arkaos 2.31.0 → 2.40.0

package/core/governance/sycophancy_detector.py

@@ -0,0 +1,169 @@
+"""Sycophancy detector for ArkaOS responses (Conclave Phase 5, PR13 v2.35.0).
+
+Implements the *arkaos-not-yes-man* NON-NEGOTIABLE rule from PR10 constitution.
+
+The detector is a heuristic — it scans an assistant response for known
+sycophancy signals (agreement-without-critique, pure-agreement-standalone,
+missing reference-companies citation when a recommendation is made,
+missing critic step). Returns a structured verdict the Stop hook records
+to telemetry (warn-only mode in v2.35.0) before promotion to hard
+enforcement in a later PR.
+
+This is NOT an LLM-based judgement. It is regex / heuristic. False
+positives are acceptable when they nudge the assistant toward more
+pushback; false negatives are the failure mode we measure and improve.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import asdict, dataclass, field
+
+# ─── Patterns ───────────────────────────────────────────────────────────
+
+# Sycophantic openers — agreement WITHOUT immediate critique follow-up.
+# These trigger inspection of the rest of the response.
+_AGREEMENT_OPENERS: tuple[re.Pattern, ...] = tuple(
+    re.compile(p, re.IGNORECASE | re.MULTILINE) for p in [
+        r"^\s*tens\s+raz[aã]o\b",
+        r"^\s*est[aá]s?\s+certo\b",
+        r"^\s*you[' ]re\s+right\b",
+        r"^\s*you\s+are\s+correct\b",
+        r"^\s*absolutely(?:[.,!]|\s)",
+        r"^\s*boa\s+ideia\b",
+        r"^\s*great\s+idea\b",
+        r"^\s*excelente\s+ideia\b",
+        r"^\s*perfeito[.,!]",
+        r"^\s*claro\s*[.,!]",
+        r"^\s*ok,?\s+vou\s+fazer\b",
+        r"^\s*ok,?\s+fazendo\b",
+        r"^\s*ok,?\s+a\s+fazer\b",
+        r"^\s*ok,?\s+seguindo\b",
+        r"^\s*sure[,.\s]",
+        r"^\s*of\s+course[,.\s]",
+        r"^\s*understood[,.\s]",
+        r"^\s*entendido[,.\s]",
+    ]
+)
+
+# Critique connectors — if present after an agreement opener, the response
+# isn't sycophantic (it's "yes, AND but here's the issue").
+_CRITIQUE_CONNECTORS: tuple[re.Pattern, ...] = tuple(
+    re.compile(p, re.IGNORECASE) for p in [
+        r"\bmas\b", r"\bpor[eé]m\b", r"\bcontudo\b", r"\btodavia\b",
+        r"\bantes\s+de\s+(avan[cç]ar|fazer|continuar)\b",
+        r"\bbut\b", r"\bhowever\b", r"\balthough\b",
+        r"\bone\s+concern\b", r"\bone\s+issue\b", r"\bone\s+problem\b",
+        r"\bn[aã]o\s+vai\s+funcionar\b", r"\bnot\s+gonna\s+work\b",
+        r"\bbefore\s+(we|you|proceed|continue)\b",
+        r"\bantes\s+disso\b", r"\bo\s+problema\s+(é|aqui)\b",
+        r"\bthere[' ]s\s+a\s+problem\b",
+        r"\bissue\s+with\s+(this|your|the)\b",
+        r"\bestructur[ae]lly\s+(flawed|wrong)\b",
+        r"\bestruturalmente\s+(errad[oa]|com\s+falha)\b",
+        # Numerical / evidence cues
+        r"\b(?:Google|Stripe|SpaceX|Tesla|Anthropic|OpenAI|Linear|Notion|Vercel|Figma|Supabase|Apple|a16z|Stratechery)\b",
+        # Pushback verbs / phrases
+        r"\bdiscordo\b", r"\bdiscord[oa]\s+com\b",
+        r"\bI\s+disagree\b", r"\bdon[' ]t\s+agree\b",
+        # ArkaOS-internal tagged dissent or critic
+        r"\[arka:dissent\]", r"\[arka:critic\]",
+    ]
+)
+
+# Pure-agreement standalone — short response that's just agreement.
+_PURE_AGREEMENT_SHORT_RE = re.compile(
+    r"^\s*(?:sim|yes|claro|perfeito|certo|ok|tudo\s+certo)[.!]?\s*$",
+    re.IGNORECASE,
+)
+
+# Recommendation markers — verbs/phrases that signal "here's what to do".
+_RECOMMENDATION_RE = re.compile(
+    r"\b(?:propon?h?o|recomendo|sugiro|deves|devias|implementa|faz|usa|escolhe|"
+    r"recommend|suggest|propose|should|build|implement|pick|choose|use)\b",
+    re.IGNORECASE,
+)
+
+# Reference companies — required citation when recommendation is made.
+_REFERENCE_COMPANIES = (
+    "Google", "Stripe", "SpaceX", "Tesla", "Anthropic", "OpenAI",
+    "Linear", "Vercel", "Supabase", "Notion", "Figma", "Apple",
+    "Raycast", "Arc", "Basecamp", "37signals", "a16z", "Stratechery",
+    "Damodaran", "ProfitWell", "Patrick Campbell",
+)
+_REFERENCE_RE = re.compile(
+    r"\b(?:" + "|".join(re.escape(c) for c in _REFERENCE_COMPANIES) + r")\b",
+)
+
+# Critic verdict marker — emitted by self-critic step.
+_CRITIC_RE = re.compile(r"critic\s*=\s*(passed|failed|skipped)", re.IGNORECASE)
+
+
+@dataclass
+class SycophancyVerdict:
+    """Structured detector output."""
+
+    is_sycophantic: bool
+    signals: list[str] = field(default_factory=list)
+    confidence: float = 0.0
+    response_length: int = 0
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+
+def detect_sycophancy(text: str) -> SycophancyVerdict:
+    """Inspect *text* and return a SycophancyVerdict.
+
+    Confidence scale:
+      0.0 — no signal at all (clean response)
+      0.3 — weak signal (agreement opener but with later critique)
+      0.6 — medium (recommendation without reference-company citation)
+      0.9 — strong (agreement opener + no critique connectors anywhere)
+      1.0 — pure-agreement standalone short reply to substantive input
+    """
+    text_clean = (text or "").strip()
+    if not text_clean:
+        return SycophancyVerdict(is_sycophantic=False)
+
+    signals: list[str] = []
+    confidence = 0.0
+
+    # Signal 1 — pure-agreement-standalone short reply.
+    if len(text_clean) <= 40 and _PURE_AGREEMENT_SHORT_RE.match(text_clean):
+        return SycophancyVerdict(
+            is_sycophantic=True,
+            signals=["pure-agreement-standalone"],
+            confidence=1.0,
+            response_length=len(text_clean),
+        )
+
+    # Signal 2 — agreement opener.
+    has_agreement_opener = any(p.search(text_clean) for p in _AGREEMENT_OPENERS)
+    if has_agreement_opener:
+        signals.append("agreement-opener")
+        # Look for critique connector elsewhere in the text.
+        has_critique = any(p.search(text_clean) for p in _CRITIQUE_CONNECTORS)
+        if not has_critique:
+            signals.append("missing-critique-connector")
+            confidence = max(confidence, 0.9)
+        else:
+            confidence = max(confidence, 0.3)
+
+    # Signal 3 — recommendation without reference-company citation.
+    if _RECOMMENDATION_RE.search(text_clean):
+        if not _REFERENCE_RE.search(text_clean):
+            signals.append("recommendation-without-reference-company")
+            confidence = max(confidence, 0.6)
+
+    # Signal 4 — missing critic verdict in substantive response (> 200 chars).
+    if len(text_clean) > 200 and not _CRITIC_RE.search(text_clean):
+        signals.append("missing-critic-verdict")
+        confidence = max(confidence, 0.4)
+
+    return SycophancyVerdict(
+        is_sycophantic=confidence >= 0.6,
+        signals=signals,
+        confidence=confidence,
+        response_length=len(text_clean),
+    )

package/core/orchestration/checkpoint.py

@@ -0,0 +1,157 @@
+"""Inter-agent checkpoint primitives (PR15 v2.37.0).
+
+Implements the `inter-agent-checkpoints` NON-NEGOTIABLE rule from PR10:
+long-running multi-agent dispatches are fragmented into sub-dispatches
+of 2-3min each, and the orchestrator emits a proactive checkpoint
+prompt between each sub-dispatch announcing the next step and inviting
+user context injection.
+
+This module ships PRIMITIVES — message builders, an injection parser,
+and a planner that splits a task list into checkpoint-sized chunks.
+The actual orchestration (calling Agent tools in sequence, pausing
+between them) is a pattern the orchestrator follows, not code this
+module runs.
+
+Conclave Phase 5 brainstorm (2026-05-13) decided:
+  * Live interruption capability — user can add context mid-task
+  * Proactive checkpoint prompts between sub-dispatches
+  * Sub-dispatch budget: 2-3 minutes each
+  * Reviewer conflicts: strategic -> escalate, technical -> Marta decides
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import asdict, dataclass, field
+from typing import Literal
+
+# Recommended sub-dispatch duration window (seconds).
+SUB_DISPATCH_MIN_S = 60
+SUB_DISPATCH_TARGET_S = 180  # 3 min sweet spot
+SUB_DISPATCH_MAX_S = 300     # 5 min hard ceiling
+
+# Threshold above which a task MUST be checkpointed.
+CHECKPOINT_TRIGGER_S = 30
+
+# Recognised user-injection cues (added context, not new turn / abort).
+_INJECTION_CUES: tuple[re.Pattern, ...] = tuple(
+    re.compile(p, re.IGNORECASE) for p in [
+        r"\b(adiciona|considera tamb[eé]m|esquecia(-me)?|antes de|t[eê]m que|ainda|t[aâ]mbem)\b",
+        r"\b(also|btw|by the way|forgot to mention|one more thing|consider also)\b",
+        r"^[+]\s",            # leading + prefix common shorthand for "add"
+        r"^\s*FYI[:\s]",
+    ]
+)
+
+# Recognised abort / hard-stop cues (user wants to stop or redirect).
+_ABORT_CUES: tuple[re.Pattern, ...] = tuple(
+    re.compile(p, re.IGNORECASE) for p in [
+        r"\b(stop|para|parar|abort|cancela|cancel|n[aã]o continues|wait)\b",
+        r"\b(redirect|muda|altera|change direction)\b",
+    ]
+)
+
+InjectionKind = Literal["new-turn", "context-injection", "abort"]
+
+
+@dataclass
+class CheckpointPlan:
+    """A fragmented multi-step work plan."""
+
+    task_name: str
+    sub_dispatches: list[str] = field(default_factory=list)
+    estimated_total_seconds: int = 0
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+
+@dataclass
+class UserInjection:
+    """Parsed verdict on a mid-checkpoint user message."""
+
+    kind: InjectionKind
+    matched_cues: list[str] = field(default_factory=list)
+    raw_text: str = ""
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+
+def build_checkpoint_message(
+    next_dispatch_name: str,
+    estimated_seconds: int,
+    step: int,
+    total_steps: int,
+    context_carried_forward: str = "",
+) -> str:
+    """Return the canonical [arka:checkpoint] message string.
+
+    Format::
+
+        [arka:checkpoint] Step S/T: next dispatch "<name>" — ~Xs.
+        Tens contexto a acrescentar antes de eu arrancar? (Silêncio = procedo.)
+    """
+    s = max(1, int(step))
+    t = max(s, int(total_steps))
+    name = next_dispatch_name.strip() or "next sub-task"
+    seconds = max(0, int(estimated_seconds))
+    body = (
+        f"[arka:checkpoint] Step {s}/{t}: next dispatch \"{name}\" — ~{seconds}s.\n"
+        "Tens contexto a acrescentar antes de eu arrancar? (Silêncio = procedo.)"
+    )
+    if context_carried_forward:
+        body += f"\n  (Carry-forward: {context_carried_forward.strip()})"
+    return body
+
+
+def parse_user_injection(text: str) -> UserInjection:
+    """Classify a user message arriving between checkpoints.
+
+    Returns an :class:`UserInjection` with kind in:
+      * ``"abort"``              — user wants to stop or redirect
+      * ``"context-injection"``  — user adds context to the current plan
+      * ``"new-turn"``           — anything else (treat as fresh request)
+
+    Abort detection wins over injection (cue order: abort first).
+    """
+    stripped = (text or "").strip()
+    if not stripped:
+        return UserInjection(kind="new-turn", raw_text=stripped)
+
+    abort_hits = [p.pattern for p in _ABORT_CUES if p.search(stripped)]
+    if abort_hits:
+        return UserInjection(
+            kind="abort", matched_cues=abort_hits, raw_text=stripped
+        )
+
+    injection_hits = [p.pattern for p in _INJECTION_CUES if p.search(stripped)]
+    if injection_hits:
+        return UserInjection(
+            kind="context-injection",
+            matched_cues=injection_hits,
+            raw_text=stripped,
+        )
+    return UserInjection(kind="new-turn", raw_text=stripped)
+
+
+def plan_fragmented_dispatches(
+    task_name: str, sub_tasks: list[str], per_task_seconds: int = SUB_DISPATCH_TARGET_S
+) -> CheckpointPlan:
+    """Build a CheckpointPlan from a list of sub-task names.
+
+    Each sub-task is one dispatch separated by a checkpoint prompt.
+    Caller is responsible for executing the sub-dispatches in order.
+    """
+    cleaned: list[str] = [s.strip() for s in sub_tasks if s and s.strip()]
+    per = max(SUB_DISPATCH_MIN_S, min(int(per_task_seconds), SUB_DISPATCH_MAX_S))
+    return CheckpointPlan(
+        task_name=task_name.strip() or "unnamed-task",
+        sub_dispatches=cleaned,
+        estimated_total_seconds=len(cleaned) * per,
+    )
+
+
+def should_checkpoint(estimated_seconds: int) -> bool:
+    """Return True if the work is long enough to require a checkpoint."""
+    return int(estimated_seconds) > CHECKPOINT_TRIGGER_S

package/core/workflow/flow_enforcer.py

@@ -54,7 +54,135 @@ def _locked_append(path: Path):
                 pass
         fh.close()
 
-GATED_TOOLS: frozenset[str] = frozenset({"Write", "Edit", "MultiEdit"})
+# PR11 v2.33.0 — Discovery vs Effect tool taxonomy (Conclave Phase 5).
+#
+# DISCOVERY tools (no routing required): Read, Grep, Glob, ToolSearch,
+# the various read-only MCP tools (Obsidian search, claude-mem search,
+# Context7 query), AskUserQuestion. These never mutate user state.
+#
+# EFFECT tools (routing required): tools below produce visible state
+# changes — write to filesystem, dispatch agents, invoke skills,
+# mutate the notebook. Each requires a flow marker
+# ([arka:routing] or [arka:trivial]) in the recent assistant messages.
+#
+# Bash is special: command-by-command classification via bash_is_effect().
+# Pure read commands (cat, ls, grep, git status, etc.) are DISCOVERY.
+# Mutating commands (rm, mv, git commit/push, npm install, etc.) are
+# EFFECT. Unknown commands default to EFFECT (safer).
+
+EFFECT_TOOLS_ALWAYS: frozenset[str] = frozenset({
+    "Write", "Edit", "MultiEdit", "NotebookEdit",
+    "Task", "Skill",  # Agent dispatch + skill invocation cascade to effect
+})
+
+# Backwards-compatible alias for callers that import GATED_TOOLS.
+GATED_TOOLS: frozenset[str] = EFFECT_TOOLS_ALWAYS
+
+# Bash classifier — whitelist of safe DISCOVERY first-tokens.
+_BASH_DISCOVERY_FIRST: frozenset[str] = frozenset({
+    # File reading
+    "cat", "head", "tail", "less", "more", "tee",
+    # Directory + search
+    "ls", "find", "locate", "tree", "stat", "file",
+    # Text search / processing (read-only)
+    "grep", "ag", "rg", "wc", "sort", "uniq", "tr", "cut", "awk", "fmt",
+    # System info
+    "pwd", "whoami", "id", "hostname", "uname", "date", "df", "du",
+    "free", "uptime", "echo", "printf", "true", "false",
+    # Process info
+    "ps", "pgrep", "jobs",
+    # Tool version queries (no side-effect)
+    "which", "type", "command", "where",
+    # Common toolchain read-only entry points (subcommand checked below)
+    "git", "npm", "yarn", "pnpm", "pip", "pip3", "uv", "poetry",
+    "brew", "apt", "snap", "winget", "choco", "ollama", "docker",
+    "python", "python3", "node", "ruby", "php", "go", "rustc",
+    "curl", "wget",  # default to read; mutation via flags below
+    # Shell builtins / control
+    "test", "[", "if", "while", "for", "case", "function", "return",
+    "exit", "source", ".", "set", "export", "alias", "unalias",
+    "shopt", "trap", "wait", "eval", "exec",
+    # Test runners (read state but don't mutate canonical files)
+    "pytest", "jest", "vitest", "phpunit", "pest", "rspec", "mocha",
+    "go", "cargo",
+})
+
+# Bash classifier — patterns that indicate mutation (anywhere in command).
+_BASH_EFFECT_PATTERNS: tuple[re.Pattern, ...] = tuple(
+    re.compile(p) for p in [
+        # File-system mutation
+        r"(^|[\s|;&])rm\s", r"(^|[\s|;&])mv\s", r"(^|[\s|;&])cp\s+-[rRf]",
+        r"(^|[\s|;&])dd\s", r"(^|[\s|;&])truncate\s",
+        r"(^|[\s|;&])touch\s", r"(^|[\s|;&])mkdir\s", r"(^|[\s|;&])rmdir\s",
+        r"(^|[\s|;&])ln\s+-s", r"(^|[\s|;&])chmod\s", r"(^|[\s|;&])chown\s",
+        # In-place edit
+        r"sed\s+-i", r"perl\s+-i", r"awk\s+-i\s",
+        # Process control
+        r"(^|[\s|;&])kill\s", r"(^|[\s|;&])killall\s", r"(^|[\s|;&])pkill\s",
+        # Elevation
+        r"(^|[\s|;&])sudo\s", r"(^|[\s|;&])su\s+-",
+        # Git mutation
+        r"git\s+(commit|push|merge|rebase|reset\s+--hard|checkout\s+-[Bb]|tag\s|stash|cherry-pick|revert|branch\s+-[dD])",
+        # Package mutation
+        r"npm\s+(install|i|publish|uninstall|update|run\s+publish)",
+        r"yarn\s+(add|remove|install|publish|upgrade)",
+        r"pnpm\s+(add|remove|install|publish|update)",
+        r"pip3?\s+install", r"pip3?\s+uninstall",
+        r"uv\s+pip\s+install", r"poetry\s+(add|remove|install|publish)",
+        r"brew\s+(install|uninstall|upgrade|cleanup)",
+        r"apt(-get)?\s+(install|remove|purge|upgrade)",
+        r"snap\s+(install|remove|refresh)",
+        r"winget\s+(install|uninstall|upgrade)",
+        r"choco\s+(install|uninstall|upgrade)",
+        # GitHub mutation
+        r"gh\s+(pr\s+create|release\s+create|issue\s+create|repo\s+create|secret\s+set)",
+        r"gh\s+pr\s+merge", r"gh\s+pr\s+close", r"gh\s+repo\s+delete",
+        # Docker mutation
+        r"docker\s+(build|push|run|create|rm|kill|stop|start|restart|exec)",
+        # Network transfer (mutates remote)
+        r"(^|[\s|;&])scp\s",
+        # rsync is intentionally not in the blacklist nor in the discovery
+        # whitelist — default-deny path classifies it as EFFECT. Users
+        # who genuinely need rsync (including --dry-run) emit a routing
+        # marker; safer than guessing intent from flags.
+        # Redirects to file (overwrite or append)
+        r">\s*[^&\s]", r">>\s*[^&\s]",
+    ]
+)
+
+
+def bash_is_effect(command: str) -> bool:
+    """Classify a Bash command as EFFECT (requires routing) or DISCOVERY (free).
+
+    Algorithm (default-deny for unknowns):
+      1. Empty command → False (no effect).
+      2. Any blacklist pattern matches anywhere in the command → True.
+      3. First non-pipe token is in the discovery whitelist → False.
+      4. Otherwise → True (unknown commands default to requiring routing).
+
+    Pipes and command chaining are scanned as a whole — if any segment
+    has an effect verb, the entire chain is classified EFFECT.
+    """
+    if not command or not command.strip():
+        return False
+    stripped = command.strip()
+    for pattern in _BASH_EFFECT_PATTERNS:
+        if pattern.search(stripped):
+            return True
+    first_tokens = stripped.split(None, 1)
+    if not first_tokens:
+        return False
+    first = first_tokens[0]
+    # Strip leading env-var assignments like FOO=bar baz qux
+    while "=" in first and first_tokens:
+        first_tokens = first_tokens[1].split(None, 1) if len(first_tokens) > 1 else []
+        first = first_tokens[0] if first_tokens else ""
+    if not first:
+        return False
+    if first in _BASH_DISCOVERY_FIRST:
+        return False
+    # Unknown command — default to requiring routing.
+    return True
 
 ROUTING_RE = re.compile(r"\[arka:routing\]\s*[\w-]+\s*->\s*\w+", re.IGNORECASE)
 TRIVIAL_RE = re.compile(r"\[arka:trivial\]\s*\S+", re.IGNORECASE)
@@ -88,7 +216,9 @@ class Decision:
         return (
             f"[ARKA:ENFORCEMENT] Flow marker missing. "
             f"Emit `[arka:routing] <dept> -> <lead>` or `[arka:trivial] <reason>` "
-            f"before any `Write`/`Edit`/`MultiEdit`. Reason: {self.reason}"
+            f"before any tool that mutates state "
+            f"(Write/Edit/MultiEdit/NotebookEdit/Task/Skill, or Bash with effect commands like rm/mv/git commit/npm install). "
+            f"Reason: {self.reason}"
         )
 
 
@@ -209,13 +339,24 @@ def evaluate(
     transcript_path: str,
     session_id: str = "",
     cwd: str = "",
+    tool_input: dict | None = None,
 ) -> Decision:
     """Decide whether a tool call may proceed.
 
     Returns a Decision. Caller is responsible for translating `allow=False`
     into the appropriate hook exit code or permissionDecision output.
+
+    PR11 v2.33.0 expanded the gated set beyond Write/Edit/MultiEdit to
+    cover all EFFECT tools (NotebookEdit, Task, Skill) and to classify
+    Bash commands per-command via ``bash_is_effect``.
     """
-    if tool_name not in GATED_TOOLS:
+    is_gated = tool_name in EFFECT_TOOLS_ALWAYS
+    if not is_gated and tool_name == "Bash":
+        bash_cmd = ""
+        if tool_input and isinstance(tool_input, dict):
+            bash_cmd = str(tool_input.get("command", ""))
+        is_gated = bash_is_effect(bash_cmd)
+    if not is_gated:
         return Decision(allow=True, reason="tool-not-gated")
 
     if not _feature_flag_on():

package/knowledge/commands-registry.json

@@ -916,7 +916,7 @@
       "id": "dev-scaffold-laravel",
       "command": "/dev scaffold laravel <name>",
       "department": "dev",
-      "description": "`git@andreagroferreira:andreagroferreira/laravel-starter-kit.git`",
+      "description": "Scaffold a Laravel project from the configured starter-kit template.",
       "lead_agent": "dev-scaffold",
       "tier": 2,
       "requires_branch": false,

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "arkaos",
-  "version": "2.31.0",
+  "version": "2.40.0",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {
-    "arkaos": "./installer/cli.js"
+    "arkaos": "installer/cli.js"
   },
   "scripts": {
     "test": "node --test \"tests/installer/**/*.test.js\"",

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "2.31.0"
+version = "2.40.0"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}