@zalom/plastic 1.14.1 → 2.0.0-alpha.1

package/scripts/lib/doctor_core.rb

@@ -26,7 +26,9 @@ class Doctor
     "hermes" => { name: "Hermes",      dir: File.join(Dir.home, ".hermes") },
   }.freeze
 
-  CLAUDE_HOOK_EVENTS = %w[SessionStart PreCompact PostToolUse UserPromptSubmit].freeze
+  # The Claude events hooks_registered expects in settings.json: the five-event map of
+  # cut-inventory 3b (intent 309 added SessionEnd, registered for close since intent 301).
+  CLAUDE_HOOK_EVENTS = %w[SessionStart PreCompact PostToolUse UserPromptSubmit SessionEnd].freeze
 
   # Launchers the installer places in the agent's hooks dir that are NOT hooks
   # (intent 204): plastic-statusline is the settings["statusLine"] command, wired
@@ -40,9 +42,8 @@ class Doctor
     folgezettel-id
     read-config
     hook-session-start
-    hook-continue
-    hook-future-intent-check
-    hook-gate-check
+    hook-capture
+    hook-record
     validate-intent
     doctor.rb
   ].freeze
@@ -329,7 +330,7 @@ class Doctor
     hooks_dir = File.join(agent_dir, "hooks")
 
     # Derived from HookRegistry.events (intent 204), not a hand-kept list, so
-    # every registered hook (all 15, including the enforcement gates) is checked.
+    # every registered hook is checked.
     expected_launchers = HookRegistry.claude_launcher_names
 
     # hooks_exist
@@ -396,12 +397,6 @@ class Doctor
       )
     end
 
-    # claude_hooks_implemented (intent 244): the edit-path gates now live as
-    # branches inside one dispatcher (scripts/hook-edit-gates), which is
-    # exactly the shape that let links-gate ship registered and dead on
-    # Codex (intent 200's failure class, one level up).
-    checks << claude_hooks_implemented_check
-
     # hooks_registered — settings.json has Plastic hooks for required events
     settings_path = File.join(agent_dir, "settings.json")
     settings = read_json_safe(settings_path)
@@ -456,7 +451,7 @@ class Doctor
 
       # hooks_match_registry (intent 108, D7): the live settings must carry
       # EXACTLY the registrations HookRegistry defines; any drift (a missing
-      # gate, a stray plastic hook, a stale matcher) is how bash-gate shipped
+      # hook, a stray plastic hook, a stale matcher) is how a hook shipped
       # dead once already.
       expected = HookRegistry.claude_settings_hooks(hook_dir: hooks_dir)
       diffs = []
@@ -569,71 +564,6 @@ class Doctor
     )
   end
 
-  def claude_dispatcher_gate_names(source)
-    case_start = source.index(/^\s*case gate\b/)
-    return nil unless case_start
-
-    case_body = source[case_start..-1]
-    end_idx = case_body.index(/^\s*end\b/)
-    scanned = end_idx ? case_body[0...end_idx] : case_body
-    names = scanned.scan(/^\s*when\s+"([^"]+)"/).flatten.uniq
-    names.empty? ? nil : names
-  end
-
-  def claude_hooks_implemented_check
-    dispatcher_path = File.join(plastic_home, "scripts", "hook-edit-gates")
-
-    unless File.exist?(dispatcher_path)
-      return check(
-        category: "agent_registration", name: "claude_hooks_implemented", status: "fail",
-        message: "scripts/hook-edit-gates not found at #{tilde(dispatcher_path)}; cannot verify " \
-                 "the edit-path gate registry and dispatcher agree",
-        fixable: true, fix_hint: "Re-run the Plastic installer"
-      )
-    end
-
-    dispatcher_names = claude_dispatcher_gate_names(File.read(dispatcher_path))
-
-    if dispatcher_names.nil?
-      return check(
-        category: "agent_registration", name: "claude_hooks_implemented", status: "fail",
-        message: "Could not read any gate names out of #{tilde(dispatcher_path)}: the `case gate` " \
-                 "statement no longer matches the shape this check expects, so the registry was " \
-                 "never actually checked against the real dispatcher. Update " \
-                 "claude_dispatcher_gate_names in doctor.rb to the file's new shape.",
-        fixable: false
-      )
-    end
-
-    registry_names = HookRegistry::GATE_TOOLS.keys
-    missing_branch = registry_names - dispatcher_names
-    dead_branch = dispatcher_names - registry_names
-
-    if missing_branch.empty? && dead_branch.empty?
-      return check(
-        category: "agent_registration", name: "claude_hooks_implemented", status: "pass",
-        message: "Every registered edit-path gate has a scripts/hook-edit-gates branch, and every " \
-                 "dispatcher branch is registered"
-      )
-    end
-
-    details = missing_branch.map do |name|
-      "#{name} is in HookRegistry::GATE_TOOLS but scripts/hook-edit-gates has no branch for it, " \
-        "so the dispatcher skips it on every edit and it never blocks anything"
-    end
-    details += dead_branch.map do |name|
-      "#{name} has a branch in scripts/hook-edit-gates but is not in HookRegistry::GATE_TOOLS, so " \
-        "the dispatcher never reaches it and it is dead code"
-    end
-
-    check(
-      category: "agent_registration", name: "claude_hooks_implemented", status: "fail",
-      message: "The edit-path gate registry and scripts/hook-edit-gates disagree on " \
-               "#{details.size} gate(s)",
-      details: details, fixable: false
-    )
-  end
-
   def flat_skills_check(agent_dir, installer_flag)
     skills_root = File.join(agent_dir, "skills")
     found = Dir.glob(File.join(skills_root, "plastic-*", "SKILL.md"))
@@ -907,22 +837,21 @@ class Doctor
   # by hand), or a dispatcher branch nobody registers (bash-gate's shape, intent
   # 203, in the opposite direction). This check closes both directions at once.
 
-  # The Codex gate names HookRegistry actually registers: the six apply_patch-gated
-  # names (CODEX_PRE_HOOKS + CODEX_POST_HOOKS), the two Bash-matcher shell gates
-  # (CODEX_BASH_HOOKS), and the live-state hook names Codex inherits whole from
-  # `events` (CODEX_LIVE_STATE_EVENTS). No parsing needed: these are HookRegistry's
-  # own Ruby constants.
+  # The Codex hook names HookRegistry actually registers: the apply_patch record
+  # hook (CODEX_POST_HOOKS) and the live-state hook names Codex inherits whole from
+  # `events` (CODEX_LIVE_STATE_EVENTS), plus the SessionEnd close hook (intent 309,
+  # CODEX_SESSION_END_HOOKS). The PreToolUse gate names left in 2.0 (intent 302). No
+  # parsing needed: these are HookRegistry's own Ruby constants.
   def codex_registry_gate_names
     live_state = HookRegistry::CODEX_LIVE_STATE_EVENTS.flat_map do |event|
       HookRegistry.events[event].flat_map { |g| g["hooks"].map { |h| h["name"] } }
     end
-    (HookRegistry::CODEX_PRE_HOOKS + HookRegistry::CODEX_POST_HOOKS +
-     HookRegistry::CODEX_BASH_HOOKS + live_state).uniq
+    (HookRegistry::CODEX_POST_HOOKS + live_state + HookRegistry::CODEX_SESSION_END_HOOKS).uniq
   end
 
   def codex_dispatcher_gate_names(source)
     names = []
-    %w[STATE_HOOKS SHELL_HOOKS].each do |const|
+    %w[STATE_HOOKS].each do |const|
       m = source.match(/^#{const}\s*=\s*%w\[([^\]]*)\]/)
       names.concat(m[1].split(/\s+/)) if m
     end
@@ -960,7 +889,7 @@ class Doctor
       return check(
         category: "agent_registration", name: "codex_hooks_implemented", status: "fail",
         message: "Could not read any gate names out of #{tilde(dispatcher_path)}: the " \
-                 "STATE_HOOKS/SHELL_HOOKS constants and the `case gate` statement no longer " \
+                 "STATE_HOOKS constant and the `case gate` statement no longer " \
                  "match the shape this check expects, so the registry could not be checked " \
                  "against the real dispatcher. This is exactly the silent-pass failure this " \
                  "check exists to prevent; update codex_dispatcher_gate_names in doctor.rb " \
@@ -1005,8 +934,8 @@ class Doctor
     toml = File.read(config_toml) rescue ""
     warns = []
     # guide Part 3: `codex_hooks` is a deprecated alias for `[features] hooks`; catch both.
-    warns << "hooks are disabled ([features] hooks = false); Plastic gates will not fire" if toml.match?(/^\s*(?:codex_)?hooks\s*=\s*false/)
-    warns << "sandbox_mode = \"read-only\"; apply_patch writes (and gates) cannot run" if toml.match?(/^\s*sandbox_mode\s*=\s*["']read-only["']/)
+    warns << "hooks are disabled ([features] hooks = false); Plastic hooks will not fire" if toml.match?(/^\s*(?:codex_)?hooks\s*=\s*false/)
+    warns << "sandbox_mode = \"read-only\"; apply_patch writes (and the record hook) cannot run" if toml.match?(/^\s*sandbox_mode\s*=\s*["']read-only["']/)
     return nil if warns.empty?
 
     check(

package/scripts/lib/doctor_session_ledger.rb

@@ -0,0 +1,106 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "time"
+require_relative "session_ledger"
+
+# DoctorSessionLedger (intent 308) - the `session_ledger` doctor category, mixed into
+# Doctor. Two checks over the batch-1 store areas that Doctor's intent walker never
+# visits (both are dot-prefixed, and the walker stays ignorant of them by design: see
+# test/store_walker_compat_test.rb). They live in the GLOBAL store only: every writer of
+# .tmp/ and .sessions/ (hook-capture, hook-record, hook-session-start, Arm, SessionClose)
+# targets the global store, so a project scope gets no finding and no check.
+#
+# Read-only: the orphan check names directories and never removes one, because a
+# heartbeat is only refreshed on prompts and edits, so an old heartbeat is evidence, not
+# proof, that the session is gone. Fail-open: an unreadable directory is skipped, never
+# raised. Depends on the including class for `plastic_home` and `check`.
+module DoctorSessionLedger
+  ORPHAN_TTL_SECONDS = 24 * 60 * 60
+
+  # Seconds since the session's last heartbeat: the ISO-8601 content of `heartbeat`,
+  # else that file's mtime, else the directory's mtime.
+  def heartbeat_age(dir, now)
+    heartbeat = File.join(dir, "heartbeat")
+    if File.file?(heartbeat)
+      begin
+        return now - Time.iso8601(File.read(heartbeat).strip)
+      rescue ArgumentError, IOError, SystemCallError
+        return now - File.mtime(heartbeat)
+      end
+    end
+    now - File.mtime(dir)
+  end
+
+  def check_session_ledger(scopes: nil, now: Time.now)
+    return [] unless scopes.nil? || scopes.include?("global")
+
+    store_dir = File.join(plastic_home, "store")
+    orphans = orphaned_session_dirs(store_dir, now)
+    shape = day_ledger_shape_problems(store_dir)
+
+    checks = []
+    checks << if orphans.empty?
+                check(category: "session_ledger", name: "orphaned_session_tmp", status: "pass",
+                      message: "No .tmp/<session>/ directory has a heartbeat older than " \
+                               "#{ORPHAN_TTL_SECONDS / 3600} hours")
+              else
+                check(category: "session_ledger", name: "orphaned_session_tmp", status: "warn",
+                      message: "#{orphans.size} .tmp/<session>/ director#{orphans.size == 1 ? "y" : "ies"} " \
+                               "with a heartbeat older than #{ORPHAN_TTL_SECONDS / 3600} hours " \
+                               "(the session close hook never ran)",
+                      details: orphans, fixable: true,
+                      fix_hint: "Remove each listed .tmp/<session>/ directory after confirming that " \
+                                "session is gone: a live session rewrites its heartbeat on every " \
+                                "prompt and edit, so only a listed directory may be removed, by hand.")
+              end
+    checks << if shape.empty?
+                check(category: "session_ledger", name: "day_ledger_shape", status: "pass",
+                      message: "Every .sessions/ entry is a YYYYMMDD day directory with its <day>.md file")
+              else
+                check(category: "session_ledger", name: "day_ledger_shape", status: "warn",
+                      message: "#{shape.size} .sessions/ shape problem#{shape.size == 1 ? "" : "s"}",
+                      details: shape, fixable: true,
+                      fix_hint: "For a day directory missing its <day>.md, run " \
+                                "`ruby ~/.plastic/scripts/file-session-intent --day <day> --carry-to " \
+                                "<today> --store <store>`; rename or remove an entry that is not a " \
+                                "YYYYMMDD day directory.")
+              end
+    checks
+  end
+
+  def orphaned_session_dirs(store_dir, now)
+    tmp_root = SessionLedger.tmp_root(store_dir)
+    return [] unless File.directory?(tmp_root)
+
+    Dir.children(tmp_root).sort.filter_map do |name|
+      dir = File.join(tmp_root, name)
+      next unless File.directory?(dir)
+
+      age = heartbeat_age(dir, now)
+      next if age <= ORPHAN_TTL_SECONDS
+
+      "global: #{dir} (session #{name}, last heartbeat #{(age / 3600).floor}h ago)"
+    end
+  rescue SystemCallError
+    [] # unreadable .tmp/: nothing to report, never a crash
+  end
+
+  def day_ledger_shape_problems(store_dir)
+    root = SessionLedger.sessions_root(store_dir)
+    return [] unless File.directory?(root)
+
+    Dir.children(root).sort.filter_map do |name|
+      path = File.join(root, name)
+      if !File.directory?(path)
+        "global: .sessions/#{name} is not a directory (only day directories belong here)"
+      elsif !SessionLedger.valid_day_id?(name)
+        "global: .sessions/#{name} is not a YYYYMMDD day id"
+      elsif !File.file?(SessionLedger.day_file(store_dir, name))
+        "global: .sessions/#{name} has no #{name}.md day file"
+      end
+    end
+  rescue SystemCallError
+    [] # unreadable .sessions/: nothing to report, never a crash
+  end
+end

package/scripts/lib/exec_worktree.rb

@@ -3,12 +3,13 @@
 
 require "open3"
 require_relative "bridge"
+require_relative "arm"
 require_relative "lock"
 require_relative "worktree"
 require_relative "scaffold_intent"
 
 # ExecWorktree - all logic for `scripts/exec-worktree` (intent 213, group 2). Finish an
-# intent's code worktree: an order precondition, then `Worktree.finish` (delivered merges
+# intent's code worktree: the dirty-worktree guard, then `Worktree.finish` (delivered merges
 # and removes, abandoned removes only).
 #
 # THIS IS THE HIGHEST-RISK SURFACE IN THIS ACTION SET because it composes worktree
@@ -21,22 +22,13 @@ require_relative "scaffold_intent"
 # either of the Lock module's release or takeover operations (that unguarded
 # read-modify-write gap is parked intent 254's territory).
 #
-# THE ORDER-PRECONDITION TRAP (spec D7, binding). `Bridge.code_gate_decision` returns nil
-# UNCONDITIONALLY when the bridge is guided (`build["auto"] != true`), so as a precondition
-# it is VACUOUS in guided mode. This module calls that predicate exactly as it exists,
-# unmodified, and never copies its "reached How" body into a second predicate (the 200/204
-# duplication failure pattern). Instead it states plainly, in the printed output, that on a
-# guided bridge the precondition is advisory only, and that the hook layer
-# (`Bridge.code_gate_decision`, wired through `scripts/lib/edit_gates.rb`) remains the
-# actual enforcement point.
-#
 # Pure and dependency-injected: never calls `exit` or `abort`, never reads `ARGV` directly.
 # Seams: `runner:` (git, defaults to `Worktree::ShellRunner.new`; also used AFTER finish, for
 # a delivered disposition, to verify from committed git state that the merge actually landed,
 # since `Worktree.finish`'s return value is discarded by design and its underlying merge is
 # fail-open, see the merge-verification note below), `finisher:` (defaults to
 # `Worktree.method(:finish)`), `status_checker:` (defaults to a `git status --porcelain`
-# lambda), `gate:` (defaults to `Bridge.method(:code_gate_decision)`). Every seam exists so
+# lambda). Every seam exists so
 # tests run with no real git, no real worktree removal, and no real bridge file outside a
 # tmpdir.
 #
@@ -58,21 +50,10 @@ module ExecWorktree
 
   EXIT_OK = 0
   EXIT_USAGE = 1
-  EXIT_PRECONDITION = 2
+  # exit 2 was the order precondition; retired in 2.0 (intent 302) and never reused
   EXIT_NOT_CLEAN = 3
   EXIT_UNRESOLVED = 4
 
-  PROBE_FILENAME = "exec-worktree-precondition-probe"
-
-  # The advisory line, verbatim (spec D7): printed whenever the order precondition
-  # actually ran (delivered disposition, a code worktree present), on BOTH the pass and
-  # the fail path, so no reader mistakes this script for the enforcement point.
-  ADVISORY_LINE =
-    "This precondition is a friendly early error, not the enforcement point. The hook " \
-    "layer (scripts/lib/bridge.rb code_gate_decision, wired through " \
-    "scripts/lib/edit_gates.rb) remains the actual gate. On a guided bridge this " \
-    "precondition is advisory only."
-
   # --- seams (DI defaults) ----------------------------------------------------------
 
   # Real `git status --porcelain` against the code worktree, returning the same
@@ -119,8 +100,7 @@ module ExecWorktree
     false
   end
 
-  # Session resolution order (mirrors scripts/end-intent:418-426, not
-  # scripts/start-intent's no-fallback order): explicit --session, else
+  # Session resolution order (mirrors scripts/end-intent:418-426): explicit --session, else
   # CLAUDE_CODE_SESSION_ID (passed in as env_session, never read from ENV here), else
   # the existing delivery.lock's own recorded owner_session when non-blank, else nil.
   # The lock-owner fallback is correct here: this is a teardown step on an intent this
@@ -134,7 +114,7 @@ module ExecWorktree
     Bridge.blank?(owner) ? nil : owner
   end
 
-  # --- result builders (mirror StartIntent's exit_code/stdout/stderr shape) --------
+  # --- result builders (the exit_code/stdout/stderr shape the thin CLIs share) --------
 
   def usage_result(message)
     { exit_code: EXIT_USAGE, stderr: ["exec-worktree: #{message}"], stdout: [] }
@@ -156,15 +136,9 @@ module ExecWorktree
       "recorded owner are all blank); refusing rather than guessing."
   end
 
-  def no_bridge_message(intent_dir, session, id)
-    "exec-worktree: no bridge resolved for session #{session.inspect} and intent " \
-      "#{id.inspect} (#{File.basename(intent_dir)}); any worktree this intent provisioned " \
-      "was NOT removed. Run /plastic-doctor to check for an orphaned worktree."
-  end
-
   def nothing_provisioned_message(intent_dir)
-    "exec-worktree: #{File.basename(intent_dir)} has no code worktree recorded on its " \
-      "bridge (precondition: skipped, no code worktree); nothing was provisioned, nothing " \
+    "exec-worktree: #{File.basename(intent_dir)} has no code worktree on disk " \
+      "(projects.yml and the intent id resolve none); nothing was provisioned, nothing " \
       "to finish."
   end
 
@@ -195,7 +169,7 @@ module ExecWorktree
 
   # --- report (printed only when the run reaches a normal finish) ------------------
 
-  def build_report(intent_dir:, disposition:, precondition_status:, worktree_code:, branch:,
+  def build_report(intent_dir:, disposition:, worktree_code:, branch:,
                    target_branch:, removed:)
     # This is only ever reached for "delivered" AFTER `run` has already confirmed, by
     # reading committed git state (merged_into_current_branch?), that `branch` IS an
@@ -215,7 +189,6 @@ module ExecWorktree
     [
       "exec-worktree: #{File.basename(intent_dir)}",
       "  disposition: #{disposition}",
-      "  precondition: #{precondition_status}",
       "  worktree:     #{worktree_code}",
       "  branch:       #{branch}",
       "  merge:        #{merge_line}",
@@ -228,8 +201,7 @@ module ExecWorktree
   def run(store:, id:, home:, disposition:, session:, env_session:,
           runner: Worktree::ShellRunner.new,
           finisher: Worktree.method(:finish),
-          status_checker: default_status_checker,
-          gate: Bridge.method(:code_gate_decision))
+          status_checker: default_status_checker)
     return usage_result("--store is required") if Bridge.blank?(store)
     return usage_result("--id is required") if Bridge.blank?(id)
     return usage_result("--home is required") if Bridge.blank?(home)
@@ -252,9 +224,7 @@ module ExecWorktree
       return deny_result(EXIT_UNRESOLVED, no_session_message(intent_dir))
     end
 
-    bridge_data = Bridge.blank?(key_session) ? nil : Bridge.read(key_session, intent_id: id)
-    return ok_result(no_bridge_message(intent_dir, key_session, id)) if bridge_data.nil?
-
+    bridge_data = Arm.bridge_hash(intent_dir: intent_dir, home: normalized_home)
     worktree_code = bridge_data.dig("worktree", "code")
     return ok_result(nothing_provisioned_message(intent_dir)) if Bridge.blank?(worktree_code)
 
@@ -264,22 +234,8 @@ module ExecWorktree
     # both `repo` and `branch` to work with.
     repo = repo_from_worktree_code(worktree_code)
 
-    precondition_ran = false
-    precondition_status = "not run (abandoned)"
-
     if disposition == "delivered"
-      precondition_ran = true
-
-      # Step 1: the order precondition. Call Bridge.code_gate_decision AS-IS (never
-      # relaxed, never duplicated). See the module doc's "order-precondition trap".
-      probe_path = File.join(worktree_code, PROBE_FILENAME)
-      reason = gate.call(bridge_data, probe_path, home: normalized_home)
-      if reason
-        return deny_result(EXIT_PRECONDITION, [reason, ADVISORY_LINE])
-      end
-      precondition_status = bridge_data.dig("build", "auto") == true ? "passed" : "advisory (guided bridge)"
-
-      # Step 2: the dirty-worktree guard, delivered only. Fail CLOSED when the check
+      # Step 1: the dirty-worktree guard, delivered only. Fail CLOSED when the check
       # itself fails or raises: removal force-removes on a plain failure, which would
       # destroy uncommitted work an inconclusive check could not rule out.
       out, err, status = status_checker.call(worktree_code)
@@ -290,7 +246,7 @@ module ExecWorktree
       end
     end
 
-    # Step 3: finish. Worktree.finish is fail-open and never raises: on a merge conflict it
+    # Step 2: finish. Worktree.finish is fail-open and never raises: on a merge conflict it
     # aborts the merge, warns, and STILL removes the worktree (Worktree.merge_branch,
     # scripts/lib/worktree.rb:246-258). So a failed merge is invisible both in this call's
     # return value (discarded, as before) and in whether the worktree directory still
@@ -315,11 +271,9 @@ module ExecWorktree
     end
 
     report = build_report(intent_dir: intent_dir, disposition: disposition,
-                          precondition_status: precondition_status,
                           worktree_code: worktree_code, branch: branch,
                           target_branch: target_branch, removed: removed)
 
-    stdout = precondition_ran ? [ADVISORY_LINE, report] : [report]
-    ok_result(stdout)
+    ok_result([report])
   end
 end

package/scripts/lib/harness_text.rb

@@ -19,9 +19,10 @@ module HarnessText
   # form the install_claude hook rewrite already writes.
   PLUGIN_ROOT_CODEX = "$HOME/.plastic"
 
-  # Spec D3: these files document Claude's placeholder convention TO SKILL AUTHORS.
-  # Rewriting the token there turns true sentences false, so the file is exempt by path.
-  PLUGIN_ROOT_EXEMPT = ["skill-creating/references/hooks.md"].freeze
+  # Spec D3: files that document Claude's placeholder convention TO SKILL AUTHORS are
+  # exempt by path. The skill-authoring reference left the installed tree in 2.0
+  # (intent 304), so the list is empty; the seam stays for the next such file.
+  PLUGIN_ROOT_EXEMPT = [].freeze
 
   # Spec D4: an explicit root table, not one regex. The ~/.claude lines in the skill
   # corpus carry four different meanings; only these three have an exact Codex
@@ -46,7 +47,7 @@ module HarnessText
   #   "~/.claude/hooks/plastic-session-start");
   #   the name alternation, built from the real skills/ directory listing, rejects
   #   anything that is not an installed skill ("/plastic-lock" is a CLI script,
-  #   "/plastic-intent-curator" is an agent role).
+  #   "/plastic-enforcer" is an agent role).
   # Longest name first so /plastic-intent-continuing cannot match "continuing".
   def rewrite_skill_prefix(text, skill_names, prefix)
     return text if skill_names.nil? || skill_names.empty?