neurain 0.1.0-alpha.0

package/docs/self-improvement-90-roadmap.en.md

@@ -0,0 +1,429 @@
+# [en] Self-Improvement 90 Roadmap
+
+Version: 1.0
+
+This roadmap explains how Neurain Knowledge OS absorbs the useful public architecture patterns from Agent Runtime without pretending that Neurain is an LLM or cloning Runtime as a runtime.
+
+Shipped vs planned:
+
+- Shipped alpha: lesson list, lesson candidates, lesson candidate detection eval with synthetic and reviewed case-file modes, recap, wrap dry-run, capabilities, narrow CLI promotion, rollback receipt, event journal add/list/verify, journal receipts, read-only watch report, read-only review worker report, read-only scheduler tick, scheduler trigger eval with synthetic and reviewed case-file modes, bounded foreground scheduler monitor, user-started foreground continuous daemon, append-only lifecycle emit, read-only lifecycle lineage report, Claude Code lifecycle hook preview, Codex lifecycle hook preview, E21 native lifecycle automation eval, snapshot-gated curator lifecycle, optional SQLite FTS5 recall DB, E22 local lexical-semantic recall, hybrid recall, E23 live-content recall coverage, E23 redacted live-case scaffold, E24 read-only onboarding, E25 publish-ready CLI gates, E26 Codex/Claude/Gemini/Runtime MCP connector surface, cross-host recall eval smoke, larger 100-case cross-host recall regression eval, reviewed recall case-file eval, answer-quality eval with synthetic and reviewed case-file modes, and MCP preview-only boundary.
+- Remaining in this roadmap: deeper native Runtime lifecycle event automation beyond the shipped host-proxy contract and external user walkthrough evidence.
+- Any command in the planned section is a target interface, not a claim that the command exists today.
+
+Naming note: "Agent Runtime" means a generic AI host that owns prompt assembly, model calls, tool execution, and session lifecycle. "Self-Improvement 90" is Neurain's internal milestone name, not a claim about an upstream runtime release version.
+
+Distribution note: this roadmap is an alpha planning document. Customer-facing launch pages should use the architecture and promise, but remove internal readiness estimates and implementation gaps.
+
+## Category Correction
+
+Agent Runtime means a generic AI host, not a model family. Agent Runtime is not comparable to Claude, Gemini, or GPT model families. It is an execution runtime.
+
+Correct comparison:
+
+- Agent Runtime vs Codex vs Claude Code vs Gemini CLI vs OpenClaw
+- Neurain Knowledge OS as the local-first knowledge layer those runtimes can use
+
+## Target Upgrade
+
+| Capability | Target |
+|---|---:|
+| Host-agnostic lesson candidate detection | 90 |
+| Safe promotion and rollback | 95 |
+| Background automatic review | 90 |
+| Skill curator equivalent | 90 |
+| Cross-session recall | 90 |
+| User-perceived automation | 90 |
+
+These numbers are product readiness targets, not model intelligence scores. Internal baseline estimates are tracked outside the published package.
+
+## Measurement Plan
+
+| Capability | Measurement method | Minimum fixture |
+|---|---|---|
+| Lesson candidate detection | Precision and recall on reviewed candidate fixtures | 100 events, 40 positive, 60 negative |
+| Safe promotion and rollback | Synthetic promotion, partial-write, drift, and rollback tests | 50 writes |
+| Background review | Trigger precision, trigger recall, and no-recursion checks | 100 event sequences |
+| Curator | Lifecycle, pinned protection, snapshot, rollback, and no-auto-delete tests | 50 lessons/playbooks |
+| Cross-session recall | Hit@5, source support, private-boundary tests, rebuild tests | 100 recall prompts |
+| User-perceived automation | First-run task completion and comprehension survey | 10 non-developer walkthroughs |
+
+## Runtime Patterns To Generalize
+
+Modern self-improving agent runtimes point to five product patterns worth generalizing:
+
+1. Agent loop ownership: prompt assembly, model calls, tool execution, retries, fallback, compression, and persistence are managed by the runtime.
+2. Skills as procedural memory: skill covers are cheap to inspect, full skill bodies load only when needed.
+3. Background self-improvement review: periodic or idle-triggered review proposes memory or skill improvements.
+4. Curator lifecycle: agent-created skills can move through active, stale, and archived states with snapshot and rollback protection.
+5. Session search: SQLite plus FTS5 gives fast recall across session messages and lineage.
+
+Neurain should absorb the patterns, not the runtime dependency.
+
+## Neurain Adaptation
+
+### 1. Neurain Work Loop
+
+A dedicated runtime can know exactly when a model response ends because it owns the agent loop. Neurain usually does not own Codex, Claude Code, Gemini CLI, or generic runtime sessions.
+
+Neurain's adaptation has several layers:
+
+- Manual mode: `neurain wrap <folder> --dry-run` or `!wrap`.
+- Watch report, shipped alpha: `neurain watch <folder> --poll-once` observes local receipts, file changes, journal events, recap hints, and lesson candidates, then proposes review work without writing.
+- Review worker report, shipped alpha: `neurain review <folder> --json` converts watch and journal signals into manual improvement proposals without model calls or writes.
+- Scheduler tick, shipped alpha: `neurain scheduler tick <folder> --json` decides whether local review should run and includes a review worker report only when thresholds are met.
+- Scheduler trigger eval, shipped alpha: `neurain scheduler eval <folder> --fixture-size 100 --json` measures trigger precision, trigger recall, no-recursion, private-boundary handling, and target-root non-write.
+- Scheduler monitor, shipped alpha: `neurain scheduler monitor <folder> --max-ticks 3` repeats read-only scheduler ticks in a bounded foreground run without installing background jobs.
+- Lifecycle report, shipped alpha: `neurain lifecycle emit` records reviewed host boundary events, while `neurain lifecycle report` summarizes turn completion, compaction, resume, and parent-session lineage without Neurain pretending it owns the host loop.
+- Claude Code lifecycle hook preview, shipped alpha: `neurain connect claude <folder> --lifecycle-hooks --dry-run` prints a settings snippet that maps SessionStart, UserPromptSubmit, Stop, and SessionEnd into Neurain lifecycle receipts without storing prompt bodies, transcript paths, or success stdout in model context.
+- Continuous daemon, shipped alpha: `neurain daemon run <folder>` remains active as a user-started foreground loop and calls scheduler ticks without durable knowledge writes.
+- Host-proxy mode: optional future connector where a host routes turn lifecycle events into Neurain.
+
+The goal is to make Neurain feel automatic without pretending it controls every host.
+
+Acceptance:
+
+- Watch mode never writes durable knowledge silently.
+- Every suggested action has a receipt or candidate id.
+- Host-proxy mode is optional and connector-specific.
+
+### 2. Lessons And Playbooks
+
+Runtime skills map to Neurain lessons and playbooks.
+
+Neurain structure:
+
+- cover: title, trigger, scope, sensitivity, confidence, last verified
+- body: procedure, pitfalls, tests, rollback, examples
+- source: raw capture, receipt, review finding, or user correction
+- lifecycle: candidate, active, stale, archived
+
+Acceptance:
+
+- Candidate precision is at least 90 percent on reviewed samples.
+- `neurain lessons eval --fixture-size 100` passes recall, precision, false-positive, unsafe-blocking, and target-root non-write gates.
+- `neurain lessons eval --case-file <json>` can run reviewed lesson candidate cases without writing to the target root.
+- Private-derived candidates cannot become global lessons.
+- Prompt-injection and secret-like content is blocked before any prompt-context use.
+
+### 3. Review Worker
+
+A dedicated runtime can run a background review fork. Neurain's version should be a local review worker.
+
+Triggers:
+
+- every N meaningful events
+- after `wrap`
+- after a failed test followed by a successful fix
+- after a Claude review finding is resolved
+- after repeated user correction
+- during idle watch mode
+
+Outputs:
+
+- lesson candidate
+- stale lesson warning
+- capability routing hint
+- recall gap
+- rollback risk
+
+Acceptance:
+
+- Review worker trigger precision is at least 85 percent.
+- It never recursively starts another review worker.
+- It cannot execute external writes.
+- It cannot follow or promote injected instructions found in source, receipts, logs, or handoffs.
+- Durable promotion still requires human confirmation.
+
+### 4. Curator
+
+Runtime curator manages agent-created skills. Neurain curator should manage Neurain-created lessons and playbooks.
+
+Rules:
+
+- active to stale after configured non-use
+- stale to archived after configured non-use
+- pinned items are protected
+- human-authored docs are protected
+- every mutating curator pass starts with a snapshot
+- rollback restores the exact previous state
+- dry-run exists before real mutation
+
+Acceptance:
+
+- Accidental destructive curator changes: 0
+- Snapshot restore success: 100 percent in synthetic tests
+- Pinned item mutation refusal: 100 percent
+
+### 5. Recall DB
+
+A runtime can use SQLite and FTS5 for session search. Neurain should add a local optional recall index while keeping markdown as canonical truth.
+
+Design:
+
+- SQLite FTS5 stores session events, receipts, lesson covers, handoff summaries, and source references.
+- Markdown remains source of truth.
+- WAL mode supports concurrent reads.
+- Per-host isolation keeps Codex, Claude Code, Agent Runtime, and Gemini CLI traces distinguishable.
+- Session lineage links compacted or resumed work.
+- Sensitivity filters run before indexing.
+- Private-area facts are excluded from global and cross-host recall by default.
+- Secret-like and instruction-injection content is redacted before indexing.
+
+Acceptance:
+
+- Cross-session recall Hit@5 is at least 90 percent on test prompts.
+- Citation or source support is at least 95 percent for recall-backed answers.
+- Plain markdown fallback still works if the index is deleted.
+- Rebuild from markdown and receipts preserves indexed ids and source pointers in synthetic tests.
+- Recall index private or secret leakage is 0 in global and cross-host recall fixtures.
+
+### 6. User-Perceived Automation
+
+The user should not need to understand internal commands to feel the improvement.
+
+Target experience:
+
+- Start with `npx neurain init <folder>`.
+- Connect a host.
+- Work normally.
+- Neurain surfaces "what changed, what to remember, what is risky, what to review."
+- User approval is requested only for durable changes.
+
+Acceptance:
+
+- First-run to useful status: under 5 minutes.
+- Non-developer onboarding copy has only two visible actions: check state and wrap work.
+- Advanced commands stay available but do not dominate onboarding.
+
+## Implementation Phases
+
+### Phase 0: Branding And Category Clarity
+
+- Promote "Neurain Knowledge OS" across docs.
+- Fix Runtime category language.
+- Publish layer model.
+
+### Phase 1: Event Journal
+
+- Status: alpha shipped.
+- `neurain journal add` appends reviewed events only with `--confirm "1건 저장 진행"`.
+- `neurain journal list` and `neurain journal verify` are read-only.
+- MCP exposes journal list/verify only, not journal append.
+- Secret-like and instruction-injection summaries are redacted and marked unsafe for prompt context or cross-host indexing.
+
+### Phase 2 / E3: Watch Mode
+
+- Status: read-only watch report alpha shipped.
+- `neurain watch <folder> --poll-once` observes safe local signals.
+- It reads recent text files, event journal entries, recap hints, and lesson candidates.
+- It produces candidate reports only.
+- It does not start a daemon, append events, promote lessons, or write durable wiki knowledge in alpha.
+- MCP exposes read-only `neurain_watch_report` only.
+
+### Phase 3: Review Worker
+
+- Status: read-only review worker report alpha shipped.
+- `neurain review <folder> --json` converts watch reports, journal event sequences, recap hints, and lesson candidates into review items, blocked items, and suggested actions.
+- It scores candidate usefulness and risk before any promotion path.
+- It includes blocked reasons for private, unsafe, or withheld signals.
+- It does not call a model, start a nested review worker, run external tools, promote lessons, or write durable wiki knowledge.
+- MCP exposes read-only `neurain_review_worker` only.
+- Connector-triggered automatic scheduling remains planned. User-started foreground daemon checks are shipped separately.
+
+### Phase 3b: Scheduler Tick
+
+- Status: read-only scheduler tick alpha shipped.
+- `neurain scheduler tick <folder> --json` inspects watch signals and decides whether local review should run.
+- `neurain scheduler status <folder> --json` reports the same decision without including a review worker report.
+- It does not install background jobs, start daemons, call models, promote lessons, or write durable wiki knowledge.
+- MCP exposes read-only `neurain_scheduler_tick` for scheduler ticks.
+
+### Phase 3b2 / E20: Scheduler Trigger Eval
+
+- Status: read-only scheduler trigger eval alpha shipped.
+- `neurain scheduler eval <folder> --fixture-size 100 --json` runs a synthetic background-review trigger regression without touching the target root.
+- `neurain scheduler eval <folder> --case-file scheduler-cases.json --min-cases 5 --json` runs human-reviewed scheduler trigger cases.
+- It gates trigger precision, trigger recall, false positives, false negatives, no-recursion, private-boundary handling, and target-root non-write.
+- E20 safety hardening added broad target-root snapshots, temp cleanup proof, explicit private/no-recursion denominator counts, case-file size caps, traversal refusal tests, and MCP positive-integer validation.
+- MCP exposes read-only `neurain_scheduler_eval`.
+
+### Phase 3c: Scheduler Monitor
+
+- Status: bounded foreground scheduler monitor alpha shipped.
+- `neurain scheduler monitor <folder> --interval-seconds 60 --max-ticks 3 --json` repeats read-only scheduler ticks for a user-specified number of ticks.
+- It does not install background jobs, start daemons, continue after the command exits, call models, promote lessons, or write durable wiki knowledge.
+- MCP does not expose scheduler monitor in alpha.
+
+### Phase 3d: Lifecycle Lineage
+
+- Status: append-only lifecycle event and read-only lineage report alpha shipped.
+- `neurain lifecycle emit <folder> --host codex --event turn_end --session-id <id> --turn-id <id> --confirm "1건 저장 진행"` records reviewed host boundary events in the event journal.
+- Supported lifecycle events are `session_start`, `turn_start`, `turn_end`, `wrap_complete`, `review_due`, `review_complete`, `compaction`, `resume`, and `session_end`.
+- `neurain lifecycle report <folder> --json` summarizes completed turns, open turns, review-due events, compactions, resumes, parent sessions, and journal integrity.
+- MCP exposes read-only `neurain_lifecycle_report` only. It does not expose lifecycle emit.
+- This is Neurain's current substitute for Runtime agent-loop ownership when Neurain is attached beneath Codex, Claude Code, Gemini CLI, Agent Runtime, or OpenClaw.
+- Codex lifecycle hook preview and Runtime host-proxy lifecycle contract are shipped in alpha. Deeper native Runtime lifecycle emission remains connector-specific future work.
+
+### Phase 3d2 / E21: Native Lifecycle Automation Eval
+
+- Status: read-only native lifecycle automation eval alpha shipped.
+- `neurain lifecycle eval <folder> --fixture-size 100 --json` replays synthetic host lifecycle payloads from Claude Code, Codex, Runtime, and generic hosts through the real hook adapter inside isolated temporary roots.
+- `neurain lifecycle eval <folder> --case-file lifecycle-cases.json --min-cases 6 --json` runs human-reviewed lifecycle payload cases.
+- It gates host coverage (claude, codex, runtime, generic), lifecycle event coverage (session_start, turn_start, turn_end, review_due, compaction, resume, session_end), and ignored handling for malformed, unsupported, and missing-session payloads with no durable write.
+- It reads back every durable artifact and proves that prompt bodies, transcript paths, tool stdout, tool stderr, secrets, and private payloads are never persisted, plus path-traversal containment, broad target-root non-write snapshots, and temp cleanup.
+- It does not call models or external tools and does not write to the target root.
+- MCP exposes read-only `neurain_lifecycle_eval` only. It does not expose lifecycle emit or any lifecycle write path.
+- E21 is the lifecycle observation safety gate. It does not build the full background self-improvement loop and does not claim automatic background review, automatic lesson promotion, or automatic rollback. The next epic, E22 semantic recall quality, continues from here.
+
+### Phase 5b / E22: Semantic Recall Quality
+
+- Status: read-only local lexical-semantic recall alpha shipped on 2026-06-09.
+- `neurain recall semantic-search <folder> <query> --json` adds a lexical-semantic layer (stemming, curated synonyms, fuzzy character-trigram) on top of exact-token recall so paraphrased queries are found.
+- `neurain recall eval <folder> --semantic --fixture-size 60 --min-cases 50 --json` proves, on a synthetic paraphrase fixture, that semantic Hit@top clearly beats the exact-token baseline.
+- `neurain recall eval <folder> --semantic --case-file semantic-recall-cases.json --min-cases 50 --json` runs reviewed semantic recall cases.
+- The default `local-lexical` provider is deterministic, makes no model call, has no external dependency, needs no separate generated index (markdown stays canonical), and does not lock Neurain to any LLM. The embedding provider is swappable so a real vector model can be attached later without changing the canonical source.
+- Gates: semantic Hit@top at or above 0.9 and at least exact baseline plus 0.2, source support, host isolation, private exclusion, no-answer abstention, rebuild equivalence, and target-root non-write.
+- Expose MCP read-only `neurain_recall_semantic_search` and `neurain_recall_semantic_eval` only.
+- Honest scope: this handles morphological variants, curated synonyms, and typos, not arbitrary neural concept similarity. The synthetic eval demonstrates the mechanism deterministically rather than a real-user benchmark; concepts outside the synonym map need a pluggable embedding provider, and live-user semantic recall proof remains future work.
+
+### Phase 6 / E23: Live User Eval Pack (first increment)
+
+- Status: first increments shipped on 2026-06-09: read-only live-content recall coverage and redacted live case scaffold.
+- `neurain recall live-eval <folder>` measures how much of a real folder's own indexed content is recallable under auto-derived paraphrase queries (real terms swapped to synonyms), reporting hybrid coverage (the recommended exact-union-semantic strategy), exact-token coverage, semantic-only coverage, and per-kind coverage.
+- Real-content finding: running live-eval on a real folder surfaced that pure semantic alone can recall LESS than exact-token (semantic 0.767 vs exact 0.814 on a real internal corpus), because the lexical-semantic layer lacks the rarity weighting exact-token BM25 has. This was added as the E22 follow-on fix: hybrid recall (`recall hybrid-search`, MCP `neurain_recall_hybrid_search`) returns exact-token union semantic, so it is never worse than exact-token and adds paraphrase catches (hybrid 0.86 vs exact 0.814 on the same corpus). For hybrid search, `--top` is the candidate depth for each branch, so the returned union can exceed `--top` when semantic-only catches exist. This is exactly the kind of regression synthetic fixtures missed and real-content eval caught.
+- It is read-only, returns metrics only with no stored content (safe on a private vault), and makes no model or external calls. Readiness gates that hybrid coverage is never worse than exact-token coverage.
+- Purpose: move alpha evidence from synthetic fixtures toward real content, and give a real user a direct read on whether recall is good enough on their own material and what it misses.
+- Honest scope and what remains: the queries are auto-derived, not human-judged relevance, and one folder is not three users. This reduces but does not remove the synthetic-only claim. Full E23 completion (reviewed live cases from at least three real work folders, redacted, wired into readiness) is a human step: real walkthroughs on real folders. The agent will not fabricate user proof.
+- Storage-safety bridge shipped: `neurain live-cases scaffold <folder>` prepares a redacted reviewed-case pack scaffold with hash-only source refs and no raw source text or absolute paths. It reports `reviewed_live_user_evidence: false` and `human_judged: false` until a human fills safe local case files and runs the evals.
+- Remaining E23 increments: answer and lesson live-eval against real folders, filled reviewed live case files from at least three real work folders, and readiness gates that require those reviewed receipts before external user evidence is claimed.
+
+### Phase 6b / E24: Non-Developer Onboarding
+
+- Status: read-only first-run onboarding alpha shipped on 2026-06-09.
+- `neurain onboard <folder>` tells a new user whether the next action is `init`, `adopt --dry-run`, host connection, or `wrap --dry-run`.
+- It reports what Neurain stores and does not store.
+- It makes no model call, no external call, and no durable write.
+- Readiness includes a non-developer onboarding dry-run gate.
+
+### Phase 6c / E25: Installable CLI Readiness
+
+- Status: publish-ready alpha CLI gates shipped on 2026-06-09.
+- The package exposes the `neurain` binary and includes public docs, CI workflow, templates, license, and security doc.
+- Full readiness verifies npm audit, npm pack dry-run, and temporary tarball install smoke.
+- Honest scope: actual npm publish or package name reservation remains a release action, not an implementation claim.
+
+### Phase 6d / E26: Thin MCP Connector
+
+- Status: Codex, Claude Code, Gemini CLI, and Agent Runtime MCP surfaces shipped on 2026-06-09.
+- `neurain connect codex <folder> --dry-run`, `neurain connect claude <folder> --dry-run`, and `neurain connect gemini <folder> --dry-run` print host CLI setup commands.
+- `neurain connect runtime <folder> --dry-run` prints a bounded config snippet.
+- Gemini uses a bounded read-first allowlist. Raw capture is not included in the Gemini allowlist by default.
+- MCP exposes bounded read, scan, eval, live-case scaffold, and preview tools. It does not expose silent durable wiki writes, lifecycle emit, daemon run/stop, curator write, recall rebuild write, or lesson promotion.
+- Gemini lifecycle automation is manual-only in alpha; explicit `lifecycle emit --host gemini` is the receipt path when needed.
+
+### Phase 3e / E11: Continuous Daemon
+
+- Status: user-started foreground continuous daemon alpha shipped.
+- `neurain daemon run <folder> --interval-seconds 300 --json` repeats scheduler ticks until the process is stopped.
+- `neurain daemon run <folder> --max-ticks 2 --json` provides a bounded proof path for tests and demos.
+- `neurain daemon status <folder> --json` reads the last operational state.
+- `neurain daemon stop <folder> --json` requests cooperative stop when a matching foreground daemon is running.
+- Stop requests are checked during the sleep interval with about one-second polling.
+- The daemon writes only `00_system/neurain/daemon-state.json` as operational state.
+- It does not install background jobs, write durable wiki knowledge, promote lessons, call models, call external tools, store private paths in state, or expose MCP tools.
+
+### Phase 4: Curator
+
+- Status: snapshot-gated curator lifecycle alpha shipped.
+- `neurain curator status <folder>` reports planned lifecycle changes without writing.
+- `neurain curator run <folder> --dry-run` previews the same plan.
+- `neurain curator run <folder> --confirm "1건 저장 진행"` writes a snapshot receipt and changes only lesson `Status` fields.
+- `neurain curator rollback <folder> --receipt <receipt>` restores the exact previous registry snapshot when the registry has not drifted.
+- Curator never deletes lessons and protects pinned, human-authored, private, and non-agent-created lessons.
+- MCP exposes read-only `neurain_curator_status` and `neurain_curator_run_preview` only.
+
+### Phase 5: Recall DB
+
+- Status: optional SQLite FTS5 recall DB alpha shipped.
+- `neurain recall status <folder>` reports cache state, row count, manifest hash, and markdown fallback availability without writing.
+- `neurain recall rebuild <folder> --dry-run` previews indexed count without writing.
+- `neurain recall rebuild <folder>` writes only `00_system/neurain/recall.sqlite` and a rebuild receipt.
+- `neurain recall search <folder> <query>` searches the SQLite FTS5 cache when present and falls back to markdown when the cache is missing.
+- `neurain recall verify <folder>` compares the current markdown, safe events, and safe receipts with the cache manifest.
+- Markdown remains canonical, and the SQLite file is a rebuildable cache.
+- Private paths, raw source bodies, secret-like content, instruction-injection content, and recall rebuild receipts are excluded from the index.
+- MCP exposes read-only `neurain_recall_status`, `neurain_recall_rebuild_preview`, `neurain_recall_search`, `neurain_recall_verify`, and `neurain_recall_cross_host_eval`.
+- MCP exposes read-only `neurain_answer_quality_eval` for answer-quality fixture regression.
+- MCP exposes read-only `neurain_scheduler_eval` for scheduler trigger regression.
+- `neurain recall eval <folder>` is shipped as a read-only alpha smoke eval for safe host-tagged journal events.
+- `neurain recall eval <folder> --fixture-size 100 --private-probes 20` is shipped as a larger synthetic cross-host regression eval. It does not touch the target root, and it gates on exact-token host filtering, source-supporting snippets, host isolation, and private leakage.
+- `neurain recall eval <folder> --case-file recall-cases.json` is shipped as a reviewed case-file eval. It does not touch the target root, and it gates on host filtering, source-supporting snippets, host isolation, and private leakage against human-reviewed recall cases.
+- These recall eval modes validate recall plumbing, reviewed case handling, and privacy filters. They do not count as semantic recall quality evidence for the 90 percent goal by themselves.
+- `neurain answer eval <folder> --fixture-size 120` is shipped as a read-only alpha fixture for answer faithfulness, citation accuracy, conflict surfacing, abstention, private boundaries, and stale-source handling.
+- `neurain answer eval <folder> --case-file answer-cases.json` is shipped as a read-only reviewed case-file eval for answer faithfulness, citation accuracy, conflict surfacing, abstention, private boundaries, and stale-source handling.
+- These answer eval modes validate policy gates and reviewed case handling, not live production answer quality. External user walkthroughs remain required before claiming full 90 percent answer quality.
+
+### Phase 6: Runtime Connector
+
+- Status: Runtime MCP config-preview connector alpha shipped.
+- `neurain connect runtime <folder> --dry-run` prints a bounded MCP server snippet for a host-managed config.
+- The snippet uses Neurain as a local stdio MCP server with a small read-heavy tool allowlist.
+- The alpha does not edit Runtime config directly.
+- Avoid requiring Runtime for Neurain adoption.
+- Deeper Runtime lifecycle-event connector automation remains planned.
+
+## Hard Gates Before Claiming 90 Percent
+
+- No product package leakage.
+- No secret or prompt-injection lesson enters prompt context.
+- No source, receipt, log, handoff, or recall-index instruction injection is executed or promoted.
+- No private-area fact or secret-like string appears in global or cross-host recall fixtures.
+- No global promotion from private or area-only source.
+- Rollback removes only receipt-listed writes.
+- Curator has dry-run, snapshot, rollback, and pinned protection.
+- Recall DB can be deleted and rebuilt from canonical markdown and receipts.
+- Recall DB rebuild equivalence and markdown-only fallback both pass synthetic tests.
+- Background review has both trigger precision and trigger recall evidence.
+- Background review trigger eval passes synthetic and reviewed case-file gates.
+- User-perceived automation has non-developer walkthrough evidence.
+- Claude MAX EFFORT review returns PASS or PASS-WITH-CHANGES with blocking findings resolved.
+- Product tests and readiness checks pass after implementation.
+
+## Current Status
+
+The current alpha has implemented the first safe slice:
+
+- lesson list
+- event journal add/list/verify
+- lesson candidates
+- recap
+- wrap dry-run
+- capabilities
+- read-only watch report
+- read-only review worker report
+- read-only scheduler tick
+- scheduler trigger eval alpha with synthetic and reviewed case-file modes
+- bounded foreground scheduler monitor
+- user-started foreground continuous daemon
+- append-only lifecycle emit
+- read-only lifecycle lineage report
+- Claude Code lifecycle hook preview
+- snapshot-gated curator lifecycle
+- optional SQLite FTS5 recall DB
+- E22 local lexical-semantic recall
+- hybrid recall
+- E23 live-content recall coverage
+- E23 redacted live-case scaffold
+- E24 read-only onboarding
+- E25 publish-ready CLI gates
+- E26 Codex, Claude Code, Gemini CLI, and Agent Runtime MCP connector surface
+- cross-host recall eval smoke
+- larger 100-case cross-host recall regression eval
+- answer-quality eval alpha with synthetic and reviewed case-file modes
+- narrow CLI promotion
+- rollback receipt
+- MCP preview-only boundary
+
+Claude Code connector-specific lifecycle hook preview is shipped in alpha. It maps SessionStart, UserPromptSubmit, Stop, and SessionEnd into Neurain lifecycle receipts without storing prompt bodies, transcript paths, or success stdout in model context.
+
+Codex lifecycle hook preview is now shipped in alpha for `.codex/hooks.json` SessionStart and Edit or Write PostToolUse review markers. Runtime host-proxy lifecycle contract is now shipped in alpha for agent loops that can forward direct lifecycle boundary events. Deeper native Runtime lifecycle-event automation remains future work because Neurain does not own the Runtime agent loop.