audrey 1.0.3 → 1.1.0

package/docs/paper/output/submission-bundle/benchmarks/output/leaderboard/guardbench-leaderboard.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "GuardBench leaderboard",
-  "generatedAt": "2026-05-29T13:33:23.840Z",
+  "generatedAt": "2026-07-10T15:00:42.478Z",
   "ranking": [
     "verified bundle",
     "adapter conformance",
@@ -28,9 +28,9 @@
         "evidenceRecall": 1,
         "redactionLeaks": 0,
         "latency": {
-          "p50Ms": 3.09,
-          "p95Ms": 28.181,
-          "maxMs": 28.181
+          "p50Ms": 3.501,
+          "p95Ms": 20.658,
+          "maxMs": 20.658
         }
       },
       "conformance": {
@@ -41,7 +41,7 @@
       },
       "source": {
         "dir": "benchmarks/output/submission-bundle",
-        "manifestGeneratedAt": "2026-05-29T13:33:23.534Z",
+        "manifestGeneratedAt": "2026-07-10T15:00:42.148Z",
         "fileCount": 17
       },
       "verification": {

package/docs/paper/output/submission-bundle/benchmarks/output/leaderboard/guardbench-leaderboard.md

@@ -1,7 +1,7 @@
 # GuardBench Leaderboard
 
-Generated: 2026-05-29T13:33:23.840Z
+Generated: 2026-07-10T15:00:42.478Z
 
 | Rank | Subject | Verified | Conformant | Full Contract | Decision Accuracy | Evidence Recall | Redaction Leaks | p95 Latency | Bundle |
 |---:|---|---:|---:|---:|---:|---:|---:|---:|---|
-| 1 | Audrey Guard | yes | yes | 100.0% | 100.0% | 100.0% | 0 | 28.181ms | benchmarks/output/submission-bundle |
+| 1 | Audrey Guard | yes | yes | 100.0% | 100.0% | 100.0% | 0 | 20.658ms | benchmarks/output/submission-bundle |

package/docs/paper/output/submission-bundle/benchmarks/output/submission-bundle/submission-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "GuardBench submission bundle",
-  "generatedAt": "2026-05-29T13:33:23.534Z",
+  "generatedAt": "2026-07-10T15:00:42.148Z",
   "sourceDir": "benchmarks/output",
   "subject": {
     "name": "Audrey Guard",
@@ -16,9 +16,9 @@
     "evidenceRecall": 1,
     "redactionLeaks": 0,
     "latency": {
-      "p50Ms": 3.09,
-      "p95Ms": 28.181,
-      "maxMs": 28.181
+      "p50Ms": 3.501,
+      "p95Ms": 20.658,
+      "maxMs": 20.658
     }
   },
   "conformance": {
@@ -44,8 +44,8 @@
   "files": [
     {
       "path": "guardbench-conformance-card.json",
-      "bytes": 1748,
-      "sha256": "88cba808b893cde3530f4e29317d4cf9ae3b20f08456c58d97d4e5300f5f9298"
+      "bytes": 1735,
+      "sha256": "f7e755fdc52216dbe387f28b3acdd6068b51b908db0cabde455b6d793b62ed43"
     },
     {
       "path": "guardbench-manifest.json",
@@ -54,13 +54,13 @@
     },
     {
       "path": "guardbench-raw.json",
-      "bytes": 43466,
-      "sha256": "66d4b69087258638f3572a40e1fd59bb84067034f899eaa2c27eed2dde554b2b"
+      "bytes": 43454,
+      "sha256": "1888c8524d54f10bb403ef09b923cec63376518bf6d202ef271ba895811d37d8"
     },
     {
       "path": "guardbench-summary.json",
-      "bytes": 69359,
-      "sha256": "91f264dd889e2c639a6fc6d1b867bc228b94c84ed5120345e23dddb79c11ee74"
+      "bytes": 69347,
+      "sha256": "88cd54e091e5aa89e7ef873a2e440430b3c35eb3f4664d963a56d197cc3691e9"
     },
     {
       "path": "schemas/guardbench-adapter-registry.schema.json",
@@ -125,7 +125,7 @@
     {
       "path": "validation-report.json",
       "bytes": 739,
-      "sha256": "284c40f608508d59e8cdc8047371dfcf0a9824a891ff37b77035241ab5de275f"
+      "sha256": "9db6530947c3f88de484235f44eaa47e7aca98dee8d3603ea0daf067d28a98d3"
     }
   ]
 }

package/docs/paper/output/submission-bundle/benchmarks/output/submission-bundle/validation-report.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-05-29T13:33:23.534Z",
+  "generatedAt": "2026-07-10T15:00:42.148Z",
   "sourceValidation": {
     "ok": true,
     "dir": "benchmarks/output",

package/docs/paper/output/submission-bundle/benchmarks/output/summary.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-05-29T13:33:19.790Z",
+  "generatedAt": "2026-07-10T15:00:37.705Z",
   "command": "node benchmarks/run.js --provider mock --dimensions 64",
   "config": {
     "provider": "mock",
@@ -23,13 +23,13 @@
         "system": "Audrey",
         "scorePercent": 100,
         "passRate": 100,
-        "avgDurationMs": 14.75
+        "avgDurationMs": 16.25
       },
       {
         "system": "Vector Only",
         "scorePercent": 41.66666666666667,
         "passRate": 25,
-        "avgDurationMs": 0.4166666666666667
+        "avgDurationMs": 0.25
       },
       {
         "system": "Keyword + Recency",
@@ -41,7 +41,7 @@
         "system": "Recent Window",
         "scorePercent": 37.5,
         "passRate": 25,
-        "avgDurationMs": 0.08333333333333333
+        "avgDurationMs": 0
       }
     ],
     "overall_scope": "comparable_suites",
@@ -170,13 +170,13 @@
             "system": "Audrey",
             "scorePercent": 100,
             "passRate": 100,
-            "avgDurationMs": 14.75
+            "avgDurationMs": 16.375
           },
           {
             "system": "Vector Only",
             "scorePercent": 56.25,
             "passRate": 37.5,
-            "avgDurationMs": 0.5
+            "avgDurationMs": 0.25
           },
           {
             "system": "Keyword + Recency",
@@ -188,7 +188,7 @@
             "system": "Recent Window",
             "scorePercent": 50,
             "passRate": 37.5,
-            "avgDurationMs": 0.125
+            "avgDurationMs": 0
           }
         ],
         "byFamily": [
@@ -277,7 +277,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 22,
+                "durationMs": 25,
                 "passed": true,
                 "score": 1,
                 "summary": "retrieved expected evidence",
@@ -336,7 +336,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 13,
+                "durationMs": 14,
                 "passed": true,
                 "score": 1,
                 "summary": "retrieved expected evidence",
@@ -371,7 +371,7 @@
               },
               {
                 "system": "Recent Window",
-                "durationMs": 1,
+                "durationMs": 0,
                 "passed": false,
                 "score": 0.5,
                 "summary": "retrieved expected evidence, but conflicting evidence still appeared later",
@@ -394,7 +394,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 13,
+                "durationMs": 15,
                 "passed": true,
                 "score": 1,
                 "summary": "retrieved expected evidence",
@@ -457,7 +457,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 13,
+                "durationMs": 15,
                 "passed": true,
                 "score": 1,
                 "summary": "retrieved expected evidence",
@@ -468,7 +468,7 @@
               },
               {
                 "system": "Vector Only",
-                "durationMs": 1,
+                "durationMs": 0,
                 "passed": true,
                 "score": 1,
                 "summary": "retrieved expected evidence",
@@ -518,7 +518,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 13,
+                "durationMs": 14,
                 "passed": true,
                 "score": 1,
                 "summary": "correct abstention",
@@ -527,7 +527,7 @@
               },
               {
                 "system": "Vector Only",
-                "durationMs": 1,
+                "durationMs": 0,
                 "passed": false,
                 "score": 0.5,
                 "summary": "no leak, but retrieved tangential context",
@@ -574,7 +574,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 13,
+                "durationMs": 16,
                 "passed": true,
                 "score": 1,
                 "summary": "retrieved expected evidence",
@@ -693,7 +693,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 12,
+                "durationMs": 13,
                 "passed": true,
                 "score": 1,
                 "summary": "correct abstention",
@@ -750,7 +750,7 @@
             "system": "Audrey",
             "scorePercent": 100,
             "passRate": 100,
-            "avgDurationMs": 14.75
+            "avgDurationMs": 16
           },
           {
             "system": "Keyword + Recency",
@@ -879,7 +879,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 14,
+                "durationMs": 15,
                 "passed": true,
                 "score": 1,
                 "summary": "correct abstention",
@@ -932,7 +932,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 16,
+                "durationMs": 17,
                 "passed": true,
                 "score": 1,
                 "summary": "retrieved expected evidence",
@@ -943,7 +943,7 @@
               },
               {
                 "system": "Vector Only",
-                "durationMs": 0,
+                "durationMs": 1,
                 "passed": false,
                 "score": 0,
                 "summary": "missed target evidence",
@@ -993,7 +993,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 15,
+                "durationMs": 18,
                 "passed": true,
                 "score": 1,
                 "summary": "retrieved expected evidence",
@@ -1004,7 +1004,7 @@
               },
               {
                 "system": "Vector Only",
-                "durationMs": 1,
+                "durationMs": 0,
                 "passed": false,
                 "score": 0,
                 "summary": "missed target evidence",
@@ -1055,7 +1055,7 @@
             "system": "Audrey",
             "scorePercent": 100,
             "passRate": 100,
-            "avgDurationMs": 14
+            "avgDurationMs": 15.25
           },
           {
             "system": "Vector Only",
@@ -1073,7 +1073,7 @@
             "system": "Recent Window",
             "scorePercent": 0,
             "passRate": 0,
-            "avgDurationMs": 0.25
+            "avgDurationMs": 0
           }
         ],
         "byFamily": [
@@ -1118,7 +1118,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 18,
+                "durationMs": 20,
                 "passed": true,
                 "score": 1,
                 "summary": "matched all required signals",
@@ -1176,7 +1176,7 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 13,
+                "durationMs": 14,
                 "passed": true,
                 "score": 1,
                 "summary": "matched all required signals",
@@ -1211,7 +1211,7 @@
               },
               {
                 "system": "Recent Window",
-                "durationMs": 1,
+                "durationMs": 0,
                 "passed": false,
                 "score": 0,
                 "summary": "missed required signals: decision:block, warning:must_follow, reflex:block",
@@ -1234,12 +1234,12 @@
             "results": [
               {
                 "system": "Audrey",
-                "durationMs": 13,
+                "durationMs": 15,
                 "passed": true,
                 "score": 1,
                 "summary": "matched all required signals",
                 "topResults": [
-                  "guard_hardened:replay_rejected error:guard receipt already has an outcome: 01KSSZ0Y0W5BPW0QA26ZDFWXGG",
+                  "guard_hardened:replay_rejected error:guard receipt already has an outcome: 01KX68PZ5QNVH4SM1NQ0ZEVHTW",
                   "decision:caution verdict:caution risk:0.55 Caution: 1 memory signal, 1 medium severity found before acting.",
                   "warning:recent_failure severity:medium npm test failed 1x recently: Vitest failed with spawn EPERM Before re-running npm test, check what changed since the last failure."
                 ],
@@ -1297,7 +1297,7 @@
                 "score": 1,
                 "summary": "matched all required signals",
                 "topResults": [
-                  "guard_hardened:non_guard_receipt_rejected error:not a guard receipt: 01KSSZ0Y19FPR6G897395CDBTH",
+                  "guard_hardened:non_guard_receipt_rejected error:not a guard receipt: 01KX68PZ643S3MRQMYPJ2PK7B3",
                   "decision:go verdict:clear risk:0 No relevant memory risks, prior failures, or must-follow procedures were found."
                 ],
                 "retrievalSummary": "guard_hardened:non_guard_receipt_rejected error:not a guard receipt: 01K | decision:go verdict:clear risk:0 No relevant memory risks, prior failure"
@@ -1352,7 +1352,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 22,
+            "durationMs": 25,
             "passed": true,
             "score": 1,
             "summary": "retrieved expected evidence",
@@ -1411,7 +1411,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 13,
+            "durationMs": 14,
             "passed": true,
             "score": 1,
             "summary": "retrieved expected evidence",
@@ -1446,7 +1446,7 @@
           },
           {
             "system": "Recent Window",
-            "durationMs": 1,
+            "durationMs": 0,
             "passed": false,
             "score": 0.5,
             "summary": "retrieved expected evidence, but conflicting evidence still appeared later",
@@ -1469,7 +1469,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 13,
+            "durationMs": 15,
             "passed": true,
             "score": 1,
             "summary": "retrieved expected evidence",
@@ -1532,7 +1532,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 13,
+            "durationMs": 15,
             "passed": true,
             "score": 1,
             "summary": "retrieved expected evidence",
@@ -1543,7 +1543,7 @@
           },
           {
             "system": "Vector Only",
-            "durationMs": 1,
+            "durationMs": 0,
             "passed": true,
             "score": 1,
             "summary": "retrieved expected evidence",
@@ -1593,7 +1593,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 13,
+            "durationMs": 14,
             "passed": true,
             "score": 1,
             "summary": "correct abstention",
@@ -1602,7 +1602,7 @@
           },
           {
             "system": "Vector Only",
-            "durationMs": 1,
+            "durationMs": 0,
             "passed": false,
             "score": 0.5,
             "summary": "no leak, but retrieved tangential context",
@@ -1649,7 +1649,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 13,
+            "durationMs": 16,
             "passed": true,
             "score": 1,
             "summary": "retrieved expected evidence",
@@ -1768,7 +1768,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 12,
+            "durationMs": 13,
             "passed": true,
             "score": 1,
             "summary": "correct abstention",
@@ -1882,7 +1882,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 14,
+            "durationMs": 15,
             "passed": true,
             "score": 1,
             "summary": "correct abstention",
@@ -1935,7 +1935,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 16,
+            "durationMs": 17,
             "passed": true,
             "score": 1,
             "summary": "retrieved expected evidence",
@@ -1946,7 +1946,7 @@
           },
           {
             "system": "Vector Only",
-            "durationMs": 0,
+            "durationMs": 1,
             "passed": false,
             "score": 0,
             "summary": "missed target evidence",
@@ -1996,7 +1996,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 15,
+            "durationMs": 18,
             "passed": true,
             "score": 1,
             "summary": "retrieved expected evidence",
@@ -2007,7 +2007,7 @@
           },
           {
             "system": "Vector Only",
-            "durationMs": 1,
+            "durationMs": 0,
             "passed": false,
             "score": 0,
             "summary": "missed target evidence",
@@ -2058,7 +2058,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 18,
+            "durationMs": 20,
             "passed": true,
             "score": 1,
             "summary": "matched all required signals",
@@ -2116,7 +2116,7 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 13,
+            "durationMs": 14,
             "passed": true,
             "score": 1,
             "summary": "matched all required signals",
@@ -2151,7 +2151,7 @@
           },
           {
             "system": "Recent Window",
-            "durationMs": 1,
+            "durationMs": 0,
             "passed": false,
             "score": 0,
             "summary": "missed required signals: decision:block, warning:must_follow, reflex:block",
@@ -2174,12 +2174,12 @@
         "results": [
           {
             "system": "Audrey",
-            "durationMs": 13,
+            "durationMs": 15,
             "passed": true,
             "score": 1,
             "summary": "matched all required signals",
             "topResults": [
-              "guard_hardened:replay_rejected error:guard receipt already has an outcome: 01KSSZ0Y0W5BPW0QA26ZDFWXGG",
+              "guard_hardened:replay_rejected error:guard receipt already has an outcome: 01KX68PZ5QNVH4SM1NQ0ZEVHTW",
               "decision:caution verdict:caution risk:0.55 Caution: 1 memory signal, 1 medium severity found before acting.",
               "warning:recent_failure severity:medium npm test failed 1x recently: Vitest failed with spawn EPERM Before re-running npm test, check what changed since the last failure."
             ],
@@ -2237,7 +2237,7 @@
             "score": 1,
             "summary": "matched all required signals",
             "topResults": [
-              "guard_hardened:non_guard_receipt_rejected error:not a guard receipt: 01KSSZ0Y19FPR6G897395CDBTH",
+              "guard_hardened:non_guard_receipt_rejected error:not a guard receipt: 01KX68PZ643S3MRQMYPJ2PK7B3",
               "decision:go verdict:clear risk:0 No relevant memory risks, prior failures, or must-follow procedures were found."
             ],
             "retrievalSummary": "guard_hardened:non_guard_receipt_rejected error:not a guard receipt: 01K | decision:go verdict:clear risk:0 No relevant memory risks, prior failure"

package/docs/paper/output/submission-bundle/docs/AUDREY_PAPER_OUTLINE.md

@@ -123,8 +123,10 @@ Metrics:
 - Why tool annotations are hints, not policy guarantees.
 - What Audrey borrows from graph memory without adding a graph database to the core.
 - Limitations:
-  - Claude Code hook config can be applied with a guarded settings merge, but
-    equivalent Codex hook wiring still depends on a stable host hook surface.
+  - Audrey 1.1 applies lifecycle hooks for Claude Code and Codex, but it can
+    inspect only the events and tool paths emitted by each trusted host.
+  - Hooks start short-lived Audrey processes; a persistent local runtime and
+    measured host-version compatibility gates remain production work.
   - Validation lineage is bound to exact preflight event evidence, but feedback
     does not yet tune risk scoring.
   - Local comparative GuardBench numbers exist; no external-system numbers yet.
@@ -134,7 +136,7 @@ Metrics:
 
 - Agent memory should be judged by whether it changes future actions, not just whether it retrieves relevant text.
 - Audrey Guard demonstrates a practical local loop for using memory as a pre-action control layer.
-- The next publishable milestone is live external-adapter GuardBench output plus broader host-hook integration.
+- The next publishable milestone is live external-adapter GuardBench output plus measured real-host coverage and a persistent hook runtime.
 
 ## Figures and Tables
 
@@ -168,6 +170,7 @@ Metrics:
 - MCP tool annotations and trust model: https://modelcontextprotocol.io/specification/2025-11-25/server/tools and https://modelcontextprotocol.io/specification/2025-11-25/schema
 - MCP annotation risk vocabulary: https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/
 - Claude Code hooks: https://code.claude.com/docs/en/hooks
+- Codex hooks: https://developers.openai.com/codex/hooks
 - Mem0 token-efficient memory algorithm: https://mem0.ai/blog/mem0-the-token-efficient-memory-algorithm
 - MemOS: https://huggingface.co/papers/2507.03724
 - MCP Security Bench: https://huggingface.co/papers/2510.15994

package/docs/paper/output/submission-bundle/docs/paper/06-implementation.md

@@ -84,11 +84,13 @@ The JSON walker redacts sensitive keys and values recursively. If a value sits u
 
 ## MCP, CLI, and REST Surfaces
 
-The MCP server registers 20 tools: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_reflexes`, and `memory_promote` (Ledger: E32). The Guard-relevant MCP surface is `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, and `memory_reflexes`, with `memory_validate` supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
+The MCP server registers 22 tools: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, `memory_reflexes`, and `memory_promote` (Ledger: E32). The Guard-relevant MCP surface is `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, and `memory_reflexes`, with `memory_validate` supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
 
-The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact` (Ledger: E34). The `guard` subcommand invokes the controller, prints JSON or formatted output, exits nonzero for blocking decisions unless an explicit override is supplied, and can run as a Claude Code PreToolUse hook with `--hook`. `hook-config claude-code --apply` merges the generated hook block into Claude Code settings with backup/idempotence (Ledger: E26, E43).
+The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `guard-after`, `hook`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact` (Ledger: E34). The `guard` subcommand remains available for explicit checks, while the host-facing `hook` subcommand normalizes current Claude Code and Codex lifecycle payloads. `audrey install --host auto` discovers installed supported CLIs, registers the MCP server, and applies host-specific lifecycle hooks from a stable Node and Audrey entrypoint. Generated settings preserve unrelated hooks, replace older Audrey-owned handlers, write backups before changing non-empty files, and are idempotent. Claude Code supports local, project, and user hook scopes; Codex supports project and user scopes and requires one-time review of non-managed hooks through `/hooks` (Ledger: E26, E43).
 
-The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without `AUDREY_API_KEY` unless `AUDREY_ALLOW_NO_AUTH=1`, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless `AUDREY_ENABLE_ADMIN_TOOLS=1` (Ledger: E33).
+The generated lifecycle covers session start, user prompt submission, guarded pre-tool use, correlated post-tool outcomes, post-compaction, and turn stop. Session and prompt hooks inject bounded, agent-scoped memory context. Retrieval queries are bounded before embedding: large prompts and edits contribute redacted previews, lengths, and hashes rather than unbounded bodies, while exact Guard identity digests the full normalized, redacted action. Pre-tool hooks create Guard receipts, and post-tool hooks close the matching receipt by `session_id + tool_use_id`; sanitized failures may become durable memories. Claude Code exposes an explicit failure event. Current Codex Bash hooks can omit exit status, so Audrey records an opaque result as `unknown` unless structured fields or response text establish success or failure. Stop and post-compaction hooks run consolidation only when due. Audrey fails open on hook-runtime errors by default, with explicit fail-closed operation available through `AUDREY_HOOK_FAIL_CLOSED=1`. This is lifecycle integration, not a complete enforcement boundary: Audrey can inspect only the events and tool paths emitted by each host, and the short-lived hook process still pays provider startup cost instead of using a persistent daemon (Ledger: E43, E44).
+
+The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, Guard before/after receipts, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without `AUDREY_API_KEY` unless `AUDREY_ALLOW_NO_AUTH=1`, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless `AUDREY_ENABLE_ADMIN_TOOLS=1` (Ledger: E33).
 
 ## Configuration
 

package/docs/paper/output/submission-bundle/docs/paper/07-evaluation.md

@@ -24,14 +24,14 @@ These numbers measure Audrey's local call path under an in-process mock embeddin
 
 ## Behavioral Regression Result
 
-The current `benchmarks/output/summary.json` was generated on 2026-05-29T13:33:19.790Z with command `node benchmarks/run.js --provider mock --dimensions 64` (Ledger: E24). It reports:
+The current `benchmarks/output/summary.json` was generated on 2026-07-10T15:00:37.705Z with command `node benchmarks/run.js --provider mock --dimensions 64` (Ledger: E24). It reports:
 
 | System | Score Percent | Pass Rate | Average Duration Ms |
 |---|---:|---:|---:|
-| Audrey | 100 | 100 | 14.75 |
-| Vector Only | 41.66666666666667 | 25 | 0.4166666666666667 |
+| Audrey | 100 | 100 | 16.25 |
+| Vector Only | 41.66666666666667 | 25 | 0.25 |
 | Keyword + Recency | 41.66666666666667 | 25 | 0.5833333333333334 |
-| Recent Window | 37.5 | 25 | 0.08333333333333333 |
+| Recent Window | 37.5 | 25 | 0 |
 
 This output is a regression-gate result. The baselines are toy local baselines used to catch retrieval and lifecycle regressions in the Audrey codebase. They are not external systems, not tuned competitor implementations, and not GuardBench baselines (Ledger: E23-E24). The current suite covers retrieval and operation families such as information extraction, knowledge updates, multi-session reasoning, conflict resolution, procedural learning, privacy boundary, overwrite, delete-and-abstain, semantic merge, and procedural merge (Ledger: E23-E24).
 
@@ -55,7 +55,7 @@ It reports local adapters only, not external-system comparisons (Ledger: E46):
 | Evidence recall | 100% |
 | Redaction leaks | 0 |
 | Recall-degradation detection | 100% |
-| Guard latency p50 / p95 | 3.09 ms / 28.181 ms |
+| Guard latency p50 / p95 | 3.501 ms / 20.658 ms |
 | Published artifact raw-secret leaks | 0 |
 | Audrey Guard decision accuracy | 100% |
 | No-memory decision accuracy | 10% |

package/docs/paper/output/submission-bundle/docs/paper/08-discussion-limitations.md

@@ -46,7 +46,7 @@ Reflex generation is deterministic, not adaptive. Reflexes are mapped from prefl
 
 ## Open Problems
 
-Host hook parity. Audrey exposes CLI pieces that host hooks can call, and Claude Code documents hook extension points [@anthropic2026claudecodehooks]. Audrey now generates and applies Claude Code hook settings, `guard --hook` emits the current PreToolUse `hookSpecificOutput.permissionDecision` shape, and `observe-tool` records post-tool events (Ledger: E43). The remaining production installer work is equivalent wiring for hosts with stable hook surfaces, especially Codex.
+Host hook coverage and process model. Audrey 1.1 generates, applies, and removes lifecycle hooks for current Claude Code and Codex CLIs; the shared adapter injects bounded context, runs Guard before selected side-effectful tools, correlates post-tool outcomes, and performs due-only maintenance (Ledger: E43). This closes the configuration gap, not the enforcement gap. Hook execution still depends on host trust and on the host emitting a supported event for the relevant tool path. Alternate or incompletely intercepted host tool paths remain outside Audrey's view. Each hook also starts a short-lived Audrey process, so the default local embedding provider can pay cold-start cost repeatedly. Production follow-up is a persistent local runtime, measured compatibility gates against supported host versions, and organization-managed deployment that binds tenant identity and enforcement policy outside a caller-controlled routing header. Claude Code's documented hook surface remains an example of the underlying host boundary [@anthropic2026claudecodehooks].
 
 Validation lineage is implemented but not yet policy-adaptive. Audrey can bind validation events to the exact preflight event, evidence IDs, and action key that produced a decision, and rejects mismatched evidence claims (Ledger: E44). The next step is using that closed-loop signal to tune warning priority and recommendation wording without giving the model direct control over policy.