continuous-improvement 3.12.3 → 3.16.0

package/lib/skill-distill.mjs

@@ -220,3 +220,144 @@ export function formatCandidates(candidates, limit = 10) {
     }
     return lines.join("\n");
 }
+// ── Workflow-run → instinct bridge ───────────────────────────────────────────
+// A native Workflow run (Opus 4.8 orchestration / ultracode) is recorded in the
+// observation feed as a `tool: "Workflow"` row whose input_summary holds
+// {"script":"..."} — truncated (~500 chars), but meta.name/description/phases sit
+// at the head of the script and survive. The output_summary holds
+// {"status","runId",...} with status "async_launched": the feed captures the
+// LAUNCH, not the result. So a workflow's success is never read from the Workflow
+// row itself — it is inferred from a following verify-exit-0 in the same feed.
+//
+// Unlike findCandidates (which needs a pattern recurring across >=2 sessions to
+// reject coincidence), a Workflow script is an AUTHORED recipe: one verified run
+// warrants a draft, so the session/occurrence thresholds do not apply here.
+const WORKFLOW_TOOL = "Workflow";
+// Pull meta.name / meta.description / meta.phases[].title out of a (possibly
+// truncated) workflow script embedded as JSON in the observation input_summary.
+// Fail-closed: returns null unless a name is recoverable — a recipe with no
+// identity is never fabricated.
+function parseWorkflowScript(inputSummary) {
+    if (!inputSummary)
+        return null;
+    let script = "";
+    try {
+        const parsed = JSON.parse(inputSummary);
+        if (typeof parsed.script === "string")
+            script = parsed.script;
+    }
+    catch {
+        // input_summary may itself be truncated mid-JSON; recover the script field loosely.
+        const m = inputSummary.match(/"script"\s*:\s*"((?:[^"\\]|\\.)*)/);
+        if (m) {
+            try {
+                script = JSON.parse(`"${m[1]}"`);
+            }
+            catch {
+                script = m[1].replace(/\\n/g, "\n").replace(/\\"/g, '"').replace(/\\'/g, "'");
+            }
+        }
+    }
+    if (!script)
+        return null;
+    // Scope name/description to the meta head (text before `phases:`) so a phase
+    // object's own description: is never mistaken for meta.description; scope phase
+    // titles to the phases array literal so inline agent/step title: fields are not
+    // captured. The capture classes exclude quotes and newlines, so a hostile
+    // name/description cannot inject lines into the draft YAML — serializeDraft emits
+    // trigger as a quoted scalar.
+    const phasesAt = script.search(/\bphases\s*:/);
+    const metaHead = phasesAt >= 0 ? script.slice(0, phasesAt) : script;
+    const name = (metaHead.match(/\bname\s*:\s*['"]([^'"\r\n]+)['"]/) ?? [])[1] ?? "";
+    if (!name)
+        return null; // fail closed: no recipe identity
+    const description = (metaHead.match(/\bdescription\s*:\s*['"]([^'"\r\n]+)['"]/) ?? [])[1] ?? "";
+    const phasesBlock = (script.match(/\bphases\s*:\s*\[([^\]]*)\]/) ?? [])[1] ?? "";
+    const phases = [];
+    const phaseRe = /\btitle\s*:\s*['"]([^'"\r\n]+)['"]/g;
+    let pm;
+    while ((pm = phaseRe.exec(phasesBlock)) !== null)
+        phases.push(pm[1]);
+    return { name, description, phases };
+}
+// A single verify-exit-0 Bash row: a verify/test/build command whose output is not
+// failing. Mirrors classifyTrajectorySuccess's verify branch for one observation.
+function isVerifySuccessRow(observation) {
+    if ((observation.tool ?? "") !== "Bash")
+        return false;
+    const input = (observation.input_summary ?? "").toString();
+    const output = (observation.output_summary ?? "").toString();
+    return VERIFY_CMD.test(input) && !FAILURE_MARKER.test(output) && (output === "" || SUCCESS_MARKER.test(output));
+}
+/**
+ * Detect the most recent completed-and-verified Workflow run in an observation
+ * list. Returns null (fail closed) unless: a `tool: "Workflow"` row carries a
+ * parseable script with a name, AND a verify-exit-0 row follows it in the feed.
+ * The trailing verify is the only success signal — the Workflow row records the
+ * launch, never the result.
+ */
+export function workflowRunFromObservations(observations) {
+    let wfIndex = -1;
+    let meta = null;
+    for (let i = observations.length - 1; i >= 0; i -= 1) {
+        if ((observations[i].tool ?? "") !== WORKFLOW_TOOL)
+            continue;
+        const parsed = parseWorkflowScript((observations[i].input_summary ?? "").toString());
+        if (parsed) {
+            wfIndex = i;
+            meta = parsed;
+            break;
+        }
+    }
+    if (wfIndex === -1 || !meta)
+        return null;
+    const wfSession = (observations[wfIndex].session ?? "").toString();
+    // The verify that proves the run must follow the Workflow row in the SAME session.
+    // A verify from an unrelated later task (different session) does not count — the
+    // run is asynchronous, so an interleaved verify could otherwise falsely prove it.
+    let verifyCommand = "";
+    for (let i = wfIndex + 1; i < observations.length; i += 1) {
+        const row = observations[i];
+        if ((row.session ?? "").toString() !== wfSession)
+            continue;
+        if (isVerifySuccessRow(row)) {
+            verifyCommand = (row.input_summary ?? "").toString();
+            break;
+        }
+    }
+    if (!verifyCommand)
+        return null; // fail closed: no evidence the run's output landed
+    return { name: meta.name, description: meta.description, phases: meta.phases, verifyCommand };
+}
+/**
+ * Turn a verified Workflow run into a DRAFT instinct. The script's phase outline is
+ * a real skeleton (not a placeholder n-gram), but the human still edits the body
+ * before promoting. Reuses serializeDraft and the drafts/ ladder; the
+ * `draft-workflow-` id prefix marks the source and stays filesystem-safe.
+ */
+export function draftFromWorkflowRun(run) {
+    // Cap the slug so a hostile/huge meta.name cannot produce a path that trips
+    // ENAMETOOLONG on write; strip a trailing hyphen left by the cut.
+    const slug = slugifyNgram([run.name]).slice(0, 120).replace(/-+$/, "") || "workflow";
+    const phaseLine = run.phases.length > 0 ? run.phases.join(" → ") : "(phases not captured)";
+    const lines = [
+        `When this situation recurs, the workflow "${run.name}" handled it end to end and its output passed verification.`,
+        "",
+    ];
+    if (run.description)
+        lines.push(`Intent: ${run.description}`);
+    lines.push(`Phases: ${phaseLine}`);
+    lines.push(`Verified by: ${run.verifyCommand}`);
+    lines.push("", "Replace this with the concrete steps, preconditions, and gotchas before promoting —", "the phase outline is the skeleton, not the full recipe.");
+    return {
+        id: `draft-workflow-${slug}`,
+        trigger: `Auto-detected from a verified workflow run: ${run.name}${run.description ? ` — ${run.description}` : ""}`,
+        body: lines.join("\n"),
+        confidence: DRAFT_CONFIDENCE,
+        domain: "workflow",
+        ngram: run.phases.length > 0 ? run.phases : [run.name],
+        occurrences: 1,
+        sessions: 1,
+        outcome: "workflow-verified",
+    };
+}

package/lib/version-check.mjs

@@ -0,0 +1,115 @@
+// version-check.mts — Pure update-check decision core + a thin npm-registry fetch
+// helper. The decision functions take no ambient I/O: the caller injects the local
+// version, the fetched remote version, the cached state, and the clock, so the whole
+// thing is unit-testable offline (mirrors how the goal-state / recall scorers are
+// structured). The ONLY network is fetchLatestNpmVersion, which fails closed
+// (returns null) on any error. No telemetry: a one-way read of the public registry.
+//
+// Wired into bin/install.mts at install end so the nudge only appears when the user
+// explicitly invokes the CLI. See docs/plans/2026-06-25-version-check-nudge.md.
+// Two-tier TTL, copied from gstack: poll often while up-to-date so a release is
+// caught quickly, then back off once an upgrade is known so the nudge is not
+// re-fetched on every invocation.
+export const TTL_UP_TO_DATE_MS = 60 * 60 * 1000; // 60 min
+export const TTL_UPGRADE_MS = 12 * 60 * 60 * 1000; // 720 min
+const NPM_REGISTRY = "https://registry.npmjs.org";
+/** Parse "a.b.c" (ignoring a leading v and any -prerelease/+build suffix) into a
+ *  numeric triple. Fail closed: any non-numeric core component returns null. */
+export function parseSemver(version) {
+    if (typeof version !== "string")
+        return null;
+    const core = version.trim().replace(/^v/, "").split(/[-+]/)[0] ?? "";
+    const parts = core.split(".");
+    if (parts.length !== 3)
+        return null;
+    const nums = parts.map((p) => (/^\d+$/.test(p) ? Number(p) : NaN));
+    if (nums.some((n) => !Number.isFinite(n)))
+        return null;
+    return [nums[0], nums[1], nums[2]];
+}
+/** Is `remote` a strictly higher release than `local`? Non-semver on either side
+ *  fails closed to false (never nudge on garbage; never nudge a dev build that is
+ *  ahead of or equal to the registry). */
+export function isNewer(remote, local) {
+    const r = parseSemver(remote);
+    const l = parseSemver(local);
+    if (!r || !l)
+        return false;
+    for (let i = 0; i < 3; i += 1) {
+        if (r[i] > l[i])
+            return true;
+        if (r[i] < l[i])
+            return false;
+    }
+    return false;
+}
+/** Should the network fetch be skipped because the cached result is still fresh?
+ *  Absent/NaN checkedAt fails OPEN (fetch) — a corrupt cache must not wedge the
+ *  check off permanently. */
+export function isThrottled(cache, now) {
+    if (!cache || typeof cache.checkedAt !== "number" || !Number.isFinite(cache.checkedAt))
+        return false;
+    const ttl = cache.status === "upgrade-available" ? TTL_UPGRADE_MS : TTL_UP_TO_DATE_MS;
+    return now - cache.checkedAt < ttl;
+}
+function buildNotice(local, remote) {
+    return (`continuous-improvement ${remote} is available (you have ${local}). ` +
+        "Update: marketplace → /plugin marketplace update continuous-improvement, " +
+        "or npm → npx continuous-improvement install. Silence: CLAUDE_CI_UPDATE_CHECK=off");
+}
+/** Re-surface a still-valid pending upgrade straight from the cache, so a throttled
+ *  invocation does not lose the nudge. Returns null unless the cache says an upgrade
+ *  is pending AND that cached remote is still newer than the current local. */
+export function pendingNotice(cache, local) {
+    if (!cache || cache.status !== "upgrade-available")
+        return null;
+    if (typeof cache.remote !== "string" || !isNewer(cache.remote, local))
+        return null;
+    return buildNotice(local, cache.remote);
+}
+/** The pure decision from a fresh fetch. `remote === null` (fetch failed) yields
+ *  `unknown` with no notice and no cache write, so the next invocation retries
+ *  rather than caching a false "up-to-date". */
+export function evaluateUpdateCheck(args) {
+    const { local, remote, now } = args;
+    if (remote === null || parseSemver(remote) === null) {
+        return { status: "unknown", notice: null, nextCache: null };
+    }
+    if (isNewer(remote, local)) {
+        return {
+            status: "upgrade-available",
+            notice: buildNotice(local, remote),
+            nextCache: { status: "upgrade-available", local, remote, checkedAt: now },
+        };
+    }
+    return {
+        status: "up-to-date",
+        notice: null,
+        nextCache: { status: "up-to-date", local, remote, checkedAt: now },
+    };
+}
+/** Fetch the `latest` dist-tag version for a package from the public npm registry.
+ *  The only network in this module. Fails closed (returns null) on any error:
+ *  timeout, non-2xx, malformed JSON, or a non-semver version string. fetchImpl and
+ *  timeoutMs are injectable so callers and tests stay offline-deterministic. */
+export async function fetchLatestNpmVersion(pkg, opts = {}) {
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function")
+        return null;
+    try {
+        const res = await fetchImpl(`${NPM_REGISTRY}/${pkg}/latest`, {
+            headers: { Accept: "application/vnd.npm.install-v1+json" },
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 5000),
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const version = typeof body.version === "string" ? body.version : null;
+        if (!version || parseSemver(version) === null)
+            return null;
+        return version;
+    }
+    catch {
+        return null;
+    }
+}

package/llms.txt

@@ -1,10 +1,10 @@
 # continuous-improvement
 
-> Makes Claude Code reason harder, recall past corrections, and learn from every session so its competence compounds run over run. The Mulahazah engine turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time — no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 25 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.
+> The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 26 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.
 
 ## What This Is
 
-An intelligence amplifier for AI coding agents. It makes Claude reason at a higher level on every task, recall the corrections it has already received, and learn from each session so its competence compounds over time — research, plan, execute one thing at a time, verify, reflect, iterate, learn — building behavioral instincts via the Mulahazah learning system, so the same correction never has to be given twice and each run starts smarter than the last.
+The persistent-memory and discipline layer for AI coding agents. It carries the corrections Claude has already received from one session into the next, grounds each edit in real facts before it lands, and learns from every session so its competence compounds over time — research, plan, execute one thing at a time, verify, reflect, iterate, learn — building behavioral instincts via the Mulahazah learning system, so the same correction never has to be given twice and each run starts smarter than the last. Orchestration tools run a task; this is the layer that makes the lessons survive the run.
 
 ## Install
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "continuous-improvement",
-  "version": "3.12.3",
-  "description": "Makes Claude Code reason harder, recall past corrections, and learn from every session so its competence compounds run over run. The Mulahazah engine turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time — no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 25 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts. Beginner: one /plugin install command. Expert: adds MCP tools and session hooks.",
+  "version": "3.16.0",
+  "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 26 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts. Beginner: one /plugin install command. Expert: adds MCP tools and session hooks.",
   "keywords": [
     "claude-code",
     "claude-code-skill",
@@ -29,7 +29,8 @@
   "bin": {
     "continuous-improvement": "bin/install.mjs",
     "ci-lint-transcript": "bin/lint-transcript.mjs",
-    "ci": "bin/unified-cli.mjs"
+    "ci": "bin/unified-cli.mjs",
+    "ci-plan-pack": "bin/plan-pack.mjs"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json && node bin/generate-plugin-manifests.mjs && node -e \"const fs=require('node:fs'); for (const f of fs.readdirSync('bin')) { if (f.endsWith('.mjs')) fs.chmodSync('bin/'+f, 0o755); } for (const f of fs.readdirSync('hooks')) { if (f.endsWith('.mjs')) fs.chmodSync('hooks/'+f, 0o755); } for (const f of fs.readdirSync('lib')) { if (f.endsWith('.mjs')) fs.chmodSync('lib/'+f, 0o755); } for (const f of fs.readdirSync('plugins/continuous-improvement/bin')) { if (f.endsWith('.mjs')) fs.chmodSync('plugins/continuous-improvement/bin/'+f, 0o755); } for (const f of fs.readdirSync('plugins/continuous-improvement/lib')) { if (f.endsWith('.mjs')) fs.chmodSync('plugins/continuous-improvement/lib/'+f, 0o755); } for (const f of fs.readdirSync('plugins/continuous-improvement/hooks')) { if (f.endsWith('.mjs')) fs.chmodSync('plugins/continuous-improvement/hooks/'+f, 0o755); } for (const f of fs.readdirSync('scripts')) { if (f.endsWith('.mjs')) fs.chmodSync('scripts/'+f, 0o755); } for (const f of fs.readdirSync('synthetic-checks')) { if (f.endsWith('.mjs')) fs.chmodSync('synthetic-checks/'+f, 0o755); } \"",
@@ -43,6 +44,7 @@
     "verify:skill-tiers": "node bin/check-skill-tiers.mjs",
     "verify:skill-law-tag": "node bin/check-skill-law-tag.mjs",
     "verify:skill-count": "node bin/check-skill-count.mjs",
+    "verify:skill-count-prose": "node bin/check-skill-count-prose.mjs",
     "verify:docs-substrings": "node bin/check-docs-substrings.mjs",
     "verify:everything-mirror": "node bin/check-everything-mirror.mjs",
     "verify:routing-targets": "node bin/check-routing-targets.mjs",
@@ -51,7 +53,7 @@
     "verify:scripts-citation-drift": "node bin/check-scripts-citation-drift.mjs",
     "verify:third-party-shape": "node bin/check-third-party-shape.mjs",
     "verify:tool-count": "node bin/check-tool-count.mjs",
-    "verify:all": "npm run verify:skill-mirror && npm run verify:skill-tiers && npm run verify:skill-law-tag && npm run verify:skill-count && npm run verify:docs-substrings && npm run verify:everything-mirror && npm run verify:routing-targets && npm run verify:doc-runtime-claims && npm run verify:test-imports-only && npm run verify:scripts-citation-drift && npm run verify:third-party-shape && npm run verify:tool-count && npm run typecheck"
+    "verify:all": "npm run verify:skill-mirror && npm run verify:skill-tiers && npm run verify:skill-law-tag && npm run verify:skill-count && npm run verify:skill-count-prose && npm run verify:docs-substrings && npm run verify:everything-mirror && npm run verify:routing-targets && npm run verify:doc-runtime-claims && npm run verify:test-imports-only && npm run verify:scripts-citation-drift && npm run verify:third-party-shape && npm run verify:tool-count && npm run typecheck"
   },
   "files": [
     ".claude-plugin/",

package/plugins/beginner.json

@@ -1,8 +1,8 @@
 {
   "name": "continuous-improvement",
-  "version": "3.12.3",
+  "version": "3.16.0",
   "mode": "beginner",
-  "description": "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles four grounding skills (gateguard, para-memory-files, tdd-workflow, verification-loop) so research, memory, tests, and verification happen by default — every edit starts from facts, not guesses.",
+  "description": "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles three grounding skills (gateguard, tdd-workflow, verification-loop) so research, memory, tests, and verification happen by default — every edit starts from facts, not guesses.",
   "tools": [
     {
       "name": "ci_status",

package/plugins/continuous-improvement/.claude-plugin/marketplace.json

@@ -7,8 +7,8 @@
   "plugins": [
     {
       "name": "continuous-improvement",
-      "description": "Makes Claude Code reason harder, recall past corrections, and learn from every session so its competence compounds run over run. The Mulahazah engine turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time — no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 25 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
-      "version": "3.12.3",
+      "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 26 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
+      "version": "3.16.0",
       "source": "./",
       "author": {
         "name": "naimkatiman"

package/plugins/continuous-improvement/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "continuous-improvement",
-  "version": "3.12.3",
-  "description": "Makes Claude Code reason harder, recall past corrections, and learn from every session so its competence compounds run over run. The Mulahazah engine turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time — no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 25 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
+  "version": "3.16.0",
+  "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 26 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
   "author": {
     "name": "naimkatiman",
     "url": "https://github.com/naimkatiman"

package/plugins/continuous-improvement/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Naim Katiman
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Naim Katiman
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/plugins/continuous-improvement/README.md

@@ -35,7 +35,7 @@ the trade-off is fallback quality vs dedicated-skill quality.
 - `tdd-workflow` — RED/GREEN/REFACTOR + 80% coverage gate
 - `workspace-surface-audit` — environment + capability audit
 - Tier-1/Tier-2 enforcement skills (`gateguard`, `verification-loop`,
-  `para-memory-files`, `safety-guard`, `token-budget-advisor`,
+  `safety-guard`, `token-budget-advisor`,
   `strategic-compact`, `wild-risa-balance`)
 
 **Optional companions the orchestrator routes to (install separately if

package/plugins/continuous-improvement/bin/backfill.mjs

@@ -27,25 +27,25 @@ const args = process.argv.slice(2);
 const DRY_RUN = args.includes("--dry-run");
 const HELP = args.includes("--help") || args.includes("-h");
 if (HELP) {
-    console.log(`
-backfill — Tag legacy thin-schema observation rows.
-
-Usage:
-  npx continuous-improvement backfill            Tag rows in place
-  npx continuous-improvement backfill --dry-run  Report counts, write nothing
-
-What it does:
-  Walks ~/.claude/instincts/<hash>/observations.jsonl files and adds a
-  schema field ("thin" or "rich") to every row that lacks one. Thin rows
-  came from the legacy bash fallback (jq missing) and have no input_summary;
-  rich rows came from the Node observer and have full tool_input.command /
-  Edit.file_path / etc.
-
-Output:
-  - observations.jsonl rewritten in place (original kept as .bak)
-  - backfill-summary.json with per-project counts
-
-Idempotent. Always exits 0 — failures go to stderr only.
+    console.log(`
+backfill — Tag legacy thin-schema observation rows.
+
+Usage:
+  npx continuous-improvement backfill            Tag rows in place
+  npx continuous-improvement backfill --dry-run  Report counts, write nothing
+
+What it does:
+  Walks ~/.claude/instincts/<hash>/observations.jsonl files and adds a
+  schema field ("thin" or "rich") to every row that lacks one. Thin rows
+  came from the legacy bash fallback (jq missing) and have no input_summary;
+  rich rows came from the Node observer and have full tool_input.command /
+  Edit.file_path / etc.
+
+Output:
+  - observations.jsonl rewritten in place (original kept as .bak)
+  - backfill-summary.json with per-project counts
+
+Idempotent. Always exits 0 — failures go to stderr only.
 `);
     process.exit(0);
 }

package/plugins/continuous-improvement/bin/mcp-server.mjs

@@ -13,15 +13,15 @@
 import { execSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { createHash } from "node:crypto";
 import { PACKAGE_NAME, VERSION, getToolDefinitions, isPluginMode, } from "../lib/plugin-metadata.mjs";
 import { formatDriftReport, parseGoalFromPlan, scoreObservations, } from "../lib/goal-state.mjs";
 import { buildIndex, formatRecallHits, parseSince, query as queryRecall, } from "../lib/recall-index.mjs";
-import { draftFromCandidate, extractTrajectories, findCandidates, formatCandidates, serializeDraft, } from "../lib/skill-distill.mjs";
-import { MAX_CLEARED_FILES, clearFiles, resolveSessionDir, } from "../lib/gateguard-state.mjs";
+import { draftFromCandidate, draftFromWorkflowRun, extractTrajectories, findCandidates, formatCandidates, serializeDraft, workflowRunFromObservations, } from "../lib/skill-distill.mjs";
+import { MAX_CLEARED_FILES, canonicalizeFileKey, clearFiles, resolveInstinctsRoot, resolveSessionDir, } from "../lib/gateguard-state.mjs";
 function getHomeDir() {
     return process.env.HOME || process.env.USERPROFILE || homedir();
 }
@@ -219,6 +219,7 @@ function readDistillObservations(projectHash) {
         tool: getString(observation.tool),
         input_summary: getString(observation.input_summary),
         output_summary: getString(observation.output_summary),
+        event: getString(observation.event),
     }));
 }
 function detectLevel(projectHash) {
@@ -508,10 +509,11 @@ function handleTool(name, params) {
         }
         case "ci_gateguard_clear": {
             // Beginner-available on purpose: the GateGuard hook fires for every
-            // install, so the clearance action must too. Resolves the session dir via
-            // gateguard-state (canonical), the same way the hook does, so the marker
-            // lands where the hook looks regardless of how each process spelled the
-            // project root.
+            // install, so the clearance action must too. The hook's block reason now
+            // prints state_path (the session-scoped state file); honoring it writes
+            // the marker exactly where the hook looks. Without it the MCP server can't
+            // know the caller's session, so it falls back to the canonical session dir
+            // — correct only on the legacy unscoped path.
             const rawList = Array.isArray(params.file_paths) ? params.file_paths : [];
             const listPaths = rawList.filter((value) => typeof value === "string" && value.length > 0);
             const single = getString(params.file_path).trim();
@@ -519,7 +521,24 @@ function handleTool(name, params) {
             if (paths.length === 0) {
                 return error("file_paths is required — pass the file path(s) named in the GateGuard block reason, e.g. { file_paths: [\"src/x.ts\"] }.");
             }
-            const sessionDir = resolveSessionDir();
+            // state_path is a model-controlled argument, so it could be a traversal
+            // string (`../../etc/...`). dirname leaves `..` segments for the OS to
+            // resolve at write time, so without a bound this is an arbitrary-write
+            // primitive. Resolve + canonicalize, then require containment within the
+            // instincts root (the only tree the hook ever prints a state_path inside).
+            const rawStatePath = getString(params.state_path).trim();
+            let sessionDir;
+            if (rawStatePath) {
+                const resolvedKey = canonicalizeFileKey(resolve(rawStatePath));
+                const rootKey = canonicalizeFileKey(resolveInstinctsRoot());
+                if (resolvedKey !== rootKey && !resolvedKey.startsWith(`${rootKey}/`)) {
+                    return error("state_path must resolve inside ~/.claude/instincts/. Pass it verbatim from the GateGuard block reason.");
+                }
+                sessionDir = dirname(resolve(rawStatePath));
+            }
+            else {
+                sessionDir = resolveSessionDir();
+            }
             const { cleared, skippedForCap } = clearFiles(sessionDir, paths);
             const lines = [
                 "## GateGuard clearance",
@@ -837,6 +856,45 @@ function handleTool(name, params) {
                 "```",
             ].join("\n"));
         }
+        case "ci_distill_from_workflow": {
+            if (MODE !== "expert") {
+                return error("ci_distill_from_workflow requires expert mode");
+            }
+            const run = workflowRunFromObservations(readDistillObservations(project.hash));
+            if (!run) {
+                return text("No completed-and-verified Workflow run found in this project's observations. " +
+                    "A run qualifies when a `Workflow` tool call is followed by a passing verify/test/build in the same feed. " +
+                    "Run a workflow, verify its output, then try `ci_distill_from_workflow` again.");
+            }
+            const draftInstinct = draftFromWorkflowRun(run);
+            if (!isSafeDraftId(draftInstinct.id)) {
+                return error(`Internal error: generated draft id "${draftInstinct.id}" failed the safety check.`);
+            }
+            const draft = serializeDraft(draftInstinct);
+            const draftsDir = join(INSTINCTS_DIR, project.hash, "drafts");
+            const draftPath = join(draftsDir, `${draftInstinct.id}.yaml`);
+            try {
+                mkdirSync(draftsDir, { recursive: true });
+                writeFileSync(draftPath, draft);
+            }
+            catch (err) {
+                return error(`Failed to write draft to ${draftPath}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return text([
+                "## Draft written from a verified workflow run",
+                "",
+                `**Workflow:** ${run.name}`,
+                `**Path:** ${draftPath}`,
+                "",
+                "Edit the body to capture the real recipe (preconditions, concrete steps, gotchas), then promote with:",
+                "",
+                `  ci_distill_promote id=${draftInstinct.id}`,
+                "",
+                "```yaml",
+                draft.trimEnd(),
+                "```",
+            ].join("\n"));
+        }
         case "ci_distill_promote": {
             if (MODE !== "expert") {
                 return error("ci_distill_promote requires expert mode");