arkaos 4.13.2 → 4.14.1

package/config/mcp-policy.yaml

@@ -14,6 +14,7 @@ policies:
     active:
       - codebase-memory
       - arka-prompts
+      - arka-tools
       - obsidian
       - context7
       - gh-grep
@@ -46,6 +47,7 @@ policies:
     active:
       - codebase-memory
       - arka-prompts
+      - arka-tools
       - obsidian
       - context7
       - gh-grep
@@ -78,6 +80,7 @@ policies:
     active:
       - codebase-memory
       - arka-prompts
+      - arka-tools
       - obsidian
       - context7
       - gh-grep
@@ -109,6 +112,7 @@ policies:
       stack_includes: [shopify]
     active:
       - arka-prompts
+      - arka-tools
       - obsidian
       - context7
       - gh-grep
@@ -142,6 +146,7 @@ policies:
     active:
       - codebase-memory
       - arka-prompts
+      - arka-tools
       - obsidian
       - context7
       - gh-grep
@@ -173,6 +178,7 @@ policies:
       ecosystem: marketing
     active:
       - arka-prompts
+      - arka-tools
       - obsidian
       - context7
       - canva
@@ -205,6 +211,7 @@ policies:
       ecosystem: content
     active:
       - arka-prompts
+      - arka-tools
       - obsidian
       - context7
       - canva
@@ -237,6 +244,7 @@ policies:
       default: true
     active:
       - arka-prompts
+      - arka-tools
       - obsidian
       - context7
       - gh-grep

package/config/skills-curated.yaml

@@ -0,0 +1,39 @@
+# Curated default skill set — the single source of truth for the F2-7
+# distribution cut (marketplace plugins now, curated installer default in
+# F2-7c). Everything downstream is GENERATED from this file plus the
+# departments/ tree by scripts/marketplace_gen.py — never hand-typed
+# (docs_stats/gate_manifest precedent).
+#
+# The cut: the default install carries the structural surface (main
+# /arka, the 17 department hubs, the 14 meta skills — 32 in total) plus
+# the curated sub-skills below (37) = 69 skills, inside the 60-80 band.
+# Every OTHER sub-skill still ships in the repo and deploys via the
+# per-department marketplace plugins (arkaos-<dept>@arkaos), where the
+# plugin namespace also disambiguates the later-wins collision slugs —
+# which are BANNED from this list (enforced by test, computed from disk).
+#
+# Operator-tunable: edit, then run `python scripts/marketplace_gen.py`
+# and commit the regenerated tree. The drift gate fails CI otherwise.
+version: 1
+structural:
+  arka: true        # main /arka skill + nested reference bundle
+  dept_hubs: all    # departments/<dept>/SKILL.md (17)
+  meta: all         # arka/skills/* (14 — includes flow: NON-NEGOTIABLE)
+curated_subskills:
+  brand: [design-review, design-system]
+  community: [moderation]
+  content: [calendar, hook-write]
+  dev: [api-design, architecture-design, clean-code-review, code-review,
+        db-design, refactor-plan, runbook, security-audit, spec, tdd-cycle]
+  ecom: [cart-recovery, store-audit]
+  finance: [financial-model, unit-economics]
+  kb: [search-kb, zettelkasten-process]
+  landing: [funnel-design, landing-gen]
+  leadership: [feedback-give]
+  marketing: [growth-loop, seo-audit]
+  ops: [sop-create, workflow-automate]
+  org: [org-design]
+  pm: [roadmap-build, sprint-plan]
+  saas: [mvp-build, plg-setup]
+  sales: [discovery-call, objection-handle]
+  strategy: [five-forces, moat-analysis]

package/config/statusline.sh

@@ -117,6 +117,61 @@ fi
 # ─── Format cost ──────────────────────────────────────────────────────────
 COST_FMT=$(printf '$%.2f' "${COST:-0}")
 
+# ─── Workflow gate + budget (F2-5, statusline v3) ─────────────────────────
+# Read ~/.arkaos/workflow-state.json directly (plain JSON, one jq call) —
+# no Python spawn on this hot path (the statusline re-renders continuously).
+# Shows the active workflow, current gate as G<n>/<total>, and violations.
+WF_SEGMENT=""
+WF_STATE="$HOME/.arkaos/workflow-state.json"
+if [ -f "$WF_STATE" ]; then
+  WF_LINE=$(jq -r '
+    (.phases // {}) as $p
+    | ($p | length) as $total
+    # No workflow name, or a phase-less (degenerate) state -> no segment
+    # (avoids a meaningless "G0/0").
+    | if (.workflow // "") == "" or $total == 0 then empty
+    else
+      ([$p[] | select(.status == "completed")] | length) as $done
+      # Gate index = position of the in_progress phase (1-based), else
+      # done+1 — DERIVED FROM POSITION, never grepped from the name
+      # (a "gate-5-x" key in a 3-phase workflow must not render G5/3).
+      # Clamped to $total so a fully-completed workflow shows G<n>/<n>,
+      # not G<n+1>/<n>.
+      | ([$p | to_entries | to_entries[]
+          | select(.value.value.status == "in_progress") | .key + 1][0]
+         // ([$done + 1, $total] | min)) as $gate
+      | (.violations // [] | length) as $v
+      # Unit-separator (), NOT tab: an empty field between tabs is
+      # IFS-whitespace and collapses under `read`, shifting every later
+      # field and SILENTLY DROPPING the violations warning (QG B1). The
+      # workflow name is stripped of control bytes so a malformed state
+      # file cannot inject ANSI or a newline into the terminal (B4/M1).
+      | ((.workflow | gsub("[[:cntrl:]\\\\]"; "")) as $wf
+         | [$wf, ($gate|tostring), ($total|tostring), ($v|tostring)] | join("\u001f"))
+    end
+  ' "$WF_STATE" 2>/dev/null)
+  if [ -n "$WF_LINE" ]; then
+    IFS=$'\x1f' read -r WF_NAME WF_GATE_NUM WF_TOTAL WF_VIOL <<< "$WF_LINE"
+    WF_SEGMENT="  ${C_DIM}|${C_RESET}  ${C_CYAN}⚑ ${WF_NAME}${C_RESET} ${C_DIM}G${WF_GATE_NUM}/${WF_TOTAL}${C_RESET}"
+    if [ "${WF_VIOL:-0}" -gt 0 ] 2>/dev/null; then
+      WF_SEGMENT+=" ${C_RED}⚠${WF_VIOL}${C_RESET}"
+    fi
+  fi
+fi
+
+# Budget: show spend against the per-session cap when one is configured
+# (~/.arkaos/config.json budget.hardCapUsd). Read-only, one jq call.
+# `numbers` coerces the type: a non-numeric cap ("lots") yields empty
+# and the segment is omitted rather than rendering a misleading /$0.00.
+BUDGET_FMT=""
+ARKA_CONFIG="$HOME/.arkaos/config.json"
+if [ -f "$ARKA_CONFIG" ]; then
+  CAP=$(jq -r '.budget.hardCapUsd | numbers // empty' "$ARKA_CONFIG" 2>/dev/null)
+  if [ -n "$CAP" ]; then
+    BUDGET_FMT=$(awk -v cap="$CAP" 'BEGIN{printf "/$%.2f", cap}')
+  fi
+fi
+
 # ─── Build Line 1: Context bar ───────────────────────────────────────────
 LINE1="${C_CYAN}▲ARKA${C_RESET}  ${C_WHITE}${DIR_NAME}${C_RESET}"
 
@@ -126,13 +181,14 @@ if [ -n "$BRANCH" ] && [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ]; the
 fi
 
 LINE1+="  ${C_DIM}|${C_RESET}  ${MODEL}"
+LINE1+="$WF_SEGMENT"
 
 # ─── Build Line 2: Metrics bar ───────────────────────────────────────────
 LINE2="${C_BAR}${BAR} ${PCT}%${C_RESET}"
 LINE2+="  ${C_DIM}|${C_RESET}  ${IN_FMT} in ${OUT_FMT} out"
 LINE2+="  ${C_DIM}|${C_RESET}  ${C_GREEN}+${ADDED}${C_RESET} ${C_RED}-${REMOVED}${C_RESET}"
 LINE2+="  ${C_DIM}|${C_RESET}  ${TIME_FMT}"
-LINE2+="  ${C_DIM}|${C_RESET}  ${COST_FMT}"
+LINE2+="  ${C_DIM}|${C_RESET}  ${COST_FMT}${BUDGET_FMT}"
 
 # ─── Output ───────────────────────────────────────────────────────────────
 echo -e "$LINE1"

package/core/cognition/capture/store.py

@@ -16,10 +16,15 @@ class CaptureStore:
     """SQLite-backed store for raw session captures."""
 
     def __init__(self, db_path: str) -> None:
-        """Connect to SQLite database and initialize tables."""
+        """Connect to SQLite database and initialize tables.
+
+        A corrupt file triggers ONE self-heal attempt (F1-D1) before
+        the error propagates — the original is never destroyed.
+        """
         Path(db_path).parent.mkdir(parents=True, exist_ok=True)
         self._db_path = db_path
-        self._init_db()
+        from core.shared.sqlite_recovery import open_with_recovery
+        open_with_recovery(db_path, self._init_db)
 
     def _conn(self) -> sqlite3.Connection:
         conn = sqlite3.connect(self._db_path)

package/core/governance/evidence_checks.py

@@ -23,11 +23,13 @@ CLI (for hooks/skills)::
 from __future__ import annotations
 
 import argparse
+import importlib.util
 import json
 import re
 import shlex
 import shutil
 import subprocess
+import sys
 import time
 from dataclasses import asdict, dataclass, field
 from pathlib import Path
@@ -216,6 +218,25 @@ def _labelled(result: CheckResult, label: str) -> CheckResult:
     return result
 
 
+def _tool_cmd(tool: str) -> list[str] | None:
+    """Resolve a Python tool: PATH binary, else the interpreter's module.
+
+    Operator machines install ruff/pytest into the ArkaOS venv with no
+    PATH binary — keying on shutil.which alone silently downgraded
+    Python lint to eslint over installer/*.js, a FALSE GREEN on a
+    NON-NEGOTIABLE gate (QG findings, F1-B2/F1-C1 reviews).
+    """
+    if shutil.which(tool):
+        return [tool]
+    if importlib.util.find_spec(tool) is not None:
+        return [sys.executable, "-m", tool]
+    return None
+
+
+def _ruff_cmd() -> list[str] | None:
+    return _tool_cmd("ruff")
+
+
 def _lint_scoped(
     project_dir: Path, changed: list[str], timeout: int,
 ) -> CheckResult | None:
@@ -225,10 +246,11 @@ def _lint_scoped(
     the same principle _check_security_grep already applies to its diff
     scope. Returns None when no scoped run applies (caller falls back).
     """
-    if shutil.which("ruff"):
+    ruff = _ruff_cmd()
+    if ruff:
         files = _scoped_files(project_dir, changed, _LINTABLE_PY)
         if files:
-            result = _run("lint", ["ruff", "check", *files], project_dir, timeout)
+            result = _run("lint", [*ruff, "check", *files], project_dir, timeout)
             return _labelled(result, f"lint(scoped: {len(files)} file(s))")
     eslint = project_dir / "node_modules" / ".bin" / "eslint"
     if eslint.is_file():
@@ -261,10 +283,22 @@ def _check_lint(
             or _scoped_files(project_dir, changed, _LINTABLE_PHP)
         )
         if not lintable:
-            return _skip("lint", "changed files contain no lintable sources")
-    if _has_python(project_dir, changed) and shutil.which("ruff"):
+            # Skipping is only honest when the DIFF has no lintable
+            # extensions. When it does but none resolved under
+            # project_dir (deleted files, a different checkout/cwd,
+            # cross-root paths), "no lintable sources" is a blind gate
+            # (QG 2026-07-12: a 2 .py + 6 .js diff got skipped) — fall
+            # through to the project-wide lint of what IS on disk.
+            all_lintable_exts = _LINTABLE_PY | _LINTABLE_JS | _LINTABLE_PHP
+            changed_exts = {s.lower() for s in _suffixes(changed)}
+            if not (changed_exts & all_lintable_exts):
+                return _skip(
+                    "lint", "changed files contain no lintable sources"
+                )
+    ruff = _ruff_cmd()
+    if _has_python(project_dir, changed) and ruff:
         return _labelled(
-            _run("lint", ["ruff", "check", "."], project_dir, timeout),
+            _run("lint", [*ruff, "check", "."], project_dir, timeout),
             "lint(project-wide)",
         )
     if _package_json_script(project_dir, "lint"):
@@ -307,8 +341,9 @@ def _check_tests(
 ) -> CheckResult:
     if test_command:
         return _run("tests", shlex.split(test_command), project_dir, timeout)
-    if _has_python(project_dir, changed) and shutil.which("pytest"):
-        return _run("tests", ["pytest", "-q"], project_dir, timeout)
+    pytest_cmd = _tool_cmd("pytest")
+    if _has_python(project_dir, changed) and pytest_cmd:
+        return _run("tests", [*pytest_cmd, "-q"], project_dir, timeout)
     if _package_json_script(project_dir, "test"):
         return _run(
             "tests", ["npm", "test", "--silent"], project_dir, timeout,

package/core/governance/routing_feedback.py

@@ -0,0 +1,229 @@
+"""Routing feedback aggregator (F1-B1 — memory/learning reform).
+
+Closes the telemetry loop the ruflo teardown flagged as ArkaOS's G1 gap:
+QG verdicts and gate-judge verdicts are written every review but nothing
+ever read them back. This module aggregates both corpora into
+``~/.arkaos/routing-scores.json`` — per-department approval scores that
+the Synapse L5.5 layer (F1-B2) injects as ``[arka:redo-risk]`` warnings.
+
+Scored table, deliberately NOT Q-learning: sample sizes are dozens, not
+thousands (Q would never converge), and the constitution's evidence-flow
+demands citable counts — ``approvals=3/9 (30d)`` is auditable, a Q-table
+weight is not. Recency weighting gives the same "reward changes future
+behaviour" property with zero exploration risk.
+
+Sources consumed (both have ``department`` on every record):
+    - qg-verdicts.jsonl     (QGVerdict: APPROVED/REJECTED + blockers)
+    - judge-verdicts.jsonl  (JudgeVerdict: PASS/REVISE)
+specialist-dispatch.jsonl is deliberately NOT consumed in v1: its records
+carry tool/file but no department — mapping would require fragile
+file-to-department inference, and a wrong attribution is worse than none.
+
+CLI: ``python3 -m core.governance.routing_feedback_cli rebuild|show``
+"""
+
+from __future__ import annotations
+
+import json
+import math
+import os
+import tempfile
+from collections import Counter
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Optional
+
+from pydantic import BaseModel, Field
+
+SCORES_ENV = "ARKA_ROUTING_SCORES_PATH"
+_WINDOW_DAYS = 90  # records older than this are ignored entirely
+_HALF_LIFE_DAYS = 30.0  # recency weight halves every 30 days
+_REDO_WINDOW_DAYS = 7  # >=2 REJECTED same deliverable+department within 7d
+_TOP_BLOCKERS = 3
+
+
+class RoutingScore(BaseModel):
+    """Per-department evidence the router can cite verbatim."""
+
+    department: str
+    approvals: int = 0  # raw QG counts inside the window (citable)
+    rejections: int = 0
+    smoothed_approval: float = Field(
+        default=0.5,
+        description="Laplace (a+1)/(a+r+2) over recency-weighted QG counts",
+    )
+    judge_passes: int = 0  # gate-judge signal, kept separate from QG
+    judge_revises: int = 0
+    redo_count: int = 0
+    top_blocker_patterns: list[str] = Field(default_factory=list)
+    samples: int = 0  # QG verdicts backing smoothed_approval
+
+
+class RoutingScores(BaseModel):
+    version: int = 1
+    computed_at: str = ""
+    window_days: int = _WINDOW_DAYS
+    sources: list[str] = Field(default_factory=list)
+    scores: list[RoutingScore] = Field(default_factory=list)
+
+
+def scores_path() -> Path:
+    override = os.environ.get(SCORES_ENV, "").strip()
+    if override:
+        return Path(override)
+    return Path.home() / ".arkaos" / "routing-scores.json"
+
+
+def _parse_ts(ts: str) -> Optional[datetime]:
+    """ONE timestamp parser for the whole module — naive stamps are
+    normalized to UTC everywhere, so mixed naive+aware corpora can
+    never poison a later comparison/sort with a TypeError."""
+    try:
+        parsed = datetime.fromisoformat(ts)
+    except (ValueError, TypeError):
+        return None
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=timezone.utc)
+    return parsed
+
+
+def _age_days(ts: str, now: datetime) -> Optional[float]:
+    parsed = _parse_ts(ts)
+    if parsed is None:
+        return None
+    return max(0.0, (now - parsed).total_seconds() / 86400.0)
+
+
+def _recency_weight(age_days: float) -> float:
+    return math.pow(0.5, age_days / _HALF_LIFE_DAYS)
+
+
+def _windowed(records: list[dict], now: datetime) -> list[tuple[dict, float]]:
+    """Pair each in-window record with its recency weight; drop the rest."""
+    kept: list[tuple[dict, float]] = []
+    for record in records:
+        age = _age_days(str(record.get("ts") or ""), now)
+        if age is None or age > _WINDOW_DAYS:
+            continue
+        department = str(record.get("department") or "").strip()
+        if not department:
+            continue  # unattributable — wrong attribution is worse than none
+        kept.append((record, _recency_weight(age)))
+    return kept
+
+
+def _count_redos(qg: list[tuple[dict, float]]) -> Counter:
+    """>=2 REJECTED for the same deliverable+department within 7 days.
+
+    Records with an EMPTY deliverable are skipped: the live pipeline
+    defaults deliverable to "" (record_cli), and an empty string cannot
+    establish "same deliverable" — counting it would flag a department
+    for two unrelated rejections (noise sold as signal).
+    """
+    rejected_ts: dict[tuple[str, str], list[datetime]] = {}
+    for record, _w in qg:
+        if str(record.get("verdict")).upper() != "REJECTED":
+            continue
+        deliverable = str(record.get("deliverable") or "").strip()
+        if not deliverable:
+            continue
+        when = _parse_ts(str(record.get("ts")))
+        if when is None:
+            continue
+        key = (str(record.get("department")), deliverable)
+        rejected_ts.setdefault(key, []).append(when)
+    redos: Counter = Counter()
+    for (department, _deliverable), stamps in rejected_ts.items():
+        stamps.sort()  # all aware-UTC via _parse_ts — sort cannot raise
+        for earlier, later in zip(stamps, stamps[1:]):
+            if (later - earlier).total_seconds() <= _REDO_WINDOW_DAYS * 86400:
+                redos[department] += 1
+    return redos
+
+
+def _blocker_patterns(records: list[dict]) -> list[str]:
+    counts: Counter = Counter()
+    for record in records:
+        for blocker in record.get("blockers") or []:
+            check = str((blocker or {}).get("check") or "").strip()
+            if check:
+                counts[check] += 1
+    return [check for check, _n in counts.most_common(_TOP_BLOCKERS)]
+
+
+def _department_score(
+    department: str,
+    qg: list[tuple[dict, float]],
+    judge: list[tuple[dict, float]],
+    redos: Counter,
+) -> RoutingScore:
+    dept_qg = [(r, w) for r, w in qg if r.get("department") == department]
+    approvals_w = sum(w for r, w in dept_qg if str(r.get("verdict")).upper() == "APPROVED")
+    rejections_w = sum(w for r, w in dept_qg if str(r.get("verdict")).upper() == "REJECTED")
+    dept_judge = [(r, w) for r, w in judge if r.get("department") == department]
+    rejected_records = [
+        r for r, _w in dept_qg if str(r.get("verdict")).upper() == "REJECTED"
+    ]
+    return RoutingScore(
+        department=department,
+        approvals=sum(1 for r, _ in dept_qg if str(r.get("verdict")).upper() == "APPROVED"),
+        rejections=len(rejected_records),
+        smoothed_approval=(approvals_w + 1.0) / (approvals_w + rejections_w + 2.0),
+        judge_passes=sum(1 for r, _ in dept_judge if str(r.get("verdict")).upper() == "PASS"),
+        judge_revises=sum(1 for r, _ in dept_judge if str(r.get("verdict")).upper() == "REVISE"),
+        redo_count=redos.get(department, 0),
+        top_blocker_patterns=_blocker_patterns(rejected_records),
+        samples=len(dept_qg),
+    )
+
+
+def rebuild(now: datetime | None = None) -> RoutingScores:
+    """Aggregate both corpora and atomically write routing-scores.json."""
+    from core.evals.verdict_labels import load_judge_labels, load_verdict_labels
+
+    current = now or datetime.now(timezone.utc)
+    qg = _windowed(load_verdict_labels(), current)
+    judge = _windowed(load_judge_labels(), current)
+    departments = sorted(
+        {str(r.get("department")) for r, _ in qg}
+        | {str(r.get("department")) for r, _ in judge}
+    )
+    redos = _count_redos(qg)
+    result = RoutingScores(
+        computed_at=current.isoformat(),
+        sources=["qg-verdicts.jsonl", "judge-verdicts.jsonl"],
+        scores=[_department_score(d, qg, judge, redos) for d in departments],
+    )
+    _atomic_write(scores_path(), result)
+    return result
+
+
+def _atomic_write(target: Path, payload: RoutingScores) -> None:
+    target.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp_name = tempfile.mkstemp(dir=target.parent, prefix=f"{target.name}.", suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as fh:
+            fh.write(payload.model_dump_json(indent=2))
+        os.replace(tmp_name, target)
+    except OSError:
+        Path(tmp_name).unlink(missing_ok=True)
+
+
+def load_scores() -> Optional[RoutingScores]:
+    """Read the scores file; None when absent/invalid (consumer stays inert)."""
+    try:
+        data: dict[str, Any] = json.loads(scores_path().read_text(encoding="utf-8"))
+        if data.get("version") != 1:
+            return None
+        return RoutingScores(**data)
+    except Exception:  # noqa: BLE001 — consumers must never break on this file
+        return None
+
+
+def stale(max_age_seconds: int = 3600) -> bool:
+    """True when the scores file is missing or older than the threshold."""
+    try:
+        mtime = scores_path().stat().st_mtime
+    except OSError:
+        return True
+    return (datetime.now(timezone.utc).timestamp() - mtime) > max_age_seconds

package/core/governance/routing_feedback_cli.py

@@ -0,0 +1,49 @@
+"""CLI for the routing feedback aggregator (F1-B1).
+
+Usage:
+    python3 -m core.governance.routing_feedback_cli rebuild
+    python3 -m core.governance.routing_feedback_cli show
+"""
+
+from __future__ import annotations
+
+import sys
+
+from core.governance.routing_feedback import load_scores, rebuild, scores_path
+
+
+def _show() -> int:
+    scores = load_scores()
+    if scores is None:
+        print(f"no routing scores at {scores_path()} — run: rebuild")
+        return 1
+    print(f"routing scores @ {scores.computed_at} (window {scores.window_days}d)")
+    print(f"sources: {', '.join(scores.sources)}")
+    for score in scores.scores:
+        blockers = ", ".join(score.top_blocker_patterns) or "-"
+        print(
+            f"  {score.department}: {score.approvals}/{score.samples} approved"
+            f" (smoothed {score.smoothed_approval:.2f}),"
+            f" judge {score.judge_passes}P/{score.judge_revises}R,"
+            f" redos {score.redo_count}, top blockers: {blockers}"
+        )
+    if not scores.scores:
+        print("  (no attributable verdicts in window)")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = argv if argv is not None else sys.argv[1:]
+    command = args[0] if args else "show"
+    if command == "rebuild":
+        result = rebuild()
+        print(f"rebuilt {scores_path()} — {len(result.scores)} department(s)")
+        return 0
+    if command == "show":
+        return _show()
+    print("usage: python3 -m core.governance.routing_feedback_cli rebuild|show")
+    return 2
+
+
+if __name__ == "__main__":  # pragma: no cover
+    raise SystemExit(main())