dsh-continual-evolve 0.15.11 → 0.15.13

package/lib/llm-call.js

@@ -0,0 +1,284 @@
+/**
+ * The transport for the plugin's own LLM calls. Every subagent call
+ * (`subagentDefs.ts` definitions loaded through `subagent.ts`) ends here.
+ *
+ * Four disciplines live in one place because all four were learned the hard
+ * way, and none of them is visible at a call site:
+ *
+ * - **The route.** `agent.options` carries an *explicit* selection only. A
+ *   session running on the host's default model carries nothing there, so the
+ *   route falls back to the host's `agentDefaultModel` service — the same
+ *   value the host Agent loop itself runs on. A caller that still has no
+ *   route refuses to send instead of streaming into a provider rejection.
+ * - **The reasoning effort.** An exact provider/model advertises the effort
+ *   ids it accepts, and a request naming one it does not accept is rejected
+ *   by capability validation before any provider I/O. The lowest *enabled*
+ *   effort the model advertises is used; a model with no reasoning metadata
+ *   gets no caller-supplied effort at all. This is the pre-teardown
+ *   `llm-text.ts` discipline (see the 2026-09-24 capability note), restored
+ *   after the direct calls that replaced that boundary shipped without it.
+ * - **The output budget.** A fixed budget is a guess about how much a model
+ *   spends before it answers, and a wrong guess cuts the answer off as
+ *   `max-tokens` — which reads in the ledger as a route fault (2026-10-13).
+ *   The exact model's own advertised per-request cap wins; the definition's
+ *   declared budget is only the fallback for adapters that advertise none.
+ * - **The failure.** A terminal `error`/`aborted` finish carries the host's
+ *   own failure object, and the stream has usually reported its usage by
+ *   then. Both now ride the thrown error: keeping only the `kind` produced a
+ *   ledger full of "stream finished with error", and discarding the usage
+ *   left failed calls with no model and no token account at all.
+ */
+/** Effort ids that mean "reasoning off"; a model may advertise only these. */
+export const CLOSED_REASONING_EFFORTS = new Set(["disabled", "off", "none"]);
+/**
+ * Select the lowest reasoning effort an exact model advertises.
+ *
+ * An enabled effort wins over a declared closing effort: the adapter's first
+ * enabled effort is the lowest enabled level it exposes, and a closing effort
+ * is only a fallback when the model publishes no enabled level at all. No
+ * capability list means no caller-supplied effort.
+ *
+ * @param modelInfo - Exact resolved-model metadata, when the provider exposes it.
+ * @returns The provider-owned effort id to send, or `undefined` to omit the field.
+ * @throws When the host reports reasoning metadata in a shape this plugin cannot trust.
+ */
+export function selectLowestReasoningEffort(modelInfo) {
+    const efforts = modelInfo?.reasoning?.efforts;
+    if (efforts === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(efforts)) {
+        throw new Error("continual-evolve: invalid model reasoning metadata");
+    }
+    const ids = [];
+    for (const effort of efforts) {
+        const id = effort?.id;
+        if (typeof id !== "string") {
+            throw new Error("continual-evolve: invalid model reasoning metadata");
+        }
+        ids.push(id);
+    }
+    return ids.find((id) => !CLOSED_REASONING_EFFORTS.has(id)) ?? ids[0];
+}
+/**
+ * The output budget to send for one exact route: the model's own advertised
+ * per-request cap when it has one, the caller's fallback otherwise.
+ *
+ * A budget below what the model needs is not a cost saving — it is a
+ * truncation. Deriving it from the model's capability (the same source the
+ * reasoning effort comes from) is what keeps one model's answer from being
+ * cut off at a number chosen for another model's habits.
+ *
+ * @param modelInfo - Exact resolved-model metadata, when the provider exposes it.
+ * @param fallbackMaxTokens - The definition's declared budget.
+ * @returns The budget to send.
+ * @throws When the host reports a max-tokens capability this plugin cannot trust.
+ */
+export function selectMaxTokens(modelInfo, fallbackMaxTokens) {
+    const advertised = modelInfo?.defaultMaxTokens;
+    if (advertised === undefined) {
+        return fallbackMaxTokens;
+    }
+    if (typeof advertised !== "number" || !Number.isInteger(advertised) || advertised <= 0) {
+        throw new Error("continual-evolve: invalid model max-tokens metadata");
+    }
+    return advertised;
+}
+/**
+ * One failed call, carrying what the stream observed before it failed.
+ *
+ * The model and the tokens of a *failed* call are exactly what the ledger
+ * could not answer for (2026-10-13): the route and usage existed in memory
+ * and were dropped on the way out. They ride the error now, so every failure
+ * path can account for itself the same way a success does.
+ */
+export class SubagentCallError extends Error {
+    /** Usage payload observed before the failure, `undefined` when the stream never reported one. */
+    usage;
+    /** The terminal finish kind, `undefined` when the stream failed before reporting one. */
+    finish;
+    /** The route the failed call ran on. */
+    route;
+    constructor(message, observed) {
+        super(message, observed.cause === undefined ? undefined : { cause: observed.cause });
+        this.name = "SubagentCallError";
+        this.usage = observed.usage;
+        this.finish = observed.finish;
+        this.route = observed.route;
+    }
+}
+/**
+ * The usage a failed call had already observed, for the ledger.
+ *
+ * @param error - Whatever a call threw.
+ * @returns The observed usage payload, or `undefined` when the failure carries none.
+ */
+export function observedUsageOf(error) {
+    return error instanceof SubagentCallError ? error.usage : undefined;
+}
+/**
+ * The host's default model selection, when the host exposes that service.
+ *
+ * The service is read through `ctx.get` and never joins an inject list: a host
+ * without it (or an older one) must keep working, and a failed read is simply
+ * "no default", never a mount failure.
+ *
+ * @param get - The host context's sibling-service reader, when available.
+ * @returns The default provider/model (plus effort), or `undefined` when unknown.
+ */
+export function defaultRouteOf(get) {
+    if (get === undefined) {
+        return undefined;
+    }
+    let service;
+    try {
+        service = get("agentDefaultModel");
+    }
+    catch {
+        // An absent service is not an error here: the caller falls back to refusing.
+        return undefined;
+    }
+    const currentSelection = service?.currentSelection;
+    if (typeof currentSelection !== "function") {
+        return undefined;
+    }
+    try {
+        return selectionOf(currentSelection.call(service));
+    }
+    catch {
+        // A throwing service is "no default" — the refusal path stays reachable.
+        return undefined;
+    }
+}
+/**
+ * Resolve the route one direct call runs on: the agent's explicit selection
+ * first, the host default second.
+ *
+ * @param agent - The host Agent the call belongs to (its `options` may be empty).
+ * @param get - The host context's sibling-service reader, when available.
+ * @returns The route to call with, or `undefined` when there is none to use.
+ */
+export function resolveCallRoute(agent, get) {
+    const options = agent?.options;
+    return selectionOf(options) ?? defaultRouteOf(get);
+}
+/** Narrow one candidate selection object; empty strings count as absent. */
+function selectionOf(value) {
+    if (typeof value !== "object" || value === null) {
+        return undefined;
+    }
+    const { provider, model, reasoningEffort } = value;
+    if (typeof provider !== "string" || provider.length === 0) {
+        return undefined;
+    }
+    if (typeof model !== "string" || model.length === 0) {
+        return undefined;
+    }
+    return typeof reasoningEffort === "string" && reasoningEffort.length > 0
+        ? { provider, model, reasoningEffort }
+        : { provider, model };
+}
+/**
+ * Stream one single-turn text call on one route.
+ *
+ * A terminal `error` or `aborted` finish always throws, carrying the host's own
+ * failure text — partial text never rescues a failed call. A `max-tokens` cut
+ * is *not* thrown here: a gate answer often completes before its budget does,
+ * so the caller owns that verdict and reads `finish`.
+ *
+ * @param llm - The LLM service; `undefined` means the host exposed no route at all.
+ * @param route - The exact provider/model to call.
+ * @param sessionId - The host Agent identity providers use for request routing.
+ * @param system - The system prompt for this call.
+ * @param prompt - The user prompt for this call.
+ * @param fallbackMaxTokens - Output budget to use when the model advertises no cap of its own.
+ * @returns The assembled text, usage, finish kind, and chosen effort.
+ * @throws On a missing LLM service, capability lookup failure, terminal provider error or abort, and empty output.
+ */
+export async function streamOnce(llm, route, sessionId, system, prompt, fallbackMaxTokens) {
+    if (llm === undefined) {
+        throw new Error("no llm route");
+    }
+    const dials = await resolveDials(llm, route, fallbackMaxTokens);
+    let text = "";
+    let usage;
+    let finish;
+    try {
+        for await (const chunk of llm.stream({
+            provider: route.provider,
+            model: route.model,
+            messages: [{ role: "user", content: [{ type: "text", text: prompt }] }],
+            system,
+            maxTokens: dials.maxTokens,
+            sessionId,
+            ...(dials.reasoningEffort === undefined ? {} : { reasoningEffort: dials.reasoningEffort }),
+        })) {
+            const piece = chunk;
+            if (piece?.type === "text-delta" && typeof piece.text === "string") {
+                text += piece.text;
+            }
+            else if (piece?.type === "usage") {
+                usage = piece.usage;
+            }
+            else if (piece?.type === "finish") {
+                finish = piece.reason;
+            }
+        }
+    }
+    catch (error) {
+        // A provider that dies mid-stream still reported what it spent: the
+        // observation survives the failure so the ledger can show it.
+        throw new SubagentCallError(failureHeadOf(error), { usage, finish: finish?.kind, route, cause: error });
+    }
+    const finishKind = finish?.kind;
+    if (finishKind === "error" || finishKind === "aborted") {
+        throw new SubagentCallError(failureTextOf(finishKind, finish?.failure), { usage, finish: finishKind, route });
+    }
+    if (text.trim().length === 0) {
+        // Nothing usable arrived: the finish reason is the only diagnosis.
+        throw new SubagentCallError(finishKind !== undefined && finishKind !== "stop" ? `stream finished with ${finishKind}` : "empty model output", { usage, finish: finishKind, route });
+    }
+    return { text, usage, finish: finishKind, reasoningEffort: dials.reasoningEffort };
+}
+/** One-line head of a mid-stream throw, flattened so the ledger row stays greppable. */
+function failureHeadOf(error) {
+    const message = error instanceof Error && error.message.length > 0 ? error.message : String(error);
+    return message.replace(/\s+/g, " ").trim();
+}
+/**
+ * Resolve both dials from one capability query.
+ *
+ * The host's capability query is the only source: an explicit selection's
+ * effort belongs to the *main* conversation and must not silently raise an
+ * auxiliary call's cost, and an explicit `maxTokens` belongs to nothing here.
+ * No query (older host, test fake) means no effort and the caller's budget.
+ */
+async function resolveDials(llm, route, fallbackMaxTokens) {
+    if (typeof llm.resolveModelInfo !== "function") {
+        return { reasoningEffort: undefined, maxTokens: fallbackMaxTokens };
+    }
+    const modelInfo = await llm.resolveModelInfo(route.provider, route.model);
+    return {
+        reasoningEffort: selectLowestReasoningEffort(modelInfo),
+        maxTokens: selectMaxTokens(modelInfo, fallbackMaxTokens),
+    };
+}
+/** Render a terminal failure for the ledger: host code plus host message. */
+function failureTextOf(kind, failure) {
+    const detail = failureDetailOf(failure);
+    return detail === undefined ? `stream finished with ${kind}` : `LLM call ${kind}: ${detail}`;
+}
+/** Flatten the host failure object to `code: message` when either is present. */
+function failureDetailOf(failure) {
+    if (typeof failure !== "object" || failure === null) {
+        return undefined;
+    }
+    const { code, message } = failure;
+    const head = typeof message === "string" && message.length > 0 ? message : undefined;
+    const label = typeof code === "string" && code.length > 0 ? code : undefined;
+    if (head !== undefined && label !== undefined) {
+        return `${label}: ${head}`;
+    }
+    return head ?? label;
+}
+//# sourceMappingURL=llm-call.js.map

package/lib/review-candidates.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The review queue: which stored items are due for a close look.
+ *
+ * The queue is rebuilt from the store on every drain (no cursor of its own):
+ * new items first, then corrects-linked requeues, then items untouched past
+ * the staleness window. One row whose last verdict never produced an item
+ * decision is still queued — "reviewed but nothing happened" is not progress.
+ */
+import type { MemoryStore } from "./store.js";
+import type { ReviewCandidate } from "./review.js";
+/**
+ * Collect review candidates across every workspace carrying active items:
+ * new items first (newest first), then corrects-linked requeues, then stale
+ * requeues (`staleDays`, default 30). Bounded by `limit`.
+ *
+ * @param store - The central store, sole source of the queue.
+ * @param opts - Clock override (tests), staleness window, and queue bound.
+ * @returns Candidates ordered by priority.
+ */
+export declare function collectCandidates(store: MemoryStore, opts?: {
+    now?: number | undefined;
+    staleDays?: number | undefined;
+    limit?: number | undefined;
+}): ReviewCandidate[];
+//# sourceMappingURL=review-candidates.d.ts.map

package/lib/review-candidates.js

@@ -0,0 +1,113 @@
+/**
+ * Collect review candidates across every workspace carrying active items:
+ * new items first (newest first), then corrects-linked requeues, then stale
+ * requeues (`staleDays`, default 30). Bounded by `limit`.
+ *
+ * @param store - The central store, sole source of the queue.
+ * @param opts - Clock override (tests), staleness window, and queue bound.
+ * @returns Candidates ordered by priority.
+ */
+export function collectCandidates(store, opts = {}) {
+    const now = opts.now ?? Date.now();
+    const staleMs = (opts.staleDays ?? 30) * 24 * 60 * 60 * 1000;
+    const limit = opts.limit ?? 100;
+    const fresh = [];
+    const requeued = [];
+    const stale = [];
+    // One push per enumerated row: store primary keys make (workspace, kind,
+    // id) unique, so no dedup set is needed — a duplicate here would mean a
+    // store invariant broke, and failing loud beats silently merging.
+    const push = (candidate) => {
+        (candidate.priority === 0 ? fresh : candidate.priority === 1 ? requeued : stale).push(candidate);
+    };
+    const partitions = new Set();
+    for (const summary of store.listWorkspaces()) {
+        partitions.add(summary.workspaceId);
+    }
+    for (const summary of store.listSkillWorkspaces()) {
+        partitions.add(summary.workspaceId);
+    }
+    partitions.add("");
+    for (const workspaceId of partitions) {
+        const correctsTargets = new Set();
+        const memories = store.listAll(workspaceId);
+        for (const record of memories) {
+            if (record.corrects !== null && record.corrects.length > 0) {
+                correctsTargets.add(record.corrects);
+            }
+        }
+        for (const record of memories) {
+            if (record.status !== "active") {
+                continue;
+            }
+            const state = store.reviewStateOf(workspaceId, "memory", record.id);
+            const updatedAt = Date.parse(record.updatedAt) || 0;
+            if (state === undefined) {
+                push({ workspaceId, kind: "memory", id: record.id, priority: 0, title: record.title, description: record.description, body: record.body, memoryType: record.type });
+            }
+            else if (correctsTargets.has(record.id)) {
+                push({ workspaceId, kind: "memory", id: record.id, priority: 1, title: record.title, description: record.description, body: record.body, memoryType: record.type });
+            }
+            else if (now - updatedAt >= staleMs) {
+                push({ workspaceId, kind: "memory", id: record.id, priority: 2, title: record.title, description: record.description, body: record.body, memoryType: record.type });
+            }
+        }
+        const projectSeen = new Set();
+        const skillsOf = (partition, scope) => {
+            for (const record of store.listAllSkills(partition)) {
+                if (record.status !== "active" || projectSeen.has(record.id)) {
+                    continue;
+                }
+                projectSeen.add(record.id);
+                const state = store.reviewStateOf(partition, "skill", record.id);
+                const updatedAt = Date.parse(record.updatedAt) || 0;
+                const candidate = {
+                    workspaceId: partition, kind: "skill", id: record.id,
+                    priority: state === undefined ? 0 : 2,
+                    title: record.title, description: record.description, body: record.body, scope,
+                };
+                if (state === undefined || now - updatedAt >= staleMs) {
+                    push(candidate);
+                }
+            }
+        };
+        if (workspaceId !== "") {
+            skillsOf(workspaceId, "project");
+        }
+    }
+    // Global skills ride along once (project rows shadow them per id).
+    skillsGlobal(store, now, staleMs, push);
+    const byPriority = (a, b) => (a.priority - b.priority);
+    return [...fresh, ...requeued, ...stale].sort(byPriority).slice(0, limit);
+}
+/** The global partition's skills, minus every id an active project row shadows. */
+function skillsGlobal(store, now, staleMs, push) {
+    const projectIds = new Set();
+    for (const summary of store.listSkillWorkspaces()) {
+        if (summary.workspaceId === "") {
+            continue;
+        }
+        for (const record of store.listAllSkills(summary.workspaceId)) {
+            // Archived rows shadow nothing (readWithScope shows the global
+            // row once the project row archives after a move-to-global).
+            if (record.status === "active") {
+                projectIds.add(record.id);
+            }
+        }
+    }
+    for (const record of store.listAllSkills("")) {
+        if (record.status !== "active" || projectIds.has(record.id)) {
+            continue;
+        }
+        const state = store.reviewStateOf("", "skill", record.id);
+        const updatedAt = Date.parse(record.updatedAt) || 0;
+        if (state === undefined || now - updatedAt >= staleMs) {
+            push({
+                workspaceId: "", kind: "skill", id: record.id,
+                priority: state === undefined ? 0 : 2,
+                title: record.title, description: record.description, body: record.body, scope: "global",
+            });
+        }
+    }
+}
+//# sourceMappingURL=review-candidates.js.map

package/lib/review-prompt.d.ts

@@ -10,8 +10,23 @@
  * body executability, reusability, non-duplicate). The prompts are
  * deliberately behavior-blind: there are no task datasets here (unlike
  * Hermes GEPA), only the item text plus its provenance.
+ *
+ * Each of the four review jobs has its own gate/evolve prompt pair, and the
+ * memory and skill rubrics contradict each other on home-ownership by design
+ * (a memory must survive having its repo name stripped; a project skill must
+ * not). Sharing one prompt between them is what made the review ring judge
+ * skills by the memory rubric.
+ */
+export declare const REVIEW_MEMORY_CHEAP_SYSTEM_PROMPT = "\u4F60\u662F\u8BB0\u5FC6\u5E93\u7684\u5185\u5BB9\u8BC4\u5BA1\u95E8\u3002\u5148\u8FC7\u5F52\u5C5E\u4E09\u6D4B\uFF1A\u2460\u4E3B\u8BED\u662F\u7528\u6237/\u73AF\u5883\u8FD8\u662F\u67D0\u4ED3\u5E93\u7684\u67D0\u7248\u673A\u5236\uFF08\u7248\u672C\u53F7\u3001\u9608\u503C\u3001\u5F00\u5173\u540D\u51FA\u73B0\u5373\u540E\u8005\uFF09\uFF1B\u2461\u62B9\u6389\u4ED3\u5E93\u540D\u7248\u672C\u53F7\u673A\u5236\u540D\u540E\u53E5\u5B50\u8FD8\u6210\u7ACB\u5417\uFF1B\u2462\u4ED3\u5E93\u4E8B\u5B9E\u4F4F ADR/docs\uFF0C\u8BB0\u5FC6\u53EA\u6536\u8DDF\u4EBA\u8D70\u7684\u3002\u5F52\u5C5E\u4E0D\u8FC7\u76F4\u63A5\u5224 false \u5E76\u6CE8\u660E\u653E\u9519\u5BB6\u3002\u518D\u5224\u503C\u4E0D\u503C\u5F97\u7EC6\u770B\uFF1A\u6709\u660E\u786E\u4E8B\u5B9E\u3001\u505A\u6CD5\u3001\u504F\u597D\u6216\u53EF\u590D\u7528\u89C4\u7A0B\u5C31\u6279\uFF1B\u7A7A\u8BDD\u3001\u7EAF\u8FC7\u7A0B\u8BB0\u5F55\u3001\u4E00\u6B21\u6027\u7684\u77AC\u65F6\u8F93\u51FA\u3001\u5F53\u8F6E\u5DF2\u53EF\u63A8\u5BFC\u7684\u4E00\u5F8B\u62D2\u3002\u53EA\u8F93\u51FA JSON\uFF1A{\"worthReview\": true|false, \"reason\": \"\u4E00\u53E5\u8BDD\"}\u3002";
+/**
+ * The skill cheap gate: the memory gate's rubric inverted on home-ownership.
+ * A skill bound to one repo's paths, gates and workflow cards is a *project
+ * skill* — its home test is the project, not the world — so the gate that
+ * fronted skills with the memory rubric rejected them for being exactly what
+ * they are. Every judgment here is scope-relative, and the scope rides the
+ * user prompt.
  */
-export declare const REVIEW_CHEAP_SYSTEM_PROMPT = "\u4F60\u662F\u8BB0\u5FC6\u5E93\u7684\u5185\u5BB9\u8BC4\u5BA1\u95E8\u3002\u5148\u8FC7\u5F52\u5C5E\u4E09\u6D4B\uFF1A\u2460\u4E3B\u8BED\u662F\u7528\u6237/\u73AF\u5883\u8FD8\u662F\u67D0\u4ED3\u5E93\u7684\u67D0\u7248\u673A\u5236\uFF08\u7248\u672C\u53F7\u3001\u9608\u503C\u3001\u5F00\u5173\u540D\u51FA\u73B0\u5373\u540E\u8005\uFF09\uFF1B\u2461\u62B9\u6389\u4ED3\u5E93\u540D\u7248\u672C\u53F7\u673A\u5236\u540D\u540E\u53E5\u5B50\u8FD8\u6210\u7ACB\u5417\uFF1B\u2462\u4ED3\u5E93\u4E8B\u5B9E\u4F4F ADR/docs\uFF0C\u8BB0\u5FC6\u53EA\u6536\u8DDF\u4EBA\u8D70\u7684\u3002\u5F52\u5C5E\u4E0D\u8FC7\u76F4\u63A5\u5224 false \u5E76\u6CE8\u660E\u653E\u9519\u5BB6\u3002\u518D\u5224\u503C\u4E0D\u503C\u5F97\u7EC6\u770B\uFF1A\u6709\u660E\u786E\u4E8B\u5B9E\u3001\u505A\u6CD5\u3001\u504F\u597D\u6216\u53EF\u590D\u7528\u89C4\u7A0B\u5C31\u6279\uFF1B\u7A7A\u8BDD\u3001\u7EAF\u8FC7\u7A0B\u8BB0\u5F55\u3001\u4E00\u6B21\u6027\u7684\u77AC\u65F6\u8F93\u51FA\u3001\u5F53\u8F6E\u5DF2\u53EF\u63A8\u5BFC\u7684\u4E00\u5F8B\u62D2\u3002\u53EA\u8F93\u51FA JSON\uFF1A{\"worthReview\": true|false, \"reason\": \"\u4E00\u53E5\u8BDD\"}\u3002";
+export declare const REVIEW_SKILL_CHEAP_SYSTEM_PROMPT = "\u4F60\u662F\u6280\u80FD\u5E93\u7684\u5185\u5BB9\u8BC4\u5BA1\u95E8\u3002\u5148\u770B\u5F52\u5C5E\uFF08prompt \u91CC\u6807\u4E86 scope\uFF09\uFF1A\u7ED1\u5B9A\u67D0\u4ED3\u5E93\u7684\u8DEF\u5F84/\u95E8\u7981/\u6D41\u7A0B**\u4E0D\u662F**\u7F3A\u9677\u2014\u2014\u4F4F\u9879\u76EE\u5206\u533A\uFF08scope=project\uFF09\u7684\u6280\u80FD\u672C\u6765\u5C31\u53EA\u5728\u8BE5\u9879\u76EE\u5185\u751F\u6548\uFF0C\u7981\u7528\u300C\u8DE8\u9879\u76EE\u4E0D\u53EF\u590D\u7528\u300D\u300C\u62B9\u6389\u4ED3\u5E93\u540D\u4E0D\u6210\u7ACB\u300D\u5F53\u7406\u7531\u53BB\u62D2\u5B83\uFF1B\u53EA\u6709\u300Cscope=global \u5374\u7ED1\u5B9A\u67D0\u4ED3\u5E93\u300D\u624D\u7B97\u653E\u9519\u5BB6\uFF0C\u76F4\u63A5\u5224 false \u5E76\u6CE8\u660E\u3002\u518D\u5224\u503C\u4E0D\u503C\u5F97\u7EC6\u770B\uFF1Adescription \u8BA9\u4EBA\u5728\u8BE5\u7528\u65F6\u60F3\u5F97\u8D77\u3001\u6B63\u6587\u6B65\u9AA4\u53EF\u6267\u884C\u3001\u6709\u53EF\u590D\u7528\u7684\u89C4\u7A0B\u5C31\u6279\uFF1B\u7A7A\u8BDD\u3001\u4E00\u6B21\u6027\u8F93\u51FA\u3001\u7EAF\u8FC7\u7A0B\u8BB0\u5F55\u3001\u4E0E\u65E2\u6709\u6280\u80FD\u91CD\u590D\u7684\u4E00\u5F8B\u62D2\u3002\u53EA\u8F93\u51FA JSON\uFF1A{\"worthReview\": true|false, \"reason\": \"\u4E00\u53E5\u8BDD\"}\u3002";
 /** Memory rubric: accurate, usable, reusable, non-duplicate, fresh, right-home. */
 export declare const REVIEW_MEMORY_SYSTEM_PROMPT = "\u4F60\u662F\u8BB0\u5FC6\u5E93\u7684\u5185\u5BB9\u8BC4\u5BA1\u3002\u5148\u8FC7\u5F52\u5C5E\u4E09\u6D4B\uFF08\u4E3B\u8BED\u662F\u7528\u6237/\u73AF\u5883\u8FD8\u662F\u67D0\u4ED3\u5E93\u7684\u67D0\u7248\u673A\u5236\uFF1B\u62B9\u6389\u4ED3\u5E93\u540D\u7248\u672C\u53F7\u673A\u5236\u540D\u540E\u8FD8\u6210\u7ACB\u5417\uFF1B\u4ED3\u5E93\u4E8B\u5B9E\u4F4F ADR/docs\uFF09\uFF1A\u5F52\u5C5E\u4E0D\u8FC7\u76F4\u63A5 quarantine \u5E76\u6CE8\u660E\u653E\u9519\u5BB6\u3002\u518D\u6309\u4E94\u7EF4\u5224\uFF1A\u2460\u51C6\u786E\uFF08\u4E8B\u5B9E\u53EF\u4FE1\u3001\u65E0\u5E7B\u89C9\uFF09\uFF1B\u2461\u53EF\u7528\uFF08Why/How \u5177\u4F53\u3001\u53EF\u6267\u884C\uFF0C\u53CD\u9988\u7C7B\u5FC5\u987B\u5E26 Why \u4E0E How to apply\uFF09\uFF1B\u2462\u53EF\u590D\u7528\uFF08\u672A\u6765\u4F1A\u8BDD\u7528\u5F97\u4E0A\uFF09\uFF1B\u2463\u4E0D\u91CD\u590D\uFF08\u4E0E\u5019\u9009\u65E7\u6761\u6BD4\uFF0C\u6709\u91CD\u590D\u5C31\u6307\u51FA\u6765\uFF09\uFF1B\u2464\u4E0D\u8FC7\u65F6\uFF08\u672A\u88AB\u7EA0\u6B63\u94FE\u53D6\u4EE3\uFF09\u3002\u53EA\u8F93\u51FA JSON\uFF1A{\"verdict\": \"keep|rewrite|quarantine\", \"reason\": \"\u4E00\u53E5\u8BDD\", \"title\"?: \"\u6539\u5199\u540E\u6807\u9898\", \"description\"?: \"\u6539\u5199\u540E\u94A9\u5B50\", \"body\"?: \"\u6539\u5199\u540E\u6B63\u6587\u5168\u6587\", \"corrects\"?: \"\u88AB\u53D6\u4EE3\u7684\u540C\u533A\u6761\u76EEid\"}\u3002verdict \u8BF4\u660E\uFF1Akeep=\u4E0D\u52A8\uFF1Brewrite=\u7ED9\u51FA\u6539\u5199\u540E\u5168\u6587\u4E09\u4EF6\uFF1Bquarantine=\u6D89\u5BC6/\u6709\u5BB3/\u5B8C\u5168\u8FC7\u65F6/\u653E\u9519\u5BB6\u3002\u7981\u5220\u9664\uFF0C\u7981\u7F16\u9020\u5F15\u7528\u3002";
 /**
@@ -49,7 +64,6 @@ export declare function evolvePrompt(entry: {
     title: string;
     description: string;
     body: string;
-    extra?: string | undefined;
     scope?: "project" | "global" | undefined;
 }, neighbors: readonly {
     id: string;

package/lib/review-prompt.js

@@ -10,8 +10,23 @@
  * body executability, reusability, non-duplicate). The prompts are
  * deliberately behavior-blind: there are no task datasets here (unlike
  * Hermes GEPA), only the item text plus its provenance.
+ *
+ * Each of the four review jobs has its own gate/evolve prompt pair, and the
+ * memory and skill rubrics contradict each other on home-ownership by design
+ * (a memory must survive having its repo name stripped; a project skill must
+ * not). Sharing one prompt between them is what made the review ring judge
+ * skills by the memory rubric.
+ */
+export const REVIEW_MEMORY_CHEAP_SYSTEM_PROMPT = "你是记忆库的内容评审门。先过归属三测：①主语是用户/环境还是某仓库的某版机制（版本号、阈值、开关名出现即后者）；②抹掉仓库名版本号机制名后句子还成立吗；③仓库事实住 ADR/docs，记忆只收跟人走的。归属不过直接判 false 并注明放错家。再判值不值得细看：有明确事实、做法、偏好或可复用规程就批；空话、纯过程记录、一次性的瞬时输出、当轮已可推导的一律拒。只输出 JSON：{\"worthReview\": true|false, \"reason\": \"一句话\"}。";
+/**
+ * The skill cheap gate: the memory gate's rubric inverted on home-ownership.
+ * A skill bound to one repo's paths, gates and workflow cards is a *project
+ * skill* — its home test is the project, not the world — so the gate that
+ * fronted skills with the memory rubric rejected them for being exactly what
+ * they are. Every judgment here is scope-relative, and the scope rides the
+ * user prompt.
  */
-export const REVIEW_CHEAP_SYSTEM_PROMPT = "你是记忆库的内容评审门。先过归属三测：①主语是用户/环境还是某仓库的某版机制（版本号、阈值、开关名出现即后者）；②抹掉仓库名版本号机制名后句子还成立吗；③仓库事实住 ADR/docs，记忆只收跟人走的。归属不过直接判 false 并注明放错家。再判值不值得细看：有明确事实、做法、偏好或可复用规程就批；空话、纯过程记录、一次性的瞬时输出、当轮已可推导的一律拒。只输出 JSON：{\"worthReview\": true|false, \"reason\": \"一句话\"}。";
+export const REVIEW_SKILL_CHEAP_SYSTEM_PROMPT = "你是技能库的内容评审门。先看归属（prompt 里标了 scope）：绑定某仓库的路径/门禁/流程**不是**缺陷——住项目分区（scope=project）的技能本来就只在该项目内生效，禁用「跨项目不可复用」「抹掉仓库名不成立」当理由去拒它；只有「scope=global 却绑定某仓库」才算放错家，直接判 false 并注明。再判值不值得细看：description 让人在该用时想得起、正文步骤可执行、有可复用的规程就批；空话、一次性输出、纯过程记录、与既有技能重复的一律拒。只输出 JSON：{\"worthReview\": true|false, \"reason\": \"一句话\"}。";
 /** Memory rubric: accurate, usable, reusable, non-duplicate, fresh, right-home. */
 export const REVIEW_MEMORY_SYSTEM_PROMPT = "你是记忆库的内容评审。先过归属三测（主语是用户/环境还是某仓库的某版机制；抹掉仓库名版本号机制名后还成立吗；仓库事实住 ADR/docs）：归属不过直接 quarantine 并注明放错家。再按五维判：①准确（事实可信、无幻觉）；②可用（Why/How 具体、可执行，反馈类必须带 Why 与 How to apply）；③可复用（未来会话用得上）；④不重复（与候选旧条比，有重复就指出来）；⑤不过时（未被纠正链取代）。只输出 JSON：{\"verdict\": \"keep|rewrite|quarantine\", \"reason\": \"一句话\", \"title\"?: \"改写后标题\", \"description\"?: \"改写后钩子\", \"body\"?: \"改写后正文全文\", \"corrects\"?: \"被取代的同区条目id\"}。verdict 说明：keep=不动；rewrite=给出改写后全文三件；quarantine=涉密/有害/完全过时/放错家。禁删除，禁编造引用。";
 /**
@@ -37,10 +52,10 @@ export function evolvePrompt(entry, neighbors) {
     if (entry.scope !== undefined) {
         lines.push(`scope=${entry.scope}`);
     }
+    // Nothing rides after `全文：` — a rubric reminder adjacent to the item
+    // text gets copied back as if it were content (2026-10-14, memory
+    // `codegraph`). The rubric lives in the system prompt only.
     lines.push(`title=${entry.title}`, `钩子=${entry.description}`, "全文：", entry.body);
-    if (entry.extra !== undefined && entry.extra.length > 0) {
-        lines.push("", entry.extra);
-    }
     if (neighbors.length > 0) {
         lines.push("", "同类候选（判重复用）：");
         for (const neighbor of neighbors) {

package/lib/review-ring.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The review ring, assembled as a responsibility chain: cheap gate → evolve
+ * pass → landing. Each link owns exactly one step and hands the item on until
+ * a link terminates the walk; the batch runner (the environment class) is the
+ * only place that knows the order.
+ *
+ * Every terminal path lands exactly one `item-review` row, and every row now
+ * carries the model it ran on — a failure with no route on it cannot be
+ * attributed, which is what left the gate's failure rate unreadable.
+ */
+import { type ChainLink } from "./chain.js";
+import { type ModelSelection } from "./llm-call.js";
+import { type EvolveVerdict } from "./review-prompt.js";
+import { type SubagentLoader } from "./subagent.js";
+import { type UsageTotals } from "./token-usage.js";
+import type { ReviewCandidate, ReviewDeps, ReviewRunOptions, ReviewRunSummary } from "./review.js";
+/** A rewrite lands only when the body-length ratio stays within this bound. */
+export declare const REWRITE_MAGNITUDE_CAP = 0.3;
+/** One item's walk through the ring: the context every link reads and fills in. */
+export interface ReviewItem {
+    readonly deps: ReviewDeps;
+    /** The loader bound to this run's route and session — the only LLM entry point. */
+    readonly loader: SubagentLoader;
+    /** The route this run reviews on, for every row's `model` column. */
+    readonly route: ModelSelection;
+    readonly runId: string;
+    readonly candidate: ReviewCandidate;
+    readonly opts: ReviewRunOptions;
+    readonly summary: ReviewRunSummary;
+    readonly skipReasons: string[];
+    /** Gate facts: the normalized totals later rows carry, and the raw payload rows keep. */
+    gate: {
+        usage: UsageTotals;
+        raw: unknown;
+    };
+    /** The evolve verdict, filled by the evolve link. */
+    evolved?: EvolveVerdict;
+    /** The evolve call's raw usage payload; `undefined` when it never reported one. */
+    evolveUsage?: unknown;
+}
+/**
+ * Assemble the review chain: the environment class owns the order, the links
+ * own their step, and the item carries the run's loader and route.
+ *
+ * @returns The chain, in order, ending in the landing link.
+ */
+export declare function reviewChain(): readonly ChainLink<ReviewItem>[];
+/** One-line error head for ledger rows (fail-loud shape, capped length). */
+export declare function failureHead(error: unknown, max?: number): string;
+/** Relative body change: |new-old| / max(old, 1). Above the cap → quarantine. */
+export declare function rewriteMagnitude(oldBody: string, newBody: string): number;
+//# sourceMappingURL=review-ring.d.ts.map