blun-king-cli 9.1.567 → 9.1.569

package/agent-spine-plugin/src/hook.js

@@ -1,565 +1,49 @@
 #!/usr/bin/env node
 import { createHash } from "node:crypto";
-import { isAbsolute, relative, resolve } from "node:path";
-import { recordAttentionEvent } from "./lib/attention.js";
+import { resolve } from "node:path";
 import { catalogForStateRoot, saveCatalog } from "./lib/catalog.js";
 import { loadGraph } from "./lib/graph.js";
 import { canonicalPath } from "./lib/paths.js";
 import { resolveHostSourceCatalog } from "./lib/source-roots.js";
 import { sessionBriefing } from "./lib/briefing.js";
-import { captureContinuityPrompt, loadContinuity } from "./lib/continuity.js";
+import { captureContinuityPrompt } from "./lib/continuity.js";
 import { recordLearningApplications, recordLearningDeliveries } from "./lib/learning.js";
-import {
-  authorizeJobEffect, checkpointJobEffect, closeJobLease, resolveSessionJob, startOrResumeJob
-} from "./lib/selfstarter.js";
-import { claimChannelEvent } from "./lib/channel-runtime.js";
+import { authorizeJobEffect, checkpointJobEffect, closeJobLease } from "./lib/selfstarter.js";
 import { syncPersonaRosterFromEnvironment } from "./lib/persona-runtime.js";
 import { captureMustRememberPrompt, recordPreflightFailure, runPreflight, verifyPreflightReceipt } from "./lib/preflight.js";
+import { actionLessonRecall } from "./lib/action-lesson-recall.js";
+import { captureSessionTimelineLifecycle, finalizeUserPromptSessionTimeline } from "./lib/hook-timeline.js";
+import { timelineToolKind } from "./lib/mcp-timeline-tools.js";
+import { emitTimelineToolGuard, runTimelineToolGuard } from "./lib/timeline-tool-guard.js";
+import { readHookInput, SILENT_OVERSIZE_POST_TOOL_USE, SILENT_OVERSIZE_POST_TOOL_USE_ARG } from "./lib/hook-input.js";
 import { isMainModule } from "./lib/runtime.js";
-import { recordHookScanAudit } from "./lib/hook-audit.js";
-
-const MAX_STDIN_BYTES = 64 * 1024;
-const STANDARD_HOST_CONTEXT_BYTES = 9500;
-const MAX_CLAUDE_OVERFLOW_CONTEXT_BYTES = 32 * 1024;
+import { deliveryActorSession, deliverySuccessEvidence, recordDeliveryToolUse,
+  recordDeliveryWriteIntent } from "./lib/delivery-verification.js";
+import {
+  blockPrompt, blockStop, blunRuntimeContext, blunRuntimeMessage, denyTool, hookOutput, lifecycleOutput
+} from "./lib/hook-output.js";
+import {
+  ATTENTION_WRITE_EVENTS, boundedId, captureAttentionLifecycle, hookDeliveryId, hostContextLimit, hostFromInput,
+  promptFromInput, renderContext, runtimeScope, selfstarterInput, selfstarterRootSkipped,
+  selfstarterScope, sessionId, startChannelEvent, startSelfstarter, toolResult, toolSucceeded
+} from "./lib/hook-context.js";
+import {
+  auditGuard, auditSkippedScans, candidatePaths, finishScanFailure, hookScanFailureFailsOpen,
+  isMutationTool, isScanFailOpenTool, shellTargetsProtected
+} from "./lib/hook-protection.js";
+import {
+  captureJavaScriptBeforeWrite, inspectWrittenJavaScript, verifyBaselineBeforeWrite, verifyDeliveredArtifacts
+} from "./lib/hook-artifact-guards.js";
+import { isPremortemWrite, prepareHookPremortem, recordHookPremortemWrite,
+  recordHookPremortemWriteIntent, verifyHookPremortemWrite } from "./lib/hook-premortem.js";
+import { verifyHookStopContracts } from "./lib/hook-stop-verification.js";
+import { processAdvisory } from "./lib/hook-process-advisory.js";
+export { blunRuntimeContext, blunRuntimeMessage } from "./lib/hook-output.js";
 const CONTEXT_EVENTS = new Set(["SessionStart", "UserPromptSubmit", "PreCompact", "PostCompact"]);
 const KNOWN_EVENTS = new Set([
   ...CONTEXT_EVENTS, "InstructionsLoaded", "PreToolUse", "PostToolUse", "Stop", "SubagentStop"
 ]);
-const ID_RE = /^[A-Za-z0-9][A-Za-z0-9:_.@/-]{0,127}$/;
-const ATTENTION_WRITE_EVENTS = new Set(["UserPromptSubmit", "PostToolUse", "Stop", "SubagentStop"]);
-const SELFSTART_EVENTS = new Set(["SessionStart", "PostCompact"]);
-const SILENT_OVERSIZE_POST_TOOL_USE = Symbol("silent-oversize-post-tool-use");
-const SILENT_OVERSIZE_POST_TOOL_USE_ARG = "--silent-oversize-post-tool-use";
-
-async function readStdin({ silentOversizePostToolUse = false } = {}) {
-  const chunks = [];
-  let bytes = 0;
-  let oversized = false;
-  for await (const chunk of process.stdin) {
-    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    const remaining = Math.max(0, MAX_STDIN_BYTES - bytes);
-    if (remaining) chunks.push(buffer.subarray(0, remaining));
-    bytes += buffer.length;
-    if (bytes > MAX_STDIN_BYTES) oversized = true;
-  }
-  if (oversized) {
-    if (silentOversizePostToolUse) return SILENT_OVERSIZE_POST_TOOL_USE;
-    throw new Error("hook input exceeds the 64 KiB limit");
-  }
-  const value = Buffer.concat(chunks, bytes).toString("utf8");
-  const parsed = value.trim() ? JSON.parse(value) : {};
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("hook input must be one JSON object");
-  return parsed;
-}
-
-function boundedId(value, field) {
-  if (value === null || value === undefined || value === "") return null;
-  if (typeof value !== "string" || !ID_RE.test(value)) throw new Error(`${field} is invalid`);
-  return value;
-}
-
-function promptFromInput(input) {
-  for (const key of ["prompt", "user_prompt", "message", "input"]) {
-    const value = input[key];
-    if (typeof value === "string") return value;
-    if (Array.isArray(value)) {
-      const text = value
-        .filter((part) => part && typeof part === "object" && part.type === "text" && typeof part.text === "string")
-        .map((part) => part.text)
-        .join("\n")
-        .trim();
-      if (text) return text;
-    }
-  }
-  return null;
-}
-
-function hostContextLimit(preflight) {
-  return preflight?.receipt?.instructionBudget?.mode === "claude-required-overflow"
-    ? MAX_CLAUDE_OVERFLOW_CONTEXT_BYTES
-    : STANDARD_HOST_CONTEXT_BYTES;
-}
-
-function hostFromInput(input) {
-  const explicit = input.host || input.provider || process.env.AGENTSPINE_HOST;
-  if (["claude", "codex", "generic"].includes(explicit)) return explicit;
-  if ((typeof input.model === "string" && input.model.trim()) || process.env.PLUGIN_ROOT || process.env.CODEX_HOME
-    || process.env.BLUN_PLUGIN_ROOT || process.env.BLUN_HOME) return "codex";
-  return "claude";
-}
-
-function gatewayEnvironmentContext(env = process.env) {
-  if (env.AGENTSPINE_GATEWAY_CONTEXT !== "agentspine.gateway-start/v1") return null;
-  return {
-    entityId: boundedId(env.AGENTSPINE_ENTITY_ID, "AGENTSPINE_ENTITY_ID"),
-    groupId: boundedId(env.AGENTSPINE_GROUP_ID, "AGENTSPINE_GROUP_ID"),
-    projectId: boundedId(env.AGENTSPINE_PROJECT_ID, "AGENTSPINE_PROJECT_ID"),
-    taskId: boundedId(env.AGENTSPINE_TASK_ID, "AGENTSPINE_TASK_ID"),
-    eventId: boundedId(env.AGENTSPINE_CHANNEL_EVENT_ID, "AGENTSPINE_CHANNEL_EVENT_ID"),
-    provider: boundedId(env.AGENTSPINE_CHANNEL_PROVIDER, "AGENTSPINE_CHANNEL_PROVIDER")
-  };
-}
-
-async function runtimeScope(input, root, userStateRoot = null, catalog) {
-  const { continuity: projectContinuity } = await loadContinuity(root, catalog);
-  const userCatalog = userStateRoot && userStateRoot !== root
-    ? catalogForStateRoot(catalog, userStateRoot) : catalog;
-  const userContinuity = userStateRoot && userStateRoot !== root
-    ? (await loadContinuity(userStateRoot, userCatalog)).continuity
-    : projectContinuity;
-  const continuity = {
-    config: {
-      ...projectContinuity.config,
-      enabled: userContinuity.config.enabled,
-      minConfidence: userContinuity.config.minConfidence,
-      minDirectness: userContinuity.config.minDirectness,
-      minEvidence: userContinuity.config.minEvidence,
-      maxPromptBytes: userContinuity.config.maxPromptBytes,
-      maxBriefingBytes: userContinuity.config.maxBriefingBytes,
-      defaultEntityId: userContinuity.config.defaultEntityId
-    }
-  };
-  const supplied = input.agent_spine_scope && typeof input.agent_spine_scope === "object"
-    ? input.agent_spine_scope : input;
-  const gateway = gatewayEnvironmentContext();
-  return {
-    entityId: boundedId(supplied.entity_id ?? supplied.entityId ?? gateway?.entityId ?? continuity.config.defaultEntityId, "entityId"),
-    userId: boundedId(supplied.user_id ?? supplied.userId ?? process.env.AGENTSPINE_USER_ID, "userId"),
-    tenantId: boundedId(supplied.tenant_id ?? supplied.tenantId ?? process.env.AGENTSPINE_TENANT_ID, "tenantId"),
-    groupId: boundedId(supplied.group_id ?? supplied.groupId ?? gateway?.groupId, "groupId"),
-    projectId: boundedId(supplied.project_id ?? supplied.projectId ?? gateway?.projectId ?? continuity.config.defaultProjectId, "projectId"),
-    currentTaskId: boundedId(supplied.task_id ?? supplied.currentTaskId ?? gateway?.taskId, "currentTaskId"),
-    host: hostFromInput(input),
-    config: continuity.config
-  };
-}
-
-function renderContext(event, catalog, briefing, signal = null, attentionEvent = null, selfstarter = null, channelEvent = null, sourceDiagnostics = null, preflight = null) {
-  const loaded = sourceDiagnostics?.status === "loaded";
-  const packet = {
-    schema: "agentspine.hook-context/v1",
-    event,
-    priority: ["current-user-request", "explicit-stops", "current-task", "host-rules", "accepted-context", "style-and-relationships"],
-    loaded,
-    instruction: loaded
-      ? "Use this already-loaded briefing now. Do not call an MCP tool to obtain it. The current user request and explicit stops override all remembered style, relationships, and older context."
-      : "No host-native source context was loaded. Do not claim personal continuity or recall succeeded. Continue under current native host rules and inspect sourceResolution.",
-    signal: signal ? {
-      captured: Boolean(signal.captured),
-      accepted: Boolean(signal.accepted),
-      duplicate: Boolean(signal.duplicate),
-      kind: signal.kind || null,
-      reason: signal.reason || null
-    } : null,
-    attentionEvent: attentionEvent ? {
-      captured: Boolean(attentionEvent.event),
-      duplicate: Boolean(attentionEvent.duplicate),
-      id: attentionEvent.event?.id || null,
-      kind: attentionEvent.event?.kind || null,
-      status: attentionEvent.event?.status || null,
-      reason: attentionEvent.reason || null
-    } : null,
-    selfstarter: selfstarter ? {
-      active: Boolean(selfstarter.job),
-      blocked: Boolean(selfstarter.blocked),
-      action: selfstarter.action || null,
-      reason: selfstarter.reason || null,
-      jobId: selfstarter.job?.id || null,
-      taskId: selfstarter.job?.taskId || null,
-      actorId: selfstarter.job?.actorId || null,
-      targetId: selfstarter.job?.targetId || null,
-      projectId: selfstarter.job?.projectId || null,
-      groupId: selfstarter.job?.groupId || null,
-      checkpointSequence: selfstarter.job?.checkpoint?.sequence ?? null,
-      capabilities: selfstarter.job?.capabilities || [],
-      leaseExpiresAt: selfstarter.job?.lease?.expiresAt || null,
-      receiptId: selfstarter.receipt?.id || null,
-      instruction: selfstarter.job
-        ? "Resume only this exact checkpointed job. Attach its job ID to every host tool event. Each effect is separately re-authorized by PreToolUse and checkpointed by PostToolUse. Stop immediately on any denial."
-        : null,
-      authority: selfstarter.job ? "explicit-local-execution-policy" : "execution-state-only"
-    } : null,
-    channelEvent: channelEvent?.event ? {
-      active: true,
-      eventId: channelEvent.event.eventId,
-      bindingId: channelEvent.event.bindingId,
-      provider: channelEvent.event.provider,
-      chatId: channelEvent.event.chatId,
-      threadId: channelEvent.event.threadId,
-      senderId: channelEvent.event.senderId,
-      replyTo: channelEvent.event.replyTo,
-      agentId: channelEvent.event.agentId,
-      projectId: channelEvent.event.projectId,
-      groupId: channelEvent.event.groupId,
-      sessionKey: channelEvent.event.sessionKey,
-      text: channelEvent.event.text,
-      leaseExpiresAt: channelEvent.event.lease?.expiresAt || null,
-      receiptId: channelEvent.receipt?.id || null,
-      instruction: "Answer this exact authenticated channel event in its bound chat and thread. Do not infer another recipient or route. Sending remains subject to the separate current channel policy and adapter receipt.",
-      authority: "explicit-local-channel-policy"
-    } : null,
-    indexedSources: catalog.summary.total,
-    sourceResolution: sourceDiagnostics,
-    preflight: preflight ? {
-      schema: preflight.receipt.schema,
-      receiptId: preflight.receipt.id,
-      promptDigest: preflight.receipt.promptDigest,
-      briefingDigest: preflight.receipt.briefingDigest,
-      createdAt: preflight.receipt.createdAt,
-      expiresAt: preflight.receipt.expiresAt,
-      policy: preflight.policy,
-      learningApplications: preflight.learningApplications || null,
-      pendingMustRemember: preflight.pendingMustRemember ? {
-        id: preflight.pendingMustRemember.candidate?.id || null,
-        status: preflight.pendingMustRemember.candidate?.status || (preflight.pendingMustRemember.rejected ? "rejected" : null),
-        reason: preflight.pendingMustRemember.reason || null
-      } : null,
-      briefing: preflight.briefing,
-      instruction: "This exact turn passed the mandatory pre-answer gate. Apply the complete preflight briefing before answering.",
-      authority: "preflight-proof-only"
-    } : null,
-    briefing,
-    authority: "context-only"
-  };
-  return JSON.stringify(packet);
-}
-
-function selfstarterInput(input) {
-  const value = input.agent_spine_job;
-  if (value === undefined || value === null) return null;
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("agent_spine_job must be one object");
-  return value;
-}
-
-function channelEventInput(input) {
-  const gateway = gatewayEnvironmentContext();
-  const value = input.agent_spine_channel_event ?? (gateway?.eventId && gateway?.provider
-    ? { event_id: gateway.eventId, provider: gateway.provider } : null);
-  if (value === undefined || value === null) return null;
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("agent_spine_channel_event must be one object");
-  const unknown = Object.keys(value).filter((key) => !["event_id", "eventId", "provider"].includes(key));
-  if (unknown.length) throw new Error(`agent_spine_channel_event contains unknown field: ${unknown.sort()[0]}`);
-  return value;
-}
-
-function hookDeliveryId(input) {
-  return boundedId(input.tool_use_id ?? input.event_id ?? input.hook_event_id, "toolUseId");
-}
-
-function sessionId(input) {
-  return boundedId(input.session_id ?? input.sessionId, "sessionId");
-}
-
-async function startSelfstarter(input, event, root, scope, sourceDiagnostics) {
-  if (!SELFSTART_EVENTS.has(event)) return null;
-  const requested = selfstarterInput(input);
-  if (selfstarterRootSkipped(sourceDiagnostics)) {
-    if (requested) throw new Error("self-starter cannot use a user home or host profile as its workspace root");
-    return null;
-  }
-  const session = sessionId(input);
-  if (!scope.entityId || !scope.projectId || !session) {
-    if (requested) throw new Error("self-starter start requires an exact actor, project, and host session");
-    return null;
-  }
-  return startOrResumeJob({
-    root, actorId: scope.entityId, projectId: scope.projectId, groupId: scope.groupId,
-    taskId: scope.currentTaskId, jobId: boundedId(requested?.job_id ?? requested?.jobId, "jobId"),
-    host: scope.host, sessionId: session, now: input.timestamp || new Date()
-  });
-}
-
-function selfstarterRootSkipped(sourceDiagnostics) {
-  return ["skipped-unmarked-home", "skipped-home-root", "skipped-profile-root"]
-    .includes(sourceDiagnostics?.projectTreeScan);
-}
-
-async function startChannelEvent(input, event, root, scope, catalog) {
-  const requested = channelEventInput(input);
-  if (!requested) return null;
-  if (event !== "SessionStart") throw new Error("channel event claims are accepted only at SessionStart");
-  const session = sessionId(input);
-  if (!scope.entityId || !scope.projectId || !session) {
-    throw new Error("channel event start requires an exact agent, project, and host session");
-  }
-  const workerId = `channel-worker:${createHash("sha256").update(`${scope.host}\0${session}`).digest("hex").slice(0, 24)}`;
-  const claim = await claimChannelEvent({
-    root, eventId: boundedId(requested.event_id ?? requested.eventId, "channelEventId"),
-    agentId: scope.entityId, projectId: scope.projectId, groupId: scope.groupId,
-    provider: boundedId(requested.provider, "channelProvider"), workerId,
-    now: input.timestamp || new Date(), catalog
-  });
-  if (!claim.event) throw new Error("the exact channel event is unavailable in this agent lane");
-  return claim;
-}
-
-async function selfstarterScope(input, scope, root, action) {
-  const requested = selfstarterInput(input);
-  const hostSession = sessionId(input);
-  const supplied = {
-    actorId: scope.entityId, projectId: scope.projectId, groupId: scope.groupId,
-    taskId: scope.currentTaskId, host: scope.host, sessionId: hostSession
-  };
-  if (requested) return { ...supplied, jobId: boundedId(requested.job_id ?? requested.jobId, "jobId") };
-  if (!hostSession) return null;
-  return resolveSessionJob({ root, ...supplied, action, now: input.timestamp || new Date() });
-}
-
-function toolSucceeded(input) {
-  if (input.success === false || input.is_error === true || input.tool_error) return false;
-  if (input.tool_result && typeof input.tool_result === "object" && input.tool_result.isError === true) return false;
-  return true;
-}
-
-function toolResult(input) {
-  return input.tool_result ?? input.tool_response ?? input.result ?? (input.tool_error ? { failed: true } : null);
-}
-
-function eventReceipt(input, event, scope, discriminator = "lifecycle") {
-  const supplied = input.event_id ?? input.hook_event_id ?? input.tool_use_id ?? input.session_id;
-  if (typeof supplied === "string" && ID_RE.test(supplied)) {
-    return `receipt:${createHash("sha256").update(`${event}\0${supplied}\0${discriminator}`).digest("hex").slice(0, 24)}`;
-  }
-  const material = [event, scope.host, scope.entityId, scope.projectId, scope.currentTaskId, discriminator].join("\0");
-  return `receipt:${createHash("sha256").update(material).digest("hex").slice(0, 24)}`;
-}
-
-function heartbeatReceipt(input, scope) {
-  const at = new Date(input.timestamp || Date.now());
-  if (!Number.isFinite(at.getTime())) throw new Error("heartbeat timestamp is invalid");
-  const minute = at.toISOString().slice(0, 16);
-  const material = [scope.host, scope.entityId, scope.groupId, scope.projectId, scope.currentTaskId, minute].join("\0");
-  return `receipt:heartbeat:${createHash("sha256").update(material).digest("hex").slice(0, 20)}`;
-}
-
-function minimalAttentionSignal(prompt) {
-  if (typeof prompt !== "string" || Buffer.byteLength(prompt) > 16384) return null;
-  const rules = [
-    { kind: "promise", re: /^(?:i promise(?: to)?|i will|ich verspreche(?:,)?|ich werde|prometo(?: que)?|voy a|jag lovar att|jag kommer att)\s+(.+)$/i, prefix: "Promise: " },
-    { kind: "blocker", re: /^(?:blocker|blocked(?: by)?|i am blocked(?: by)?|ich bin blockiert(?: durch)?|blockiert durch|bloquead[oa](?: por)?|estoy bloquead[oa](?: por)?|blockerad(?: av)?|jag är blockerad(?: av)?)\s*[:,-]?\s*(.+)$/i, prefix: "Blocker: " }
-  ];
-  for (const rule of rules) {
-    const match = prompt.trim().match(rule.re);
-    if (!match) continue;
-    const value = match[1].trim().replace(/\s+/g, " ").replace(/[.!?]+$/, "").slice(0, 220);
-    if (value) return { kind: rule.kind, summary: `${rule.prefix}${value}` };
-  }
-  return null;
-}
-
-async function captureAttentionLifecycle(input, event, root, scope, catalog) {
-  if (!ATTENTION_WRITE_EVENTS.has(event)) return null;
-  const explicit = input.agent_spine_attention && typeof input.agent_spine_attention === "object"
-    && !Array.isArray(input.agent_spine_attention) ? input.agent_spine_attention : null;
-  let proposed = explicit;
-  let automaticHeartbeat = false;
-  if (!proposed && event === "UserPromptSubmit" && scope.config.enabled) {
-    proposed = minimalAttentionSignal(promptFromInput(input));
-    if (proposed && scope.groupId) return { event: null, duplicate: false, reason: "rejected:group conversation events are never learned automatically" };
-  }
-  if (!proposed && event === "PostToolUse" && scope.currentTaskId) {
-    proposed = { kind: "heartbeat", summary: "Work heartbeat recorded.", status: "active" };
-    automaticHeartbeat = true;
-  }
-  if (!proposed && ["Stop", "SubagentStop"].includes(event) && scope.currentTaskId) {
-    proposed = { kind: "heartbeat", summary: "Work heartbeat recorded.", status: "stopped" };
-  }
-  if (!proposed) return null;
-  if (event === "PostToolUse" && ![input.event_id, input.hook_event_id, input.tool_use_id].some((value) => typeof value === "string" && ID_RE.test(value))) {
-    throw new Error("PostToolUse attention requires a stable host delivery ID");
-  }
-  if (!scope.entityId || !scope.projectId || !scope.currentTaskId) {
-    if (explicit) throw new Error("lifecycle attention event is missing exact actor, project, or task scope");
-    return { event: null, duplicate: false, reason: "missing-exact-scope" };
-  }
-  const privacy = proposed.privacy || "private";
-  if (event === "UserPromptSubmit" && privacy === "group") {
-    return { event: null, duplicate: false, reason: "rejected:group conversation events are never learned automatically" };
-  }
-  const discriminator = proposed.id || `${proposed.kind}:${proposed.status || ""}:${proposed.summary}`;
-  return recordAttentionEvent({
-    root,
-    id: boundedId(proposed.id, "attentionEventId"),
-    kind: proposed.kind,
-    summary: proposed.summary,
-    status: proposed.status || null,
-    entityId: scope.entityId,
-    groupId: privacy === "group" ? scope.groupId : null,
-    projectId: scope.projectId,
-    taskId: scope.currentTaskId,
-    privacy,
-    dueAt: proposed.due_at ?? proposed.dueAt ?? null,
-    receiptId: automaticHeartbeat ? heartbeatReceipt(input, scope) : eventReceipt(input, event, scope, discriminator),
-    host: scope.host,
-    hookEvent: event,
-    observedAt: input.timestamp || new Date(), catalog
-  });
-}
-
-export function blunRuntimeContext(context) {
-  const detailed = JSON.parse(context);
-  const sourceResolution = detailed.sourceResolution ? {
-    status: detailed.sourceResolution.status || null,
-    reason: detailed.sourceResolution.reason || null
-  } : null;
-  const runtime = {
-    schema: "agentspine.blun-runtime-context/v1",
-    event: detailed.event,
-    loaded: Boolean(detailed.loaded),
-    failedClosed: detailed.failedClosed ? true : undefined,
-    indexedSources: detailed.indexedSources || 0,
-    sourceResolution,
-    instruction: detailed.loaded
-      ? "Detailed AgentSpine context is available on demand through session_briefing. Load it only when the current request needs continuity."
-      : detailed.instruction,
-    authority: "context-only"
-  };
-  if (detailed.signal && (detailed.signal.captured || detailed.signal.accepted || detailed.signal.reason)) {
-    runtime.signal = detailed.signal;
-  }
-  if (detailed.attentionEvent
-    && (detailed.attentionEvent.captured || detailed.attentionEvent.duplicate || detailed.attentionEvent.reason)) {
-    runtime.attentionEvent = detailed.attentionEvent;
-  }
-  if (detailed.selfstarter && (detailed.selfstarter.active || detailed.selfstarter.blocked)) {
-    runtime.selfstarter = detailed.selfstarter;
-  }
-  if (detailed.channelEvent?.active) runtime.channelEvent = detailed.channelEvent;
-  return JSON.stringify(runtime);
-}
-
-export function blunRuntimeMessage(context) {
-  const runtime = JSON.parse(blunRuntimeContext(context));
-  const base = runtime.loaded
-    ? `AgentSpine ready: ${runtime.indexedSources} sources indexed. Load detailed continuity only on demand through session_briefing.`
-    : `AgentSpine unavailable${runtime.sourceResolution?.reason ? `: ${runtime.sourceResolution.reason}` : ""}. ${runtime.instruction}`;
-  const active = {};
-  if (runtime.signal && (runtime.signal.captured || runtime.signal.accepted
-    || String(runtime.signal.reason || "").startsWith("rejected:"))) {
-    active.signal = runtime.signal;
-  }
-  if (runtime.attentionEvent && (runtime.attentionEvent.captured || runtime.attentionEvent.duplicate
-    || String(runtime.attentionEvent.reason || "").startsWith("rejected:"))) {
-    active.attentionEvent = runtime.attentionEvent;
-  }
-  if (runtime.selfstarter) active.selfstarter = runtime.selfstarter;
-  if (runtime.channelEvent) active.channelEvent = runtime.channelEvent;
-  return Object.keys(active).length === 0
-    ? base
-    : `${base}\nActive AgentSpine runtime data: ${JSON.stringify(active)}`;
-}
-
-function hookOutput(event, context) {
-  if (process.env.BLUN_PLUGIN_ROOT) {
-    return { hookSpecificOutput: { hookEventName: event, message: blunRuntimeMessage(context) } };
-  }
-  return { hookSpecificOutput: { hookEventName: event, additionalContext: context } };
-}
-
-function candidatePaths(value, output = []) {
-  if (!value) return output;
-  if (typeof value === "string") {
-    for (const match of value.matchAll(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm)) output.push(match[1].trim());
-    return output;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) candidatePaths(item, output);
-    return output;
-  }
-  for (const [key, item] of Object.entries(value)) {
-    if (["path", "file_path", "target_file", "filename"].includes(key) && typeof item === "string") output.push(item);
-    else candidatePaths(item, output);
-  }
-  return output;
-}
-
-function isMutationTool(name = "") {
-  return /(^|__)(apply_patch|edit|write|delete|move|rename|bash|exec_command|shell)(_|$)/i.test(name);
-}
-
-function isScanFailOpenTool(name = "") {
-  return /(^|__)(apply_patch|edit|write|bash|exec_command)(_|$)/i.test(name);
-}
-
-function filesystemScanError(error) {
-  return Boolean(error && (error.code === "AGENTSPINE_SCAN_INCOMPLETE" || error.agentSpineScan === true));
-}
-
-export function hookScanFailureFailsOpen(eventOrError, _toolName, suppliedError) {
-  const error = suppliedError ?? eventOrError;
-  return filesystemScanError(error) || (["EPERM", "EACCES"].includes(error?.code)
-    && ["opendir", "readdir", "scandir"].includes(error?.syscall));
-}
-
-async function auditSkippedScans(input, phase, skipped = []) {
-  const item = skipped[0];
-  if (!item) return;
-  await recordHookScanAudit({
-    event: "PreToolUse", toolName: input.tool_name || null, phase,
-    error: { code: item.code, message: `${item.code}: ${item.operation} skipped ${item.path}` },
-    path: item.path, operation: item.operation, now: input.timestamp || new Date()
-  });
-}
-
-async function allowScanFailure(input, phase, error) {
-  const event = input.hook_event_name || input.event_name || "unknown";
-  await recordHookScanAudit({
-    event, toolName: input.tool_name || null, phase, error,
-    path: error?.path || input.cwd || process.cwd(), now: input.timestamp || new Date()
-  });
-  return { blocked: false, scanFailedOpen: true, event, phase, error: error.message };
-}
-
-async function finishScanFailure(input, payload, phase, error) {
-  const allowed = await allowScanFailure(input, phase, error);
-  if (payload) return allowed;
-  process.stdout.write("{}\n");
-  return undefined;
-}
-
-function stringValues(value, output = []) {
-  if (typeof value === "string") output.push(value);
-  else if (Array.isArray(value)) value.forEach((item) => stringValues(item, output));
-  else if (value && typeof value === "object") Object.values(value).forEach((item) => stringValues(item, output));
-  return output;
-}
-
-function shellTargetsProtected(input, documents, cwd, root) {
-  if (!/(bash|exec_command|shell)/i.test(input.tool_name || "")) return null;
-  const command = stringValues(input.tool_input || input.tool_args).join("\n").replaceAll("\\", "/");
-  if (!/(?:^|[;&|\s])(?:rm|mv|cp|truncate|tee|sed\s+-i|perl\s+-i)\b|(?:^|[^>])>{1,2}(?!>)/i.test(command)) return null;
-  for (const document of documents) {
-    const forms = new Set([document.path.replaceAll("\\", "/"), document.relativePath]);
-    for (const base of [cwd, root]) {
-      const candidate = relative(base, document.path);
-      if (candidate && !candidate.startsWith("..") && !isAbsolute(candidate)) forms.add(candidate.replaceAll("\\", "/"));
-    }
-    if ([...forms].some((form) => form && command.includes(form))) return document;
-  }
-  return null;
-}
-
-function deny(reason) {
-  process.stdout.write(`${JSON.stringify({
-    decision: "block",
-    reason,
-    hookSpecificOutput: {
-      hookEventName: "PreToolUse",
-      permissionDecision: "deny",
-      permissionDecisionReason: reason
-    }
-  })}\n`);
-}
-
-function blockPrompt(reason) {
-  process.stdout.write(`${JSON.stringify({
-    decision: "block",
-    reason,
-    hookSpecificOutput: { hookEventName: "UserPromptSubmit", decision: "block", reason }
-  })}\n`);
-}
-
-async function runHookCore(input, payload) {
+async function runHookCore(input, payload, options) {
   if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("hook input must be one JSON object");
   const event = input.hook_event_name || input.event_name || "";
   if (!KNOWN_EVENTS.has(event)) throw new Error(`unsupported hook event: ${event || "missing"}`);
@@ -595,7 +79,7 @@ async function runHookCore(input, payload) {
     const reason = `AgentSpine source resolution failed closed: ${error.message}`;
     if (event === "PreToolUse" && isMutationTool(input.tool_name)) {
       if (payload) return { blocked: true, failedClosed: true, reason };
-      deny(reason);
+      denyTool(reason);
       return;
     }
     if (event === "UserPromptSubmit") {
@@ -616,16 +100,18 @@ async function runHookCore(input, payload) {
   }
   const root = resolvedSources.projectRoot;
   const catalog = resolvedSources.catalog;
-  const catalogPath = await saveCatalog(catalog);
+  const catalogPath = await saveCatalog(catalog), sourceWarning = resolvedSources.diagnostics.warning || null;
   let scope = null;
   let selfstarter = null;
   let channelEvent = null;
   let learningDelivery = null;
-
+  let deliveryVerification = null;
+  let artifactGuard = null;
+  let premortem = null;
+  let lessonRecall = null;
   if (event === "PreToolUse" && isScanFailOpenTool(input.tool_name) && resolvedSources.diagnostics.skipped?.length) {
     await auditSkippedScans(input, "source-resolution", resolvedSources.diagnostics.skipped);
   }
-
   if (event === "PreToolUse" && isMutationTool(input.tool_name)) {
     const { graph } = await loadGraph(root, catalog);
     const inferredProtected = new Set(graph.annotations
@@ -659,11 +145,32 @@ async function runHookCore(input, payload) {
       const relativePath = shellHit?.relativePath || catalog.documents.find((doc) => resolve(doc.path) === hit)?.relativePath || hit;
       const reason = `AgentSpine protected source: ${relativePath}. Existing identity, rule, soul, and memory documents are read-only to agents.`;
       if (payload) return { blocked: true, reason };
-      deny(reason);
+      denyTool(reason);
       return;
     }
   }
-
+  if (event === "PreToolUse") {
+    try {
+      artifactGuard = await verifyBaselineBeforeWrite({ input, cwd });
+      if (["no-stand", "no-baseline", "invalid-stand", "ambiguous-baseline"].includes(artifactGuard.status)) {
+        await auditGuard(input, "baseline-guard", artifactGuard, true);
+      }
+      if (artifactGuard.blocked) {
+        if (payload) return { blocked: true, reason: artifactGuard.reason, artifactGuard };
+        denyTool(artifactGuard.reason);
+        return;
+      }
+    } catch (error) {
+      artifactGuard = { status: "scan-failed-open", blocked: false, path: error.path || cwd, reason: error.message };
+      await auditGuard(input, "baseline-guard", artifactGuard);
+    }
+    try { await captureJavaScriptBeforeWrite({ input, cwd, root }); }
+    catch (error) {
+      await auditGuard(input, "identifier-before-state", {
+        status: "scan-failed-open", blocked: false, path: error.path || cwd, reason: error.message
+      });
+    }
+  }
   if (event === "PreToolUse" && !selfstarterRootSkipped(resolvedSources.diagnostics)) {
     try {
       scope ||= await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
@@ -680,11 +187,101 @@ async function runHookCore(input, payload) {
       }
       const reason = `AgentSpine self-starter denied this effect: ${error.message}`;
       if (payload) return { blocked: true, reason, selfstarter: { allowed: false, reason: error.message } };
-      deny(reason);
+      denyTool(reason);
       return;
     }
   }
+  if (event === "PreToolUse" && isPremortemWrite(input)) {
+    scope ||= await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
+    premortem = await verifyHookPremortemWrite({ input, root, scope });
+    if (premortem.blocked) {
+      if (premortem.status === "invalid-session") {
+        if (payload) return { blocked: true, reason: premortem.reason, premortem };
+        return denyTool(premortem.reason);
+      }
+      deliveryVerification = await recordDeliveryWriteIntent({
+        root, host: scope.host, sessionId: deliveryActorSession(input), scope, input
+      });
+      return processAdvisory(input, payload, root, scope, { premortem, deliveryVerification });
+    }
+  }
+  if (event === "PreToolUse") {
+    scope ||= await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
+    deliveryVerification = await recordDeliveryWriteIntent({
+      root, host: scope.host, sessionId: deliveryActorSession(input), scope, input
+    });
+    if (deliveryVerification.blocked) {
+      return processAdvisory(input, payload, root, scope, { deliveryVerification });
+    }
+    if (typeof options.afterDeliveryWriteIntent === "function") await options.afterDeliveryWriteIntent();
+    const premortemIntent = await recordHookPremortemWriteIntent({ input, root, scope });
+    if (premortemIntent.blocked) {
+      return processAdvisory(input, payload, root, scope, { deliveryVerification, premortem: premortemIntent });
+    }
+    premortem = { ...premortem, writeIntent: premortemIntent.status,
+      writeDigest: premortemIntent.writeDigest || null };
+    try { lessonRecall = actionLessonRecall({ catalog, event, input, scope }); }
+    catch (error) { lessonRecall = { status: "degraded", items: [], reason: error.message, authority: "context-only" }; }
+  }
+  if (["PostToolUse", "Stop", "SubagentStop"].includes(event)) {
+    scope ||= await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
+    if (event === "PostToolUse") {
+      premortem = await recordHookPremortemWrite({
+        input, root, scope, success: toolSucceeded(input)
+      });
+      deliveryVerification = await recordDeliveryToolUse({
+        root, host: scope.host, sessionId: deliveryActorSession(input), scope,
+        input, success: deliverySuccessEvidence(input)
+      });
+      if (toolSucceeded(input)) {
+        try {
+          artifactGuard = await inspectWrittenJavaScript({ input, cwd, root });
+        } catch (error) {
+          artifactGuard = { status: "scan-failed-open", blocked: false, path: error.path || cwd, reason: error.message };
+          await auditGuard(input, "identifier-guard", artifactGuard);
+        }
+      }
+    } else {
+      const activeJob = selfstarterRootSkipped(resolvedSources.diagnostics)
+        ? null : await selfstarterScope(input, scope, root, "resume");
+      const pauseRequested = Boolean(activeJob && selfstarterInput(input)?.status !== "completed");
+      let contracts = await verifyHookStopContracts({
+        input,
+        root,
+        scope,
+        recordPause: pauseRequested
+      });
+      ({ deliveryVerification, premortem } = contracts);
+      if (contracts.blocked) {
+        return processAdvisory(input, payload, root, scope, { deliveryVerification, premortem });
+      }
 
+      try {
+        artifactGuard = await verifyDeliveredArtifacts({ input, cwd });
+        if (artifactGuard.blocked) {
+          return processAdvisory(input, payload, root, scope, { deliveryVerification, artifactGuard });
+        }
+      } catch (error) {
+        artifactGuard = { status: "scan-failed-open", blocked: false, path: error.path || cwd, reason: error.message };
+        await auditGuard(input, "delivery-artifact-guard", artifactGuard);
+      }
+      if (typeof options.afterArtifactVerification === "function") await options.afterArtifactVerification();
+      contracts = await verifyHookStopContracts({
+        input,
+        root,
+        scope,
+        recordPause: pauseRequested,
+        completionFence: !pauseRequested,
+        afterDeliveryVerification: options.afterFinalDeliveryVerification,
+        afterPremortemVerification: options.afterFinalPremortemVerification
+      });
+      ({ deliveryVerification, premortem } = contracts);
+      if (contracts.blocked) {
+        return processAdvisory(input, payload, root, scope,
+          { deliveryVerification, premortem, artifactGuard });
+      }
+    }
+  }
   let attentionEvent = null;
   if (ATTENTION_WRITE_EVENTS.has(event) && !CONTEXT_EVENTS.has(event)) {
     scope = await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
@@ -733,6 +330,11 @@ async function runHookCore(input, payload) {
     try {
       await syncPersonaRosterFromEnvironment({ root, env: process.env, now: input.timestamp || new Date(), catalog });
       scope ||= await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
+      if (event !== "UserPromptSubmit") {
+        try { resolvedSources.diagnostics.timeline = await captureSessionTimelineLifecycle({ root, event, input, scope,
+          hostHome: resolvedSources.hostHome, catalog }); }
+        catch (error) { resolvedSources.diagnostics.timeline = { status: "degraded", reason: error.message, authority: "context-only" }; }
+      }
       channelEvent = await startChannelEvent(input, event, root, scope, catalog);
       selfstarter = await startSelfstarter(input, event, root, scope, resolvedSources.diagnostics);
       if (selfstarter?.job && !scope.currentTaskId) scope.currentTaskId = selfstarter.job.taskId;
@@ -746,6 +348,7 @@ async function runHookCore(input, payload) {
           receipt: preflight.receipt, input, scope, resolvedSources, prompt,
           now: input.timestamp || new Date(), env: process.env
         })) throw new Error("newly created preflight receipt failed exact turn verification");
+        preflight.premortem = await prepareHookPremortem({ input, root, scope });
         preflight.pendingMustRemember = await captureMustRememberPrompt({ prompt, receipt: preflight.receipt, env: process.env });
         try {
           attentionEvent = await captureAttentionLifecycle(input, event, root, scope, catalog);
@@ -776,14 +379,20 @@ async function runHookCore(input, payload) {
         catalog, userStateRoot: resolvedSources.userStateRoot, sourceDiagnostics: resolvedSources.diagnostics,
         prompt: event === "UserPromptSubmit" ? promptFromInput(input) : null
       });
-      let context = renderContext(event, catalog, briefing, signal, attentionEvent, selfstarter, channelEvent, resolvedSources.diagnostics, preflight);
+      if (event === "PostCompact") {
+        try { lessonRecall = actionLessonRecall({ catalog, event, input, scope }); }
+        catch (error) { lessonRecall = { status: "degraded", items: [], reason: error.message, authority: "context-only" }; }
+      }
+      let context = renderContext(event, catalog, briefing, signal, attentionEvent, selfstarter, channelEvent, resolvedSources.diagnostics, preflight, lessonRecall);
       if (event === "UserPromptSubmit" && Buffer.byteLength(context) > hostContextLimit(preflight)) {
         throw new Error("mandatory preflight context exceeds the host hook injection limit");
       }
-      if (event === "UserPromptSubmit" && !await verifyPreflightReceipt({
-        receipt: preflight.receipt, input, scope, resolvedSources, prompt: promptFromInput(input),
-        now: input.timestamp || new Date(), env: process.env, consume: true
-      })) throw new Error("preflight receipt could not be consumed atomically for this exact turn");
+      if (event === "UserPromptSubmit") {
+        const { preflightConsumed, timeline } = await finalizeUserPromptSessionTimeline({ root, input, scope, resolvedSources, preflight,
+          prompt: promptFromInput(input), now: input.timestamp || new Date() });
+        if (!preflightConsumed) throw new Error("preflight receipt could not be consumed atomically for this exact turn");
+        resolvedSources.diagnostics.timeline = timeline;
+      }
       if (event === "UserPromptSubmit") {
         const activeCanaries = briefing.learning.filter((item) => ["active", "revalidating"].includes(item.outcomeStatus));
         if (!activeCanaries.length) {
@@ -815,15 +424,15 @@ async function runHookCore(input, payload) {
           };
         }
         const enriched = renderContext(event, catalog, briefing, signal, attentionEvent, selfstarter, channelEvent,
-          resolvedSources.diagnostics, preflight);
+          resolvedSources.diagnostics, preflight, lessonRecall);
         if (Buffer.byteLength(enriched) <= hostContextLimit(preflight)) context = enriched;
         else if (preflight.learningApplications.status === "degraded") {
           preflight.learningApplications = null;
           context = renderContext(event, catalog, briefing, signal, attentionEvent, selfstarter, channelEvent,
-            resolvedSources.diagnostics, preflight);
+            resolvedSources.diagnostics, preflight, lessonRecall);
         }
       }
-      if (payload) return { blocked: false, context, briefing, preflight, signal, attentionEvent, channelEvent, catalogPath };
+      if (payload) return { blocked: false, context, briefing, preflight, signal, attentionEvent, channelEvent, lessonRecall, catalogPath };
       process.stdout.write(`${JSON.stringify(hookOutput(event, context))}\n`);
       return;
     } catch (error) {
@@ -851,17 +460,26 @@ async function runHookCore(input, payload) {
       return;
     }
   }
-
-  if (payload) return { blocked: false, attentionEvent, selfstarter, learningDelivery };
-  process.stdout.write("{}\n");
+  if (artifactGuard?.blocked) {
+    return processAdvisory(input, payload, root, scope, { artifactGuard,
+      attentionEvent, selfstarter, learningDelivery, deliveryVerification, premortem });
+  }
+  if (payload) return { blocked: false, sourceWarning, artifactGuard, attentionEvent, selfstarter,
+    learningDelivery, deliveryVerification, premortem, lessonRecall };
+  process.stdout.write(`${JSON.stringify(lifecycleOutput(event, artifactGuard, premortem, deliveryVerification, process.env, sourceWarning, lessonRecall))}\n`);
 }
 
 export async function runHook(payload = null, options = {}) {
   let input = payload;
   try {
-    input ||= await readStdin(options);
+    input ||= await readHookInput(options);
     if (input === SILENT_OVERSIZE_POST_TOOL_USE) return;
-    return await runHookCore(input, payload);
+    if (input.hook_event_name === "PreToolUse" && timelineToolKind(input.tool_name)) {
+      const result = await runTimelineToolGuard(input);
+      if (!payload) emitTimelineToolGuard(result);
+      return result;
+    }
+    return await runHookCore(input, payload, options);
   } catch (error) {
     if (!hookScanFailureFailsOpen(error) || input === SILENT_OVERSIZE_POST_TOOL_USE) throw error;
     return finishScanFailure(input, payload, "lifecycle", error);