eklavya 1.19.0 → 1.19.2

package/dist/paths.js

@@ -22,4 +22,64 @@ export function migrationsDir() {
 export function seedDir() {
     return path.join(moduleDir, 'seed');
 }
+/**
+ * Per-project settings, kept **outside** the checkout.
+ *
+ * Eklavya used to read `<repo>/.eklavya.json`, a file you committed. That was
+ * wrong in the ordinary case: a project's settings are how *you* want to be
+ * taught in that codebase, and a committed file makes one person's choice
+ * everybody's. It also made every clone a configuration file from a stranger,
+ * which cost a whole security boundary to contain.
+ *
+ * So project settings live beside the global ones, keyed by the checkout's
+ * absolute path, the way `~/.claude/projects/` does it:
+ *
+ *   ~/.eklavya/config.json                         you, everywhere
+ *   ~/.eklavya/projects/<slug>/config.json         you, on one project
+ *
+ * Nothing Eklavya writes ever lands in a repository again — concept packs
+ * included; see `projectPacksDir` below, which moved for the same reason. The
+ * pre-move directories are still *read* so nothing breaks on upgrade, and the
+ * settings file is deleted from the checkout while a pack is not, because a
+ * committed pack is authored content somebody reviewed.
+ */
+export function projectsDir() {
+    return path.join(eklavyaHome(), 'projects');
+}
+/**
+ * The directory name for a checkout: its absolute path with the separators
+ * turned into dashes, which is what `~/.claude/projects/` does and what makes
+ * the directory identifiable at a glance. Readability is the whole point —
+ * somebody looking for "the settings for this repo" has to be able to find
+ * them without a lookup table.
+ *
+ * It is lossy, and deliberately so: `/a/b-c` and `/a-b/c` both slug to
+ * `-a-b-c`. The collision is caught rather than avoided — `projectConfigPath`'s
+ * file records the path it belongs to, and `loadConfig` ignores a file whose
+ * `project` names a different checkout. A rare wrong-directory read is worth a
+ * name you can recognise; a silent one would not be.
+ */
+export function projectSlug(repoRoot) {
+    return repoRoot.replace(/[/\\:]/g, '-');
+}
+export function projectConfigPath(repoRoot) {
+    return path.join(projectsDir(), projectSlug(repoRoot), 'config.json');
+}
+/**
+ * A project's concept packs, kept outside the checkout like its settings.
+ *
+ * Packs used to live at `<repo>/.eklavya/packs/`, committed, and that was the
+ * last thing Eklavya wrote into a repository. The argument for keeping them
+ * there was real — a pack is a shared concept graph, the same for everyone —
+ * but it lost to a simpler rule: Eklavya creates no files in your project.
+ *
+ * `loadPacks` still *reads* the old location, so a repository that already
+ * ships one keeps working, and nothing deletes it. That asymmetry with the
+ * settings file is deliberate: a settings file was a mistake to undo, while a
+ * committed pack is authored content somebody reviewed, and relocating it is
+ * their decision rather than ours.
+ */
+export function projectPacksDir(repoRoot) {
+    return path.join(projectsDir(), projectSlug(repoRoot), 'packs');
+}
 //# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,0EAA0E;AAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,0EAA0E;AAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC"}

package/dist/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "eklavya",
   "displayName": "Eklavya",
-  "version": "1.19.0",
+  "version": "1.19.2",
   "description": "Learn while your agent works. Turns coding-agent generation time into adaptive, Socratic learning grounded in the code being written.",
   "author": {
     "name": "Ajay Kumar"

package/dist/plugin/cli/CLAUDE.md

@@ -20,10 +20,22 @@ between the `# >>> eklavya gate >>>` markers, and if a `pre-commit` already
 existed it moves it to `pre-commit.local` and chains it first. `--uninstall`
 restores it.
 
-Then the script itself only acts on a repo whose `.eklavya.json` sets
-`"mode": "enforced"`. Note that it reads **only** the repo file — not
-`~/.eklavya/config.json` — so a globally enforced mode does not gate a bare
-terminal. Any doc claiming a terminal commit is gated has to attach the installer
+Then the script itself only acts on a project whose config sets `quiz.enforced`
+(or the retired `"mode": "enforced"`, which it still reads). That config is at
+`~/.eklavya/projects/<slug>/config.json` — the script rebuilds the slug itself,
+in shell, from `git rev-parse --show-toplevel` folded to the main checkout via
+`--git-common-dir`, because a worktree shares its parent's settings. Note that it
+reads enforcement from **only** the project file — not `~/.eklavya/config.json` —
+so a globally set gate does not hold a bare terminal. The global file is read for
+one thing: a `quiz.enabled: false` (or `mode: off`) there, not overridden by the
+project, releases the gate, exactly as `coerce()` does — otherwise a terminal
+commit is held by a gate no quiz will ever run to clear. The slug path is built
+with `pwd -P` so a checkout reached through a symlink still finds its file.
+
+It reads `<repo>/.eklavya.json` as a fallback and does **not** migrate it. The
+node half moves that file out automatically; a git pre-commit hook is the wrong
+place to start rewriting somebody's working tree, so it reads the old location
+and lets the next ordinary session do the move. Any doc claiming a terminal commit is gated has to attach the installer
 step and the repo config; `web/src/content/docs/docs/commit-gate.mdx` and
 `skills/setup/SKILL.md` are where that lives.
 
@@ -33,10 +45,12 @@ A learning tool that bricks commits gets uninstalled, and an unpassable gate
 teaches nothing. Every one of these exits 0:
 
 - not inside a git repo, or `git rev-parse` fails;
-- no `.eklavya.json` in the repo root;
+- no config for this project, at either the current or the legacy location;
 - `jq` not on PATH (warns on stderr) — **or** `sqlite3` not on PATH (warns too).
   It needs both, not just `jq`;
-- `mode` is anything but `enforced`;
+- the config does not ask for enforcement — `quiz.enforced` false or absent with
+  no `mode: enforced` behind it, or `quiz.enabled` false — in the project file,
+  or in the global one when the project does not say;
 - the database file does not exist;
 - the `sqlite3` query errors, or returns no gate row for this repo.
 
@@ -51,8 +65,18 @@ SQL and duplicates things it cannot import. Keep it in step with:
 - the `gates` table shape — it selects `passed, required, answered` and picks the
   repo's most recent row by `updated_at`. `syncGate` in `mcp/src/store.ts` is the
   only writer; a renamed or added column lands here in the same commit.
-- `DEFAULT_CONFIG.mode` in `mcp/src/config.ts` — the script hardcodes `"ambient"`
-  as jq's fallback for a `.eklavya.json` with no `mode`.
+- `DEFAULT_CONFIG.quiz` in `mcp/src/config.ts` — the script defaults a config
+  with neither `quiz` nor `mode` to unenforced.
+- `projectSlug` in `mcp/src/paths.ts` — the script rebuilds it with
+  `tr '/\\:' '-'`, and `test/gate.test.ts` runs both parsers over one set of
+  configs so the two cannot drift apart silently.
+- the `mode` → `quiz` alias in `normalizeLegacyKeys`, and the rule that
+  `quiz.enabled: false` forces `enforced` off. Both are duplicated here in jq,
+  spelled out with `if`/`elif` rather than `//`: jq's `//` is an alternative
+  operator, so `.quiz.enforced // (.mode == "enforced")` reads an explicit
+  `false` as unset and falls back to a stale `mode` in the same file — a gate
+  that keeps holding commits after somebody switched it off.
+  `test/gate.test.ts` runs both parsers over the same five configs.
 
 The pass/fail arithmetic itself (`PASSING_GRADE`, `pass_threshold`,
 `ceil(required * pass_threshold)`) is **not** duplicated here — the script trusts

package/dist/plugin/cli/eklavya-gate

@@ -9,10 +9,24 @@
 # bricks commits when a dependency is absent gets uninstalled, and an unpassable
 # gate teaches nothing.
 #
-# It reads the repo's .eklavya.json and nothing else -- never ~/.eklavya/config.json.
-# That is deliberate: a git hook installed once must not start blocking commits
-# because someone flipped a global setting. Gating a repo is a per-repo decision,
-# stated in a file the repo can see.
+# Enforcement is read from this project's config only -- never from
+# ~/.eklavya/config.json. That is deliberate: a git hook installed once must not
+# start blocking commits because someone flipped a global setting. Gating a
+# codebase is a per-project decision, stated in that project's own file. The
+# global file is consulted for one thing: a `quiz.enabled: false` there switches
+# the questions off, and a gate nothing can pass must not hold.
+#
+# That file used to be <repo>/.eklavya.json, committed. It is not any more: a
+# project's settings say how *you* want to be taught in that codebase, and a
+# committed file made one person's choice everybody's. They now live at
+# ~/.eklavya/projects/<checkout path with separators as dashes>/config.json,
+# alongside the global config and keyed the way ~/.claude/projects/ keys its own.
+# Nothing Eklavya writes lands in a checkout.
+#
+# The node half migrates a leftover .eklavya.json out of the repo automatically.
+# This script does not -- a git pre-commit hook is the wrong place to start
+# rewriting somebody's working tree -- so it reads the legacy file as a fallback
+# and lets the next ordinary session do the move.
 
 set -u
 
@@ -22,8 +36,37 @@ eklavya_db()   { printf '%s' "${EKLAVYA_DB:-$(eklavya_home)/knowledge.db}"; }
 REPO=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
 [ -n "$REPO" ] || exit 0
 
-# Only repos that explicitly opt in are gated.
-CONFIG="$REPO/.eklavya.json"
+# A linked worktree is a branch of the same codebase, not a project to configure
+# again -- the same fold `mainRepoRoot` applies on the node side. `--git-common-dir`
+# points at the main checkout's .git for a worktree and at this one's otherwise,
+# so stripping the trailing /.git yields the checkout that owns the settings.
+#
+# `--path-format=absolute` would be the obvious way to ask, and is deliberately
+# not used: it needs git >= 2.31, and on anything older the whole `rev-parse`
+# fails, the slug misses, and the gate fails open in every linked worktree --
+# enforcement somebody was promised, silently not happening. Plain
+# `--git-common-dir` has been there for years and answers relative to the
+# current directory, so the relative case is resolved by hand.
+#
+# Resolved with `pwd -P`, never `$(pwd)/...`: in a hook `pwd` echoes the `PWD`
+# the shell handed down, which is the symlinked spelling when the repo was
+# reached through one (macOS's /tmp, a symlinked ~/code). The node side keys on
+# the real path, so a symlinked prefix misses the slug and the gate fails open.
+PROJECT="$REPO"
+COMMON=$(git rev-parse --git-common-dir 2>/dev/null) || COMMON=''
+[ -n "$COMMON" ] && COMMON=$(cd "$COMMON" 2>/dev/null && pwd -P) || COMMON=''
+case "$COMMON" in
+  */.git) CANDIDATE=${COMMON%/.git}; [ -d "$CANDIDATE" ] && PROJECT="$CANDIDATE" ;;
+esac
+
+# The slug `projectSlug` builds: the absolute path with separators as dashes.
+SLUG=$(printf '%s' "$PROJECT" | tr '/\\:' '-')
+CONFIG="$(eklavya_home)/projects/$SLUG/config.json"
+
+# The pre-move location, read only while a checkout still has one.
+[ -f "$CONFIG" ] || CONFIG="$REPO/.eklavya.json"
+
+# Only projects that explicitly opt in are gated.
 [ -f "$CONFIG" ] || exit 0
 
 if ! command -v jq >/dev/null 2>&1; then
@@ -35,8 +78,36 @@ if ! command -v sqlite3 >/dev/null 2>&1; then
   exit 0
 fi
 
-MODE=$(jq -r '.mode // "ambient"' "$CONFIG" 2>/dev/null) || exit 0
-[ "$MODE" = "enforced" ] || exit 0
+# `quiz.enforced`, with the retired `mode` dial honoured as a fallback -- this
+# script meets configs written years before it.
+#
+# Spelled out with if/elif rather than jq's `//`, which is an alternative
+# operator and not a null-coalescing one: `false // X` evaluates to X, so the
+# obvious `.quiz.enforced // (.mode == "enforced")` would read an explicit
+# `"enforced": false` as unset and fall through to a stale `mode` left in the
+# same file. That is a gate holding commits after somebody switched it off.
+#
+ENFORCED=$(jq -r '
+  if .quiz.enforced != null then .quiz.enforced
+  else (.mode == "enforced") end
+' "$CONFIG" 2>/dev/null) || exit 0
+[ "$ENFORCED" = "true" ] || exit 0
+
+# `quiz.enabled`, resolved the way `coerce()` resolves it: project over global,
+# `mode` per file. A gate with no questions behind it can never be passed, so
+# it must not hold -- and the switch that silences the questions may well be in
+# the global file. This is the one thing read from there: the global config can
+# release this gate, never impose one.
+QUIZ_ENABLED='
+  if .quiz.enabled != null then .quiz.enabled
+  elif .mode == "off" then false
+  elif .mode == "ambient" or .mode == "enforced" then true
+  else null end'
+ENABLED=$(jq -r "$QUIZ_ENABLED" "$CONFIG" 2>/dev/null) || exit 0
+if [ "$ENABLED" = "null" ] && [ -f "$(eklavya_home)/config.json" ]; then
+  ENABLED=$(jq -r "$QUIZ_ENABLED" "$(eklavya_home)/config.json" 2>/dev/null) || exit 0
+fi
+[ "$ENABLED" = "false" ] && exit 0
 
 DB=$(eklavya_db)
 [ -f "$DB" ] || exit 0
@@ -70,7 +141,7 @@ cat >&2 <<EOF
   Open Claude Code in this repo and run /eklavya:quiz to finish, then commit again.
 
   To see what is outstanding:  /eklavya:gate
-  To turn this off for the repo, set "mode" to "ambient" in .eklavya.json
+  To turn this off:  eklavya config set quiz.enforced false --project
 
 EOF
 exit 1

package/dist/plugin/hooks/CLAUDE.md

@@ -34,24 +34,26 @@ else.
 
 | Event | Matcher | Timeout | Script | Job |
 |---|---|---|---|---|
-| SessionStart | — | 10s | `session-start` | stamp this checkout's session pointer (`meta.current_session:<repo root>`), replay the spool, summarise the last session's batch, recall this project's memory, print the profile banner and the standing log directive |
+| SessionStart | — | 10s | `session-start` | stamp this checkout's session pointer (`meta.current_session:<repo root>`), replay the spool, summarise the last session's batch, recall this project's memory, show the developer the profile banner (`systemMessage`) and hand the model the recall and the standing log directive (`additionalContext`) |
 | UserPromptSubmit | — | 10s | `prompt-submit-nudge` | re-stamp this checkout's session pointer, then re-state the log directive in one line, but only for a session that has logged nothing after a grace window |
 | SubagentStart | — | 10s | `subagent-start` | give a delegated agent the log directive the parent's SessionStart never reached it with |
-| PreToolUse | `Bash` | 10s | `pre-tool-gate` | in `enforced` mode only, deny a `git commit` whose session gate has not passed |
+| PreToolUse | `Bash` | 10s | `pre-tool-gate` | with `quiz.enforced` only, deny a `git commit` whose session gate has not passed |
 | PostToolUse | — | 10s | `capture-tool` | record the tool use as memory evidence |
 | PostToolUse | `mcp__.*log_session_concepts` | 10s | `checkpoint-quiz` | one mid-task question, `interleaved` cadence only |
 | Stop | — | 15s | `stop-quiz-check` | block the turn and demand a quiz |
 
-## Memory capture is not governed by `mode`
+## Memory capture is not governed by `quiz`
 
 `capture-tool` has no matcher, so it runs after **every** tool call — it is the
 hook that fires most often in a session, and it does the least: resolve
 identity, normalise one event, one insert, exit. It never quizzes, summarises
 or calls a provider.
 
-Four hooks now carry memory work, and all four do it **before** their `mode`
+Four hooks now carry memory work, and all four do it **before** their `quiz`
 check, because `memory.enabled` is a separate decision from the learning dials
-(PRD CFG-01): `mode: off` means no quizzes, not no project history.
+(PRD CFG-01): `quiz.enabled: false` means no quizzes, not no project history.
+That separation is why the `mode` dial was retired — it was always true and the
+word `off` denied it, so `session-start` now says on screen which half stopped.
 `session-start` replays the spool and recalls; `prompt-submit-nudge` captures
 the prompt; `capture-tool` captures the tool use; `stop-quiz-check` closes the
 batch at the seam. `mcp/src/hooks/memory-lib.ts` holds the shared helpers, and
@@ -70,9 +72,25 @@ the prefix depends on how the plugin was installed —
 catches both; anchoring it to one spelling silently disables the checkpoint for
 half the installs.
 
+## Two audiences, two channels
+
+Every line a hook writes is for the developer or for the model, and each has
+exactly one channel: top-level `systemMessage` is rendered to the developer,
+`hookSpecificOutput.additionalContext` is read by the model. Plain stdout is
+never used. On `SessionStart` it is accepted, but as context only — the banner
+went out that way for months and every session opened in apparent silence while
+the model read three lines meant for a person. And `systemMessage` is **top
+level**: nested inside `hookSpecificOutput` the harness drops it, which is how
+the checkpoint's one line to the developer went unseen for just as long.
+`docs/verified-schemas.md` has the per-hook table; `mcp/test/hooks.test.ts`
+asserts on `shown` and `context` separately, and its `systemMessage()` helper
+throws on the nested placement, so a new hook cannot repeat either mistake
+without a test saying so.
+
 ## SubagentStart needs the JSON form, and skips the tutor
 
-`SessionStart` may print its context as raw stdout. `SubagentStart` may not: it
+`SessionStart` accepts raw stdout as context (Eklavya no longer uses it — see
+above). `SubagentStart` does not: it
 reads `hookSpecificOutput.additionalContext` and drops anything else in silence,
 so the wrong form is a hook that runs, exits 0, and does nothing. That is the
 one thing `subagent-start.ts` cannot get wrong, and `mcp/test/hooks.test.ts`
@@ -193,20 +211,21 @@ reads rather than output anyone sees.
 
 That was a bug for a while, and a bad one: `session-start` returned before
 pushing the directive, so a developer who turned the greeting off logged
-nothing, was never quizzed, and saw `mode: ambient` in `get_config` the whole
-time. Two tests encoded it as intended behaviour. `mode: off` is the off switch
-— along with its session-scoped twin below, which is the same switch with a
-shorter life.
-
-## The Stop hook blocks in `ambient` too
-
-Commonly got wrong. `ambient` is not "never interrupts" — `stop-quiz-check.ts`
-returns 2 in ambient as readily as in enforced. `enforced` changes three things:
-the `min_minutes_between_quizzes` cooldown is skipped (a cooldown could make a
-commit gate unpassable — decision G5); the one-question cap under `interleaved`
-is lifted, so the sweep asks for the whole remaining budget; and `pre-tool-gate`
-plus `cli/eklavya-gate` start holding commits. Only `mode === 'off'` silences
-everything.
+nothing, was never quizzed, and saw quizzing reported as enabled in
+`get_config` the whole time. Two tests encoded it as intended behaviour.
+`quiz.enabled: false` is the off switch — along with its session-scoped twin
+below, which is the same switch with a shorter life.
+
+## The Stop hook blocks when unenforced too
+
+Commonly got wrong. Unenforced is not "never interrupts" — `stop-quiz-check.ts`
+returns 2 without the gate as readily as with it. `quiz.enforced` changes three
+things: the `min_minutes_between_quizzes` cooldown is skipped (a cooldown could
+make a commit gate unpassable — decision G5); the one-question cap under
+`interleaved` is lifted, so the sweep asks for the whole remaining budget; and
+`pre-tool-gate` plus `cli/eklavya-gate` start holding commits. Only
+`quiz.enabled: false` silences the questions — and it silences only those, not
+the memory half.
 
 ## The per-session off switch
 
@@ -220,7 +239,7 @@ config file has quietly turned the product off for good.
 
 Two rules it is easy to get wrong:
 
-- It silences, it does not exempt. `cli/eklavya-gate` reads `.eklavya.json` and
+- It silences, it does not exempt. `cli/eklavya-gate` reads the project config and
   never sees a session id, so an enforced repo still holds the commit. Making
   the gate honour it would turn a per-session convenience into a gate bypass.
   `pre-tool-gate` reads `isSessionOff` for one reason only: its refusal tells

package/dist/plugin/scripts/install-git-hook.sh

@@ -78,4 +78,5 @@ EOF
 
 chmod +x "$HOOK"
 printf 'Installed the Eklavya commit gate in %s\n' "$HOOK"
-printf 'It only acts on repositories whose .eklavya.json sets "mode": "enforced".\n'
+printf 'It only acts on projects whose config sets quiz.enforced. That config lives at\n'
+printf '~/.eklavya/projects/<checkout>/config.json, never inside the repository.\n'

package/dist/plugin/skills/CLAUDE.md

@@ -106,16 +106,16 @@ Check every one of these against the code when you touch a skill.
   write it: `grep -rn 'focus' skills/ user-skill/ agents/`.
 - **The `interleaved` one-question cap has exemptions.** In
   `mcp/src/tools/get_session_quiz_plan.ts`:
-  `capped = cadence === 'interleaved' && mode !== 'enforced' && !explicitTopic`,
+  `capped = cadence === 'interleaved' && !quiz.enforced && !explicitTopic`,
   and then `max = args.max ?? (capped ? 1 : max_questions_per_task)`.
-  So `enforced` mode is exempt, an explicit `domain` or `slugs` is exempt, and
+  So `quiz.enforced` is exempt, an explicit `domain` or `slugs` is exempt, and
   an explicit `max` wins outright because it is read first. Read that code
   rather than trusting prose about it — including this paragraph.
-- **The Stop hook blocks in `ambient` too.** `mcp/src/hooks/stop-quiz-check.ts`
-  blocks in both modes; what `enforced` changes is that it skips the
+- **The Stop hook blocks when unenforced too.** `mcp/src/hooks/stop-quiz-check.ts`
+  blocks either way; what `quiz.enforced` changes is that it skips the
   `min_minutes_between_quizzes` cooldown, takes the whole remaining budget
-  instead of one question, and gates commits. Do not write "ambient never
-  interrupts".
+  instead of one question, and gates commits. Do not write "it never
+  interrupts unless enforced".
 - **`get_learner_profile`'s lists are capped, and `known` is ordered by score.**
   `LIST_CAP = 8` covers `weak`, `due_for_review`, `projects`,
   `recent_concepts` and `skipped`; `KNOWN_CAP = 30` covers `known`, with the
@@ -130,14 +130,16 @@ Check every one of these against the code when you touch a skill.
 
 Until 1.14 every plan item carried `ask_header` and the tutor printed it above
 the question: `[mode: ambient · focus: concept · level: easy · tier: 2
-mechanism]`. It existed for a real reason — on `concept` focus a deliberately
+mechanism]` — in the vocabulary of the day, when a single `mode` dial still
+existed. It existed for a real reason — on `concept` focus a deliberately
 transferable question reads as a vague one, and on `easy` a tier-2 question
 reads as shallow rather than as a runway — but it spent four settings' worth of
 screen above *every* stem to say something that is true for the whole session.
 
 Ambient state belongs somewhere ambient. `statusLine` in `mcp/src/statusline.ts`
-composes `[EKLAVYA ambient · concept · interleaved · easy]` for
-`eklavya statusline`, which the host's status bar runs. `askHeader` is deleted,
+composes `[EKLAVYA concept · interleaved · easy]` for `eklavya statusline`,
+which the host's status bar runs — with `enforced` prepended only when it is
+set, since a segment that is always there is a segment nobody reads. `askHeader` is deleted,
 the plan no longer carries `ask_header`, and both hooks now say *ask the stem on
 its own*.
 
@@ -287,7 +289,7 @@ renderers that lack it.
 ## Consistency
 
 The same behaviour described in two skills has drifted apart before — that is
-how `focus: project` got into three files. The four dials appear in
+how `focus: project` got into three files. The dials appear in
 `skills/mode/SKILL.md` and `user-skill/eklavya/SKILL.md`; the level bands
 appear in `skills/level/SKILL.md` and `tutor/references/focus-and-level.md`;
 the cadence cap appears in `mode`, `quiz` and that same reference. **When you

package/dist/plugin/skills/gate/SKILL.md

@@ -8,7 +8,7 @@ disable-model-invocation: true
 
 Call `get_gate_status` and report it in a few lines:
 
-- Mode. If it is not `enforced`, say that nothing is gated and stop.
+- Whether `quiz.enforced` is set. If it is not, say that nothing is gated and stop.
 - `passed_count` of `needed` passing answers, out of `required` concepts.
 - Passed or not.
 

package/dist/plugin/skills/level/SKILL.md

@@ -29,7 +29,7 @@ Report it in three lines or fewer:
 - **The runway** — `passed`/`needed` passing answers, plus whichever other condition is still short (accuracy, or distinct concepts). Say the number; a progress bar nobody can total is not progress.
 - **What is next** — the band above, and what changes about the questions when they reach it. If they are on `hard`, say that this is the top and the tier ladder keeps working inside it.
 
-If `pinned` is set, say who pinned it (global config or this repo's `.eklavya.json`) and that nothing will promote while it stands. Do not report a runway toward a level a pin makes unreachable.
+If `pinned` is set, say where it was pinned (their global config or their settings for this project) and that nothing will promote while it stands. Do not report a runway toward a level a pin makes unreachable.
 
 ## With an argument
 
@@ -41,11 +41,11 @@ If `pinned` is set, say who pinned it (global config or this repo's `.eklavya.js
 Scope, and ask when it is ambiguous:
 
 - **global** (default) — their own setting on every project. `hard` here is a senior saying they do not want the runway.
-- **repo** — `.eklavya.json` at the root, and it beats global for **everyone** working in that project. `easy` here is an onboarding codebase that stays gentle whoever opens it.
+- **project** — `~/.eklavya/projects/<checkout>/config.json`, and it beats global whenever *they* work in that codebase. `easy` here is a codebase they are new to and want kept gentle. It is in their home directory, not the repository, so it reaches nobody else.
 
 Two things to say plainly before writing:
 
-- Pinning at repo scope overrides every contributor's personal setting in that project.
+- Pinning at project scope overrides their own global setting in that codebase, and nobody else's.
 - Pinning `hard` on a codebase someone has just met is the failure levels exist to prevent. If they are pinning up because the questions feel trivial, check the level first — they may simply be near a promotion.
 
 ## Confirm

package/dist/plugin/skills/mode/SKILL.md

@@ -1,27 +1,33 @@
 ---
 name: mode
-description: Show or change how Eklavya teaches — the focus (project, concept, learn), the enforcement mode (ambient, enforced, off), the cadence (interleaved, end) and the difficulty (auto, easy, medium, hard).
+description: Show or change how Eklavya teaches — whether it quizzes at all and whether it gates commits (quiz.enabled, quiz.enforced), the focus (project, concept, learn), the cadence (interleaved, end) and the difficulty (auto, easy, medium, hard).
 disable-model-invocation: true
 ---
 
-# /eklavya:mode [project|concept|learn|ambient|enforced|off|interleaved|end] [topic] [--session]
+# /eklavya:mode [on|off|enforced|project|concept|learn|interleaved|end] [topic] [--session]
 
-Eklavya has **four independent dials**, and conflating them is the most common confusion. Say which one you are changing.
+Eklavya has **independent switches**, and conflating them is the most common confusion. Say which one you are changing.
 
-| Dial | Question it answers | Values |
+| Setting | Question it answers | Values |
 |---|---|---|
-| `mode` | How hard does Eklavya push? | `ambient`, `enforced`, `off` |
+| `quiz.enabled` | Does it ask questions at all? | `true` (default), `false` |
+| `quiz.enforced` | Do unanswered questions hold commits? | `false` (default), `true` |
 | `focus` | What does it teach? | `concept` (default), `project`, `learn` |
 | `cadence` | When does it ask? | `interleaved` (default), `end` |
 | `difficulty` | How hard may the questions get? | `auto` (default), `easy`, `medium`, `hard` |
+| `memory.enabled` | Is the work recorded and recalled? | `true` (default), `false` |
+
+**`quiz` and `memory` are separate, and this is the thing to get right.** Turning the questions off does not stop Eklavya recording what the session did — that is `memory.enabled`, and it is a deliberate second decision. Someone who says "turn Eklavya off" has usually asked for silence, not amnesia: set `quiz.enabled: false` and tell them memory is still running, rather than switching both and losing their history. If they want everything off, they will say so, and then it is both.
+
+These replaced a single `mode` dial whose values were `ambient`, `enforced` and `off`. Configs still using it keep working — `off` reads as `quiz.enabled: false`, `enforced` as `quiz.enforced: true` — but do not write it. `off` is exactly the word that made people believe their memory had stopped.
 
 `difficulty` is the one that is normally *earned* rather than set: on `auto`, each project starts at `easy` and climbs. **`/eklavya:level` is the command for it** — send them there rather than explaining the ladder here, and only set it from this command if they explicitly asked to pin a level.
 
-They combine freely. `enforced` + `learn` is an intern who must pass a gate on a topic they chose; `ambient` + `project` is a gentle nudge grounded in today's diff. The default pairing is `ambient` + `concept`: teach the idea, use today's code as the way in. `off` is the exception — it wins outright and `focus` is never read.
+They combine freely. `quiz.enforced` + `learn` is an intern who must pass a gate on a topic they chose; unenforced + `project` is a gentle nudge grounded in today's diff. The default pairing is unenforced + `concept`: teach the idea, use today's code as the way in. `quiz.enabled: false` is the exception — it wins outright, `focus` is never read, and it forces `quiz.enforced` off with it, since a gate nothing asks questions for could never be passed.
 
 ## No arguments
 
-Call `get_config` and report the effective settings in two lines: mode and what it means, focus and what it means, then cadence and difficulty in a clause each. If `overridden_by_repo` is non-empty, say which settings this repo is overriding and where the file is — someone whose personal focus silently stopped applying needs to be told why, not left to guess.
+Call `get_config` and report the effective settings in two lines: whether questions are on and whether they gate commits, focus and what it means, then cadence and difficulty in a clause each. **Say whether memory is on in the same breath** — it is the setting people most often assume follows the others. If `overridden_by_project` is non-empty, say which settings this project is overriding and where the file is: someone whose global focus silently stopped applying needs to be told why, not left to guess.
 
 Then offer the three focus choices below in one line each. Do not lecture.
 
@@ -33,7 +39,7 @@ Then offer the three focus choices below in one line each. Do not lecture.
 
 ## The two cadence values
 
-- **interleaved** *(default)* — one question mid-task, at the moment a concept is logged, while the code is still on screen. A quiz is capped at one question under this cadence, the end-of-task sweep included — except in `enforced` mode, where the gate needs a full round, and when the developer asked for a quiz themselves — and it draws on `max_questions_per_task`, which is a session budget rather than a batch size. This is the tool working as advertised: learning while the agent builds, not a pile of questions once it stops.
+- **interleaved** *(default)* — one question mid-task, at the moment a concept is logged, while the code is still on screen. A quiz is capped at one question under this cadence, the end-of-task sweep included — except when `quiz.enforced` is set, where the gate needs a full round, and when the developer asked for a quiz themselves — and it draws on `max_questions_per_task`, which is a session budget rather than a batch size. This is the tool working as advertised: learning while the agent builds, not a pile of questions once it stops.
 - **end** — no mid-task questions at all. Everything waits for the end of the task. Reach for it when someone is pairing, demoing, or genuinely cannot be interrupted — and mention `min_minutes_between_checkpoints` first, since spacing the questions out is usually what they actually want.
 
 ## Setting it
@@ -43,24 +49,26 @@ Then offer the three focus choices below in one line each. Do not lecture.
 Scope matters and is worth one question when it is ambiguous:
 
 - **global** (default) — their own setting, everywhere. This is where a personal `learn` topic belongs.
-- **repo** — writes `.eklavya.json` at the repo root, and beats global for everyone working in it. This is where a lead pins `enforced` or `project` for onboarding.
+- **project** — writes `~/.eklavya/projects/<checkout>/config.json`, and beats global whenever they work in that codebase. This is where `quiz.enforced` or `focus: project` goes for a codebase they are new to. (`repo` is accepted as the older name for this scope.)
+
+**Nothing is written into the repository.** Project settings are per developer: they are in the developer's own home directory, keyed by the checkout's path, and no teammate ever sees them. Say so if they ask about sharing — what a team can share is a concept pack, not settings.
 
-Warn before writing `focus` at repo scope: it overrides every contributor's personal focus in that project, including a `learn` topic they set for themselves. That is sometimes exactly right, but it should be deliberate.
+Mention when writing `focus` at project scope that it overrides the `learn` topic they set for themselves, in that codebase only. That is sometimes exactly right, but it should be deliberate.
 
-## Changing mode
+## Turning the gate on
 
-Same tool, `mode` key. Follow `/eklavya:setup` step 4 if they move **to** `enforced` — the git `pre-commit` hook is what covers commits made outside Claude Code, and enforced mode without it only gates half the ways to commit.
+Same tool, `quiz: { enforced: true }`. Follow `/eklavya:setup` step 4 when they move **to** enforcement — the git `pre-commit` hook is what covers commits made outside Claude Code, and the gate without it only covers half the ways to commit.
 
 ## "Turn it off for this session"
 
-**Hear this phrasing — "for now", "for this session", "I'm in the middle of something", `--session` — and use `set_config` with `scope: "session"` and `mode: "off"`.** Not global scope. Global is a file, the file outlives the afternoon, and a developer who silenced one urgent hour in April finds out in June that they turned the tool off for good. Session scope writes nothing: every question, checkpoint, banner and status bar stops until this session ends, and it forgets by itself.
+**Hear this phrasing — "for now", "for this session", "I'm in the middle of something", `--session` — and use `set_config` with `scope: "session"` and `quiz: { enabled: false }`.** Not global scope. Global is a file, the file outlives the afternoon, and a developer who silenced one urgent hour in April finds out in June that they turned the questions off for good. Session scope writes nothing: every question, checkpoint, banner and status bar stops until this session ends, and it forgets by itself.
 
-It takes `mode` and nothing else. Any other value of `mode` at that scope brings the session back — that is what "turn Eklavya back on" does — and the file-backed dials are whatever they always were.
+It takes `quiz` and nothing else. `quiz: { enabled: true }` at that scope brings the session back — that is what "turn Eklavya back on" does — and the file-backed settings are whatever they always were. **Memory has no session switch at all**, deliberately: a day of work nobody recorded is a day nobody can look up later, and the request was for quiet, not for a hole in the history. Say so if they ask.
 
-Say one line back — including *which* session it acted on if `set_config` reports a `session_id` you did not pass — and say the limit in it when the effective mode is `enforced`: the questions are silenced, but the commit gate reads `.eklavya.json` and never sees a session id, so a commit still waits for the quiz, and it keeps growing while you work in silence. Someone who wants that gone wants a repo or global `mode` change, and that is a different, deliberate decision — `set_config` returns a `note` saying so.
+Say one line back — including *which* session it acted on if `set_config` reports a `session_id` you did not pass — and say the limit in it when `quiz.enforced` is set: the questions are silenced, but the commit gate reads the project config and never sees a session id, so a commit still waits for the quiz, and it keeps growing while you work in silence. Someone who wants that gone wants a project or global change, and that is a different, deliberate decision — `set_config` returns a `note` saying so.
 
 Nothing is lost while a session is silent: concepts logged stay unmastered, and a later session offers them again once its own work and review debt are covered.
 
 ## Confirm
 
-Say the new state back in one line — `Mode: ambient. Focus: learn (caching). Cadence: interleaved. Difficulty: auto (easy on this repo).` — and what changes next time they build something. If they set `learn`, add that `/eklavya:learn` teaches the topic on demand rather than waiting for a task to touch it.
+Say the new state back in one line — `Questions: on. Focus: learn (caching). Cadence: interleaved. Difficulty: auto (easy on this repo). Memory: on.` — and what changes next time they build something. If they set `learn`, add that `/eklavya:learn` teaches the topic on demand rather than waiting for a task to touch it.

package/dist/plugin/skills/pack/SKILL.md

@@ -12,16 +12,20 @@ Two places, and the difference is the whole decision:
 
 | Where | Who it is for |
 |---|---|
-| `~/.eklavya/packs/*.json` | this developer, on every project |
-| `<repo>/.eklavya/packs/*.json` | everyone who works in this repository, versioned with it |
+| `~/.eklavya/packs/*.json` | them, on every project |
+| `~/.eklavya/projects/<checkout>/packs/*.json` | them, on this codebase |
 
-The repo one is the interesting half. A codebase that ships its own concepts and prerequisites is describing itself to whoever joins next, and that is onboarding rather than quizzing. Ask which one they want before writing anything, and say what the repo scope means: it is committed, and it applies to every contributor.
+The project one is the interesting half. A pack that describes a codebase's own concepts and prerequisites is onboarding rather than quizzing. Ask which one they want before writing anything.
+
+**Never write into the checkout.** Both directories are under the developer's home, and Eklavya creates no files in a project — not settings, not packs. A pack used to go to `<repo>/.eklavya/packs/`, committed; that directory is still **read**, so a repository that already ships one keeps working, but nothing writes there any more and nothing deletes what is there.
+
+If they ask for a pack the whole team gets: say plainly that this no longer exists. A pack is theirs, on their machine. What a team can still do is keep the JSON in the repository as a file they each install — but Eklavya will not pick it up from there unless it is in the legacy directory, and it will not put it there.
 
 ## Build the pack in this order
 
 1. **Read before you write.** `get_concept_graph` for the domain they named. If Eklavya already seeds it, the pack is an *extension* — new concepts, retiered old ones — not a replacement.
 2. **Name it.** `pack` is an identifier (`eklavya-pack-rust`, `acme-billing`), `version` is a string you bump when you edit it, `domain` is the one word that groups these concepts in a learner profile.
-3. **List the concepts, from the code.** For a repo pack, read the codebase: the modules, the invariants, the decisions someone new gets wrong. Each concept is `{ slug, name, tier, description }`. A slug is lowercase, hyphenated, and names the *idea* — `event-sourcing-replay`, not `fixed-the-replay-bug`.
+3. **List the concepts, from the code.** For a project pack, read the codebase: the modules, the invariants, the decisions someone new gets wrong. Each concept is `{ slug, name, tier, description }`. A slug is lowercase, hyphenated, and names the *idea* — `event-sourcing-replay`, not `fixed-the-replay-bug`.
 4. **Set each tier honestly.** 1 is what a thing is; 3 is why this choice here; 5 is when the architecture is wrong. A pack where everything is tier 3 teaches nothing about order.
 5. **Add the prerequisites.** `{ from, to, relation }`, relation one of `prerequisite_of`, `related_to`, `part_of`. An edge may point at a concept Eklavya already seeds — that is how a pack hangs itself off the shipped graph. `from` is the thing that comes first.
 6. **Write the file** into the directory the scope chose, and run `eklavya doctor`. It names every pack that loaded and every one that did not, with the reason.

package/dist/plugin/skills/progress/SKILL.md

@@ -11,7 +11,7 @@ Render the learning map. Read-only: do not quiz, do not teach.
 1. `get_learner_profile` (no domain — you want everything).
 2. `get_concept_graph` with `include_mastery: true` only if you need a domain's
    shape to explain something the profile already flagged. Usually you do not.
-3. `get_gate_status` if the mode is `enforced`.
+3. `get_gate_status` if `quiz.enforced` is set.
 
 ## What the report has to answer
 

package/dist/plugin/skills/quiz/SKILL.md

@@ -22,8 +22,8 @@ The developer asked for this, so always pass `ignore_cooldown: true`. The quiz c
    - `already_covered` → "Everything from this session has already been asked about. `/eklavya:quiz <topic>` to go wider."
    - `nothing_logged` → "Nothing logged this session yet, so there's nothing grounded to ask about."
    - `no_candidates` (topic mode) → that topic is fully mastered and nothing is due; name the closest domain that is not.
-   - `mode_off` → "Eklavya is off. `/eklavya:setup` to turn it back on."
-   - `session_off` → they turned Eklavya off for this session, and then asked for a quiz. Say so and offer the one step back: "Eklavya is off for this session — say the word and I'll turn it back on." Turn it back on with `set_config`, `scope: "session"`, `mode: "ambient"` if they agree, then run the quiz.
+   - `quiz_disabled` → "Questions are off for this project. Memory is still recording — `/eklavya:mode` turns the questions back on." Do not say "Eklavya is off": it is not, and saying so is what sent people hunting for a bug that was a setting.
+   - `session_off` → they silenced the questions for this session, and then asked for a quiz. Say so and offer the one step back: "Questions are off for this session — say the word and I'll turn them back on." Turn them back on with `set_config`, `scope: "session"`, `quiz: { enabled: true }` if they agree, then run the quiz.
    - `no_topic` → focus is `learn` with nothing set; ask what they want to learn, then `/eklavya:mode learn <topic>`.
    - `topic_unknown` → the graph has nothing matching their topic; offer the closest domain rather than inventing questions.