continuous-improvement 3.11.0 → 3.15.0

package/plugins/continuous-improvement/lib/gateguard-state.mjs

@@ -2,20 +2,25 @@
  * Gateguard per-session state.
  *
  * State file: <sessionDir>/gateguard-session.json. sessionDir resolves to
- * GATEGUARD_SESSION_DIR (env override, used by tests) or
- * ~/.claude/instincts/<projectHash>/ in production.
+ * GATEGUARD_SESSION_DIR (env override, used by tests), or in production to
+ * ~/.claude/instincts/<projectHash>/sessions/<sessionId>/ when the hook passes
+ * the stdin session_id, falling back to ~/.claude/instincts/<projectHash>/ when
+ * no session id is available. Per-session scoping is what stops the clearance
+ * cap from bleeding across concurrent same-day sessions on a multi-Claude host.
  *
- * V1 limitations (documented for honesty, not mitigated in code):
+ * Limitations and guarantees:
  * - Honor system: clearance is granted whenever the agent sets
  *   `_gateguard_facts_presented: true` in tool_input or has a prior per-file
  *   marker. The hook cannot verify that real investigation occurred.
  * - State-file deletion: rm'ing the state file resets every gate in the
- *   session. Defensible because the session itself is the trust boundary;
- *   the cap below limits cumulative damage.
+ *   session. Defensible because the session is the trust boundary — and with
+ *   per-session scoping that boundary is now real, not just asserted.
+ * - Self-heal: loadState treats a file older than STATE_TTL_MS (or one with an
+ *   unparseable created_at) as empty, so a stale gate never needs a manual rm.
  * - Concurrency: two parallel hook invocations can race the read+write.
  *   Acceptable trade-off vs OS-specific atomic-rename complexity on Windows.
- * - Cap: MAX_CLEARED_FILES caps the number of distinct files a single
- *   session can clear, bounding stuck-loop / rogue-agent damage.
+ * - Cap: MAX_CLEARED_FILES caps the distinct files ONE session can clear,
+ *   bounding stuck-loop / rogue-agent damage without affecting other sessions.
  */
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -23,14 +28,36 @@ import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
 export const MAX_CLEARED_FILES = 50;
-export function resolveSessionDir() {
+// A clearance file whose created_at is older than this self-heals to empty on
+// the next load, so a stale gate never needs a manual rm. Long enough not to
+// reset an active session mid-work; the real cross-session fix is the
+// per-session dir in resolveSessionDir below.
+export const STATE_TTL_MS = 12 * 60 * 60 * 1000; // 12h
+// The root that holds every project's gateguard + instinct state. The MCP
+// clearance route uses this to bound a caller-supplied state_path to this tree
+// so a hostile argument can't turn the clear into an arbitrary-write primitive.
+export function resolveInstinctsRoot() {
+    const home = process.env.HOME || process.env.USERPROFILE || homedir();
+    return join(home, ".claude", "instincts");
+}
+export function resolveSessionDir(sessionId) {
     const fromEnv = process.env.GATEGUARD_SESSION_DIR;
     if (fromEnv)
         return fromEnv;
-    const home = process.env.HOME || process.env.USERPROFILE || homedir();
     const projectRoot = resolveProjectRoot();
     const projectHash = createHash("sha256").update(canonicalizeProjectRoot(projectRoot)).digest("hex").slice(0, 12);
-    return join(home, ".claude", "instincts", projectHash);
+    const base = join(resolveInstinctsRoot(), projectHash);
+    const scoped = sanitizeSessionId(sessionId);
+    return scoped ? join(base, "sessions", scoped) : base;
+}
+// A session id flows into a directory name. Strip anything outside a safe
+// alphabet so a hostile or malformed id can't traverse (`../`) or break the
+// path, and cap the length. Returns "" for an absent/empty id, which the caller
+// treats as "no session" — the legacy unscoped dir, preserving back-compat.
+function sanitizeSessionId(sessionId) {
+    if (!sessionId)
+        return "";
+    return sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 64);
 }
 function resolveProjectRoot() {
     const fromEnv = process.env.CLAUDE_PROJECT_DIR;
@@ -49,21 +76,43 @@ function resolveProjectRoot() {
     }
     return "global";
 }
+function freshState() {
+    return { created_at: new Date().toISOString(), cleared_files: {} };
+}
+// A clearance file self-heals to empty once it ages out of STATE_TTL_MS, so a
+// stale gate never needs a manual rm. An unparseable created_at fails closed
+// (treated as expired) rather than living forever as a never-resetting gate.
+function isExpired(createdAt) {
+    const created = Date.parse(createdAt);
+    if (Number.isNaN(created))
+        return true;
+    return Date.now() - created > STATE_TTL_MS;
+}
 export function loadState(sessionDir) {
     const path = join(sessionDir, "gateguard-session.json");
     if (!existsSync(path)) {
-        return { created_at: new Date().toISOString(), cleared_files: {} };
+        return freshState();
     }
     try {
         const raw = readFileSync(path, "utf8");
         const parsed = JSON.parse(raw);
+        // Absent created_at is treated as expired (fail closed), like an unparseable
+        // one — never a never-resetting gate. On expiry we persist the new epoch
+        // immediately so the cap re-applies from zero on the very next load;
+        // otherwise every load before the next clear would independently reset and a
+        // TTL-crossing session could clear well past MAX_CLEARED_FILES.
+        if (!parsed.created_at || isExpired(parsed.created_at)) {
+            const reset = freshState();
+            saveState(sessionDir, reset);
+            return reset;
+        }
         return {
-            created_at: parsed.created_at ?? new Date().toISOString(),
+            created_at: parsed.created_at,
             cleared_files: parsed.cleared_files ?? {},
         };
     }
     catch {
-        return { created_at: new Date().toISOString(), cleared_files: {} };
+        return freshState();
     }
 }
 export function saveState(sessionDir, state) {

package/plugins/continuous-improvement/lib/goal-state.mjs

@@ -19,11 +19,15 @@ const STOPWORDS = new Set([
     "make", "made", "adds", "new", "get", "got", "set", "also", "only", "each",
     "task", "goal", "plan", "work", "working", "build", "building", "code",
 ]);
-// 4 suits Latin/Cyrillic prose, but it silently drops most Korean/Thai words
-// (typically 2 chars) even though the Unicode splitter now keeps them — so the
-// goal-state half of the tokenizer fix is only partial for those scripts. A
-// script-aware floor is a logged follow-up (see CLAUDE.md Deferred).
+// 4 suits Latin/Cyrillic/Thai prose (Thai combining marks are now kept; see
+// extractKeywordsFromProse regex). Korean Hangul words are typically 2-3 chars
+// but represent full concepts, so they get a script-aware floor of 2.
 const KEYWORD_MIN_LENGTH = 4;
+function keywordMinLengthFor(word) {
+    if (/\p{Script=Hangul}/u.test(word))
+        return 2;
+    return KEYWORD_MIN_LENGTH;
+}
 const KEYWORD_CAP = 20;
 const DEFAULT_WINDOW = 30;
 const DEFAULT_THRESHOLD = 0.3;
@@ -52,16 +56,16 @@ export function getSection(markdown, heading) {
 }
 /**
  * Tokenize prose into goal keywords: lowercase, split on any non-letter /
- * non-number (Unicode-aware, so accented Latin / Cyrillic / CJK survive), drop
- * stopwords, pure-digit tokens, and tokens shorter than KEYWORD_MIN_LENGTH.
- * Deduped, capped at KEYWORD_CAP.
+ * non-number / non-mark (Unicode-aware, so accented Latin / Cyrillic / CJK /
+ * Thai survive), drop stopwords, pure-digit tokens, and tokens shorter than
+ * KEYWORD_MIN_LENGTH. Deduped, capped at KEYWORD_CAP.
  */
 export function extractKeywordsFromProse(prose) {
     const seen = new Set();
     const out = [];
-    for (const raw of prose.toLowerCase().split(/[^\p{L}\p{N}]+/u)) {
+    for (const raw of prose.toLowerCase().split(/[^\p{L}\p{N}\p{M}]+/u)) {
         const word = raw.trim();
-        if (word.length < KEYWORD_MIN_LENGTH)
+        if (word.length < keywordMinLengthFor(word))
             continue;
         if (/^\p{N}+$/u.test(word))
             continue;

package/plugins/continuous-improvement/lib/hook-pack-gate.mjs

@@ -0,0 +1,65 @@
+// hook-pack-gate.mts — Pure decision core for the enforcing-hook pack (v1).
+//
+// No I/O. Given a raw Bash command string, the resolved current branch, the
+// staged-file count, and the operator's mode, decide allow / warn / block.
+// The hook (src/hooks/hook-pack.mts) wires stdin + git subprocess calls around
+// these functions; keeping them pure lets the unit tests cover every branch
+// without spawning anything. Lives in lib/ so tests can import it (the
+// test-imports-only invariant forbids importing from hooks/).
+//
+// Fail-open by construction: callers pass safe defaults (null branch, 0 staged)
+// on any failure, and an unrecognized mode resolves to warn.
+export const COMMIT_FILE_LIMIT = 15;
+const ALLOW = { action: "allow", reason: "" };
+export function parseMode(raw) {
+    const v = (raw ?? "warn").trim().toLowerCase();
+    return v === "block" || v === "off" ? v : "warn";
+}
+// Match `git push` / `git commit` at the start of the command or immediately
+// after a shell separator (newline, ;, |, &). This deliberately does NOT match
+// a mention like `echo git push`, where git is an argument, not the command.
+export function classifyCommand(command) {
+    if (/(?:^|[\n;|&])\s*git\s+push\b/.test(command))
+        return "push";
+    if (/(?:^|[\n;|&])\s*git\s+commit\b/.test(command))
+        return "commit";
+    return "other";
+}
+export function isProtectedBranch(branch) {
+    return branch === "main" || branch === "master" || /^release\//.test(branch);
+}
+// Extract the explicit destination branch of a `git push`, or null when none is
+// given (the caller should then fall back to the current branch). Handles
+// `git push <remote> <branch>`, `git push -u <remote> <branch>`, and refspecs
+// like `HEAD:main` (destination after the colon).
+function parsePushTarget(command) {
+    const tokens = command.split(/\s+/).filter(Boolean);
+    const pushIdx = tokens.findIndex((t, i) => t === "push" && tokens[i - 1] === "git");
+    if (pushIdx === -1)
+        return null;
+    const operands = tokens.slice(pushIdx + 1).filter((t) => !t.startsWith("-"));
+    // operands[0] is the remote; operands[1] is the refspec. Fewer than two means
+    // no explicit branch (e.g. `git push` or `git push origin`).
+    if (operands.length < 2)
+        return null;
+    const refspec = operands[1];
+    return refspec.includes(":") ? (refspec.split(":").pop() ?? null) : refspec;
+}
+export function evaluatePush(command, currentBranch) {
+    if (/(?:^|\s)--dry-run\b/.test(command))
+        return { gated: false, branch: null };
+    const branch = parsePushTarget(command) ?? currentBranch;
+    if (!branch)
+        return { gated: false, branch: null };
+    return { gated: isProtectedBranch(branch), branch };
+}
+export function evaluateCommitSize(command, stagedCount) {
+    if (/(?:^|\s)--amend\b/.test(command))
+        return { gated: false };
+    return { gated: stagedCount > COMMIT_FILE_LIMIT };
+}
+export function decide(mode, gated, reason) {
+    if (!gated || mode === "off")
+        return ALLOW;
+    return { action: mode === "block" ? "block" : "warn", reason };
+}

package/plugins/continuous-improvement/lib/plugin-metadata.mjs

@@ -26,7 +26,7 @@ const KEYWORDS = [
     "transcript-linter",
 ];
 const CLAUDE_PLUGIN_CATEGORY = "productivity";
-const SHARED_PLUGIN_DESCRIPTION = "Stops Claude Code from skipping research, claiming 'done' without verifying, and repeating yesterday's mistakes. The 7 Laws of AI Agent Discipline — 25 bundled skills, gating hooks, the Mulahazah auto-leveling instinct engine, and a GitHub Action transcript linter.";
+const SHARED_PLUGIN_DESCRIPTION = "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 25 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.";
 // Four vendored upstream companions registered alongside the CI plugin.
 // Each entry points at a pinned-SHA snapshot under third-party/<name>/.
 // See third-party/MANIFEST.md for refresh recipes and per-snapshot
@@ -76,7 +76,7 @@ const THIRD_PARTY_COMPANIONS = [
     },
     {
         name: "oh-my-claudecode",
-        description: "Multi-agent orchestration system for Claude Code — 39 skills + 19 agents covering audit, plan, build, verify, ship, release, retrospective, and ops. Includes ralph (autonomous PRD loop), release, ultrawork, ultraqa, team, trace, visual-verdict, debug, deep-dive, deep-interview, autopilot, autoresearch. Vendored snapshot at third-party/oh-my-claudecode/ pinned to upstream SHA aacde3e (v4.13.6). Heavy overlap with continuous-improvement /ralph and /superpowers — pick per task.",
+        description: "Multi-agent orchestration system for Claude Code — 38 skills + 19 agents covering audit, plan, build, verify, ship, release, retrospective, and ops. Includes ralph (autonomous PRD loop), release, ultrawork, ultraqa, team, trace, visual-verdict, debug, deep-dive, deep-interview, autopilot, autoresearch. Vendored snapshot at third-party/oh-my-claudecode/ pinned to upstream SHA aacde3e (v4.13.6). Heavy overlap with continuous-improvement /ralph and /superpowers — pick per task.",
         version: "4.13.6",
         source: "./third-party/oh-my-claudecode",
         author: {
@@ -143,6 +143,10 @@ const BEGINNER_TOOL_ENTRIES = [
                     type: "string",
                     description: "A single file path to clear (alternative to file_paths)",
                 },
+                state_path: {
+                    type: "string",
+                    description: "State-file path from the GateGuard block reason (the session-scoped gateguard-session.json). Pass it verbatim so the clearance lands in the session the hook is reading; it must resolve inside ~/.claude/instincts/. Omitting it falls back to the unscoped canonical dir — safe only in legacy (no session id) contexts; when the hook is session-scoped, omitting it writes to the wrong dir and the retry will still block.",
+                },
             },
             required: [],
         },
@@ -373,15 +377,21 @@ const EXPERT_TOOL_ENTRIES = [
             required: ["id"],
         },
     },
+    {
+        name: "ci_distill_from_workflow",
+        description: "Draft a reusable instinct from the most recent completed-and-verified native Workflow run in this project's observation feed. A Workflow script is an authored recipe, so a single run whose output passed verification is enough — unlike ci_distill_candidates, which needs a pattern repeated across sessions. Writes a DRAFT to drafts/ (a skeleton you edit); it changes no behavior until promoted with ci_distill_promote. Returns a message when no verified workflow run is found.",
+        manifestWhat: "Draft a reusable instinct from a verified Workflow run",
+        inputSchema: { type: "object", properties: {}, required: [] },
+    },
 ];
 const MODE_METADATA = {
     beginner: {
-        description: "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles four discipline skills (gateguard, para-memory-files, tdd-workflow, verification-loop) so research, memory, tests, and verification happen by default.",
+        description: "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles three grounding skills (gateguard, tdd-workflow, verification-loop) so research, memory, tests, and verification happen by default — every edit starts from facts, not guesses.",
         hooks: ["PreToolUse", "PostToolUse", "UserPromptSubmit"],
-        hookDescription: "Silently captures every tool call as observations and routes prompts to the matching discipline skill via the route table. Lightweight and non-blocking.",
+        hookDescription: "Silently captures every tool call as observations and routes prompts to the matching skill via the route table. Lightweight and non-blocking.",
     },
     expert: {
-        description: "Expert mode: tune confidence, manage instincts, and persist plans on disk. Adds safety, token-budget, and strategic-compact skills plus the /learn-eval command so long sessions stay disciplined and learnings survive context resets.",
+        description: "Expert mode: tune confidence, manage instincts, and persist plans on disk. Adds safety, token-budget, and strategic-compact skills plus the /learn-eval command so long sessions stay sharp and learnings survive context resets.",
         hooks: ["PreToolUse", "PostToolUse", "UserPromptSubmit", "SessionStart", "SessionEnd"],
         hookDescription: "Full hook suite: observation capture, lazy prompt routing, session-level instinct loading, and auto-reflection.",
     },
@@ -457,6 +467,11 @@ export function getPluginHooksConfig() {
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/companion-preference.mjs\"",
         timeout: 5,
     };
+    const hookPackCommand = {
+        type: "command",
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/hook-pack.mjs\"",
+        timeout: 5,
+    };
     const observeCommand = {
         type: "command",
         command: "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/observe.sh\"",
@@ -482,8 +497,13 @@ export function getPluginHooksConfig() {
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/route-prompt.mjs\"",
         timeout: 5,
     };
+    const recallBriefingCommand = {
+        type: "command",
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/recall-briefing.mjs\"",
+        timeout: 5,
+    };
     return {
-        description: "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, and UserPromptSubmit lazy-routing hooks for continuous-improvement.",
+        description: "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
         hooks: {
             // gateguard runs FIRST on PreToolUse so its block decision short-circuits
             // before companion-preference sees the call. companion-preference runs
@@ -496,9 +516,15 @@ export function getPluginHooksConfig() {
             // through with no output.
             PreToolUse: [
                 { hooks: [gateguardCommand, companionPreferenceCommand] },
+                // hook-pack gates Bash `git push` to protected branches and oversized
+                // `git commit`s. The "Bash" matcher scopes it off the hot path for all
+                // non-Bash tools, so the two-subprocess note above still holds for
+                // Edit/Read/etc. Warn-default (CLAUDE_CI_HOOKPACK_GATE) — never blocks
+                // until the operator opts in.
+                { matcher: "Bash", hooks: [hookPackCommand] },
             ],
             PostToolUse: [{ hooks: [observeCommand] }],
-            UserPromptSubmit: [{ hooks: [routePromptCommand] }],
+            UserPromptSubmit: [{ hooks: [routePromptCommand, recallBriefingCommand] }],
             SessionStart: [{ hooks: [sessionCommand] }],
             SessionEnd: [{ hooks: [sessionCommand] }],
             Stop: [{ hooks: [threeSectionCloseCommand, goalDriftStopCommand] }],

package/plugins/continuous-improvement/lib/recall-briefing.mjs

@@ -0,0 +1,57 @@
+// recall-briefing.mts — Pure decision core for the proactive recall-briefing hook.
+//
+// No I/O. Given (enabled, already-briefed, prompt, ranked recall hits), decides
+// whether to inject a one-time-per-session "you've touched related work before"
+// system-reminder and renders it. The hook (src/hooks/recall-briefing.mts) does
+// the filesystem work — read the prompt, read observations.jsonl, build the BM25
+// index (recall-index.mts), track per-session state — then calls decideBriefing.
+// Keeping the decision pure lets the unit tests cover every gate and boundary
+// (disabled / already-briefed / empty-or-short prompt / no hits / malformed
+// input) without touching the filesystem, per the repo lesson that green gates
+// do not prove boundary safety.
+//
+// This is an amplifier, not a gate: it never blocks a prompt. It only surfaces
+// prior context so the agent reuses a past fix instead of re-deriving it. It is
+// opt-in (the hook checks an env flag) and fires at most once per session.
+export const DEFAULT_MAX_HITS = 3;
+export const DEFAULT_MIN_PROMPT_LENGTH = 12;
+/** Render ranked hits as a compact UserPromptSubmit system-reminder. Pure string. */
+export function formatBriefing(hits) {
+    const lines = [
+        "<system-reminder>",
+        "Recall briefing: this project has prior sessions that touched related work. Before re-deriving a fix, consider the `ci_recall` MCP tool (or `/recall`) for full context. Most relevant past activity:",
+    ];
+    for (const h of hits) {
+        const stamp = h && h.ts ? `[${h.ts}] ` : "";
+        const tool = (h && h.tool) || "(tool?)";
+        const snippet = ((h && h.snippet) || "").replace(/\s+/g, " ").trim();
+        lines.push(`- ${stamp}${tool}: ${snippet || "(no summary)"}`);
+    }
+    lines.push("</system-reminder>");
+    return lines.join("\n");
+}
+/**
+ * Decide whether to inject a recall briefing. Fails closed: any disabling
+ * condition (opted out, already briefed, prompt below the noise floor, no hits,
+ * malformed input) returns shouldBrief=false and never throws.
+ */
+export function decideBriefing(params) {
+    const none = { shouldBrief: false, reminder: null };
+    if (!params || params.enabled !== true)
+        return none;
+    if (params.alreadyBriefed === true)
+        return none;
+    const prompt = typeof params.prompt === "string" ? params.prompt : "";
+    const minLen = typeof params.minPromptLength === "number" && params.minPromptLength >= 0
+        ? params.minPromptLength
+        : DEFAULT_MIN_PROMPT_LENGTH;
+    if (prompt.trim().length < minLen)
+        return none;
+    const maxHits = typeof params.maxHits === "number" && params.maxHits > 0
+        ? Math.floor(params.maxHits)
+        : DEFAULT_MAX_HITS;
+    const hits = Array.isArray(params.hits) ? params.hits.slice(0, maxHits) : [];
+    if (hits.length === 0)
+        return none;
+    return { shouldBrief: true, reminder: formatBriefing(hits) };
+}

package/plugins/continuous-improvement/lib/recall-index.mjs

@@ -19,10 +19,10 @@ const BM25_K1 = 1.5;
 const BM25_B = 0.75;
 const DEFAULT_K = 5;
 const SNIPPET_RADIUS = 60;
-/** Lowercase, split on any non-letter / non-number (Unicode-aware), drop stopwords and tokens shorter than TOKEN_MIN_LENGTH. */
+/** Lowercase, split on any non-letter / non-number / non-mark (Unicode-aware), drop stopwords and tokens shorter than TOKEN_MIN_LENGTH. */
 export function tokenize(text) {
     const out = [];
-    for (const raw of text.toLowerCase().split(/[^\p{L}\p{N}]+/u)) {
+    for (const raw of text.toLowerCase().split(/[^\p{L}\p{N}\p{M}]+/u)) {
         if (raw.length < TOKEN_MIN_LENGTH)
             continue;
         if (STOPWORDS.has(raw))

package/plugins/continuous-improvement/lib/skill-distill.mjs

@@ -220,3 +220,144 @@ export function formatCandidates(candidates, limit = 10) {
     }
     return lines.join("\n");
 }
+// ── Workflow-run → instinct bridge ───────────────────────────────────────────
+// A native Workflow run (Opus 4.8 orchestration / ultracode) is recorded in the
+// observation feed as a `tool: "Workflow"` row whose input_summary holds
+// {"script":"..."} — truncated (~500 chars), but meta.name/description/phases sit
+// at the head of the script and survive. The output_summary holds
+// {"status","runId",...} with status "async_launched": the feed captures the
+// LAUNCH, not the result. So a workflow's success is never read from the Workflow
+// row itself — it is inferred from a following verify-exit-0 in the same feed.
+//
+// Unlike findCandidates (which needs a pattern recurring across >=2 sessions to
+// reject coincidence), a Workflow script is an AUTHORED recipe: one verified run
+// warrants a draft, so the session/occurrence thresholds do not apply here.
+const WORKFLOW_TOOL = "Workflow";
+// Pull meta.name / meta.description / meta.phases[].title out of a (possibly
+// truncated) workflow script embedded as JSON in the observation input_summary.
+// Fail-closed: returns null unless a name is recoverable — a recipe with no
+// identity is never fabricated.
+function parseWorkflowScript(inputSummary) {
+    if (!inputSummary)
+        return null;
+    let script = "";
+    try {
+        const parsed = JSON.parse(inputSummary);
+        if (typeof parsed.script === "string")
+            script = parsed.script;
+    }
+    catch {
+        // input_summary may itself be truncated mid-JSON; recover the script field loosely.
+        const m = inputSummary.match(/"script"\s*:\s*"((?:[^"\\]|\\.)*)/);
+        if (m) {
+            try {
+                script = JSON.parse(`"${m[1]}"`);
+            }
+            catch {
+                script = m[1].replace(/\\n/g, "\n").replace(/\\"/g, '"').replace(/\\'/g, "'");
+            }
+        }
+    }
+    if (!script)
+        return null;
+    // Scope name/description to the meta head (text before `phases:`) so a phase
+    // object's own description: is never mistaken for meta.description; scope phase
+    // titles to the phases array literal so inline agent/step title: fields are not
+    // captured. The capture classes exclude quotes and newlines, so a hostile
+    // name/description cannot inject lines into the draft YAML — serializeDraft emits
+    // trigger as a quoted scalar.
+    const phasesAt = script.search(/\bphases\s*:/);
+    const metaHead = phasesAt >= 0 ? script.slice(0, phasesAt) : script;
+    const name = (metaHead.match(/\bname\s*:\s*['"]([^'"\r\n]+)['"]/) ?? [])[1] ?? "";
+    if (!name)
+        return null; // fail closed: no recipe identity
+    const description = (metaHead.match(/\bdescription\s*:\s*['"]([^'"\r\n]+)['"]/) ?? [])[1] ?? "";
+    const phasesBlock = (script.match(/\bphases\s*:\s*\[([^\]]*)\]/) ?? [])[1] ?? "";
+    const phases = [];
+    const phaseRe = /\btitle\s*:\s*['"]([^'"\r\n]+)['"]/g;
+    let pm;
+    while ((pm = phaseRe.exec(phasesBlock)) !== null)
+        phases.push(pm[1]);
+    return { name, description, phases };
+}
+// A single verify-exit-0 Bash row: a verify/test/build command whose output is not
+// failing. Mirrors classifyTrajectorySuccess's verify branch for one observation.
+function isVerifySuccessRow(observation) {
+    if ((observation.tool ?? "") !== "Bash")
+        return false;
+    const input = (observation.input_summary ?? "").toString();
+    const output = (observation.output_summary ?? "").toString();
+    return VERIFY_CMD.test(input) && !FAILURE_MARKER.test(output) && (output === "" || SUCCESS_MARKER.test(output));
+}
+/**
+ * Detect the most recent completed-and-verified Workflow run in an observation
+ * list. Returns null (fail closed) unless: a `tool: "Workflow"` row carries a
+ * parseable script with a name, AND a verify-exit-0 row follows it in the feed.
+ * The trailing verify is the only success signal — the Workflow row records the
+ * launch, never the result.
+ */
+export function workflowRunFromObservations(observations) {
+    let wfIndex = -1;
+    let meta = null;
+    for (let i = observations.length - 1; i >= 0; i -= 1) {
+        if ((observations[i].tool ?? "") !== WORKFLOW_TOOL)
+            continue;
+        const parsed = parseWorkflowScript((observations[i].input_summary ?? "").toString());
+        if (parsed) {
+            wfIndex = i;
+            meta = parsed;
+            break;
+        }
+    }
+    if (wfIndex === -1 || !meta)
+        return null;
+    const wfSession = (observations[wfIndex].session ?? "").toString();
+    // The verify that proves the run must follow the Workflow row in the SAME session.
+    // A verify from an unrelated later task (different session) does not count — the
+    // run is asynchronous, so an interleaved verify could otherwise falsely prove it.
+    let verifyCommand = "";
+    for (let i = wfIndex + 1; i < observations.length; i += 1) {
+        const row = observations[i];
+        if ((row.session ?? "").toString() !== wfSession)
+            continue;
+        if (isVerifySuccessRow(row)) {
+            verifyCommand = (row.input_summary ?? "").toString();
+            break;
+        }
+    }
+    if (!verifyCommand)
+        return null; // fail closed: no evidence the run's output landed
+    return { name: meta.name, description: meta.description, phases: meta.phases, verifyCommand };
+}
+/**
+ * Turn a verified Workflow run into a DRAFT instinct. The script's phase outline is
+ * a real skeleton (not a placeholder n-gram), but the human still edits the body
+ * before promoting. Reuses serializeDraft and the drafts/ ladder; the
+ * `draft-workflow-` id prefix marks the source and stays filesystem-safe.
+ */
+export function draftFromWorkflowRun(run) {
+    // Cap the slug so a hostile/huge meta.name cannot produce a path that trips
+    // ENAMETOOLONG on write; strip a trailing hyphen left by the cut.
+    const slug = slugifyNgram([run.name]).slice(0, 120).replace(/-+$/, "") || "workflow";
+    const phaseLine = run.phases.length > 0 ? run.phases.join(" → ") : "(phases not captured)";
+    const lines = [
+        `When this situation recurs, the workflow "${run.name}" handled it end to end and its output passed verification.`,
+        "",
+    ];
+    if (run.description)
+        lines.push(`Intent: ${run.description}`);
+    lines.push(`Phases: ${phaseLine}`);
+    lines.push(`Verified by: ${run.verifyCommand}`);
+    lines.push("", "Replace this with the concrete steps, preconditions, and gotchas before promoting —", "the phase outline is the skeleton, not the full recipe.");
+    return {
+        id: `draft-workflow-${slug}`,
+        trigger: `Auto-detected from a verified workflow run: ${run.name}${run.description ? ` — ${run.description}` : ""}`,
+        body: lines.join("\n"),
+        confidence: DRAFT_CONFIDENCE,
+        domain: "workflow",
+        ngram: run.phases.length > 0 ? run.phases : [run.name],
+        occurrences: 1,
+        sessions: 1,
+        outcome: "workflow-verified",
+    };
+}

package/plugins/continuous-improvement/skills/README.md

@@ -18,7 +18,7 @@ skill set on disk.
 ## Tier 1 — beginner-mode pairing
 - `deploy-receipt` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline at the deploy seam. A merge into a branch that auto-deploys is not "done" until the deploy provider reports the merged commit SHA running and a healthcheck endpoint returns 200. Companion to the vendored `finishing-a-development-branch` skill — does not replace it, runs after it for projects on Railway, Cloudflare Workers, Vercel, Netlify, Fly.io, or any other auto-deploy target.
 - `gateguard` — Enforces Law 1 (Research Before Executing) of the 7 Laws of AI Agent Discipline. Fact-forcing gate that blocks Edit/Write/Bash (including MultiEdit) and demands concrete investigation (importers, data schemas, user instruction) before allowing the action. Measurably improves output quality by +2.25 points vs ungated agents.
-- `para-memory-files` — Enforces Law 5 (Reflect After Every Session) and Law 7 (Learn From Every Session) of the 7 Laws of AI Agent Discipline by giving the agent a durable file-based memory it can read on resume and write at session end. File-based memory system using Tiago Forte's PARA method. Use this skill whenever you need to store, retrieve, update, or organize knowledge across sessions. Covers three memory layers: (1) Knowledge graph in PARA folders with atomic YAML facts, (2) Daily notes as raw timeline, (3) Tacit knowledge about user patterns. Also handles planning files, memory decay, weekly synthesis, and recall via qmd. Trigger on any memory operation: saving facts, writing daily notes, creating entities, running weekly synthesis, recalling past context, or managing plans.
+- `model-forward` — Enforces all 7 Laws as a standing stance — go with Claude Code and the model, not against it. Skills are scaffolding that merges into the model over time; the durable core is goal-driven execution (the higher the stated goal, the better) plus self-discipline guardrails.
 - `recall` — Enforces Law 1 (Research Before Executing) of the 7 Laws of AI Agent Discipline. Makes past sessions first-class research material by searching the observation log with BM25 ranking, so 'have I hit this before?' is answerable before re-deriving a fix or repeating a mistake.
 - `tdd-workflow` — Enforces Law 3 (One Thing at a Time) and Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. Use this skill when writing new features, fixing bugs, or refactoring code. Enforces test-driven development with 80%+ coverage including unit, integration, and E2E tests.
 - `verification-loop` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. A comprehensive verification system for agent coding sessions covering build, types, lint, tests, security, and diff with a PASS/FAIL report.

package/plugins/continuous-improvement/skills/continuous-improvement/SKILL.md

@@ -6,7 +6,7 @@ description: "Install structured self-improvement loops with instinct-based lear
 
 # continuous-improvement
 
-You follow the continuous-improvement framework. These 7 laws govern all your work.
+You follow the continuous-improvement framework. These 7 laws make every task sharper — each is a capability that compounds: research deeper, plan tighter, verify with evidence, reflect, and learn so the same lesson is never re-taught.
 
 ## Law 1: Research Before Executing
 

package/plugins/continuous-improvement/skills/gateguard/SKILL.md

@@ -136,7 +136,7 @@ This gate is what catches the squash-merge / ahead-of-origin trap recorded in th
 
 ### Today: runtime hook + skill (zero install beyond the plugin)
 
-`hooks/gateguard.mjs` is bundled with this plugin and wired as the first PreToolUse hook in `plugins/continuous-improvement/hooks/hooks.json`. When you install the plugin, the runtime gate is live — no extra config, no opt-in. The hook reads tool input from stdin, classifies it through a data-driven routing table (Read/Grep/Glob → allow, Write/Edit/MultiEdit → mutating-file gate, Bash → destructive-pattern check), and emits `{decision, reason?}` on stdout. Per-session state lives at `~/.claude/instincts/<project-hash>/gateguard-session.json` (override via `GATEGUARD_SESSION_DIR` for tests) and caps cumulative clearances at `MAX_CLEARED_FILES = 50`.
+`hooks/gateguard.mjs` is bundled with this plugin and wired as the first PreToolUse hook in `plugins/continuous-improvement/hooks/hooks.json`. When you install the plugin, the runtime gate is live — no extra config, no opt-in. The hook reads tool input from stdin, classifies it through a data-driven routing table (Read/Grep/Glob → allow, Write/Edit/MultiEdit → mutating-file gate, Bash → destructive-pattern check), and emits `{decision, reason?}` on stdout. Per-session state lives at `~/.claude/instincts/<project-hash>/sessions/<session-id>/gateguard-session.json` — scoped by the stdin `session_id` so the cap never bleeds across concurrent sessions (it falls back to the unscoped `<project-hash>/` dir when no session id is present, and `GATEGUARD_SESSION_DIR` overrides it for tests). The cap is `MAX_CLEARED_FILES = 50` per session, and the state self-heals after `STATE_TTL_MS` so a stale gate never needs a manual `rm`.
 
 Smoke-test the runtime gate after install: ask Claude to write a throwaway file with no research first. The hook should return a `block` decision with a fact-list reason; Claude should pause rather than write.
 
@@ -150,10 +150,10 @@ The block reason prints the exact `gateguard-session.json` path and the clearanc
 
 The inline `_gateguard_facts_presented: true` retry still works on harnesses that forward unknown tool params, but Claude Code's strict tool schema (`additionalProperties: false`) rejects it with `InputValidationError` — use one of the above on Claude Code.
 
-### V1 honest limitations (not mitigated, documented)
+### Limitations and guarantees
 
-- **Honor system.** Clearance is recorded by `ci_gateguard_clear`, the `gateguard-clear.mjs` CLI, a manual state-file write, or the inline `_gateguard_facts_presented` flag where the harness allows it (see "Clearing the gate" above). The hook can't verify the investigation actually happened; the 50-file cap bounds damage from stuck loops or rogue agents.
-- **State-file deletion.** `rm`-ing the session state resets every gate. Acceptable because the session itself is the trust boundary.
+- **Honor system.** Clearance is recorded by `ci_gateguard_clear`, the `gateguard-clear.mjs` CLI, a manual state-file write, or the inline `_gateguard_facts_presented` flag where the harness allows it (see "Clearing the gate" above). The hook can't verify the investigation actually happened; the 50-file cap — counted per session — bounds damage from stuck loops or rogue agents.
+- **State-file deletion / self-heal.** `rm`-ing the session state resets every gate. Because state is scoped per session (`sessions/<session-id>/`), the session is a real trust boundary, not one shared across concurrent runs. A stale state file also self-heals once its `created_at` ages past `STATE_TTL_MS`, so a manual `rm` is rarely needed.
 - **Parallel-hook race.** Two simultaneous hook invocations can race the read+write of the state file. Acceptable trade-off vs Windows atomic-rename complexity.
 
 **MultiEdit per-file gating.** The hook clears and checks every `edits[]` path individually, so a mixed-clearance batch blocks until *all* edited files are cleared or facts are presented. The block reason now names the whole batch, not just the first uncleared path.

package/plugins/continuous-improvement/skills/goal-monitor/SKILL.md

@@ -77,5 +77,5 @@ ci_goal_check goal_file=docs/x.md  # score against a specific plan file
 ## Pairs With
 
 - **`proceed-with-the-recommendation`** (orchestrator, Law 2) — run a goal check at phase boundaries to confirm the plan still matches the work.
-- **`para-memory-files`** / planning-with-files — the `## Goal` section this skill reads is the same one those workflows write.
+- **planning-with-files** — the `## Goal` section this skill reads is the same one that workflow writes.
 - **`strategic-compact`** — before compacting a long session, a goal check confirms what the session was actually about.

package/plugins/continuous-improvement/skills/handoff/SKILL.md

@@ -51,7 +51,6 @@ Anything that is already captured elsewhere gets a path or URL pointer, not a du
 ## Companion / alternative skills
 
 - [`strategic-compact`](./strategic-compact.md) — compact the current session at a phase boundary instead of writing a handoff doc. Use when the session continues with the same agent.
-- [`para-memory-files`](./para-memory-files.md) — durable cross-session memory under `~/.claude/memory/`. Use for classified facts (user, project, feedback, reference), not per-session handoff briefs.
 - `superpowers:writing-plans` — produce the plan doc the handoff can reference instead of duplicating.
 
 ## Attribution