continuous-improvement 3.12.3 → 3.16.0

package/plugins/continuous-improvement/instinct-packs/react.json

@@ -1,58 +1,58 @@
-[
-  {
-    "id": "react-check-existing-components",
-    "trigger": "when creating a new React component",
-    "body": "Search the codebase for existing components that solve the same problem before creating new ones. Check shared/, components/, and ui/ directories.",
-    "confidence": 0.65,
-    "domain": "workflow"
-  },
-  {
-    "id": "react-prefer-server-components",
-    "trigger": "when creating components in Next.js App Router",
-    "body": "Default to Server Components. Only add 'use client' when the component needs useState, useEffect, event handlers, or browser APIs.",
-    "confidence": 0.7,
-    "domain": "patterns"
-  },
-  {
-    "id": "react-key-prop-lists",
-    "trigger": "when rendering lists with .map()",
-    "body": "Always use a stable, unique key prop. Never use array index as key unless the list is static and never reordered.",
-    "confidence": 0.7,
-    "domain": "patterns"
-  },
-  {
-    "id": "react-effect-cleanup",
-    "trigger": "when writing useEffect with subscriptions or timers",
-    "body": "Always return a cleanup function from useEffect when setting up subscriptions, event listeners, or timers to prevent memory leaks.",
-    "confidence": 0.7,
-    "domain": "patterns"
-  },
-  {
-    "id": "react-memo-expensive",
-    "trigger": "when a component re-renders with expensive calculations",
-    "body": "Use useMemo for expensive computations and React.memo for components that receive the same props frequently. Don't memo everything — only what's measurably slow.",
-    "confidence": 0.6,
-    "domain": "patterns"
-  },
-  {
-    "id": "react-form-validation",
-    "trigger": "when building forms",
-    "body": "Check if react-hook-form or zod is already in the project before building custom form validation. Prefer library solutions over hand-rolled validation.",
-    "confidence": 0.65,
-    "domain": "tooling"
-  },
-  {
-    "id": "react-error-boundary",
-    "trigger": "when adding a new page or route",
-    "body": "Ensure error boundaries exist around new pages/routes. In Next.js App Router, add error.tsx. In other React apps, wrap with ErrorBoundary component.",
-    "confidence": 0.6,
-    "domain": "patterns"
-  },
-  {
-    "id": "react-test-user-behavior",
-    "trigger": "when writing React component tests",
-    "body": "Test user behavior, not implementation details. Use @testing-library/react. Query by role, label, or text — not by class name or test ID.",
-    "confidence": 0.65,
-    "domain": "testing"
-  }
-]
+[
+  {
+    "id": "react-check-existing-components",
+    "trigger": "when creating a new React component",
+    "body": "Search the codebase for existing components that solve the same problem before creating new ones. Check shared/, components/, and ui/ directories.",
+    "confidence": 0.65,
+    "domain": "workflow"
+  },
+  {
+    "id": "react-prefer-server-components",
+    "trigger": "when creating components in Next.js App Router",
+    "body": "Default to Server Components. Only add 'use client' when the component needs useState, useEffect, event handlers, or browser APIs.",
+    "confidence": 0.7,
+    "domain": "patterns"
+  },
+  {
+    "id": "react-key-prop-lists",
+    "trigger": "when rendering lists with .map()",
+    "body": "Always use a stable, unique key prop. Never use array index as key unless the list is static and never reordered.",
+    "confidence": 0.7,
+    "domain": "patterns"
+  },
+  {
+    "id": "react-effect-cleanup",
+    "trigger": "when writing useEffect with subscriptions or timers",
+    "body": "Always return a cleanup function from useEffect when setting up subscriptions, event listeners, or timers to prevent memory leaks.",
+    "confidence": 0.7,
+    "domain": "patterns"
+  },
+  {
+    "id": "react-memo-expensive",
+    "trigger": "when a component re-renders with expensive calculations",
+    "body": "Use useMemo for expensive computations and React.memo for components that receive the same props frequently. Don't memo everything — only what's measurably slow.",
+    "confidence": 0.6,
+    "domain": "patterns"
+  },
+  {
+    "id": "react-form-validation",
+    "trigger": "when building forms",
+    "body": "Check if react-hook-form or zod is already in the project before building custom form validation. Prefer library solutions over hand-rolled validation.",
+    "confidence": 0.65,
+    "domain": "tooling"
+  },
+  {
+    "id": "react-error-boundary",
+    "trigger": "when adding a new page or route",
+    "body": "Ensure error boundaries exist around new pages/routes. In Next.js App Router, add error.tsx. In other React apps, wrap with ErrorBoundary component.",
+    "confidence": 0.6,
+    "domain": "patterns"
+  },
+  {
+    "id": "react-test-user-behavior",
+    "trigger": "when writing React component tests",
+    "body": "Test user behavior, not implementation details. Use @testing-library/react. Query by role, label, or text — not by class name or test ID.",
+    "confidence": 0.65,
+    "domain": "testing"
+  }
+]

package/plugins/continuous-improvement/lib/gateguard-state.mjs

@@ -2,20 +2,25 @@
  * Gateguard per-session state.
  *
  * State file: <sessionDir>/gateguard-session.json. sessionDir resolves to
- * GATEGUARD_SESSION_DIR (env override, used by tests) or
- * ~/.claude/instincts/<projectHash>/ in production.
+ * GATEGUARD_SESSION_DIR (env override, used by tests), or in production to
+ * ~/.claude/instincts/<projectHash>/sessions/<sessionId>/ when the hook passes
+ * the stdin session_id, falling back to ~/.claude/instincts/<projectHash>/ when
+ * no session id is available. Per-session scoping is what stops the clearance
+ * cap from bleeding across concurrent same-day sessions on a multi-Claude host.
  *
- * V1 limitations (documented for honesty, not mitigated in code):
+ * Limitations and guarantees:
  * - Honor system: clearance is granted whenever the agent sets
  *   `_gateguard_facts_presented: true` in tool_input or has a prior per-file
  *   marker. The hook cannot verify that real investigation occurred.
  * - State-file deletion: rm'ing the state file resets every gate in the
- *   session. Defensible because the session itself is the trust boundary;
- *   the cap below limits cumulative damage.
+ *   session. Defensible because the session is the trust boundary — and with
+ *   per-session scoping that boundary is now real, not just asserted.
+ * - Self-heal: loadState treats a file older than STATE_TTL_MS (or one with an
+ *   unparseable created_at) as empty, so a stale gate never needs a manual rm.
  * - Concurrency: two parallel hook invocations can race the read+write.
  *   Acceptable trade-off vs OS-specific atomic-rename complexity on Windows.
- * - Cap: MAX_CLEARED_FILES caps the number of distinct files a single
- *   session can clear, bounding stuck-loop / rogue-agent damage.
+ * - Cap: MAX_CLEARED_FILES caps the distinct files ONE session can clear,
+ *   bounding stuck-loop / rogue-agent damage without affecting other sessions.
  */
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -23,14 +28,36 @@ import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
 export const MAX_CLEARED_FILES = 50;
-export function resolveSessionDir() {
+// A clearance file whose created_at is older than this self-heals to empty on
+// the next load, so a stale gate never needs a manual rm. Long enough not to
+// reset an active session mid-work; the real cross-session fix is the
+// per-session dir in resolveSessionDir below.
+export const STATE_TTL_MS = 12 * 60 * 60 * 1000; // 12h
+// The root that holds every project's gateguard + instinct state. The MCP
+// clearance route uses this to bound a caller-supplied state_path to this tree
+// so a hostile argument can't turn the clear into an arbitrary-write primitive.
+export function resolveInstinctsRoot() {
+    const home = process.env.HOME || process.env.USERPROFILE || homedir();
+    return join(home, ".claude", "instincts");
+}
+export function resolveSessionDir(sessionId) {
     const fromEnv = process.env.GATEGUARD_SESSION_DIR;
     if (fromEnv)
         return fromEnv;
-    const home = process.env.HOME || process.env.USERPROFILE || homedir();
     const projectRoot = resolveProjectRoot();
     const projectHash = createHash("sha256").update(canonicalizeProjectRoot(projectRoot)).digest("hex").slice(0, 12);
-    return join(home, ".claude", "instincts", projectHash);
+    const base = join(resolveInstinctsRoot(), projectHash);
+    const scoped = sanitizeSessionId(sessionId);
+    return scoped ? join(base, "sessions", scoped) : base;
+}
+// A session id flows into a directory name. Strip anything outside a safe
+// alphabet so a hostile or malformed id can't traverse (`../`) or break the
+// path, and cap the length. Returns "" for an absent/empty id, which the caller
+// treats as "no session" — the legacy unscoped dir, preserving back-compat.
+function sanitizeSessionId(sessionId) {
+    if (!sessionId)
+        return "";
+    return sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 64);
 }
 function resolveProjectRoot() {
     const fromEnv = process.env.CLAUDE_PROJECT_DIR;
@@ -49,21 +76,43 @@ function resolveProjectRoot() {
     }
     return "global";
 }
+function freshState() {
+    return { created_at: new Date().toISOString(), cleared_files: {} };
+}
+// A clearance file self-heals to empty once it ages out of STATE_TTL_MS, so a
+// stale gate never needs a manual rm. An unparseable created_at fails closed
+// (treated as expired) rather than living forever as a never-resetting gate.
+function isExpired(createdAt) {
+    const created = Date.parse(createdAt);
+    if (Number.isNaN(created))
+        return true;
+    return Date.now() - created > STATE_TTL_MS;
+}
 export function loadState(sessionDir) {
     const path = join(sessionDir, "gateguard-session.json");
     if (!existsSync(path)) {
-        return { created_at: new Date().toISOString(), cleared_files: {} };
+        return freshState();
     }
     try {
         const raw = readFileSync(path, "utf8");
         const parsed = JSON.parse(raw);
+        // Absent created_at is treated as expired (fail closed), like an unparseable
+        // one — never a never-resetting gate. On expiry we persist the new epoch
+        // immediately so the cap re-applies from zero on the very next load;
+        // otherwise every load before the next clear would independently reset and a
+        // TTL-crossing session could clear well past MAX_CLEARED_FILES.
+        if (!parsed.created_at || isExpired(parsed.created_at)) {
+            const reset = freshState();
+            saveState(sessionDir, reset);
+            return reset;
+        }
         return {
-            created_at: parsed.created_at ?? new Date().toISOString(),
+            created_at: parsed.created_at,
             cleared_files: parsed.cleared_files ?? {},
         };
     }
     catch {
-        return { created_at: new Date().toISOString(), cleared_files: {} };
+        return freshState();
     }
 }
 export function saveState(sessionDir, state) {

package/plugins/continuous-improvement/lib/goal-state.mjs

@@ -20,10 +20,14 @@ const STOPWORDS = new Set([
     "task", "goal", "plan", "work", "working", "build", "building", "code",
 ]);
 // 4 suits Latin/Cyrillic/Thai prose (Thai combining marks are now kept; see
-// extractKeywordsFromProse regex), but it silently drops most Korean words
-// (typically 2 chars). A script-aware floor for Korean is a logged follow-up
-// (see CLAUDE.md Deferred).
+// extractKeywordsFromProse regex). Korean Hangul words are typically 2-3 chars
+// but represent full concepts, so they get a script-aware floor of 2.
 const KEYWORD_MIN_LENGTH = 4;
+function keywordMinLengthFor(word) {
+    if (/\p{Script=Hangul}/u.test(word))
+        return 2;
+    return KEYWORD_MIN_LENGTH;
+}
 const KEYWORD_CAP = 20;
 const DEFAULT_WINDOW = 30;
 const DEFAULT_THRESHOLD = 0.3;
@@ -61,7 +65,7 @@ export function extractKeywordsFromProse(prose) {
     const out = [];
     for (const raw of prose.toLowerCase().split(/[^\p{L}\p{N}\p{M}]+/u)) {
         const word = raw.trim();
-        if (word.length < KEYWORD_MIN_LENGTH)
+        if (word.length < keywordMinLengthFor(word))
             continue;
         if (/^\p{N}+$/u.test(word))
             continue;

package/plugins/continuous-improvement/lib/hook-pack-gate.mjs

@@ -0,0 +1,65 @@
+// hook-pack-gate.mts — Pure decision core for the enforcing-hook pack (v1).
+//
+// No I/O. Given a raw Bash command string, the resolved current branch, the
+// staged-file count, and the operator's mode, decide allow / warn / block.
+// The hook (src/hooks/hook-pack.mts) wires stdin + git subprocess calls around
+// these functions; keeping them pure lets the unit tests cover every branch
+// without spawning anything. Lives in lib/ so tests can import it (the
+// test-imports-only invariant forbids importing from hooks/).
+//
+// Fail-open by construction: callers pass safe defaults (null branch, 0 staged)
+// on any failure, and an unrecognized mode resolves to warn.
+export const COMMIT_FILE_LIMIT = 15;
+const ALLOW = { action: "allow", reason: "" };
+export function parseMode(raw) {
+    const v = (raw ?? "warn").trim().toLowerCase();
+    return v === "block" || v === "off" ? v : "warn";
+}
+// Match `git push` / `git commit` at the start of the command or immediately
+// after a shell separator (newline, ;, |, &). This deliberately does NOT match
+// a mention like `echo git push`, where git is an argument, not the command.
+export function classifyCommand(command) {
+    if (/(?:^|[\n;|&])\s*git\s+push\b/.test(command))
+        return "push";
+    if (/(?:^|[\n;|&])\s*git\s+commit\b/.test(command))
+        return "commit";
+    return "other";
+}
+export function isProtectedBranch(branch) {
+    return branch === "main" || branch === "master" || /^release\//.test(branch);
+}
+// Extract the explicit destination branch of a `git push`, or null when none is
+// given (the caller should then fall back to the current branch). Handles
+// `git push <remote> <branch>`, `git push -u <remote> <branch>`, and refspecs
+// like `HEAD:main` (destination after the colon).
+function parsePushTarget(command) {
+    const tokens = command.split(/\s+/).filter(Boolean);
+    const pushIdx = tokens.findIndex((t, i) => t === "push" && tokens[i - 1] === "git");
+    if (pushIdx === -1)
+        return null;
+    const operands = tokens.slice(pushIdx + 1).filter((t) => !t.startsWith("-"));
+    // operands[0] is the remote; operands[1] is the refspec. Fewer than two means
+    // no explicit branch (e.g. `git push` or `git push origin`).
+    if (operands.length < 2)
+        return null;
+    const refspec = operands[1];
+    return refspec.includes(":") ? (refspec.split(":").pop() ?? null) : refspec;
+}
+export function evaluatePush(command, currentBranch) {
+    if (/(?:^|\s)--dry-run\b/.test(command))
+        return { gated: false, branch: null };
+    const branch = parsePushTarget(command) ?? currentBranch;
+    if (!branch)
+        return { gated: false, branch: null };
+    return { gated: isProtectedBranch(branch), branch };
+}
+export function evaluateCommitSize(command, stagedCount) {
+    if (/(?:^|\s)--amend\b/.test(command))
+        return { gated: false };
+    return { gated: stagedCount > COMMIT_FILE_LIMIT };
+}
+export function decide(mode, gated, reason) {
+    if (!gated || mode === "off")
+        return ALLOW;
+    return { action: mode === "block" ? "block" : "warn", reason };
+}

package/plugins/continuous-improvement/lib/plugin-metadata.mjs

@@ -26,7 +26,7 @@ const KEYWORDS = [
     "transcript-linter",
 ];
 const CLAUDE_PLUGIN_CATEGORY = "productivity";
-const SHARED_PLUGIN_DESCRIPTION = "Makes Claude Code reason harder, recall past corrections, and learn from every session so its competence compounds run over run. The Mulahazah engine turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time — no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 25 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.";
+const SHARED_PLUGIN_DESCRIPTION = "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 26 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.";
 // Four vendored upstream companions registered alongside the CI plugin.
 // Each entry points at a pinned-SHA snapshot under third-party/<name>/.
 // See third-party/MANIFEST.md for refresh recipes and per-snapshot
@@ -143,6 +143,10 @@ const BEGINNER_TOOL_ENTRIES = [
                     type: "string",
                     description: "A single file path to clear (alternative to file_paths)",
                 },
+                state_path: {
+                    type: "string",
+                    description: "State-file path from the GateGuard block reason (the session-scoped gateguard-session.json). Pass it verbatim so the clearance lands in the session the hook is reading; it must resolve inside ~/.claude/instincts/. Omitting it falls back to the unscoped canonical dir — safe only in legacy (no session id) contexts; when the hook is session-scoped, omitting it writes to the wrong dir and the retry will still block.",
+                },
             },
             required: [],
         },
@@ -373,10 +377,16 @@ const EXPERT_TOOL_ENTRIES = [
             required: ["id"],
         },
     },
+    {
+        name: "ci_distill_from_workflow",
+        description: "Draft a reusable instinct from the most recent completed-and-verified native Workflow run in this project's observation feed. A Workflow script is an authored recipe, so a single run whose output passed verification is enough — unlike ci_distill_candidates, which needs a pattern repeated across sessions. Writes a DRAFT to drafts/ (a skeleton you edit); it changes no behavior until promoted with ci_distill_promote. Returns a message when no verified workflow run is found.",
+        manifestWhat: "Draft a reusable instinct from a verified Workflow run",
+        inputSchema: { type: "object", properties: {}, required: [] },
+    },
 ];
 const MODE_METADATA = {
     beginner: {
-        description: "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles four grounding skills (gateguard, para-memory-files, tdd-workflow, verification-loop) so research, memory, tests, and verification happen by default — every edit starts from facts, not guesses.",
+        description: "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles three grounding skills (gateguard, tdd-workflow, verification-loop) so research, memory, tests, and verification happen by default — every edit starts from facts, not guesses.",
         hooks: ["PreToolUse", "PostToolUse", "UserPromptSubmit"],
         hookDescription: "Silently captures every tool call as observations and routes prompts to the matching skill via the route table. Lightweight and non-blocking.",
     },
@@ -457,6 +467,11 @@ export function getPluginHooksConfig() {
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/companion-preference.mjs\"",
         timeout: 5,
     };
+    const hookPackCommand = {
+        type: "command",
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/hook-pack.mjs\"",
+        timeout: 5,
+    };
     const observeCommand = {
         type: "command",
         command: "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/observe.sh\"",
@@ -477,6 +492,11 @@ export function getPluginHooksConfig() {
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/goal-drift-stop.mjs\"",
         timeout: 5,
     };
+    const workflowDistillCommand = {
+        type: "command",
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/workflow-distill.mjs\"",
+        timeout: 5,
+    };
     const routePromptCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/route-prompt.mjs\"",
@@ -488,7 +508,7 @@ export function getPluginHooksConfig() {
         timeout: 5,
     };
     return {
-        description: "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
+        description: "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
         hooks: {
             // gateguard runs FIRST on PreToolUse so its block decision short-circuits
             // before companion-preference sees the call. companion-preference runs
@@ -501,12 +521,18 @@ export function getPluginHooksConfig() {
             // through with no output.
             PreToolUse: [
                 { hooks: [gateguardCommand, companionPreferenceCommand] },
+                // hook-pack gates Bash `git push` to protected branches and oversized
+                // `git commit`s. The "Bash" matcher scopes it off the hot path for all
+                // non-Bash tools, so the two-subprocess note above still holds for
+                // Edit/Read/etc. Warn-default (CLAUDE_CI_HOOKPACK_GATE) — never blocks
+                // until the operator opts in.
+                { matcher: "Bash", hooks: [hookPackCommand] },
             ],
             PostToolUse: [{ hooks: [observeCommand] }],
             UserPromptSubmit: [{ hooks: [routePromptCommand, recallBriefingCommand] }],
             SessionStart: [{ hooks: [sessionCommand] }],
             SessionEnd: [{ hooks: [sessionCommand] }],
-            Stop: [{ hooks: [threeSectionCloseCommand, goalDriftStopCommand] }],
+            Stop: [{ hooks: [threeSectionCloseCommand, goalDriftStopCommand, workflowDistillCommand] }],
         },
     };
 }

package/plugins/continuous-improvement/lib/skill-distill.mjs

@@ -220,3 +220,144 @@ export function formatCandidates(candidates, limit = 10) {
     }
     return lines.join("\n");
 }
+// ── Workflow-run → instinct bridge ───────────────────────────────────────────
+// A native Workflow run (Opus 4.8 orchestration / ultracode) is recorded in the
+// observation feed as a `tool: "Workflow"` row whose input_summary holds
+// {"script":"..."} — truncated (~500 chars), but meta.name/description/phases sit
+// at the head of the script and survive. The output_summary holds
+// {"status","runId",...} with status "async_launched": the feed captures the
+// LAUNCH, not the result. So a workflow's success is never read from the Workflow
+// row itself — it is inferred from a following verify-exit-0 in the same feed.
+//
+// Unlike findCandidates (which needs a pattern recurring across >=2 sessions to
+// reject coincidence), a Workflow script is an AUTHORED recipe: one verified run
+// warrants a draft, so the session/occurrence thresholds do not apply here.
+const WORKFLOW_TOOL = "Workflow";
+// Pull meta.name / meta.description / meta.phases[].title out of a (possibly
+// truncated) workflow script embedded as JSON in the observation input_summary.
+// Fail-closed: returns null unless a name is recoverable — a recipe with no
+// identity is never fabricated.
+function parseWorkflowScript(inputSummary) {
+    if (!inputSummary)
+        return null;
+    let script = "";
+    try {
+        const parsed = JSON.parse(inputSummary);
+        if (typeof parsed.script === "string")
+            script = parsed.script;
+    }
+    catch {
+        // input_summary may itself be truncated mid-JSON; recover the script field loosely.
+        const m = inputSummary.match(/"script"\s*:\s*"((?:[^"\\]|\\.)*)/);
+        if (m) {
+            try {
+                script = JSON.parse(`"${m[1]}"`);
+            }
+            catch {
+                script = m[1].replace(/\\n/g, "\n").replace(/\\"/g, '"').replace(/\\'/g, "'");
+            }
+        }
+    }
+    if (!script)
+        return null;
+    // Scope name/description to the meta head (text before `phases:`) so a phase
+    // object's own description: is never mistaken for meta.description; scope phase
+    // titles to the phases array literal so inline agent/step title: fields are not
+    // captured. The capture classes exclude quotes and newlines, so a hostile
+    // name/description cannot inject lines into the draft YAML — serializeDraft emits
+    // trigger as a quoted scalar.
+    const phasesAt = script.search(/\bphases\s*:/);
+    const metaHead = phasesAt >= 0 ? script.slice(0, phasesAt) : script;
+    const name = (metaHead.match(/\bname\s*:\s*['"]([^'"\r\n]+)['"]/) ?? [])[1] ?? "";
+    if (!name)
+        return null; // fail closed: no recipe identity
+    const description = (metaHead.match(/\bdescription\s*:\s*['"]([^'"\r\n]+)['"]/) ?? [])[1] ?? "";
+    const phasesBlock = (script.match(/\bphases\s*:\s*\[([^\]]*)\]/) ?? [])[1] ?? "";
+    const phases = [];
+    const phaseRe = /\btitle\s*:\s*['"]([^'"\r\n]+)['"]/g;
+    let pm;
+    while ((pm = phaseRe.exec(phasesBlock)) !== null)
+        phases.push(pm[1]);
+    return { name, description, phases };
+}
+// A single verify-exit-0 Bash row: a verify/test/build command whose output is not
+// failing. Mirrors classifyTrajectorySuccess's verify branch for one observation.
+function isVerifySuccessRow(observation) {
+    if ((observation.tool ?? "") !== "Bash")
+        return false;
+    const input = (observation.input_summary ?? "").toString();
+    const output = (observation.output_summary ?? "").toString();
+    return VERIFY_CMD.test(input) && !FAILURE_MARKER.test(output) && (output === "" || SUCCESS_MARKER.test(output));
+}
+/**
+ * Detect the most recent completed-and-verified Workflow run in an observation
+ * list. Returns null (fail closed) unless: a `tool: "Workflow"` row carries a
+ * parseable script with a name, AND a verify-exit-0 row follows it in the feed.
+ * The trailing verify is the only success signal — the Workflow row records the
+ * launch, never the result.
+ */
+export function workflowRunFromObservations(observations) {
+    let wfIndex = -1;
+    let meta = null;
+    for (let i = observations.length - 1; i >= 0; i -= 1) {
+        if ((observations[i].tool ?? "") !== WORKFLOW_TOOL)
+            continue;
+        const parsed = parseWorkflowScript((observations[i].input_summary ?? "").toString());
+        if (parsed) {
+            wfIndex = i;
+            meta = parsed;
+            break;
+        }
+    }
+    if (wfIndex === -1 || !meta)
+        return null;
+    const wfSession = (observations[wfIndex].session ?? "").toString();
+    // The verify that proves the run must follow the Workflow row in the SAME session.
+    // A verify from an unrelated later task (different session) does not count — the
+    // run is asynchronous, so an interleaved verify could otherwise falsely prove it.
+    let verifyCommand = "";
+    for (let i = wfIndex + 1; i < observations.length; i += 1) {
+        const row = observations[i];
+        if ((row.session ?? "").toString() !== wfSession)
+            continue;
+        if (isVerifySuccessRow(row)) {
+            verifyCommand = (row.input_summary ?? "").toString();
+            break;
+        }
+    }
+    if (!verifyCommand)
+        return null; // fail closed: no evidence the run's output landed
+    return { name: meta.name, description: meta.description, phases: meta.phases, verifyCommand };
+}
+/**
+ * Turn a verified Workflow run into a DRAFT instinct. The script's phase outline is
+ * a real skeleton (not a placeholder n-gram), but the human still edits the body
+ * before promoting. Reuses serializeDraft and the drafts/ ladder; the
+ * `draft-workflow-` id prefix marks the source and stays filesystem-safe.
+ */
+export function draftFromWorkflowRun(run) {
+    // Cap the slug so a hostile/huge meta.name cannot produce a path that trips
+    // ENAMETOOLONG on write; strip a trailing hyphen left by the cut.
+    const slug = slugifyNgram([run.name]).slice(0, 120).replace(/-+$/, "") || "workflow";
+    const phaseLine = run.phases.length > 0 ? run.phases.join(" → ") : "(phases not captured)";
+    const lines = [
+        `When this situation recurs, the workflow "${run.name}" handled it end to end and its output passed verification.`,
+        "",
+    ];
+    if (run.description)
+        lines.push(`Intent: ${run.description}`);
+    lines.push(`Phases: ${phaseLine}`);
+    lines.push(`Verified by: ${run.verifyCommand}`);
+    lines.push("", "Replace this with the concrete steps, preconditions, and gotchas before promoting —", "the phase outline is the skeleton, not the full recipe.");
+    return {
+        id: `draft-workflow-${slug}`,
+        trigger: `Auto-detected from a verified workflow run: ${run.name}${run.description ? ` — ${run.description}` : ""}`,
+        body: lines.join("\n"),
+        confidence: DRAFT_CONFIDENCE,
+        domain: "workflow",
+        ngram: run.phases.length > 0 ? run.phases : [run.name],
+        occurrences: 1,
+        sessions: 1,
+        outcome: "workflow-verified",
+    };
+}

package/plugins/continuous-improvement/skills/README.md

@@ -18,7 +18,7 @@ skill set on disk.
 ## Tier 1 — beginner-mode pairing
 - `deploy-receipt` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline at the deploy seam. A merge into a branch that auto-deploys is not "done" until the deploy provider reports the merged commit SHA running and a healthcheck endpoint returns 200. Companion to the vendored `finishing-a-development-branch` skill — does not replace it, runs after it for projects on Railway, Cloudflare Workers, Vercel, Netlify, Fly.io, or any other auto-deploy target.
 - `gateguard` — Enforces Law 1 (Research Before Executing) of the 7 Laws of AI Agent Discipline. Fact-forcing gate that blocks Edit/Write/Bash (including MultiEdit) and demands concrete investigation (importers, data schemas, user instruction) before allowing the action. Measurably improves output quality by +2.25 points vs ungated agents.
-- `para-memory-files` — Enforces Law 5 (Reflect After Every Session) and Law 7 (Learn From Every Session) of the 7 Laws of AI Agent Discipline by giving the agent a durable file-based memory it can read on resume and write at session end. File-based memory system using Tiago Forte's PARA method. Use this skill whenever you need to store, retrieve, update, or organize knowledge across sessions. Covers three memory layers: (1) Knowledge graph in PARA folders with atomic YAML facts, (2) Daily notes as raw timeline, (3) Tacit knowledge about user patterns. Also handles planning files, memory decay, weekly synthesis, and recall via qmd. Trigger on any memory operation: saving facts, writing daily notes, creating entities, running weekly synthesis, recalling past context, or managing plans.
+- `model-forward` — Enforces all 7 Laws as a standing stance — go with Claude Code and the model, not against it. Skills are scaffolding that merges into the model over time; the durable core is goal-driven execution (the higher the stated goal, the better) plus self-discipline guardrails.
 - `recall` — Enforces Law 1 (Research Before Executing) of the 7 Laws of AI Agent Discipline. Makes past sessions first-class research material by searching the observation log with BM25 ranking, so 'have I hit this before?' is answerable before re-deriving a fix or repeating a mistake.
 - `tdd-workflow` — Enforces Law 3 (One Thing at a Time) and Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. Use this skill when writing new features, fixing bugs, or refactoring code. Enforces test-driven development with 80%+ coverage including unit, integration, and E2E tests.
 - `verification-loop` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. A comprehensive verification system for agent coding sessions covering build, types, lint, tests, security, and diff with a PASS/FAIL report.
@@ -31,6 +31,7 @@ skill set on disk.
 - `handoff` — Enforces Law 5 (Reflect After Every Session) of the 7 Laws of AI Agent Discipline. Compact the current conversation into a handoff document for another agent to pick up. Ported from mattpocock/skills under MIT.
 - `reconcile` — Enforces Law 1 (Research Before Executing) of the 7 Laws of AI Agent Discipline. Establishes git ground truth — branch, status, stashes, worktrees, ahead/behind — before any mutation, halts on protected or destructive operations, and verifies a push actually landed instead of assuming it did.
 - `recovery-classification` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. After any failure in the verification ladder or auto-loop, classify the failure class before retrying — provider, tool-schema, deterministic-policy, git, worktree, runtime — so retry-vs-pause-vs-self-heal-vs-stop is an intentional decision, not a generic 'try again'.
+- `roast` — Enforces Law 1 (Research Before Executing) of the 7 Laws of AI Agent Discipline. Convene a 5-persona adversarial council (Contrarian, Expansionist, Logician, Researcher, Buyer) that attacks an idea from every angle, then a Judge returns one GO / RESHAPE / KILL verdict plus the cheapest 48-hour test to de-risk it — so you pressure-test an idea before sinking time into building the wrong thing.
 - `safety-guard` — Enforces Law 3 (One Thing at a Time) of the 7 Laws of AI Agent Discipline by scoping edits to a directory and blocking destructive shell commands. Use this skill to prevent destructive operations when working on production systems or running agents autonomously.
 - `skill-distillation` — Enforces Law 7 (Learn From Every Session) of the 7 Laws of AI Agent Discipline. Distills repeated successful tool sequences into reusable draft instincts, so a pattern that worked three times becomes a captured recipe instead of being re-derived from scratch every session.
 - `state-reconciliation` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. Pre-dispatch invariant: reconcile DB-vs-disk-vs-memory state before any unit runs, so a stale flag, missing artifact, or out-of-sync row never re-dispatches a unit that already completed or never started.

package/plugins/continuous-improvement/skills/gateguard/SKILL.md

@@ -136,7 +136,7 @@ This gate is what catches the squash-merge / ahead-of-origin trap recorded in th
 
 ### Today: runtime hook + skill (zero install beyond the plugin)
 
-`hooks/gateguard.mjs` is bundled with this plugin and wired as the first PreToolUse hook in `plugins/continuous-improvement/hooks/hooks.json`. When you install the plugin, the runtime gate is live — no extra config, no opt-in. The hook reads tool input from stdin, classifies it through a data-driven routing table (Read/Grep/Glob → allow, Write/Edit/MultiEdit → mutating-file gate, Bash → destructive-pattern check), and emits `{decision, reason?}` on stdout. Per-session state lives at `~/.claude/instincts/<project-hash>/gateguard-session.json` (override via `GATEGUARD_SESSION_DIR` for tests) and caps cumulative clearances at `MAX_CLEARED_FILES = 50`.
+`hooks/gateguard.mjs` is bundled with this plugin and wired as the first PreToolUse hook in `plugins/continuous-improvement/hooks/hooks.json`. When you install the plugin, the runtime gate is live — no extra config, no opt-in. The hook reads tool input from stdin, classifies it through a data-driven routing table (Read/Grep/Glob → allow, Write/Edit/MultiEdit → mutating-file gate, Bash → destructive-pattern check), and emits `{decision, reason?}` on stdout. Per-session state lives at `~/.claude/instincts/<project-hash>/sessions/<session-id>/gateguard-session.json` — scoped by the stdin `session_id` so the cap never bleeds across concurrent sessions (it falls back to the unscoped `<project-hash>/` dir when no session id is present, and `GATEGUARD_SESSION_DIR` overrides it for tests). The cap is `MAX_CLEARED_FILES = 50` per session, and the state self-heals after `STATE_TTL_MS` so a stale gate never needs a manual `rm`.
 
 Smoke-test the runtime gate after install: ask Claude to write a throwaway file with no research first. The hook should return a `block` decision with a fact-list reason; Claude should pause rather than write.
 
@@ -150,10 +150,10 @@ The block reason prints the exact `gateguard-session.json` path and the clearanc
 
 The inline `_gateguard_facts_presented: true` retry still works on harnesses that forward unknown tool params, but Claude Code's strict tool schema (`additionalProperties: false`) rejects it with `InputValidationError` — use one of the above on Claude Code.
 
-### V1 honest limitations (not mitigated, documented)
+### Limitations and guarantees
 
-- **Honor system.** Clearance is recorded by `ci_gateguard_clear`, the `gateguard-clear.mjs` CLI, a manual state-file write, or the inline `_gateguard_facts_presented` flag where the harness allows it (see "Clearing the gate" above). The hook can't verify the investigation actually happened; the 50-file cap bounds damage from stuck loops or rogue agents.
-- **State-file deletion.** `rm`-ing the session state resets every gate. Acceptable because the session itself is the trust boundary.
+- **Honor system.** Clearance is recorded by `ci_gateguard_clear`, the `gateguard-clear.mjs` CLI, a manual state-file write, or the inline `_gateguard_facts_presented` flag where the harness allows it (see "Clearing the gate" above). The hook can't verify the investigation actually happened; the 50-file cap — counted per session — bounds damage from stuck loops or rogue agents.
+- **State-file deletion / self-heal.** `rm`-ing the session state resets every gate. Because state is scoped per session (`sessions/<session-id>/`), the session is a real trust boundary, not one shared across concurrent runs. A stale state file also self-heals once its `created_at` ages past `STATE_TTL_MS`, so a manual `rm` is rarely needed.
 - **Parallel-hook race.** Two simultaneous hook invocations can race the read+write of the state file. Acceptable trade-off vs Windows atomic-rename complexity.
 
 **MultiEdit per-file gating.** The hook clears and checks every `edits[]` path individually, so a mixed-clearance batch blocks until *all* edited files are cleared or facts are presented. The block reason now names the whole batch, not just the first uncleared path.