson_seen "$PROJECT_KEY" "art-seen-shared"
+	[ "$status" -eq 0 ] || return 1
+	run librarian_lesson_seen "$PROJECT_KEY" "art-never-declined"
+	[ "$status" -ne 0 ]
+}