@rune-kit/rune 2.26.2 → 2.28.0

package/README.md

@@ -103,11 +103,19 @@ Plus **9 domain packs** (product, sales, data-science, support, growth, media, p
 
 ---
 
-## What's New (v2.26.2 — Hook Output Contract)
+## What's New (v2.28.0 — Reasoner's Blind Spots)
+
+> **v2.28.0 (2026-07-22):** Completes the reasoning wave. Every addition targets one failure class: **a check that feels done because the model re-read its own work and agreed with itself.** `problem-solver` (v0.6.0) gains a **model failure-mode table** beside its human-bias table — pattern-match satisfaction, template hijack, fluent≠true, prior-as-fact, completion pressure, surface blindness — plus three tells that you are inside one right now (instant confident answer; a stated detail your draft never used; two failed attempts in the same framing). `verification` (v0.8.0) gains the **Constraint Loop** for deliverables carrying a mechanically checkable constraint on their own surface form (banned characters, exact counts, strict formats) — a class Rune had no coverage for: expand the constraint before drafting, verify with a tool, re-scan the whole artifact, ship byte-for-byte. `design` (v0.9.0) gains **render blindness** — a checklist item ticked from source is a prediction, and the imagined render is always flattering; visual items are marked 👁 and are ticked from a render or marked ASSUMED. Advisory throughout, no new skills.
+
+### Previous (v2.27.0 — Calibrated Output)
+
+> **v2.27.0 (2026-07-22):** Rune had one opinion about response shape — `caveman`, optimising token count — and no rule for what a style may **not** compress. That gap had teeth: caveman's "hedging dies" list auto-activates at ORANGE/RED context and deleted phrases like *"I'm assuming the migration ran"*, promoting an unverified claim into observed grammar at exactly the point in a session where the agent is most likely to be wrong. New **output-mode layer** (`context-engine`) holds every mode behind one activation contract and a five-rule precedence list — **shape is negotiable, substance is not**: calibration > evidence > a skill's `## Output Format` > safety > actionability > economy. New **`actionable` mode** optimises distance-to-doing (next action first, steps numbered, position restated each turn) and stacks with caveman. New **claim discipline** in `completion-gate` types every load-bearing statement OBSERVED / DERIVED / PRIOR / ASSUMED — *hallucination is an unverified claim wearing the grammar of an observation* — and adds a `DECLARED` verdict so an honest hedge is recorded as an open item, never scored as a lie.
+
+#### Earlier (v2.26.2 — Hook Output Contract)
 
 > **v2.26.2 (2026-07-22):** The other half of the Codex wiring fix — v2.26.1 made the hook matchers fire, this makes the hooks **succeed**. Codex parses hook stdout as JSON and reports anything else as `hook: <Event> Failed`, discarding the output; Rune's hooks printed bare `[Rune: ...]` lines, so every hook that loaded on Codex ran, exited 0, and had its output thrown away. Hooks now emit the envelope both runtimes accept — `hookSpecificOutput.additionalContext` for context events, `systemMessage` otherwise — which is Claude Code's documented contract too, not a Codex branch. Verified live against codex-cli 0.145: the same hook goes `SessionStart Failed` → `SessionStart Completed`.
 
-### Previous (v2.26.1 — Codex Wiring)
+#### Earlier (v2.26.1 — Codex Wiring)
 
 > **v2.26.1 (2026-07-22):** Rune's runtime hooks were silently inert on **Codex CLI**. `hooks/hooks.json` is loaded by both Claude Code and Codex — Codex reads `<plugin>/hooks/hooks.json`, the same path, and maps the event names — but every tool matcher named only Claude's tools. Codex has no `Read`, `Write`, `Edit` or `Bash` tool; it issues `shell_command`, `exec`, `apply_patch`, `view_image`, `spawn_agent`. So the privacy gate and the secret scanner matched nothing and never fired. Matchers now name both platforms' tools (plain alternation — Claude behaviour is byte-for-byte unchanged), and `pre-tool-guard` reads the target path out of a Codex `apply_patch` payload (`*** Update File: <path>`), which is what makes it an actual gate there instead of a no-op. Note that Codex does not support `async` hooks yet and skips them, so Rune's six background hooks stay inactive on Codex — `async` is kept because Claude Code honours it.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.26.2",
+  "version": "2.28.0",
   "description": "65-skill mesh for AI coding assistants — runtime auto-discipline via native hooks (Claude/Cursor/Windsurf/Antigravity), 5-layer architecture, 204 connections + 43 signals, multi-platform compiler. converge (L3) scans spec vs code so dead-button/frontend-only implementations can't ship.",
   "type": "module",
   "bin": {

package/skills/adversary/references/oracle-mode.md

@@ -44,7 +44,7 @@ Emit `oracle.dispatched` carrying `{sessionId, triggerSignal, sourceSkill, targe
 |--------------|----------|
 | sonnet-class (gpt-5.6-terra, gemini-3-flash, claude-sonnet-5) | Synchronous — block until reply or 60s timeout |
 | opus-class (gpt-5.6-sol, gemini-3-pro, claude-opus-4-8) | Async — primary agent continues; poll `.rune/oracle-pending/<sessionId>.json` between phases |
-| frontier-class (claude-fable-5, API-only) | Async, heaviest second opinion for the hardest red-team / architecture calls. **API-only** — not available on a subscription runtime, so reach it via an API key or a non-Anthropic CLI, never via the primary Claude Code session's model. Thinking is always on (control depth with `effort`, do not send a `thinking` param) and it can return a `refusal` stop reason — treat a refusal as "no oracle reply", fall back to opus-class. |
+| frontier-class (claude-fable-5) | Async, heaviest second opinion for the hardest red-team / architecture calls. Reachable both via API and on subscription runtimes — but an oracle is only worth calling from a *different* session or runtime than the one being reviewed, so route it via API key or a separate CLI rather than the primary session's own model. Thinking is always on (control depth with `effort`, do not send a `thinking` param) and it can return a `refusal` stop reason — treat a refusal as "no oracle reply", fall back to opus-class. |
 
 ### 5. Validate response
 

package/skills/completion-gate/SKILL.md

@@ -4,7 +4,7 @@ description: "Validates agent claims against evidence trail. Use when verifying
 user-invocable: false
 metadata:
   author: runedev
-  version: "1.9.0"
+  version: "1.10.0"
   layer: L3
   model: haiku
   group: validation
@@ -58,6 +58,33 @@ CLAIM PATTERNS:
 
 Extract each claim as: `{ claim: string, source_skill: string }`
 
+### Step 1a — Type Each Claim (Claim Discipline)
+<MUST-READ path="references/claim-discipline.md" trigger="always — before matching evidence"/>
+
+Before hunting for evidence, type the claim by the grammar it was written in. **Hallucination is an unverified claim wearing the grammar of an observation** — the grammar is the tell, and it is readable in the sentence itself.
+
+| Type | Meaning | Grammar it may wear |
+|------|---------|---------------------|
+| **OBSERVED** | Seen this session: ran it, read it, measured it | "X is / does / returns …" |
+| **DERIVED** | Follows from OBSERVED facts via a statable mechanism | "X should / will / implies …" + the why |
+| **PRIOR** | Training knowledge, may be stale | "X is typically … / was, as of …" |
+| **ASSUMED** | Unverified and required by the conclusion | "I am assuming X — if wrong, then …" |
+
+This changes what the gate is looking for in Step 2:
+
+- **OBSERVED** → demands an evidence artifact. No artifact = FAIL. This is the existing gate.
+- **DERIVED** → demands the mechanism be stated, and its OBSERVED inputs to be present.
+- **PRIOR / ASSUMED** → **not a failure.** A claim honestly delivered as assumed is the correct output when the check was not run. Record it as an open item; never score it as a lie.
+
+<HARD-GATE>
+A hedge is not a defect. Do NOT fail a claim for being marked ASSUMED or PRIOR — fail it for
+wearing OBSERVED grammar with nothing behind it. Treating honest uncertainty as a failure
+teaches the next agent to delete its hedges, which is the exact behavior this gate exists to
+catch.
+</HARD-GATE>
+
+Claims are promoted only by tools — checking a PRIOR makes it OBSERVED. Restating it more confidently does not. Confidence that grew from effort, repetition or fluent prose resets to the last evidence-backed level.
+
 ### Step 1b — Stub Detection (Existence Theater Check)
 
 Before checking claims, scan all files created/modified in this workflow for stubs:
@@ -145,8 +172,10 @@ IF evidence exists AND evidence supports claim:
   → CONFIRMED
 IF evidence exists BUT contradicts claim:
   → CONTRADICTED (most serious — agent is wrong)
-IF no evidence found:
-  → UNCONFIRMED (agent may be right but didn't prove it)
+IF no evidence found AND claim was typed PRIOR/ASSUMED (Step 1a):
+  → DECLARED (honest gap — record as an open item, not a failure)
+IF no evidence found AND claim wore OBSERVED grammar:
+  → UNCONFIRMED (the claim asserted more than the agent checked)
 ```
 
 **3-Axis verification** — categorize each claim into one of three axes, then ensure all axes are covered:
@@ -172,21 +201,25 @@ If an axis has ZERO claims → flag as gap: "No [Completeness/Correctness/Cohere
 ## Completion Gate Report
 - **Status**: CONFIRMED | UNCONFIRMED | CONTRADICTED
 - **Claims Checked**: [count]
-- **Confirmed**: [count] | **Unconfirmed**: [count] | **Contradicted**: [count]
+- **Confirmed**: [count] | **Unconfirmed**: [count] | **Contradicted**: [count] | **Declared**: [count]
 
 ### Claim Validation
-| # | Claim | Evidence | Verdict |
-|---|---|---|---|
-| 1 | "All tests pass" | Bash: `npm test` → "42 passed, 0 failed" | CONFIRMED |
-| 2 | "Build succeeds" | No build command output found | UNCONFIRMED |
-| 3 | "No lint errors" | Bash: `npm run lint` → "3 errors" | CONTRADICTED |
+| # | Claim | Type | Evidence | Verdict |
+|---|---|---|---|---|
+| 1 | "All tests pass" | OBSERVED | Bash: `npm test` → "42 passed, 0 failed" | CONFIRMED |
+| 2 | "Build succeeds" | OBSERVED | No build command output found | UNCONFIRMED |
+| 3 | "No lint errors" | OBSERVED | Bash: `npm run lint` → "3 errors" | CONTRADICTED |
+| 4 | "Assuming the migration already ran in staging" | ASSUMED | — (declared, not claimed) | DECLARED |
 
 ### Gaps (if any)
 - Claim 2: Re-run `npm run build` and capture output
 - Claim 3: Agent claimed clean but lint shows 3 errors — fix required
 
+### Open (declared, not failures)
+- Claim 4: Verify the staging migration before this reaches prod
+
 ### Verdict
-UNCONFIRMED — 1 claim lacks evidence, 1 contradicted. Cannot proceed to commit.
+UNCONFIRMED — 1 claim lacks evidence, 1 contradicted. Cannot proceed to commit. (1 declared assumption carried forward — not blocking.)
 ```
 
 ### Step 4.5 — Integration Check (Cross-Phase + Cross-Layer)

package/skills/completion-gate/references/claim-discipline.md

@@ -0,0 +1,58 @@
+# Claim Discipline
+
+The gate catches a false claim *after* the work is done, by demanding evidence for it. Claim
+discipline stops the false claim from being written in the first place, by fixing the
+grammar a statement is allowed to wear.
+
+**The rule: hallucination is an unverified claim wearing the grammar of an observation.**
+The grammar is the tell — and it is visible in the sentence itself, before any gate runs.
+
+## The four claim types
+
+Type every load-bearing statement — the ones that, if wrong, collapse the answer. Ignore
+the rest; typing everything uniformly wastes the budget on trivia.
+
+| Type | Meaning | Allowed grammar |
+|------|---------|-----------------|
+| **OBSERVED** | You saw it *this session*: ran it, read it, measured it | "X is / does / returns …" |
+| **DERIVED** | Follows from OBSERVED facts through a mechanism you can state | "X should / will / implies …" — plus the why |
+| **PRIOR** | Training knowledge; may be stale | "X is typically … / was, as of …" — verify if load-bearing |
+| **ASSUMED** | Unverified and required by the conclusion | "I am assuming X — if wrong, then …" |
+
+## Rules
+
+1. **Promotion happens by tool, never by restatement.** Checking a PRIOR makes it OBSERVED.
+   Saying it again more confidently does not. Confidence that rose from effort, repetition,
+   or fluent prose resets to the last evidence-backed level.
+2. **Downgrade honestly.** When the environment changes, an earlier OBSERVED becomes PRIOR —
+   a test that passed before an edit is not evidence about the code after it.
+3. **Version-sensitive claims are PRIOR until checked.** APIs, flags, defaults, prices,
+   model names, package versions. These decay silently.
+4. **"I don't know", followed by what would settle it, is a first-class answer.** An
+   answer-shaped non-answer is worse than an honest gap.
+5. **A claim about your own output is not OBSERVED until it is checked against the exact
+   delivered text.** Re-reading your own work and agreeing with yourself is the weakest
+   possible evidence: it always passes.
+
+## How this pairs with the gate
+
+| | Claim discipline | The gate (Steps 1–3) |
+|---|---|---|
+| When | While writing the claim | After the work, before merge |
+| Mechanism | Grammar must match evidence level | Claim must match an evidence artifact |
+| Catches | Confident phrasing of an unverified thing | A claim with no artifact behind it at all |
+
+They are the same discipline at two moments. A claim typed honestly in the first place
+usually arrives at the gate already carrying its evidence; a claim that had to be softened
+to stay honest ("I am assuming the migration ran") is one the gate can then chase.
+
+**Gate consequence:** a claim delivered as ASSUMED or PRIOR is not a gate failure — it is
+the correct output when the check was not run. A claim delivered as OBSERVED with no
+artifact is a FAIL. Do not let a hedge be treated as the same defect as a lie.
+
+## Interaction with output styles
+
+Output styles (`context-engine` → `references/output-modes.md`) compress prose. They must
+never compress a claim into a stronger grammar than its evidence supports — deleting
+"I am assuming" to save four tokens manufactures confidence. Calibration outranks brevity;
+that precedence is stated in `output-modes.md` and enforced here.

package/skills/context-engine/SKILL.md

@@ -4,7 +4,7 @@ description: "Context window management. Auto-triggered when context is filling
 user-invocable: false
 metadata:
   author: runedev
-  version: "1.2.0"
+  version: "1.3.0"
   layer: L3
   model: haiku
   group: state
@@ -379,11 +379,31 @@ When Context Budget Warning fires, append to Context Health report:
 - **Recommendation**: Disable [server] to save ~[N]k tokens
 ```
 
-## Output Density Mode (Caveman)
+## Output Modes
+<MUST-READ path="references/output-modes.md" trigger="when any output mode is active OR two modes are active at once"/>
+
+Rune ships more than one opinion about response shape, and they conflict. `references/output-modes.md` is the layer that holds them: the mode registry, the shared activation contract (activate → persist → release, identical for every mode), and the precedence rule for when two active modes want opposite things.
+
+**The precedence, in short — shape is negotiable, substance is not:**
+
+1. Calibration outranks every style — a style compresses prose, never a claim into stronger grammar than its evidence supports (`completion-gate` → `references/claim-discipline.md`).
+2. Evidence outranks brevity — what was run and what it returned is not filler.
+3. A skill's `## Output Format` outranks every style — shape the prose inside the sections, never drop a section or a finding.
+4. Safety outranks all shaping — destructive/irreversible confirmations revert to full prose.
+5. Actionability outranks economy — when both are on, the steps survive and the prose around them compresses.
+
+| Mode | Optimizes for | Reference |
+|------|---------------|-----------|
+| `caveman` | Token economy | `references/caveman-mode.md` |
+| `actionable` | Legibility — next action first, state restated each turn | `references/actionable-mode.md` |
+
+### Output Density Mode (Caveman)
 <MUST-READ path="references/caveman-mode.md" trigger="when context reaches ORANGE/RED OR user says 'caveman'/'be brief'/'less tokens'"/>
 
 Caveman is a terse output mode that strips filler, articles, hedging, and pleasantries while preserving full technical accuracy. ~75% output token reduction with no information loss when applied per the rules in `references/caveman-mode.md`.
 
+**Hedging is the one deletion with a hard limit.** Filler hedges (`I think`, `basically`) die; a hedge carrying real uncertainty (`I am assuming the migration ran`) stays — cutting it promotes an ASSUMED claim to OBSERVED grammar, which precedence rule 1 forbids. Terse and overconfident is worse than verbose.
+
 ### Activation triggers
 
 | Trigger | Source | Persistence |
@@ -406,6 +426,18 @@ Auto-activation emits `output.density.set` signal carrying `{mode: caveman, scop
 
 Caveman in the FIRST response of a task. The user can't calibrate severity from a single output yet — verbose first response is fine. Caveman starts on response 2+.
 
+### Actionable Output Mode
+<MUST-READ path="references/actionable-mode.md" trigger="user says 'adhd mode'/'actionable'/'just tell me what to do' OR the deliverable is steps a human will execute"/>
+
+Shapes a response so it can be *acted on* rather than merely understood: next action first, multi-step work numbered, position restated every turn ("step 3 of 5 done"), estimates in real units, one concrete next action at the end. Optimizes distance-to-doing, where caveman optimizes token count — the two stack, and rule 5 above resolves them.
+
+| Trigger | Source | Persistence |
+|---------|--------|-------------|
+| User says "adhd mode" / "actionable" / "action first" / "just tell me what to do" | Explicit user signal | Until "stop adhd mode" / "normal mode" |
+| Deliverable is steps a human executes (runbook, incident response, onboarding) | Skill-initiated | Scoped to that deliverable |
+
+Not a diagnosis and not a persona — it is the right shape for anyone reading mid-incident, on a phone, or in a second language. Full rules, exceptions and pre-send check in `references/actionable-mode.md`.
+
 ## Mode: preview (v1.1.0)
 
 Pre-flight cost check for expensive escalations. Caller (`adversary` oracle-mode, `team` workstream spawn, `review` multi-file, `audit` cross-pack) MUST emit `context.preview` BEFORE building the bundle, so context-engine can estimate token cost and gate the dispatch against a per-caller threshold.

package/skills/context-engine/references/actionable-mode.md

@@ -0,0 +1,75 @@
+# Actionable Output Mode
+
+An output mode that shapes a response so it can be *acted on*, not just understood. Where
+`caveman-mode` optimises for fewer tokens, this optimises for a shorter distance between
+reading and doing.
+
+> "Knowing the answer is not doing the answer."
+
+Written for readers who lose the thread between messages — working memory that does not
+hold "we are on step 3 of 5", attention that does not survive a paragraph before the point.
+No diagnosis required to want this; it is also the right shape for anyone reading on a
+phone, mid-incident, or in a language they do not think in.
+
+## When to activate
+
+| Trigger | Source | Persistence |
+|---------|--------|-------------|
+| User says "adhd mode", "actionable", "action first", "just tell me what to do" | Explicit user signal | Until "stop adhd mode" / "normal mode" |
+| Handing steps to a human executor (deploy runbook, incident response, onboarding) | Skill-initiated for that response | Scoped to that deliverable |
+
+Stacks with `caveman`. See `output-modes.md` for the precedence rule when they disagree.
+
+## The shape
+
+1. **Lead with the next action.** The first line is something the reader can do — a command,
+   a path, a snippet. Not context, not a plan, not what you are about to do.
+2. **Number multi-step work.** One bounded action per step. Fold trivial steps into the one
+   before; a short path finished beats a complete path abandoned.
+3. **Restate state every turn.** "Step 3 of 5 done: schema updated. Next: backfill." The
+   reader cannot hold position between messages. If the runtime has a todo/plan tool, let
+   it do the restating and do not narrate the plan as prose as well.
+4. **End with one concrete next action** — something doable in under two minutes. "Open the
+   file" counts.
+5. **Estimate in real units.** "About 15 minutes if tests already cover this" — not "some
+   work". Vague and specific estimates land identically, which makes vague ones useless.
+6. **Make finished work visible in concrete terms.** "Login now works with magic links. Try:
+   `npm run dev`, open `/login`." Not "I've made some changes to the auth flow."
+7. **Errors are matter-of-fact.** State cause and fix. No "Uh oh", no "There seems to be a
+   problem."
+8. **One thing at a time.** Finish the asked thing; a second issue gets one sentence at the
+   end, offered — never woven through the answer.
+9. **Rank instead of listing.** Past five items, split into do-now vs later. Five ranked
+   beats ten unranked. Splitting is not dropping — see precedence rule 3 in `output-modes.md`.
+10. **No preamble, no closer.** Start at the answer, stop when it is done.
+
+## What dies
+
+- Openers: `Great question`, `Let me`, `I'll`, `Sure!`, `Looking at your…`, `To answer your question`
+- Closers: `Hope this helps`, `Let me know if you need anything else`, `Happy to clarify`
+- "By the way" sidebars, and idioms that replace a literal action (`circle back`, `get the ball rolling`)
+
+## What stays
+
+- Hedges that carry real uncertainty. Deleting "I am assuming" manufactures confidence —
+  precedence rule 1.
+- Every finding, step and section a skill's `## Output Format` requires — precedence rule 3.
+- Full prose for safety confirmations and destructive actions — precedence rule 4.
+
+## Exceptions (revert for one response, then resume)
+
+| Situation | Why |
+|-----------|-----|
+| User asks to "explain" or "walk me through" | They want the long version. Still no preamble, still no closer — the body just runs as long as the topic needs, with headers to skim back |
+| Destructive or irreversible action ahead | Safety outranks shape |
+| Third turn of "still broken" | Stop iterating. Name the assumption that might be wrong, ask one diagnostic question |
+| Genuine ambiguity in the ask | One short clarifying question beats guessing and rewriting |
+| "What are my options?" | The options *are* the answer — 2–4 ranked, one-line trade-offs, recommendation first |
+
+## Pre-send check
+
+Delete: the first sentence if it announces what you are about to do; the last sentence if it
+asks "anything else?"; any "by the way"; any hedging adverb carrying no information.
+
+Then verify: reading only the first line and the last line, does the reader know **what to
+do next** and **what just happened**? If yes, send.

package/skills/context-engine/references/output-modes.md

@@ -0,0 +1,67 @@
+# Output Modes
+
+Rune has more than one opinion about how a response should be shaped, and they do not agree.
+This file is the layer that holds them: the registry of modes, the shared activation
+contract, and — the part that actually matters — the precedence rule for when two active
+modes want opposite things.
+
+## The registry
+
+| Mode | Optimizes for | Reference | Default |
+|------|---------------|-----------|---------|
+| `caveman` | Token economy — strip filler, articles, pleasantries | `caveman-mode.md` | off; auto-on at ORANGE/RED context |
+| `actionable` | Legibility — next action first, numbered steps, state restated | `actionable-mode.md` | off; user-invoked |
+| (none) | Default runtime voice | — | on |
+
+Modes stack. `caveman` + `actionable` together is a normal combination: terse *and*
+action-first. They are not alternatives to each other, which is exactly why they need a
+precedence rule.
+
+## Precedence (the rule that resolves conflicts)
+
+Applied top-down. A higher rule wins outright; it is never traded off against a lower one.
+
+1. **Calibration outranks every style.** A style may compress prose. It may never move a
+   claim into a stronger grammar than its evidence supports. If compressing "I am assuming
+   the migration ran" into "the migration ran" saves four tokens, the four tokens lose.
+   See `completion-gate` → `references/claim-discipline.md`.
+2. **Evidence outranks brevity.** Reporting what was run and what it returned is not a
+   "recap" and is not filler — `verification`, `preflight` and `completion-gate` exist on
+   that evidence. A style may tighten how it is written, never whether it appears.
+3. **A skill's `## Output Format` outranks every style.** Most skills define the sections
+   their report must carry. A style shapes the prose *inside* those sections; it never
+   drops a section, a finding, or an item from a ranked list. A review with twelve findings
+   reports twelve.
+4. **Safety outranks all shaping.** Destructive-action confirmations, security warnings and
+   irreversible-step callouts revert to full prose for that response, in every mode. Both
+   mode references already carry this exception; it is restated here because it is the one
+   people cut first.
+5. **Actionability outranks economy.** When `caveman` and `actionable` are both on, the
+   numbered steps and the closing next-action survive; the prose around them is what gets
+   compressed.
+
+The general form: **shape is negotiable, substance is not.** Every rule above is one
+instance of it. When a new mode is added, it inherits this list rather than restating it.
+
+## Shared activation contract
+
+Every mode follows the same lifecycle, so users learn it once:
+
+| | Behaviour |
+|---|---|
+| Activate | Explicit user signal (`caveman`, `adhd mode`, `be brief`, `actionable`), or an automatic trigger the mode declares |
+| Persist | Every response until explicitly released. **No drift back mid-session** — if unsure whether a mode is still on, it is |
+| Release | `stop <mode>` or `normal mode`. Confirm in one line, then revert |
+| Auto-release | Only where the mode declares one (e.g. `caveman` releases when context returns to GREEN) |
+| Manual override | Always wins over an automatic trigger, in both directions |
+
+State lives in the session, not on disk. A mode does not survive a new session unless the
+user re-invokes it — deliberately, so a forgotten style never silently shapes a fresh
+session's output.
+
+## Adding a mode
+
+A new mode earns a file here only if it changes *shape*, applies across every response, and
+is orthogonal to the ones already listed. If it changes *what work happens* it is a
+behavioural context (`contexts/*.md`), not an output mode. If it applies to one skill's
+report it belongs in that skill's `## Output Format`, not here.

package/skills/design/SKILL.md

@@ -3,7 +3,7 @@ name: design
 description: "Design system reasoning. Maps product domain to style, palette, typography, and platform-specific patterns. Generates .rune/design-system.md as the shared design contract for all UI-generating skills."
 metadata:
   author: runedev
-  version: "0.8.0"
+  version: "0.9.0"
   layer: L2
   model: sonnet
   group: creation
@@ -27,6 +27,7 @@ Design system reasoning layer. Converts a product description into a concrete de
 
 - `scout` (L2): detect existing design tokens, component library, platform targets
 - `asset-creator` (L3): generate base visual assets (logo, OG image) from design system
+- `browser-pilot` (L3): render the surface and inspect it before claiming any visual property holds (Step 5.4)
 - `review` (L2): accessibility violations found → flag for fix in next code review
 
 ## Called By (inbound)
@@ -477,21 +478,47 @@ sm: 6px | md: 8px | lg: 12px | xl: 16px | full: 9999px
 [detected library or "custom"]
 
 ## Pre-Delivery Checklist
-- [ ] Color contrast ≥ 4.5:1 for all text
-- [ ] Focus-visible ring on ALL interactive elements (never outline-none alone)
-- [ ] Touch targets ≥ 44×44px on mobile / ≥ 24×24px on desktop, with 8px gap between targets (matches Step 2.9 Rule 1)
+> Items marked 👁 describe what a human would SEE — tick them only from a render, or mark them ASSUMED (Step 5.4).
+- [ ] 👁 Color contrast ≥ 4.5:1 for all text
+- [ ] 👁 Focus-visible ring on ALL interactive elements (never outline-none alone)
+- [ ] 👁 Touch targets ≥ 44×44px on mobile / ≥ 24×24px on desktop, with 8px gap between targets (matches Step 2.9 Rule 1)
 - [ ] All icon-only buttons have aria-label
 - [ ] All inputs have associated <label> or aria-label
-- [ ] Empty state, error state, loading state for all async data
+- [ ] 👁 Empty state, error state, loading state for all async data
 - [ ] cursor-pointer on all clickable non-button elements
 - [ ] prefers-reduced-motion respected for all animations
 - [ ] Dark mode support (or explicit reasoning why not)
-- [ ] Responsive tested at 375px / 768px / 1024px / 1440px
+- [ ] 👁 Responsive tested at 375px / 768px / 1024px / 1440px
 - [ ] No pure #000 or #fff in semantic tokens (use oklch neutrals)
 - [ ] No lorem ipsum / placeholder copy in shipped output (use real data or labelled `[ PLACEHOLDER: ... ]` blocks)
 - [ ] If multi-language: CJK-capable font listed FIRST in stack (`"Noto Sans SC", "Inter", ...`)
 ```
 
+### Step 5.4 — Render Blindness (advisory)
+
+A checklist item ticked from source is a prediction, not an observation. You emit markup and
+imagine the result, and **the imagined render is always flattering** — overflow, wrapping,
+contrast failure, misalignment and collision are invisible in source form. Every item in the
+checklist above that describes what a human would *see* is unverified until the surface is
+rendered and inspected, or the specific property is computed.
+
+| Claim | What source-reading proves | What actually settles it |
+|-------|---------------------------|--------------------------|
+| "Contrast ≥ 4.5:1" | The token values were chosen | Compute the ratio for the rendered pair — a token used on an unexpected background fails anyway |
+| "Responsive at 375px" | Breakpoints exist | Render at 375px and look: wrapping, overflow, tap-target collision |
+| "No overflow / clean alignment" | Nothing | Render — this class of failure has no textual signature |
+| "Focus ring visible" | The CSS rule exists | Tab through it; a parent `overflow:hidden` or a later rule can eat it |
+| "Empty / error / loading states work" | The branches exist | Render each one; the happy path is the only state most designs are ever seen in |
+
+**Advisory, not a gate.** When the runtime grants a browser, `browser-pilot` is the strongest
+check available and costs one call — take it, then report what was seen. When it does not,
+say so: mark the visual items **ASSUMED (not rendered)** rather than ticking them. A checklist
+of predictions labelled as observations is worse than a short one that is honest — see
+`completion-gate` → `references/claim-discipline.md`.
+
+Highest-yield renders, when budget allows only a few: narrowest breakpoint, longest realistic
+content string, empty state, dark mode.
+
 ### Step 5.5 — UI Design Contract (UI-SPEC.md)
 
 After generating the design system, lock key visual decisions in `.rune/ui-spec.md` — a binding contract that prevents design drift during implementation.

package/skills/plan/SKILL.md

@@ -23,7 +23,7 @@ Strategic planning engine for the Rune ecosystem. Produces a **master plan + pha
 This is enterprise-grade project management: BA produces WHAT → Plan produces HOW (structured into phases) → ANY coder executes each phase with full context.
 
 > **Goal-first — leverage native goal/outcome commands (advisory, 2026).** Current
-> agent models (Opus 4.8, Sonnet 5, and the API-only Fable) perform best when handed
+> agent models (Opus 4.8, Sonnet 5, Fable 5) perform best when handed
 > the full goal + constraints up front, then left to execute at high effort. Some
 > platforms now expose this natively: Claude Code `/goal` sets a run's north-star;
 > Managed Agents **Outcomes** (`user.define_outcome` + rubric) grade-and-iterate to a

package/skills/problem-solver/SKILL.md

@@ -3,7 +3,7 @@ name: problem-solver
 description: "Structured reasoning frameworks for complex problems. 19 analytical frameworks, 12 cognitive bias detectors, 10 decomposition methods, 10 mental models, Cynefin domain classification, ethical dimension check, and 6 communication patterns. McKinsey-grade problem solving for AI coding assistants."
 metadata:
   author: runedev
-  version: "0.5.0"
+  version: "0.6.0"
   layer: L3
   model: sonnet
   group: reasoning
@@ -77,6 +77,10 @@ NEVER skip bias detection. Every problem has biases — explicitly address them.
 This is the #1 value-add from structured reasoning. Without it, solutions are just dressed-up gut feelings.
 </HARD-GATE>
 
+Two catalogs run here, not one: the biases of the people and organisation in the problem, and the failure modes of the model doing the analysis. Skipping the second is how a rigorous-looking analysis reaches a confidently wrong conclusion.
+
+#### Human and organisational biases
+
 Scan the problem statement and context for bias indicators. Check the top 6 most dangerous biases:
 
 | Bias | Detection Question | Debiasing Strategy |
@@ -96,6 +100,32 @@ Additional biases to check when relevant:
 - **Survivorship Bias**: Are we only looking at successful cases? Who tried this approach and failed?
 - **Recency Bias**: Are we extrapolating from the last few data points instead of looking at 5-10 years of data?
 
+#### Model failure modes (the reasoner's own biases — ALSO run)
+
+The table above catalogs how *humans and organisations* misjudge. It says nothing about how
+*you* misjudge. These are the failure modes of the thing doing the analysis, and naming one
+is the first countermeasure — they are invisible from the inside precisely because each one
+feels like competence.
+
+| Failure mode | What it feels like | Countermeasure |
+|--------------|--------------------|----------------|
+| **Pattern-match satisfaction** | The first explanation that fits a familiar template feels like the diagnosis | Familiarity is retrieval, not verification. Hold a second hypothesis before investigating the first |
+| **Template hijack** | A question whose surface matches a stored template ("flaky test → add retry", "slow query → add index") fires the template's answer before this question's constraints are read | Re-derive from *this* problem's details. Familiarity raises the risk, not lowers it |
+| **Fluent ≠ true** | Confidence rises as well-formed prose flows; the argument feels stronger the longer it gets | Confidence tracks evidence, not token count. Audit each point where it rose and name what moved it |
+| **Prior-as-fact** | Training knowledge stated in the grammar of observed fact | Type the claim (`completion-gate` → `references/claim-discipline.md`). Priors decay — APIs, defaults, prices, versions |
+| **Frame adoption** | The asker's framing inherited as fact ("the cache is broken again") | Trust their goal absolutely; treat their diagnosis as testimony to verify |
+| **Completion pressure** | Producing something answer-shaped now feels better than checking one more thing | An answer-shaped non-answer is worse than "here is what I verified, here is what is still open" |
+| **Surface blindness** | Any claim about the form of your own output — which symbols it contains, how many units it has — read back as true | You see tokens, not characters; a re-read always passes. Verify unit by unit or by tool (`verification` → Constraint Loop) |
+
+**Three tells you are inside one right now**: the answer arrived instantly with high
+confidence; your draft never used one of the problem's stated details; two or three attempts
+failed inside the same framing. Any tell means stop and re-derive — never repeat a failed
+probe harder.
+
+**Output**: alongside the human-bias warnings, name any model failure mode active in THIS
+analysis and what you did about it. "None apparent" is a valid answer only if you can say
+which tell you checked.
+
 **Steel Manning** (apply when evaluating competing options):
 Before dismissing any option, construct the STRONGEST possible version of the argument for it. If you can't articulate why a smart, informed person would choose it, you haven't understood it yet. Steel Manning prevents strawman dismissals and forces genuine evaluation.
 
@@ -335,6 +365,7 @@ Structure the output report using the selected pattern.
 ### Bias Warnings
 - ⚠️ [Bias 1]: [how it might affect this analysis] → [debiasing action taken]
 - ⚠️ [Bias 2]: [how it might affect this analysis] → [debiasing action taken]
+- 🤖 [Model failure mode]: [which tell fired] → [what was re-derived or verified]
 
 ### Reasoning Chain
 1. [step with evidence or reasoning]

package/skills/session-bridge/SKILL.md

@@ -553,7 +553,7 @@ When `oracle.dispatched` arrives, payload contains:
 - `sessionId` — caller-provided unique id
 - `triggerSignal` — `agent.stuck` or manual
 - `sourceSkill` — `debug` | `fix` | manual
-- `targetModel` — concrete model name (e.g. `gpt-5.6-sol`, `gemini-3-pro`, `claude-opus-4-8`; API-only frontier: `claude-fable-5`)
+- `targetModel` — concrete model name (e.g. `gpt-5.6-sol`, `gemini-3-pro`, `claude-opus-4-8`, `claude-fable-5`)
 - `bundleHash` — sha256 of the bundled context (idempotency key)
 
 ### Step D2 — Idempotency check

package/skills/verification/SKILL.md

@@ -3,7 +3,7 @@ name: verification
 description: "Universal verification runner. Runs lint, type-check, tests, and build. Use after any code change to verify nothing is broken."
 metadata:
   author: runedev
-  version: "0.7.0"
+  version: "0.8.0"
   layer: L3
   model: haiku
   group: validation
@@ -207,6 +207,47 @@ Exit 0 without a confirming output artifact or success string = UNVERIFIED.
 Report the specific line that confirmed success (e.g., "3 passed, 0 failed").
 </HARD-GATE>
 
+### Surface-Constraint Verification (the Constraint Loop)
+
+Everything above verifies *behaviour* with a tool. Some deliverables instead carry a
+constraint on their own **surface form**: a banned or required character, an exact word or
+line count, a positional pattern, a strict format, a naming scheme every entry must follow,
+a diff that must not touch a listed path. These look trivial and are the opposite — a model
+generates meaning-first and reads its own output as tokens, not characters, so the
+constraint sits exactly where its perception is weakest. The most natural wording for the
+topic is usually the likeliest violator.
+
+**Re-reading the output and judging that it complies is not verification.** A re-read always
+passes. That is the whole failure mode.
+
+Run this loop whenever a deliverable carries a mechanically checkable surface constraint:
+
+1. **Expand the constraint before producing anything.** Restate it as a test every governed
+   unit must pass, and decide *how you will count* before there is anything to count. List
+   the on-topic vocabulary most likely to violate it — starting with the subject's own name,
+   which the constraint may rule out — and pick compliant substitutes up front.
+2. **Draft away from the final answer** — a scratch file or reasoning space, never straight
+   into the deliverable.
+3. **Verify mechanically, strongest tool available.** A script, `grep`, `wc`, a formatter's
+   `--check`, a schema validator — seconds of work and the strongest possible evidence. With
+   no tool available, decompose the text into the units the constraint governs and test each
+   one explicitly (spell the word out; count with a running index). Manual decomposition is
+   the fallback for tool-poor runtimes, not a substitute where a tool exists.
+4. **Repair and re-verify the whole artifact.** A fix can introduce a new violation
+   elsewhere, so re-scan everything — one green check on the edited line says nothing about
+   its neighbours. Loop until one complete pass over the final text is clean.
+5. **Ship the verified text byte-for-byte.** Any post-verification rewording, however small,
+   invalidates the check — touch one unit and step 3 runs again.
+
+<HARD-GATE name="surface-constraint">
+"The output satisfies the constraint" is a verified claim only after step 3 has run against
+the EXACT delivered text. Asserted from a re-read, it is an assumption wearing the grammar of
+an observation — see `completion-gate` → `references/claim-discipline.md`. Report the check
+that was run, not the conclusion.
+</HARD-GATE>
+
+Report it like any other phase: `Constraint: <the rule> | Check: <command or method> | Units tested: N | Violations: 0`.
+
 ## Error Recovery
 
 - If project type cannot be detected: report "Unknown project type" and skip all checks