auxilo-mcp 0.9.2 → 0.9.4

package/mcp-server.js

@@ -160,14 +160,16 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.2' },
+  { name: 'auxilo', version: '0.9.4' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.
 
 SEARCH BEFORE YOU DEBUG: When you encounter a non-trivial problem — an unfamiliar API, an unexpected error, an integration challenge — search Auxilo FIRST using auxilo_knowledge before spending tokens on trial-and-error. A free search that returns one verified answer saves minutes of debugging and dollars in API calls. Rule: if your first attempt fails, search Auxilo before trying a second approach.
 
-CONTRIBUTE AFTER YOU SOLVE: When you solve a non-trivial problem through debugging, experimentation, or combining information from multiple sources, submit the learning to Auxilo using auxilo_contribute. This includes: workarounds for undocumented behavior, edge cases, subtle bugs, API quirks, and solutions that required multiple attempts to find. Do NOT submit trivial lookups or well-documented standard approaches.
+CONTRIBUTE AFTER YOU SOLVE: When you solve a non-trivial TECHNICAL problem through debugging, experimentation, or combining information from multiple sources, submit the learning to Auxilo using auxilo_contribute. This includes: workarounds for undocumented behavior, edge cases, subtle bugs, API quirks, and solutions that required multiple attempts to find. Do NOT submit trivial lookups or well-documented standard approaches.
+
+TECHNICAL SCOPE (hard rule — the server refuses anything else): Auxilo accepts TECHNICAL learnings only — APIs, developer tools, code, infrastructure, data pipelines, monitoring, payment/crypto technology, debugging. Never submit interpersonal or communication strategy, copywriting/content/marketing insights, business or negotiation strategy, personal matters, or creative-writing technique. Categories: data-processing, web-interaction, code-execution, storage-state, payment-financial, monitoring. A technical learning about a messaging/email/notification API belongs under web-interaction or code-execution; content/data pipeline tech belongs under data-processing. SYSTEM-FACT TEST: submit ONLY when a system and a symptom are at the core — an error, an undocumented limitation, a reproducible behavior of an external tool/API/OS. Advice about how to work (process, workflow, methodology, decision practice) is not a learning and is held for review, regardless of quality score.
 
 QUALITY GATE: Before submitting, self-assess on four dimensions (1-5 each): Specificity, Actionability, Novelty, Completeness. Only submit if total >= 14/20 and no single dimension is below 3.
 
@@ -234,19 +236,20 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_contribute',
-      description: 'Submit operational knowledge you discovered during this session to the Auxilo marketplace. WHEN TO USE: Call this AFTER you solve a non-trivial problem that required debugging, experimentation, or combining information from multiple sources. Call it when you discover undocumented behavior, a workaround, or a subtle edge case. Do NOT call it for trivial lookups or standard documentation answers. QUALITY GATE: Self-assess on Specificity, Actionability, Novelty, Completeness (1-5 each) and ALWAYS include your scores in quality_self_assessment — a submission WITHOUT it is held for manual review instead of publishing seamlessly. Only submit if total >= 14/20, no dimension below 3 (the server quarantines below-floor submissions for review). DEDUP: Search auxilo_knowledge first to avoid duplicates. SENSITIVITY (mandatory self-screen): never include secrets, credentials, API keys, PII, private filesystem paths, or proprietary/client business content — generalize to placeholders or omit; this is a PUBLIC marketplace. PRICING: Leave unlock_price unset to let the dynamic pricing engine calculate automatically (recommended). If setting manually: $0.05-$0.10 common techniques, $0.10-$1.00 specific solutions, $1.00-$10.00 novel discoveries, $10.00-$50.00 breakthroughs. Minimum $0.05, maximum $50.00. Free to submit — you earn 70% when others unlock. If the result is status pending_review, follow its how_to_review instructions (self-approval via `auxilo review`, the dashboard queue, or GET /account/pending).',
+      description: 'Submit TECHNICAL operational knowledge you discovered during this session to the Auxilo marketplace. WHEN TO USE: Call this AFTER you solve a non-trivial TECHNICAL problem that required debugging, experimentation, or combining information from multiple sources. Call it when you discover undocumented behavior, a workaround, or a subtle edge case. Do NOT call it for trivial lookups or standard documentation answers. SCOPE (hard rule — the server refuses out-of-scope submissions with CATEGORY_OUT_OF_SCOPE): technical learnings ONLY — APIs, developer tools, code, infrastructure, data pipelines, monitoring, payment/crypto technology, debugging. NEVER submit interpersonal/communication strategy, copywriting/content/marketing insights, business or negotiation strategy, personal matters, or creative-writing technique. A technical learning about a messaging/email/notification API belongs under web-interaction or code-execution; content/data pipeline tech belongs under data-processing. QUALITY GATE: Self-assess on Specificity, Actionability, Novelty, Completeness (1-5 each) and ALWAYS include your scores in quality_self_assessment — a submission WITHOUT it is held for manual review instead of publishing seamlessly. Only submit if total >= 14/20, no dimension below 3 (the server quarantines below-floor submissions for review). DEDUP: Search auxilo_knowledge first to avoid duplicates. SENSITIVITY (mandatory self-screen): never include secrets, credentials, API keys, PII, private filesystem paths, or proprietary/client business content — generalize to placeholders or omit; this is a PUBLIC marketplace. PRICING: Leave unlock_price unset to let the dynamic pricing engine calculate automatically (recommended). If setting manually: $0.05-$0.10 common techniques, $0.10-$1.00 specific solutions, $1.00-$10.00 novel discoveries, $10.00-$50.00 breakthroughs. Minimum $0.05, maximum $50.00. Free to submit — you earn 70% when others unlock. If the result is status pending_review, follow its how_to_review instructions (self-approval via `auxilo review`, the dashboard queue, or GET /account/pending).',
       inputSchema: {
         type: 'object',
         properties: {
           title: { type: 'string', description: 'Concise title (min 10 chars)' },
           body: { type: 'string', description: 'Detailed explanation — what you tried, what worked, what failed (min 50 chars)' },
-          category: { type: 'string', enum: ['data-processing', 'web-interaction', 'code-execution', 'communication', 'storage-state', 'content-generation', 'payment-financial', 'monitoring'] },
+          // CI-5: technical-only taxonomy — 'communication' and 'content-generation' retired.
+          category: { type: 'string', enum: ['data-processing', 'web-interaction', 'code-execution', 'storage-state', 'payment-financial', 'monitoring'] },
           tags: { type: 'array', items: { type: 'string' }, description: 'Relevant keywords' },
           task_context: { type: 'string', description: 'What task were you performing?' },
           outcome: { type: 'string', enum: ['success', 'partial', 'failure', 'workaround'] },
           quality_self_assessment: {
             type: 'object',
-            description: 'Your quality self-assessment. ALWAYS include this — without it the submission is held for manual review. Score each dimension 1-5; total MUST equal their sum (server-verified). Submissions below the floor (total < 14 or any dimension < 3) are quarantined for review rather than published.',
+            description: 'Your quality self-assessment. ALWAYS include this — without it the submission is held for manual review. Score each dimension 1-5; total MUST equal their sum (server-verified). Submissions below the floor (total < 14 or any dimension < 3) are quarantined for review rather than published. High scores REQUIRE a system+symptom anchor — a named external system and a concrete error/limitation/reproducible behavior an agent would search mid-task; process or workflow advice cannot score high no matter how polished (the server holds it for review as process_advice).',
             properties: {
               specificity: { type: 'integer', minimum: 1, maximum: 5, description: 'How precise and detailed? (1-5)' },
               actionability: { type: 'integer', minimum: 1, maximum: 5, description: 'Can another agent directly use this? (1-5)' },
@@ -272,7 +275,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         type: 'object',
         properties: {
           query: { type: 'string', description: 'What you need help with' },
-          category: { type: 'string', enum: ['data-processing', 'web-interaction', 'code-execution', 'communication', 'storage-state', 'content-generation', 'payment-financial', 'monitoring'] },
+          // CI-5: learnings are technical-only; retired labels match nothing post-migration.
+          category: { type: 'string', enum: ['data-processing', 'web-interaction', 'code-execution', 'storage-state', 'payment-financial', 'monitoring'] },
           outcome: { type: 'string', enum: ['success', 'partial', 'failure', 'workaround'] },
           related_skill: { type: 'string', description: 'Filter by Auxilo skill ID' },
           limit: { type: 'number', description: 'Max results (default 5, max 15)' },
@@ -283,7 +287,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_unlock',
-      description: 'Unlock full learning content by ID. Price is set by the contributor (min $0.05 USDC). 70% of the amount you pay goes to the contributor who shared this knowledge. Check unlock_price_usd in search results to see the cost before unlocking.',
+      description: 'Unlock full learning content by ID. Price is set by the contributor (min $0.05 USDC). 70% of the amount you pay goes to the contributor who shared this knowledge. Check unlock_price_usd in search results to see the cost before unlocking. YOUR OWN learnings are $0: anything this account contributed (or that was contributed under a wallet linked to this account) comes back free, with no credit deducted and no earnings movement.',
       inputSchema: {
         type: 'object',
         properties: {
@@ -295,7 +299,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_rate',
-      description: 'Rate a learning 1-5 after using it. WHEN TO USE: After you unlock and apply knowledge from auxilo_unlock, always come back and rate it. Your rating helps other agents find the best knowledge and deprioritizes low-quality submissions. This is how the marketplace stays useful. Free.',
+      description: 'Rate a learning 1-5 after using it. WHEN TO USE: After you unlock and apply knowledge from auxilo_unlock, always come back and rate it. Your rating helps other agents find the best knowledge and deprioritizes low-quality submissions. This is how the marketplace stays useful. Free. One rating slot per account per learning: re-rating REPLACES your prior score, it never counts twice (CH-6). REQUIRES: your API key (run `npx auxilo setup` if unset) and a prior unlock of this learning by your account — only verified purchasers can rate (LW-7).',
       inputSchema: {
         type: 'object',
         properties: {
@@ -390,27 +394,27 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_review',
-      description: 'Review YOUR OWN pending-review learnings (from background extraction) so they can be approved to the public marketplace or rejected to stay private. Account-scoped: only the authenticated account\'s own pending items are ever visible or affected. ACTIONS: "list" returns the triage summary (counts + compact rows with quality score and platform screen verdicts: injection, content sensitivity, near-duplicate). "approve" / "reject" apply explicit decisions to the ids you pass (the operator must have named or confirmed these items). "approve_clean" selects every item that passed ALL platform screens AND has quality >= min_quality (default 14/20); it is DRY-RUN BY DEFAULT and returns exactly what WOULD be approved. CONSENT CONTRACT: nothing goes public without the contributor\'s explicit approval. So before executing approve_clean you MUST show the operator the dry-run list and count and get their confirmation, then call again with dry_run:false, confirm:true, and expected_count set to the dry-run count. The server also enforces a counted-confirmation gate on every bulk call. Requires your configured API key (or session_token).',
+      description: 'Review YOUR OWN pending-review learnings (from background extraction) so they can be approved to the public marketplace or rejected to stay private. Account-scoped: only the authenticated account\'s own pending items are ever visible or affected. ACTIONS: "list" returns the triage summary (counts incl. by_signal + compact rows with quality score, lane, a one-sentence why for flagged items, and platform screen verdicts: injection, content sensitivity, near-duplicate). "approve" / "reject" apply explicit decisions to the ids you pass (the operator must have named or confirmed these items). "approve_clean" selects every item that passed ALL platform screens AND has quality >= min_quality (default 14/20); it is DRY-RUN BY DEFAULT and returns exactly what WOULD be approved. "reject_by_signal" bulk-rejects every pending item carrying one flag signal (e.g. social_handle) — REJECT ONLY (items stay private; there is deliberately no bulk approve by class): the operator must confirm the signal AND its by_signal count from "list", and you pass that count as expected_count — the server refuses if the live selection differs. "sanitize" resubmits ONE operator-corrected item through EVERY screen with lineage (the original is retired to private, reason sanitize-resubmit; the replacement is ALWAYS held for the operator\'s explicit approval — never auto-published): only call it with a correction the operator reviewed. CONSENT CONTRACT: nothing goes public without the contributor\'s explicit approval. So before executing approve_clean you MUST show the operator the dry-run list and count and get their confirmation, then call again with dry_run:false, confirm:true, and expected_count set to the dry-run count. The server also enforces a counted-confirmation gate on every bulk call. Requires your configured API key (or session_token).',
       inputSchema: {
         type: 'object',
         properties: {
-          action: { type: 'string', enum: ['list', 'approve', 'reject', 'approve_clean'], description: 'What to do. Start with "list".' },
+          action: { type: 'string', enum: ['list', 'approve', 'reject', 'approve_clean', 'reject_by_signal', 'sanitize'], description: 'What to do. Start with "list".' },
           ids: { type: 'array', items: { type: 'string' }, description: 'Learning ids for action approve/reject. These must be items the operator explicitly chose.' },
-          reason: { type: 'string', description: 'Optional rejection reason (action reject; max 500 chars).' },
+          reason: { type: 'string', description: 'Optional rejection reason (actions reject / reject_by_signal; max 500 chars).' },
+          signal: { type: 'string', description: 'reject_by_signal only. The flag signal to reject by (a name from counts.by_signal, e.g. social_handle, person_name, injection).' },
+          id: { type: 'string', description: 'sanitize only. The pending/rejected learning being corrected (operator-chosen).' },
+          title: { type: 'string', description: 'sanitize only. Corrected title (omit to keep the original).' },
+          body: { type: 'string', description: 'sanitize only. Corrected body (omit to keep the original). At least one of title/body is required.' },
+          tags: { type: 'array', items: { type: 'string' }, description: 'sanitize only. Corrected tags (omit to keep the original).' },
           dry_run: { type: 'boolean', description: 'approve_clean only. Default TRUE: report what would be approved without changing anything. Set false only together with confirm:true and expected_count after the operator confirmed the dry-run list.' },
           confirm: { type: 'boolean', description: 'approve_clean only. Must be exactly true to execute. Never set this without the operator\'s explicit go-ahead on the dry-run output.' },
-          expected_count: { type: 'number', description: 'approve_clean execute only. The count from the dry run, echoed back. If the live selection differs (queue changed), nothing is approved and a fresh dry run is returned.' },
+          expected_count: { type: 'number', description: 'approve_clean execute + reject_by_signal. The count the operator confirmed (dry-run count / by_signal count), echoed back. If the live selection differs (queue changed), nothing is mutated.' },
           min_quality: { type: 'number', description: 'approve_clean quality threshold 0-20 (default 14). 0 includes unscored items.' },
           session_token: { type: 'string', description: 'Optional JWT session token from /auth/verify. If omitted, your configured API key authenticates the account.' },
         },
         required: ['action'],
       },
     },
-    {
-      name: 'get_stats',
-      description: 'Get Auxilo registry statistics — catalog size, skill types, and query volume. Free.',
-      inputSchema: { type: 'object', properties: {} },
-    },
     {
       name: 'get_knowledge_stats',
       description: 'Get knowledge marketplace statistics — total learnings, unlocks, contributors, and top categories. Free.',
@@ -703,12 +707,52 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           });
         }
 
-        return text({ error: `Unknown action: ${args.action}. Use list, approve, reject, or approve_clean.` });
-      }
+        if (args.action === 'reject_by_signal') {
+          // SPEC3 B2 (§5.2): server-side counted bulk reject by flag class.
+          // The operator confirms signal + by_signal count from {action:"list"};
+          // the server refuses (409, nothing mutated) if the live selection
+          // differs. Reject-only — the safe direction (items stay private).
+          if (typeof args.signal !== 'string' || !args.signal) {
+            return text({ error: 'reject_by_signal requires "signal" (a name from counts.by_signal — run {action:"list"} first).' });
+          }
+          if (!Number.isInteger(args.expected_count)) {
+            return text({ error: 'reject_by_signal requires expected_count: the by_signal count the operator confirmed. This is the counted-confirmation gate.' });
+          }
+          const resp = await fetch(`${AUXILO_BASE}/account/pending/reject-by-signal`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+              signal: args.signal,
+              expected_count: args.expected_count,
+              ...(args.reason && { reason: args.reason }),
+            }),
+          });
+          return text(await resp.json());
+        }
 
-      case 'get_stats': {
-        const resp = await fetch(`${AUXILO_BASE}/stats`, { headers: baseHeaders() });
-        return text(await resp.json());
+        if (args.action === 'sanitize') {
+          // SPEC3 B3 (§5.3): operator-corrected resubmission through EVERY
+          // screen, with lineage. The replacement is ALWAYS held for the
+          // operator's explicit approve — this action can never publish.
+          if (typeof args.id !== 'string' || !args.id) {
+            return text({ error: 'sanitize requires "id" (the pending/rejected learning the operator chose to correct).' });
+          }
+          if (args.title === undefined && args.body === undefined) {
+            return text({ error: 'sanitize requires at least one of "title" / "body" (the operator-reviewed correction).' });
+          }
+          const resp = await fetch(`${AUXILO_BASE}/account/pending/${encodeURIComponent(args.id)}/sanitize`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+              ...(args.title !== undefined && { title: args.title }),
+              ...(args.body !== undefined && { body: args.body }),
+              ...(args.tags !== undefined && { tags: args.tags }),
+            }),
+          });
+          return text(await resp.json());
+        }
+
+        return text({ error: `Unknown action: ${args.action}. Use list, approve, reject, approve_clean, reject_by_signal, or sanitize.` });
       }
 
       case 'get_knowledge_stats': {
@@ -736,12 +780,12 @@ if (require.main !== module) {
   return;
 }
 
-// ─── CLI delegation (LW-17) ────────────────────────────────────────────────────
-// `npx auxilo-mcp setup|status|review|disable` runs the full turnkey CLI.
+// ─── CLI delegation (LW-17; init added Wave 3.4/NF-3) ─────────────────────────
+// `npx auxilo-mcp setup|init|status|review|disable` runs the full turnkey CLI.
 // npx resolves PACKAGE names, not bin aliases — the documented `npx auxilo
 // setup` 404s until the `auxilo` npm package name is claimed, so the package
 // bin must handle these commands itself.
-if (['setup', 'status', 'review', 'disable'].includes(process.argv[2])) {
+if (['setup', 'init', 'status', 'review', 'disable'].includes(process.argv[2])) {
   require('./bin/auxilo-cli.js').run();
   return; // module-level return in CommonJS stops the MCP server from starting
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",
@@ -17,6 +17,7 @@
     "scripts/runner.js",
     "scripts/capture-core.js",
     "scripts/extract-local.js",
+    "scripts/review-notice.js",
     "scripts/sources/",
     "scripts/hooks/auxilo-extract.sh",
     "README.md",
@@ -24,7 +25,7 @@
   ],
   "scripts": {
     "start": "node mcp-server.js",
-    "test": "node --test --test-force-exit test/*.test.js"
+    "test": "node --test test/*.test.js && node tests/test-mobile-nav-overlay.js"
   },
   "keywords": [
     "mcp",
@@ -49,11 +50,14 @@
   "homepage": "https://auxilo.io",
   "license": "MIT",
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.1090.0",
+    "@aws-sdk/lib-storage": "^3.1090.0",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "stripe": "^17.0.0",
     "viem": "^2.46.3"
   },
   "devDependencies": {
+    "playwright": "1.61.1",
     "proxyquire": "^2.1.3"
   }
-}
+}

package/scripts/extract-local.js

@@ -17,12 +17,40 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-const CATEGORIES = ['data-processing', 'web-interaction', 'code-execution', 'communication', 'storage-state', 'content-generation', 'payment-financial', 'monitoring'];
+// CI-5 (PUNCH-LIST §30, 2026-07-19): Auxilo is TECHNICAL-ONLY. The learning
+// taxonomy is these six tech categories; `communication` and `content-generation`
+// are RETIRED — the server 400s them (CATEGORY_OUT_OF_SCOPE) and this extractor
+// must never emit them. This file ships standalone in the npm package, so the
+// lists are duplicated here from lib/category-scope-migration.js (server truth);
+// test/ci5-scope-enforcement.test.js pins the copies equal.
+const CATEGORIES = ['data-processing', 'web-interaction', 'code-execution', 'storage-state', 'payment-financial', 'monitoring'];
+const RETIRED_CATEGORIES = ['communication', 'content-generation'];
 
-const EXTRACTION_PROMPT = `You are extracting reusable OPERATIONAL LEARNINGS from an AI agent's session transcript, to publish to a PUBLIC knowledge marketplace read by other AI agents.
+/**
+ * SPEC3 slice A1 gate — score-at-extraction, BUILT BUT DARK by default.
+ *
+ * ┌─ CRITICAL SEQUENCING CONSTRAINT (SPEC3-BUILDER-REVIEW-LOOP §3.1/§8) ──────┐
+ * │ Under a server WITHOUT the B1 extraction-channel hold, a clean /learn     │
+ * │ submission carrying a floor-passing quality_self_assessment publishes    │
+ * │ IMMEDIATELY (seamlessEligible). Turning this gate on against such a      │
+ * │ server silently flips hook extraction from "everything held" to "clean   │
+ * │ items auto-publish" — an unrecorded consent change (2026-06-10 class).   │
+ * │ Do NOT set AUXILO_SCORE_EXTRACTION=1 until the server holds              │
+ * │ submission_channel:'extraction' items behind standing consent (B1).      │
+ * └───────────────────────────────────────────────────────────────────────────┘
+ */
+function scoreExtractionEnabled(env = process.env) {
+  return env.AUXILO_SCORE_EXTRACTION === '1';
+}
+
+const EXTRACTION_PROMPT_BASE = `You are extracting reusable OPERATIONAL LEARNINGS from an AI agent's session transcript, to publish to a PUBLIC knowledge marketplace read by other AI agents.
 
 Extract 0 to 5 GENUINE learnings: non-obvious solutions, workarounds, API quirks, error root-causes, integration gotchas — the kind of thing that cost real debugging or combined multiple sources. SKIP trivial lookups, well-documented standard approaches, opinions, and conversation.
 
+HARD SCOPE RULE — TECHNICAL LEARNINGS ONLY (the marketplace accepts nothing else): extract ONLY technical/operational learnings — APIs, developer tools, code, infrastructure, data pipelines, monitoring/observability, payment/crypto TECHNOLOGY, debugging. NEVER extract interpersonal or communication strategy, copywriting/content/marketing insights, business or negotiation strategy, personal matters, or creative-writing technique — DROP such candidates entirely, do not relabel them. A technical learning about a messaging/email/notification API belongs under "web-interaction" or "code-execution"; content/data pipeline TECH belongs under "data-processing".
+
+SYSTEM-FACT TEST (CI-7): Extract ONLY when a system and a symptom are at the core — an error, an undocumented limitation, a reproducible behavior of an external tool/API/OS. If the candidate is advice about how to work (process, workflow, methodology, decision practice), do NOT extract it. "Odesli cannot resolve Tidal artist URLs" is a learning; "use a two-phase consultation workflow" is not, no matter how well it would score.
+
 MANDATORY SENSITIVITY SELF-SCREEN (the marketplace is PUBLIC): NEVER include secrets, credentials, API keys, tokens, private keys, or seed phrases; personal data (real people's names, emails, phone numbers, wallet addresses); private filesystem paths, internal hostnames, or infrastructure identifiers; proprietary, confidential, or client-specific business content. Rewrite specifics into generic placeholders (/Users/USER/..., API_KEY, "a client") or omit them. If a learning cannot be generalized without leaking private material, DROP it entirely.
 
 Output STRICT JSON ONLY — an array (possibly empty []) of objects with these keys:
@@ -31,12 +59,39 @@ Output STRICT JSON ONLY — an array (possibly empty []) of objects with these k
   "category": one of ${JSON.stringify(CATEGORIES)}
   "tags": array of lowercase keyword strings
   "task_context": one sentence describing the task
-  "outcome": one of "success","partial","failure","workaround"
+  "outcome": one of "success","partial","failure","workaround"`;
+
+/** A1: rubric addendum — appended ONLY when scoreExtractionEnabled(). */
+const QUALITY_RUBRIC_ADDENDUM = `
+  "quality_self_assessment": an object scoring the learning honestly on four
+  dimensions, each an INTEGER 1-5: "specificity" (precise and detailed, not
+  vague), "actionability" (another agent can directly use it), "novelty"
+  (non-obvious; an LLM would likely get it wrong), "completeness" (context,
+  reproduction steps, caveats), plus "total" (the exact sum of the four).
+  A learning worth publishing scores at least 14/20 with no dimension below 3.
+  High scores REQUIRE a system+symptom anchor — a named external system and a
+  concrete error/limitation/behavior; process or workflow advice cannot score
+  high no matter how polished (CI-7 system-fact test).
+  If a learning honestly scores below that bar, DROP it from the array rather
+  than inflating the numbers.`;
+
+const PROMPT_SUFFIX = `
 No prose, no explanation, no markdown code fences — just the raw JSON array.
 
 TRANSCRIPT:
 `;
 
+/** Build the extraction prompt for the current (or injected) gate state. */
+function buildExtractionPrompt(opts = {}) {
+  const withScore = opts.scoreExtraction !== undefined
+    ? Boolean(opts.scoreExtraction)
+    : scoreExtractionEnabled();
+  return EXTRACTION_PROMPT_BASE + (withScore ? QUALITY_RUBRIC_ADDENDUM : '') + PROMPT_SUFFIX;
+}
+
+/** Back-compat export: the default (gate-evaluated-at-call) prompt. */
+const EXTRACTION_PROMPT = buildExtractionPrompt({ scoreExtraction: false });
+
 /** Resolve the `claude` binary — hook/launchd env may have a minimal PATH. */
 function resolveClaudeBin() {
   const candidates = [
@@ -63,7 +118,7 @@ function resolveClaudeBin() {
  */
 function extractWithClaudeCode(transcript) {
   const bin = resolveClaudeBin();
-  const input = EXTRACTION_PROMPT + String(transcript).slice(0, 200000);
+  const input = buildExtractionPrompt() + String(transcript).slice(0, 200000);
   // Do NOT pass ANTHROPIC_API_KEY through — we want the user's logged-in Claude
   // subscription (OAuth), not an API key (which would bill someone). Delete it.
   const childEnv = { ...process.env, AUXILO_EXTRACTING: '1' };
@@ -79,8 +134,41 @@ function extractWithClaudeCode(transcript) {
   return { ok: true, out, reason: null };
 }
 
-/** Defensively parse a JSON array of learnings out of model output. */
-function parseLearnings(raw) {
+/**
+ * A1: validate a model-emitted quality_self_assessment. Returns the normalized
+ * object, or null when malformed/missing — the caller then OMITS the field
+ * entirely (never fabricate; the server's `awaiting_quality` hold is the
+ * correct fallback and is deliberately not a 400 — AUD19-6 quarantines rather
+ * than bounces).
+ */
+const QUALITY_DIMENSIONS = ['specificity', 'actionability', 'novelty', 'completeness'];
+function validateQualityAssessment(qa) {
+  if (!qa || typeof qa !== 'object' || Array.isArray(qa)) return null;
+  const out = {};
+  let sum = 0;
+  for (const dim of QUALITY_DIMENSIONS) {
+    const v = qa[dim];
+    if (!Number.isInteger(v) || v < 1 || v > 5) return null;
+    out[dim] = v;
+    sum += v;
+  }
+  if (!Number.isInteger(qa.total) || qa.total !== sum) return null;
+  out.total = sum;
+  return out;
+}
+
+/**
+ * Defensively parse a JSON array of learnings out of model output.
+ * A1: `quality_self_assessment` is attached ONLY when (a) the score gate is on
+ * (opts.scoreExtraction, default = env AUXILO_SCORE_EXTRACTION) AND (b) the
+ * assessment validates. Gate OFF strips the field even if the model emits one,
+ * so a dark 0.9.3 client can never arm seamless publish (see the sequencing
+ * constraint at scoreExtractionEnabled).
+ */
+function parseLearnings(raw, opts = {}) {
+  const withScore = opts.scoreExtraction !== undefined
+    ? Boolean(opts.scoreExtraction)
+    : scoreExtractionEnabled();
   let s = String(raw || '').trim();
   const fence = s.match(/```(?:json)?\s*([\s\S]*?)```/i);
   if (fence) s = fence[1].trim();
@@ -90,16 +178,35 @@ function parseLearnings(raw) {
   let arr;
   try { arr = JSON.parse(s.slice(start, end + 1)); } catch (_) { return []; }
   if (!Array.isArray(arr)) return [];
-  return arr
-    .filter(l => l && typeof l.title === 'string' && typeof l.body === 'string' && l.title.length >= 10 && l.body.length >= 50)
-    .map(l => ({
-      title: l.title,
-      body: l.body,
-      category: CATEGORIES.includes(l.category) ? l.category : 'code-execution',
-      tags: Array.isArray(l.tags) ? l.tags.slice(0, 8).map(String) : [],
-      task_context: typeof l.task_context === 'string' ? l.task_context : '',
-      outcome: ['success', 'partial', 'failure', 'workaround'].includes(l.outcome) ? l.outcome : 'success',
-    }));
+  const shaped = arr
+    .filter(l => l && typeof l.title === 'string' && typeof l.body === 'string' && l.title.length >= 10 && l.body.length >= 50);
+  // CI-5 post-parse scope validation (defense-in-depth against prompt drift):
+  // a candidate whose category is outside the tech set is DROPPED entirely.
+  // The old coerce-unknown-to-'code-execution' fallback is gone — coercion
+  // would launder a non-tech candidate (e.g. one the model labeled
+  // 'communication') into the catalog wearing a tech label. Category-based,
+  // so it applies identically in BOTH score-gate states.
+  const inScope = shaped.filter(l => CATEGORIES.includes(l.category));
+  // Gate-A F5: make the drop observable — count to stderr (never stdout; the
+  // hook log captures it) so a silently over-dropping prompt is diagnosable.
+  const dropped = shaped.length - inScope.length;
+  if (dropped > 0) console.error(`[extract-local] dropped ${dropped} candidate(s) outside the technical category set (CI-5 scope)`);
+  return inScope
+    .map(l => {
+      const out = {
+        title: l.title,
+        body: l.body,
+        category: l.category,
+        tags: Array.isArray(l.tags) ? l.tags.slice(0, 8).map(String) : [],
+        task_context: typeof l.task_context === 'string' ? l.task_context : '',
+        outcome: ['success', 'partial', 'failure', 'workaround'].includes(l.outcome) ? l.outcome : 'success',
+      };
+      if (withScore) {
+        const qa = validateQualityAssessment(l.quality_self_assessment);
+        if (qa) out.quality_self_assessment = qa;
+      }
+      return out;
+    });
 }
 
 /**
@@ -116,4 +223,8 @@ async function extractLocally(transcript, sourceType) {
   return { learnings: parseLearnings(out) };
 }
 
-module.exports = { extractLocally, parseLearnings, resolveClaudeBin, EXTRACTION_PROMPT, CATEGORIES };
+module.exports = {
+  extractLocally, parseLearnings, resolveClaudeBin, CATEGORIES, RETIRED_CATEGORIES,
+  EXTRACTION_PROMPT, buildExtractionPrompt, scoreExtractionEnabled,
+  validateQualityAssessment, QUALITY_DIMENSIONS,
+};

package/scripts/review-notice.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+
+/**
+ * scripts/review-notice.js — SessionStart held-count notice (LW-18 layer 1b)
+ *
+ * Invoked by the Claude Code SessionStart hook (structured entry written by
+ * `auxilo setup` → lib/installer.js registerClaudeCodeSessionStartNotice via
+ * the ~/.auxilo/bin/auxilo-review-notice.sh shim). Whatever this prints to
+ * stdout is added to the session's context — so the contract is strict:
+ *
+ *   COUNT ONLY. Never titles, never bodies, never flags. Pending bodies are
+ *   adversarial by assumption (some are held BECAUSE injection-flagged —
+ *   LW-18 threat model); surfacing content to a live agent at session start
+ *   would be a confused-deputy channel. One count + two command names, that
+ *   is all.
+ *
+ * Behavior:
+ *   - FAIL-SILENT: every non-happy path exits 0 with NO output. A broken
+ *     notice must never break (or noise up) a session.
+ *   - Recursion guard: AUXILO_EXTRACTING=1 (the headless `claude -p`
+ *     extraction child fires SessionStart too) → silent exit.
+ *   - Suppression: at most ONE notice per 4 hours, tracked in
+ *     ~/.auxilo/review-notice-state.json (LW-18 spec).
+ *   - Count source: GET /account/pending/summary with the credentials from
+ *     ~/.auxilo/credentials.json; 3.5s abort so session start is never held
+ *     hostage by a slow network.
+ *
+ * Self-contained (fs/path/os + global fetch) — ships in RUNNER_STACK to
+ * ~/.auxilo/bin/scripts/ and must not require anything outside that layout
+ * except node builtins.
+ *
+ * @module review-notice
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+/** ≤ 1 notice per 4h (LW-18 spec). */
+const NOTICE_SUPPRESSION_MS = 4 * 60 * 60 * 1000;
+
+/** Network budget: SessionStart hooks block session start. */
+const FETCH_TIMEOUT_MS = 3500;
+
+function auxiloDir(homeDir) {
+  return path.join(homeDir || os.homedir(), '.auxilo');
+}
+
+function statePath(homeDir) {
+  return path.join(auxiloDir(homeDir), 'review-notice-state.json');
+}
+
+/** Read suppression state; malformed/absent → {} (fail-open to notifying). */
+function readState(homeDir) {
+  try {
+    const s = JSON.parse(fs.readFileSync(statePath(homeDir), 'utf-8'));
+    return s && typeof s === 'object' ? s : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Pure suppression decision: notify iff no prior notice, or the last one is
+ * older than the suppression window (bad timestamps read as "no prior").
+ */
+function shouldNotify(state, now = Date.now(), suppressionMs = NOTICE_SUPPRESSION_MS) {
+  const last = state && state.last_notice_at ? Date.parse(state.last_notice_at) : NaN;
+  if (!Number.isFinite(last)) return true;
+  return now - last >= suppressionMs;
+}
+
+/** Persist the suppression stamp (best-effort — failure must not throw). */
+function writeState(homeDir, now = Date.now()) {
+  try {
+    const p = statePath(homeDir);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify({ last_notice_at: new Date(now).toISOString() }, null, 2) + '\n');
+  } catch { /* fail-silent */ }
+}
+
+/** The one line. Count only — see the header contract. */
+function renderNotice(count) {
+  return `Auxilo: ${count} learning(s) held for your review — run auxilo_review (MCP) or \`npx auxilo review\`.`;
+}
+
+/** Load credentials; null when absent/malformed/keyless. */
+function readCredentials(homeDir) {
+  try {
+    const creds = JSON.parse(fs.readFileSync(path.join(auxiloDir(homeDir), 'credentials.json'), 'utf-8'));
+    return creds && typeof creds === 'object' && creds.api_key ? creds : null;
+  } catch {
+    return null;
+  }
+}
+
+async function fetchPendingCount(creds, fetchImpl = fetch) {
+  const baseUrl = String(creds.base_url || 'https://auxilo.io').replace(/\/+$/, '');
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(`${baseUrl}/account/pending/summary`, {
+      headers: { 'X-API-Key': creds.api_key },
+      signal: controller.signal,
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    const n = body && body.pending_count;
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function main() {
+  // Recursion guard: extraction children must never notice (or burn the
+  // suppression window).
+  if (process.env.AUXILO_EXTRACTING === '1') return;
+
+  const homeDir = os.homedir();
+  const creds = readCredentials(homeDir);
+  if (!creds) return;
+
+  if (!shouldNotify(readState(homeDir))) return;
+
+  const count = await fetchPendingCount(creds);
+  if (count == null || count <= 0) return;
+
+  process.stdout.write(renderNotice(count) + '\n');
+  writeState(homeDir);
+}
+
+module.exports = {
+  shouldNotify, renderNotice, readState, writeState, readCredentials,
+  fetchPendingCount, NOTICE_SUPPRESSION_MS, FETCH_TIMEOUT_MS,
+};
+
+if (require.main === module) {
+  // FAIL-SILENT: exit 0 on every path, including internal errors.
+  main().then(() => process.exit(0)).catch(() => process.exit(0));
+}