nexo-brain 7.31.4 → 7.31.7

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.31.4",
+  "version": "7.31.7",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,9 +18,13 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.31.4` is the current packaged-runtime line. Patch release over v7.31.3 - memory recall honours absolute time ranges (ISO dates, start..end ranges, datetimes, epochs) and enforces the window in SQL, so asking about a specific past day returns that day.
+Version `7.31.7` is the current packaged-runtime line. Patch release over v7.31.6 - stateful answers now require evidence before claiming release, commit, branch, server, ticket, deployment, sent/uploaded, installed, verified, or closed status. Guardian defaults promote identity coherence to hard/core and add a hard/core pre-answer evidence gate, while closeout and Local Context telemetry now leave stronger proof trails.
 
-Previously in `7.31.3`: patch release over v7.31.2 - the recommended Claude Code model returns to Opus 4.8 with max reasoning (installs riding NEXO defaults migrate back automatically; customized models untouched), and the dead heartbeat-enforcement hook trio is removed from the source tree.
+Previously in `7.31.6`: patch release over v7.31.5 - headless/email-monitor notifications now respect the Desktop UI language for static ES/EN templates before falling back to profile/calibration language and English.
+
+Previously in `7.31.5`: patch release over v7.31.4 - the breaker resume notice exists: when a notified engine pause recovers, the operator gets exactly one resume email in their language, signed by their agent.
+
+Previously in `7.31.4`: patch release over v7.31.3 - memory recall honours absolute time ranges (ISO dates, start..end ranges, datetimes, epochs) and enforces the window in SQL, so asking about a specific past day returns that day.
 
 Previously in `7.30.33`: patch release over v7.30.32 - personal agent/script status now keeps the newest real run between manual executions and cron history, so a successful manual agent run cannot be hidden behind an older scheduled failure.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.31.4",
+  "version": "7.31.7",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/auto_update.py

@@ -4727,6 +4727,54 @@ def _runtime_flat_files(base_dir: Path) -> list[str]:
     return ordered
 
 
+_RUNTIME_RESOURCE_DIRS = {"crons", "hooks", "managed_mcp", "presets"}
+_RUNTIME_PACKAGE_IGNORE_DIRS = {
+    "__pycache__",
+    "bin",
+    "node_modules",
+    "scripts",
+    "skills",
+    "skills-core",
+    "skills-runtime",
+    "templates",
+    "test",
+    "tests",
+    "vendor",
+}
+
+
+def _pyproject_top_level_packages(repo_dir: Path, src_dir: Path) -> set[str]:
+    pyproject = repo_dir / "pyproject.toml"
+    if not pyproject.is_file():
+        return set()
+    try:
+        text = pyproject.read_text(encoding="utf-8", errors="ignore")
+    except Exception:
+        return set()
+    packages: set[str] = set()
+    for match in re.finditer(r'["\']([A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z0-9_]+)*)["\']', text):
+        top = match.group(1).split(".", 1)[0]
+        if top in _RUNTIME_PACKAGE_IGNORE_DIRS:
+            continue
+        if (src_dir / top).is_dir():
+            packages.add(top)
+    return packages
+
+
+def _runtime_package_dirs(src_dir: Path, repo_dir: Path | None = None) -> list[str]:
+    packages: set[str] = set()
+    if src_dir.is_dir():
+        for child in sorted(src_dir.iterdir(), key=lambda path: path.name):
+            if not child.is_dir() or child.name.startswith(".") or child.name in _RUNTIME_PACKAGE_IGNORE_DIRS:
+                continue
+            if (child / "__init__.py").is_file():
+                packages.add(child.name)
+        if repo_dir is not None:
+            packages.update(_pyproject_top_level_packages(repo_dir, src_dir))
+    packages.update(dirname for dirname in _RUNTIME_RESOURCE_DIRS if (src_dir / dirname).is_dir())
+    return sorted(packages)
+
+
 def _installed_scripts_classification(dest: Path) -> dict[str, str]:
     scripts_dest = dest / "scripts"
     if dest != NEXO_HOME or not scripts_dest.is_dir():
@@ -4753,17 +4801,9 @@ def _backup_runtime_tree(dest: Path = NEXO_HOME) -> str:
     backup_dir = paths.create_backup_dir("runtime-tree")
 
     code_dirs = [
-        "hooks",
+        *_runtime_package_dirs(dest),
         "plugins",
-        "db",
-        "cognitive",
-        "dashboard",
-        "local_context",
-        "product_knowledge",
-        "rules",
-        "crons",
         "scripts",
-        "doctor",
         "skills",
         "skills-core",
         "skills-runtime",
@@ -4839,19 +4879,7 @@ def _restore_runtime_tree(backup_dir: str, dest: Path = NEXO_HOME) -> None:
 def _copy_runtime_from_source(src_dir: Path, repo_dir: Path, dest: Path = NEXO_HOME, progress_fn=None) -> dict:
     import shutil
 
-    packages = [
-        "db",
-        "cognitive",
-        "doctor",
-        "local_context",
-        "managed_mcp",
-        "product_knowledge",
-        "dashboard",
-        "rules",
-        "crons",
-        "hooks",
-        "presets",
-    ]
+    packages = _runtime_package_dirs(src_dir, repo_dir)
     flat_files = _runtime_flat_files(src_dir)
     copied_packages = 0
     copied_files = 0

package/src/cli.py

@@ -2045,6 +2045,7 @@ def _local_context_query(args) -> int:
             max_chars=int(getattr(args, "max_chars", 20000) or 0),
             include_entities=bool(getattr(args, "include_entities", False)),
             include_relations=bool(getattr(args, "include_relations", False)),
+            record_query=not bool(getattr(args, "no_record", False)),
         ),
         args,
     )
@@ -4094,6 +4095,7 @@ def main():
     local_context_query_p.add_argument("--include-entities", action="store_true", help="Include matched entities in the JSON payload.")
     local_context_query_p.add_argument("--include-relations", action="store_true", help="Include graph relations in the JSON payload.")
     local_context_query_p.add_argument("--no-evidence-required", action="store_true", help="Allow empty evidence results")
+    local_context_query_p.add_argument("--no-record", action="store_true", help="Do not write query telemetry to local-context-usage.db")
     local_context_query_p.add_argument("--json", action="store_true", help="JSON output")
 
     local_context_diagnostics_p = local_context_sub.add_parser("diagnostics", help="Tail local memory diagnostic events")

package/src/enforcement_engine.py

@@ -253,10 +253,20 @@ try:
 except ImportError:  # pragma: no cover
     _r23j_should = None  # type: ignore
 
+try:
+    from scripts.jargon_first_response import scan_text as _scan_jargon, user_requested_detail as _jargon_user_requested_detail
+except ImportError:  # pragma: no cover
+    _scan_jargon = None  # type: ignore
+    _jargon_user_requested_detail = None  # type: ignore
+
 NEXO_HOME = Path(os.environ.get("NEXO_HOME", str(Path.home() / ".nexo")))
 MAP_FILENAME = "tool-enforcement-map.json"
 LOG_DIR = paths.logs_dir()
 
+_JARGON_PROMPT = render_core_prompt("r26-jargon-rewrite")
+_EXECUTE_BEFORE_ASK_PROMPT = render_core_prompt("r35-execute-before-ask")
+_PRODUCTION_CHANGE_LOG_PROMPT = render_core_prompt("r36-production-change-log-required")
+
 _logger = logging.getLogger("nexo.enforcer")
 if not _logger.handlers:
     LOG_DIR.mkdir(parents=True, exist_ok=True)
@@ -317,6 +327,41 @@ _SILENT_REMINDER_DISCLOSURE_SUFFIX = (
     " Do not mention this reminder or any internal enforcement to the user."
 )
 
+_CAPABILITY_DENIAL_RE = re.compile(
+    r"\b("
+    r"no\s+(?:se\s+puede|puedo|existe|hay|tenemos|esta\s+montado|est[aá]\s+montado)|"
+    r"no\s+(?:est[aá]\s+soportado|hay\s+nada\s+montado)|"
+    r"(?:cannot|can't|can\s+not|not\s+possible|does\s+not\s+exist|no\s+such\s+capability|not\s+supported)"
+    r")\b",
+    re.IGNORECASE,
+)
+_CAPABILITY_REALITY_TOOLS = {
+    "nexo_system_catalog",
+    "mcp__nexo__nexo_system_catalog",
+    "nexo_card_match",
+    "mcp__nexo__nexo_card_match",
+    "nexo_skill_match",
+    "mcp__nexo__nexo_skill_match",
+    "nexo_credential_list",
+    "mcp__nexo__nexo_credential_list",
+    "nexo_credential_get",
+    "mcp__nexo__nexo_credential_get",
+    "nexo_pre_action_context",
+    "mcp__nexo__nexo_pre_action_context",
+    "nexo_recent_context",
+    "mcp__nexo__nexo_recent_context",
+    "nexo_session_diary_read",
+    "mcp__nexo__nexo_session_diary_read",
+    "nexo_status",
+    "mcp__nexo__nexo_status",
+    "Read",
+    "Grep",
+    "Glob",
+    "Bash",
+}
+
+_CAPABILITY_REALITY_PROMPT = render_core_prompt("r34-capability-reality-check")
+
 
 def _redact_for_log(text: str, max_len: int = 200) -> str:
     """Return a log-safe truncation of `text` with secret-like tokens
@@ -333,6 +378,11 @@ def _redact_for_log(text: str, max_len: int = 200) -> str:
     return out
 
 
+def _security_followup_id(seed: str) -> str:
+    digest = hashlib.sha1(seed.encode("utf-8"), usedforsecurity=False).hexdigest()[:10].upper()
+    return f"NF-SECURITY-EXPOSED-CREDENTIAL-{digest}"
+
+
 def _upgrade_silent_reminder_prompt(prompt: str) -> str:
     """Normalize old silent-reminder copy to the full turn-wide contract.
 
@@ -416,6 +466,7 @@ class HeadlessEnforcer:
         # R25 — last user message is inspected for an explicit permit token
         # ("force OK", "si borra", etc). Populated by on_user_message.
         self._r25_last_user_text = ""
+        self._first_assistant_text_checked_for_jargon = False
         # R17 promise-debt state. Opened on a detected promise, counts
         # down on each tool call.
         self._r17_window_remaining = 0
@@ -433,6 +484,8 @@ class HeadlessEnforcer:
         # it as a bool avoids carrying stale push context across
         # unrelated tool chains.
         self._r23i_recent_push = False
+        self._production_mutation_tool_instance: int | None = None
+        self._production_mutation_evidence: str = ""
         # R23m — circular buffer of outbound-message sends with
         # {thread, body, ts}. Capped at 16 entries.
         self._r23m_recent_messages: list[dict] = []
@@ -677,6 +730,7 @@ class HeadlessEnforcer:
         # R15/R25 context MUST be updated regardless of R14 module availability
         # (critical fix: R14 import failure was silently killing R15/R25 too).
         self._r25_last_user_text = text or ""
+        self._first_assistant_text_checked_for_jargon = False
         try:
             self.on_user_message_r15(text or "")
         except Exception as _r15_exc:  # noqa: BLE001
@@ -925,6 +979,11 @@ class HeadlessEnforcer:
         shadow → logs only. soft/hard → enqueues the reminder. Dedup 60s
         via the standard _enqueue tag guard.
         """
+        if not self._first_assistant_text_checked_for_jargon:
+            self._first_assistant_text_checked_for_jargon = True
+            self._check_jargon_text(text, tag="r26:first-response-jargon")
+        self._check_execute_before_ask(text)
+        self._check_capability_denial_requires_reality(text)
         if _detect_declared_done is None:
             return
         mode = self._guardian_rule_mode("R16_declared_done")
@@ -959,6 +1018,25 @@ class HeadlessEnforcer:
         except Exception:
             pass
 
+    def _check_capability_denial_requires_reality(self, text: str):
+        """Block unsupported capability denials until a live source was checked."""
+        if not text or not _CAPABILITY_DENIAL_RE.search(text):
+            return
+        if self.tools_called.intersection(_CAPABILITY_REALITY_TOOLS):
+            return
+        mode = self._guardian_rule_mode("R34_capability_reality_check")
+        if mode == "off":
+            return
+        if mode == "shadow":
+            _logger.info("[R34 SHADOW] would inject capability reality check")
+            return
+        self._enqueue(
+            _CAPABILITY_REALITY_PROMPT,
+            "r34:capability-denial-without-reality-check",
+            rule_id="R34_capability_reality_check",
+        )
+        _logger.info("[R34 %s] enqueued capability reality check", mode.upper())
+
     def _r25_context(self) -> tuple[set[str], list[str]]:
         """Resolve the (read_only_hosts, destructive_patterns) pair from
         the shared entities registry. Returns empty sets/list on any
@@ -1149,6 +1227,130 @@ class HeadlessEnforcer:
         except Exception as exc:  # noqa: BLE001
             _logger.debug("R17 commitment resolution skipped: %s", exc)
 
+    def _check_jargon_text(self, text: str, *, tag: str) -> None:
+        if _scan_jargon is None:
+            return
+        clean = (text or "").strip()
+        if not clean:
+            return
+        if _jargon_user_requested_detail is not None and _jargon_user_requested_detail(self._r25_last_user_text or ""):
+            return
+        try:
+            matches = _scan_jargon(clean)
+        except Exception as exc:  # noqa: BLE001
+            _logger.warning("jargon scan failed (%s); staying silent", exc)
+            return
+        if not matches:
+            return
+        mode = self._guardian_rule_mode("R26_jargon_filter")
+        if mode == "off":
+            return
+        if mode == "shadow":
+            _logger.info("[R26 SHADOW] would inject jargon rewrite: %s", [m.get("token") for m in matches[:5]])
+            return
+        self._enqueue(_JARGON_PROMPT, tag, rule_id="R26_jargon_filter")
+
+    def _check_execute_before_ask(self, text: str) -> None:
+        user = (self._r25_last_user_text or "").lower()
+        reply = (text or "").lower()
+        if not user or not reply:
+            return
+        imperative = re.search(r"\b(hazlo|mira|reactiva|ejecuta|arregla|corrige|aplica|dale|haz|revisa|comprueba)\b", user)
+        asking = (
+            "?" in reply
+            or "tengo dos decisiones" in reply
+            or "elige" in reply
+            or "quieres que" in reply
+            or "confirmas" in reply
+            or "necesito que decidas" in reply
+        )
+        hard_boundary = re.search(
+            r"\b(credencial|contraseñ|password|pago|payment|destructiv|irreversible|borrar|delete|revocar|rotar|publicar|publish|dns|legal)\b",
+            user + "\n" + reply,
+        )
+        if not imperative or not asking or hard_boundary:
+            return
+        mode = self._guardian_rule_mode("R35_execute_before_ask")
+        if mode == "off":
+            return
+        if mode == "shadow":
+            _logger.info("[R35 SHADOW] would inject execute-before-ask")
+            return
+        self._enqueue(_EXECUTE_BEFORE_ASK_PROMPT, "r35:execute-before-ask", rule_id="R35_execute_before_ask")
+
+    def _production_mutation_summary(self, tool_name: str, tool_input) -> str:
+        if tool_name not in {"Bash", "mcp__nexo__Bash"} or not isinstance(tool_input, dict):
+            return ""
+        cmd = str(tool_input.get("command") or "")
+        if not cmd:
+            return ""
+        patterns = (
+            r"\bgit\s+push\b(?!.*--dry-run)(?=.*\b(?:main|master|release|stable)\b)",
+            r"\b(?:rsync|scp)\b(?!.*--dry-run).+\s+\S+:\S+",
+            r"\b(?:rsync|scp)\b(?!.*--dry-run).+\s+\S+:(?:/[^ \n\r;]*)(?:public_html|httpdocs|www|webroot)\b",
+            r"\bssh\b[^'\"]*['\"][^'\"]*(?:sed\s+-i|tee\s+|>\s*\S|>>\s*\S|rm\s+-|mv\s+|cp\s+)[^'\"]*['\"]",
+            r"\bssh\b[^'\"]*['\"][^'\"]*(?:sed\s+-i|tee\s+|>\s*\S|>>\s*\S|rm\s+-|mv\s+|cp\s+)[^'\"]*(?:public_html|httpdocs|/var/www|/opt/)[^'\"]*['\"]",
+            r"\bnpm\s+publish\b",
+            r"\bupload-release\.sh\b",
+            r"\bgcloud\s+builds\s+(?:submit|triggers\s+run)\b",
+            r"\bgcloud\s+run\s+(?:deploy|services\s+update|jobs\s+deploy|jobs\s+update)\b",
+            r"\bgcloud\s+dns\s+record-sets\s+transaction\s+execute\b",
+            r"\b(?:whmapi1|uapi|cpapi2)\b",
+            r"\b(?:cloudflare|cfcli)\b.*\b(?:dns|record)\b.*\b(?:create|delete|update|patch|put|post)\b",
+            r"\bcurl\b(?=.*api\.cloudflare\.com/client/v4/zones/.*/dns_records)(?=.*(?:-X|--request)\s*(?:POST|PUT|PATCH|DELETE)\b)",
+        )
+        for pattern in patterns:
+            if re.search(pattern, cmd, re.IGNORECASE | re.DOTALL):
+                return cmd[:300]
+        return ""
+
+    def _task_close_has_change_trace(self, tool_input) -> bool:
+        payload = tool_input if isinstance(tool_input, dict) else {}
+        fields = (
+            "files_changed",
+            "change_summary",
+            "change_why",
+            "change_verify",
+            "evidence_refs",
+            "evidence",
+            "verification",
+        )
+        joined = "\n".join(str(payload.get(field) or "") for field in fields).lower()
+        if "change_log:" in joined or "nexo_change_log" in joined:
+            return True
+        return bool(str(payload.get("files_changed") or "").strip() and str(payload.get("change_summary") or "").strip())
+
+    def _check_production_change_log_close(self, tool_name: str, tool_input) -> None:
+        if tool_name in {"nexo_change_log", "mcp__nexo__nexo_change_log"}:
+            self._production_mutation_tool_instance = None
+            self._production_mutation_evidence = ""
+            return
+        summary = self._production_mutation_summary(tool_name, tool_input)
+        if summary:
+            self._production_mutation_tool_instance = self._tool_instance_counter
+            self._production_mutation_evidence = summary
+            return
+        if tool_name not in {"nexo_task_close", "mcp__nexo__nexo_task_close"}:
+            return
+        if self._production_mutation_tool_instance is None:
+            return
+        if self._task_close_has_change_trace(tool_input):
+            self._production_mutation_tool_instance = None
+            self._production_mutation_evidence = ""
+            return
+        mode = self._guardian_rule_mode("R36_production_change_log")
+        if mode == "off":
+            return
+        if mode == "shadow":
+            _logger.info("[R36 SHADOW] would inject production change_log requirement")
+            return
+        self.injection_queue.append({
+            "prompt": _PRODUCTION_CHANGE_LOG_PROMPT,
+            "tag": "r36:production-change-log",
+            "rule_id": "R36_production_change_log",
+        })
+        _logger.info("[R36 %s] enqueued production change_log requirement", mode.upper())
+
     def _advance_r17_window(self, tool_name: str):
         if not self._r17_promise_seen_for_turn:
             return
@@ -1713,10 +1915,45 @@ class HeadlessEnforcer:
             return
         if mode == "shadow":
             _logger.info("[R23g SHADOW] would inject")
+            self._ensure_exposed_credential_followup(tool_input, reason="R23g shadow")
             return
         self._enqueue(prompt, "R23g_secrets_in_output", rule_id="R23g_secrets_in_output")
+        self._ensure_exposed_credential_followup(tool_input, reason="R23g detected secret exposure risk")
         _logger.info("[R23g %s] enqueued", mode.upper())
 
+    def _ensure_exposed_credential_followup(self, tool_input, *, reason: str) -> None:
+        if not isinstance(tool_input, dict):
+            return
+        cmd = tool_input.get("command")
+        if not isinstance(cmd, str) or not cmd.strip():
+            return
+        safe_cmd = _redact_for_log(cmd, max_len=160)
+        followup_id = _security_followup_id(f"{reason}:{safe_cmd}")
+        try:
+            from db import create_followup, get_followup  # type: ignore
+
+            if get_followup(followup_id):
+                return
+            create_followup(
+                followup_id,
+                description=(
+                    "SEGURIDAD: credencial expuesta o en riesgo detectada por el guard. "
+                    f"Origen: {safe_cmd}. Rotar/revocar la credencial y sustituirla en el gestor seguro."
+                ),
+                date=time.strftime("%Y-%m-%d"),
+                verification=(
+                    "Cierre solo con evidencia de revocación efectiva: llamada/API/HTTP 401 para la credencial antigua "
+                    "o comprobación oficial equivalente, más nueva ubicación segura registrada."
+                ),
+                reasoning=reason,
+                priority="critical",
+                internal=1,
+                owner="agent",
+            )
+            _logger.info("[R23g] security followup created: %s", followup_id)
+        except Exception as exc:  # noqa: BLE001
+            _logger.warning("R23g security followup create failed: %s", exc)
+
     def _check_r23i(self, tool_name: str, tool_input):
         """R23i — Edit after recent git push on auto_deploy project (soft)."""
         if _r23i_should is None or _r23i_is_push is None:
@@ -2285,12 +2522,22 @@ class HeadlessEnforcer:
             else:
                 self._conditional_counters[tool] = self._conditional_counters.get(tool, 0) + 1
 
+        if name != "nexo_task_close":
+            self._check_production_change_log_close(name, tool_input)
+
         # v7.6 task_close observed → rearm conditional for the companion
         # open tool so the next task cycle re-opens the obligation.
         if name == "nexo_task_close":
+            if isinstance(tool_input, dict):
+                close_text = "\n".join(
+                    str(tool_input.get(field) or "")
+                    for field in ("summary", "result", "evidence", "verification", "outcome_notes", "change_summary")
+                )
+                self._check_jargon_text(close_text, tag="r26:task-close-jargon")
             self._last_task_close_user_message_count = int(self.user_message_count or 0)
             self.reset_task_cycle("nexo_task_open")
             self._start_post_close_cooldown()
+            self._check_production_change_log_close(name, tool_input)
             self._resolve_r17_commitments_from_task_close(tool_input)
 
         if name == "nexo_stop":

package/src/evidence_ledger.py

@@ -892,6 +892,37 @@ def _collect_local_context(conn: sqlite3.Connection, limit: int, allowed: set[st
                 privacy_level="metadata",
             )
         )
+    try:
+        from local_context import usage_events
+
+        for row in usage_events.list_recent_query_events(limit=limit):
+            intent = str(row.get("intent") or "answer")
+            intent_label = intent.replace("_", " ").replace("-", " ")
+            entries.append(
+                _entry(
+                    evidence_id=f"local_context_usage:{row.get('event_id')}",
+                    source_type="local_context",
+                    source_id=str(row.get("event_id") or ""),
+                    created_at=row.get("created_at"),
+                    client=row.get("client"),
+                    object_type="local_context_query",
+                    object_ref=row.get("query_hash"),
+                    action=intent,
+                    summary=(
+                        f"local-context query intent={intent_label} "
+                        f"result_count={row.get('result_count') or 0}"
+                    ),
+                    refs=[],
+                    confidence=0.75 if int(row.get("evidence_refs_count") or 0) > 0 else 0.0,
+                    privacy_level="metadata",
+                    metadata={
+                        "store": "local-context-usage.db",
+                        "route_stage": row.get("route_stage") or "",
+                    },
+                )
+            )
+    except Exception:
+        pass
     return entries
 
 

package/src/guardian_config.py

@@ -2,7 +2,7 @@
 
 Fase 2 spec items 0.5 + 0.19. Provides the canonical loader for the
 Guardian configuration and the validator that enforces the core-rule
-invariant: R13, R14, R16, R25, R30 can only be shadow / soft / hard.
+invariant: R13, R14, R16, R25, R30, R34, R37 can only be shadow / soft / hard.
 A mode of 'off' is rejected with a clear error so the operator cannot
 accidentally disable a rule that Fase 2 declared non-negotiable.
 
@@ -43,6 +43,8 @@ CORE_RULES: frozenset[str] = frozenset({
     "R16_declared_done",
     "R25_nora_maria_read_only",
     "R30_pre_done_evidence_system_prompt",
+    "R34_identity_coherence",
+    "R37_pre_answer_evidence_gate",
 })
 
 VALID_MODES: frozenset[str] = frozenset({"off", "shadow", "soft", "hard"})