nexo-brain 5.3.11 → 5.3.13

package/src/scripts/nexo-sleep.py

@@ -37,6 +37,12 @@ if str(NEXO_CODE) not in sys.path:
     sys.path.insert(0, str(NEXO_CODE))
 
 from agent_runner import AutomationBackendUnavailableError, run_automation_prompt
+try:
+    from client_preferences import resolve_user_model as _resolve_user_model
+    _USER_MODEL = _resolve_user_model()
+except Exception:
+    _USER_MODEL = ""
+
 
 # ─── Paths ────────────────────────────────────────────────────────────────────
 CLAUDE_DIR = NEXO_HOME
@@ -439,7 +445,7 @@ Execute without asking."""
     try:
         result = run_automation_prompt(
             prompt,
-            model="opus",
+            model=_USER_MODEL or "opus",
             timeout=21600,
             output_format="text",
             allowed_tools="Read,Write,Edit,Glob,Grep,Bash,mcp__nexo__*",

package/src/scripts/nexo-synthesis.py

@@ -18,6 +18,13 @@ import sys
 from datetime import datetime, date, timedelta
 from pathlib import Path
 
+
+try:
+    from client_preferences import resolve_user_model as _resolve_user_model
+    _USER_MODEL = _resolve_user_model()
+except Exception:
+    _USER_MODEL = ""
+
 HOME = Path.home()
 NEXO_HOME = Path(os.environ.get("NEXO_HOME", str(Path.home() / ".nexo")))
 _script_dir = Path(__file__).resolve().parent
@@ -340,7 +347,7 @@ Execute without asking."""
     try:
         result = run_automation_prompt(
             prompt,
-            model="opus",
+            model=_USER_MODEL or "opus",
             timeout=21600,
             output_format="text",
             allowed_tools="Read,Write,Edit,Glob,Grep,Bash,mcp__nexo__*",

package/src/scripts/rehydrate_learnings_from_archive.py

@@ -0,0 +1,245 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+"""Rehydrate archived markdown learnings back into the NEXO learnings table.
+
+The original Evolution #5 incident found an empty learnings table while the
+historical archive still existed as markdown grouped by domain. This helper
+parses the archive format used in those files:
+
+- markdown tables with `Error | Solucion`
+- dated sections with bullet/numbered operational learnings
+
+Dry-run is the default. Pass `--apply` to insert missing learnings.
+"""
+
+import argparse
+import re
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+REPO_SRC = Path(__file__).resolve().parents[1]
+if str(REPO_SRC) not in sys.path:
+    sys.path.insert(0, str(REPO_SRC))
+
+from db import create_learning, get_db, init_db  # noqa: E402
+from runtime_home import export_resolved_nexo_home  # noqa: E402
+
+NEXO_HOME = export_resolved_nexo_home()
+TABLE_HEADER_TITLES = {"error", "problema", "issue"}
+DEFAULT_ARCHIVE_DIRS = (
+    NEXO_HOME / "claude" / "operations" / "archive" / "learnings",
+    Path.home() / "claude" / "operations" / "archive" / "learnings",
+    Path.home() / ".claude" / "operations" / "archive" / "learnings",
+)
+
+
+@dataclass(frozen=True)
+class LearningCandidate:
+    category: str
+    title: str
+    content: str
+    reasoning: str
+    prevention: str
+    status: str = "active"
+
+
+def _strip_markdown(text: str) -> str:
+    text = text.replace("**", "").replace("__", "")
+    text = text.replace("~~", "")
+    text = re.sub(r"`([^`]*)`", r"\1", text)
+    text = re.sub(r"\[([^\]]+)\]\([^)]+\)", r"\1", text)
+    text = re.sub(r"\s+", " ", text).strip(" |")
+    return text.strip()
+
+
+def _derive_title(text: str) -> str:
+    first_sentence = re.split(r"(?<=[.!?])\s+", text, maxsplit=1)[0].strip()
+    if not first_sentence:
+        first_sentence = text.strip()
+    return first_sentence[:180].rstrip(" .")
+
+
+def _derive_prevention(text: str) -> str:
+    match = re.search(r"(Regla:\s*.*|SIEMPRE\s+.*|NUNCA\s+.*)", text, flags=re.IGNORECASE)
+    if match:
+        return match.group(1).strip()
+    return text[:500].strip()
+
+
+def _candidate_reasoning(path: Path, section: str) -> str:
+    section_note = f" [{section}]" if section and section != path.stem else ""
+    return f"Rehydrated from markdown archive {path.name}{section_note}"
+
+
+def _parse_table_row(path: Path, section: str, line: str) -> LearningCandidate | None:
+    parts = [_strip_markdown(cell) for cell in line.strip().strip("|").split("|")]
+    if len(parts) < 2:
+        return None
+    title, prevention = parts[0], parts[1]
+    if title.lower() in TABLE_HEADER_TITLES or set(title) <= {"-"}:
+        return None
+    if not title or not prevention:
+        return None
+    status = "superseded" if "obsoleto" in prevention.lower() or "obsoleto" in title.lower() else "active"
+    content = f"{title}. {prevention}"
+    return LearningCandidate(
+        category=path.stem,
+        title=title,
+        content=content,
+        reasoning=_candidate_reasoning(path, section),
+        prevention=prevention,
+        status=status,
+    )
+
+
+def _consume_bullet_block(lines: list[str], start: int) -> tuple[str, int]:
+    pieces = [re.sub(r"^([-*]|\d+\.)\s+", "", lines[start].strip())]
+    idx = start + 1
+    while idx < len(lines):
+        stripped = lines[idx].strip()
+        if not stripped:
+            break
+        if stripped.startswith("## ") or stripped.startswith("|"):
+            break
+        if re.match(r"^([-*]|\d+\.)\s+", stripped):
+            break
+        pieces.append(stripped)
+        idx += 1
+    return _strip_markdown(" ".join(pieces)), idx
+
+
+def _parse_bullet(path: Path, section: str, text: str) -> LearningCandidate | None:
+    if len(text) < 12:
+        return None
+    title = _derive_title(text)
+    prevention = _derive_prevention(text)
+    status = "superseded" if "obsoleto" in text.lower() else "active"
+    return LearningCandidate(
+        category=path.stem,
+        title=title,
+        content=text,
+        reasoning=_candidate_reasoning(path, section),
+        prevention=prevention,
+        status=status,
+    )
+
+
+def parse_archive_file(path: Path) -> list[LearningCandidate]:
+    lines = path.read_text(encoding="utf-8", errors="ignore").splitlines()
+    section = path.stem
+    results: list[LearningCandidate] = []
+    idx = 0
+    while idx < len(lines):
+        stripped = lines[idx].strip()
+        if stripped.startswith("## "):
+            section = _strip_markdown(stripped[3:])
+            idx += 1
+            continue
+        if stripped.startswith("|") and not re.match(r"^\|\s*-", stripped):
+            row = _parse_table_row(path, section, stripped)
+            if row is not None:
+                results.append(row)
+            idx += 1
+            continue
+        if re.match(r"^([-*]|\d+\.)\s+", stripped):
+            block, next_idx = _consume_bullet_block(lines, idx)
+            row = _parse_bullet(path, section, block)
+            if row is not None:
+                results.append(row)
+            idx = next_idx
+            continue
+        idx += 1
+    return results
+
+
+def parse_archive_dir(archive_dir: Path) -> list[LearningCandidate]:
+    candidates: list[LearningCandidate] = []
+    for path in sorted(archive_dir.glob("*.md")):
+        candidates.extend(parse_archive_file(path))
+
+    deduped: list[LearningCandidate] = []
+    seen: set[tuple[str, str]] = set()
+    for item in candidates:
+        key = (item.category.lower(), item.title.lower())
+        if key in seen:
+            continue
+        seen.add(key)
+        deduped.append(item)
+    return deduped
+
+
+def resolve_archive_dir(explicit: str = "") -> Path:
+    if explicit:
+        path = Path(explicit).expanduser()
+        if not path.is_dir():
+            raise FileNotFoundError(f"archive dir not found: {path}")
+        return path
+    for candidate in DEFAULT_ARCHIVE_DIRS:
+        if candidate.is_dir():
+            return candidate
+    raise FileNotFoundError(
+        "No learnings archive found. Tried: "
+        + ", ".join(str(path) for path in DEFAULT_ARCHIVE_DIRS)
+    )
+
+
+def apply_candidates(candidates: list[LearningCandidate], *, apply: bool) -> dict:
+    init_db()
+    conn = get_db()
+    existing = {
+        (row[0].lower(), row[1].lower())
+        for row in conn.execute("SELECT category, title FROM learnings").fetchall()
+    }
+    inserted = 0
+    skipped = 0
+    for item in candidates:
+        key = (item.category.lower(), item.title.lower())
+        if key in existing:
+            skipped += 1
+            continue
+        if apply:
+            create_learning(
+                item.category,
+                item.title,
+                item.content,
+                reasoning=item.reasoning,
+                prevention=item.prevention,
+                status=item.status,
+            )
+        existing.add(key)
+        inserted += 1
+    return {
+        "parsed": len(candidates),
+        "inserted": inserted,
+        "skipped_existing": skipped,
+        "mode": "apply" if apply else "dry-run",
+    }
+
+
+def build_arg_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--archive-dir", default="", help="Override archive directory")
+    parser.add_argument("--apply", action="store_true", help="Insert parsed learnings into the DB")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_arg_parser().parse_args(argv)
+    try:
+        archive_dir = resolve_archive_dir(args.archive_dir)
+    except FileNotFoundError as exc:
+        print(f"ERROR: {exc}", file=sys.stderr)
+        return 1
+    candidates = parse_archive_dir(archive_dir)
+    summary = apply_candidates(candidates, apply=args.apply)
+    print(
+        f"{summary['mode']}: archive={archive_dir} parsed={summary['parsed']} "
+        f"inserted={summary['inserted']} skipped_existing={summary['skipped_existing']}"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/src/server.py

@@ -202,6 +202,8 @@ mcp = FastMCP(
         "- **Workflow runtime (MANDATORY for long multi-step or cross-session work):** open `nexo_goal_open(...)` when the objective must survive sessions, then `nexo_workflow_open(...)`, "
         "update meaningful checkpoints with `nexo_workflow_update(...)`, then use `nexo_workflow_resume(...)` / "
         "`nexo_workflow_replay(...)` instead of restarting blindly.\n"
+        "- **Diagnostic plane (MANDATORY before diagnosing NEXO):** fix the plane explicitly first — `product_public`, `runtime_personal`, `installation_live`, `database_real`, or `cooperator`. "
+        "Do not mix product, runtime, install, DB, and agent-behavior explanations in the same diagnosis.\n"
         "- **Guard (MANDATORY before ANY code edit):** `nexo_guard_check(files='...', area='...')` BEFORE editing code. "
         "No exceptions. Blocking rules→resolve first. `nexo_track(sid=SID, paths=[...])` before shared files\n"
         "- **Skills (MANDATORY before multi-step tasks):** `nexo_skill_match(task)` to find reusable procedures. "

package/src/skills/run-nexo-core-fix-cycle/guide.md

@@ -0,0 +1,17 @@
+# Run NEXO Core Fix Cycle
+
+Usa esta skill cuando haya que implementar y verificar un grupo pequeño de fixes del core de NEXO sin improvisar el plano ni repetir siempre la misma fase de descubrimiento y test.
+
+## Steps
+1. Fija primero el plano: repo público `nexo`, runtime instalado `~/.nexo` y claims/documentación pública. No mezcles esos tres mundos.
+2. Abre `nexo_task_open(...)` y `nexo_workflow_open(...)` antes de tocar código. Si el fix es de acción, pasa también por `nexo_cortex_decide(...)`.
+3. Ejecuta la skill con `areas` ajustadas al fix. El helper te devuelve el mapa de archivos y corre la batería de tests focalizada para `protocol`, `plane`, `guard`, `cortex` y/o `release`.
+4. Implementa el cambio mínimo defendible solo en la superficie correcta. Si el problema es producto, se arregla en el repo; no en `~/.nexo`.
+5. Reejecuta la skill para revalidar el clúster exacto de tests tocado por el fix.
+6. Cierra con `nexo_task_close(...)` y evidencia real. Si hubo edición real, deja `change_log` y captura learning si cambió una regla canónica.
+
+## Gotchas
+- No uses diary, workflow text o intuición como sustituto de git/tests/runtime reales.
+- Si el fix toca doctor o claims públicos, fija el `plane` explícito antes de ejecutar diagnósticos.
+- Si el fix toca release o runtime update, usa la vía oficial (`nexo update`, doctor, skill de release final) y no scripts laterales.
+- Si el helper no encuentra un área, añade la superficie nueva de forma explícita en la skill en vez de seguir repitiendo grep manual disperso.

package/src/skills/run-nexo-core-fix-cycle/script.py

@@ -0,0 +1,276 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+
+AREA_MAP = {
+    "protocol": {
+        "files": [
+            "src/plugins/protocol.py",
+            "src/db/_protocol.py",
+            "src/db/__init__.py",
+            "tests/test_protocol.py",
+        ],
+        "tests": [
+            "tests/test_protocol.py",
+        ],
+    },
+    "plane": {
+        "files": [
+            "src/doctor/orchestrator.py",
+            "src/plugins/doctor.py",
+            "src/server.py",
+            "tests/test_doctor.py",
+        ],
+        "tests": [
+            "tests/test_doctor.py",
+        ],
+    },
+    "guard": {
+        "files": [
+            "src/hook_guardrails.py",
+            "tests/test_hook_guardrails.py",
+        ],
+        "tests": [
+            "tests/test_hook_guardrails.py",
+        ],
+    },
+    "cortex": {
+        "files": [
+            "src/plugins/cortex.py",
+            "tests/test_cortex_decisions.py",
+        ],
+        "tests": [
+            "tests/test_cortex_decisions.py",
+        ],
+    },
+    "release": {
+        "files": [
+            "scripts/verify_release_readiness.py",
+            "src/skills/run-release-final-audit/script.py",
+            "tests/test_verify_release_readiness.py",
+            "tests/test_release_readiness_baseline.py",
+        ],
+        "tests": [
+            "tests/test_verify_release_readiness.py",
+            "tests/test_release_readiness_baseline.py",
+        ],
+    },
+}
+
+
+def _is_repo_root(candidate: Path) -> bool:
+    return (
+        (candidate / "package.json").is_file()
+        and (candidate / "src" / "server.py").is_file()
+        and (candidate / "tests").is_dir()
+    )
+
+
+def _normalize_candidate(raw: str | Path) -> Path:
+    candidate = Path(raw).expanduser().resolve()
+    if candidate.is_file():
+        candidate = candidate.parent
+    if candidate.name == "src" and (candidate / "server.py").is_file():
+        candidate = candidate.parent
+    return candidate
+
+
+def _resolve_repo_root_from_atlas() -> Path | None:
+    homes = []
+    env_home = os.environ.get("NEXO_HOME", "").strip()
+    if env_home:
+        homes.append(Path(env_home).expanduser())
+    homes.extend((Path.home() / ".nexo", Path.home() / "claude"))
+
+    seen = set()
+    for home in homes:
+        key = str(home)
+        if key in seen:
+            continue
+        seen.add(key)
+        atlas_path = home / "brain" / "project-atlas.json"
+        if not atlas_path.is_file():
+            continue
+        try:
+            payload = json.loads(atlas_path.read_text(encoding="utf-8"))
+        except json.JSONDecodeError:
+            continue
+        nexo = payload.get("nexo") if isinstance(payload, dict) else None
+        locations = nexo.get("locations") if isinstance(nexo, dict) else None
+        source = locations.get("mcp_server", "") if isinstance(locations, dict) else ""
+        if not isinstance(source, str) or not source.strip():
+            continue
+        candidate = _normalize_candidate(source)
+        if _is_repo_root(candidate):
+            return candidate
+    return None
+
+
+def _resolve_repo_root(explicit_root: str = "") -> Path:
+    if explicit_root.strip():
+        candidate = _normalize_candidate(explicit_root)
+        if _is_repo_root(candidate):
+            return candidate
+
+    env_code = os.environ.get("NEXO_CODE", "").strip()
+    if env_code:
+        candidate = _normalize_candidate(env_code)
+        if _is_repo_root(candidate):
+            return candidate
+
+    cwd = Path.cwd().resolve()
+    for candidate in (cwd, *cwd.parents):
+        if _is_repo_root(candidate):
+            return candidate
+
+    atlas_repo = _resolve_repo_root_from_atlas()
+    if atlas_repo is not None:
+        return atlas_repo
+
+    script_root = Path(__file__).resolve().parents[3]
+    if _is_repo_root(script_root):
+        return script_root
+    return script_root
+
+
+def _parse_bool(raw: str, default: bool) -> bool:
+    text = (raw or "").strip().lower()
+    if not text:
+        return default
+    if text in {"1", "true", "yes", "on"}:
+        return True
+    if text in {"0", "false", "no", "off"}:
+        return False
+    raise SystemExit(f"[core-fix-cycle] invalid boolean: {raw}")
+
+
+def _normalize_areas(raw: str) -> list[str]:
+    text = (raw or "protocol,plane").replace("+", ",")
+    parts = [item.strip().lower() for item in text.split(",") if item.strip()]
+    if not parts:
+        return ["protocol", "plane"]
+    unknown = [item for item in parts if item not in AREA_MAP]
+    if unknown:
+        raise SystemExit(
+            f"[core-fix-cycle] unknown area(s): {', '.join(unknown)}. Expected one of: {', '.join(sorted(AREA_MAP))}"
+        )
+    seen = set()
+    ordered = []
+    for item in parts:
+        if item in seen:
+            continue
+        seen.add(item)
+        ordered.append(item)
+    return ordered
+
+
+def _env(root: Path, nexo_home: str) -> dict[str, str]:
+    env = os.environ.copy()
+    src_path = str(root / "src")
+    existing_pythonpath = env.get("PYTHONPATH", "").strip()
+    env["PYTHONPATH"] = (
+        f"{src_path}{os.pathsep}{existing_pythonpath}" if existing_pythonpath else src_path
+    )
+    env["NEXO_CODE"] = src_path
+    env["PYTEST_DISABLE_PLUGIN_AUTOLOAD"] = "1"
+    if nexo_home.strip():
+        env["NEXO_HOME"] = str(Path(nexo_home).expanduser())
+    return env
+
+
+def _command_succeeds(cmd: list[str], *, env: dict[str, str], root: Path) -> bool:
+    result = subprocess.run(
+        cmd,
+        cwd=root,
+        env=env,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    return result.returncode == 0
+
+
+def _resolve_python(root: Path, env: dict[str, str]) -> str:
+    candidates = []
+    override = os.environ.get("NEXO_RELEASE_PYTHON", "").strip()
+    if override:
+        candidates.append(override)
+
+    for name in ("python3", "python"):
+        path = shutil.which(name)
+        if path:
+            candidates.append(path)
+
+    candidates.append(sys.executable)
+
+    seen = set()
+    for candidate in candidates:
+        if not candidate or candidate in seen:
+            continue
+        seen.add(candidate)
+        if _command_succeeds([candidate, "-m", "pytest", "--version"], env=env, root=root):
+            return candidate
+
+    raise SystemExit(
+        "[core-fix-cycle] no Python interpreter with pytest available. "
+        "Set NEXO_RELEASE_PYTHON or install pytest in the active runtime."
+    )
+
+
+def _run(cmd: list[str], *, env: dict[str, str], root: Path) -> None:
+    print(f"[core-fix-cycle] $ {' '.join(cmd)}")
+    result = subprocess.run(cmd, cwd=root, env=env)
+    if result.returncode != 0:
+        raise SystemExit(result.returncode)
+
+
+def main() -> int:
+    areas = _normalize_areas(sys.argv[1] if len(sys.argv) > 1 else "protocol,plane")
+    run_tests = _parse_bool(sys.argv[2] if len(sys.argv) > 2 else "true", True)
+    repo_root = _resolve_repo_root(sys.argv[3] if len(sys.argv) > 3 else "")
+    nexo_home = sys.argv[4] if len(sys.argv) > 4 else ""
+    env = _env(repo_root, nexo_home)
+
+    files: list[str] = []
+    tests: list[str] = []
+    for area in areas:
+        for path in AREA_MAP[area]["files"]:
+            if path not in files:
+                files.append(path)
+        for path in AREA_MAP[area]["tests"]:
+            if path not in tests:
+                tests.append(path)
+
+    print(f"[core-fix-cycle] repo_root={repo_root}")
+    print(f"[core-fix-cycle] areas={','.join(areas)}")
+    print("[core-fix-cycle] file-map:")
+    for path in files:
+        label = "OK" if (repo_root / path).exists() else "missing"
+        print(f"[core-fix-cycle]   - {path} [{label}]")
+
+    if not run_tests:
+        print("[core-fix-cycle] tests skipped")
+        print("[core-fix-cycle] OK")
+        return 0
+
+    existing_tests = [path for path in tests if (repo_root / path).is_file()]
+    if not existing_tests:
+        print("[core-fix-cycle] no tests found for selected areas")
+        print("[core-fix-cycle] OK")
+        return 0
+
+    python_bin = _resolve_python(repo_root, env)
+    print(f"[core-fix-cycle] python={python_bin}")
+    _run([python_bin, "-m", "pytest", "-q", *existing_tests], env=env, root=repo_root)
+    print("[core-fix-cycle] OK")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/src/skills/run-nexo-core-fix-cycle/skill.json

@@ -0,0 +1,58 @@
+{
+  "id": "SK-RUN-NEXO-CORE-FIX-CYCLE",
+  "name": "Run NEXO Core Fix Cycle",
+  "description": "Mapea las superficies core impactadas y ejecuta la verificación focalizada para ciclos pequeños de fixes de NEXO sin mezclar repo público, runtime y claims no verificados.",
+  "level": "published",
+  "mode": "hybrid",
+  "source_kind": "core",
+  "execution_level": "read-only",
+  "approval_required": false,
+  "tags": [
+    "nexo",
+    "core",
+    "fix",
+    "protocol",
+    "plane",
+    "verification"
+  ],
+  "trigger_patterns": [
+    "dos fixes core nexo",
+    "core fix cycle",
+    "enforcement protocolario",
+    "plano antes del diagnostico",
+    "ciclo fix core nexo"
+  ],
+  "params_schema": {
+    "areas": {
+      "type": "string",
+      "required": false,
+      "default": "protocol,plane"
+    },
+    "run_tests": {
+      "type": "boolean",
+      "required": false,
+      "default": true
+    },
+    "repo_root": {
+      "type": "string",
+      "required": false,
+      "default": ""
+    },
+    "nexo_home": {
+      "type": "string",
+      "required": false,
+      "default": ""
+    }
+  },
+  "command_template": {
+    "argv": [
+      "{{file_path}}",
+      "{{areas}}",
+      "{{run_tests}}",
+      "{{repo_root}}",
+      "{{nexo_home}}"
+    ]
+  },
+  "executable_entry": "script.py",
+  "stable_after_uses": 5
+}

package/src/skills/run-release-final-audit/guide.md

@@ -1,14 +1,16 @@
 # Run Release Final Audit
 
-Use this before the final release/publication package when you need a live check that smoke, release contract, changelog/version surfaces, client parity, and runtime doctor still align.
+Use this before claiming a release/publication is closed when you need a live check that smoke, release contract, public surfaces, runtime update/doctor, and protocol closeout still align.
 
 ## Steps
 1. Run the skill with defaults to audit the current package version. It auto-resolves `release-contracts/v{version}.json` and `scripts/run_vX_Y_smoke.py` when present.
 2. Keep `contract="auto"` and `require_contract_complete=true` for the real final gate. Set `contract="none"` only for pre-contract repo checks.
-3. Treat `ci=true` as repo-only. The last live audit should keep runtime doctor enabled.
+3. For the real post-publish closeout, set `final_closeout=true` and pass the release `protocol_task_id` so the audit also verifies GitHub Release, npm, `nexo update`, runtime doctor, `change_log`, and `task_close`.
+4. Treat `ci=true` as repo-only. The last live audit must stay outside CI because `final_closeout` expects a live runtime and a real closed task.
 
 ## Gotchas
 - A missing auto-resolved contract is a real blocker for the final release audit.
 - Smoke is version-line scoped. If no runner exists, the skill reports the skip explicitly instead of pretending it ran.
-- The script is read-only. It verifies readiness but does not bump versions, tag, publish, or update website worktrees.
+- The script is read-only except for the optional official `nexo update` step during `final_closeout`; it still does not bump versions, tag, publish, or edit website worktrees.
+- `final_closeout` is intentionally stricter than the repo-only readiness pass: it fails if the release task was not closed with evidence or if its `change_log` row is missing.
 - If the touched area includes bootstrap, startup, or public claims, finish with the manual watchpoints in `docs/client-parity-checklist.md`.