greprag 5.79.0 → 5.82.0

package/dist/procedure-enabled.js

@@ -0,0 +1,55 @@
+"use strict";
+/** The Procedure System's master switch — OFF since 2026-09-11.
+ *
+ *  Flip `PROCEDURE_SYSTEM_ENABLED` to `true` to turn it back on. That is the
+ *  whole mechanism; there is no setting, no per-project state and no env var,
+ *  because turning this back on should be a deliberate commit that travels with
+ *  the repo rather than something a machine drifts into.
+ *
+ *  WHY IT IS OFF
+ *
+ *  Shipped 2026-07-02 (v5.51.0) and never revisited. Its own design named the
+ *  measure that would prove it — a task fails once, is learned, and never fails
+ *  again — and picked this as the first Capture consumer to build *because* that
+ *  number is falsifiable. The number was never taken. The trigger is still the
+ *  plain keyword match the design labelled a deterministic stopgap pending a
+ *  real intent judge; that judge was never built.
+ *
+ *  What it produced instead, all surfaced within eight days of 2026-09-11 and
+ *  every one found by a person or an agent tripping over it, never by the system:
+ *
+ *    site      `build`   a database grep, endpoint "Bash completed with no output"
+ *    site      `test`    the literal string "ENDPOINT:" pasted into its own steps
+ *    longhome  `test`    a Blender house build from a repo since renamed, then
+ *                        relearned into a render check from a different repo
+ *    longhome  `build`   a Godot export at a dead worktree path
+ *    sift      `verify`  a liveness recipe that went stale and reported a landed
+ *                        deploy as hours old
+ *    site      `verify`  relearned into `node scripts/worktree-bootstrap.cjs`
+ *    sift      `build`   a git merge belonging to a different repository
+ *    sift      `test`    an invoice restore against the live database
+ *    greprag   `test`    a memory search about operators reading customer memories
+ *
+ *  The split is clean: every recipe a PERSON wrote was fine, and every recipe the
+ *  LEARN leg wrote was garbage. Three separate fixes landed in that week — request
+ *  phrase keying, project-scope discard, delivery-owned refusal — each correctly
+ *  root-caused, and each one revealed the next. That is the signal: the failures
+ *  are not a bug list, they are what an unjudged keyword trigger produces.
+ *
+ *  WHAT IS PRESERVED
+ *
+ *  Nothing is deleted. Stores stay on disk, `procedure list` and `show` still
+ *  read them, and every guard those three fixes added stays in the code so that
+ *  whatever comes back cannot repeat those failures. Off means: no recipe reaches
+ *  a session, and no watch ever writes one.
+ *
+ *  adr: adr/procedure-system-off.md
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROCEDURE_SYSTEM_OFF_NOTE = exports.PROCEDURE_SYSTEM_ENABLED = void 0;
+exports.PROCEDURE_SYSTEM_ENABLED = false;
+/** Why the CLI says it is off, in one line, wherever a command would otherwise
+ *  imply the system is live. */
+exports.PROCEDURE_SYSTEM_OFF_NOTE = 'The Procedure System is OFF (since 2026-09-11). Nothing is injected into sessions '
+    + 'and no recipe is learned. Stored rows are readable but inert. '
+    + 'See adr/procedure-system-off.md.';

package/dist/procedure-runtime.js

@@ -42,6 +42,7 @@ const project_anchor_1 = require("./project-anchor");
 const procedure_1 = require("./procedure");
 const procedure_watch_1 = require("./procedure-watch");
 const delivery_lifecycle_1 = require("./delivery-lifecycle");
+const procedure_enabled_1 = require("./procedure-enabled");
 const procedure_shadow_1 = require("./procedure-shadow");
 /** Read the latest real user prompt from opencode's outbound message shape.
  * Synthetic/ignored text is harness context, not user intent. `key` includes
@@ -87,6 +88,11 @@ function procedureRuntimeState(configuredState, proc) {
 }
 function runProcedurePromptCheck(params) {
     try {
+        // Master switch. Off since 2026-09-11 — nothing injects, nothing learns, and
+        // no watch opens, so the Stop hook finds nothing to observe or distill.
+        // adr: adr/procedure-system-off.md
+        if (!procedure_enabled_1.PROCEDURE_SYSTEM_ENABLED)
+            return { mode: 'none' };
         if (!params.prompt.trim())
             return { mode: 'none' };
         const anchor = (0, project_anchor_1.readAnchor)(params.cwd);

package/dist/procedure-scope.js

@@ -0,0 +1,190 @@
+"use strict";
+/** Procedure project scope — a learned recipe belongs to the checkout it was
+ *  learned in (adr/procedure-project-scope.md).
+ *
+ *  A watch is opened against ONE project, and the distiller boxes whatever the
+ *  span happened to do. When the span's work happened in a *different* checkout,
+ *  the resulting recipe is not a recipe for this project at all. Observed live
+ *  in project `sift` on 2026-09-11: the `build` verb held
+ *  `cd /c/suppliersift-site && git merge --no-ff ... chip/fix-css-render-harness-gap`
+ *  at status `confirmed`, injected under "Use this recipe" to any sift session
+ *  asking to run the build.
+ *
+ *  The detector is deliberately narrow. It does not try to judge whether a
+ *  recipe "feels" like this project; it looks for the one unambiguous statement
+ *  a command can make about where it runs — a directory-changing command, or
+ *  `git -C`, pointed at an ABSOLUTE path outside every root this checkout owns.
+ *  Anything softer (a bare mention of another repo's name, a relative path, a
+ *  URL) is not evidence and is not treated as any.
+ *
+ *  Pure detection (`commandDirectoryTargets` / `foreignCheckoutTarget`) is split
+ *  from the filesystem walk (`projectCheckoutRoots`) so the rule is testable
+ *  without a repo on disk.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAbsoluteCheckoutPath = isAbsoluteCheckoutPath;
+exports.normalizeCheckoutPath = normalizeCheckoutPath;
+exports.isInsideCheckout = isInsideCheckout;
+exports.commandDirectoryTargets = commandDirectoryTargets;
+exports.foreignCheckoutTarget = foreignCheckoutTarget;
+exports.projectCheckoutRoots = projectCheckoutRoots;
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+/** Commands that declare where the rest of the line runs. `git -C <dir>` is
+ *  here for the same reason `cd` is: it names the repository operated on. */
+const CD_TARGET_RE = /(?:^|[\s;&|(])(?:cd|pushd|chdir|set-location)\s+(?:\/d\s+|-path\s+)?("[^"]*"|'[^']*'|[^\s;&|)]+)/gi;
+const GIT_C_TARGET_RE = /(?:^|[\s;&|(])git\s+-C\s+("[^"]*"|'[^']*'|[^\s;&|)]+)/gi;
+function unquote(arg) {
+    const s = arg.trim();
+    if ((s.startsWith('"') && s.endsWith('"')) || (s.startsWith("'") && s.endsWith("'"))) {
+        return s.slice(1, -1);
+    }
+    return s;
+}
+/** Is this an absolute filesystem path? Covers the three spellings that reach a
+ *  distilled recipe on this platform: `C:\x`, `C:/x`, and the MSYS/git-bash
+ *  `/c/x` (plus a plain POSIX `/x`). PURE. */
+function isAbsoluteCheckoutPath(p) {
+    if (!p)
+        return false;
+    if (/^[A-Za-z]:[\\/]/.test(p))
+        return true;
+    return /^[\\/][^\\/]/.test(p);
+}
+/** One comparable spelling for a filesystem path: forward slashes, MSYS drive
+ *  form folded to `c:/…`, no trailing slash, lowercased. Lowercasing can only
+ *  make two paths look MORE alike, so on a case-sensitive filesystem it errs
+ *  toward keeping a recipe, never toward discarding one. PURE. */
+function normalizeCheckoutPath(p) {
+    let s = (p || '').trim().replace(/\\/g, '/').replace(/\/{2,}/g, '/');
+    const msys = /^\/([a-zA-Z])\//.exec(s);
+    if (msys)
+        s = `${msys[1]}:/${s.slice(3)}`;
+    s = s.replace(/\/+$/, '');
+    return s.toLowerCase();
+}
+/** Does `candidate` sit at or under `root`? PURE. */
+function isInsideCheckout(candidate, root) {
+    const c = normalizeCheckoutPath(candidate);
+    const r = normalizeCheckoutPath(root);
+    if (!c || !r)
+        return false;
+    return c === r || c.startsWith(r + '/');
+}
+/** Every absolute directory the text explicitly operates in. PURE. */
+function commandDirectoryTargets(text) {
+    if (!text)
+        return [];
+    const out = [];
+    for (const re of [CD_TARGET_RE, GIT_C_TARGET_RE]) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(text)) !== null) {
+            const target = unquote(m[1]);
+            if (isAbsoluteCheckoutPath(target))
+                out.push(target);
+        }
+    }
+    return out;
+}
+/** The first directory this recipe operates in that belongs to no checkout of
+ *  this project, or null when every target is ours (the common case: no
+ *  absolute target at all). With no roots to compare against, nothing is
+ *  foreign — an unresolvable project never discards anything. PURE. */
+function foreignCheckoutTarget(proc, roots) {
+    if (!roots || roots.length === 0)
+        return null;
+    const fields = [proc.steps, proc.caveats, proc.endpoint, proc.preconditions];
+    for (const field of fields) {
+        for (const target of commandDirectoryTargets(field || '')) {
+            if (!roots.some(root => isInsideCheckout(target, root)))
+                return target;
+        }
+    }
+    return null;
+}
+// ---------- Resolving this project's checkouts (filesystem) -------------------
+/** Walk up for the directory holding `.git`. Null outside a repo. */
+function findCheckoutRoot(startDir) {
+    let dir = path.resolve(startDir);
+    for (;;) {
+        try {
+            if (fs.existsSync(path.join(dir, '.git')))
+                return dir;
+        }
+        catch { /* unreadable → keep walking */ }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/** The main checkout behind a worktree. A worktree's `.git` is a FILE holding
+ *  `gitdir: <main>/.git/worktrees/<name>`, so the main root is two levels above
+ *  that. Without this, every recipe a worktree session read that named the main
+ *  checkout by absolute path would look foreign — the same project, discarded
+ *  for having more than one directory. Null when `.git` is an ordinary dir. */
+function mainCheckoutRoot(checkoutRoot) {
+    const dotGit = path.join(checkoutRoot, '.git');
+    try {
+        if (!fs.statSync(dotGit).isFile())
+            return null;
+        const m = /^\s*gitdir:\s*(.+?)\s*$/m.exec(fs.readFileSync(dotGit, 'utf-8'));
+        if (!m)
+            return null;
+        const gitDir = path.resolve(checkoutRoot, m[1]);
+        const marker = normalizeCheckoutPath(gitDir).indexOf('/worktrees/');
+        if (marker < 0)
+            return null;
+        // <main>/.git/worktrees/<name> → <main>/.git → <main>
+        return path.dirname(gitDir.slice(0, marker));
+    }
+    catch {
+        return null;
+    }
+}
+/** Every checkout root that IS this project: the enclosing checkout, plus the
+ *  main repository when the enclosing one is a worktree. Falls back to the
+ *  directory itself outside a repo. */
+function projectCheckoutRoots(startDir) {
+    const root = findCheckoutRoot(startDir);
+    if (!root)
+        return startDir ? [path.resolve(startDir)] : [];
+    const main = mainCheckoutRoot(root);
+    return main && normalizeCheckoutPath(main) !== normalizeCheckoutPath(root)
+        ? [root, main]
+        : [root];
+}

package/dist/procedure-watch.js

@@ -72,6 +72,8 @@ exports.openWatchIfIdle = openWatchIfIdle;
 const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
 const procedure_1 = require("./procedure");
+const delivery_lifecycle_1 = require("./delivery-lifecycle");
+const procedure_scope_1 = require("./procedure-scope");
 /** Watchdog backstop: a watch never observes past this many turns — the next
  *  turn aborts it (log a fix-queue smell, never distill). */
 exports.WATCH_MAX_TURNS = 15;
@@ -87,21 +89,10 @@ const DIGEST_COMMAND_CAP = 180;
 const DIGEST_EXIT_HINT_CAP = 80;
 const DIGEST_MAX_FILES = 8;
 // ---------- Tier-1 LEARN trigger vocabulary (PURE data) -----------------------
-/** The Tier-1 trigger set for OPENING A LEARN WATCH, independent of the store
- *  (docs/procedure-system.md §Tier 1: deploy / push / release / ship / build /
- *  test — `ship` phrases map to the `release` verb, matching GIT_SEED_SET).
- *  `build` + `test` have no seed: the clean LEARN proof case. `push` is
- *  destructive — it sits here only so the opener can NAME the refusal; a LEARN
- *  watch never opens for it (the seed is the canon even when stale). Entries
- *  are Procedure-shaped (steps empty — vocabulary, not recipes) so the same
- *  matcher + intent guard run over them. */
-exports.TIER1_LEARN_TRIGGERS = [
-    { verb: 'deploy', triggers: ['deploy', 'deploy the api', 'deploy the worker', 'redeploy'], steps: '', status: 'seeded' },
-    { verb: 'push', triggers: ['push', 'git push', 'push to remote', 'push it up', 'push upstream'], steps: '', status: 'seeded', destructive: true },
-    { verb: 'release', triggers: ['release', 'ship', 'ship it', 'ship a release', 'cut a release', 'publish the release', 'do a release'], steps: '', status: 'seeded' },
-    { verb: 'build', triggers: ['build', 'rebuild', 'compile', 'run the build'], steps: '', status: 'seeded' },
-    { verb: 'test', triggers: ['test', 'tests', 'run the tests', 'run tests'], steps: '', status: 'seeded' },
-];
+/** The Tier-1 trigger set for OPENING A LEARN WATCH lives in procedure.ts
+ *  (LEARN_TRIGGER_VOCABULARY) so the store's read-time re-keying can reach it
+ *  without a circular import; re-exported here under its historical name. */
+exports.TIER1_LEARN_TRIGGERS = procedure_1.LEARN_TRIGGER_VOCABULARY;
 /** Match a prompt against the Tier-1 LEARN vocabulary (same matcher + intent
  *  guard as the store path). PURE. */
 function matchLearnTrigger(prompt) {
@@ -240,13 +231,35 @@ function liveSpan(watch) {
  *  outcome. A missing required field = the unreadable/judge-down row → no
  *  write. All writes flow through upsertProcedure, whose destructive guard
  *  already refuses to overwrite a `push` seed (never weakened here).
+ *
+ *  `checkoutRoots` are the directories this project's checkout occupies (from
+ *  projectCheckoutRoots). A distilled recipe that runs its commands in some
+ *  OTHER checkout is evidence the span was not about this project, so it is
+ *  discarded rather than sanitised — see below.
  *  PURE — unit-tested. Returns the (possibly unchanged) store + what happened. */
-function applyDistillTransition(store, watch, outcome, distilled, fallbackTriggers) {
+// adr: adr/procedure-project-scope.md
+function applyDistillTransition(store, watch, outcome, distilled, fallbackTriggers, checkoutRoots = []) {
     const existing = store.procedures.find(p => p.verb === watch.verb);
     // Shadow watches are evidence only. They can never confirm, stale, relearn,
     // or otherwise mutate the procedure definition.
     if (watch.phase === 'SHADOW')
         return { store, action: 'discarded' };
+    // A delivery-owned verb has no registry presence at all. The distiller has no
+    // business writing one, and when it did the damage was total: project
+    // suppliersift-site's `verify` — the answer to "is my change live" — was
+    // relearned into `node scripts/worktree-bootstrap.cjs` from a floundered
+    // REPLAY span, and injected that on every later ask.
+    if ((0, delivery_lifecycle_1.isDeliveryOwnedVerb)(watch.verb))
+        return { store, action: 'discarded' };
+    // A span whose commands ran in another repository was never about this
+    // project. Project sift's `build` verb was written from one such span and
+    // held `cd /c/suppliersift-site && git merge --no-ff … chip/fix-css-render-
+    // harness-gap` — another repo's merge, injected as sift's build recipe. There
+    // is no correct salvage: the steps are right for a checkout this session is
+    // not in, so the whole span goes.
+    if (distilled && (0, procedure_scope_1.foreignCheckoutTarget)(distilled, checkoutRoots)) {
+        return { store, action: 'discarded' };
+    }
     if (watch.phase === 'LEARN') {
         if (!distilled)
             return { store, action: 'discarded' };

package/dist/procedure.js

@@ -50,9 +50,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BUILTIN_PROCEDURES = exports.GIT_SEED_SET = exports.PROCEDURE_STORE_VERSION = void 0;
+exports.BUILTIN_PROCEDURES = exports.LEARN_TRIGGER_VOCABULARY = exports.GIT_SEED_SET = exports.REDACTED_PROJECT_DIR_MARKER = exports.PROCEDURE_STORE_VERSION = void 0;
 exports.procedureStorePath = procedureStorePath;
 exports.readProcedureStore = readProcedureStore;
+exports.isRequestPhraseTrigger = isRequestPhraseTrigger;
+exports.requestPhraseTriggers = requestPhraseTriggers;
+exports.requestPhraseKeyedProcedure = requestPhraseKeyedProcedure;
+exports.healRedactedProjectDir = healRedactedProjectDir;
+exports.dropForeignCheckoutProcedures = dropForeignCheckoutProcedures;
 exports.normalizeProcedureStore = normalizeProcedureStore;
 exports.writeProcedureStore = writeProcedureStore;
 exports.procedureId = procedureId;
@@ -74,6 +79,7 @@ exports.activeProcedureAnnounces = activeProcedureAnnounces;
 const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
 const delivery_lifecycle_1 = require("./delivery-lifecycle");
+const procedure_scope_1 = require("./procedure-scope");
 exports.PROCEDURE_STORE_VERSION = '2';
 // ---------- Store I/O (local, hot-path) --------------------------------------
 function stateDir() {
@@ -92,9 +98,10 @@ function readProcedureStore(projectId) {
         const raw = fs.readFileSync(procedureStorePath(projectId), 'utf-8');
         const parsed = JSON.parse(raw);
         if (parsed && Array.isArray(parsed.procedures)) {
+            const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
             return normalizeProcedureStore({
                 version: parsed.version || '1',
-                procedures: parsed.procedures,
+                procedures: dropForeignCheckoutProcedures(parsed.procedures.map(p => healRedactedProjectDir(p, projectDir)), (0, procedure_scope_1.projectCheckoutRoots)(projectDir)),
                 installs: Array.isArray(parsed.installs) ? parsed.installs : [],
             });
         }
@@ -102,18 +109,93 @@ function readProcedureStore(projectId) {
     catch { /* missing / unreadable → empty */ }
     return { version: exports.PROCEDURE_STORE_VERSION, procedures: [], installs: [] };
 }
+/** A trigger is a REQUEST PHRASE when it is more than one word. A single
+ *  common word (`test`, `build`) is a mention, not a request, and a machine-
+ *  learned recipe keyed on one fires on every conversational use of the word
+ *  (adr/procedure-trigger-specificity.md). PURE. */
+function isRequestPhraseTrigger(trigger) {
+    return /\S\s+\S/.test((trigger || '').trim());
+}
+/** Keep only the request-phrase triggers. PURE. */
+function requestPhraseTriggers(triggers) {
+    return (triggers || []).filter(isRequestPhraseTrigger);
+}
+/** Machine-learned rows (anything the LEARN leg wrote: learned / confirmed /
+ *  stale / discovered) replay ONLY on request phrases. Operator-authored
+ *  `seeded` rows keep whatever they were registered with. A row left with no
+ *  phrase falls back to the verb's vocabulary phrases; with none it is dormant
+ *  (listed, never fired) rather than firing on a bare word. PURE. */
+// adr: adr/procedure-trigger-specificity.md
+function requestPhraseKeyedProcedure(proc) {
+    if (proc.status === 'seeded' || (0, delivery_lifecycle_1.isDeliveryLifecycleVerb)(proc.verb))
+        return proc;
+    const own = requestPhraseTriggers(proc.triggers);
+    if (own.length === proc.triggers.length)
+        return proc;
+    const vocab = exports.LEARN_TRIGGER_VOCABULARY.find(p => p.verb === proc.verb);
+    const triggers = own.length ? own : requestPhraseTriggers(vocab?.triggers ?? []);
+    return { ...proc, triggers };
+}
+/** The marker the Stop hook's env walker used to write in place of the project
+ *  directory before it learned that a path is never a secret
+ *  (adr/secret-scrubber.md, 2026-09-09). */
+exports.REDACTED_PROJECT_DIR_MARKER = '[REDACTED:CLAUDE_PROJECT_DIR]';
+/** Heal a recipe distilled under the old walker: every project-dir marker in
+ *  its text fields becomes the CURRENT project directory, so the steps run
+ *  again. Read-time only — the store file is rewritten healed on its next
+ *  write. Untouched rows come back by reference. PURE. */
+// adr: adr/secret-scrubber.md
+function healRedactedProjectDir(proc, projectDir) {
+    if (!projectDir)
+        return proc;
+    const heal = (s) => s && s.includes(exports.REDACTED_PROJECT_DIR_MARKER)
+        ? s.split(exports.REDACTED_PROJECT_DIR_MARKER).join(projectDir)
+        : s;
+    const steps = heal(proc.steps);
+    const caveats = heal(proc.caveats);
+    const endpoint = heal(proc.endpoint);
+    const preconditions = heal(proc.preconditions);
+    if (steps === proc.steps && caveats === proc.caveats
+        && endpoint === proc.endpoint && preconditions === proc.preconditions)
+        return proc;
+    return { ...proc, steps: steps, caveats, endpoint, preconditions };
+}
+/** Drop machine-learned rows whose commands run in a checkout this project does
+ *  not own. The write-time guard stops new ones; this retires the ones already
+ *  on disk, at read time, with no migration — the same pattern the re-keying and
+ *  the seed refresh use. Operator-authored `seeded` rows are exempt: a person
+ *  who hand-registers a step in a sibling checkout meant to. Discarded, never
+ *  repointed — the steps are correct for a repository we are not in, so there is
+ *  nothing here to salvage. PURE. */
+// adr: adr/procedure-project-scope.md
+function dropForeignCheckoutProcedures(procedures, checkoutRoots) {
+    return procedures.filter(proc => proc.status === 'seeded' || !(0, procedure_scope_1.foreignCheckoutTarget)(proc, checkoutRoots));
+}
 /** Seeded git procedures are bundled definition snapshots. Refresh stale local
  *  copies on read so upgraded CLIs cannot keep injecting old seed text forever.
- *  Learned/confirmed/stale procedures remain project-owned evidence. */
+ *  Learned/confirmed/stale procedures remain project-owned evidence, but their
+ *  triggers are re-keyed to request phrases on read (a store learned under the
+ *  old bare-word vocabulary otherwise keeps firing on mentions forever). */
 function normalizeProcedureStore(store) {
     return {
         ...store,
         version: store.version || exports.PROCEDURE_STORE_VERSION,
-        procedures: store.procedures.map(proc => {
+        // A delivery-owned verb that is NOT lifecycle vocabulary has no legitimate
+        // registry presence at all, so its stored row is DROPPED on read rather than
+        // refreshed. `verify` is the whole of that set today: it was invented on
+        // 2026-09-04 to push deploy knowledge at sessions, it went stale on one
+        // machine and was relearned into an unrelated command on the other, and the
+        // operator removed it on 2026-09-11 as something they never asked for.
+        // Dropping on read is what keeps it removed everywhere without a migration.
+        // The five lifecycle verbs keep their rows — they are shadow-only vocabulary
+        // the announce-first pilot uses for receipts, and inject nothing.
+        procedures: store.procedures
+            .filter(proc => !(0, delivery_lifecycle_1.isDeliveryOwnedVerb)(proc.verb) || (0, delivery_lifecycle_1.isDeliveryLifecycleVerb)(proc.verb))
+            .map(proc => {
             const seed = exports.GIT_SEED_SET.find(p => p.verb === proc.verb);
             return seed && proc.status === 'seeded'
                 ? { ...seed, updatedAt: proc.updatedAt }
-                : proc;
+                : requestPhraseKeyedProcedure(proc);
         }),
         installs: store.installs ?? [],
     };
@@ -386,6 +468,30 @@ exports.GIT_SEED_SET = [
         status: 'seeded',
     },
 ];
+// ---------- Tier-1 LEARN trigger vocabulary (PURE data) -----------------------
+/** The Tier-1 trigger set for OPENING A LEARN WATCH, independent of the store
+ *  (docs/procedure-system.md §Tier 1: deploy / push / release / ship / build /
+ *  test — `ship` phrases map to the `release` verb, matching GIT_SEED_SET).
+ *  `build` + `test` have no seed: the clean LEARN proof case. `push` is
+ *  destructive — it sits here only so the opener can NAME the refusal; a LEARN
+ *  watch never opens for it (the seed is the canon even when stale). Entries
+ *  are Procedure-shaped (steps empty — vocabulary, not recipes) so the same
+ *  matcher + intent guard run over them.
+ *
+ *  Learnable verbs (`build`, `test`) carry REQUEST PHRASES ONLY. A bare
+ *  `test`/`build` opened a LEARN watch on any conversational use of the word
+ *  ("a short test to confirm", "build the tower"), distilled whatever the next
+ *  turns happened to do into a recipe, then injected that recipe on every
+ *  later mention (adr/procedure-trigger-specificity.md). Lifecycle verbs keep
+ *  their bare words: they are shadow-only vocabulary and inject nothing. */
+// adr: adr/procedure-trigger-specificity.md
+exports.LEARN_TRIGGER_VOCABULARY = [
+    { verb: 'deploy', triggers: ['deploy', 'deploy the api', 'deploy the worker', 'redeploy'], steps: '', status: 'seeded' },
+    { verb: 'push', triggers: ['push', 'git push', 'push to remote', 'push it up', 'push upstream'], steps: '', status: 'seeded', destructive: true },
+    { verb: 'release', triggers: ['release', 'ship', 'ship it', 'ship a release', 'cut a release', 'publish the release', 'do a release'], steps: '', status: 'seeded' },
+    { verb: 'build', triggers: ['run the build', 'build the project', 'build the app', 'rebuild the project'], steps: '', status: 'seeded' },
+    { verb: 'test', triggers: ['run the tests', 'run tests', 'run the test suite', 'run the unit tests'], steps: '', status: 'seeded' },
+];
 /** No bundled orchestration procedures are active. The retired `ship-through`
  *  prototype proved the install/run split but conflated deploy recipes with
  *  review/session workflow. Deploy now routes through repo/target DeploySchema. */

package/dist/project-anchor.js

@@ -45,8 +45,6 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ASSISTANT_ROLE = void 0;
-exports.isAssistantProject = isAssistantProject;
 exports.computeGitDerivedProjectId = computeGitDerivedProjectId;
 exports.readAnchor = readAnchor;
 exports.ensureGlobalAnchor = ensureGlobalAnchor;
@@ -57,17 +55,6 @@ const fs = __importStar(require("fs"));
 const crypto = __importStar(require("crypto"));
 const os = __importStar(require("os"));
 const proc_1 = require("./proc");
-/** Role value flagging a project as the tenant's GrepRAG Assistant. Mirrors the
- *  single-resolution-point shape of `resolveReceptionistProject` (`@greprag/core`),
- *  but the assistant is a LOCAL flag in `.greprag/project.json`
- *  (`"role": "assistant"`) — no server migration, resolvable by the zero-dep hook
- *  from the anchor it already reads. adr: adr/assistant-role.md */
-exports.ASSISTANT_ROLE = 'assistant';
-/** True iff this project is the designated GrepRAG Assistant — the single gate both
- *  hook paths use (doctrine auto-load + `--assistant` arm). Pure, no filesystem. */
-function isAssistantProject(anchor) {
-    return anchor.role === exports.ASSISTANT_ROLE;
-}
 const ANCHOR_DIR = '.greprag';
 const ANCHOR_FILE = 'project.json';
 const LEGACY_ANCHOR_DIR = '.claude';
@@ -428,7 +415,7 @@ function ensureAnchor(cwd, projectName) {
     };
 }
 /** Set (or clear, when `role === null`) the project `role` flag in the repo-level
- *  `.greprag/project.json`, preserving every other field. Backs `greprag assistant
+ *  `.greprag/project.json`, preserving every other field. Backs `greprag mechanic
  *  set/unset` so the operator never hand-edits JSON. adr: adr/assistant-role.md */
 function setProjectRole(cwd, role) {
     // Ensure a repo-level anchor file exists to carry the flag (idempotent).

package/dist/reminder-injector.js

@@ -134,26 +134,24 @@ async function injectReminders(input, cfg, short, platform = 'claude-code') {
     try {
         const cwd = input.cwd || process.cwd();
         const anchor = (0, project_anchor_1.readAnchor)(cwd);
-        const codex = platform === 'codex';
-        let armed = codex;
+        // Only a watcher-driven harness needs the local pidfile probe. claude-code went
+        // turn-based (2026-09-04) and codex always was, so both report armed and skip the
+        // probe entirely — no watcher state, no unread pre-count, no arm nag.
+        const watcherDriven = platform === 'grok';
+        let armed = !watcherDriven;
         let sessionUnread = 0;
         let ownerPid = null;
-        if (!codex) {
+        if (watcherDriven) {
             const watcher = await claudeWatcherState(short);
             armed = watcher.armed;
             ownerPid = watcher.ownerPid;
             if (!armed)
                 sessionUnread = await fetchSessionUnread(cfg.apiUrl, cfg.apiKey, short);
         }
-        let assistant = false;
         let mechanic = false;
         let mechanicLive = false;
         let mechanicEpoch = null;
         let mechanicSessionId = null;
-        try {
-            assistant = (0, project_anchor_1.isAssistantProject)(anchor);
-        }
-        catch { /* fail-open */ }
         try {
             mechanicLive = (0, mechanic_role_1.isMechanicProject)(anchor);
             mechanic = (0, mechanic_role_1.isMechanicSession)(anchor, short);
@@ -181,7 +179,7 @@ async function injectReminders(input, cfg, short, platform = 'claude-code') {
         const env = {
             short, turnCount, stress, armed, sessionUnread,
             bootstrapFriction,
-            ownerPid, alias: (0, session_id_1.readIdentityAlias)(), assistant, mechanic, mechanicLive,
+            ownerPid, alias: (0, session_id_1.readIdentityAlias)(), mechanic, mechanicLive,
             mechanicLiveNotice: mechanicLiveNoticeDue({
                 projectId: anchor.projectId,
                 sessionId: short,
@@ -194,7 +192,10 @@ async function injectReminders(input, cfg, short, platform = 'claude-code') {
             promptText,
             equippedLoadouts,
         };
-        const base = (0, app_settings_1.filterEnabledInterrupts)((0, reminder_registry_1.promptModules)()).filter(m => !codex || m.id !== 'watcher-arm');
+        // Harness scoping comes from each module's own `harnesses:` tag (the whitelist-drift
+        // killer), NOT from an ad hoc id filter here. The old hardcoded codex/watcher-arm
+        // exclusion made the per-turn surface disagree with the announce surface.
+        const base = (0, app_settings_1.filterEnabledInterrupts)((0, reminder_registry_1.harnessModules)(platform, (0, reminder_registry_1.promptModules)()));
         const reg = mechanicKilled() ? base.filter(m => m.id !== 'mechanic-friction') : base;
         const fired = (0, reminder_registry_1.collectReminders)(env, reg);
         if (!fired.length)