@softspark/ai-toolkit 4.16.1 → 4.18.0

package/kb/procedures/maintenance-sop.md

@@ -291,7 +291,7 @@ python3 scripts/validate.py --strict
 ai-toolkit plugin list                             # show available packs
 ai-toolkit plugin install --editor claude <name>  # install for Claude Code global target
 ai-toolkit plugin install --editor codex <name>   # install for Codex global target
-ai-toolkit plugin install --editor all --all      # install all 11 packs for both runtimes
+ai-toolkit plugin install --editor all --all      # install all 12 packs for both runtimes
 ai-toolkit plugin update --editor all --all       # re-apply all installed packs after toolkit updates
 ai-toolkit plugin clean <name>                    # prune data older than 90 days
 ai-toolkit plugin clean <name> --days 30  # custom retention

package/kb/procedures/release-preparation-sop.md

@@ -250,12 +250,17 @@ Add entry at the top of `CHANGELOG.md` (after the header, before previous releas
 
 ## Phase 4: Regenerate Artifacts
 
+Use the npm scripts, not the generators directly:
+
 ```bash
-python3 scripts/generate_agents_md.py > AGENTS.md
-python3 scripts/generate_llms_txt.py > llms.txt
-python3 scripts/generate_llms_txt.py --full > llms-full.txt
+npm run generate:agents   # AI_TOOLKIT_NO_CUSTOM_RULES=1 python3 scripts/generate_agents_md.py > AGENTS.md
+npm run generate:llms     # llms.txt + llms-full.txt
 ```
 
+`generate:agents` sets `AI_TOOLKIT_NO_CUSTOM_RULES=1`. Running
+`generate_agents_md.py` bare picks up whatever is registered in the maintainer's
+own `~/.softspark/ai-toolkit/rules/`, which then ships inside `AGENTS.md`.
+
 Check if anything actually changed:
 
 ```bash

package/kb/procedures/rtk-upstream-sync-sop.md

@@ -0,0 +1,279 @@
+---
+title: "SOP: rtk Upstream Sync"
+category: procedures
+service: ai-toolkit
+tags: [sop, rtk, rtk-pack, upstream, cross-build, telemetry, checksum, port-validation, advisory]
+version: "1.0.0"
+created: "2026-07-26"
+last_updated: "2026-07-26"
+description: "Procedure for moving rtk-pack to a newer upstream rtk release: detect the tag, review the files we depend on, re-validate the Python port that every coverage number rests on, rebuild five targets with telemetry undefined, verify silence, publish to our own release namespace, and bump the pack. Written after the v0.43.0 to v0.44.0 bump, which changed every file this SOP names."
+---
+
+# SOP: rtk Upstream Sync
+
+Moves `rtk-pack` from one pinned upstream tag to the next.
+
+Currently pinned: **v0.44.0**, shipped as
+`softspark-rtk-v0.44.0-1`. The pin lives in
+`app/plugins/rtk-pack/plugin.json` under `upstream.version`.
+
+Upstream ships stable tags roughly every two to four weeks behind a long
+release-candidate train (300+ RCs preceded v0.44.0). Do not track RCs.
+
+Background and the measured numbers: `kb/history/completed/rtk-pack-integration-20260726.md`.
+
+## Why this SOP is not "just rebuild"
+
+The v0.43.0 to v0.44.0 bump was 200 commits and touched **every file listed in
+Phase 2 below**. It also inverted pipeline rewriting: v0.43.0 rewrote the first
+stage of a pipeline, v0.44.0 rewrites the last. A rebuild without the review
+step would have shipped that silently, and the coverage numbers quoted to users
+would have described a version we no longer ship.
+
+## Phase 1: Detect
+
+```bash
+gh api repos/rtk-ai/rtk/releases --paginate \
+  --jq '.[] | select(.tag_name | test("^v[0-9]")) | "\(.tag_name)\t\(.published_at)"' | head -5
+```
+
+Compare against `upstream.version` in `app/plugins/rtk-pack/plugin.json`.
+
+Cadence: on demand, plus a check folded into release preparation.
+
+## Phase 2: Review before building
+
+Fetch the diff for the areas the pack depends on:
+
+```bash
+gh api repos/rtk-ai/rtk/compare/<pinned>...<new> \
+  --jq '{ahead: .ahead_by, files: [.files[] | {f: .filename, add: .additions, del: .deletions}]}'
+```
+
+Read the changelog, then diff these specifically:
+
+| File | Why it matters |
+|---|---|
+| `src/discover/registry.rs` | rewrite eligibility, pipeline handling, the TOML call sites |
+| `src/discover/rules.rs` | the rule table and `IGNORED_PREFIXES` |
+| `src/discover/lexer.rs` | tokenisation and `contains_unattestable_construct` |
+| `src/core/toml_filter.rs` | the filter DSL, which affects users who write their own filters |
+| `src/hooks/trust.rs` | the trust gate and its paths |
+| `src/hooks/hook_cmd.rs` | the Claude hook contract and permission handling |
+| `src/core/telemetry.rs`, `src/core/telemetry_cmd.rs` | the compile-time endpoint gate |
+| `Cargo.toml`, `Cargo.lock` | native deps, the MSRV, and new advisories |
+
+**A change to the DSL, to trust handling, or to the permission flow is a
+stop-and-think, not a rebuild.** In particular:
+
+- The pack ships no filters of its own, so a DSL change cannot break us. It can
+  still break a **user's** `filters.toml`, which upstream then skips silently
+  (`toml_filter.rs:220-221`). Worth a release-note line, not a code change.
+- If `hook_cmd.rs` changes when `permissionDecision` is emitted, the trust
+  boundary documented in the pack README changes with it.
+- If `IGNORED_PREFIXES` or the `pipeline_final_safe` rule set moves, every
+  coverage number is stale.
+
+## Phase 3: Re-validate the port
+
+Every coverage and saving figure the pack quotes comes from `rtk_port.py`, a
+Python model of rtk's rewrite pipeline. **Anything short of full agreement
+invalidates those numbers until the port is fixed.** Tooling lives in
+`~/rtk-measurement-archive/`.
+
+```bash
+git clone --depth 1 --branch <new-tag> https://github.com/rtk-ai/rtk.git /tmp/rtk-new
+cd ~/rtk-measurement-archive
+
+# Rewrite assertions from the tag's own test block.
+python3 extract_cases.py /tmp/rtk-new/src/discover/registry.rs cases.json
+python3 validate_port.py cases.json
+
+# The entry gate both real hook paths apply before rewrite_command.
+# Its assertions live in lexer.rs; re-extract if that block moved.
+python3 -c "import entry_gate; print('gate import ok')"
+```
+
+Baseline at v0.44.0: **203/203** rewrite assertions, **35/35** gate assertions.
+
+If the port diverges, fix the port first, then re-measure:
+
+```bash
+python3 measure_gated.py gated 0:1224
+```
+
+Measure over the whole transcript pool, never the default 134-file window: at
+that size the projection swings 8.8x on an unchanged mechanism.
+
+### 3.1 Re-measure, do not just re-validate
+
+Port agreement proves rtk still rewrites the same commands. It says nothing
+about how much each rewrite saves, and that is where the value actually sits.
+
+**`rtk grep` carries 4.04 MB of the 5.66 MB measurable saving: 71% of the total
+rests on one family.** If upstream changes that one filter, the headline number
+moves even with the port at full agreement. Measured effectiveness has already
+diverged from expectation in both directions once: `rtk grep` measured 22.3%
+against 9.0% modelled, `rtk rg` 7.0% against 30% modelled.
+
+So on every bump, after the port passes, replay against the newly built binary:
+
+```bash
+python3 replay_rtk.py --pool 1300 --rtk <path-to-the-new-binary>
+```
+
+Compare per family against the recorded baseline:
+
+| Family | Measured at v0.44.0 | Share of total saving |
+|---|---:|---:|
+| `rtk grep` | 22.3% | 71% |
+| `rtk git` | 33.1% | 21% |
+| `rtk find` | 35.6% | 8% |
+
+**Act on the result, do not just record it.** If the total lands below the
+published kill number of **0.05% of input tokens**, the pack has stopped earning
+its supply-chain surface and retiring it is the correct outcome, exactly as the
+in-house filter was retired. The margin at v0.44.0 is 0.0615%, which is 1.23x
+the kill number, so a single-family regression is enough to cross it.
+
+## Phase 4: Rebuild
+
+```bash
+gh workflow run rtk-build.yml --ref main \
+  -f upstream_tag=<new-tag> -f build_revision=1 -f rust_version=<pinned> -f publish=false
+```
+
+Five targets: `x86_64-apple-darwin`, `aarch64-apple-darwin`,
+`x86_64-unknown-linux-musl`, `aarch64-unknown-linux-gnu`,
+`x86_64-pc-windows-msvc`. A target that will not build is dropped, not faked.
+
+Pin `rust_version` explicitly. Upstream uses unpinned `stable` with
+`warnings = "deny"`, so a new rustc lint can turn the build red with no change
+on either side.
+
+**Advisories.** The `audit` job blocks. Re-derive the disposition rather than
+carrying the previous one forward:
+
+```bash
+# Cross-reference the new lockfile against OSV without waiting for CI.
+python3 - <<'PY'
+import json, re, urllib.request, pathlib
+lock = pathlib.Path("/tmp/rtk-new/Cargo.lock").read_text()
+pkgs = [(re.search(r'^name = "([^"]+)"', b, re.M).group(1),
+         re.search(r'^version = "([^"]+)"', b, re.M).group(1))
+        for b in lock.split("[[package]]")[1:]
+        if re.search(r'^name = ', b, re.M) and re.search(r'^version = ', b, re.M)]
+q = [{"package": {"name": n, "ecosystem": "crates.io"}, "version": v} for n, v in pkgs]
+req = urllib.request.Request("https://api.osv.dev/v1/querybatch",
+    data=json.dumps({"queries": q}).encode(), headers={"Content-Type": "application/json"})
+res = json.load(urllib.request.urlopen(req, timeout=60))
+for (n, v), r in zip(pkgs, res["results"]):
+    if r.get("vulns"):
+        print(n, v, [x["id"] for x in r["vulns"]])
+PY
+```
+
+For each advisory decide, and record the reason in the workflow:
+
+- **In-range fix** (`cargo update -p <crate>` works): add the crate to
+  `RTK_CARGO_UPDATES` in `.github/workflows/rtk-build.yml`. Both the audit job
+  and every build job apply it, so we audit what we ship.
+- **Needs a `Cargo.toml` change**: that is a source modification and breaks the
+  NOTICE claim. Ignore with a written reason, or escalate.
+- **Carried-forward ignores**: re-check every `--ignore` still applies. The
+  quick-xml pair exists only because upstream pins `"0.37"`; **delete both the
+  moment upstream moves to 0.41 or later** rather than carrying them.
+
+## Phase 5: Verify
+
+CI asserts this per target and the run fails on any `fail` verdict:
+
+1. `RTK_TELEMETRY_URL` and `RTK_TELEMETRY_TOKEN` unset at build time
+2. the artifact starts and reports the expected version
+3. no telemetry state written into a sandboxed home
+4. on Linux, identical behaviour with no network route
+5. every archive holds exactly one flat entry
+
+Then check by hand:
+
+```bash
+gh run download <run-id> --dir /tmp/rtk-verify
+cd /tmp/rtk-verify && shasum -a 256 -c checksums.txt
+```
+
+Three things CI cannot tell you:
+
+- **`strings` markers.** Compare `tls_markers_present` per target against the
+  previous build. Their absence is an LLVM outcome under LTO, not a guarantee,
+  so a sudden appearance means the telemetry stack survived and is worth
+  understanding before shipping.
+- **Reproducibility.** Four of five targets are bit-reproducible; compare
+  extracted binaries, never the tarballs, because gzip records a timestamp.
+  `x86_64-pc-windows-msvc` differs by 24 bytes per link (MSVC timestamp plus a
+  CodeView GUID), so a changed Windows digest proves nothing on its own.
+- **Upstream has no test asserting network silence.** That property can regress
+  on any bump without turning their CI red. We own it.
+
+## Phase 6: Publish
+
+```bash
+gh workflow run rtk-build.yml --ref main \
+  -f upstream_tag=<new-tag> -f build_revision=1 -f rust_version=<pinned> -f publish=true
+```
+
+Creates `softspark-rtk-<upstream>-<revision>`. Bump the revision, not the
+upstream part, when rebuilding the same upstream tag.
+
+## Phase 7: Bump the pack
+
+In `app/plugins/rtk-pack/plugin.json`:
+
+- `upstream.version` to the new tag
+- `binary.release_tag` to the new release
+- every `assets.*.sha256` from the published `checksums.txt`
+- `version` (the pack's own) — bump it whether or not the upstream tag moved,
+  because `plugin update` skips a pack whose recorded version still matches, so
+  an unbumped pack never reaches installed users. The two fields are separate so
+  a pack-only fix does not pretend to be an upstream bump
+
+Then:
+
+```bash
+npm test          # tests/test_rtk_pack.bats asserts digest shape and layout
+python3 scripts/validate.py --strict
+python3 scripts/audit_skills.py --ci
+shellcheck --severity=warning app/hooks/*.sh app/plugins/*/hooks/*.sh
+```
+
+Verify a real install end to end, against the published release rather than a
+mirror:
+
+```bash
+H=$(mktemp -d)
+AI_TOOLKIT_DATA_DIR="$H" python3 app/plugins/rtk-pack/scripts/init.py
+AI_TOOLKIT_DATA_DIR="$H" python3 app/plugins/rtk-pack/scripts/status.py
+```
+
+## Phase 8: Ship
+
+The pack version bump reaches installed users through `ai-toolkit update`,
+which runs `plugin update --editor all --all`. A pack whose recorded version
+matches its manifest is skipped silently, so the bump in Phase 7 is what makes
+the update fire at all. Forgetting it means nobody gets the new binary.
+
+## Phase 9: Record the licence position
+
+If upstream relicenses, adds a `NOTICE`, or changes `DISCLAIMER.md`, update the
+NOTICE generated in `.github/workflows/rtk-build.yml`. It currently records two
+build-time differences: the undefined telemetry endpoint, and in-range lockfile
+security updates. If Phase 4 changes that set, the NOTICE text changes with it.
+
+`DISCLAIMER.md` is deliberately not redistributed because it states telemetry is
+collected by default, which our builds contradict. Re-check that this is still
+the reason before changing the decision.
+
+## Related
+
+- `kb/history/completed/rtk-pack-integration-20260726.md` — decisions, measurements, pre-mortem
+- `kb/history/completed/output-filter-retirement-20260726.md` — why premise validation comes first
+- `app/plugins/rtk-pack/README.md` — the user-facing trust boundary

package/kb/reference/architecture-overview.md

@@ -3,9 +3,9 @@ title: "AI Toolkit - Architecture Overview"
 category: reference
 service: ai-toolkit
 tags: [architecture, overview, design, structure]
-version: "1.5.0"
+version: "1.6.0"
 created: "2026-03-23"
-last_updated: "2026-07-23"
+last_updated: "2026-07-26"
 description: "Architecture of ai-toolkit: directory layout, Claude app export, global install model, editor-aware MCP install, Codex translation layer, skill tiers, and integration with projects."
 ---
 
@@ -300,7 +300,6 @@ Agents (code-reviewer, debugger, devops-implementer, ...)
 | UserPromptSubmit | Before user prompt execution | `track-usage.sh` | Record skill invocations to stats.json |
 | PostToolUse | After edit/write tools | `post-tool-use.sh` | Lightweight validation reminders |
 | PostToolUse | After any tool | `governance-capture.sh` | Log security-sensitive operations |
-| PostToolUse | After successful Bash | `filter-tool-output.sh` | Observe eligible text or replace it only after exact recovery succeeds; Claude Code only |
 | Stop | After response | `quality-check.sh` | Multi-language lint |
 | Stop | After response | `save-session.sh` | Persist session context |
 | Stop | Before final stop | `quality-gate.sh` | Block final response on lint/type errors |

package/kb/reference/cli-reference.md

@@ -2,9 +2,9 @@
 title: "CLI Reference"
 category: reference
 service: ai-toolkit
-tags: [cli, commands, reference, install, update, plugin, mcp, telemetry, output-filter]
+tags: [cli, commands, reference, install, update, plugin, mcp, telemetry]
 created: "2026-04-13"
-last_updated: "2026-07-23"
+last_updated: "2026-07-26"
 description: "Complete CLI reference for all ai-toolkit commands, options, and flags."
 ---
 
@@ -58,7 +58,7 @@ Usage: ai-toolkit <command> [options]
 |---------|-------------|
 | `plugin list` | Show available plugin packs with install status |
 | `plugin install <name> [--editor claude\|codex\|all]` | Install a plugin pack for Claude Code and/or Codex (`claude` means Claude Code, not the Claude app) |
-| `plugin install --all [--editor claude\|codex\|all]` | Install all 11 plugin packs |
+| `plugin install --all [--editor claude\|codex\|all]` | Install all 12 plugin packs |
 | `plugin update <name> [--editor claude\|codex\|all]` | Update a plugin pack (remove + reinstall, preserves data) |
 | `plugin update --all [--editor claude\|codex\|all]` | Update all installed plugin packs |
 | `plugin clean <name> [--days N]` | Prune old plugin data (default: 90 days) |
@@ -79,18 +79,8 @@ Usage: ai-toolkit <command> [options]
 
 | Command | Description |
 |---------|-------------|
-| `output-filter status [--policy PATH]` | Print the effective trusted project/global policy, or inspect an explicit policy |
-| `output-filter inspect --profile repeat-lines\|tap-success` | Read stdin and print content-free candidate metadata without changing or echoing the input |
-| `output-filter recover <handle> [--base-directory PATH] [--session-id ID]` | Print the exact stored native response object for an opaque recovery handle |
-| `output-filter clean [--base-directory PATH] [--session-id ID]` | Remove owned filter artifacts for one session or all sessions in the current repository |
-| `output-filter clean --session-id ID --expired` | Remove expired exact-response artifacts for one native session |
-| `output-filter hook --policy PATH` | **Internal, not for manual use.** `PostToolUse` entry point that reads the native hook payload on stdin and emits any replacement. The installed hook `filter-tool-output.sh` calls the same runtime through the lean `output_filter_hook.py` process instead |
-
-`off` is the default. Configure `toolOutputFilter.mode` in
-`.softspark-toolkit.json`, then run `install --local` or `update --local`.
+
 `AI_TOOLKIT_OUTPUT_FILTER_DISABLE=1` bypasses active filtering immediately.
-See [Native Tool Output Filter](tool-output-filter.md) for eligibility,
-privacy, recovery, and runtime support.
 
 ## Project Registry
 

package/kb/reference/enterprise-config-guide.md

@@ -10,7 +10,7 @@ tags:
   - multi-repo
 doc_type: reference
 created: "2026-04-11"
-last_updated: "2026-07-23"
+last_updated: "2026-07-26"
 description: "Comprehensive guide for setting up and using ai-toolkit configuration inheritance. Covers base config creation, project setup, enforcement rules, CI integration, and troubleshooting."
 ---
 
@@ -77,7 +77,6 @@ ai-toolkit config check       # CI enforcement check
 |-------|------|-------------|
 | `extends` | string | Base config source (npm, git URL, local path) |
 | `profile` | enum | `minimal`, `standard`, `strict`, `full`, `offline-slm` |
-| `toolOutputFilter` | object | Native Bash result filtering policy: mode, profiles, savings thresholds, and recovery limits |
 | `agents` | object | `enabled`, `disabled`, `custom` arrays |
 | `plugins` | object | Resolved `enabled` and `disabled` plugin intent |
 | `rules` | object | `inject`, `remove` arrays |
@@ -157,25 +156,6 @@ effective intent explicit and causes validation to reject a conflicting
 `plugins.disabled` entry. Install the named plugin pack separately with
 `ai-toolkit plugin install <name>` or your organization deployment workflow.
 
-### Native tool-output filtering
-
-Projects can opt into the dependency-free output filter without changing the
-organization-wide default:
-
-```json
-{
-  "toolOutputFilter": {
-    "mode": "observe",
-    "profiles": ["repeat-lines", "tap-success"]
-  }
-}
-```
-
-`ai-toolkit install --local` materializes the effective policy as the managed
-`.claude/ai-toolkit-output-filter.json` file. `off` is the default, `observe`
-collects metadata without changing model-visible output, and `safe` permits
-replacement only when every invariant and exact-recovery check succeeds.
-
 ### Overrides
 
 Projects can override base settings, but must declare intent:

package/kb/reference/hooks-catalog.md

@@ -3,9 +3,9 @@ title: "Hooks Catalog"
 category: reference
 service: ai-toolkit
 tags: [hooks, quality, safety, enforcement, settings.json]
-version: "1.8.0"
+version: "1.9.0"
 created: "2026-03-27"
-last_updated: "2026-07-23"
+last_updated: "2026-07-26"
 description: "Complete reference of all ai-toolkit hooks: events, scripts, installation, and runtime behavior."
 ---
 
@@ -31,9 +31,6 @@ ai-toolkit update     # re-copies scripts, re-merges (idempotent)
 **File locations:**
 
 - Scripts: `~/.softspark/ai-toolkit/hooks/*.sh`
-- Output-filter runtime: `~/.softspark/ai-toolkit/scripts/output_filter_hook.py`, `output_filter_cli.py`, and `tool_output_filter/`
-- Global output-filter policy: `~/.softspark/ai-toolkit/hooks/output-filter-policy.json`
-- Managed project policy: `<project>/.claude/ai-toolkit-output-filter.json`
 - Config: `~/.claude/settings.json` → `hooks` key
 - Source: `ai-toolkit/app/hooks/*.sh` + `app/hooks.json`
 
@@ -178,59 +175,6 @@ arms the corrective Stop hook.
 
 Skipped when `TOOLKIT_HOOK_PROFILE=minimal`.
 
-### PostToolUse (native Bash output filter): `filter-tool-output.sh`
-
-| Field | Value |
-|-------|-------|
-| Event | `PostToolUse` |
-| Matcher | `Bash` |
-| Script | `~/.softspark/ai-toolkit/hooks/filter-tool-output.sh` |
-| Fires | After a successful Claude Code Bash tool call |
-
-The hook is disabled by default and runs last among the installed
-`PostToolUse` handlers. Its modes are:
-
-| Mode | Behavior |
-|------|----------|
-| `off` | Shell fast path exits before Python starts |
-| `observe` | Evaluates eligible output and writes content-free metadata, but emits no replacement |
-| `safe` | Replaces eligible output only after invariants pass and the exact native response is stored for recovery |
-
-Only explicitly allowlisted test, lint, typecheck, and validation command
-shapes are eligible. Failed or interrupted tools, non-empty stderr, image or
-binary results, pipes, redirects, deployment, migrations, audits, security
-scanners, malformed payloads, unavailable recovery, and any uncertain case
-remain unchanged.
-
-The per-project policy `<project>/.claude/ai-toolkit-output-filter.json` is
-honored only when **both** checks pass: the project root is registered in
-`~/.softspark/ai-toolkit/projects.json`, and the sibling regular file
-`<project>/.claude/.ai-toolkit-output-filter.owner` holds the ai-toolkit owner
-marker. `ai-toolkit install --local` writes both. Registration is required
-because the owner marker is a public constant, so a cloned or untrusted
-checkout must never be able to self-enable filtering by shipping its own
-marker. An unregistered project, a missing or foreign marker, or a symlinked
-project root or `.claude` directory falls back to the installed global policy
-at `~/.softspark/ai-toolkit/hooks/output-filter-policy.json`, which ships as
-`off`.
-
-`jq` is a required system dependency (`python3 scripts/check_deps.py`
-verifies it alongside `python3`, `git`, and `node`); without it `guard-path.sh`
-blocks file tools rather than skipping path validation.
-
-Recovery data is private and session-scoped under
-`~/.softspark/ai-toolkit/sessions/<repo-key>/output-filter/`. Telemetry records
-only profile/version, byte and line counts, latency, outcome, and fallback
-reason. Recovery-backed modes require a bounded native session ID containing
-only ASCII letters, digits, underscores, or hyphens. Three consecutive
-profile, invariant, or recovery safety failures open a session circuit
-breaker. Set `AI_TOOLKIT_OUTPUT_FILTER_DISABLE=1` for an immediate bypass.
-
-The replacement adapter is Claude Code-specific. Claude Chat/Cowork exports
-exclude it, and the generated hooks for other editors do not activate it.
-The `minimal` hook profile and `AI_TOOLKIT_DISABLED_HOOKS=filter-tool-output`
-bypass it before the Python runtime starts.
-
 ### Stop (quality check) — `quality-check.sh`
 
 | Field | Value |
@@ -344,8 +288,7 @@ Skipped when `TOOLKIT_HOOK_PROFILE=minimal`.
 | Script | `~/.softspark/ai-toolkit/hooks/session-end.sh` |
 | Fires | When a Claude session ends |
 
-**Action:** Removes private output-filter artifacts and isolated edit state for
-the ending native session, then writes `session-end.md` to the per-repo session store
+**Action:** Removes isolated edit state for the ending native session, then writes `session-end.md` to the per-repo session store
 (`~/.softspark/ai-toolkit/sessions/<repo-key>/`) with a lightweight handoff note
 for the next session.
 

package/kb/reference/plugin-pack-conventions.md

@@ -72,10 +72,10 @@ Required keys:
 ## CLI Management
 
 ```bash
-ai-toolkit plugin list               # show all 11 packs with install status
+ai-toolkit plugin list               # show all 12 packs with install status
 ai-toolkit plugin install --editor claude <name>   # Claude Code global target
 ai-toolkit plugin install --editor codex <name>    # Codex global target
-ai-toolkit plugin install --editor all --all       # install all 11 packs for both runtimes
+ai-toolkit plugin install --editor all --all       # install all 12 packs for both runtimes
 ai-toolkit plugin update --editor all --all        # update all installed packs
 ai-toolkit plugin clean <name>       # prune data older than 90 days (default)
 ai-toolkit plugin clean <name> --days 30  # prune data older than 30 days
@@ -138,6 +138,21 @@ ai-toolkit plugin status --editor all              # show installed packs with r
 | `kotlin-pack` | kotlin | 0 | 1 | 0 | Kotlin patterns |
 | `swift-pack` | swift | 0 | 1 | 0 | Swift patterns |
 | `ruby-pack` | ruby | 0 | 1 | 0 | Ruby patterns |
+| `rtk-pack` | token-reduction | 0 | 0 | 1 | Command rewriting via a checksum-pinned rtk binary fetched at install |
+
+`rtk-pack` is the first pack to break three assumptions the others share, so it
+is the one to read when extending the contract:
+
+- **It fetches from the network at install time.** `scripts/init.py` downloads a
+  platform-specific artifact and verifies its SHA-256 against `plugin.json`
+  before installing anything. A mismatch aborts and leaves nothing behind.
+- **It declares platform assets and digests in `plugin.json`.** The manifest
+  schema tolerates extra keys, so `upstream` and `binary` are additive; nothing
+  validates them, which means a malformed block fails at install rather than in
+  `validate.py --strict`.
+- **It reports its own health.** `scripts/status.py` is picked up generically by
+  `plugin status`, replacing what used to be a hardcoded `if name == "memory-pack"`
+  branch. Any pack can now ship one.
 
 ## Optional Hook Modules
 

package/kb/reference/supported-tools-registry.md

@@ -33,7 +33,6 @@ The canonical data lives in **`scripts/ecosystem_tools.json`** and is consumed b
 | Our generators | — (Claude Code is the primary target; toolkit content ships directly as `.md` files and `settings.json` merges) |
 | Tracked hook events | Core: `SessionStart`, `SessionEnd`, `UserPromptSubmit`, `Notification`, `MessageDisplay`. Tool: `PreToolUse`, `PostToolUse`, `PostToolUseFailure`, `PostToolBatch`. Turn: `Stop`, `StopFailure`, `UserPromptExpansion`. Subagent: `SubagentStart`, `SubagentStop`. Compaction: `PreCompact`, `PostCompact`. Permissions: `PermissionRequest`, `PermissionDenied`. Elicitation: `Elicitation`, `ElicitationResult`. Teams: `TaskCreated`, `TaskCompleted`, `TeammateIdle`. Worktrees/env: `WorktreeCreate`, `WorktreeRemove`, `CwdChanged`, `FileChanged`, `ConfigChange`. Setup: `Setup`, `InstructionsLoaded` |
 | Tracked handler types | `command`, `prompt`, `agent`, `mcp_tool`, `http` (POST event JSON to allowlisted URLs via `allowedHttpHookUrls`) |
-| Tool-output replacement | Native `PostToolUse.updatedToolOutput`; ai-toolkit exposes dependency-free `off`, byte-identical `observe`, and opt-in recoverable `safe` modes for eligible successful Bash text |
 | Other capabilities | slash commands, MCP server/client, sub-agent, output style, `SKILL.md` (≥500 lines warn) |
 | Version probe | `claude --version` |
 | Notes | v2.1.169 added `disableBundledSkills` setting + `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS` env var (hides bundled skills/built-in slash commands from the model; toolkit skills in `.claude/skills/` are unaffected — useful when toolkit skills overlap built-ins) and `claude --safe-mode` / `CLAUDE_CODE_SAFE_MODE` (starts with hooks, skills, agents, and CLAUDE.md disabled — first isolation step when debugging toolkit rule enforcement). `fallbackModel` settings key (v2.1.166) noted as not-adopted (class C, no toolkit surface writes model settings). |
@@ -53,7 +52,6 @@ The canonical data lives in **`scripts/ecosystem_tools.json`** and is consumed b
 | Plugin layout | `.claude-plugin/plugin.json`, `skills/*/SKILL.md`, `agents/*.md`, `hooks/hooks.json`; ai-toolkit uses manifest paths under `claude-app/` for its generated app-only rules and hooks |
 | Our generator | `scripts/claude_app.py` (`ai-toolkit claude-app export`) |
 | Runtime split | Skills work in Chat (web/Desktop) and Cowork. Hooks and sub-agents run only in Cowork. Claude app does **not** scan Claude Code's `~/.claude/rules/`, `CLAUDE.md`, or `~/.claude/settings.json`. |
-| Tool-output replacement | Not shipped. The Claude Code-only filter hook and runtime are excluded from the app archive until Cowork has an independently verified replacement contract. |
 | Install/update | Export the ZIP, upload it from `Customize > Plugins`, then paste the generated global-instructions file into `Settings > Cowork > Global instructions`. Re-export/re-upload after toolkit updates. |
 
 ---
@@ -201,7 +199,6 @@ The canonical data lives in **`scripts/ecosystem_tools.json`** and is consumed b
 | Our generators | `scripts/generate_codex.py`, `scripts/generate_codex_agents.py` (native custom-agent TOML), `scripts/generate_codex_hooks.py`, `scripts/generate_codex_skills.py` (opt-in via `--codex-skills`) |
 | Rules delivery | Universal coding rules are inlined into `AGENTS.md` (Codex reads instructions only from AGENTS.md, not `.agents/rules/`); language rules ship as `<lang>-rules` skills under `.agents/skills/`. Global install writes `~/.codex/AGENTS.md` (not `~/AGENTS.md`, which Codex never loads globally); plugin-pack rules are marker-injected into the same file. `project_doc_max_bytes` default is 32 KiB and Codex silently truncates AGENTS.md past that (see codex-cli-compatibility.md). |
 | Tracked hook events | Upstream canonical (codex-rs `HookEventName` enum): `PreToolUse`, `PostToolUse`, `PermissionRequest`, `PreCompact`, `PostCompact`, `SessionStart`, `UserPromptSubmit`, `SubagentStart`, `SubagentStop`, `Stop` (10 events). We wire 9 through an explicit Codex map, including destructive-command and wrong-home path guards on both Bash `PreToolUse` and `PermissionRequest`. `PostCompact` is not wired (its only hook was the removed environment-snapshot probe). |
-| Tool-output replacement | Manual `ai-toolkit output-filter inspect` only. The Claude-specific `updatedToolOutput` adapter is not emitted into Codex hooks. |
 | Tracked handler types | `command` (emitted by default; the only handler Codex actually runs). `prompt` and `agent` are parsed by Codex but NOT yet executed, so hand-authored handlers of those types are inert. |
 | Other capabilities | `AGENTS.md`, `config.toml`, `mcp_servers`, sandbox policies, `.agents/skills/*/SKILL.md` (native Codex skill discovery path), `.codex/agents/*.toml` (native custom agents) |
 | Version probe | `codex --version` |
@@ -216,7 +213,6 @@ The canonical data lives in **`scripts/ecosystem_tools.json`** and is consumed b
 | Config paths | `opencode.json`, `.opencode/agents/*.md`, `.opencode/commands/*.md`, `.opencode/plugins/*`, `.opencode/skills/*/SKILL.md` (v1.14+), `AGENTS.md`; skill fallback discovery: `.claude/skills/`, `.agents/skills/`, `~/.config/opencode/skills/`, `~/.claude/skills/`, `~/.agents/skills/` |
 | Our generators | `scripts/generate_opencode.py`, `scripts/generate_opencode_agents.py`, `scripts/generate_opencode_commands.py`, `scripts/generate_opencode_json.py`, `scripts/generate_opencode_plugin.py` |
 | Hook isolation | Tool hooks preserve native `sessionID` as normalized `session_id`; exit code 2 from a blocking pre-tool guard is raised back to OpenCode instead of being ignored. |
-| Tool-output replacement | Manual `ai-toolkit output-filter inspect` only. No active OpenCode output adapter is shipped. |
 | Tracked plugin events | `session.created`, `session.compacted`, `session.deleted`, `message.updated`, `tool.execute.before`, `tool.execute.after`, `permission.asked`, `command.executed` |
 | Other capabilities | `opencode.json` config, primary + subagent modes, `@`-mention subagents, `/`-invocation commands, MCP (local + remote), plugin hooks in JS/TS, native `SKILL.md` discovery with Claude-compatible fallback, `permission.skill.*` matrix |
 | Version probe | `opencode --version` |