fraim-hub 2.0.338 → 2.0.340

package/dist/registry/scripts/learning/completion-state.js

@@ -0,0 +1,153 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPLETION_END = exports.COMPLETION_START = void 0;
+exports.validateProcessedSources = validateProcessedSources;
+exports.decodeCompletion = decodeCompletion;
+const node_path_1 = __importDefault(require("node:path"));
+function validateProcessedSources(sources) {
+    if (!Array.isArray(sources) || new Set(sources.map(item => item.path)).size !== sources.length || sources.some(item => !item || !node_path_1.default.isAbsolute(item.path) || !node_path_1.default.isAbsolute(item.destination) || !['raw', 'retrospective'].includes(item.kind)
+        || !/^[a-f0-9]{64}$/.test(item.sha256) || !/^[a-f0-9]{64}$/.test(item.resultHash) || !/^\d{4}-\d{2}-\d{2}$/.test(item.synthesizedAt)))
+        throw new Error('invalid-processed-sources');
+}
+exports.COMPLETION_START = '<!-- fraim-sleep-decisions:v1 -->';
+exports.COMPLETION_END = '<!-- /fraim-sleep-decisions -->';
+const text = (value) => typeof value === 'string' && !!value.trim();
+const hash = (value) => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const object = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const keys = (value, allowed) => object(value) && Object.keys(value).every(key => allowed.includes(key));
+const ownerValid = (value) => object(value) && ['Project', 'Manager', 'Org'].includes(value.level)
+    && keys(value, ['level', 'path']) && text(value.path) && node_path_1.default.isAbsolute(value.path)
+    && !/[\x00-\x1f]/.test(value.path) && value.path === (process.platform === 'win32' ? node_path_1.default.resolve(value.path).replace(/\\/g, '/').toLowerCase() : node_path_1.default.resolve(value.path));
+const sameOwner = (a, b) => a.level === b.level && a.path === b.path;
+function decodeCompletion(markdown, expected = {}) {
+    const fail = () => { throw new Error('invalid-completion-decisions'); };
+    if ((markdown.match(/<!--\s*fraim-sleep-decisions:/g) || []).length !== 1 || markdown.split(exports.COMPLETION_START).length !== 2 || markdown.split(exports.COMPLETION_END).length !== 2)
+        fail();
+    const start = markdown.indexOf(exports.COMPLETION_START) + exports.COMPLETION_START.length;
+    const end = markdown.indexOf(exports.COMPLETION_END);
+    if (end < start)
+        fail();
+    const block = markdown.slice(start, end).match(/^\s*```json\r?\n([\s\S]*?)\r?\n```\s*$/);
+    if (!block)
+        fail();
+    let state;
+    try {
+        state = JSON.parse(block[1]);
+    }
+    catch {
+        fail();
+    }
+    if (!keys(state, ['schemaVersion', 'runId', 'owner', 'finalizationState', 'decisions', 'sourceDispositions', 'cleanup', 'reconciliations', 'retrospective', 'processedSources']) || state.schemaVersion !== 1 || !text(state.runId) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(state.runId) || !ownerValid(state.owner)
+        || !['pending', 'complete'].includes(state.finalizationState) || !Array.isArray(state.decisions) || !Array.isArray(state.sourceDispositions) || !Array.isArray(state.cleanup))
+        fail();
+    if ((expected.runId && expected.runId !== state.runId) || (expected.owner && !sameOwner(expected.owner, state.owner)))
+        fail();
+    if (state.retrospective !== undefined && (!keys(state.retrospective, ['relativePath', 'sha256'])
+        || state.retrospective.relativePath !== `retrospectives/${state.runId}-sleep-postmortem.md` || !hash(state.retrospective.sha256)))
+        fail();
+    if (state.processedSources !== undefined)
+        validateProcessedSources(state.processedSources);
+    const ids = new Set();
+    for (const item of state.decisions) {
+        if (!keys(item, ['actionId', 'revision', 'digest', 'owner', 'claimKey', 'evidenceFingerprint', 'sourceRefs', 'decision', 'publicationRef', 'target', 'dependencies']) || !text(item.actionId) || ids.has(item.actionId) || !Number.isInteger(item.revision) || item.revision < 1 || !hash(item.digest) || !ownerValid(item.owner)
+            || !text(item.claimKey) || !text(item.evidenceFingerprint) || !Array.isArray(item.sourceRefs) || !item.sourceRefs.every(text) || (item.publicationRef !== undefined && !text(item.publicationRef)))
+            fail();
+        ids.add(item.actionId);
+        const decision = item.decision;
+        if (!keys(decision, ['action', 'revision', 'digest', 'reviewer', 'reason', 'revisitCondition', 'at']) || !['approve', 'reject'].includes(decision.action) || decision.revision !== item.revision || decision.digest !== item.digest
+            || !text(decision.reviewer) || !text(decision.reason) || !text(decision.at) || !Number.isFinite(Date.parse(decision.at))
+            || (decision.revisitCondition !== undefined && (decision.action !== 'reject' || !text(decision.revisitCondition))))
+            fail();
+        if ('content' in item || 'specification' in item || 'application' in item || 'preimage' in item)
+            fail();
+        if (item.target && (!keys(item.target, ['owner', 'relativePath', 'entryId', 'learningSubject']) || !ownerValid(item.target.owner) || !text(item.target.relativePath) || /^[\\/]|^[a-zA-Z]:/.test(item.target.relativePath) || item.target.relativePath.split('/').includes('..')))
+            fail();
+        if (item.dependencies && (!Array.isArray(item.dependencies) || item.dependencies.some((dependency) => !keys(dependency, ['actionId', 'outcome']) || !text(dependency.actionId) || !['applied', 'rejected'].includes(dependency.outcome))))
+            fail();
+    }
+    for (const source of state.sourceDispositions) {
+        if (!keys(source, ['sourceRef', 'sourceHash', 'outcome', 'actionId']) || !text(source.sourceRef) || !hash(source.sourceHash) || !['applied', 'rejected'].includes(source.outcome) || !ids.has(source.actionId))
+            fail();
+    }
+    const decisions = new Map(state.decisions.map((item) => [item.actionId, item]));
+    const outcome = (item) => item.decision.action === 'approve' ? 'applied' : 'rejected';
+    const dispositions = new Set();
+    for (const source of state.sourceDispositions) {
+        const action = decisions.get(source.actionId);
+        const key = JSON.stringify([source.actionId, source.sourceRef]);
+        if (dispositions.has(key) || !action.sourceRefs.includes(source.sourceRef) || source.outcome !== outcome(action))
+            fail();
+        dispositions.add(key);
+    }
+    for (const action of decisions.values()) {
+        if (action.target && !sameOwner(action.owner, action.target.owner))
+            fail();
+        if (new Set(action.sourceRefs).size !== action.sourceRefs.length || action.sourceRefs.some(ref => !dispositions.has(JSON.stringify([action.actionId, ref]))))
+            fail();
+        const dependencies = action.dependencies || [];
+        if (new Set(dependencies.map(dependency => dependency.actionId)).size !== dependencies.length)
+            fail();
+        for (const dependency of dependencies) {
+            const target = decisions.get(dependency.actionId);
+            if (!target || target.actionId === action.actionId || dependency.outcome !== outcome(target)
+                || (action.decision.action === 'approve' && dependency.outcome !== 'applied'))
+                fail();
+        }
+    }
+    const checked = new Set();
+    const visiting = new Set();
+    const visit = (id) => {
+        if (visiting.has(id))
+            fail();
+        if (checked.has(id))
+            return;
+        visiting.add(id);
+        for (const dependency of decisions.get(id).dependencies || [])
+            visit(dependency.actionId);
+        visiting.delete(id);
+        checked.add(id);
+    };
+    for (const id of decisions.keys())
+        visit(id);
+    for (const item of state.cleanup) {
+        if (!keys(item, ['path', 'outcome', 'reason', 'sha256', 'location']) || !text(item.path) || !['pending', 'deleted', 'absent', 'retained'].includes(item.outcome) || (item.reason !== undefined && typeof item.reason !== 'string') || (item.sha256 !== undefined && !hash(item.sha256)))
+            fail();
+        if (item.location !== undefined) {
+            const location = item.location;
+            if (!keys(location, ['owner', 'relativePath']) || !ownerValid(location.owner)
+                || !text(location.relativePath) || !/^learnings\/(?:review-queue|review-archive|review-evidence|archive)\//.test(location.relativePath)
+                || /[\\:]/.test(location.relativePath) || location.relativePath.split('/').some((part) => !part || part === '.' || part === '..'))
+                fail();
+        }
+        if (state.finalizationState === 'complete' && item.outcome === 'pending')
+            fail();
+    }
+    if (state.reconciliations !== undefined) {
+        if (!Array.isArray(state.reconciliations))
+            fail();
+        const sources = new Set();
+        for (const item of state.reconciliations) {
+            if (!keys(item, ['sourceRef', 'sourceHash', 'owner', 'relativePath', 'actionIds', 'actionBindings', 'disposition', 'rationale', 'preservedDecisions', 'reviewer'])
+                || !text(item.sourceRef) || sources.has(item.sourceRef) || !hash(item.sourceHash) || !ownerValid(item.owner)
+                || !text(item.relativePath) || !/^learnings\/(?:review-queue|review-archive|review-evidence|archive)\//.test(item.relativePath)
+                || /[\\:]/.test(item.relativePath) || item.relativePath.split('/').some((part) => !part || part === '.' || part === '..')
+                || !['accounted', 'unrelated', 'raw-source'].includes(item.disposition) || !text(item.rationale) || !text(item.reviewer)
+                || !Array.isArray(item.preservedDecisions) || !item.preservedDecisions.every(text)
+                || !Array.isArray(item.actionIds) || new Set(item.actionIds).size !== item.actionIds.length
+                || !Array.isArray(item.actionBindings) || item.actionBindings.length !== item.actionIds.length)
+                fail();
+            sources.add(item.sourceRef);
+            for (const [index, id] of item.actionIds.entries()) {
+                const decision = decisions.get(id);
+                const binding = item.actionBindings[index];
+                if (!decision || !keys(binding, ['actionId', 'revision', 'digest']) || binding.actionId !== id || binding.revision !== decision.revision || binding.digest !== decision.digest
+                    || !state.sourceDispositions.some((source) => source.actionId === id && source.sourceRef.replace(/\\/g, '/') === item.sourceRef.replace(/\\/g, '/') && source.sourceHash === item.sourceHash))
+                    fail();
+            }
+        }
+    }
+    return state;
+}

package/dist/src/ai-hub/desktop-main.js

@@ -468,6 +468,51 @@ function buildDesktopDebugSnapshot(runtimeId) {
         gpuFeatureStatus: electron_1.app.getGPUFeatureStatus(),
     };
 }
+function installEditingContextMenu(window) {
+    const contents = window.webContents;
+    contents.on('context-menu', async (_event, params) => {
+        if (!params.isEditable && !params.selectionText)
+            return;
+        // The Hub can override the OS theme. Read only that existing preference;
+        // keep native menu colors consistent without introducing a renderer bridge.
+        try {
+            const theme = await contents.executeJavaScript("document.documentElement.getAttribute('data-theme')");
+            if (theme === 'light' || theme === 'dark')
+                electron_1.nativeTheme.themeSource = theme;
+        }
+        catch { /* Navigation may remove the document; retain the native theme. */ }
+        if (window.isDestroyed() || contents.isDestroyed())
+            return;
+        const flags = params.editFlags;
+        // Chromium marks read-only fields as editable, but disables paste/cut.
+        const canChange = params.isEditable && flags.canPaste;
+        const items = [];
+        if (canChange && params.misspelledWord) {
+            for (const suggestion of params.dictionarySuggestions) {
+                items.push({ label: suggestion, click: () => contents.replaceMisspelling(suggestion) });
+            }
+            items.push({
+                label: 'Add to dictionary',
+                click: () => {
+                    let added = false;
+                    try {
+                        added = contents.session.addWordToSpellCheckerDictionary(params.misspelledWord);
+                    }
+                    catch { /* An unavailable platform dictionary must not disrupt editing. */ }
+                    if (!added && !window.isDestroyed()) {
+                        void electron_1.dialog.showMessageBox(window, {
+                            type: 'warning', title: 'Dictionary unavailable',
+                            message: 'Could not add the word to the dictionary. You can continue editing your draft.',
+                            buttons: ['OK'],
+                        }).catch(() => { });
+                    }
+                },
+            }, { type: 'separator' });
+        }
+        items.push({ role: 'cut', enabled: canChange && flags.canCut }, { role: 'copy', enabled: flags.canCopy }, { role: 'paste', enabled: canChange }, { role: 'selectAll', enabled: flags.canSelectAll });
+        electron_1.Menu.buildFromTemplate(items).popup({ window });
+    });
+}
 async function createWindow(url, runtimeId = process.env.FRAIM_HUB_RUNTIME_ID || 'hub') {
     const { width, height } = preferredWindowSize();
     const isMac = process.platform === 'darwin';
@@ -497,6 +542,7 @@ async function createWindow(url, runtimeId = process.env.FRAIM_HUB_RUNTIME_ID ||
         webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true },
     });
     electron_1.Menu.setApplicationMenu(null);
+    installEditingContextMenu(mainWindow);
     mainWindow.on('focus', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('window.focus'));
     mainWindow.on('blur', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('window.blur'));
     mainWindow.on('show', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('window.show', { elapsedSinceProcessStartMs: performance.now() }));

package/dist/src/ai-hub/hosts.js

@@ -38,6 +38,7 @@ exports.spawnHostProcess = spawnHostProcess;
 exports.findGeminiSessionIdForPrompt = findGeminiSessionIdForPrompt;
 exports.checkFraimMcpAttachReadiness = checkFraimMcpAttachReadiness;
 const crypto_1 = require("crypto");
+const handoff_contracts_1 = require("../core/handoff-contracts");
 const child_process_1 = require("child_process");
 const background_command_1 = require("./background-command");
 const process_liveness_1 = require("./process-liveness");
@@ -843,6 +844,7 @@ function extractSignalFromArgs(args) {
         : typeof args.issueNumber === 'number' ? String(args.issueNumber)
             : undefined;
     const reviewHandoff = extractReviewHandoffFromArgs(args);
+    const reviewHandoffError = reviewHandoff ? null : extractMalformedReviewHandoffError(args);
     const delegationLedger = extractDelegationLedgerFromArgs(args);
     const nextJobRecommendations = extractNextJobRecommendationsFromArgs(args);
     const deliveryActionId = readNullableString(evidenceArgs?.deliveryActionId);
@@ -858,6 +860,7 @@ function extractSignalFromArgs(args) {
         jobId,
         ...(issueNumber ? { issueNumber } : {}),
         ...(reviewHandoff ? { reviewHandoff } : {}),
+        ...(reviewHandoffError ? { reviewHandoffError } : {}),
         ...(delegationLedger ? { delegationLedger } : {}),
         ...(nextJobRecommendations ? { nextJobRecommendations } : {}),
         ...(deliveryActionId !== undefined ? { deliveryActionId } : {}),
@@ -1142,6 +1145,21 @@ function extractReviewHandoffFromArgs(args) {
     }
     return null;
 }
+function extractMalformedReviewHandoffError(args) {
+    const evidence = args.evidence;
+    const findings = args.findings;
+    let candidate = [args.reviewHandoff, evidence?.reviewHandoff, findings?.reviewHandoff]
+        .find((value) => value !== undefined && value !== null);
+    if (candidate === undefined)
+        return null;
+    if (typeof candidate === 'string') {
+        try {
+            candidate = JSON.parse(candidate);
+        }
+        catch { /* The shared checker reports the invalid object. */ }
+    }
+    return (0, handoff_contracts_1.reviewHandoffNormalizationError)(candidate);
+}
 function readReviewHandoffCandidate(value) {
     let candidate = value;
     if (typeof candidate === 'string') {

package/dist/src/ai-hub/server.js

@@ -45,6 +45,7 @@ exports.__setCatalogSyncSpawnForTests = __setCatalogSyncSpawnForTests;
 exports.__setAgentInstallTimeoutMsForTests = __setAgentInstallTimeoutMsForTests;
 exports.hubRunProcess = hubRunProcess;
 exports.buildOpenFileInvocation = buildOpenFileInvocation;
+const handoff_contracts_1 = require("../core/handoff-contracts");
 const express_1 = __importDefault(require("express"));
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
@@ -55,6 +56,7 @@ const https_1 = __importDefault(require("https"));
 const native_voice_input_1 = require("./native-voice-input");
 const types_1 = require("../first-run/types");
 const local_provider_registry_1 = require("../cli/providers/local-provider-registry");
+const learning_domains_1 = require("../config/learning-domains");
 const learning_context_builder_1 = require("../local-mcp-server/learning-context-builder");
 const brand_store_1 = require("../core/brand-store");
 const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
@@ -982,6 +984,7 @@ function normalizeReviewHandoff(raw) {
     const value = raw;
     if (typeof value.reviewRequired !== 'boolean')
         return null;
+    const producingJobName = typeof value.producingJobName === 'string' ? value.producingJobName.trim() : '';
     const artifacts = Array.isArray(value.artifacts)
         ? value.artifacts.map((artifact, index) => normalizeReviewArtifact(artifact, index)).filter((artifact) => Boolean(artifact))
         : [];
@@ -995,6 +998,7 @@ function normalizeReviewHandoff(raw) {
         : '';
     if (!value.reviewRequired) {
         return {
+            ...(producingJobName ? { producingJobName } : {}),
             reviewRequired: false,
             reviewTarget: rawTarget ? { type: targetType || 'none', label: targetLabel || 'Completed work' } : null,
             artifacts,
@@ -1010,6 +1014,7 @@ function normalizeReviewHandoff(raw) {
         if (artifacts.length > 0)
             return null;
         return {
+            ...(producingJobName ? { producingJobName } : {}),
             reviewRequired: true,
             reviewTarget: { type: 'pull_request', label: targetLabel || 'Pull request', url },
             artifacts: [],
@@ -1027,6 +1032,7 @@ function normalizeReviewHandoff(raw) {
     const fileArtifacts = artifacts.filter((artifact) => artifact.path && !artifact.url);
     if (targetType === 'artifact_set' && fileArtifacts.length === artifacts.length) {
         return {
+            ...(producingJobName ? { producingJobName } : {}),
             reviewRequired: true,
             reviewTarget: { type: 'artifact_set', label: targetLabel || `${artifacts.length} artifact${artifacts.length === 1 ? '' : 's'}` },
             artifacts: fileArtifacts,
@@ -1615,31 +1621,7 @@ function isCodexMissingReasoningResumeText(value) {
     return text.includes("provided without its required 'reasoning' item") ||
         text.includes('provided without its required "reasoning" item');
 }
-// Issue #1447: a dropped or non-persisted review handoff must not look
-// successful to the agent. Records the failure on the existing non-droppable
-// hostError channel (the same `run.lastHostError`/`run.events` pattern the
-// #1264/#1265 `detectUnrecognizedReviewHandoffCall` diagnostic uses) AND
-// appends a system message directly to `run.messages` — the agent- and
-// manager-visible thread — so the failure is visible immediately rather than
-// only after a terminal non-zero exit (`pushTerminalFailureToThread` only
-// fires then). The message names the reason and this run's identity so the
-// agent can recover by resubmitting.
-function failLoudlyOnDroppedReviewHandoff(run, reason) {
-    const message = `FRAIM review handoff was not applied to run ${run.id} (job "${run.jobId || 'unknown'}"): ${reason}. The Hub review surface does not reflect this submission — resubmit seekMentoring from this run's active job/phase.`;
-    run.lastHostError = message;
-    run.events.push((0, hosts_1.createHubEvent)('stderr', boundedEventText(message)));
-    // This runs outside recordHostEvent's own end-of-call cap, so cap here too —
-    // an agent stuck retrying a mismatched-job submission must not grow this
-    // array past the same bound every other event source respects.
-    capProjectedEvents(run);
-    run.messages.push((0, hosts_1.createHubMessage)('system', message));
-}
-// Issue #1447: applies a reviewHandoff carried on a same-job seekMentoring
-// signal. Pure apply/normalize — it records no diagnostics itself. Fidelity
-// to the submission is checked once, generically, by
-// verifyReviewHandoffReflectsSubmission below, regardless of which of this
-// function's branches (or the caller's cross-job guard) is why the stored
-// result might not match.
+// Review ownership follows the submitted deliverable, independently of tracker identity.
 function applyReviewHandoffToRun(run, reviewHandoff) {
     const normalizedReviewHandoff = normalizeReviewHandoff(reviewHandoff);
     if (!normalizedReviewHandoff) {
@@ -1663,7 +1645,7 @@ function applyReviewHandoffToRun(run, reviewHandoff) {
 }
 // Issue #1447: a mismatched `pull_request` target, isolated for readability.
 function pullRequestTargetMismatch(stored, submittedTarget) {
-    const submittedUrl = typeof submittedTarget?.url === 'string' ? submittedTarget.url : undefined;
+    const submittedUrl = (0, url_safety_1.safeHttpUrl)(submittedTarget?.url) || undefined;
     if (stored.reviewTarget?.type !== 'pull_request' || stored.reviewTarget.url !== submittedUrl) {
         return `stored reviewTarget (${JSON.stringify(stored.reviewTarget)}) does not match the submitted pull_request target (url: "${submittedUrl}")`;
     }
@@ -1680,7 +1662,7 @@ function artifactSetMismatch(stored, submitted) {
     const rawArtifacts = submitted.artifacts;
     const rawArtifactList = Array.isArray(rawArtifacts) ? rawArtifacts : [];
     const submittedPaths = rawArtifactList
-        .map((artifact) => (artifact && typeof artifact.path === 'string' ? artifact.path : null))
+        .map((artifact) => (artifact && typeof artifact.path === 'string' ? artifact.path.trim() : null))
         .filter((path) => Boolean(path))
         .sort();
     const storedPaths = (stored.artifacts || [])
@@ -1693,8 +1675,7 @@ function artifactSetMismatch(stored, submitted) {
     return null;
 }
 // Issue #1447: one generic post-condition instead of enumerating each way a
-// review handoff can fail to land. Whatever the reason — cross-job
-// filtering, normalization rejecting the whole payload, or a per-artifact
+// review handoff can fail to land. Whether normalization rejects the whole payload or a per-artifact
 // normalization failure silently dropping one item while the handoff as a
 // whole still normalizes — this compares what was actually submitted against
 // what the run now holds and fails loudly on any structural mismatch. Only
@@ -1702,33 +1683,29 @@ function artifactSetMismatch(stored, submitted) {
 // issue's incident describes (a stale or absent handoff masquerading as a
 // successful submission); a `reviewRequired: false` payload carries no such
 // promise.
-function verifyReviewHandoffReflectsSubmission(run, submitted, crossJobName) {
+function verifyReviewHandoffReflectsSubmission(run, submitted, onFailure) {
     if (!submitted || typeof submitted !== 'object' || submitted.reviewRequired !== true)
         return;
-    if (crossJobName) {
-        failLoudlyOnDroppedReviewHandoff(run, `a review handoff was submitted under job "${crossJobName}", but this run is tracking job "${run.jobId}" — the cross-job guard did not apply it`);
-        return;
-    }
     const stored = run.reviewHandoff;
     const submittedTarget = submitted.reviewTarget;
     if (!stored || stored.reviewRequired !== true) {
-        failLoudlyOnDroppedReviewHandoff(run, `evidence.reviewHandoff failed validation and was rejected (submitted reviewTarget: ${JSON.stringify(submittedTarget) || 'none'})`);
+        onFailure(`evidence.reviewHandoff failed validation and was rejected (submitted reviewTarget: ${JSON.stringify(submittedTarget) || 'none'})`);
         return;
     }
-    const submittedType = submittedTarget && typeof submittedTarget.type === 'string' ? submittedTarget.type : undefined;
+    const submittedType = submittedTarget && typeof submittedTarget.type === 'string' ? submittedTarget.type.trim() : undefined;
     const mismatch = submittedType === 'pull_request'
         ? pullRequestTargetMismatch(stored, submittedTarget)
         : artifactSetMismatch(stored, submitted);
     if (mismatch)
-        failLoudlyOnDroppedReviewHandoff(run, mismatch);
+        onFailure(mismatch);
 }
 // Apply a parsed seekMentoring tool-use signal from the host stream to
 // the run state. Returns the updated currentPhase.
-function applySeekMentoringSignal(run, signal) {
+function applySeekMentoringSignal(run, signal, onReviewFailure) {
     // Issue #347: filter cross-job pollution. The agent may call
     // seekMentoring for jobs OTHER than the one this run is tracking
     // (e.g., consulting `organizational-learning-synthesis` mid-run).
-    // Only apply signals whose job identity matches this run's.
+    // Only tracker metadata requires matching job identity.
     // Issue #732: match on `jobName` — the stable job-name slug that equals
     // run.jobId — NOT `jobId`. get_fraim_job mints a fresh randomUUID as the
     // job id on every call and the agent echoes that UUID into
@@ -1739,33 +1716,24 @@ function applySeekMentoringSignal(run, signal) {
     const targetJobId = run.jobId;
     const callJobName = signal.jobName;
     const isCrossJob = Boolean(callJobName && targetJobId && callJobName !== targetJobId);
-    // Issue #1447: a genuine reviewHandoff must not vanish without a trace,
-    // whether the cross-job guard just below is why it was never applied, or
-    // applyReviewHandoffToRun rejected/truncated it. Apply first (skipped
-    // entirely for a foreign job, since that guard is still correct — a
-    // foreign job's data must never overwrite this run's tracked state), then
-    // verify unconditionally that the result actually reflects the submission.
-    if (signal.reviewHandoff) {
-        if (!isCrossJob)
-            applyReviewHandoffToRun(run, signal.reviewHandoff);
-        verifyReviewHandoffReflectsSubmission(run, signal.reviewHandoff, isCrossJob ? callJobName : null);
-    }
-    else if (!isCrossJob) {
-        // Issue #1501: No reviewHandoff in this same-job call. Clear any prior reviewHandoff so
-        // run.reviewHandoff always reflects the most recent seekMentoring intent,
-        // not a stale flag from an earlier submit phase.
-        run.reviewHandoff = null;
-    }
-    if (isCrossJob)
+    if (signal.reviewHandoffError) {
+        onReviewFailure(signal.reviewHandoffError);
         return;
-    // Issue #848: capture the issue number the call carries so a launched follow-on
-    // run can reference the originating issue, and persist any next-job recommendations.
-    if (signal.issueNumber)
-        run.issueNumber = signal.issueNumber;
-    if (signal.nextJobRecommendations) {
-        const normalized = normalizeNextJobRecommendations(signal.nextJobRecommendations);
-        if (normalized)
-            run.nextJobRecommendations = normalized;
+    }
+    else if (signal.reviewHandoff) {
+        const error = (0, handoff_contracts_1.reviewHandoffNormalizationError)(signal.reviewHandoff);
+        if (error) {
+            onReviewFailure(error);
+            return;
+        }
+        else {
+            applyReviewHandoffToRun(run, { ...signal.reviewHandoff, producingJobName: callJobName });
+            verifyReviewHandoffReflectsSubmission(run, signal.reviewHandoff, onReviewFailure);
+        }
+    }
+    else {
+        // The most recent mentoring intent owns review lifetime across all jobs.
+        run.reviewHandoff = null;
     }
     if (signal.deliveryActionId !== undefined) {
         run.pendingDeliveryActionId = signal.deliveryActionId;
@@ -1785,6 +1753,17 @@ function applySeekMentoringSignal(run, signal) {
             run.pendingDeliveryActionId = null;
         }
     }
+    // Delivery actions belong to the review, while tracker and issue metadata
+    // remain scoped to the run's original job (including colliding phase names).
+    if (isCrossJob)
+        return;
+    if (signal.issueNumber)
+        run.issueNumber = signal.issueNumber;
+    if (signal.nextJobRecommendations) {
+        const normalized = normalizeNextJobRecommendations(signal.nextJobRecommendations);
+        if (normalized)
+            run.nextJobRecommendations = normalized;
+    }
     if (signal.delegationLedger &&
         run.jobId === 'fully-delegate' &&
         signal.phaseStatus === 'complete' &&
@@ -3515,6 +3494,10 @@ class AiHubServer {
             project.droppedRecordedReason = this.droppedRecordedReason;
         }
         const rawJobs = (0, catalog_1.discoverEmployeeJobs)(normalizedProjectPath, FULL_JOB_CATALOG_OPTIONS);
+        // Issue #1891: build the custom-employee index once (O(1) per job, one disk walk total)
+        // so custom ownership wins over catalog assignment. Follows the same pattern as
+        // buildCustomJobOwnerIndex documented in the Issue #1090 comment above.
+        const customJobOwners = buildCustomJobOwnerIndex(normalizedProjectPath ?? '');
         // Issue #566 (R7): jobs already carry `personalized` from catalog discovery
         // (true for the fraim/personalized-employee layer). The Hub renders a plain
         // "Personalized" marking from that flag — no author/attribution is tracked.
@@ -3522,7 +3505,7 @@ class AiHubServer {
             .filter((job) => !FRAIM_INTERNAL_JOB_IDS.has(job.id))
             .map((job) => ({
             ...job,
-            requiredPersonaKey: getProtectedPersonaForHubJob(job.id),
+            requiredPersonaKey: customJobOwners.get(job.id) ?? getProtectedPersonaForHubJob(job.id),
         }));
         // Issue #1247: expose internal jobs in a separate bootstrap field so next-job
         // recommendation chips can resolve and launch them. They are intentionally
@@ -5128,7 +5111,9 @@ class AiHubServer {
         // jobId (resolveHubJob would never match a UUID, leaving a freeform run
         // unpromoted and then dropping its phase signals).
         this.maybePromoteFreeformRunToJob(run, signal.jobName || signal.jobId);
-        applySeekMentoringSignal(run, signal);
+        applySeekMentoringSignal(run, signal, (reason) => {
+            this.recordHostEvent(run, run.hostId, { hostError: 'Review handoff was not applied: ' + reason }, 'stderr');
+        });
         if (signal.phaseId === 'retrospective' && signal.phaseStatus === 'complete') {
             void this.releaseBrowserConversationPage(run.conversationId || run.id);
         }
@@ -5645,7 +5630,10 @@ class AiHubServer {
                 const projectPath = resolveProjectPath(req);
                 const entries = (0, learning_context_builder_1.readPreservedLearnings)(projectPath, userEmail, scope, level);
                 const threshold = (0, learning_context_builder_1.getScoreThreshold)(projectPath);
-                return res.json({ scope, level, entries, threshold });
+                // Issue #1755 R9: the domain catalogue travels with the corpus so the library's
+                // domain filter and the re-scope selector offer every valid domain, not only the
+                // ones that happen to have an entry already.
+                return res.json({ scope, level, entries, threshold, domains: ['global', ...learning_domains_1.LEARNING_DOMAINS] });
             }
             catch (error) {
                 return res.status(500).json({ error: error instanceof Error ? error.message : 'Could not read learnings.' });
@@ -5664,7 +5652,16 @@ class AiHubServer {
             if (!b.category || !VALID_CATEGORIES.includes(b.category))
                 return res.status(400).json({ error: `category must be one of: ${VALID_CATEGORIES.join(', ')}` });
             const level = (b.level && VALID_LEVELS.includes(b.level)) ? b.level : 'machine';
-            const ref = { scope: b.scope, level, category: b.category };
+            // Issue #1755: `domain` names the file the entry lives in today, `targetDomain`
+            // the file it should live in after the write. Without the first, every write
+            // resolved to the undecorated global file and a domain-scoped entry could not be
+            // edited or deleted at all.
+            const ref = {
+                scope: b.scope,
+                level,
+                category: b.category,
+                domain: (0, learning_context_builder_1.normalizeLearningDomain)(b.domain),
+            };
             // Issue #750: writes to a personal-scope file need a resolved identity —
             // fail explicitly rather than writing to a guessed or empty-string file.
             const userEmail = await this.resolveLearningIdentity(b.scope);
@@ -5677,6 +5674,7 @@ class AiHubServer {
                     severity: b.severity,
                     title: b.title,
                     body: b.body,
+                    targetDomain: b.targetDomain === undefined ? undefined : (0, learning_context_builder_1.normalizeLearningDomain)(b.targetDomain),
                 });
                 return res.json({ ok: true, path: result.path });
             }