blun-king-cli 9.1.523 → 9.1.526

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 9.1.526 - 2026-09-01
+
+- Materializes the AgentSpine version bundled with the current package before `/reload` rebuilds the plugin catalogue and MCP configuration.
+- Preserves unrelated plugin records and reuses an unchanged managed AgentSpine tree without rewriting `installed.json`.
+- Adds a red-to-green regression against 9.1.525 for bootstrap ordering, managed-plugin adoption, and idempotent reload behavior.
+
+## 9.1.525 - 2026-09-01
+
+- Starts every local shell command in its own process group on Windows as well as POSIX, so programs cannot attach to the BLUN TUI's controlling console and consume `Escape`, `Ctrl+S`, or other editor input.
+- Keeps stdin, stdout, and stderr on private pipes; interactive commands receive EOF and fail or time out without competing with the editor.
+- Adapts DeepAgents' local-shell terminal isolation to Windows and adds an executable regression for both platform branches plus a real captured-process probe.
+
+## 9.1.524 - 2026-09-01
+
+- Keeps the immediate prompt created by a Telegram `/loop` command inside the protected remote-command delivery path, so it cannot survive as a second plain queue item.
+- Shows each session's resume-checkpoint size, retained message and token counts, Wire size, and missing, invalid, or stale checkpoint state directly in the resume picker.
+- Updates the bundled AgentSpine runtime to the verified official 0.11.4 source at commit `8034487cdd24498076bac48d3f24400bca5e6ae4`, while preserving BLUN's 180-second background `SessionStart` completion budget.
+- Adds executable regressions for Telegram loop exactly-once delivery and all resume-metric states while preserving the existing local busy-loop queue behavior.
+
 ## 9.1.523 - 2026-09-01
 
 - Makes `Escape` cancel an open slash-command menu and clear its slash draft in one action instead of leaving the command text behind.

package/LIESMICH.txt

@@ -9,10 +9,12 @@ Installation
 ------------
 Die geprüfte Version exakt global installieren:
 
-  npm install -g blun-king-cli@9.1.523
+  npm install -g blun-king-cli@9.1.526
 
-AgentSpine 0.10.1
+AgentSpine 0.11.4
 -----------------
+Version 9.1.524 aktualisiert die gebündelte AgentSpine-Laufzeit auf 0.11.4 aus dem offiziellen Commit `8034487cdd24498076bac48d3f24400bca5e6ae4`. Vor der Aufnahme in BLUN King wurden die hermetischen Tests, die Host- und Installationsprüfungen, die Acceptance-Suite, das Audit und der Release-Check erfolgreich abgeschlossen.
+
 Version 9.1.519 enthält weiterhin AgentSpine 0.10.1 als inhaltsadressierte Pluginfassung. Der Preflight prüft jede aktive Host-Anweisungsdatei weiterhin race-sicher und bindet SHA-256 sowie Dateiidentität an den Zug, dupliziert den bereits vom Host geladenen Volltext aber nicht im Laufzeitkontext. Die reale Probe mit einer 15.519 Byte großen `CLAUDE.md` blieb dadurch bei 5.667 injizierten Byte. Der Stand enthält außerdem den selbstheilenden Persona- und Beziehungsgraphen, die begrenzte Telegram-Mnemo-Abfrage und eine sichtbare Fünf-Sekunden-Grenze für lokale Beziehungsabfragen.
 
 Start

package/README.md

@@ -9,10 +9,12 @@ Voraussetzung ist Node.js 24.15 oder neuer. Die geprüfte Version wird exakt
 installiert:
 
 ```powershell
-npm install -g blun-king-cli@9.1.523
+  npm install -g blun-king-cli@9.1.526
 ```
 
-## AgentSpine 0.10.1
+## AgentSpine 0.11.4
+
+Version 9.1.524 aktualisiert die gebündelte AgentSpine-Laufzeit auf 0.11.4 aus dem offiziellen Commit `8034487cdd24498076bac48d3f24400bca5e6ae4`. Vor der Aufnahme in BLUN King wurden die hermetischen Tests, die Host- und Installationsprüfungen, die Acceptance-Suite, das Audit und der Release-Check erfolgreich abgeschlossen.
 
 Version 9.1.519 enthält weiterhin AgentSpine 0.10.1 als inhaltsadressierte Pluginfassung. Der Preflight prüft jede aktive Host-Anweisungsdatei weiterhin race-sicher und bindet SHA-256 sowie Dateiidentität an den Zug, dupliziert den bereits vom Host geladenen Volltext aber nicht im Laufzeitkontext. Die reale Probe mit einer 15.519 Byte großen `CLAUDE.md` blieb dadurch bei 5.667 injizierten Byte. Der Stand enthält außerdem den selbstheilenden Persona- und Beziehungsgraphen, die begrenzte Telegram-Mnemo-Abfrage und eine sichtbare Fünf-Sekunden-Grenze für lokale Beziehungsabfragen.
 

package/agent-spine-plugin/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "agent-spine",
       "source": ".",
       "description": "Map existing rules, soul, and memory without rewriting source files.",
-      "version": "0.10.1",
+      "version": "0.11.4",
       "author": {
         "name": "Mayk Biletti"
       },

package/agent-spine-plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-spine",
-  "version": "0.10.1",
+  "version": "0.11.4",
   "description": "A non-destructive identity and memory spine for Claude Code agents.",
   "author": {
     "name": "Mayk Biletti",

package/agent-spine-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-spine",
-  "version": "0.10.1",
+  "version": "0.11.4",
   "description": "A non-destructive identity and memory spine for Codex agents.",
   "author": {
     "name": "Mayk Biletti",
@@ -11,7 +11,6 @@
   "license": "Apache-2.0",
   "keywords": ["identity", "memory", "mcp", "agents"],
   "skills": "./skills/",
-  "hooks": "./hooks/codex.json",
   "mcpServers": {
     "agent-spine": {
       "command": "node",

package/agent-spine-plugin/CHANGELOG.md

@@ -2,18 +2,80 @@
 
 All notable changes to AgentSpine will be documented here. The project follows [Semantic Versioning](https://semver.org/).
 
-## [Unreleased]
-
-## [0.10.1] - 2026-08-31
-
-### Fixed
-
-- Mandatory host-instruction files are still race-safely reread, hashed, identity-bound, and verified for each exact turn, but their already host-loaded bytes are no longer duplicated into the injected preflight briefing.
-- Large native `CLAUDE.md` and `AGENTS.md` hierarchies no longer fail merely because their instruction text exceeds the runtime context budget; only bounded descriptors enter the hook context.
-
-### Security
-
-- Unreadable, changed, replaced, symlinked, out-of-scope, individually oversized, or descriptor-overflowing mandatory instruction files continue to fail closed.
+## [Unreleased]
+
+## [0.11.4] - 2026-09-01
+
+### Fixed
+
+- Nonexistent descendants inherit the canonical identity of their nearest existing ancestor, preventing macOS aliases and Windows namespace normalization from misclassifying an internal state directory as external before its first write.
+
+## [0.11.3] - 2026-09-01
+
+### Fixed
+
+- Scanner exclusion roots are canonicalized before comparison, so macOS `/var` → `/private/var` aliases and Windows path normalization cannot reintroduce private AgentSpine state into a home-root catalog.
+
+## [0.11.2] - 2026-09-01
+
+### Fixed
+
+- Exact user-home working directories may keep authenticated AgentSpine state below the home only when that state root is explicitly excluded from source discovery; the installed hook no longer deadlocks on its own signing identity.
+- Generic catalog discovery now prunes the configured AgentSpine state subtree before opening Markdown, so signing keys, persona rosters, receipts, and generated state cannot become project context.
+
+### Security
+
+- The exception is limited to an exact OS/`HOME`/`USERPROFILE` home root. State inside an ordinary nested project remains fail-closed, symlinks remain untraversed, and user Markdown remains byte-preserved.
+
+## [0.11.1] - 2026-09-01
+
+### Fixed
+
+- Installed hooks reuse the already bounded host-source catalog throughout scope, continuity, learning, attention, persona, relationship, and briefing reads instead of recursively rebuilding it from the active working directory.
+- Windows profile homes are recognized through canonical OS, `USERPROFILE`, `HOME`, and `HOMEDRIVE`/`HOMEPATH` identities, including case-insensitive paths and homes that contain a project marker; their recursive project tree is never enumerated.
+
+### Security
+
+- Direct host-native `CLAUDE.md` and `AGENTS.md` chain files remain fully injected and byte-preserved while unrelated home descendants are excluded from context and indexing.
+
+## [0.11.0] - 2026-08-31
+
+### Added
+
+- Provider-neutral `agentspine.learning-outcome/v1` receipts for content-free, normalized fixed-task before/after measurements bound to exact persona, user, tenant, project, group, task, metric, and evaluator scopes
+- Default-off outcome-gated `behavior` candidates with independent-evaluator thresholds, objective-evidence requirements, bounded canary application, measured validation, contradiction detection, staleness gates, and read-only MCP diagnostics
+- Local CLI commands for recording outcome receipts and inspecting promotion, canary, regression, and expiry state
+
+### Changed
+
+- Session briefings project outcome-gated behavior only into the exact matching scope and exclude expired canaries with a visible degraded diagnostic
+- Learning-state upgrades add outcome configuration and receipts without rewriting existing candidates or user-authored Markdown
+
+### Security
+
+- Model suggestions are retained separately but never count toward automatic promotion or canary validation
+- Any blocking defect overrides aggregate scores and immediately rolls back the canary; regressions, insufficient improvement, and expiry also fail closed through rollback
+- Outcome receipts contain no prompts, answers, transcripts, credentials, rights, delegation, tool access, production, payment, or policy authority
+- Codex plugin metadata omits the validator-rejected `hooks` field; the separate versioned Codex host adapter remains packaged and independently validated
+
+## [0.10.1] - 2026-08-31
+
+### Changed
+
+- Claude mandatory instructions retain the 8 KiB standard budget but may use one explicit, receipt-bound overflow up to 16 KiB; Codex and generic instruction hosts remain capped at 8 KiB
+- Relationship deadlines return a visible `degraded` context and abort the active graph read instead of aborting the turn
+
+### Fixed
+
+- Relationship CLI and MCP reads no longer rebuild the complete project catalog before reading the bounded graph state
+- An unmarked home-directory working directory no longer becomes a recursive project scan; known user rules are still loaded through their exact host-native paths
+- Dropbox, OneDrive, dependency, build and embedded repository directories are excluded from bounded project source traversal
+- Oversized mandatory instructions now block immediately with the measured and allowed byte counts instead of an opaque budget message
+
+### Security
+
+- Automatic group neighborhoods continue to exclude explicit cross-group edges, inactive personas, private records and every entity outside the exact authenticated group audience
+- The Claude overflow mode, byte usage and hard limit are HMAC-receipt-bound and revalidated immediately before one-time consumption
 
 ## [0.10.0] - 2026-08-30
 
@@ -325,8 +387,13 @@ All notable changes to AgentSpine will be documented here. The project follows [
 - Dual Claude Code and Codex plugin manifests
 - Cross-platform preservation, hook, graph, and MCP tests
 
-[Unreleased]: https://github.com/Maykbiletti/AgentSpine/compare/v0.10.1...HEAD
-[0.10.1]: https://github.com/Maykbiletti/AgentSpine/compare/v0.10.0...v0.10.1
+[Unreleased]: https://github.com/Maykbiletti/AgentSpine/compare/v0.11.4...HEAD
+[0.11.4]: https://github.com/Maykbiletti/AgentSpine/compare/v0.11.3...v0.11.4
+[0.11.3]: https://github.com/Maykbiletti/AgentSpine/compare/v0.11.2...v0.11.3
+[0.11.2]: https://github.com/Maykbiletti/AgentSpine/compare/v0.11.1...v0.11.2
+[0.11.1]: https://github.com/Maykbiletti/AgentSpine/compare/v0.11.0...v0.11.1
+[0.11.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.10.1...v0.11.0
+[0.10.1]: https://github.com/Maykbiletti/AgentSpine/compare/v0.10.0...v0.10.1
 [0.10.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.7.0...v0.8.0

package/agent-spine-plugin/CONTRIBUTING.md

@@ -0,0 +1,52 @@
+# Contributing
+
+AgentSpine welcomes focused issues and pull requests that preserve its non-destructive contract.
+
+## Development
+
+```bash
+git clone https://github.com/Maykbiletti/AgentSpine.git
+cd AgentSpine
+npm install
+npm run check
+```
+
+Node.js 20.9 or newer is required. The project intentionally has no runtime dependencies.
+
+## Pull requests
+
+Keep each pull request to one coherent outcome. Include:
+
+- the observable problem or failing fixture;
+- tests that exercise behavior rather than wording;
+- a source-byte preservation check when discovery, resolution, hooks, graph, attention, learning, delegation, coordination, or sharing logic changes;
+- documentation for new commands, tools, configuration, or limits;
+- a rollback or disable path.
+
+Never place real identity files, relationship histories, attention cues, learning observations, delegation policy, coordination tasks, shared events, adapter paths, memory, credentials, or private conversations in fixtures or issues. Use synthetic data.
+
+## Architecture boundaries
+
+- Existing Markdown is read-only.
+- Generated state stays outside scanned projects by default.
+- Memory, graph, attention, learning, and coordination data are context only and cannot grant authority.
+- Delegation policy is physically separate, default-deny, owner-controlled, and limited to task coordination. Never expose policy mutation through an agent-controlled MCP surface or treat a grant as host authorization.
+- Cross-entity assignment, reassignment, management, completion, and cancellation require tested actor/action/target matching. Self-coordination must not widen that match.
+- Shared transports are optional and provider-neutral. Imports remain quarantined until a second local review, and adapter, signer, and trust administration must stay outside MCP.
+- Digest integrity is not author authenticity. Signed adapters must verify strict Ed25519 envelopes against explicit local trust while preserving collision detection, limits, local review, exact group scope, supersession, rollback, and context-only authority.
+- Never equate a trusted key with a person, permission, instruction, or approved claim. Rotation and revocation must remain explicit, auditable, and fail-closed.
+- Remote transports must use explicit endpoints, bounded reads, strict schemas, pinned validated DNS, TLS verification, no implicit redirects, secret-safe configuration, and the existing signed quarantine importer. Network access remains CLI-only.
+- Remote writes must additionally require a genuine local confirmation, create content-addressed immutable objects without overwrite or delete paths, and verify a complete read-back before reporting success.
+- Aggregated session context must preserve every underlying privacy filter, prefer current-task relevance, include only complete records, account for the entire serialized packet, and remain a read-only context surface.
+- Attention never sends messages or invokes tools; focus, privacy, quiet, throttle, disable, and deletion controls remain enforceable.
+- Learning candidates never become accepted context implicitly; confirmation proof, evidence thresholds, privacy, rollback, and the authority boundary remain testable.
+- Host-native precedence remains visible.
+- A learned classification augments discovery hints; it never rewrites a source.
+- Shared-memory backends are optional adapters.
+
+Run both validators when changing package surfaces:
+
+```bash
+python3 /path/to/plugin-creator/scripts/validate_plugin.py .
+python3 /path/to/skill-creator/scripts/quick_validate.py skills/agent-spine
+```

package/agent-spine-plugin/README.md

@@ -91,7 +91,7 @@ claude --plugin-dir .
 ```
 
 Claude Code discovers the bundled skill, hooks, and MCP server. Review and trust executable components when the host asks.
-Version `0.10.1` retains the `agentspine.preflight/v2` pre-answer contract, removes duplicate host-instruction injection, and includes self-healing authenticated persona-to-graph reconciliation. Exact roster groups are materialized as context-only entities, stale membership edges are repaired, inactive personas disappear from current relationship reads, and an exact group-scoped briefing includes visible team peers without exposing another group. Claude uses `hooks/hooks.json`; Codex selects `hooks/codex.json` so Claude-only events never enter Codex configuration. Fresh-install and upgrade checks prove package containment and entrypoint behavior; actual hook discovery and trust remain host-controlled and must be inspected in the live host. Claude project memory remains `MEMORY.md`-indexed, lazy, race-safe, persistently cached outside the project, and independent of unrelated file count. See [pre-answer recall gate](docs/preflight-recall.md) and [durable gateway worker](docs/gateway-runtime.md).
+Version `0.11.4` retains the `agentspine.preflight/v2` pre-answer contract, self-healing authenticated persona-to-graph reconciliation, and provider-neutral outcome-bound behavior loop. The installed hook reuses one bounded source catalog through scope, continuity, learning, attention, persona, relationship, and briefing reads. Canonical Windows home identities are excluded from recursive project enumeration even when the home contains a project marker. When the working root is exactly the user home, the configured AgentSpine state subtree is an explicit scanner exclusion, so authenticated state remains usable without entering context; state inside an ordinary nested project still fails closed. Direct host-native rules remain fully injected and byte-preserved. Exact roster groups remain context-only and isolated; model suggestions never count as promotion evidence; blocking defects and regressions still roll back canaries. Claude keeps an 8 KiB instruction standard with one signed, revalidated overflow up to 16 KiB. Claude uses `hooks/hooks.json`; Codex ships the separate validated `hooks/codex.json` adapter. Fresh-install and upgrade checks prove package containment and entrypoint behavior; actual hook discovery and trust remain host-controlled and must be inspected in the live host. See [safe learning](docs/learning.md), [pre-answer recall gate](docs/preflight-recall.md), and [durable gateway worker](docs/gateway-runtime.md).
 
 Verify the installed registration from a checkout with:
 
@@ -141,7 +141,7 @@ AgentSpine's first release is intentionally narrow and testable:
 
 - source Markdown is opened read-only;
 - symlinks are not followed during discovery;
-- generated state is stored outside the project;
+- generated state is stored outside ordinary projects; an exact user-home root may contain its explicitly scan-excluded AgentSpine state subtree;
 - every source receives a SHA-256 fingerprint, byte size, path, layer, and provenance;
 - native host precedence is retained rather than flattened;
 - broken links and competing candidates are exposed as findings, never auto-resolved;
@@ -178,6 +178,8 @@ Read the full [preservation contract](docs/preservation-contract.md), including
 | `agentspine learn-review …` | Explicitly accept or reject a candidate |
 | `agentspine learn-context …` | Read only accepted, privacy-filtered learning |
 | `agentspine learn-evaluate …` | Run the default-off low-risk automatic policy |
+| `agentspine learn-outcome …` | Record a content-free fixed-task before/after measurement locally |
+| `agentspine learn-status …` | Diagnose contradictions, receipt counts, canary health, and staleness |
 | `agentspine learn-rollback …` | Restore the accepted fact replaced by a learning |
 | `agentspine learn-config …` | Configure auto-promotion thresholds and context limits |
 | `agentspine learn-delete …` | Permanently remove one candidate and its learning history |
@@ -260,7 +262,7 @@ flowchart LR
 - `link_documents` and `annotate_document` let agents build their own semantic map without editing sources.
 - `upsert_entity`, `link_entities`, and `relationship_context` maintain a privacy-scoped social and responsibility map outside the project.
 - `upsert_attention`, `record_activity`, `attention_context`, `resolve_attention`, `configure_attention`, and `delete_attention` provide sparse follow-up suggestions without sending messages or granting authority.
-- `propose_learning`, `add_learning_evidence`, `review_learning`, `learning_context`, `evaluate_learning`, `rollback_learning`, `configure_learning`, and `delete_learning` keep observations separate from accepted context and preserve every relevance change.
+- `propose_learning`, `add_learning_evidence`, `review_learning`, `learning_context`, `learning_outcome_status`, `evaluate_learning`, `rollback_learning`, `configure_learning`, and `delete_learning` keep observations separate from accepted context and preserve every relevance change. Outcome writes remain local runtime/CLI operations; MCP receives only their read-only status.
 - `check_delegation`, `create_task`, `update_task`, and `task_context` coordinate work under a separate default-deny policy. MCP intentionally has no policy grant, revoke, or permanent task-delete tool.
 - `shared_context` reads only locally reviewed shared memory. MCP intentionally cannot initialize adapters, publish, pull, inspect the pending inbox, review imports, roll back, or delete.
 - `audit` runs the same ten gates available through the CLI.
@@ -269,7 +271,7 @@ Relationship updates supersede the active view but retain the previous observati
 
 Attention is deliberately restrained: installed hooks retain minimal heartbeats, promises, and blockers without storing transcripts; each event requires an exact known actor/project/task scope; private and group visibility stays exact; and quiet hours, focus, throttling, lifecycle transitions, deletion, and purge remain enforceable. Events are context only—they send no messages, start no work, and grant no authority. See [attention](docs/attention.md).
 
-Safe learning is evidence-first: general candidates remain invisible until reviewed. A separate default-off continuity opt-in can automatically accept only direct, high-confidence style, preference, no-go, correction, project-fact, and reference signals. Sensitive personal facts, secrets, identity merges, private group content, and operational or authority claims are always rejected. See [automatic continuity](docs/automatic-continuity.md) and [safe learning](docs/learning.md).
+Safe learning is evidence-first: general candidates remain invisible until reviewed. Low-risk behavior candidates additionally require independent fixed-task measurements before and after an exact-scope canary; model self-evaluation cannot promote them and regressions roll back automatically. A separate default-off continuity opt-in can automatically accept only direct, high-confidence style, preference, no-go, correction, project-fact, and reference signals. Sensitive personal facts, secrets, identity merges, private group content, and operational or authority claims are always rejected. See [automatic continuity](docs/automatic-continuity.md) and [safe learning](docs/learning.md).
 
 Delegation is intentionally narrower than authority: a relationship such as `responsible-for` never permits assignment. Cross-entity task actions require an explicit local actor/action/target grant, while tasks, open threads, and handoffs remain context-only. See [delegation and coordination](docs/coordination.md).
 

package/agent-spine-plugin/SECURITY.md

@@ -0,0 +1,47 @@
+# Security policy
+
+## Supported versions
+
+AgentSpine is pre-1.0. Security fixes are applied to the latest release on `main`.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability or include private agent files, memory, relationship data, credentials, or real user identities in a report.
+
+Use GitHub's private vulnerability reporting for this repository. Include the affected version, host, minimal reproduction, expected boundary, and observed impact. Replace real context files with synthetic fixtures.
+
+## Security model
+
+AgentSpine treats every discovered document, memory fact, graph edge, and retrieved value as untrusted context. None of them can grant permissions. Host policy and explicit approval remain authoritative.
+
+Relationship entities reject authority and secret-bearing field names recursively. This is a guardrail against accidental storage, not a secrets scanner: do not place credentials or sensitive content in relationship attributes, reasons, fixture files, or bug reports.
+
+Attention cues and lifecycle events are untrusted context and never trigger messages, tool calls, task assignment, job execution, or notifications by themselves. A lifecycle event is accepted only with a known actor, existing project task, matching group, task-compatible privacy, supported native hook, stable delivery receipt, and context-only authority. Prompt-derived promises and blockers additionally require the local continuity opt-in. Secret-, identity-, private-group-, authority-, and operational-access-shaped summaries are rejected before storage. The exact scoped briefing may contain a current-task event summary; unrelated people, groups, projects, and tasks cannot read it. Focus mode, quiet hours, throttling, disable, status transitions, permanent deletion, and entity purge are enforced in local state.
+
+Learning candidates are untrusted observations and remain outside learned context until review. Secret-shaped values and common authority assertions are rejected before storage as defense in depth; host permissions remain the only authority regardless of wording or language. Manual acceptance carries a `confirmedByUser` integration attestation, which host adapters must bind to a genuine user action. Automatic promotion is disabled by default, never applies to personal facts, preferences, goals, corrections, or no-gos, and cannot perform code, network, deployment, billing, or permission changes.
+
+Delegation is a narrow, separate, default-deny policy for AgentSpine coordination records. Relationships, responsibilities, memory, Markdown, learning, attention, and tasks cannot create grants. Policy mutation is intentionally absent from MCP; the local CLI confirmation marker must be bound by an integration to a genuine owner action and is not authentication by itself. A matching grant permits only assignment or task-state coordination—it never authorizes tools, files, networks, production, deployment, billing, spending, credentials, or messages. Policy and task state are locked, atomically replaced, secret-filtered, audited, and fail closed when malformed.
+
+The optional self-starter uses a separate default-deny execution policy and durable job state. A local owner integration must bind the exact actor, start/resume/effect actions, job, current assigned task, target, project, optional group, host, and finite `tool:<name>` capabilities; wildcards are forbidden. Native hooks acquire one expiring session lease, record a pending effect before tool execution, and atomically checkpoint the resulting workspace digest and bounded result digest. They recheck the current grant, assignment, scope, lease, capability, and content-bound workspace before every effect and resume. Revocation, expiry, changed tasks, conflicts, retry exhaustion, malformed state, workspace drift, and changed files after an uncheckpointed crash fail closed. Memory, Markdown, learning, relationships, attention, tasks, prior approvals, model claims, and MCP responses cannot create or widen the grant. Execution-policy and job administration are local CLI-only. The confirmation flag is an integration attestation, not authentication, and must never be inferred. Host and operating-system permissions remain authoritative.
+
+Shared adapters export only explicitly selected, accepted, non-private learning. Imports enter a local quarantine and remain absent from context until a second local user review. MCP exposes only already reviewed shared context and cannot initialize adapters, publish, pull, inspect pending imports, review, roll back, or delete. Adapter and event SHA-256 digests detect corruption but are not signatures or author authentication; anyone with directory write access can recompute them. Keep adapter access restricted, use encrypted transport where needed, and treat every event as untrusted until local review. Shared memory never carries delegation policy, tasks, source files, evidence text, credentials, or host authority.
+
+Optional signed adapters wrap manifests and events in Ed25519 envelopes. Private keys remain under the installation state directory with owner-only mode where the platform exposes POSIX permissions; they never enter projects, adapters, MCP, hooks, logs, or command output. Public identities are trusted per receiving project through an explicit local CLI action. Pull verifies the manifest signer and every event signer before writing quarantine state, and the audit replays retained event signatures against the stored public identity. Unknown, revoked, swapped, malformed, or mismatched keys fail closed. A signature authenticates the holder of a configured key—it does not establish a real-world identity, approve the claim, grant delegation, or replace the receiving user's review. Key distribution, device security, encrypted transport, and real-world identity verification remain deployment responsibilities.
+
+The optional HTTPS snapshot transport accepts only an explicit TLS URL and signed immutable snapshots. Public mode rejects private, loopback, link-local, reserved, multicast, and documentation address ranges, validates every DNS answer, and pins the actual connection to a vetted address. Redirects, compression, embedded URL credentials, query strings, ambiguous directory URLs, non-JSON responses, oversized bodies, unsigned documents, and mixed or untrusted signers fail before local quarantine mutation. Private-network access requires explicit local confirmation. Optional bearer credentials come only from a named environment variable and are never returned, persisted, exposed through MCP, or added to hooks. HTTPS protects transit, not snapshot storage; server authorization, retention, logging, certificate operations, and endpoint availability remain deployment responsibilities.
+
+The immutable HTTPS object transport adds network writes only to the local CLI. Every publish requires explicit local owner confirmation, derives a content-addressed object URL, sends `If-None-Match: *`, accepts only create or precondition-failed outcomes, and performs a hardened signed read-back before reporting success. There is no overwrite, deletion, listing, mutable pointer, endpoint state, token state, MCP tool, or hook action. A service must enforce atomic create-only semantics and independently authenticate writers; the request digest header is not authorization. A `412` is considered idempotent only when read-back verifies the exact intended snapshot. Upload status, TLS, bearer authentication, digest equality, and signatures still create no rights or content approval.
+
+The optional mutable feed adds one deliberately constrained overwrite surface above immutable objects. Its entire bounded reference window is Ed25519-signed, updates require a strong previously observed ETag, and a `412` is exposed as a concurrency conflict. Receivers pin the feed ID, scope, adapter, signer identity, last sequence, entry digest, and snapshot digest in external local state while retaining prior receipts. Rollback, same-sequence equivocation, signer replacement, broken chains, and a window that no longer contains the locally observed tip fail closed before snapshot import. Corrupt receipt state is reported by the audit and never replaced automatically. Feed pulls still import only into quarantine. Feed state and remote authentication are context-only and cannot grant rights. Endpoint, token, publish, pull, and reset capabilities remain absent from MCP and hooks.
+
+The optional peer transport executes one owner-selected local program, which is a privileged operation independent of AgentSpine's content checks. Both serving and carrier execution require explicit local confirmation. AgentSpine passes a bounded executable/argument array directly with the shell disabled and a minimal environment that omits unrelated application secrets, bounds and discards stderr, enforces time and frame limits, and opens no listener. A fresh 256-bit challenge is bound by an Ed25519 response whose key must match the snapshot manifest and local trust. This prevents captured-response replay but does not sandbox a malicious chosen executable or carrier; operators must verify and constrain it using operating-system and SSH controls. Valid responses still enter quarantine, grant no rights, and require local content review. Peer controls remain absent from MCP and hooks.
+
+The optional local SQLite transport stores signed snapshots only in an owner-selected regular file outside the scanned project. Initialization and publication require explicit local confirmation; inspection and pull validate the exact schema, SQLite integrity result, immutable signed-manifest binding, all retained snapshots, the full revision hash chain, and its atomic head. Symbolic links, hard links, unexpected schema objects, malformed rows, oversized state, identity changes, tampering, and chain discontinuity fail closed. Extension loading is disabled, `trusted_schema` is off, and bound parameters carry values. File permissions, backups, encryption, copying, external rollback checkpoints, and filesystem availability remain operator responsibilities. A restored older but internally consistent database is not detectable without an external checkpoint. SQLite controls remain absent from MCP and hooks, imports still enter quarantine, and database state can never grant rights.
+
+Session briefing composes only existing privacy-filtered read models. It never reads pending learning or shared imports, delegation policy, assignment proof, credentials, adapter configuration, or signer material. Direct private context is explicit. Group context rejects private inclusion, requires an exact visible membership audience, excludes other groups, and emits source metadata without arbitrary Markdown content. The complete compact JSON output is byte-bounded and records are never truncated. Briefing reads do not consume attention cues or mutate any state. The resulting packet remains untrusted, context-only input to the host.
+
+Lifecycle hooks cover participating direct-write tools and common shell mutation forms. They also persist minimal heartbeat, promise, blocker, lease, and checkpoint state without storing transcripts, tool arguments, or tool output. For a leased self-starter session, all host tool events are resolved against the session automatically and must pass the exact capability check. Hooks remain defense in depth, not a shell parser, user authenticator, or operating-system sandbox. Encoded commands, custom tools outside the installed lifecycle, subprocesses, or programs outside the host can bypass them. Users should review plugin code, restrict tool access, protect credentials, use version control, and keep host approval controls enabled.
+
+The visible acceptance runner uses fictional identities and isolated temporary directories. Its SHA-256 receipts prove that bounded synthetic evidence passed a named gate; they are not signatures, user authentication, host trust, policy grants, or proof about a real deployment. The runner cannot approve executable components or create rights for an installed project. Fresh-install and upgrade tests use the same production hook adapter and require zero model-side MCP calls, exactly one MCP registration, exactly one hook set, source-hash preservation, and cleanup of staged state.
+
+Release workflows are tag-only and pin every external action to a full commit SHA. The build job can read repository content and mint short-lived OIDC attestations but cannot modify repository contents; the isolated publication job can write GitHub Release assets but cannot mint attestations. The local release gate rejects user-owned agent Markdown, generated AgentSpine state, tests, workflow internals, environment files, and key material from the npm tarball. GitHub attestations prove workflow provenance, not software correctness or authority. Consumers must still verify checksums, the repository identity, the expected tag, and the attestation.

package/agent-spine-plugin/blun.plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-spine",
-  "version": "0.10.1",
+  "version": "0.11.4",
   "description": "A non-destructive identity and memory spine for BLUN King agents.",
   "license": "Apache-2.0",
   "author": {

package/agent-spine-plugin/docs/acceptance.md

@@ -1,6 +1,6 @@
 # Visible cross-host acceptance
 
-AgentSpine `0.10.1` runs a visible, reproducible 15-gate acceptance scenario for the lifecycle adapter, including exact host-instruction identity verification without duplicate context injection, required provider recall and a fail-closed missing-provider probe. Staged installed-entrypoint source-root and indexed-memory scaling smoke tests execute the same bundled adapter used by Claude Code and Codex and never select an MCP tool, but they do not substitute for the hosts' own plugin discovery and hook-trust UI.
+AgentSpine `0.11.4` runs a visible, reproducible 15-gate acceptance scenario for the lifecycle adapter, including complete mandatory host instructions, required provider recall and a fail-closed missing-provider probe. Staged installed-entrypoint source-root and indexed-memory scaling smoke tests execute the same bundled adapter used by Claude Code and Codex and never select an MCP tool, but they do not substitute for the hosts' own plugin discovery and hook-trust UI.
 
 ```bash
 agentspine acceptance
@@ -52,7 +52,7 @@ Every line includes a SHA-256 receipt derived from the acceptance schema, gate I
 
 ## Installation proof
 
-`npm run host:install-check` stages both a fresh installation and an upgrade from `0.7.0`. Each installed `0.10.1` bundle must contain exactly one MCP server, one hook set, and one worker entrypoint, then pass the complete visible acceptance run with `mcpCalls: 0`. It directly invokes the packaged hook entrypoint from an AgentSpine checkout and a foreign `cwd` with sources only in a custom Claude profile, and repeats the Codex-shaped event path with a custom home, two Git projects, a fallback name, and a nested override. Uninstall removes only staged plugin and generated state; all synthetic source hashes remain unchanged. A real Codex session must separately show the plugin source in `/hooks`, record trust for the current definition hash, and inject the briefing after a new session starts.
+`npm run host:install-check` stages both a fresh installation and an upgrade from `0.7.0`. Each installed `0.8.0` bundle must contain exactly one MCP server, one hook set, and one worker entrypoint, then pass the complete visible acceptance run with `mcpCalls: 0`. It directly invokes the packaged hook entrypoint from an AgentSpine checkout and a foreign `cwd` with sources only in a custom Claude profile, and repeats the Codex-shaped event path with a custom home, two Git projects, a fallback name, and a nested override. Uninstall removes only staged plugin and generated state; all synthetic source hashes remain unchanged. A real Codex session must separately show the plugin source in `/hooks`, record trust for the current definition hash, and inject the briefing after a new session starts.
 
 ## Deliberate trust boundaries
 

package/agent-spine-plugin/docs/architecture.md

@@ -136,7 +136,7 @@ Generated catalogs live outside the scanned repository:
         <key-fingerprint>.pem
 ```
 
-`source-roots.json` retains only explicit or host-evidenced source/state bindings, profile digests, provenance, rollback, and purge history; it never stores source content or authority. `indexed-memory-cache.json` is a bounded private cache of integrity-checked indexed-memory snapshots and file identities. It is invalidated by index changes, correction, deletion, binding rollback, or purge; it remains context-only and cannot grant identity, rights, trust, or execution. `catalog.json` is reproducible provenance. `graph.json` stores reversible annotations, relationships, privacy scopes, confidence, and superseded observations. `attention.json` stores bounded follow-up cues, minimal interaction timestamps, quiet-hour policy, presentation throttles, and hook-driven heartbeat, promise, and blocker lifecycles with idempotent receipts and retained prior values. `learning.json` separates evidence-backed candidates from accepted context and records review, promotion, supersession, and rollback history. `continuity.json` stores only opt-in configuration and minimal signal receipts with prompt digests, never transcripts. `coordination.json` stores context-only tasks, open threads, handoffs, and their prior versions. `delegation-policy.json` is physically separate and contains only explicit local task-coordination grants. `execution-policy.json` contains exact locally confirmed self-starter grants; `selfstarter.json` contains leased jobs, content-bound checkpoints, retry state, retained prior versions, and idempotent receipts. Neither is context authority, and neither is writable through MCP. `sharing.json` quarantines imports and retains local review, supersession, rollback, and signature proof. `sharing-trust.json` is a project-local allowlist of public signing keys; the installation-wide signer registry keeps private keys separate. Policy, trust, keys, and adapter administration are not writable through MCP. All are private user state. This gives uninstall a simple, auditable property: removing AgentSpine state cannot remove or alter original agent files.
+`source-roots.json` retains only explicit or host-evidenced source/state bindings, profile digests, provenance, rollback, and purge history; it never stores source content or authority. `indexed-memory-cache.json` is a bounded private cache of integrity-checked indexed-memory snapshots and file identities. It is invalidated by index changes, correction, deletion, binding rollback, or purge; it remains context-only and cannot grant identity, rights, trust, or execution. `catalog.json` is reproducible provenance. `graph.json` stores reversible annotations, relationships, privacy scopes, confidence, and superseded observations. `attention.json` stores bounded follow-up cues, minimal interaction timestamps, quiet-hour policy, presentation throttles, and hook-driven heartbeat, promise, and blocker lifecycles with idempotent receipts and retained prior values. `learning.json` separates evidence-backed candidates from accepted context and records review, promotion, supersession, rollback, content-free outcome receipts, and bounded canary history. `continuity.json` stores only opt-in configuration and minimal signal receipts with prompt digests, never transcripts. `coordination.json` stores context-only tasks, open threads, handoffs, and their prior versions. `delegation-policy.json` is physically separate and contains only explicit local task-coordination grants. `execution-policy.json` contains exact locally confirmed self-starter grants; `selfstarter.json` contains leased jobs, content-bound checkpoints, retry state, retained prior versions, and idempotent receipts. Neither is context authority, and neither is writable through MCP. `sharing.json` quarantines imports and retains local review, supersession, rollback, and signature proof. `sharing-trust.json` is a project-local allowlist of public signing keys; the installation-wide signer registry keeps private keys separate. Policy, trust, keys, and adapter administration are not writable through MCP. All are private user state. This gives uninstall a simple, auditable property: removing AgentSpine state cannot remove or alter original agent files.
 
 Task mutations read and validate policy while holding the policy lock, then write coordination state under a second lock. This lock order prevents a policy revocation from racing a new assignment. Invalid or malformed policy and coordination state fails closed and is never automatically overwritten.
 

package/agent-spine-plugin/docs/gateway-runtime.md

@@ -33,9 +33,9 @@ Set `AGENTSPINE_PERSONA_ROSTER_FILE` or pass `--persona-roster` to the worker. T
 
 Every tick synchronizes authenticated identities before any work is reconciled. New bindings append `join` events; renames retain the stable persona ID; omitted members in the same explicit roster scope become `left`; `"deactivated": true` records a distinct deactivation; reappearance appends `rejoin`. A binding may describe a `person`, `agent`, or `bot`; equal display names never merge identities. Names, Markdown, memory, and chat text cannot create identity or rights. Existing source files are never changed.
 
-Version `0.10.0` reconciles the authenticated roster into the relationship graph on every sync, including an otherwise unchanged replay. An exact `groupId` creates a missing group-scoped, context-only group entity; a conflicting non-group or private group fails visibly. Missing persona entities and membership edges are recreated, stale memberships are removed, and left or deactivated personas remain in append-only identity history but disappear from current relationship context. Reconciliation reports whether the roster changed separately from graph repair, so a previously partial installation can self-heal instead of remaining a permanent duplicate.
+Version `0.10.1` reconciles the authenticated roster into the relationship graph on every sync, including an otherwise unchanged replay. An exact `groupId` creates a missing group-scoped, context-only group entity; a conflicting non-group or private group fails visibly. Missing persona entities and membership edges are recreated, stale memberships are removed, and left or deactivated personas remain in append-only identity history but disappear from current relationship context. Reconciliation reports whether the roster changed separately from graph repair, so a previously partial installation can self-heal instead of remaining a permanent duplicate.
 
-When a hook supplies the same exact `groupId`, `relationship_context` and `session_briefing` include current visible co-members reached through authenticated `member-of` edges. They do not infer friendships, merge names, cross tenants, expose another group, or turn membership into delegation. A direct session without an exact group scope does not receive group-private peers. Relationship reads have a five-second local state deadline and return a clear error instead of waiting indefinitely on a stalled read.
+When a hook supplies the same exact `groupId`, `relationship_context` and `session_briefing` include current visible co-members reached through authenticated `member-of` edges. They do not infer friendships, merge names, cross tenants, expose another group, or turn membership into delegation. A direct session without an exact group scope does not receive group-private peers. Relationship reads bypass project discovery, abort the graph read after a five-second local deadline, and return a visible `degraded` status instead of aborting the turn or waiting indefinitely.
 
 The same approved envelope may contain `nativeDiscovery` scopes. AgentSpine then checks only the officially documented direct agent-manifest directories: Claude Code `~/.claude/agents/` or `<project>/.claude/agents/`, and Codex `~/.codex/agents/` or `<project>/.codex/agents/`. `CLAUDE_CONFIG_DIR` and `CODEX_HOME` replace only their matching user scope. Each scope fixes issuer, tenant, profile, agent/bot kind, and optional group; those authenticated scope fields plus the exact source binding form the stable identity. The manifest contributes only its declared display name and an exact source descriptor; its instructions remain host-native context. Direct regular `.md` or `.toml` files are bounded to 128 entries and 256 KiB each; symlinks and files exchanged during a read fail closed. No other home or project directory is enumerated. See the official [Claude Code custom subagent locations](https://code.claude.com/docs/en/sub-agents) and [Codex custom agent locations](https://developers.openai.com/codex/agent-configuration/subagents).
 

package/agent-spine-plugin/docs/host-integration.md

@@ -21,7 +21,7 @@ claude plugin install agent-spine@agent-spine
 
 Use `claude plugin validate .` in a checkout to validate the manifest and marketplace. Claude Code asks the user to approve executable plugin components according to its trust model.
 
-The Claude manifest explicitly references `./.mcp.json`. The hook bundle remains at Claude Code's native auto-discovery path `hooks/hooks.json`; it is deliberately not registered a second time through the manifest. Version `0.10.1` replaces the `0.10.0` plugin cache identity. The hook definition contains only portable documented hook fields; `hooks/version.json` carries the separately validated bundle release and preflight contract. The repository checks resolve installed-root variables, perform a real MCP `initialize` handshake, validate exactly one native hook command per event, and exercise staged clean install, previous-version cache rejection, upgrade, host-native source resolution, indexed and lazy Claude memory, automatic multilingual briefing, pre-answer recall, authenticated persona graph reconciliation, attention, exact job start, tool checkpoint, new-session resume, purge, and uninstall preservation:
+The Claude manifest explicitly references `./.mcp.json`. The hook bundle remains at Claude Code's native auto-discovery path `hooks/hooks.json`; it is deliberately not registered a second time through the manifest. Codex keeps its host-specific adapter in `hooks/codex.json`, while `.codex-plugin/plugin.json` omits the unsupported `hooks` field and passes the official plugin validator. Version `0.11.4` replaces the `0.11.2` plugin cache identity. The hook definitions contain only portable documented fields; `hooks/version.json` carries the separately validated bundle release and preflight contract. The repository checks resolve installed-root variables, perform a real MCP `initialize` handshake, validate exactly one native hook command per event, and exercise staged clean install, previous-version cache rejection, upgrade, host-native source resolution, indexed and lazy Claude memory, automatic multilingual briefing, pre-answer recall, authenticated persona graph reconciliation, attention, exact job start, tool checkpoint, new-session resume, purge, and uninstall preservation:
 
 ```bash
 npm run host:check
@@ -110,7 +110,7 @@ The audit exits non-zero when a required gate fails, making it suitable for inst
 
 Use `agentspine doctor --host claude|codex --cwd /active/project --json` or `agentspine source-status --host claude|codex --cwd /active/project --json` to see the checked scope counts and a concrete empty/fail-closed reason. The lifecycle adapter never substitutes the installation directory for the active host hierarchy. Details and official host references are in [host-native source roots](source-roots.md).
 
-The provider-neutral lifecycle adapter covers `SessionStart` (including resume and compact starts), `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, `PreCompact`, `PostCompact`, `Stop`, and `SubagentStop`. Claude Code additionally registers its documented `InstructionsLoaded` observability event; Codex does not. `UserPromptSubmit` is the blocking boundary. Before a prompt can proceed, `agentspine.preflight/v2` verifies the complete mandatory host-instruction hierarchy without reinjecting its bytes, loads confirmed Must-Remember entries and every locally required retrieval provider, then consumes one exact-turn receipt. Start and compaction boundaries retain the scoped `session_briefing`; no model-side MCP selection is required. Full behavior and the documented command-hook timeout limitation are in [pre-answer recall gate](preflight-recall.md).
+The provider-neutral lifecycle adapter covers `SessionStart` (including resume and compact starts), `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, `PreCompact`, `PostCompact`, `Stop`, and `SubagentStop`. Claude Code additionally registers its documented `InstructionsLoaded` observability event; Codex does not. `UserPromptSubmit` is the blocking boundary. Before a prompt can proceed, `agentspine.preflight/v2` loads complete mandatory host instructions, confirmed Must-Remember entries and every locally required retrieval provider, then consumes one exact-turn receipt. Start and compaction boundaries retain the scoped `session_briefing`; no model-side MCP selection is required. Full behavior and the documented command-hook timeout limitation are in [pre-answer recall gate](preflight-recall.md).
 
 When an exact locally registered job is waiting, `SessionStart` acquires its lease and injects its real checkpoint automatically. Subsequent tool and stop hooks resolve that job from the native host session; the model does not need to repeat a job envelope. `PreToolUse` first retains the protected-source guard, then rechecks the current execution grant, assignment, scope, capability, lease, and workspace. `PostToolUse` checkpoints exactly one matching result. A new session resumes only after the same checks. Grant and job administration remain local CLI operations and are absent from MCP. No hook creates permissions.
 

package/agent-spine-plugin/docs/learning.md

@@ -1,6 +1,6 @@
 # Safe learning
 
-AgentSpine separates an observation from a fact that may enter future context. An agent can propose a candidate and append evidence, but the candidate remains invisible to `learning_context` until it passes an explicit review or the narrowly scoped, default-off automatic policy.
+AgentSpine separates an observation from a fact that may enter future context. An agent can propose a candidate and append evidence, but the candidate remains invisible to `learning_context` until it passes an explicit review or the narrowly scoped, default-off automatic policy. Version 0.11 adds an outcome-bound path for low-risk behavior: a lesson is useful only when fixed, externally measured tasks improve after a limited canary application.
 
 ```mermaid
 flowchart LR
@@ -9,7 +9,12 @@ flowchart LR
     E --> R{"Review gate"}
     R -->|"explicit user confirmation"| A["Accepted context"]
     R -->|"reject"| X["Rejected history"]
-    R -->|"opt-in low-risk policy"| A
+    R -->|"opt-in fact policy"| A
+    E --> M["Independent before receipts"]
+    M --> K["Scoped canary"]
+    K --> N["Independent after receipts"]
+    N -->|"measured improvement"| A
+    N -->|"regression or blocking defect"| B["Automatic rollback"]
     A --> S["Supersede without erasing"]
     S --> B["Rollback restores prior fact"]
 ```
@@ -25,6 +30,7 @@ flowchart LR
 | `personal-fact` | Explicit confirmation | Never |
 | `project-fact` | Explicit confirmation | Opt-in, evidence-gated |
 | `reference` | Explicit confirmation | Opt-in, evidence-gated |
+| `behavior` | Explicit confirmation | Opt-in, outcome-gated canary |
 
 Every candidate and evidence record carries `authority: context-only`. Accepted learning can improve relevance and consistency, but it cannot grant permissions, delegation, production access, spending rights, policy exceptions, or instructions to act.
 
@@ -72,6 +78,35 @@ The accepted record stores the policy thresholds, evidence count, and evaluation
 
 This evaluator is separate from [automatic continuity](automatic-continuity.md). After its own local privacy opt-in, the lifecycle adapter may accept only direct, high-confidence style preferences, no-gos, corrections, project facts, and references with a recorded threshold proof. Personal facts, group conversation content, identity claims, secrets, authority, access, and operational permissions are never eligible. The continuity path is not exposed through MCP.
 
+## Measured behavior loop
+
+`behavior` candidates use `agentspine.learning-outcome/v1` receipts. A receipt stores no prompt, answer, transcript, credential, or source content. It binds a normalized metric to one exact persona, user, tenant, project, group, task, evaluator, phase, and time. Metric values are normalized to `0..1`; the direction states whether higher or lower is better. Objective measurements, explicit user feedback, and model suggestions remain separate. Model suggestions are retained for diagnosis but never count toward automatic promotion or validation.
+
+Before promotion, the candidate needs the configured number of independent, fresh, non-model receipts for the same metric and exact scope, including at least one objective evaluator. It also needs the normal distinct-evidence and confidence thresholds. A conflicting active candidate blocks automatic promotion. Security, safety, identity, authentication, authorization, credential, policy, production, deployment, payment, and access lessons are marked for local review and can never enter this automatic path. Successful evaluation creates a time-limited canary rather than a final unmeasured claim. Only that exact scope receives the canary in its next briefing.
+
+```bash
+agentspine learn-propose learning:check-invariant \
+  --kind behavior \
+  --claim "Check the fixed invariant before answering." \
+  --evidence "Two fixture runs missed the invariant." \
+  --privacy shared \
+  --persona agent:synthetic --user user:synthetic --tenant tenant:synthetic \
+  --project project:synthetic --task task:synthetic
+
+agentspine learn-outcome learning:check-invariant \
+  --phase before --metric fixed-task-success --direction higher --value 0.40 \
+  --measurement objective --evaluator evaluator:test-a \
+  --persona agent:synthetic --user user:synthetic --tenant tenant:synthetic \
+  --project project:synthetic --task task:synthetic
+
+agentspine learn-evaluate . --json
+agentspine learn-status . --json
+```
+
+After canary use, the host records `after` receipts for the same metric and scope. Independent receipts meeting `minImprovement` validate the lesson. Any blocking defect rolls it back immediately; a regression beyond `regressionTolerance`, insufficient measured improvement, or expiry before validation also rolls it back. A superseded lesson is restored atomically. No average score can override a blocking defect.
+
+Outcome recording and policy changes are local CLI/runtime operations. MCP exposes only the read-only `learning_outcome_status` view for this loop; model-side MCP cannot manufacture outcome evidence. `learning_context` returns only active, unexpired or validated, exact-scope behavior lessons and reports stale canaries as degraded instead of silently projecting them.
+
 ## Supersession and rollback
 
 New information does not overwrite an accepted fact. Propose a new candidate with `--supersedes` and the same kind, subject, and privacy scope. Acceptance marks the prior record `superseded` and retains both versions. Rollback deactivates the replacement and restores the prior accepted record atomically.

package/agent-spine-plugin/docs/preflight-recall.md

@@ -6,7 +6,7 @@ The receipt binds agent and optional persona, user, tenant, host, instruction ho
 
 ## Host instructions
 
-Claude Code uses its resolved user and project `CLAUDE.md` hierarchy. Codex uses the corresponding `AGENTS.override.md`/`AGENTS.md` hierarchy. A generic host must explicitly bind `instruction_host` to `claude` or `codex`; AgentSpine does not guess. The preflight race-safely rereads and hashes every active host instruction document, binds its exact file identity into the receipt, and emits only bounded `host-native` descriptors. It never duplicates the already host-loaded instruction bytes into hook context. An unreadable, replaced, deleted, oversized, out-of-scope, or symlinked mandatory file still blocks the turn.
+Claude Code uses its resolved user and project `CLAUDE.md` hierarchy. Codex uses the corresponding `AGENTS.override.md`/`AGENTS.md` hierarchy. A generic host must explicitly bind `instruction_host` to `claude` or `codex`; AgentSpine does not guess. The mandatory preflight section contains the complete bytes of every active instruction document. Its standard hard budget is 8 KiB. Claude instructions may use one explicit aggregate overflow up to 16 KiB; the mode, used bytes, overflow and hard limit are bound into the signed exact-turn receipt and revalidated before consumption. Codex and generic instruction hosts remain capped at 8 KiB. An unreadable, replaced, deleted, oversized, out-of-scope, or symlinked mandatory file blocks immediately with a visible bounded diagnostic instead of degrading to a descriptor or waiting silently.
 
 Claude Code's `InstructionsLoaded` lifecycle event is registered as an additional observability signal, while `UserPromptSubmit` remains the blocking and injection boundary. Codex uses its own manifest-selected hook set without that unsupported Claude-only event. The preflight does not rely on the model remembering to read a file or call a tool.
 

package/agent-spine-plugin/docs/quality-gates.md

@@ -16,7 +16,7 @@ agentspine audit /path/to/project --json
 | 5 | Markdown link integrity | An indexed local `.md` link has no target |
 | 6 | Conflict visibility | Precedence and competing candidates are surfaced for review |
 | 7 | Authority boundary | Context or shared state claims authority; a delegation, execution, channel, persona, or goal policy lacks explicit local provenance; or a task/job/channel/gateway snapshot has no valid policy binding |
-| 8 | Context privacy | Graph, attention, learning, coordination, self-starter, channel, persona, gateway queue/lane/checkpoint/delivery, sharing, signer, trust, signature, group binding, local-review proof, or safety boundary is invalid |
+| 8 | Context privacy | Graph, attention, learning candidate, outcome receipt, canary scope, coordination, self-starter, channel, persona, gateway queue/lane/checkpoint/delivery, sharing, signer, trust, signature, group binding, local-review proof, or safety boundary is invalid |
 | 9 | Context budget | Resolved source bytes or the complete compact session briefing exceed the requested ceiling |
 | 10 | Byte preservation | A source hash changed during the audit or differs from the saved scan |
 

package/agent-spine-plugin/docs/relationships.md

@@ -67,7 +67,7 @@ With an exact `groupId`, a relationship read returns the requested entity's dire
 
 - The graph is local user state and is not synchronized automatically.
 - Authenticated roster state is synchronized only when an owner-configured roster or native manifest scope is active; chat names never create entities.
-- Relationship reads stop with a visible error after a five-second local state deadline.
+- Relationship reads bypass project discovery, abort the graph read after a five-second local deadline, and return a visible `degraded` status without aborting the turn.
 - A 5 MiB graph ceiling stops unbounded growth instead of discarding history.
 - Attribute-key rejection cannot determine whether innocent-looking prose contains a secret.
 - Group-specific recipient policy and notification delivery are not implemented.

package/agent-spine-plugin/docs/session-briefing.md

@@ -38,7 +38,7 @@ The packet contains:
 - the current task first, followed by other visible scoped work;
 - the requested entity and its visible relationship neighborhood;
 - a voice brief containing only visible persona descriptors, allowed voice fields, accepted preferences, corrections, no-gos, the current task, and active promise or blocker signals;
-- accepted local learning relevant to the entity or project;
+- accepted local learning relevant to the exact persona, user, tenant, project, group, and task scope; outcome-gated behavior is included only while its canary is active and unexpired or after measured validation;
 - locally reviewed shared memory, deduplicated against equivalent local learning;
 - due attention suggestions only when focus mode is explicitly disabled.
 

package/agent-spine-plugin/docs/source-roots.md

@@ -36,7 +36,7 @@ Every direct index link is counted as indexed, but its target is opened only whe
 
 An exact person, project, group, or task ID must match the current hook scope. Prompt relevance requires a normalized keyword match against the link label, filename, or explicit `keywords` marker. If relevance is uncertain, the target remains unopened. The index itself is always loaded so the host retains its native memory overview.
 
-The persistent cache lives under AgentSpine's platform state directory, outside every agent project. It stores integrity-checked snapshots keyed by an opaque root digest and relative path. A cache hit still opens and validates the original path and file identity, but does not reread or rehash unchanged source bytes. Corrections, deletion, link removal, source-binding rollback, purge, restart, and compaction invalidate or prune the affected cache record immediately. Cache contents and relevance markers are context-only.
+The persistent cache lives under AgentSpine's platform state directory, outside ordinary agent projects. If the active project root is exactly a recognized user home, the configured AgentSpine state subtree may be below that root but is explicitly pruned before source enumeration; it is never context. The exception does not apply to nested project roots. The cache stores integrity-checked snapshots keyed by an opaque root digest and relative path. A cache hit still opens and validates the original path and file identity, but does not reread or rehash unchanged source bytes. Corrections, deletion, link removal, source-binding rollback, purge, restart, and compaction invalidate or prune the affected cache record immediately. Cache contents and relevance markers are context-only.
 
 Indexed targets use no-follow open semantics. Parent components, canonical scope, regular-file status, size, identity, modification metadata, and the pathname-to-handle identity are checked around the same read. A changing target is retried a bounded number of times and then rejected as a race; mixed snapshots are never injected.