@try-works/dsh-recursive-mode 0.4.9 → 0.6.0

package/references/artifact-template.md

@@ -2437,49 +2437,32 @@ Approval: PASS
 
 Before locking (or when a lock verification fails unexpectedly), lint the run artifacts for required header fields, required section headings, and TODO completion rules:
 
-```powershell
-# Python (cross-platform):
-python ./.agents/skills/recursive-mode/scripts/lint-recursive-run.py --run-id "<run-id>"
-# Or, when running from this repo:
-python ./.recursive/scripts/lint-recursive-run.py --run-id "<run-id>"
-python3 ./.agents/skills/recursive-mode/scripts/lint-recursive-run.py --run-id "<run-id>"
-python3 ./.recursive/scripts/lint-recursive-run.py --run-id "<run-id>"
-
-# Treat WARN as FAIL
-python ./.agents/skills/recursive-mode/scripts/lint-recursive-run.py --run-id "<run-id>" --strict
-python ./.recursive/scripts/lint-recursive-run.py --run-id "<run-id>" --strict
-python3 ./.agents/skills/recursive-mode/scripts/lint-recursive-run.py --run-id "<run-id>" --strict
-python3 ./.recursive/scripts/lint-recursive-run.py --run-id "<run-id>" --strict
-
-# Lint specific run
-.\.agents\skills\recursive-mode\scripts\lint-recursive-run.ps1 -RunId "<run-id>"
-# Or, when running from this repo:
-.\scripts\lint-recursive-run.ps1 -RunId "<run-id>"
-
-# Treat WARN as FAIL
-.\.agents\skills\recursive-mode\scripts\lint-recursive-run.ps1 -RunId "<run-id>" -Strict
-.\scripts\lint-recursive-run.ps1 -RunId "<run-id>" -Strict
+```text
+# One artifact (defaults to the run's current phase). `mode: "summary"` returns a few
+# findings plus the true totals; `full` (default) returns up to 200 per list. When a list
+# is clipped, `elided` says how many and how to see the rest.
+recursive_lint  { "runId": "<run-id>", "artifact": "<artifact>.md", "mode": "summary" }
+
+# Treat WARN as FAIL is not a flag here: `errors` are the failures, `warnings` are not,
+# and both lists come back with their true `failCount`/`warnCount`.
+
+# The same read, from the slash-command surface
+/recursive status <run-id>
 ```
 
+This plugin is TypeScript and runs the linter in-process: there is no `lint-recursive-run.py`/`.ps1` to call, and no `.recursive/scripts/` to call it from.
+
 ## Locking Commands
 
 Preferred:
 
-```powershell
-# Python (cross-platform)
-python ./.agents/skills/recursive-mode/scripts/recursive-lock.py --run-id "<run-id>" --artifact "<artifact>.md"
-# Or, when running from this repo:
-python ./.recursive/scripts/recursive-lock.py --run-id "<run-id>" --artifact "<artifact>.md"
-python3 ./.agents/skills/recursive-mode/scripts/recursive-lock.py --run-id "<run-id>" --artifact "<artifact>.md"
-python3 ./.recursive/scripts/recursive-lock.py --run-id "<run-id>" --artifact "<artifact>.md"
-
-# PowerShell
-.\.agents\skills\recursive-mode\scripts\recursive-lock.ps1 -RunId "<run-id>" -Artifact "<artifact>.md"
-# Or, when running from this repo:
-.\scripts\recursive-lock.ps1 -RunId "<run-id>" -Artifact "<artifact>.md"
+```text
+# Lock one artifact once its gates pass. It refuses a lock whose gates or whose earlier
+# phases are unmet, and writes Status: LOCKED, LockedAt and LockHash.
+recursive_lock  { "runId": "<run-id>", "artifact": "<artifact>.md" }
 ```
 
-The lock command is the primary supported path. It must refuse to lock artifacts whose required gates or lint-critical structure are still invalid.
+The lock tool is the primary supported path. It refuses to lock artifacts whose required gates or lint-critical structure are still invalid.
 
 Manual fallback for hash computation only:
 
@@ -2521,34 +2504,16 @@ sed '/^LockHash:/d' .recursive/run/<run-id>/<artifact>.md | tr -d '\r' | sha256s
 
 ### Automated Verification
 
-Use the provided script to verify all locks in a run:
+Use the plugin's own tool to verify all locks in a run — there is no verifier script:
 
-```bash
-# Verify specific run
-python ./.agents/skills/recursive-mode/scripts/verify-locks.py --run-id "<run-id>"
-# Or, when running from this repo:
-python ./.recursive/scripts/verify-locks.py --run-id "<run-id>"
-python3 ./.agents/skills/recursive-mode/scripts/verify-locks.py --run-id "<run-id>"
-python3 ./.recursive/scripts/verify-locks.py --run-id "<run-id>"
-
-# Fix incorrect hashes (use with caution)
-python ./.agents/skills/recursive-mode/scripts/verify-locks.py --run-id "<run-id>" --fix
-# Or, when running from this repo:
-python ./.recursive/scripts/verify-locks.py --run-id "<run-id>" --fix
-python3 ./.agents/skills/recursive-mode/scripts/verify-locks.py --run-id "<run-id>" --fix
-python3 ./.recursive/scripts/verify-locks.py --run-id "<run-id>" --fix
-```
+```text
+# One run: the phase table and per-artifact lock state. A LockHash that no longer matches
+# its content is reported as TAMPERED, named against the receipt it was locked under.
+recursive_status  { "runId": "<run-id>" }
 
-```powershell
-# Verify specific run
-.\.agents\skills\recursive-mode\scripts\verify-locks.ps1 -RunId "<run-id>"
-# Or, when running from this repo:
-.\scripts\verify-locks.ps1 -RunId "<run-id>"
-
-# Fix incorrect hashes (use with caution)
-.\.agents\skills\recursive-mode\scripts\verify-locks.ps1 -RunId "<run-id>" -Fix
-# Or, when running from this repo:
-.\scripts\verify-locks.ps1 -RunId "<run-id>" -Fix
+# There is deliberately no `--fix`. Re-hashing a changed artifact would erase the only
+# evidence that it changed, so the mismatch is reported and the decision (restore the
+# content, or record an addendum) stays with the agent.
 ```
 
 ### Manual Verification

package/references/bodies/claude.md

@@ -3,5 +3,5 @@
 - Canonical repository memory lives under `/.recursive/memory/`.
 - Read `/.recursive/memory/MEMORY.md` before loading any other memory docs.
 - Load only the memory docs relevant to the current task.
-- When repository experiential memory may help, run `python .recursive/scripts/recursive-training-loader.py --repo-root . --query "<task>" --files "<path1,path2>"`.
+- When repository experiential memory may help, load it through the plugin's own TS loader: `recursive_phase` returns the prior-run memory shards relevant to this run and phase (with the reason when none matched), and `/recursive memory "<task>" [--phase <nn>]` prints the same selection with its score components. There is no script to run and no `.recursive/scripts/` step — retrieval is in-process.
 - Treat this file as a pointer only; the canonical memory store remains `/.recursive/memory/`.

package/references/bodies/copilot.md

@@ -3,5 +3,5 @@
 - Canonical repository memory lives under `/.recursive/memory/`.
 - Read `/.recursive/memory/MEMORY.md` before loading any other memory docs.
 - Load only the memory docs relevant to the current task.
-- When repository experiential memory may help, run `python .recursive/scripts/recursive-training-loader.py --repo-root . --query "<task>" --files "<path1,path2>"`.
+- When repository experiential memory may help, load it through the plugin's own TS loader: `recursive_phase` returns the prior-run memory shards relevant to this run and phase (with the reason when none matched), and `/recursive memory "<task>" [--phase <nn>]` prints the same selection with its score components. There is no script to run and no `.recursive/scripts/` step — retrieval is in-process.
 - Treat this file as a pointer only; the canonical memory store remains `/.recursive/memory/`.

package/references/bodies/cursorrules.md

@@ -2,6 +2,8 @@
 # Canonical repository memory lives under `/.recursive/memory/`.
 # Read `/.recursive/memory/MEMORY.md` before loading any other memory docs.
 # Load only the memory docs relevant to the current task.
-# When repository experiential memory may help, run:
-#   python .recursive/scripts/recursive-training-loader.py --repo-root . --query "<task>" --files "<path1,path2>"
+# When repository experiential memory may help, load it through the plugin's own TS loader: the
+# `recursive_phase` tool returns the prior-run memory shards relevant to this run and phase (with the
+# reason when none matched), and `/recursive memory "<task>" [--phase <nn>]` prints the same selection
+# with its score components. There is no script to run and no `.recursive/scripts/` step.
 # This file is only a pointer surface; the canonical memory store remains `/.recursive/memory/`.

package/references/bodies/memory-router.md

@@ -16,7 +16,7 @@ Control-plane docs are not memory docs:
 - Read this file before loading any other memory docs.
 - Load only the memory docs relevant to the current task.
 - If the task may benefit from prior recursive-mode experiential learnings, use this index to identify the relevant docs under `/.recursive/memory/training/` and `/.recursive/memory/domains/`.
-- The optional `recursive-training-sync.py` helper is read-only; it prints startup guidance about what to read, but does not modify `MEMORY.md` or the memory plane.
+- The plugin loads this plane **in-process, in TypeScript**: the `recursive_phase` tool returns the shards that match the run and the phase in play, and `/recursive memory "<task>" [--phase <nn>]` prints the same selection with the score component behind every shard and a reason for every shard it left out. There is no `recursive-training-loader`/`recursive-training-sync` script to run and no `.recursive/scripts/` helper in this plugin.
 - If the task plans delegated review, subagent help, review bundles, smoke-harness portability work, or capability-sensitive execution, read `/.recursive/memory/skills/SKILLS.md` and then load the relevant skill-memory shards.
 - If Phase 8 will need to promote durable lessons, first capture run-local skill usage in the run artifact and only then promote generalized conclusions into skill-memory shards.
 - Prefer `Status: CURRENT` docs for planning and execution.

package/references/bodies/recursive-agents-router.md

@@ -48,10 +48,11 @@ It exists to reduce blind doc-by-doc scanning. It is not a second workflow spec.
   - the installed `recursive-router`, `recursive-subagent`, and `recursive-review-bundle` skills
 - Working on memory behavior:
   - `/.recursive/memory/MEMORY.md`
-  - the installed `recursive-training` skill
-  - `/.recursive/scripts/recursive-training-loader.py`
-  - `/.recursive/memory/training/`
+  - the memory shards themselves: `/.recursive/memory/domains/`, `/.recursive/memory/training/`, and the rest of the registry in `MEMORY.md`
+  - the plugin's **TS** memory surfaces — `recursive_phase` (injects the shards that match this run and phase) and `/recursive memory "<task>" [--phase <nn>]` (the same selection, printed with its score components)
+  - `recursive_closeout --phase 08` for the run-close training trigger, which runs in-process; its extractor is the operator environment variable `RECURSIVE_TRAINING_EXTRACTOR_CMD`
   - `/.recursive/memory/skills/SKILLS.md`
+  - ⚠ there is no `.recursive/scripts/` helper and no Python anywhere in this plugin — lint, lock, status, closeout and retrieval all run in-process, so a script path is not a route to any of them
 
 ## Non-Canonical Bridges
 

package/references/bootstrap/RECURSIVE.md

@@ -90,8 +90,8 @@ Required read behavior:
 - If relevant prior runs are found, read only the docs needed from those runs to understand the affected codebase areas before writing the new run artifacts.
 - If no relevant prior runs are identified, skip that step.
 - After reading `MEMORY.md`, load only the memory docs relevant to the current task. Do not load the entire memory tree by default.
-- If the task may benefit from prior experiential learnings, load only the relevant docs under `/.recursive/memory/training/` and `/.recursive/memory/domains/`, preferably by using the training loader with filesystem-backed discovery.
-- If the optional `recursive-training` skill is installed, run `/.recursive/scripts/recursive-training-loader.py` after reading `MEMORY.md` and before planning or implementation whenever the task may benefit from experiential memory. If no automatic hook is wired, the agent must still manually load relevant training docs from the memory index when they matter.
+- If the task may benefit from prior experiential learnings, load only the relevant docs under `/.recursive/memory/training/` and `/.recursive/memory/domains/`.
+- The plugin loads those docs itself, **in-process and in TypeScript**: call `recursive_phase` on entering a phase and it returns the memory shards that match the run and the phase in play, with the reason stated when none matched. For an on-demand lookup, `/recursive memory "<task>" [--phase <nn>]` prints the same selection with the score component behind each shard and a reason for each shard it excluded. Nothing is loaded by running a script — this plugin ships no `.recursive/scripts/` helper and no Python — and nothing is ever fabricated: an empty result means continue normally.
 - If the run plans delegated review, subagent help, review bundles, smoke harness portability work, or other skill-sensitive execution, load `/.recursive/memory/skills/SKILLS.md` and the relevant skill-memory shards before planning or auditing.
 - Prefer `Status: CURRENT` memory docs for planning/execution.
 - `Status: SUSPECT` memory docs may be used as leads but must be revalidated before trust.
@@ -559,9 +559,10 @@ Phase 8 — Memory maintenance and impact review
 - Audit must verify memory updates and status transitions against reviewed final product/worktree paths, touched memory docs, prior memory truth, `STATE.md`, and `DECISIONS.md`
 - Must include `## Run-Local Skill Usage Capture` with concrete availability / attempted / used / worked-well / issue / recommendation fields whenever skill usage is relevant to the run
 - Must include `## Skill Memory Promotion Review` explaining what durable lessons were promoted, what stayed run-local, and why
-- If the optional `recursive-training` skill is installed, run `/.recursive/scripts/recursive-training-phase8-trigger.py` immediately after `08-memory-impact.md` locks to extract or refresh cross-run experiential learnings.
-- `recursive-lock` does not invoke training by itself. After Phase 8 locks, either run the trigger directly or re-run `recursive-closeout --phase 08` (without `--force`) so the helper can call `recursive-training-phase8-trigger.py --auto`.
-- Treat trigger/GRPO exit `2` (extractor unavailable) and exit `3` (zero items written) as unsuccessful training; do not claim the memory plane was updated.
+- The training pass runs **in-process**: re-run the closeout for the phase — `recursive_closeout` with `phase 08` for a run whose `08-memory-impact.md` has already been closed out once — and the plugin's phase-8 trigger extracts or refreshes cross-run experiential learnings then.
+- `recursive_lock` does not invoke training by itself, and neither does the FIRST closeout of phase 08: training at the first lock would train the run on itself. The trigger fires on the closeout **re-run**, and it needs at least two runs with a LOCKED `08-memory-impact.md` before it will extract — one run is an anecdote, not evidence. There is no trigger script to run.
+- The extractor is the operator environment variable `RECURSIVE_TRAINING_EXTRACTOR_CMD`, and its answer comes back through a response file rather than a pipe. An unset command is a named failure, never a silent success.
+- Treat trigger exit `2` (extractor unavailable) and exit `3` (nothing usable to extract, including too little evidence) as unsuccessful training; do not claim the memory plane was updated.
 - **TODO Requirement:** Phase artifact MUST include `## TODO` section with checkable items
 - **TODO Enforcement:** ALL TODO items must be checked off before locking
 - **Completion rule:** the run is not fully complete before Phase 8 passes
@@ -752,7 +753,7 @@ Recursive phases are one-way. Iteration is allowed within a phase, but after a p
 ### DRAFT vs LOCKED
 
 - While a phase is in progress, its output artifact status is `DRAFT`. The agent may revise it until both gates pass.
-- When both gates pass, the agent must lock the artifact with `.recursive/scripts/recursive-lock.py` or `.recursive/scripts/recursive-lock.ps1`. The lock command is the primary supported path and must:
+- When both gates pass, the agent must lock the artifact with the **`recursive_lock` tool**. It is the primary supported path and it must:
   1) verify the artifact is lockable,
   2) set Status to `LOCKED`,
   3) set `LockedAt`,
@@ -779,11 +780,11 @@ that contains its own hash.
 
 #### Preferred: use the lock command
 
-Use `.recursive/scripts/recursive-lock.py` (cross-platform) or `.recursive/scripts/recursive-lock.ps1` (PowerShell) to lock a draft artifact. Those commands validate lockability, write `Status: LOCKED`, write `LockedAt`, and compute `LockHash` using the canonical normalization rules.
+Use the **`recursive_lock`** tool to lock a draft artifact — run **`recursive_lint`** first when you want the artifact machine-checked before you attempt the lock. It validates lockability, writes `Status: LOCKED`, writes `LockedAt`, and computes `LockHash` using the canonical normalization rules; it refuses a lock whose gates or whose earlier phases are unmet. This plugin runs in-process in TypeScript: there is no lock script to call under `.recursive/scripts/`, and no Python in the package at all.
 
 #### Secondary: verify an existing lock
 
-Use `.recursive/scripts/verify-locks.py` (cross-platform) or `.recursive/scripts/verify-locks.ps1` (PowerShell) to verify and (optionally) fix mismatched hashes on already locked artifacts.
+Use the **`recursive_status`** tool to verify already locked artifacts: it recomputes every `LockHash` and reports each artifact's state, naming a `Status: LOCKED` artifact whose hash no longer matches as `TAMPERED`. There is no separate verifier to call, and deliberately no fix-up mode — see the tampering action below.
 
 #### Manual computation examples
 
@@ -1763,8 +1764,8 @@ The LockHash is a SHA-256 hash of the normalized artifact content at lock time.
 "How to compute LockHash" above for the canonical normalization rules.
 
 **Preferred:**
-- use `.recursive/scripts/verify-locks.py` for cross-platform verification (and optional fixing)
-- use `.recursive/scripts/verify-locks.ps1` when running in PowerShell environments
+- use the `recursive_status` tool: it recomputes every `LockHash` under the run and reports the lock state per artifact
+- use the `recursive_lint` tool to machine-check one artifact against its phase rules before or after locking
 
 **PowerShell:**
 ```powershell
@@ -1796,28 +1797,18 @@ A phase artifact is **lock-valid** only when ALL of the following are true:
 
 ### Automated Verification
 
-Use the provided verifier scripts to verify all locks:
+Use the plugin's own tools to verify locks. There is no verifier script to run:
 
-```bash
-# Verify specific run
-python ./.recursive/scripts/verify-locks.py --run-id "<run-id>"
-
-# Scan all runs
-python ./.recursive/scripts/verify-locks.py
-
-# Fix incorrect hashes (use with caution)
-python ./.recursive/scripts/verify-locks.py --run-id "<run-id>" --fix
-```
-
-```powershell
-# Verify specific run
-.\.agents\skills\recursive-mode\scripts\verify-locks.ps1 -RunId "<run-id>"
+```text
+# One run: the phase table and per-artifact lock state. A LockHash that no longer
+# matches its content is reported as TAMPERED, with the receipt it was locked under.
+recursive_status  { "runId": "<run-id>" }
 
-# Scan all runs
-.\.agents\skills\recursive-mode\scripts\verify-locks.ps1
+# All runs in the workspace, from the slash-command surface
+/recursive status <run-id>
 
-# Fix incorrect hashes (use with caution)
-.\.agents\skills\recursive-mode\scripts\verify-locks.ps1 -RunId "<run-id>" -Fix
+# Machine-check a single artifact against its phase rules before locking it
+recursive_lint  { "runId": "<run-id>", "artifact": "<artifact>.md" }
 ```
 
 ### Tampering Detection
@@ -1829,7 +1820,7 @@ If LockHash doesn't match the canonical normalized content:
 3. **Line endings changed** (CRLF vs LF)
 
 **Action:**
-- If accidental: Use `verify-locks.py --fix` (or `verify-locks.ps1 -Fix`) to update hash
+- If accidental: restore the artifact's content. The plugin has **no `--fix` on purpose** — re-hashing a changed artifact would erase the only evidence that it changed, so the mismatch is reported as `TAMPERED` and the decision (restore the content, or record an addendum) stays with you.
 - If intentional modification: This is an anti-pattern. Use addenda instead.
 
 ### Phase Transition Lock Chain

package/scripts/test-recursive-mode-smoke.ts

@@ -166,7 +166,17 @@ async function main() {
     const coercedAdvisory = coerceAskToDecision(askDecision, 'advisory')
     check('T6 ask->deny under strict', coercedStrict.kind === 'deny')
     check('T6 ask->allow+warn under advisory (never silent)', coercedAdvisory.kind === 'allow' && typeof (coercedAdvisory as { warn?: string }).warn === 'string')
-    check('R7 config default advisory', JSON.stringify(resolveEnforcementConfig(undefined)) === JSON.stringify(DEFAULT_ENFORCEMENT))
+    // ⚠ THE CHECK THAT USED TO BE HERE WAS VACUOUS: it compared the resolver's output with
+    // `DEFAULT_ENFORCEMENT`, and both sides move together, so a change of default could never
+    // fail it. Read the default and assert the VALUE, so a revert to advisory is caught.
+    const defaultConfig = resolveEnforcementConfig(undefined)
+    check('R7 config default strict (all three gates)',
+      defaultConfig.preStep === 'strict' && defaultConfig.toolGuards === 'strict' && defaultConfig.tamper === 'strict'
+      && JSON.stringify(defaultConfig) === JSON.stringify(DEFAULT_ENFORCEMENT))
+    // A PARTIAL section must fill the unstated gates with the same posture, not with advisory:
+    // the settings service merges ONE edited field into an entry's config.
+    const partial = resolveEnforcementConfig({ toolGuards: 'advisory' })
+    check('R7 partial config fills strict', partial.preStep === 'strict' && partial.tamper === 'strict' && partial.toolGuards === 'advisory')
     let configError = ''
     try { resolveEnforcementConfig({ bogus: 1 }) } catch (err) { configError = (err as Error).message }
     check('R7 unknown config key fails', configError.includes('unknown key'))

package/src/bootstrap.ts

@@ -2,16 +2,18 @@
  * Idempotent scaffold installer (R3). TS port of install-recursive-mode.py's
  * core: bootstrap the FULL canonical /.recursive/ control plane + cross-tool
  * bridges byte-identically (RECURSIVE.md marker-wrapped, AGENTS.md, STATE/
- * DECISIONS, memory routers + shards, config/recursive-router.json, .gitignore,
- * vendored runtime scripts copied into .recursive/scripts/), plus the
- * agent/session-start Stage B (new vs resume) workspace-scoped to the session's
- * control-plane root (R1).
+ * DECISIONS, memory routers + shards, config/recursive-router.json, .gitignore),
+ * plus the agent/session-start Stage B (new vs resume) workspace-scoped to the
+ * session's control-plane root (R1).
+ *
+ * ⚠ NO `.recursive/scripts/` IS CREATED, and a legacy one is removed once it is empty — see the block in
+ * the scaffold below for the measurement that decided it.
  *
  * Templates + bodies + runtime scripts are SHIPPED package files under
  * references/ (never inlined TS string literals) and resolved relative to this
  * module (package install location), never process.cwd().
  */
-import { existsSync, mkdirSync, readdirSync, statSync, writeFileSync, readFileSync, rmSync } from 'node:fs'
+import { existsSync, mkdirSync, readdirSync, statSync, writeFileSync, readFileSync, rmSync, rmdirSync } from 'node:fs'
 import { join, dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -224,15 +226,21 @@ export function bootstrapScaffold(root: string): BootstrapResult {
     '.recursive/memory/skills/issues/.gitkeep', '.recursive/memory/skills/patterns/.gitkeep', '.recursive/run/.gitkeep',
   ]) noteFile(rel, '')
 
-  // Runtime scripts: TS-only scaffold (R2). No .py/.ps1 are vendored; the
-  // plugin's lint/lock/status/init run in-process via TS tools, so the
-  // scaffold carries an empty .recursive/scripts/ dir (kept for canonical
-  // tree-shape parity with the golden fixture).
-  noteDir('.recursive/scripts')
-  // R3 (run 09): TS-only repair — drop python-era artifacts from an EXISTING
-  // workspace's .recursive/scripts/ (the pre-0.1.6 scaffold vendored 29 .py +
-  // .ps1 wrappers; those are no longer shipped or needed). Deletes only
-  // .py/.ps1 under scripts/; never touches user content elsewhere.
+  // Runtime scripts: TS-ONLY, AND THE EMPTY DIRECTORY IS NO LONGER CREATED.
+  //
+  // ⚠ WHY IT GONE. It used to be scaffolded EMPTY — no .py/.ps1 is vendored, because lint/lock/status/
+  // closeout all run in-process as TS tools — while two shipped documents pointed INTO it: the `CLAUDE.md`
+  // memory pointers at `.recursive/scripts/recursive-training-loader.py`, and the canonical `RECURSIVE.md`
+  // at `.recursive/scripts/recursive-lock.py` / `verify-locks.py`. An empty directory that shipped documents
+  // send an agent into is a TRAP, not tree-shape parity: the agent follows the documented path, finds
+  // nothing, and the memory plane those documents promised never loads. Measured in three live runs — the
+  // directory was empty in every one, and no run ever locked a phase. Nothing in this package reads or
+  // executes anything from it; the only code that ever touched it is the legacy cleanup below.
+  //
+  // ⚠ THE CLEANUP STAYS, AND NOW FINISHES THE JOB. The pre-0.1.6 scaffold vendored 29 .py + .ps1 wrappers
+  // into real workspaces, so those are still deleted wherever they are found — and the directory is then
+  // removed when it is EMPTY, because leaving it behind is the same trap for the next agent. A directory
+  // still holding anything else is that user's and is left untouched.
   {
     const scriptsDir = join(recursiveRoot, 'scripts')
     if (existsSync(scriptsDir)) {
@@ -241,6 +249,14 @@ export function bootstrapScaffold(root: string): BootstrapResult {
           rmSync(join(scriptsDir, name), { force: true })
         }
       }
+      // ⚠ `rmdirSync`, NOT `rmSync({ recursive: false })`: measured — the latter throws `ERR_FS_EISDIR`
+      // on a directory, and a silently caught error here would leave exactly the empty directory this
+      // block exists to remove. A spec asserts the directory is GONE, so the wrong call cannot hide.
+      try {
+        if (readdirSync(scriptsDir).length === 0) rmdirSync(scriptsDir)
+      } catch {
+        // A directory that cannot be removed is not a scaffold failure, and never a reason to stop.
+      }
     }
   }
 

package/src/config.ts

@@ -17,7 +17,7 @@
  * silently coerced a bad value would be a second, weaker contract beside the real one.
  */
 import z from '@deepseek-ai/schemastery'
-import { DEFAULT_BUDGETS } from './enforcement.ts'
+import { DEFAULT_BUDGETS, DEFAULT_ENFORCEMENT_MODE } from './enforcement.ts'
 
 /** One enforcement mode, as the settings form presents it. */
 const enforcementMode = z.union([z.const('strict'), z.const('advisory')])
@@ -58,14 +58,21 @@ export const Config = z.object({
   repoRoot: z.string().description(
     'Control-plane root. Defaults to the process working directory when unset.',
   ),
+  /**
+   * ⚠ THE THREE MODE DEFAULTS READ `DEFAULT_ENFORCEMENT_MODE` FROM `enforcement.ts`, and
+   * that is deliberate: the schema default and the runtime default are the SAME value, and
+   * two literals here would be two defaults. A caller that omits the section gets
+   * `DEFAULT_ENFORCEMENT` from the runtime; a caller that supplies a partial section gets
+   * the resolver's fill. Both must be the enforcing posture — see the const for why.
+   */
   enforcement: z.object({
-    preStep: enforcementMode.default('advisory').description(
+    preStep: enforcementMode.default(DEFAULT_ENFORCEMENT_MODE).description(
       'Phase pre-step enforcement: strict refuses an out-of-order transition, advisory warns and proceeds.',
     ),
-    toolGuards: enforcementMode.default('advisory').description(
+    toolGuards: enforcementMode.default(DEFAULT_ENFORCEMENT_MODE).description(
       'Tool guard mode: strict DENIES an out-of-order tool call, advisory allows it and carries the warning.',
     ),
-    tamper: enforcementMode.default('advisory').description(
+    tamper: enforcementMode.default(DEFAULT_ENFORCEMENT_MODE).description(
       'Tamper detection: strict refuses an artifact whose LockHash no longer matches its body.',
     ),
     budgets: z.object({