blun-king-cli 9.1.587 → 9.1.588

package/agent-spine-plugin/docs/session-timeline.md

@@ -1,251 +1,112 @@
 # Bounded session timeline and evidence recall
 
-Long-lived hosts already persist a session transcript. AgentSpine leaves that
-host-owned file in place: it never copies, archives, rewrites, places it in
-`MEMORY.md`, or injects it into a briefing. The timeline sidecar stores only a
-small, restart-safe index of redacted objective evidence, not a second
-transcript.
+AgentSpine indexes immutable host transcripts without copying them. Signed
+sidecars contain bounded redacted evidence and opaque references, never text.
+Recall is private, task-scoped, context-only, and grants no authority.
 
-## Enrollment contract
+## Enrollment and retrieval
 
-The Claude, Codex, and King adapters are deny-by-default. A regular `UserPromptSubmit` hook first
-creates a short-lived opaque receipt only after its exact host preflight has
-been verified. The receipt binds one regular, non-symlinked transcript below a
-verified host `projects` (Claude) or `sessions` (Codex and King) root to the exact host, session, entity, user, tenant,
-project, task, and optional goal step. It is not exposed in hook context or to
-the model.
-
-The local owner may then activate that one snapshot explicitly:
+Claude, Codex, and King use separate deny-by-default adapters. Verified
+`UserPromptSubmit` issues a short-lived one-use receipt bound to source,
+provider, session, user, tenant, project, task, optional goal, and derived
+portal/thread route. Model values, partial routes, groups, and unknown visibility
+cannot enroll.
 
 ```text
 agentspine timeline-receipt --root /path/to/project
 agentspine timeline-enroll --root /path/to/project --receipt asthr_… --confirm-local-timeline
 ```
 
-The receipt is one-use, expires quickly, and needs the same protected local
-host transport that created it. Normal CLI flags cannot substitute a path,
-host, session, or scope. Enrollment initializes only sidecar metadata from the
-signed record and may revalidate fixed source metadata plus a ≤4 KiB prefix; it
-never scans or indexes historic transcript content. It is context-only and
-creates no identity, permission, delegation, tool access, approval, or policy
-exception.
-
-Every capture and retrieval checks the exact binding again. The profile and
-provider-specific transcript root must be real non-symlinked directories; the source must be a
-single-link regular non-symlinked file below that root. `groupId` must be
-exactly `null`; groups and unknown visibility are excluded from enrollment,
-capture, and recall. Another provider needs its own equivalent verified host
-evidence and does not inherit Claude enrollment by name, transcript text, or
-path convention.
-
-If the enrolled transcript changes or grows, the old snapshot is unavailable.
-There is deliberately no append or full-history fallback. A fresh host receipt
-and a new local confirmation renew the immutable snapshot. If a torn local
-enrollment state cannot be repaired, a local owner can discard only that
-sidecar state:
-
-```text
-agentspine timeline-enrollment-recover --root /path/to/project --confirm-local-timeline-recovery
-```
-
-Recovery retains no old source, receipt, or evidence and requires a fresh host
-receipt before another enrollment.
-
-## Bounded retrieval
-
-Hooks do not scan, backfill, or search historic transcripts. They can expose a
-small freshness/status hint and a continuation capsule only. A matching
-`PreToolUse` guard may revalidate source metadata and a fixed ≤4 KiB prefix to
-reject a changed snapshot; it never extracts history. The only historic reader
-is a bound, on-demand MCP call:
+Enrollment reads fixed metadata and at most 4 KiB. Each operation revalidates
+source, root, provider, and scope; changed bytes invalidate the snapshot. No
+append, broad scan, refresh, retry, or fallback exists. One-use `PreToolUse`
+permits expose:
 
 ```text
 session_timeline_index(maxBytes)
-session_timeline_search(at | terms)
-session_timeline_search(at | terms, includePriorSessions: true)
+session_timeline_search(at | terms, includePriorSessions, includePriorProviders)
+session_timeline_capture(eventId, at | terms, includePriorSessions, interpretation)
 ```
 
-Indexing is serialized and bounded to 64 KiB–16 MiB per call. A search needs
-either one exact UTC instant such as `2026-09-04T12:40:00.000Z`, or at least two
-concrete terms such as `Suite PASS`. An instant is exact unless the caller
-explicitly requests a valid window. There is no broad-text fallback and no
-whole-transcript MCP tool. Timestamp seeking reads only bounded byte probes and
-a selected bounded range; term search uses only already indexed cards.
-
-After a restart, the lifecycle hint may report only the number of already
-indexed prior sessions and objective events for the exact same private task.
-It does not contain transcript text. When a concrete question is relevant,
-`includePriorSessions: true` restricts candidate sources to the same host,
-entity, user, tenant, project, task and compatible goal. It ranks their signed
-sidecar cards before opening a source, selects at most one prior immutable
-snapshot, and verifies only matching original lines. A missing match does not
-fall back to scanning old transcripts.
-
-A matching host guard replaces all MCP-provided binding fields with its exact
-one-use invocation. Raw stdio, a reused invocation, a changed argument,
-foreign host/session/scope, a group claim, an expired receipt, a changed source,
-or an unsafe sidecar returns no cards. Plain stdio is not a cross-process
-identity channel: the feature remains unavailable without the protected local
-host transport capability. None of these records is a permission or approval.
-
-At most eight cards return. Each carries a timestamp, bounded redacted excerpt,
-stable opaque session and message references, source digest, deterministic room ID, and the
-`untrusted-session-history` trust marker. No public event digest or raw
-transcript byte is returned. Secret-shaped values and instruction-like archive
-text are redacted or discarded before state is written or a card is returned.
-Historic text remains untrusted context: it can support a check or a question,
-never an identity, permission, tool, delegation, access, payment, credential,
-policy exception, or external effect.
-
-## Memory-palace structure
-
-A room ID is deterministic for the enrolled source digest and a fixed one MiB
-byte-offset segment. A
-`agentspine.session-continuation-capsule/v1` contains only current task, goal,
-step, selected-lesson digest, outcome status, and room IDs. It contains no
-transcript text and does not make a room visible by itself.
-
-The authenticated sidecar holds source metadata, bounded redacted cards, and a
-state signature. A separate signed head detects state-only and mixed sidecar
-rollback while the protected integrity anchor remains intact. An exact
-one-generation torn write can be repaired under the owned lock; malformed,
-gapped, missing, altered, symlinked, hard-linked, re-rooted, racing, or
-signature-invalid state yields no cards. Restoring a complete matching local
-integrity directory is not distinguishable without an independent monotonic
-anchor, so AgentSpine makes no stronger rollback claim. It never preserves
-transcript bytes.
-
-## Measured boundary
-
-The synthetic acceptance sources contain 2,500 memory links, four old
-CSS-archive error lessons, and a multi-megabyte prior-session JSONL transcript.
-Before explicit prior-session selection, the restarted session finds no matching
-current result. After selection, the concrete `12:40` query retrieves only the
-matching verified objective result and stable source references; it does not
-load unrelated links or full history. The probes cover source-byte preservation, exact scope
-and group denial, expired and reused records, source/state tampering, profile
-changes, crashes, concurrency, final JSONL records, redaction, and bounded
-results.
-
-## Research inputs
-
-On 2026-09-04, AgentSpine reviewed two public repositories as untrusted
-architectural context only:
-
-- [Claude-Mem](https://github.com/thedotmack/claude-mem), `v13.24.0` at
-  `1df66c2`, Apache-2.0: the search → timeline → observation split informed
-  bounded retrieval.
-- [MemPalace](https://github.com/MemPalace/mempalace), `v3.9.0` at `d5250c7`,
-  MIT: raw-source ownership plus indexed time anchors informed the sidecar
-  boundary.
-
-No external code or script was copied or executed. License, architecture, and
-the current AgentSpine contracts were reviewed before independently implemented
-synthetic tests.
-
-
-## Codex native rollout contract
-
-The `codex-rollout-jsonl/v1` adapter accepts only an explicitly enrolled,
-uncompressed native rollout below the verified Codex profile's `sessions`
-directory. It never lists that directory or discovers neighboring sessions.
-Before enrollment, a bounded first-line read (at most 64 KiB) validates the
-`session_meta` record: native session identity, canonical project `cwd`, CLI
-version syntax, and absent/legacy history mode. The per-session transport,
-owner-confirmed enrollment and one-use PreToolUse invocation remain required.
-A Codex lookup leaves native permission decisions to Codex; the lookup adds no
-prompt or permission grant. King/BLUN cannot reuse this adapter through its
-Codex-compatible instruction hierarchy.
-
-Only native `response_item` tool outputs (`function_call_output`,
-`custom_tool_call_output`, `mcp_tool_call_output`) become historical result
-candidates. User and assistant messages do not. Results include timestamp,
-content digest, stable session/message references, native `call_id`, and a
-bounded original excerpt. They remain **untrusted historical context**, never
-current test verification, completion evidence or a learning authorization.
-Structured facts and corrections remain in the separate structured knowledge
-view; raw transcripts are not copied there. Conflicting historical outcomes
-are retained rather than combined into a new claim.
-
-The search ranks the existing bounded index before opening one selected source.
-Sources must match the same host, project, tenant, user and task; groups,
-unregistered private files, symlink escapes and modified snapshots are excluded.
-A source change makes the snapshot unavailable, including after restart. No
-automatic enrollment refresh, receipt reset or retry follows. Missing history
-must be stated honestly while ordinary authorized work remains possible.
-
-Unsupported: compressed, paginated or inherited/forked history; unknown record
-or explicit schema versions; automatic import of a real user's sessions.
-`cli_version` is header provenance, not proof that every version of a
-Codex installation is compatible. The supported structural contract is pinned
-below. A changed host format requires a reviewed adapter and fresh synthetic
-acceptance, not unchecked migration. No Otto/Fredrik live acceptance is implied.
-
-### Primary source provenance
-
-Inspected 2026-09-06: official [Codex hooks documentation](https://learn.chatgpt.com/docs/hooks)
-provides `session_id` and optional `transcript_path`, and explicitly states that
-the transcript format is not a stable interface. The adapter was independently
-implemented against [openai/codex commit 6af345407d9c2a568da9d01b6c4b81a9e61495c0](https://github.com/openai/codex/tree/6af345407d9c2a568da9d01b6c4b81a9e61495c0),
-Apache-2.0: `codex-rs/rollout/src/lib.rs`,
-`codex-rs/history/src/rollout_payload.rs`, and the protocol definitions
-`protocol.rs` / `models.rs`. That source workspace reports `0.0.0`; it is not an
-installed release-version claim. External sources supplied format evidence
-only; no implementation was copied or executed.
-
-Synthetic acceptance exercises native hooks and restarted MCP processes:
-session A stores a measured failure, session B retrieves its exact source after
-compaction, replay/races admit only one invocation, and foreign scope, changed
-sources, model claims, secret-bearing outputs and unknown formats yield no
-verified historical result. Fixtures create their own profiles and sessions.
-
-## King native agent-wire contract
-
-The `king-agent-wire-jsonl/v1` adapter is separate from both Claude and Codex.
-King may use the Codex-compatible `AGENTS.md` hierarchy for project rules, but
-that does not turn its history into a Codex rollout. The verified King lifecycle
-keeps the runtime host identity as `codex` while binding timeline records to the
-distinct `king` provider.
-
-King history is never discovered automatically. The trusted local launcher must
-provide both `AGENTSPINE_KING_TIMELINE_SOURCE`, pointing to the current
-`sessions/.../session_<id>/agents/main/wire.jsonl`, and
-`AGENTSPINE_KING_WIRE_PROTOCOL_VERSION`, matching that file's metadata header.
-The source must remain below the canonical non-symlinked `BLUN_HOME/sessions`
-root. A prompt, model response, MCP argument, remembered fact, or filename alone
-cannot create this mapping. Missing mappings leave history unavailable without
-blocking ordinary host-authorized work.
-
-Enrollment reads only the bounded first record. It requires the exact metadata
-shape and configured `protocol_version`, a positive integer creation time, and
-the current session directory. Indexing accepts only the reviewed King record
-types and extracts objective evidence solely from
-`context.append_loop_event` records whose event is `tool.result`. User and
-assistant messages, model claims, unknown records, unknown schema versions, and
-non-text tool outputs create no evidence card. The native `toolCallId` becomes
-the stable message reference; the record time remains the source timestamp.
-
-King keeps its own permission decisions. AgentSpine only binds a one-use,
-context-only lookup to the current verified gateway, transport, source, and
-scope. Restart and compaction reuse signed sidecar metadata, then revalidate the
-unchanged original source before any selected line is opened. A protocol change,
-source mutation, replay, foreign project or tenant, group context, or unknown
-record makes recall unavailable and never triggers a retry or enrollment reset.
-
-### Primary source provenance
-
-Inspected 2026-09-06: [BLUN Code commit fbb97459a3fa2157f8bfea3d24931be63288ab11](https://github.com/Maykbiletti/blun-code/tree/fbb97459a3fa2157f8bfea3d24931be63288ab11),
-application version `1.0.109`, MIT. Its public verification fixture locates the
-main agent wire at `sessions/.../session_<id>/agents/main/wire.jsonl` and reads
-`context.append_loop_event` / `tool.result`; the vendored King runtime type
-surface identifies the reviewed record union and metadata fields. The vendored
-`@blun/king-sdk` contract is version `0.12.1`, MIT. External files were treated
-as untrusted format evidence; no implementation was copied or executed.
-
-Synthetic repository acceptance proves A-to-B recall of one measured `FAIL
-0/15` result after restart and compaction, with immutable source bytes and
-stable session/message references. It also covers exact gateway binding,
-wrong protocol, wrong path/scope/provider, replay/race, mutation, and unknown
-records. This does not prove Fredrik's installed launcher supplies these two
-protected mappings, that King enforces a returned block decision, or that a
-live session passed. Those remain separate live-host checks.
+Indexing is serialized and limited to 64 KiB–16 MiB. Search uses an exact UTC
+window or two terms, opens ≤1 ranked source, verifies bounded lines,
+returns at most eight cards, and never widens misses. Prior sessions require the
+exact private route. Cross-provider recall additionally requires
+`AGENTSPINE_TIMELINE_CROSS_PROVIDER=1` and both prior flags while retaining the
+original provider enrollment.
+
+Capture consumes a new permit and derives provenance from the reopened source.
+Only allowlisted objective fields enter the existing world model. Direct stdio,
+replay mutation, foreign/group scope, expiry, unsafe state, or changed bytes
+writes nothing. Conflicts remain unresolved; duplicates survive restart.
+
+## Natural user-message continuity (development)
+
+Authenticated routes may retain 256 native user references without evicting
+objective/strict-correction evidence; the combined cap is 4096. Text and derived
+terms are not indexed. The technical `user message` query selects this lane.
+
+Capture rechecks one single-line user message (maximum 2048 UTF-8 bytes), its
+route, and checkpoint. The exact quote becomes an `uninterpreted-user-message`
+assumption with provenance and target—not a fact, correction, completion,
+supersession, permission, or action.
+
+One active candidate may receive a source-bound
+`agentspine.timeline-user-feedback-interpretation-request/v1` proposal. Two or
+three same-task candidates accept only an
+`agentspine.timeline-user-feedback-clarification-request/v2` bound to the full
+sorted assertion set. Each candidate keeps its own provider, session, message,
+source digest, message digest and timestamp. Each registered source is reopened
+and rechecked within the capture gate; partial, reordered, changed,
+foreign-scope, unregistered, or larger sets fail. Replay deduplicates and
+competing proposals conflict.
+
+Both private `model-suggestion` forms keep model/source provenance, target,
+replaced next step, and `completionVerified:false`; neither mutates continuation
+nor grants authority. Pre-answer recall carries them across restart/compaction.
+Three candidates use lossless field/row encoding. King's
+bounded form shares repeated values and prefixes, so all IDs, messages, times,
+provider, session, and source digest reconstruct within the unchanged 1200-byte
+host field.
+
+An objective result may advance continuation only when the same private task
+and route already contain one confirmed
+`agentspine.timeline-continuation-outcome-contract/v1`. The contract fixes the
+exact current step, test label, total, success count, and success state before
+the event. Capture reopens the source, retains the raw measurement, and then
+updates `lastVerifiedStep`; failure keeps the agreed step without retrying,
+while success applies only the contract's explicit next step or terminal state.
+Postdated, stale, conflicting, foreign, superseded, or model-suggested contracts
+cannot advance work. A newer user correction wins because its step no longer
+matches the old contract. Raw contradictory outcomes remain visible uncertainty.
+
+The deterministic lane still requires a whole native line beginning
+`Correction: next step:` or `Korrektur: nächster Schritt:` and changes only
+`nextStep` on one same-thread active conflict-free continuation. Ordinary,
+assistant, multiline, stale, unsafe, foreign, and group inputs fail.
+
+Repository tests for Claude, Codex, and King are independent. Quotes,
+hypotheticals, negations, old/foreign text, and completion claims remain context.
+Acceptance still needs a genuinely new model session to recognize the job, name
+its result file, apply a natural correction, and ask only on real ambiguity.
+Technical checks do not prove semantics, repetition, tokens, or live behavior.
+
+## Integrity and provider formats
+
+Signed sidecar, head, and protected anchor detect state-only/mixed rollback. One
+torn generation is lock-repairable; malformed, missing, altered, linked,
+rerooted, racing, or signature-invalid state yields no cards. Detecting a fully
+matching anchor restoration needs an external monotonic anchor. Failure means
+unverified recall, not a work ban or retry loop.
+
+`codex-rollout-jsonl/v1` accepts one enrolled uncompressed file below verified
+Codex `sessions` and validates bounded `session_meta`; `king-agent-wire-jsonl/v1`
+requires a protected source/protocol mapping. Unknown, inherited, compressed,
+or changed formats fail closed. Only reviewed native tool results yield
+objective cards; chat never does.
+
+Format provenance was inspected on 2026-09-06 in [Codex hooks](https://learn.chatgpt.com/docs/hooks),
+[Codex 6af3454](https://github.com/openai/codex/tree/6af345407d9c2a568da9d01b6c4b81a9e61495c0),
+and [BLUN fbb97459](https://github.com/Maykbiletti/blun-code/tree/fbb97459a3fa2157f8bfea3d24931be63288ab11).
+No source was copied/executed; live mapping, trust, blocking, model use, and
+installation remain separate acceptance boundaries.

package/agent-spine-plugin/docs/world-model.md

@@ -75,6 +75,31 @@ facts, preferences, decisions, or error lessons and keeps their source reference
 Uncertain, stale, superseded, private, foreign, and terminal state is excluded.
 No transcript or source is opened, and the view grants no authority.
 
+## Authenticated portal and thread continuity
+
+When the gateway starts a portal-bound task, it derives opaque `portalRef` and
+`threadRef` values from the complete authenticated route. The MCP runtime, not
+the model or tool arguments, attaches that pair to structured knowledge whose
+subject is the exact current task. `SessionStart`, `PostCompact`,
+`session_briefing`, and `world_context` then use the same pair. A continuation,
+decision, correction, or error lesson about that task is visible only on that
+route, even when another portal thread uses the same user, project, and task ID.
+
+An unbound reader cannot see route-bound task knowledge. Conversely, an
+authenticated portal task does not silently inherit older unbound task-local
+knowledge. Historical records remain byte-valid and stored, but need an
+explicitly reviewed migration rather than an inferred binding. Supersession
+must keep subject, predicate, portal, and thread identical, so a correction in
+one conversation cannot retire another conversation's state.
+
+This narrower rule does not trap intentionally portable memory. General user
+preferences and measured project-level lessons that are not assertions about
+the current task retain their existing project/group/privacy scope and may be
+reused across threads. Portal references are not MCP input fields, do not expose
+raw route identifiers, and grant no retrieval, sending, tool, or execution
+right. A host without the authenticated gateway pair gets no portal-bound task
+context.
+
 ## Privacy and authority
 
 Assertions use `private`, `shared`, or exact `group` privacy. A group read rejects private inclusion, sees only its exact group records plus shared records, and cannot observe another group's values. Project-scoped records are visible only in that exact project; unscoped records may follow the same installation across project turns when intentionally read from that root.

package/agent-spine-plugin/hooks/codex.json

@@ -14,7 +14,7 @@
     ],
     "PreToolUse": [
       {
-        "matcher": "^(?:Edit|Write|apply_patch|Bash|PowerShell|mcp__(?:plugin_agent-spine_agent-spine|agent-spine)__session_timeline_(?:index|search))$",
+        "matcher": "^(?:Edit|Write|apply_patch|Bash|PowerShell|mcp__(?:plugin_agent-spine_agent-spine|agent-spine)__session_timeline_(?:index|search|capture))$",
         "hooks": [{ "type": "command", "command": "node \"${PLUGIN_ROOT}/src/hook.js\"", "timeout": 15 }]
       }
     ],

package/agent-spine-plugin/hooks/hooks.json

@@ -37,7 +37,7 @@
     ],
     "PreToolUse": [
       {
-        "matcher": "^(?:Edit|Write|apply_patch|Bash|PowerShell|mcp__plugin_agent-spine_agent-spine__session_timeline_(?:index|search))$",
+        "matcher": "^(?:Edit|Write|apply_patch|Bash|PowerShell|mcp__plugin_agent-spine_agent-spine__session_timeline_(?:index|search|capture))$",
         "hooks": [
           {
             "type": "command",

package/agent-spine-plugin/package.json

@@ -19,15 +19,13 @@
     "assets",
     "bin",
     "docs/acceptance.md",
-    "docs/assignment-continuation.md",
+    "docs/artifact-evaluation.md",
     "docs/host-integration.md",
     "docs/preflight-recall.md",
     "docs/preservation-contract.md",
     "docs/quality-gates.md",
-    "docs/releasing.md",
     "docs/session-timeline.md",
     "docs/source-roots.md",
-    "docs/structured-completion.md",
     "docs/world-model.md",
     "hooks",
     "scripts",

package/agent-spine-plugin/scripts/check-hosts.js

@@ -5,8 +5,8 @@ import { isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { installedHostEnvironment } from "./check-install-hook.js";
 
-const TIMELINE_PRE_TOOL_MATCHER = "^(?:Edit|Write|apply_patch|Bash|PowerShell|mcp__plugin_agent-spine_agent-spine__session_timeline_(?:index|search))$";
-const BLUN_TIMELINE_PRE_TOOL_MATCHER = "^(?:Edit|Write|apply_patch|Bash|PowerShell|exec_command|mcp__(?:agent-spine|plugin-agent-spine_agent-spine)__session_timeline_(?:index|search))$";
+const TIMELINE_PRE_TOOL_MATCHER = "^(?:Edit|Write|apply_patch|Bash|PowerShell|mcp__plugin_agent-spine_agent-spine__session_timeline_(?:index|search|capture))$";
+const BLUN_TIMELINE_PRE_TOOL_MATCHER = "^(?:Edit|Write|apply_patch|Bash|PowerShell|exec_command|mcp__agent-spine__session_timeline_(?:index|search|capture))$";
 
 function assert(condition, message) {
   if (!condition) throw new Error(message);
@@ -168,7 +168,7 @@ export async function checkHosts(root = process.cwd()) {
     required: [...commonEvents, "InstructionsLoaded"], commandRoot: "CLAUDE_PLUGIN_ROOT"
   });
   const codexHookInventory = validateHooks(root, codexHooks, { required: commonEvents, commandRoot: "PLUGIN_ROOT",
-    matcher: "^(?:Edit|Write|apply_patch|Bash|PowerShell|mcp__(?:plugin_agent-spine_agent-spine|agent-spine)__session_timeline_(?:index|search))$" });
+    matcher: "^(?:Edit|Write|apply_patch|Bash|PowerShell|mcp__(?:plugin_agent-spine_agent-spine|agent-spine)__session_timeline_(?:index|search|capture))$" });
   const blunHookInventory = validateBlunHooks(root, blunManifest.hooks);
   const registrations = await Promise.all([
     initializeServer({ label: "blun", root, variable: "BLUN_PLUGIN_ROOT", server: blunManifest.mcpServers["agent-spine"], version: pkg.version }),

package/agent-spine-plugin/scripts/release-check.js

@@ -5,9 +5,10 @@ import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
-const MAX_PACKED_BYTES = 520 * 1024;
-// Includes the native Codex history adapter and its documented format contract.
-const MAX_UNPACKED_BYTES = 2336 * 1024;
+// Includes the bounded user-feedback candidate path; this is not semantic acceptance.
+// Measured code growth before documentation: 1874 packed / 7830 unpacked bytes.
+const MAX_PACKED_BYTES = 544 * 1024;
+const MAX_UNPACKED_BYTES = 2430 * 1024;
 const REQUIRED_PACKAGE_FILES = [
   "blun.plugin.json", ".claude-plugin/plugin.json", ".codex-plugin/plugin.json", ".mcp.json",
   "CHANGELOG.md", "LICENSE", "README.md", "bin/agentspine.js", "bin/agentspine-mcp.js",
@@ -15,8 +16,12 @@ const REQUIRED_PACKAGE_FILES = [
   "src/lib/codex-skill-installation.js", "src/cli-host.js",
   "docs/acceptance.md", "docs/source-roots.md", "docs/preflight-recall.md", "docs/preservation-contract.md",
   "docs/world-model.md", "docs/session-timeline.md", "scripts/run-acceptance.js", "skills/agent-spine/SKILL.md",
+  "docs/artifact-evaluation.md", "src/lib/learning-artifact-evaluator.js",
+  "src/lib/gateway-group-response.js", "src/lib/channel-continuity.js",
   "src/index.js", "src/mcp.js", "src/lib/mcp-world-tools.js", "src/lib/world-model.js", "src/lib/session-timeline.js",
   "src/lib/session-timeline-auth.js", "src/lib/session-timeline-results.js", "src/lib/session-timeline-state.js", "src/lib/mcp-timeline-tools.js", "src/worker.js",
+  "src/lib/timeline-world-capture.js",
+  "src/lib/timeline-user-feedback.js",
   "hooks/hooks.json", "hooks/codex.json", "hooks/version.json"
 ];
 const FORBIDDEN_PACKAGE_PATHS = [
@@ -72,8 +77,8 @@ function validatePackageReport(report, version) {
   assert(typeof item.filename === "string" && item.filename.endsWith(`-${version}.tgz`), "npm pack filename is not versioned correctly");
   assert(typeof item.integrity === "string" && item.integrity.startsWith("sha512-"), "npm pack did not report SHA-512 integrity");
   assert(Number.isInteger(item.entryCount) && item.entryCount > 0 && item.entryCount <= 500, "npm package file count is outside the release limit");
-  assert(Number.isInteger(item.size) && item.size > 0 && item.size <= MAX_PACKED_BYTES, "npm package exceeds the 520 KiB packed release limit");
-  assert(Number.isInteger(item.unpackedSize) && item.unpackedSize > 0 && item.unpackedSize <= MAX_UNPACKED_BYTES, "npm package exceeds the 2336 KiB unpacked release limit");
+  assert(Number.isInteger(item.size) && item.size > 0 && item.size <= MAX_PACKED_BYTES, "npm package exceeds the 544 KiB packed release limit");
+  assert(Number.isInteger(item.unpackedSize) && item.unpackedSize > 0 && item.unpackedSize <= MAX_UNPACKED_BYTES, "npm package exceeds the 2430 KiB unpacked release limit");
   const paths = (item.files || []).map((file) => file.path);
   assert(paths.length === new Set(paths).size, "npm package contains duplicate paths");
   for (const path of REQUIRED_PACKAGE_FILES) assert(paths.includes(path), `npm package is missing required file: ${path}`);

package/agent-spine-plugin/scripts/run-checks.js

@@ -7,9 +7,12 @@ import { githubErrorCommand } from "./github-actions.js";
 const CHECKS = [
   { title: "Syntax check", script: "lint" },
   { title: "Line budget", script: "line-budget" },
-  { title: "Hermetic test suite", script: "test" },
   { title: "Host manifest check", script: "host:check" },
+  // Exercise the copied-bundle hook deadlines before the hermetic suite creates
+  // hundreds of short-lived Windows processes. The deadlines and assertions stay
+  // unchanged; this removes residual runner load from the installed-host probe.
   { title: "Installed bundle check", script: "host:install-check" },
+  { title: "Hermetic test suite", script: "test" },
   { title: "Runtime smoke test", script: "smoke" },
   { title: "Self audit", script: "audit:self" }
 ];

package/agent-spine-plugin/scripts/run-tests-hermetic.js

@@ -9,7 +9,11 @@ import { configuredTestTimeout, runBoundedProcess } from "./hermetic-process.js"
 const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
 const base = await mkdtemp(join(tmpdir(), "agentspine-hermetic-tests-"));
 const testFiles = (await readdir(join(root, "test"))).filter((name) => name.endsWith(".test.js")).sort();
-const concurrency = Math.max(1, Math.min(4, cpus().length));
+// Windows process creation and antivirus-backed temporary I/O contend sharply
+// when several hermetic files each spawn MCP children. Preserve the real child
+// deadlines by reducing runner load there, rather than relaxing any deadline.
+const concurrencyCeiling = process.platform === "win32" ? 2 : 4;
+const concurrency = Math.max(1, Math.min(concurrencyCeiling, cpus().length));
 const testTimeoutMs = configuredTestTimeout();
 const slowTestTimeouts = new Map([
   ["indexed-memory.test.js", 300_000]
@@ -51,11 +55,33 @@ async function runOne(file, mode, index) {
 async function runMode(mode) {
   const indexed = testFiles.map((file, index) => ({ file, index }));
   const results = [];
-  // Installation copies complete bundles and checks real 2-second source / 5-second
-  // child-hook deadlines. Keep that healthy-baseline probe off the shared I/O pool.
-  // Both profiles still run it once, with identical assertions and time limits.
-  const isolated = indexed.filter(item => item.file === "package.test.js");
-  const queue = indexed.filter(item => item.file !== "package.test.js");
+  // Installation copies complete bundles, while the MCP and route-lifecycle tests
+  // start real children with fixed deadlines and host-origin enrollment attests a
+  // live source plus signed state. Keep those probes off the shared Windows I/O pool.
+  // Both profiles still run them once, with unchanged assertions and limits.
+  const isolatedNames = new Set([
+    "assignment-continuation-boundaries.test.js",
+    "assignment-continuation.test.js",
+    "codex-history.test.js",
+    "hook-artifact-guards.test.js",
+    "hook.test.js",
+    "cross-provider-history.test.js",
+    "delivery-completion.test.js",
+    "hook-briefing-use.test.js",
+    "king-history.test.js",
+    "lesson-recall.test.js",
+    "mcp-bounded-preflight.test.js",
+    "mcp-bounded-recovery.test.js",
+    "package.test.js",
+    "portal-thread-continuity.test.js",
+    "mcp.test.js",
+    "owned-file-lock.test.js",
+    "session-timeline-host-origin.test.js",
+    "session-timeline-invocation.test.js",
+    "timeline-natural-feedback.test.js"
+  ]);
+  const isolated = indexed.filter(item => isolatedNames.has(item.file));
+  const queue = indexed.filter(item => !isolatedNames.has(item.file));
   for (const item of isolated) results.push(await runOne(item.file, mode, item.index));
   async function worker() { while (queue.length) { const item = queue.shift(); results.push(await runOne(item.file, mode, item.index)); } }
   await Promise.all(Array.from({ length: concurrency }, () => worker()));

package/agent-spine-plugin/src/cli-learning.js

@@ -1,7 +1,10 @@
 import { addLearningEvidence, beginLearningRevalidation, configureLearning, deleteLearning, evaluateLearning, learningContext, learningOutcomeStatus, loadLearning, proposeLearning, purgeStaleLearningApplications, purgeStaleLearningMeasurements, recordLearningMeasurement, recordLearningOutcome, registerLearningEvaluation, registerLearningEvaluator, renewLearningValidation, revokeLearningEvaluator, reviewLearning, revokeLearningApplication, revokeLearningDelivery, revokeLearningEvaluation, revokeLearningEvidence, revokeLearningMeasurement, revokeLearningOutcome, revokeLearningTrialFailure, revokeLearningValidation, revokeLearningEvidenceSourceAttestation, rollbackLearning } from "./lib/learning.js";
 import { booleanFlag, evaluatorRootsFlag, hasLearningScope, learningScope, output } from "./cli-common.js";
+import { artifactEvaluationPlan, measureLearningArtifacts } from "./lib/learning-artifact-evaluator.js";
 
 export const learningCommands = new Set([
+  "learn-artifact-plan",
+  "learn-artifact-measure",
   "learn-propose",
   "learn-evidence",
   "learn-evidence-revoke",
@@ -32,6 +35,18 @@ export const learningCommands = new Set([
 ]);
 
 export async function runLearningCommand({ command, flags, positional, json }) {
+  if (command === "learn-artifact-plan" || command === "learn-artifact-measure") {
+    const text = flags.checks;
+    if (typeof text !== "string" || Buffer.byteLength(text) > 16384) {
+      throw new Error("--checks must contain a bounded artifact-checks JSON specification");
+    }
+    const spec = JSON.parse(text);
+    if (command === "learn-artifact-plan") return output(artifactEvaluationPlan(spec), json);
+    return output(await measureLearningArtifacts({ root: flags.root || process.cwd(), spec,
+      id: positional[0], learningId: flags.learning, evaluationId: flags.evaluation,
+      phase: flags.phase, scope: learningScope(flags), evaluatorId: flags.evaluator, runId: flags.run,
+      confirmLocalMeasurement: booleanFlag(flags["confirm-local-measurement"]) }), json);
+  }
   if (command === "learn-propose") {
     return output(await proposeLearning({
       root: flags.root || process.cwd(), id: positional[0], kind: flags.kind,

package/agent-spine-plugin/src/cli.js

@@ -50,6 +50,8 @@ Usage:
   agentspine learn-trial-failure-revoke <trial-failure-id> --reason-code clock-invalid|host-invalid|receipt-invalid|scope-invalid|duplicate|other --reason text --confirm-local-trial-failure-revocation
   agentspine learn-revalidation-start <learning-id> --confirm-local-validation
   agentspine learn-revalidate <learning-id> --measurements id,id --applications id,id --deliveries id,id --confirm-local-validation
+  agentspine learn-artifact-plan --checks JSON [--json]
+  agentspine learn-artifact-measure <id> --root path --checks JSON --learning id --evaluation id --phase before|after --evaluator id --run id --persona id --user id --tenant id --project id [--task id] [--group id] --confirm-local-measurement [--json]
   agentspine learn-measurement <id> --learning id --evaluation id --phase before|after --metric name --direction higher|lower --value 0..1 --measurement objective|user-feedback|model-suggestion --evaluator id --run id --source-digest sha256 --dataset-digest sha256 --case-count n --confirm-local-measurement
   agentspine learn-measurement-revoke <measurement-id> --reason-code source-invalid|evaluator-invalid|protocol-invalid|duplicate|other --reason text --confirm-local-measurement-revocation
   agentspine learn-application-revoke <application-id> --reason-code preflight-invalid|scope-invalid|projection-invalid|duplicate|other --reason text --confirm-local-application-revocation