blun-king-cli 9.1.587 → 9.1.588

package/agent-spine-plugin/blun.plugin.json

@@ -11,23 +11,58 @@
     "agent-spine": {
       "transport": "stdio",
       "command": "node",
-      "args": ["./src/mcp.js"]
+      "args": [
+        "./src/mcp.js"
+      ]
     }
   },
   "hooks": [
-    { "event": "SessionStart", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "UserPromptSubmit", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "PreToolUse", "matcher": "^(?:Edit|Write|apply_patch|Bash|PowerShell|exec_command|mcp__(?:agent-spine|plugin-agent-spine_agent-spine)__session_timeline_(?:index|search))$", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "PostToolUse", "command": "node \"./src/hook.js\" --silent-oversize-post-tool-use", "timeout": 15 },
-    { "event": "PreCompact", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "PostCompact", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "Stop", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "SubagentStop", "command": "node \"./src/hook.js\"", "timeout": 15 }
+    {
+      "event": "SessionStart",
+      "command": "node \"./src/hook.js\"",
+      "timeout": 15
+    },
+    {
+      "event": "UserPromptSubmit",
+      "command": "node \"./src/hook.js\"",
+      "timeout": 15
+    },
+    {
+      "event": "PreToolUse",
+      "matcher": "^(?:Edit|Write|apply_patch|Bash|PowerShell|exec_command|mcp__(?:agent-spine|plugin-agent-spine_agent-spine)__session_timeline_(?:index|search|capture))$",
+      "command": "node \"./src/hook.js\"",
+      "timeout": 15
+    },
+    {
+      "event": "PostToolUse",
+      "command": "node \"./src/hook.js\" --silent-oversize-post-tool-use",
+      "timeout": 15
+    },
+    {
+      "event": "PreCompact",
+      "command": "node \"./src/hook.js\"",
+      "timeout": 15
+    },
+    {
+      "event": "PostCompact",
+      "command": "node \"./src/hook.js\"",
+      "timeout": 15
+    },
+    {
+      "event": "Stop",
+      "command": "node \"./src/hook.js\"",
+      "timeout": 15
+    },
+    {
+      "event": "SubagentStop",
+      "command": "node \"./src/hook.js\"",
+      "timeout": 15
+    }
   ],
   "interface": {
     "displayName": "AgentSpine",
     "shortDescription": "Identity, memory, attention, and resumable context without rewriting source files.",
-    "developerName": "Mayk Biletti",
+    "developerName": "BLUN",
     "websiteURL": "https://github.com/Maykbiletti/AgentSpine"
   }
 }

package/agent-spine-plugin/docs/artifact-evaluation.md

@@ -0,0 +1,93 @@
+# Objective artifact evaluation
+
+The learning ledger already validates external measurement bindings. It does not
+execute the benchmark or prove that caller-supplied scores describe a real task.
+`learn-artifact-measure` adds a narrow local evaluator: it reads explicitly named
+project files, checks their SHA-256 digests or absence, computes the pass rate and
+blocking-defect count itself, and registers the result through the existing
+measurement API. It never executes commands, discovers files or calls a provider.
+
+## Precommit the experiment
+
+Prepare an `agentspine.artifact-checks/v1` specification with one to sixteen checks:
+
+```json
+{
+  "schema": "agentspine.artifact-checks/v1",
+  "checks": [
+    {"path": "artifacts/unwanted.txt", "sha256": null, "blocking": true}
+  ]
+}
+```
+
+`null` means the file must be absent. A SHA-256 means the regular file must have
+exactly that content. `blocking` is explicit for every check; any failed blocking
+check is counted separately and cannot be averaged away. File contents are never
+included in the report. Only paths, digests, byte counts and result flags appear.
+
+Run `agentspine learn-artifact-plan --checks '<JSON>' --json` before the experiment.
+The result supplies `datasetDigest`, `protocolDigest`, `minCases`, the fixed metric
+`artifact-check-pass-rate` / `higher`, and `principalDigest`. Use these with the
+existing locally confirmed evaluator and evaluation registration commands. The
+task digest still belongs to the externally declared task. The plan command does
+not register anything or supply authority.
+
+One implementation has one fixed principal digest across every name, project and
+specification. Two aliases of this evaluator cannot satisfy the existing distinct
+principal requirement. Another independently registered evaluator is still needed
+for a complete learning experiment; assigning a second name is insufficient.
+The principal is an implementation identifier, not a signature or proof of an
+independent organization.
+
+## Measure, then consume through the existing contract
+
+Use `learn-artifact-measure <measurement-id>` with `--root`, `--checks`, `--learning`,
+`--evaluation`, `--phase before|after`, `--evaluator`, the precommitted `--run`, exact
+`--persona`, `--user`, `--tenant`, `--project`, optional `--task` / `--group`,
+`--confirm-local-measurement` and `--json`. The root must be canonical. This is a
+local runtime/CLI operation, not an MCP tool or new host permission.
+
+The evaluator accepts neither a model score nor a model claim of having loaded or
+verified data. It validates the frozen specification, protocol, case count, metric,
+principal and exact scope before target reads. The ordinary measurement writer
+rechecks lifecycle, registry, expiry, immutable cohort, delivery and replay bindings
+at commit. After measurements require the existing prompt-bound application and
+Stop-bound delivery. Missing binding remains unverified, without creating an
+automatic retry or blocking normal host work.
+
+Each explicit file is limited to 2 MiB and checked using the existing parent/path
+and source-byte reader. The whole bounded cohort is read twice; observed drift,
+symlinks, path escapes, oversized files and read errors abort without registering a
+partial score. This is a bounded point-in-time observation, not a filesystem-wide
+transaction or proof that no change ever happened between reads. No source is
+written. The final measurement uses the existing atomic ledger and replay lineage;
+crash before registration leaves no successful measurement, crash afterward cannot
+permit a replacement run. Initial-trial deadlines remain unchanged.
+
+Capture the returned `report` with external experiment records: its JSON digest is
+the receipt's `measurement.sourceDigest`. The normal ledger stores the metric and
+digest, not a new transcript or artifact database. Repeated/concurrent measurements
+cannot replace the first committed trial. Revalidation and arbitrary evaluator
+programs remain on the existing external measurement path, not this adapter.
+
+The returned `completionVerified: false` and `automaticRetry: false` distinguish a
+file-state measurement from a verified delivery. Use existing `learn-outcome` to
+consume the receipt with its application/delivery bindings. Existing promotion,
+canary validation, supersession, revocation and rollback rules are unchanged.
+
+## Scope of the comparison
+
+The isolated archive task really creates a migrated artifact. Without the selected
+backup strategy, two of three predefined file checks pass. After bounded learned
+context is selected and the synthetic worker creates the backup, three of three
+pass. A separate byte-comparison fixture supplies the other synthetic evaluator;
+both outcomes are computed from files rather than fixed score constants. Fresh
+CLI-process measurement, real Claude/Codex prompt and Stop hooks, compaction,
+scope/criteria/principal rejection, concurrency, replay and a blocking-defect
+rollback are covered by `test/learning-artifact-evaluator.test.js`.
+
+This proves the local artifact-to-learning connection for a deterministic synthetic
+worker, not improved LLM reasoning, genuine provider execution, independent AGI
+evaluation or ExampleOperator/ExampleAgent live acceptance. Runtime and inspected bytes are reported;
+tokens and unnecessary questions are not measured by this evaluator. It creates no
+live installation, host configuration, production action or new authority.

package/agent-spine-plugin/docs/host-integration.md

@@ -4,19 +4,20 @@ AgentSpine uses native plugin surfaces instead of asking users to paste a large
 
 ## Provider contracts and evidence
 
-Provider names are not interchangeable. Shared retrieval, structured knowledge and task continuation remain context-only. Each adapter must separately establish native lifecycle events, instruction roots, transcript format/version, session/message identifiers and authenticated invocation binding. Unknown formats remain unavailable; adapters must not impersonate another host or infer access from remembered text.
+Provider evidence is not interchangeable. Each adapter separately binds its lifecycle, instruction root, transcript version, session/message IDs and invocation. Portal tasks also require the gateway-issued `AGENTSPINE_PORTAL_REF`/`AGENTSPINE_THREAD_REF` pair from `agentspine.gateway-start/v1`; hooks and MCP may match but never invent it. Direct sessions omit it. All recalled state is context-only, and repository checks do not prove a live launcher forwards it.
 
 | Surface | Claude Code | Codex | BLUN King |
 |---|---|---|---|
 | Project instructions | `CLAUDE.md` hierarchy | `AGENTS.md` hierarchy | `AGENTS.md` through the isolated BLUN profile |
 | Hook package | Native `hooks/hooks.json` | Explicit `hooks/codex.json` | Manifest lifecycle hooks |
-| Verified hook briefing → delivery knowledge | Shared signed preflight bridge | Shared signed preflight bridge; synthetic Codex regression | Shared bridge only if the actual host delivers the verified lifecycle; live acceptance remains open |
-| Historical transcript enrollment | Existing Claude adapter, bounded registered source | Explicit native Codex rollout snapshot; bounded `sessions` source, verified project/session header; synthetic A/B acceptance | Explicit King agent-wire snapshot; protected source/protocol mapping, verified session/header and synthetic A/B acceptance; live mapping remains open |
+| Verified hook briefing → delivery knowledge | Native `additionalContext` handoff receipt | Native `additionalContext` handoff receipt | Native bounded `message` handoff receipt; live acceptance open |
+| Historical transcript enrollment | Bounded registered Claude source | Bounded Codex `sessions` source with verified headers | Protected King agent-wire mapping; live mapping open |
+| Cross-provider evidence handoff | Explicit opt-in; Claude provenance retained | Explicit opt-in; Codex provenance retained | Same contract; live launcher unverified |
 | Native permissions/trust | Host-owned | Host-owned | Host-owned; enforcement of returned block decisions remains externally unverified |
 
-A successful `SessionStart` alone is not assignment-bound proof. On `UserPromptSubmit`, the exact signed source snapshot is verified and consumed once, then its briefing use is recorded for the current requirement. MCP knowledge and premortem reuse that recorded observation without refetching content. Serialized `loaded: true` claims cannot create the process-local verification capability. Missing or consumed usage evidence yields useful context with `verified: false`, `completionVerified: false` and `automaticRetry: false`; it does not certify delivery or trigger a mandatory fetch. An optional explicit MCP briefing read reports `satisfied-by-host` when the original verified hook observation already exists, preserving that first receipt.
+`UserPromptSubmit` consumes the exact signed snapshot once. Only after stdout accepts the native output does AgentSpine store `agentspine.host-context-handoff/v1`, bound to provider, field, byte count and digest. In-process returns, serialized claims and legacy `verified-host-preflight` receipts do not prove handoff. MCP knowledge may reuse a valid receipt; missing, stale or consumed evidence remains non-blocking and explicitly unverified. The receipt proves transport, not model use or delivery.
 
-Adapter acceptance must use synthetic sessions A/B, a bounded registered project root, exact source bytes and stable provenance, and cover restart, changed sources, foreign project/tenant/group, private-source exclusion and service failure. Report repository tests separately from the installed provider version and live-host observations. Never claim cross-provider history support from package validation, matching tool names or another provider's passing test.
+Adapter acceptance uses bounded synthetic A/B sessions and covers restart, source mutation, foreign scope, private exclusion and service failure. Cross-provider recall still needs local opt-in plus `includePriorProviders: true` with `includePriorSessions: true`. Report repository, installed-host and model observations separately.
 
 ## Claude Code
 
@@ -37,19 +38,9 @@ claude plugin install agent-spine@agent-spine
 
 Use `claude plugin validate .` in a checkout to validate the manifest and marketplace. Claude Code asks the user to approve executable plugin components according to its trust model.
 
-Version `0.73.0` keeps the `0.72.7` managed common Codex skill, stable launcher, loaded-reader verification, assignment continuation and structured completion contracts, and adds bounded post-compaction session-evidence recall. It leaves host transcripts in place, never injects their full content, and exposes only explicit, scope-bound redacted cards. A verified `UserPromptSubmit` creates an opaque receipt; a direct Claude session stays excluded until the local owner runs `timeline-receipt --root …` and `timeline-enroll --root … --receipt asthr_… --confirm-local-timeline`. Groups stay excluded. Writing deliveries can reuse the verified hook briefing for `delivery_knowledge_query` and `record_delivery_premortem` with the exact hook-issued requirement. These are advisory preparation; missing proof never blocks ordinary authorized work.
+Version `0.73.0` preserves the managed skill/launcher, task continuation, structured completion, and bounded post-compaction evidence recall. Direct transcript recall stays excluded until the owner creates and enrolls a verified timeline receipt. Groups stay excluded. Writing deliveries may reuse the exact hook-issued briefing requirement for advisory knowledge and premortem calls; missing proof does not block ordinary authorized work.
 
-Ordinary assignments may now call [`complete_delivery`](structured-completion.md) after observed tests to store the three completion checks and use a normal final summary. Stop still checks the latest write and current test evidence. Goal and queue deliveries retain their existing completion route. This repository operation does not itself register MCP in a native host or validate a live update.
-
-A contradictory retry is rejected and stored separately without changing the first valid registration. A legacy 0.72 conflict can be preserved and moved to a fresh requirement through either `recover_delivery_premortem` or `agentspine premortem-recover <predecessor-requirement> --root <project>`. The returned requirement must perform all three preflight calls again; recovery never deletes evidence or grants authority.
-
-Version `0.39.0` replaces the `0.38.0` plugin cache identity.
-
-Version `0.38.0` replaces the `0.37.0` plugin cache identity.
-
-Version `0.36.0` replaces the `0.35.0` plugin cache identity.
-
-The Claude manifest explicitly references `./.mcp.json`. The hook bundle remains at Claude Code's native auto-discovery path `hooks/hooks.json`; it is deliberately not registered a second time through the manifest. Codex selects its host-specific `hooks/codex.json` adapter through `.codex-plugin/plugin.json`. Version `0.35.0` replaces the `0.34.0` plugin cache identity. The hook definitions contain only portable documented fields; `hooks/version.json` carries the separately validated bundle release and preflight contract. The repository checks resolve installed-root variables, perform a real MCP `initialize` handshake, validate exactly one native hook command per event, and exercise staged clean install, previous-version cache rejection, upgrade, host-native source resolution, indexed and lazy Claude memory, automatic multilingual briefing, pre-answer recall, authenticated persona graph reconciliation, attention, exact job start, tool checkpoint, new-session resume, purge, and uninstall preservation:
+The Claude manifest references `.mcp.json` and uses only its native `hooks/hooks.json`; Codex selects `hooks/codex.json` from its own manifest. Repository checks validate portable manifests, installed-root expansion, one command per event, a real MCP handshake, clean install/upgrade, source isolation, briefing, continuation, compaction, and uninstall preservation:
 
 ```bash
 npm run host:check
@@ -73,7 +64,7 @@ Open `/mcp` in the new interactive session and approve or reconnect `agent-spine
 
 ## Codex
 
-History uses the native Codex adapter described in [session timeline](session-timeline.md#codex-native-rollout-contract). It does not use Claude enrollment or a Claude-shaped transcript. Installed-host acceptance remains separate from the repository fixtures.
+History uses the native Codex adapter described in [session timeline](session-timeline.md#integrity-and-provider-formats). It does not use Claude enrollment or a Claude-shaped transcript. Installed-host acceptance remains separate from the repository fixtures.
 
 | Component | Path | Purpose |
 |---|---|---|
@@ -82,7 +73,7 @@ History uses the native Codex adapter described in [session timeline](session-ti
 | MCP | Manifest `mcpServers` | Read-only source tools plus external overlay workflows |
 | Hooks | `hooks/codex.json` | Manifest-selected lifecycle guardrails |
 
-Open `/plugins` in Codex CLI after configuring a marketplace that contains AgentSpine, then start a new session. Review the installed hook source and trust state with `/hooks`; Codex also presents a startup warning when a new or changed hook definition needs trust. Codex records trust against the exact hook-definition hash, so an installed, updated, or previously untrusted bundle is skipped until that current definition is reviewed and trusted. This follows the official [Codex hooks trust and plugin discovery contract](https://developers.openai.com/codex/hooks).
+Open `/plugins` in Codex CLI, then start a new session and review `/hooks`. New or changed hook definitions are skipped until the user trusts their exact hash, following the official [Codex hook contract](https://developers.openai.com/codex/hooks).
 
 For a direct npm/package installation, register or update the common user skill and MCP reader together. The command writes only its sealed skill directory and a marked AgentSpine configuration block, refuses unmanaged conflicts, and requires a local confirmation flag:
 
@@ -90,7 +81,7 @@ For a direct npm/package installation, register or update the common user skill
 agentspine host-install codex --confirm-local-host-install --json
 ```
 
-Use `--codex-home /absolute/profile` and `--skills-root /absolute/user-skills` only for non-default or synthetic roots. The default skill destination is `$HOME/.agents/skills/agent-spine/SKILL.md`, one of Codex's documented [user skill discovery locations](https://developers.openai.com/codex/build-skills). AgentSpine refuses an existing unowned directory at that name, serializes parallel updates and recovers only recognizable sealed partial states. The stable launcher lives below the Codex profile and points through an atomically replaced, digest-sealed registration; `config.toml` does not need a versioned cache path. Start a new Codex process after a successful update. During MCP `initialize`, the launcher checks the canonical package root, exact package/runtime version and required tools before it forwards any state-bearing request. A failed check returns no tools and does not migrate or delete state. User-controlled executable and hook trust remain separate and mandatory. The configuration shape follows the official [Codex MCP configuration contract](https://developers.openai.com/codex/mcp).
+Non-default or synthetic roots may use `--codex-home` and `--skills-root`. The default skill path is `$HOME/.agents/skills/agent-spine/SKILL.md`, a documented [Codex skill location](https://developers.openai.com/codex/build-skills). AgentSpine refuses unowned conflicts and atomically updates sealed state. The launcher verifies package/runtime identity and tools during MCP initialization; failure returns no tools or migration. User trust remains separate. Configuration follows the official [Codex MCP contract](https://developers.openai.com/codex/mcp).
 
 Codex loads `hooks/codex.json` through the explicit plugin-manifest entry. It contains only Codex-documented lifecycle events; Claude Code's additional `InstructionsLoaded` event remains confined to `hooks/hooks.json`. Both files deliberately contain only the documented top-level `description` and `hooks` fields. Cache identity remains in `.codex-plugin/plugin.json`, while Codex records hook trust against the current definition hash. The Codex hook and MCP registrations use the host-native `PLUGIN_ROOT` expansion.
 
@@ -102,9 +93,7 @@ Verify the live host in a newly started Codex CLI session:
 Trust all and continue
 ```
 
-Acceptance requires four separate observations from that new host process: `skills/list` includes `agent-spine`, `mcpServerStatus/list` shows the configured server, MCP `tools/list` exposes the required tools, and a real hook briefing followed by assignment-bound knowledge and premortem succeeds without another briefing fetch. These are distinct Codex [app-server APIs](https://developers.openai.com/codex/app-server); an isolated server handshake or the presence of `SKILL.md` alone is not native host proof.
-
-`npm run host:check` proves manifest shape, package containment, and a real MCP handshake. `npm run host:install-check` stages an update, verifies the copied skill bytes, restarts the managed reader, lists tools, reads the existing synthetic session and performs the three bound calls. Neither command can manufacture Codex's user-controlled discovery, trust or process state; only those observations in the actual host prove the final boundary.
+Native Codex acceptance separately observes `skills/list`, `mcpServerStatus/list`, MCP `tools/list`, the hook handoff and subsequent bound knowledge/premortem. These are distinct [app-server APIs](https://developers.openai.com/codex/app-server); a handshake or `SKILL.md` alone is insufficient. Repository host checks validate manifests, package bytes and an isolated MCP/install lifecycle, but cannot prove user trust, live discovery or model application.
 
 ## BLUN King
 
@@ -115,7 +104,7 @@ Acceptance requires four separate observations from that new host process: `skil
 | MCP | Manifest `mcpServers` | Read-only source tools plus external overlay workflows |
 | Hooks | Manifest `hooks` | Automatic briefing, attention, protected-source guard, and checkpoints |
 
-Install the local checkout from Fredrik's TUI:
+Install the local checkout from ExampleAgent's TUI:
 
 ```text
 /plugins install C:\path\to\AgentSpine
@@ -123,11 +112,11 @@ Install the local checkout from Fredrik's TUI:
 
 BLUN asks the user to trust a third-party plugin before installation because its MCP server and hooks execute local code. Accept that visible install decision, then use `/reload` or `/new`; BLUN has no separate `/hooks` command. The BLUN adapter maps its isolated `BLUN_HOME` to AgentSpine's Codex-compatible `AGENTS.md` source hierarchy, so user state remains under the BLUN app home instead of leaking into `.codex` or a scanned project.
 
-BLUN Code 1.0.109 uses `mcp__agent-spine__session_timeline_{index,search}`; King CLI also uses `mcp__plugin-agent-spine_agent-spine__session_timeline_{index,search}`. Both exact forms reach the invocation guard; lookalikes do not. Naming was checked on 2026-09-05 against public `Maykbiletti/blun-code` commit `fbb97459a3fa2157f8bfea3d24931be63288ab11` (`mcp-harness-tools.js`, MIT). This external naming evidence is untrusted context; no code was copied. Repository tests do not prove actual hook delivery or host block enforcement; live acceptance remains separate.
+BLUN Code 1.0.109 constructs MCP tool names as `mcp__<server-name>__<tool-name>`. With AgentSpine's exact manifest server name, its timeline calls are therefore `mcp__agent-spine__session_timeline_index`, `mcp__agent-spine__session_timeline_search`, and `mcp__agent-spine__session_timeline_capture`; the BLUN hook matcher admits only those three exact names. This contract was checked on 2026-09-05 against public `Maykbiletti/blun-code` commit `fbb97459a3fa2157f8bfea3d24931be63288ab11` (`mcp-harness-tools.js`, package license `MIT`). The external source is naming evidence only and is treated as untrusted context; no implementation was copied. Repository checks do not prove that an installed King forwards the hook payload or enforces AgentSpine's returned block decision, and they do not replace a live host acceptance test.
 
-History has an independent [King agent-wire adapter](session-timeline.md#king-native-agent-wire-contract). The local launcher must bind the current source and measured wire version through `AGENTSPINE_KING_TIMELINE_SOURCE` and `AGENTSPINE_KING_WIRE_PROTOCOL_VERSION`; AgentSpine neither searches `BLUN_HOME` nor infers either value. Project instructions still resolve through the Codex-compatible hierarchy, while history is enrolled as provider `king` and reads only the explicitly mapped `agents/main/wire.jsonl`. Correct MCP names, a passing Codex adapter, or a model-supplied path do not satisfy this contract.
+History has an independent [King agent-wire adapter](session-timeline.md#integrity-and-provider-formats). The local launcher must bind the current source and measured wire version through `AGENTSPINE_KING_TIMELINE_SOURCE` and `AGENTSPINE_KING_WIRE_PROTOCOL_VERSION`; AgentSpine neither searches `BLUN_HOME` nor infers either value. Project instructions still resolve through the Codex-compatible hierarchy, while history is enrolled as provider `king` and reads only the explicitly mapped `agents/main/wire.jsonl`. Correct MCP names, a passing Codex adapter, or a model-supplied path do not satisfy this contract.
 
-Repository fixtures verify the reviewed BLUN Code `1.0.109` / King SDK `0.12.1` record shape, objective `tool.result` recall across session restart and compaction, source-byte preservation, and denial for wrong protocol, foreign scope, replay, mutation, and unknown records. Fredrik's actual launcher mapping, installed wire version, live A/B recall, and King's enforcement of returned block decisions are still unverified and must be reported separately. No installation or trust configuration is changed by the repository tests.
+Repository fixtures verify the reviewed BLUN Code `1.0.109` / King SDK `0.12.1` record shape, objective `tool.result` recall across session restart and compaction, source-byte preservation, and denial for wrong protocol, foreign scope, replay, mutation, and unknown records. ExampleAgent's actual launcher mapping, installed wire version, live A/B recall, and King's enforcement of returned block decisions are still unverified and must be reported separately. No installation or trust configuration is changed by the repository tests.
 
 ## Direct MCP use
 
@@ -176,3 +165,29 @@ The package also registers exactly one `agentspine-worker` entrypoint. It is sep
 The host runner is responsible for starting the selected host with the supplied scope and `agent_spine_channel_event` fields. Codex skips an untrusted hook definition until the user accepts its current hash in the startup warning or `/hooks`; the worker cannot bypass or manufacture that trust. Setup and the stdin/stdout contract are documented in [durable gateway worker](gateway-runtime.md).
 
 The visible acceptance runner invokes the same production lifecycle adapter with new synthetic people, separated groups, Swedish and Spanish prompts, restarts, compaction, correction, rollback, purge, current-rights checks, and durable checkpoints. It prints one reproducible receipt per gate and proves `mcpCalls: 0`. See [visible cross-host acceptance](acceptance.md).
+# Group participation in the gateway worker
+
+`agentspine.run-request/v1` carries an internal `groupResponseContract`. Without
+a direct request, remain silent except for a relevant idea, concrete error, or
+useful improvement. Never emit status, echo bots, change identity/language, or
+present suggestions as measured facts. Silence is:
+
+```json
+{"groupResponse":{"schema":"agentspine.group-response/v1","kind":"silence"}}
+```
+
+`answer` needs text and no subject; other contribution kinds need text plus a
+stable subject. `silence` forbids text/skip markers. Unknown shapes fail.
+Identity, capability, privacy, and output gates still apply; no rights arise.
+
+Silence/duplicates consume the lease without an outbox; delivery/completion stay
+false. Receipts record disposition and recover crashes. Deduplication binds
+normalized text/subject to the full route except event ID; outbox recovery
+handles uncertainty. It is not semantic.
+
+Legacy text-only results remain compatible. Ingress cannot authenticate direct
+address (`directAddressVerified:false`), so the host must adopt and enforce this
+contract. Installation proves no live behavior. Group silence is not private;
+no broad filter/live change is included. Synthetic tests cover response kinds,
+replay, crash, mutation, source bytes, limits, and deadlines; model relevance,
+questions, tokens, and Telegram remain unverified.

package/agent-spine-plugin/docs/preflight-recall.md

@@ -10,6 +10,8 @@ Claude Code uses its resolved user and project `CLAUDE.md` hierarchy. Codex uses
 
 Claude Code's `InstructionsLoaded` lifecycle event is registered as an additional observability signal, while `UserPromptSubmit` remains the blocking and injection boundary. Codex uses its own manifest-selected hook set without that unsupported Claude-only event. The preflight does not rely on the model remembering to read a file or call a tool.
 
+Codex `UserPromptSubmit` binds the receipt to the native string `turn_id`; if an exact event ID is also present, both IDs are digest-bound. Claude's supported `UserPromptSubmit` input has no turn ID, so the adapter issues a process-local invocation capability that only the parsed hook-input object can consume. This lets two legitimate identical prompts run separately while a copied object cannot reconstruct the receipt binding. Numeric or otherwise unsupported turn identifiers are rejected rather than treated as King/BLUN lifecycle evidence.
+
 ## Required retrieval providers
 
 Retrieval policy is a separate local policy file outside every project. Configure it only through the local CLI:
@@ -41,7 +43,7 @@ Example local policy profile:
       "timeoutMs": 5000,
       "command": "/absolute/path/to/mnemo-adapter",
       "args": [],
-      "credentialEnv": ["MNEMO_TOKEN"]
+      "credentialEnv": ["EXAMPLE_PROVIDER_TOKEN"]
     }
   ]
 }
@@ -66,4 +68,4 @@ Confirmed entries are scoped, checksummed, append-only and versioned. A new vers
 
 Claude Code documents that a command hook killed by the host timeout is fail-open, even though an explicit exit code 2 blocks. Therefore an absolute guarantee against process termination requires the host or TUI to invoke the same preflight contract as a wrapper-hard gate immediately before its model API call. AgentSpine does not mislabel a merely installed command hook as proof against host-enforced timeout. A release is only live-proven after the target host shows fresh consumed receipts across consecutive turns, restart, and compaction.
 
-Host hierarchy and lifecycle behavior were checked on 2026-08-30 against the official [Claude Code hook reference](https://code.claude.com/docs/en/hooks) and [Codex AGENTS.md reference](https://developers.openai.com/codex/agent-configuration/agents-md).
+Host hierarchy and lifecycle behavior were checked on 2026-09-09 against the official [Claude Code hook reference](https://code.claude.com/docs/en/hooks) and [Codex hook reference](https://learn.chatgpt.com/docs/hooks).