audrey 1.0.2 → 1.1.0

package/dist/src/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/validate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,iCAAiC,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAkBpC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAqB,EACrB,iBAAoC,EACpC,OAAwD,EACxD,UAMI,EAAE;IAEN,MAAM,EACJ,SAAS,GAAG,uBAAuB,EACnC,sBAAsB,GAAG,uBAAuB,EAChD,WAAW,EACX,eAAe,EACf,eAAe,GAChB,GAAG,OAAO,CAAC;IAEZ,MAAM,aAAa,GACjB,eAAe;QACf,iBAAiB,CAAC,cAAc,CAC9B,eAAe,IAAI,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CACpE,CAAC;IAEJ,MAAM,eAAe,GAAG,EAAE;SACvB,OAAO,CACN;;;;;;;GAOH,CACE;SACA,GAAG,CAAC,aAAa,CAAuC,CAAC;IAE5D,IAAI,SAAS,GAAkC,IAAI,CAAC;IACpD,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,IAAI,eAAe,EAAE,CAAC;QACpB,SAAS,GAAG,eAAe,CAAC;QAC5B,cAAc,GAAG,eAAe,CAAC,UAAU,CAAC;IAC9C,CAAC;IAED,IAAI,SAAS,IAAI,cAAc,IAAI,SAAS,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACpC,mFAAmF;YACnF,MAAM,OAAO,GAAG,EAAE;iBACf,OAAO,CAAC,yDAAyD,CAAC;iBAClE,GAAG,CAAC,OAAO,CAAwD,CAAC;YACvE,MAAM,QAAQ,GAAG,aAAa,CAAW,OAAO,EAAE,oBAAoB,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YACpF,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,yEAAyE;YACzE,qEAAqE;YACrE,EAAE,CAAC,OAAO,CACR;;;;;;;;OAQD,CACA,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;QACH,SAAS,EAAE,CAAC;QAEZ,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,OAAO;YACnB,UAAU,EAAE,cAAc;SAC3B,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,cAAc,IAAI,sBAAsB,IAAI,WAAW,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,iCAAiC,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,SAAS,GAAG,GAA8B,CAAC;QACjD,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAKT;YACF,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,UAAU,EAAE,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACvF,UAAU,EACR,SAAS,CAAC,UAAU;gBACpB,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;gBACxC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;gBACpC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACnE,CAAC,CAAE,SAAS,CAAC,UAAqC;gBAClD,CAAC,CAAC,SAAS;YACf,WAAW,EAAE,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC3F,CAAC;QAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,KAAK,mBAAmB;gBACxC,CAAC,CAAC;oBACE,IAAI,EAAE,mBAAmB;oBACzB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC;gBACH,CAAC,CAAC,OAAO,CAAC,UAAU;oBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;oBAChE,CAAC,CAAC,IAAI,CAAC;YAEb,IAAI,eAAe,GAAG,EAAE,CAAC;YACzB,MAAM,mBAAmB,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBAC9C,eAAe,GAAG,mBAAmB,CACnC,EAAE,EACF,OAAO,EACP,UAAU,EACV,OAAO,CAAC,EAAE,EACV,UAAU,EACV,UAAU,CACX,CAAC;gBACF,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACtC,EAAE,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClF,CAAC;qBAAM,IAAI,OAAO,CAAC,UAAU,KAAK,mBAAmB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;oBAC5E,EAAE,CAAC,OAAO,CACR,+EAA+E,CAChF,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,CAAC;YACH,mBAAmB,EAAE,CAAC;YAEtB,OAAO;gBACL,MAAM,EAAE,eAAe;gBACvB,eAAe;gBACf,UAAU,EAAE,OAAO;gBACnB,UAAU,EAAE,cAAc;gBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;aACvC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,sBAAsB,CAC7B,EAAqB,EACrB,WAAqB,EACrB,cAAkC;IAElC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CAAC,qDAAqD,YAAY,GAAG,CAAC;aAC7E,GAAG,CAAC,GAAG,WAAW,CAAgB,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,EAAqB,EACrB,QAAgB,EAChB,UAAkB,EAClB,QAAgB,EAChB,UAAkB,EAClB,UAAyB;IAEzB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtE,EAAE,CAAC,OAAO,CACR;;;;GAID,CACA,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAE9F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,EAAqB,EACrB,eAAuB,EACvB,aAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,EAAE,CAAC,OAAO,CACR;;;;;;GAMD,CACA,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/validate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAsBpC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAqB,EACrB,iBAAoC,EACpC,OAAwE,EACxE,UAMI,EAAE;IAEN,MAAM,EACJ,SAAS,GAAG,uBAAuB,EACnC,sBAAsB,GAAG,uBAAuB,EAChD,WAAW,EACX,eAAe,EACf,eAAe,GAChB,GAAG,OAAO,CAAC;IAEZ,MAAM,aAAa,GACjB,eAAe;QACf,iBAAiB,CAAC,cAAc,CAC9B,eAAe,IAAI,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CACpE,CAAC;IAEJ,MAAM,YAAY,GAAG,YAAY,CAC/B,OAAO,CAAC,KAAK;QAET,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAErE,EAAE,KAAK,EACV,SAAS,CACV,CAAC;IACF,MAAM,eAAe,GAAG,EAAE;SACvB,OAAO,CACN;;;;;;;;;GASH,CACE;SACA,GAAG,CAAC,aAAa,EAAE,YAAY,EAAE,YAAY,CAAuC,CAAC;IAExF,IAAI,SAAS,GAAkC,IAAI,CAAC;IACpD,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,IAAI,eAAe,EAAE,CAAC;QACpB,SAAS,GAAG,eAAe,CAAC;QAC5B,cAAc,GAAG,eAAe,CAAC,UAAU,CAAC;IAC9C,CAAC;IAED,IAAI,SAAS,IAAI,cAAc,IAAI,SAAS,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACpC,mFAAmF;YACnF,MAAM,OAAO,GAAG,EAAE;iBACf,OAAO,CAAC,yDAAyD,CAAC;iBAClE,GAAG,CAAC,OAAO,CAAwD,CAAC;YACvE,MAAM,QAAQ,GAAG,aAAa,CAAW,OAAO,EAAE,oBAAoB,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YACpF,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,yEAAyE;YACzE,qEAAqE;YACrE,EAAE,CAAC,OAAO,CACR;;;;;;;;OAQD,CACA,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;QACH,SAAS,EAAE,CAAC;QAEZ,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,OAAO;YACnB,UAAU,EAAE,cAAc;SAC3B,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,cAAc,IAAI,sBAAsB,IAAI,WAAW,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,iCAAiC,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,SAAS,GAAG,GAA8B,CAAC;QACjD,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAKT;YACF,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,UAAU,EAAE,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACvF,UAAU,EACR,SAAS,CAAC,UAAU;gBACpB,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;gBACxC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;gBACpC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACnE,CAAC,CAAE,SAAS,CAAC,UAAqC;gBAClD,CAAC,CAAC,SAAS;YACf,WAAW,EAAE,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC3F,CAAC;QAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,KAAK,mBAAmB;gBACxC,CAAC,CAAC;oBACE,IAAI,EAAE,mBAAmB;oBACzB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC;gBACH,CAAC,CAAC,OAAO,CAAC,UAAU;oBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;oBAChE,CAAC,CAAC,IAAI,CAAC;YAEb,IAAI,eAAe,GAAG,EAAE,CAAC;YACzB,MAAM,mBAAmB,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBAC9C,eAAe,GAAG,mBAAmB,CACnC,EAAE,EACF,OAAO,EACP,UAAU,EACV,OAAO,CAAC,EAAE,EACV,UAAU,EACV,UAAU,CACX,CAAC;gBACF,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACtC,EAAE,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClF,CAAC;qBAAM,IAAI,OAAO,CAAC,UAAU,KAAK,mBAAmB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;oBAC5E,EAAE,CAAC,OAAO,CACR,+EAA+E,CAChF,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,CAAC;YACH,mBAAmB,EAAE,CAAC;YAEtB,OAAO;gBACL,MAAM,EAAE,eAAe;gBACvB,eAAe;gBACf,UAAU,EAAE,OAAO;gBACnB,UAAU,EAAE,cAAc;gBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;aACvC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,sBAAsB,CAC7B,EAAqB,EACrB,WAAqB,EACrB,cAAkC,EAClC,KAAa;IAEb,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN;;;qBAGa,YAAY;;KAE5B,CACE;aACA,GAAG,CAAC,GAAG,WAAW,EAAE,KAAK,CAAgB,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,EAAqB,EACrB,QAAgB,EAChB,UAAkB,EAClB,QAAgB,EAChB,UAAkB,EAClB,UAAyB;IAEzB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtE,EAAE,CAAC,OAAO,CACR;;;;GAID,CACA,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAE9F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,EAAqB,EACrB,eAAuB,EACvB,aAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,EAAE,CAAC,OAAO,CACR;;;;;;GAMD,CACA,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;AAC7C,CAAC"}

package/docs/AUDREY_PAPER_OUTLINE.md

@@ -123,8 +123,10 @@ Metrics:
 - Why tool annotations are hints, not policy guarantees.
 - What Audrey borrows from graph memory without adding a graph database to the core.
 - Limitations:
-  - Claude Code hook config can be applied with a guarded settings merge, but
-    equivalent Codex hook wiring still depends on a stable host hook surface.
+  - Audrey 1.1 applies lifecycle hooks for Claude Code and Codex, but it can
+    inspect only the events and tool paths emitted by each trusted host.
+  - Hooks start short-lived Audrey processes; a persistent local runtime and
+    measured host-version compatibility gates remain production work.
   - Validation lineage is bound to exact preflight event evidence, but feedback
     does not yet tune risk scoring.
   - Local comparative GuardBench numbers exist; no external-system numbers yet.
@@ -134,7 +136,7 @@ Metrics:
 
 - Agent memory should be judged by whether it changes future actions, not just whether it retrieves relevant text.
 - Audrey Guard demonstrates a practical local loop for using memory as a pre-action control layer.
-- The next publishable milestone is live external-adapter GuardBench output plus broader host-hook integration.
+- The next publishable milestone is live external-adapter GuardBench output plus measured real-host coverage and a persistent hook runtime.
 
 ## Figures and Tables
 
@@ -168,6 +170,7 @@ Metrics:
 - MCP tool annotations and trust model: https://modelcontextprotocol.io/specification/2025-11-25/server/tools and https://modelcontextprotocol.io/specification/2025-11-25/schema
 - MCP annotation risk vocabulary: https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/
 - Claude Code hooks: https://code.claude.com/docs/en/hooks
+- Codex hooks: https://developers.openai.com/codex/hooks
 - Mem0 token-efficient memory algorithm: https://mem0.ai/blog/mem0-the-token-efficient-memory-algorithm
 - MemOS: https://huggingface.co/papers/2507.03724
 - MCP Security Bench: https://huggingface.co/papers/2510.15994

package/docs/PRODUCTION_BACKLOG.md

@@ -1,6 +1,6 @@
 # Audrey Production Backlog
 
-Updated: 2026-05-13 after the Audrey 1.0 release-cut and paper-gate pass.
+Updated: 2026-07-10 for the Audrey 1.1 Autopilot release candidate.
 
 This file tracks release posture and remaining product work. It is intentionally
 public-safe: it avoids exploit recipes, stale line references, and private
@@ -8,8 +8,9 @@ planning notes.
 
 ## Current Release Posture
 
-Audrey 1.0.0 has been cut locally and is ready for package-level validation
-through the full gate:
+Audrey 1.0.0 and 1.0.1 remain the published historical baseline. The 1.1.0
+working tree adds automatic Claude Code and Codex lifecycle integration and is
+released only after it passes the full gate:
 
 ```bash
 npm run release:gate
@@ -17,7 +18,8 @@ npm run release:gate:paper
 npm run release:cut:plan
 npm run release:readiness
 npm run python:release:check
-npm run npm:smoke
+npm run smoke:cli
+npm run pack:check
 npm run security:audit
 npx audrey doctor
 npx audrey status --fail-on-unhealthy
@@ -26,14 +28,14 @@ python -m build --no-isolation python
 ```
 
 `npm run release:readiness` is intentionally pending-aware. It exits cleanly
-when local code and paper artifacts verify but the final 1.0 release is still
+when local code and paper artifacts verify but the final 1.1 release is still
 blocked on source-control release state, GitHub Release object readiness, npm
 registry/auth readiness, PyPI publish readiness, authenticated browser
 publication URLs, live Mem0/Zep evidence, or npm/PyPI account steps. Use
-`npm run release:readiness:strict` only when cutting the actual 1.0 release;
+`npm run release:readiness:strict` only when cutting the actual 1.1 release;
 strict mode must fail until those publish blockers are resolved.
 `npm run release:cut:plan` is the dry-run version/changelog cut. It previews
-the edits that `npm run release:cut:apply -- --target-version 1.0.0` would
+the edits that `npm run release:cut:apply -- --target-version 1.1.0` would
 write to `package.json`, `package-lock.json`, `mcp-server/config.ts`,
 `python/audrey_memory/_version.py`, and `CHANGELOG.md`. The changelog plan is
 publishable release-note copy rather than TODO scaffolding, and strict
@@ -45,9 +47,24 @@ previous locked-down Windows temp-directory startup failure while keeping
 `npm run release:gate:sandbox` available for hosts that block child-process
 spawning entirely.
 
-## Unreleased v0.23 Guard Chassis
+## Guard Chassis And 1.1 Autopilot
 
-The first Audrey Guard slice is now in the working tree:
+The Guard chassis shipped across the 0.23 and 1.0 lines. Audrey 1.1 adds the
+automatic host loop:
+
+- `audrey install --host auto` discovers installed Claude Code and Codex CLIs,
+  registers the MCP server, and applies host-specific hooks from stable Node
+  and Audrey entrypoints. It preserves unrelated configuration, backs up
+  non-empty files, replaces older Audrey-owned handlers, and is idempotent.
+- One host adapter normalizes session start, prompt submission, pre-tool,
+  post-tool, post-compaction, and stop events. It injects bounded memory,
+  creates Guard receipts, correlates outcomes by `session_id + tool_use_id`,
+  forms sanitized failure memories, and runs maintenance only when due.
+- Codex project and user hooks require one-time review through `/hooks`;
+  Claude Code supports local, project, and user scopes. Hook failures remain
+  fail-open unless `AUDREY_HOOK_FAIL_CLOSED=1` is set.
+
+The underlying Guard chassis includes:
 
 - `src/controller.ts` adds `MemoryController.beforeAction()` and
   `afterAction()` over the existing tool-trace, reflex, preflight, capsule,
@@ -96,9 +113,8 @@ The first Audrey Guard slice is now in the working tree:
 - `npm run release:gate:paper` is the publication gate: it rebuilds, typechecks,
   refreshes performance and behavioral benchmark outputs, runs GuardBench,
   syncs README/paper/ledger metrics from JSON artifacts, verifies paper
-  consistency and redaction hygiene, runs the pending-aware 1.0 readiness
-  checklist, then runs a clean-consumer npm package smoke test and the npm pack
-  dry-run.
+  consistency and redaction hygiene, runs the pending-aware 1.1 readiness
+  checklist, then runs the CLI smoke test and npm pack dry-run.
 - Preflight now performs a supplemental tagged control-memory sweep for
   trusted `must-follow` memories so high-salience rules survive irrelevant
   memory noise.
@@ -112,9 +128,10 @@ The first Audrey Guard slice is now in the working tree:
 - `docs/AUDREY_PAPER_OUTLINE.md` defines the publishable Audrey Guard thesis
   and the GuardBench evaluation plan.
 
-Still not production-complete Guard: Claude Code hook apply is explicit rather
-than part of `install`, Codex hook wiring is not available yet, and validation
-feedback is recorded but not yet used to tune risk scoring.
+Still not production-complete Guard: hooks can inspect only the lifecycle
+events and tool paths emitted by each trusted host, each event starts a
+short-lived Audrey process rather than using a persistent local daemon, and
+validation feedback is recorded but does not yet tune risk scoring.
 
 ## Shipped In The 0.22.2 Correctness Pass
 
@@ -158,11 +175,11 @@ Before publishing a new npm or Python package, capture:
 - `npm run release:gate:sandbox` on locked-down local hosts.
 - `npm run release:gate:paper` before publishing the paper, npm package, or
   public launch posts that quote benchmark numbers.
-- `npm run release:readiness -- --json` to capture the current 1.0 prompt-to-artifact checklist.
+- `npm run release:readiness -- --json` to capture the current 1.1 prompt-to-artifact checklist.
 - `npm run release:readiness:strict -- --json` immediately before npm publish, PyPI publish, and browser launch are claimed complete.
-- `npm run release:cut:plan -- --target-version 1.0.0 --json` before applying the final version/changelog bump.
+- `npm run release:cut:plan -- --target-version 1.1.0 --json` before applying the final version/changelog bump.
 - `npm run python:release:check` to build wheel/sdist artifacts, inspect package metadata, check for local path leakage, and run `twine check`.
-- `npm run npm:smoke` to prove the packed npm tarball installs in a clean consumer project, imports the public ESM API, runs encode/recall, and executes both CLI shims.
+- `npm run smoke:cli` and `npm run pack:check` to exercise the public CLI and inspect the npm tarball contents.
 - `npm run security:audit`.
 - `npm ci --dry-run`.
 - Direct stdio MCP smoke: initialize, `tools/list`, `resources/list`,
@@ -173,9 +190,9 @@ Before publishing a new npm or Python package, capture:
 
 ## P0: Next Release Blockers
 
-1. Add the equivalent Codex hook wiring when the host exposes a stable hook
-   surface, and add a one-command Claude Code install mode that runs MCP
-   registration plus hook apply after a dry-run preview.
+1. Replace per-event process startup with a persistent local runtime, and add a
+   real-host compatibility matrix that measures cold/warm latency and records
+   which tool paths each supported Claude Code and Codex version emits.
 2. Run the Mem0 Platform and Zep Cloud adapters with real runtime keys,
    publish their raw per-scenario outputs, then add Letta/Graphiti-style
    adapters.
@@ -185,10 +202,10 @@ Before publishing a new npm or Python package, capture:
 4. Add MCP tool-risk policy inputs: descriptor fingerprints, annotation hints,
    trusted-server status, and descriptor drift warnings.
 
-## 1.0 / Paper Publish Blockers
+## Historical 1.0 / Paper Publish Snapshot
 
-The local code and paper gates are strong, but the 1.0/publication objective is
-not complete until `release:readiness:strict` passes. Current blockers:
+The following rows preserve the publication state recorded during the 2026-05-13
+paper pass. They are evidence history, not the current 1.1 release checklist:
 
 - Source control is partially released remotely but not coherent yet: live
   GitHub refs now show `release/audrey-1.0.0` at `83eb0ad` while `v1.0.0` is
@@ -257,7 +274,7 @@ the context they already earned. The strongest paid surface is likely team
 memory operations: policy editor, memory diff/rollback, audit log, shared
 encrypted stores, hosted relay, CI gates, and support.
 
-## v0.23 Product Direction (Tracked, Not Decided)
+## Historical v0.23 Product Direction
 
 A 2026-05-01 audit recommends repositioning Audrey from a generic local
 memory framework to **Audrey Guard** — a local-first memory firewall whose
@@ -275,12 +292,12 @@ Open questions before committing to the rename:
   while branding the guard CLI separately give us the same wedge without
   abandoning existing positioning?
 
-Concrete v0.23 work the audit identified, scoped to fit one or two
-releases:
+Concrete v0.23 work the audit identified, with shipped items marked:
 
-1. Host hook wiring for Claude Code and Codex so Guard runs automatically
-   before tool use and tool outcomes feed back into trace/validation surfaces.
-2. Memory Controller Layer (`src/controller.ts`) that owns
+1. Shipped in 1.1: host hook wiring for Claude Code and Codex so Guard runs
+   automatically before supported tool use and outcomes feed trace/validation
+   surfaces.
+2. Shipped: Memory Controller Layer (`src/controller.ts`) that owns
    `beforeAction(action) → GuardResult` and
    `afterAction(outcome) → void` over the existing primitives. This
    chassis also enables splitting `src/audrey.ts` (now ~1.2K lines) into

package/docs/paper/06-implementation.md

@@ -84,11 +84,13 @@ The JSON walker redacts sensitive keys and values recursively. If a value sits u
 
 ## MCP, CLI, and REST Surfaces
 
-The MCP server registers 20 tools: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_reflexes`, and `memory_promote` (Ledger: E32). The Guard-relevant MCP surface is `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, and `memory_reflexes`, with `memory_validate` supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
+The MCP server registers 22 tools: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, `memory_reflexes`, and `memory_promote` (Ledger: E32). The Guard-relevant MCP surface is `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, and `memory_reflexes`, with `memory_validate` supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
 
-The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact` (Ledger: E34). The `guard` subcommand invokes the controller, prints JSON or formatted output, exits nonzero for blocking decisions unless an explicit override is supplied, and can run as a Claude Code PreToolUse hook with `--hook`. `hook-config claude-code --apply` merges the generated hook block into Claude Code settings with backup/idempotence (Ledger: E26, E43).
+The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `guard-after`, `hook`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact` (Ledger: E34). The `guard` subcommand remains available for explicit checks, while the host-facing `hook` subcommand normalizes current Claude Code and Codex lifecycle payloads. `audrey install --host auto` discovers installed supported CLIs, registers the MCP server, and applies host-specific lifecycle hooks from a stable Node and Audrey entrypoint. Generated settings preserve unrelated hooks, replace older Audrey-owned handlers, write backups before changing non-empty files, and are idempotent. Claude Code supports local, project, and user hook scopes; Codex supports project and user scopes and requires one-time review of non-managed hooks through `/hooks` (Ledger: E26, E43).
 
-The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without `AUDREY_API_KEY` unless `AUDREY_ALLOW_NO_AUTH=1`, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless `AUDREY_ENABLE_ADMIN_TOOLS=1` (Ledger: E33).
+The generated lifecycle covers session start, user prompt submission, guarded pre-tool use, correlated post-tool outcomes, post-compaction, and turn stop. Session and prompt hooks inject bounded, agent-scoped memory context. Retrieval queries are bounded before embedding: large prompts and edits contribute redacted previews, lengths, and hashes rather than unbounded bodies, while exact Guard identity digests the full normalized, redacted action. Pre-tool hooks create Guard receipts, and post-tool hooks close the matching receipt by `session_id + tool_use_id`; sanitized failures may become durable memories. Claude Code exposes an explicit failure event. Current Codex Bash hooks can omit exit status, so Audrey records an opaque result as `unknown` unless structured fields or response text establish success or failure. Stop and post-compaction hooks run consolidation only when due. Audrey fails open on hook-runtime errors by default, with explicit fail-closed operation available through `AUDREY_HOOK_FAIL_CLOSED=1`. This is lifecycle integration, not a complete enforcement boundary: Audrey can inspect only the events and tool paths emitted by each host, and the short-lived hook process still pays provider startup cost instead of using a persistent daemon (Ledger: E43, E44).
+
+The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, Guard before/after receipts, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without `AUDREY_API_KEY` unless `AUDREY_ALLOW_NO_AUTH=1`, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless `AUDREY_ENABLE_ADMIN_TOOLS=1` (Ledger: E33).
 
 ## Configuration
 

package/docs/paper/07-evaluation.md

@@ -24,13 +24,13 @@ These numbers measure Audrey's local call path under an in-process mock embeddin
 
 ## Behavioral Regression Result
 
-The current `benchmarks/output/summary.json` was generated on 2026-05-29T03:45:32.997Z with command `node benchmarks/run.js --provider mock --dimensions 64` (Ledger: E24). It reports:
+The current `benchmarks/output/summary.json` was generated on 2026-07-10T15:00:37.705Z with command `node benchmarks/run.js --provider mock --dimensions 64` (Ledger: E24). It reports:
 
 | System | Score Percent | Pass Rate | Average Duration Ms |
 |---|---:|---:|---:|
-| Audrey | 100 | 100 | 15.416666666666666 |
-| Vector Only | 41.66666666666667 | 25 | 0.3333333333333333 |
-| Keyword + Recency | 41.66666666666667 | 25 | 0.6666666666666666 |
+| Audrey | 100 | 100 | 16.25 |
+| Vector Only | 41.66666666666667 | 25 | 0.25 |
+| Keyword + Recency | 41.66666666666667 | 25 | 0.5833333333333334 |
 | Recent Window | 37.5 | 25 | 0 |
 
 This output is a regression-gate result. The baselines are toy local baselines used to catch retrieval and lifecycle regressions in the Audrey codebase. They are not external systems, not tuned competitor implementations, and not GuardBench baselines (Ledger: E23-E24). The current suite covers retrieval and operation families such as information extraction, knowledge updates, multi-session reasoning, conflict resolution, procedural learning, privacy boundary, overwrite, delete-and-abstain, semantic merge, and procedural merge (Ledger: E23-E24).
@@ -55,7 +55,7 @@ It reports local adapters only, not external-system comparisons (Ledger: E46):
 | Evidence recall | 100% |
 | Redaction leaks | 0 |
 | Recall-degradation detection | 100% |
-| Guard latency p50 / p95 | 2.916 ms / 21.17 ms |
+| Guard latency p50 / p95 | 3.501 ms / 20.658 ms |
 | Published artifact raw-secret leaks | 0 |
 | Audrey Guard decision accuracy | 100% |
 | No-memory decision accuracy | 10% |

package/docs/paper/08-discussion-limitations.md

@@ -46,7 +46,7 @@ Reflex generation is deterministic, not adaptive. Reflexes are mapped from prefl
 
 ## Open Problems
 
-Host hook parity. Audrey exposes CLI pieces that host hooks can call, and Claude Code documents hook extension points [@anthropic2026claudecodehooks]. Audrey now generates and applies Claude Code hook settings, `guard --hook` emits the current PreToolUse `hookSpecificOutput.permissionDecision` shape, and `observe-tool` records post-tool events (Ledger: E43). The remaining production installer work is equivalent wiring for hosts with stable hook surfaces, especially Codex.
+Host hook coverage and process model. Audrey 1.1 generates, applies, and removes lifecycle hooks for current Claude Code and Codex CLIs; the shared adapter injects bounded context, runs Guard before selected side-effectful tools, correlates post-tool outcomes, and performs due-only maintenance (Ledger: E43). This closes the configuration gap, not the enforcement gap. Hook execution still depends on host trust and on the host emitting a supported event for the relevant tool path. Alternate or incompletely intercepted host tool paths remain outside Audrey's view. Each hook also starts a short-lived Audrey process, so the default local embedding provider can pay cold-start cost repeatedly. Production follow-up is a persistent local runtime, measured compatibility gates against supported host versions, and organization-managed deployment that binds tenant identity and enforcement policy outside a caller-controlled routing header. Claude Code's documented hook surface remains an example of the underlying host boundary [@anthropic2026claudecodehooks].
 
 Validation lineage is implemented but not yet policy-adaptive. Audrey can bind validation events to the exact preflight event, evidence IDs, and action key that produced a decision, and rejects mismatched evidence claims (Ledger: E44). The next step is using that closed-loop signal to tune warning priority and recommendation wording without giving the model direct control over policy.
 

package/docs/paper/audrey-paper-v1.md

@@ -841,11 +841,13 @@ The JSON walker redacts sensitive keys and values recursively. If a value sits u
 
 ### MCP, CLI, and REST Surfaces
 
-The MCP server registers 20 tools: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_reflexes`, and `memory_promote` (Ledger: E32). The Guard-relevant MCP surface is `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, and `memory_reflexes`, with `memory_validate` supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
+The MCP server registers 22 tools: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, `memory_reflexes`, and `memory_promote` (Ledger: E32). The Guard-relevant MCP surface is `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, and `memory_reflexes`, with `memory_validate` supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
 
-The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact` (Ledger: E34). The `guard` subcommand invokes the controller, prints JSON or formatted output, exits nonzero for blocking decisions unless an explicit override is supplied, and can run as a Claude Code PreToolUse hook with `--hook`. `hook-config claude-code --apply` merges the generated hook block into Claude Code settings with backup/idempotence (Ledger: E26, E43).
+The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `guard-after`, `hook`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact` (Ledger: E34). The `guard` subcommand remains available for explicit checks, while the host-facing `hook` subcommand normalizes current Claude Code and Codex lifecycle payloads. `audrey install --host auto` discovers installed supported CLIs, registers the MCP server, and applies host-specific lifecycle hooks from a stable Node and Audrey entrypoint. Generated settings preserve unrelated hooks, replace older Audrey-owned handlers, write backups before changing non-empty files, and are idempotent. Claude Code supports local, project, and user hook scopes; Codex supports project and user scopes and requires one-time review of non-managed hooks through `/hooks` (Ledger: E26, E43).
 
-The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without `AUDREY_API_KEY` unless `AUDREY_ALLOW_NO_AUTH=1`, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless `AUDREY_ENABLE_ADMIN_TOOLS=1` (Ledger: E33).
+The generated lifecycle covers session start, user prompt submission, guarded pre-tool use, correlated post-tool outcomes, post-compaction, and turn stop. Session and prompt hooks inject bounded, agent-scoped memory context. Pre-tool hooks create Guard receipts, and post-tool hooks close the matching receipt by `session_id + tool_use_id`; sanitized failures may become durable memories. Claude Code exposes an explicit failure event. Current Codex Bash hooks can omit exit status, so Audrey records an opaque result as `unknown` unless structured fields or response text establish success or failure. Stop and post-compaction hooks run consolidation only when due. Audrey fails open on hook-runtime errors by default, with explicit fail-closed operation available through `AUDREY_HOOK_FAIL_CLOSED=1`. This is lifecycle integration, not a complete enforcement boundary: Audrey can inspect only the events and tool paths emitted by each host, and the short-lived hook process still pays provider startup cost instead of using a persistent daemon (Ledger: E43).
+
+The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, Guard before/after receipts, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without `AUDREY_API_KEY` unless `AUDREY_ALLOW_NO_AUTH=1`, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless `AUDREY_ENABLE_ADMIN_TOOLS=1` (Ledger: E33).
 
 ### Configuration
 
@@ -895,13 +897,13 @@ These numbers measure Audrey's local call path under an in-process mock embeddin
 
 ### Behavioral Regression Result
 
-The current `benchmarks/output/summary.json` was generated on 2026-05-29T03:45:32.997Z with command `node benchmarks/run.js --provider mock --dimensions 64` (Ledger: E24). It reports:
+The current `benchmarks/output/summary.json` was generated on 2026-07-10T15:00:37.705Z with command `node benchmarks/run.js --provider mock --dimensions 64` (Ledger: E24). It reports:
 
 | System | Score Percent | Pass Rate | Average Duration Ms |
 |---|---:|---:|---:|
-| Audrey | 100 | 100 | 15.416666666666666 |
-| Vector Only | 41.66666666666667 | 25 | 0.3333333333333333 |
-| Keyword + Recency | 41.66666666666667 | 25 | 0.6666666666666666 |
+| Audrey | 100 | 100 | 16.25 |
+| Vector Only | 41.66666666666667 | 25 | 0.25 |
+| Keyword + Recency | 41.66666666666667 | 25 | 0.5833333333333334 |
 | Recent Window | 37.5 | 25 | 0 |
 
 This output is a regression-gate result. The baselines are toy local baselines used to catch retrieval and lifecycle regressions in the Audrey codebase. They are not external systems, not tuned competitor implementations, and not GuardBench baselines (Ledger: E23-E24). The current suite covers retrieval and operation families such as information extraction, knowledge updates, multi-session reasoning, conflict resolution, procedural learning, privacy boundary, overwrite, delete-and-abstain, semantic merge, and procedural merge (Ledger: E23-E24).
@@ -924,7 +926,7 @@ It reports local adapters only, not external-system comparisons (Ledger: E46):
 | Evidence recall | 100% |
 | Redaction leaks | 0 |
 | Recall-degradation detection | 100% |
-| Guard latency p50 / p95 | 2.916 ms / 21.17 ms |
+| Guard latency p50 / p95 | 3.501 ms / 20.658 ms |
 | Published artifact raw-secret leaks | 0 |
 | Audrey Guard decision accuracy | 100% |
 | No-memory decision accuracy | 10% |
@@ -1071,7 +1073,7 @@ Reflex generation is deterministic, not adaptive. Reflexes are mapped from prefl
 
 ### Open Problems
 
-Host hook parity. Audrey exposes CLI pieces that host hooks can call, and Claude Code documents hook extension points [@anthropic2026claudecodehooks]. Audrey now generates and applies Claude Code hook settings, `guard --hook` emits the current PreToolUse `hookSpecificOutput.permissionDecision` shape, and `observe-tool` records post-tool events (Ledger: E43). The remaining production installer work is equivalent wiring for hosts with stable hook surfaces, especially Codex.
+Host hook coverage and process model. Audrey 1.1 generates, applies, and removes lifecycle hooks for current Claude Code and Codex CLIs; the shared adapter injects bounded context, runs Guard before selected side-effectful tools, correlates post-tool outcomes, and performs due-only maintenance (Ledger: E43). This closes the configuration gap, not the enforcement gap. Hook execution still depends on host trust and on the host emitting a supported event for the relevant tool path. Alternate or incompletely intercepted host tool paths remain outside Audrey's view. Each hook also starts a short-lived Audrey process, so the default local embedding provider can pay cold-start cost repeatedly. Production follow-up is a persistent local runtime, measured compatibility gates against supported host versions, and organization-managed deployment that binds tenant identity and enforcement policy outside a caller-controlled routing header. Claude Code's documented hook surface remains an example of the underlying host boundary [@anthropic2026claudecodehooks].
 
 Validation lineage is implemented but not yet policy-adaptive. Audrey can bind validation events to the exact preflight event, evidence IDs, and action key that produced a decision, and rejects mismatched evidence claims (Ledger: E44). The next step is using that closed-loop signal to tune warning priority and recommendation wording without giving the model direct control over policy.
 

package/docs/paper/evidence-ledger.md

@@ -21,7 +21,7 @@ Every implementation claim in the paper should point to one or more ledger IDs i
 | E15 - Recall degradation is represented as `RecallError[]`, propagated through `partialFailure` and `errors`, and exposed in memory status as `recall_degraded` and `last_recall_errors`. | Recall degradation types and status | src/types.ts:129-137,568-570; src/recall.ts:741-753; src/audrey.ts:844-846 | Yes, 2026-05-08 |
 | E16 - Closed-loop validation accepts `used`, `helpful`, and `wrong` outcomes and updates salience, usage count, retrieval count, challenge count, and last-use/reinforcement timestamps by memory type. | Feedback application | src/feedback.ts:3-18,32-45,91-163 | Yes, 2026-05-08 |
 | E17 - Impact reporting computes memory totals, all-time and windowed validation counts, challenge counts, per-outcome validation events, top-used memories, weakest memories, and recent activity. | Impact report | src/impact.ts:12-35,100-158 | Yes, 2026-05-08 |
-| E18 - The MCP surface registers 20 tools; Guard-relevant tools include `memory_observe_tool`, `memory_capsule`, `memory_preflight`, and `memory_reflexes`. | MCP tool surface | mcp-server/index.ts:639-654,1455-2022 | Yes, `rg "server\.tool\(" mcp-server/index.ts` count = 20 on 2026-05-08 |
+| E18 - The MCP surface registers 22 tools; Guard-relevant tools include `memory_observe_tool`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, and `memory_reflexes`. | MCP tool surface | mcp-server/index.ts | Yes, `rg "server\.tool\(" mcp-server/index.ts` count = 22 on 2026-07-10 |
 | E19 - Audrey exposes `memory_validate`, `memory_dream`, `memory_observe_tool`, `memory_capsule`, `memory_preflight`, and `memory_reflexes` in the server help and registers each as an MCP tool. | MCP guard and lifecycle tools | mcp-server/index.ts:639-654,1456,1779,1835,1905,1944,1982 | Yes, 2026-05-08 |
 | E20 - `benchmarks/snapshots/perf-0.22.2.json` is the canonical performance snapshot generated on 2026-05-01 from git SHA `e2e821b`, using mock in-process 64-dimensional embeddings, hybrid recall limit 5, corpus sizes 100/1000/5000, and 50 recall runs per size on Node 25.5.0 with a 24-core Ryzen 9 7900X3D and 62.9 GB RAM. | Performance snapshot methodology and provenance | benchmarks/snapshots/perf-0.22.2.json:2-16,19-26 | Yes, 2026-05-08 |
 | E21 - The canonical perf snapshot reports hybrid recall p95 of 1.82 ms at 100 memories, 2.364 ms at 1,000 memories, and 3.417 ms at 5,000 memories under the mock-provider methodology. | Performance snapshot recall p95 | benchmarks/snapshots/perf-0.22.2.json:42-44,73-75,104-106 | Yes, 2026-05-08 |
@@ -35,21 +35,21 @@ Every implementation claim in the paper should point to one or more ledger IDs i
 | E29 - Audrey stores episodic, semantic, and procedural memories alongside causal links, contradictions, consolidation runs and metrics, configuration, and tool/memory events in SQLite tables with indexes on created time, source, state, session, tool, and outcome. | Storage schema | src/db.ts:8-158 | Yes, 2026-05-08 |
 | E30 - Audrey creates sqlite-vec virtual tables for episodic, semantic, and procedural embeddings, creates FTS5 virtual tables for the same memory classes, backfills FTS tables, and manages schema evolution through in-code migrations. | Vector, FTS, and migrations | src/db.ts:193-208,318-370; src/fts.ts:15-21,143-159 | Yes, 2026-05-08 |
 | E31 - Audrey's runtime stack is Node 20+, TypeScript, Hono, MCP stdio, better-sqlite3, sqlite-vec, transformers.js local embeddings, and optional OpenAI or Gemini embedding providers. The local provider uses a 384-dimensional `Xenova/all-MiniLM-L6-v2` model; mock, OpenAI, and Gemini default to 64, 1536, and 3072 dimensions respectively. | Runtime stack and embedding providers | package.json:105-115,122; mcp-server/index.ts:1605,2061-2064; mcp-server/config.ts:29-79; src/embedding.ts:39-46,122-180,207-218,288-299 | Yes, 2026-05-08 |
-| E32 - The MCP server registers exactly 20 tools by name: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_reflexes`, and `memory_promote`. | MCP tool registry | mcp-server/index.ts:1455-2022 | Yes, `rg "server\.tool\(" mcp-server/index.ts` count = 20 on 2026-05-08 |
-| E33 - The REST sidecar exposes health, encode, recall, validate, mark-used, capsule, preflight, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting routes; API-key middleware uses bearer-token constant-time comparison, and export/import/forget are disabled unless admin tools are enabled. | REST route surface and auth/admin gates | src/routes.ts:13-61,68-70,135-188,195-494 | Yes, 2026-05-08 |
-| E34 - The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact`. | CLI subcommands | mcp-server/index.ts; tests/mcp-server.test.js | Yes, 2026-05-12 |
+| E32 - The MCP server registers exactly 22 tools by name: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, `memory_reflexes`, and `memory_promote`. | MCP tool registry | mcp-server/index.ts | Yes, `rg "server\.tool\(" mcp-server/index.ts` count = 22 on 2026-07-10 |
+| E33 - The REST sidecar exposes health, encode, recall, validate, mark-used, capsule, preflight, Guard before/after receipt, reflex, consolidation, dream, introspection, impact, truth-resolution, export, import, forget, decay, status, reflection, and greeting routes; API-key middleware uses bearer-token constant-time comparison, and export/import/forget are disabled unless admin tools are enabled. | REST route surface and auth/admin gates | src/routes.ts; tests/http-api.test.js | Yes, focused HTTP API coverage passed on 2026-07-10 |
+| E34 - The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `guard-after`, `hook`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact`. | CLI subcommands | mcp-server/index.ts; tests/mcp-server.test.js; tests/hooks-config.test.js | Yes, relevant CLI and hook-config cases passed in the targeted 2026-07-10 run |
 | E35 - The REST sidecar defaults to `127.0.0.1`, refuses non-loopback binds without `AUDREY_API_KEY` unless `AUDREY_ALLOW_NO_AUTH=1`, and emits a no-auth warning when that override is used. | Loopback bind discipline | src/server.ts:13-31; mcp-server/index.ts:217-225,1266-1280 | Yes, 2026-05-08 |
 | E36 - Audrey ships a Python client that calls the REST sidecar and exposes synchronous and asynchronous encode, recall, recall-response, and impact operations. | Python client | README.md:127-184; python/audrey_memory/client.py:116-181,258-310 | Yes, 2026-05-08 |
-| E37 - The documented environment matrix includes security-relevant defaults for data directory, agent identity, embedding and LLM provider selection, device, port, host, API key, no-auth override, admin tools, promote roots, debug/profile flags, warmup, ONNX verbosity, SQLite pragmas, and context budget. | README configuration matrix | README.md:220-236 | Yes, 2026-05-08 |
+| E37 - The documented environment matrix includes security-relevant defaults for data directory, agent identity, embedding and LLM provider selection and model override, device, port, host, API key, no-auth override, admin tools, hook memory scope, hook failure policy, debug/profile flags, warmup, ONNX verbosity, SQLite pragmas, and context budget. | README configuration matrix | README.md; .env.example; mcp-server/config.ts | Yes, re-verified 2026-07-10 |
 | E38 - `AUDREY_MODEL` is not a documented Audrey environment variable in the README matrix; embedding model selection is represented by provider defaults in configuration and embedding-provider constructors. | Environment variable scope and provider defaults | README.md:220-236; mcp-server/config.ts:38-79; src/embedding.ts:39-46,122-180,207-218 | Yes, `rg "AUDREY_MODEL" README.md src mcp-server package.json` returned no Audrey runtime variable on 2026-05-08 |
 | E39 - Release and verification scripts include build, typecheck, Vitest, perf benchmark, performance snapshot, memory regression check, GuardBench check, npm pack dry-run, release gate, sandbox release gate, and documented Python unittest/build commands. | Test and release gates | package.json:39-58; README.md:200,247-300,352-356; python/tests/test_client.py:124-149,195-245 | Yes, 2026-05-12 |
 | E40 - Recall checks vector-table availability, records per-type partial failures for missing vector tables or KNN errors, records FTS lookup failures, and attaches collected `RecallError[]` to the returned recall result while preserving available partial results. | Recall partial-failure pathway | src/recall.ts:82-105,626-721,741-753 | Yes, 2026-05-08 |
 | E41 - The Phase 3 demo run rebuilt the project with `npm run build`, which completed successfully before executing the repeated-failure demo. | Build command for evaluation demo | package.json:39-40; Phase 3 command output | Yes, command succeeded on 2026-05-08 |
 | E42 - The Phase 3 repeated-failure demo printed an Audrey Guard `BLOCKED` decision with risk score `0.90`, two blocking memory reflexes, one warning reflex, three evidence IDs, one repeated failure prevented, one helpful memory validation recorded, and three evidence IDs attached. | Demo transcript captured for evaluation | mcp-server/index.ts:828-880; Phase 3 command output | Yes, command succeeded on 2026-05-08 |
-| E43 - Audrey exposes a Claude Code hook generator, guarded settings apply path, and hook-mode Guard command: `hook-config claude-code` emits hooks, `hook-config claude-code --apply --scope project|user` merges them into Claude Code settings with backup/idempotence, `guard --hook --fail-on-warn` consumes PreToolUse JSON and returns `hookSpecificOutput.permissionDecision`, and `observe-tool` records post-tool events. Codex hook wiring remains pending on a stable host hook surface. | Hook integration boundary | README.md; mcp-server/index.ts; tests/mcp-server.test.js | Yes, focused Vitest and CLI hook smoke passed on 2026-05-12 |
-| E44 - Audrey preflight events now persist `preflight_evidence_ids` and `audrey_guard_action_key`; `memory_validate` accepts optional `preflight_event_id`, action key, and evidence ids, persists them on the validation audit event, and rejects validation lineage when the memory id was not evidence for that preflight. | Validation lineage implementation | src/action-key.ts; src/controller.ts; src/preflight.ts; src/audrey.ts; mcp-server/index.ts; tests/controller.test.js | Yes, focused Vitest passed on 2026-05-12 |
+| E43 - Audrey 1.1 ships one normalized lifecycle adapter and host-specific configuration for current Claude Code and Codex CLIs. `audrey install --host auto` registers MCP and applies hooks for detected hosts from stable executable paths. `hook-config` supports preview, scoped apply, private backups, and idempotent Audrey-handler replacement; `uninstall` supports non-mutating preview and removes Audrey-owned registrations and handlers in the selected scope. Session and prompt hooks inject bounded, agent-scoped context; PreToolUse creates Guard receipts; post-tool events correlate outcomes by `session_id + tool_use_id`; sanitized failures may form durable memories; Stop and PostCompact run due-only maintenance. Codex requires explicit non-managed hook trust through `/hooks`. Hook errors fail open unless `AUDREY_HOOK_FAIL_CLOSED=1`. Coverage remains limited to events and tool paths emitted by the host, and each hook starts a short-lived Audrey process rather than using a persistent daemon. | Automatic lifecycle integration and boundary | README.md; CHANGELOG.md; mcp-server/hooks.ts; mcp-server/index.ts; src/autopilot.ts; tests/autopilot.test.js; tests/hooks-config.test.js; tests/mcp-server.test.js | Yes, build plus 191 focused install, hook, Autopilot, preflight, controller, and HTTP tests passed on 2026-07-10 |
+| E44 - Audrey preflight events now persist `preflight_evidence_ids` and `audrey_guard_action_key`; `memory_validate` accepts optional `preflight_event_id`, action key, and evidence ids, persists them on the validation audit event, and rejects validation lineage when the memory id was not evidence for that preflight. Preflight embedding queries are bounded, while exact action identity hashes the full normalized, redacted action so large inputs with a shared prefix do not collide. | Validation lineage implementation | src/action-key.ts; src/controller.ts; src/preflight.ts; src/audrey.ts; mcp-server/index.ts; tests/controller.test.js | Yes, focused Vitest passed on 2026-07-10, including a large-action prefix-collision regression |
 | E45 - Preflight risk scoring uses a fixed severity map (`info=0.1`, `low=0.25`, `medium=0.55`, `high=0.85`), sorts warnings by severity, and strict mode blocks on high-severity warnings; the scoring path does not consume validation feedback. | Fixed risk scoring boundary | src/preflight.ts:6-60,291-299,332-338; src/feedback.ts:3-18,70-163 | Yes, 2026-05-08 |
-| E46 - `benchmarks/guardbench.js` runs ten local comparative GuardBench scenarios across Audrey Guard, no-memory, recent-window, vector-only, and FTS-only adapters and writes `benchmarks/output/guardbench-summary.json`, `benchmarks/output/guardbench-manifest.json`, and `benchmarks/output/guardbench-raw.json`; the latest local run has Audrey Guard passing 10/10 scenarios with 100% prevention rate, 0% false-block rate, 100% evidence recall, zero decision-output redaction leaks, zero published artifact raw-secret leaks, 100% recall-degradation detection, 100% decision accuracy, and 2.916ms/21.17ms p50/p95 guard latency under the mock-provider methodology. Baseline decision accuracy was no-memory 10%, recent-window 60%, vector-only 40%, and FTS-only 10%, with 0% full-contract pass rate for each baseline. | GuardBench local comparative results | benchmarks/guardbench.js; benchmarks/output/guardbench-summary.json; benchmarks/output/guardbench-manifest.json; benchmarks/output/guardbench-raw.json; package.json | Yes, `npm run bench:guard:check` passed on 2026-05-13 |
+| E46 - `benchmarks/guardbench.js` runs ten local comparative GuardBench scenarios across Audrey Guard, no-memory, recent-window, vector-only, and FTS-only adapters and writes `benchmarks/output/guardbench-summary.json`, `benchmarks/output/guardbench-manifest.json`, and `benchmarks/output/guardbench-raw.json`; the latest local run has Audrey Guard passing 10/10 scenarios with 100% prevention rate, 0% false-block rate, 100% evidence recall, zero decision-output redaction leaks, zero published artifact raw-secret leaks, 100% recall-degradation detection, 100% decision accuracy, and 3.501ms/20.658ms p50/p95 guard latency under the mock-provider methodology. Baseline decision accuracy was no-memory 10%, recent-window 60%, vector-only 40%, and FTS-only 10%, with 0% full-contract pass rate for each baseline. | GuardBench local comparative results | benchmarks/guardbench.js; benchmarks/output/guardbench-summary.json; benchmarks/output/guardbench-manifest.json; benchmarks/output/guardbench-raw.json; package.json | Yes, `npm run bench:guard:check` passed on 2026-05-13 |
 | E47 - GuardBench accepts external ESM adapters through `--adapter`, supports `default`, `adapter`, or `createGuardBenchAdapter()` exports, withholds `expectedDecision` and `requiredEvidence` during adapter execution, then scores adapter output against the same full-contract decision/evidence/redaction checks. | GuardBench external adapter contract | benchmarks/guardbench.js; tests/guardbench.test.js; package.json | Yes, `node scripts/run-vitest.mjs run tests/guardbench.test.js` passed on 2026-05-12 |
 | E48 - Audrey ships a Mem0 Platform GuardBench adapter that uses the current Mem0 REST shape: V3 async memory add with event polling, V2 filtered memory search, and user-entity cleanup. It requires runtime `MEM0_API_KEY` and is not run by default. | First external-system GuardBench adapter | benchmarks/adapters/mem0-platform.mjs; tests/guardbench.test.js; README.md | Import/contract and mocked REST-flow tests passed on 2026-05-12; live Mem0 run not yet executed |
 | E49 - GuardBench ships a credential-free example external adapter and a `bench:guard:adapter-smoke` script so the adapter loader can be exercised through the real CLI path without external credentials. | External adapter smoke path | benchmarks/adapters/example-allow.mjs; package.json; README.md; tests/guardbench.test.js | Yes, `npm run bench:guard:adapter-smoke` passed on 2026-05-12 |

package/docs/paper/output/arxiv/arxiv-manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "Audrey arXiv source package",
-  "generatedAt": "2026-05-29T03:45:42.097Z",
+  "generatedAt": "2026-07-10T15:00:47.587Z",
   "sourceMarkdown": "docs/paper/audrey-paper-v1.md",
   "publicationPack": "docs/paper/publication-pack.json",
   "sourceHashes": {
-    "sourceMarkdown": "f2afc1cda24b1ba91cf39429e7836ead97c7a1c815b294b3d623bb20d8f5e7e6",
+    "sourceMarkdown": "d8eca75076e4ce06b1d6f15a5f2c91b2fab6da767c0bd613539b6fb9dace802d",
     "publicationPack": "a1a523d5938faea72be568b843ac3890e61cea6070b0cfa46acf22ad3d2fb974",
     "referencesBib": "c0bfcaf7bfe37d6933c812e46352be8a95397eaa430a0f5bc94037600a53f654"
   },
@@ -13,8 +13,8 @@
     {
       "path": "main.tex",
       "source": "docs/paper/audrey-paper-v1.md",
-      "bytes": 122667,
-      "sha256": "e3ee98ea8c523e8f394b8fbbc73e206f0d6126b7349df5669206d4d48d9feea6"
+      "bytes": 124811,
+      "sha256": "1dbe78fa0648e70bd02db6ff29352d8af859af25e27eb28e39a3cd78fa0965f9"
     },
     {
       "path": "references.bib",

package/docs/paper/output/arxiv/main.tex

@@ -673,11 +673,13 @@ The JSON walker redacts sensitive keys and values recursively. If a value sits u
 
 \subsection{MCP, CLI, and REST Surfaces}
 
-The MCP server registers 20 tools: \texttt{memory\_dream}, \texttt{memory\_encode}, \texttt{memory\_recall}, \texttt{memory\_consolidate}, \texttt{memory\_introspect}, \texttt{memory\_resolve\_truth}, \texttt{memory\_export}, \texttt{memory\_import}, \texttt{memory\_forget}, \texttt{memory\_validate}, \texttt{memory\_decay}, \texttt{memory\_status}, \texttt{memory\_reflect}, \texttt{memory\_greeting}, \texttt{memory\_observe\_tool}, \texttt{memory\_recent\_failures}, \texttt{memory\_capsule}, \texttt{memory\_preflight}, \texttt{memory\_reflexes}, and \texttt{memory\_promote} (Ledger: E32). The Guard-relevant MCP surface is \texttt{memory\_observe\_tool}, \texttt{memory\_recent\_failures}, \texttt{memory\_capsule}, \texttt{memory\_preflight}, and \texttt{memory\_reflexes}, with \texttt{memory\_validate} supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
+The MCP server registers 22 tools: \texttt{memory\_dream}, \texttt{memory\_encode}, \texttt{memory\_recall}, \texttt{memory\_consolidate}, \texttt{memory\_introspect}, \texttt{memory\_resolve\_truth}, \texttt{memory\_export}, \texttt{memory\_import}, \texttt{memory\_forget}, \texttt{memory\_validate}, \texttt{memory\_decay}, \texttt{memory\_status}, \texttt{memory\_reflect}, \texttt{memory\_greeting}, \texttt{memory\_observe\_tool}, \texttt{memory\_recent\_failures}, \texttt{memory\_capsule}, \texttt{memory\_preflight}, \texttt{memory\_guard\_before}, \texttt{memory\_guard\_after}, \texttt{memory\_reflexes}, and \texttt{memory\_promote} (Ledger: E32). The Guard-relevant MCP surface is \texttt{memory\_observe\_tool}, \texttt{memory\_recent\_failures}, \texttt{memory\_capsule}, \texttt{memory\_preflight}, \texttt{memory\_guard\_before}, \texttt{memory\_guard\_after}, and \texttt{memory\_reflexes}, with \texttt{memory\_validate} supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
 
-The CLI recognizes \texttt{install}, \texttt{uninstall}, \texttt{mcp-config}, \texttt{hook-config}, \texttt{demo}, \texttt{guard}, \texttt{reembed}, \texttt{dream}, \texttt{greeting}, \texttt{reflect}, \texttt{serve}, \texttt{status}, \texttt{doctor}, \texttt{observe-tool}, \texttt{promote}, and \texttt{impact} (Ledger: E34). The \texttt{guard} subcommand invokes the controller, prints JSON or formatted output, exits nonzero for blocking decisions unless an explicit override is supplied, and can run as a Claude Code PreToolUse hook with \texttt{--hook}. \texttt{hook-config claude-code --apply} merges the generated hook block into Claude Code settings with backup/idempotence (Ledger: E26, E43).
+The CLI recognizes \texttt{install}, \texttt{uninstall}, \texttt{mcp-config}, \texttt{hook-config}, \texttt{demo}, \texttt{guard}, \texttt{guard-after}, \texttt{hook}, \texttt{reembed}, \texttt{dream}, \texttt{greeting}, \texttt{reflect}, \texttt{serve}, \texttt{status}, \texttt{doctor}, \texttt{observe-tool}, \texttt{promote}, and \texttt{impact} (Ledger: E34). The \texttt{guard} subcommand remains available for explicit checks, while the host-facing \texttt{hook} subcommand normalizes current Claude Code and Codex lifecycle payloads. \texttt{audrey install --host auto} discovers installed supported CLIs, registers the MCP server, and applies host-specific lifecycle hooks from a stable Node and Audrey entrypoint. Generated settings preserve unrelated hooks, replace older Audrey-owned handlers, write backups before changing non-empty files, and are idempotent. Claude Code supports local, project, and user hook scopes; Codex supports project and user scopes and requires one-time review of non-managed hooks through \texttt{/hooks} (Ledger: E26, E43).
 
-The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without \texttt{AUDREY\_API\_KEY} unless \texttt{AUDREY\_ALLOW\_NO\_AUTH=1}, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless \texttt{AUDREY\_ENABLE\_ADMIN\_TOOLS=1} (Ledger: E33).
+The generated lifecycle covers session start, user prompt submission, guarded pre-tool use, correlated post-tool outcomes, post-compaction, and turn stop. Session and prompt hooks inject bounded, agent-scoped memory context. Pre-tool hooks create Guard receipts, and post-tool hooks close the matching receipt by \texttt{session\_id + tool\_use\_id}; sanitized failures may become durable memories. Claude Code exposes an explicit failure event. Current Codex Bash hooks can omit exit status, so Audrey records an opaque result as \texttt{unknown} unless structured fields or response text establish success or failure. Stop and post-compaction hooks run consolidation only when due. Audrey fails open on hook-runtime errors by default, with explicit fail-closed operation available through \texttt{AUDREY\_HOOK\_FAIL\_CLOSED=1}. This is lifecycle integration, not a complete enforcement boundary: Audrey can inspect only the events and tool paths emitted by each host, and the short-lived hook process still pays provider startup cost instead of using a persistent daemon (Ledger: E43).
+
+The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, Guard before/after receipts, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without \texttt{AUDREY\_API\_KEY} unless \texttt{AUDREY\_ALLOW\_NO\_AUTH=1}, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless \texttt{AUDREY\_ENABLE\_ADMIN\_TOOLS=1} (Ledger: E33).
 
 \subsection{Configuration}
 
@@ -729,13 +731,13 @@ These numbers measure Audrey's local call path under an in-process mock embeddin
 
 \subsection{Behavioral Regression Result}
 
-The current \texttt{benchmarks/output/summary.json} was generated on 2026-05-29T03:45:32.997Z with command \texttt{node benchmarks/run.js --provider mock --dimensions 64} (Ledger: E24). It reports:
+The current \texttt{benchmarks/output/summary.json} was generated on 2026-07-10T15:00:37.705Z with command \texttt{node benchmarks/run.js --provider mock --dimensions 64} (Ledger: E24). It reports:
 
 \begin{verbatim}
 | System | Score Percent | Pass Rate | Average Duration Ms |
-| Audrey | 100 | 100 | 15.416666666666666 |
-| Vector Only | 41.66666666666667 | 25 | 0.3333333333333333 |
-| Keyword + Recency | 41.66666666666667 | 25 | 0.6666666666666666 |
+| Audrey | 100 | 100 | 16.25 |
+| Vector Only | 41.66666666666667 | 25 | 0.25 |
+| Keyword + Recency | 41.66666666666667 | 25 | 0.5833333333333334 |
 | Recent Window | 37.5 | 25 | 0 |
 \end{verbatim}
 
@@ -759,7 +761,7 @@ It reports local adapters only, not external-system comparisons (Ledger: E46):
 | Evidence recall | 100% |
 | Redaction leaks | 0 |
 | Recall-degradation detection | 100% |
-| Guard latency p50 / p95 | 2.916 ms / 21.17 ms |
+| Guard latency p50 / p95 | 3.501 ms / 20.658 ms |
 | Published artifact raw-secret leaks | 0 |
 | Audrey Guard decision accuracy | 100% |
 | No-memory decision accuracy | 10% |
@@ -908,7 +910,7 @@ Reflex generation is deterministic, not adaptive. Reflexes are mapped from prefl
 
 \subsection{Open Problems}
 
-Host hook parity. Audrey exposes CLI pieces that host hooks can call, and Claude Code documents hook extension points \cite{anthropic2026claudecodehooks}. Audrey now generates and applies Claude Code hook settings, \texttt{guard --hook} emits the current PreToolUse \texttt{hookSpecificOutput.permissionDecision} shape, and \texttt{observe-tool} records post-tool events (Ledger: E43). The remaining production installer work is equivalent wiring for hosts with stable hook surfaces, especially Codex.
+Host hook coverage and process model. Audrey 1.1 generates, applies, and removes lifecycle hooks for current Claude Code and Codex CLIs; the shared adapter injects bounded context, runs Guard before selected side-effectful tools, correlates post-tool outcomes, and performs due-only maintenance (Ledger: E43). This closes the configuration gap, not the enforcement gap. Hook execution still depends on host trust and on the host emitting a supported event for the relevant tool path. Alternate or incompletely intercepted host tool paths remain outside Audrey's view. Each hook also starts a short-lived Audrey process, so the default local embedding provider can pay cold-start cost repeatedly. Production follow-up is a persistent local runtime, measured compatibility gates against supported host versions, and organization-managed deployment that binds tenant identity and enforcement policy outside a caller-controlled routing header. Claude Code's documented hook surface remains an example of the underlying host boundary \cite{anthropic2026claudecodehooks}.
 
 Validation lineage is implemented but not yet policy-adaptive. Audrey can bind validation events to the exact preflight event, evidence IDs, and action key that produced a decision, and rejects mismatched evidence claims (Ledger: E44). The next step is using that closed-loop signal to tune warning priority and recommendation wording without giving the model direct control over policy.
 

package/docs/paper/output/arxiv-compile-report.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "Audrey arXiv compile check",
-  "generatedAt": "2026-05-29T03:45:42.412Z",
+  "generatedAt": "2026-07-10T15:00:49.374Z",
   "source": {
     "sourceDir": "docs/paper/output/arxiv",
     "manifest": "docs/paper/output/arxiv/arxiv-manifest.json",
-    "manifestSha256": "6364c368755a4188d5b2deea9e3fe80201f5fa55658e6ae570141e54c5293bc6",
+    "manifestSha256": "9df7fee92964064551d7eb23098800f909f7ae8dc770be2ddcc29ff3cb33723a",
     "mainTex": "docs/paper/output/arxiv/main.tex",
-    "mainTexSha256": "e3ee98ea8c523e8f394b8fbbc73e206f0d6126b7349df5669206d4d48d9feea6",
+    "mainTexSha256": "1dbe78fa0648e70bd02db6ff29352d8af859af25e27eb28e39a3cd78fa0965f9",
     "referencesBib": "docs/paper/output/arxiv/references.bib",
     "referencesBibSha256": "c0bfcaf7bfe37d6933c812e46352be8a95397eaa430a0f5bc94037600a53f654"
   },