qualia-framework 7.2.0 → 7.2.1

package/CHANGELOG.md

@@ -8,6 +8,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > Note: git tags for historical versions were not retained; commit references are approximate
 > and dates reflect commit history rather than npm publish timestamps.
 
+## [7.2.1] - 2026-06-27 (system-audit makeover — portability, least-privilege, the one-loop)
+
+Outcome of a full four-system audit. Doc-truth and portability fixes plus the
+memory-loop wiring that makes the brain learn again. No execution-kernel behavior
+change; additive and corrective only.
+
+### Fixed
+- **`/qualia-scope` portability** — replaced hardcoded `/home/qualia/` paths with
+  `${QUALIA_RULES}` / `${QUALIA_REFERENCES}` so the constitution + archetype DoD
+  actually load on every install (Claude and Codex). It was silently HALTing before.
+- **Doc truth** — Opus 4.7 to 4.8 strings; skill/hook/rule counts (28/16/12)
+  regenerated from disk with a `refs.test.sh` guard so they cannot drift again;
+  the 5 undiscoverable skills added to the guide.
+
+### Added
+- **Least-privilege on `zoho-workflow`** — the only money-moving skill that had no
+  `allowed-tools` boundary now has one.
+- **The one memory loop** — `knowledge-flush.js` dual-writes durable concepts into
+  the vault; one nightly `systemd --user` timer (installer-owned) runs
+  flush -> ingest-erp-reports -> export-team-wiki; `qualia-doctor` gains five
+  freshness gates so a frozen loop is loud.
+- **R6 golden verifier fixture** — a seeded panel that must FAIL, proving the
+  verifier cannot default to a passing score.
+
 ## [7.2.0] - 2026-06-25 (journey spine — lifecycle UX for employees)
 
 A cosmetic/UX layer that gives an employee a continuous sense of place and

package/FLAGS.md

@@ -9,6 +9,7 @@ or another underlying CLI.
 | Skill | Flag | Effect |
 |---|---|---|
 | `/qualia-new` | `--auto` | Chain end-to-end after journey approval. Pauses only at milestone boundaries. |
+| `/qualia-new` | `--quick` | 4-phase flat wizard for trivial projects (landing pages, prototypes). Skips research and journey mapping. |
 | `/qualia-plan` | `--gaps` | Surgical-fix mode. Reads `phase-{N}-verification.md` FAILs, produces wave-1 fix tasks without touching passing items. |
 | `/qualia-verify` | `--adversarial` | Spawn a second-pass critic that attacks the verifier's own report. Required on auth / payment / migration phases. |
 | `/qualia-postmortem` | `--auto` | Auto-invoked by `/qualia-verify` on FAIL. Identifies which agent/rule/skill should have caught the failure and proposes a delta. |
@@ -59,6 +60,15 @@ or another underlying CLI.
 |---|---|---|
 | `/qualia-test` | `--tdd` | Drive a feature test-first via vertical-slice loop (one test → one impl → repeat). |
 
+## Specialized & post-launch
+
+| Skill | Flag | Effect |
+|---|---|---|
+| `/qualia-secure` | `--deep` | Run the optional Opus adversarial red/blue/auditor deep-analysis pass after the static scan. |
+| `/qualia-secure` | `--exit-code` | CI release-gate mode: non-zero exit on findings (wire into pipelines). |
+| `/qualia-recall` | `--scope <knowledge\|vault\|all>` | Restrict recall to the knowledge layer, the qualia-memory vault, or both (default `all`). |
+| `/qualia-recall` | `--json` | Machine-readable output. |
+
 ## Ship & report
 
 | Skill | Flag | Effect |

package/README.md

@@ -135,12 +135,12 @@ Project
 
 **Why it matters:** non-technical team members can follow the ladder from any entry point. `/qualia` and `/qualia-milestone` render JOURNEY.md as a visual ladder with current position highlighted. In the ERP, the primary operational dates are project deadline, milestone deadline, and employee shift submission date; framework tasks stay internal to agent execution.
 
-## What's Inside (v6.3.0)
+## What's Inside
 
-- **25 installed skills**, focused into Road (new / plan / build / verify / milestone / polish / ship / handoff / report), depth (scope, research, map), navigation (qualia router + road), quality (fix, review, optimize with `--deepen` parallel-interface design, feature, test), design (`qualia-polish --loop` and `--vibe`), health/reporting (doctor, learn, postmortem), and Zoho workflow support. Retired helper commands are pruned on install rather than exposed as default slash commands.
+- **28 installed skills** (`skills/` is the source of truth — run `qualia-framework doctor` for the live list), focused into Road (new / plan / build / verify / milestone / polish / ship / handoff / report), depth (scope, research, map), navigation (qualia router + road), quality (fix, review, optimize with `--deepen` parallel-interface design, feature, test), AI-feature evaluation (eval), security scanning (secure), post-launch operate mode (update), OWNER recall (recall), health/reporting (doctor, learn, postmortem), and Zoho workflow support. Retired helper commands are pruned on install rather than exposed as default slash commands.
 - **9 agents** (each runs in fresh context): planner, builder, verifier, qa-browser, researcher, research-synthesizer, roadmapper, plan-checker, visual-evaluator
-- **12 hooks** (pure Node.js, cross-platform): session-start, auto-update, git-guardrails, branch-guard, pre-push tracking stamp, migration-guard, pre-deploy-gate, stop-session-log, fawzi-approval-guard, vercel-account-guard, env-empty-guard, supabase-destructive-guard
-- **10 installed rules** (`rules/`): grounding, security, infrastructure, deployment, speed, architecture, trust-boundary, codex-goal, one-opinion, and always-on command-output transparency.
+- **16 hooks** (pure Node.js, cross-platform): session-start, auto-update, git-guardrails, branch-guard, pre-push tracking stamp, migration-guard, pre-deploy-gate, stop-session-log, fawzi-approval-guard, vercel-account-guard, env-empty-guard, supabase-destructive-guard, secret-guard, task-write-guard, pre-compact, usage-capture
+- **12 installed rules** (`rules/`): constitution, grounding, security, access, infrastructure, deployment, speed, architecture, trust-boundary, codex-goal, one-opinion, and always-on command-output transparency.
 - **7 lazy-loaded design files** (`qualia-design/`): design-laws, design-brand, design-product, design-rubric, design-reference, frontend, graphics — `Read` on demand by design-aware skills/agents only.
 - **25 template files**: project.md, journey.md, plan.md (story-file format), state.md, DESIGN.md, CONTEXT.md (domain glossary), work-packet.md (ERP-approved session context), decisions/ADR-template.md, tracking.json (with `milestone_name` + `milestones[]`), requirements.md (multi-milestone), roadmap.md (current milestone only), phase-context.md, 4 project-type templates (website, ai-agent, voice-agent, mobile-app), 5 research-project templates (STACK, FEATURES, ARCHITECTURE, PITFALLS, SUMMARY), knowledge templates, help.html
 - **Planning hygiene guard**: `planning-hygiene.js` scans `.planning/` for loose reports/assets and can organize them under `reports/`, `assets/`, `design/`, or `archive/loose/` only with explicit `--write`
@@ -180,7 +180,7 @@ Splitting planner, builder, and verifier into separate agents with separate cont
 
 ### Production-Grade Hooks
 
-All 12 hooks are real ops engineering, not theoretical:
+All 16 hooks are real ops engineering, not theoretical:
 
 - **Pre-deploy gate** — TypeScript, lint, tests, build, and `service_role` leak scan before `vercel --prod`
 - **Fawzi approval guard** — Silently counts employee proxy-approval claims for ERP review
@@ -214,12 +214,12 @@ npx qualia-framework@latest install
      |
      v
 ~/.claude/ and/or ~/.codex/
-  ├── skills/             25 installed skills (each may ship SKILL.md + REFERENCE.md + scripts/ + fixtures/)
+  ├── skills/             28 installed skills (each may ship SKILL.md + REFERENCE.md + scripts/ + fixtures/)
   ├── agents/             9 agent definitions (Claude .md, Codex .toml)
-  ├── hooks/              11 Node.js hooks — cross-platform (no bash dependency)
+  ├── hooks/              16 Node.js hooks — cross-platform (no bash dependency)
   ├── bin/                state.js + qualia-ui.js + statusline.js + knowledge.js + knowledge-flush.js + slop-detect.mjs + planning-hygiene.js + plan-contract.js + agent-runs.js + ERP/report helpers
   ├── knowledge/          learned-patterns.md, common-fixes.md, client-prefs.md, daily-log/
-  ├── rules/              grounding, security, infrastructure, deployment, speed, architecture, trust-boundary, codex-goal, one-opinion, command-output
+  ├── rules/              constitution, grounding, security, access, infrastructure, deployment, speed, architecture, trust-boundary, codex-goal, one-opinion, command-output
   ├── qualia-design/      lazy-loaded design substrate — read on demand
   ├── qualia-templates/   project, journey, plan, state, DESIGN, CONTEXT, work-packet, decisions, tracking, requirements, roadmap, research, help
   ├── qualia-references/  questioning.md (deep project initialization methodology)

package/bin/cli.js

@@ -453,6 +453,7 @@ async function cmdUninstall() {
     safeRmDir(path.join(home, "qualia-templates"), counters);
     safeRmDir(path.join(home, "qualia-design"), counters);
     safeRmDir(path.join(home, "qualia-references"), counters);
+    safeRmDir(path.join(home, "references"), counters);
 
     if (!preserveKnowledge) {
       safeRmDir(path.join(home, "knowledge"), counters);
@@ -466,10 +467,39 @@ async function cmdUninstall() {
 
     safeRmDir(path.join(home, ".qualia-traces"), counters);
 
+    // Memory-loop runner (installed alongside bin/, not a .js so not in QUALIA_BIN_FILES).
+    safeUnlink(path.join(home, "bin", "qualia-loop.sh"), counters);
+
     if (isCodexHome(home)) cleanCodexHooksJson(home, counters);
     else cleanSettingsJson(home, counters);
   }
 
+  // ── Memory loop systemd --user timer teardown ─────────────
+  // installMemoryTimer() (bin/install.js) enables a nightly timer + writes unit
+  // files. Disable + remove them so uninstall leaves no scheduled job behind.
+  try {
+    const os = require("os");
+    const { spawnSync } = require("child_process");
+    const unitDir = path.join(os.homedir(), ".config", "systemd", "user");
+    const units = ["qualia-loop.timer", "qualia-loop.service"];
+    const probe = spawnSync("systemctl", ["--user", "--version"], { stdio: "ignore" });
+    if (probe.status === 0) {
+      spawnSync("systemctl", ["--user", "disable", "--now", "qualia-loop.timer"], { stdio: "ignore" });
+    }
+    let removedUnit = false;
+    for (const u of units) {
+      const p = path.join(unitDir, u);
+      if (fs.existsSync(p)) { try { fs.unlinkSync(p); removedUnit = true; counters.filesRemoved++; } catch (e) { counters.errors.push(`systemd unit ${u}: ${e.message}`); } }
+    }
+    const loopLog = path.join(os.homedir(), ".claude", ".qualia-loop.log");
+    if (fs.existsSync(loopLog)) { try { fs.unlinkSync(loopLog); counters.filesRemoved++; } catch {} }
+    if (probe.status === 0 && removedUnit) {
+      spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
+    }
+  } catch (e) {
+    counters.errors.push(`memory-loop timer teardown: ${e.message}`);
+  }
+
   // Summary.
   console.log("");
   console.log(`${TEAL}  ⬢ Uninstall complete${RESET}`);
@@ -1478,11 +1508,29 @@ function cmdDoctor() {
     projectAdvisories.push(`project contract health unavailable: ${e.message}`);
   }
 
+  // ── Memory-loop freshness gates (advisory) ─────────────
+  // Surfaces a silently-frozen loop: stale capture, an unscheduled flush, a
+  // stale export, partial coverage, or deprecated rows leaking into the export.
+  let memoryGates = [];
+  try {
+    memoryGates = require("./qualia-doctor.js").runGates();
+  } catch (e) {
+    memoryGates = [{ gate: "memory-loop gates", status: "FAIL", detail: e.message }];
+  }
+
   // ── Render ────────────────────────────────────────────
   for (const c of checks) {
     const mark = c.ok ? `${GREEN}✓${RESET}` : `${RED}✗${RESET}`;
     console.log(`  ${mark} ${c.label}`);
   }
+  if (memoryGates.length > 0) {
+    console.log("");
+    console.log(`  ${WHITE}Memory loop:${RESET}`);
+    for (const g of memoryGates) {
+      const mark = g.status === "PASS" ? `${GREEN}✓${RESET}` : g.status === "WARN" ? `${YELLOW}!${RESET}` : `${RED}✗${RESET}`;
+      console.log(`  ${mark} ${g.gate} ${DIM}— ${g.detail}${RESET}`);
+    }
+  }
   if (projectAdvisories.length > 0) {
     console.log("");
     console.log(`  ${WHITE}Project trust:${RESET}`);

package/bin/host-adapters.js

@@ -69,7 +69,11 @@ function adapter(name) {
       QUALIA_RULES: `${home}/rules`,
       QUALIA_TEMPLATES: `${home}/qualia-templates`,
       QUALIA_KNOWLEDGE: `${home}/knowledge`,
-      QUALIA_REFERENCES: `${home}/qualia-references`,
+      // Canonical references tree (methodology docs + archetypes/). The
+      // archetype DoD files (read by qualia-scope) live ONLY under this canonical
+      // path, so the token points here — NOT at the flat `qualia-references/`
+      // mirror, which carries questioning.md but not the nested archetypes/ tree.
+      QUALIA_REFERENCES: `${home}/references`,
       QUALIA_DESIGN: `${home}/qualia-design`,
     },
   };

package/bin/install.js

@@ -629,6 +629,111 @@ function resolveTeamCode(input) {
   return null;
 }
 
+// ─── Memory loop scheduler (systemd --user timer) ────────────────────────
+// THE ONE LOOP, installer-owned. A single nightly timer runs, in order:
+//   1. knowledge-flush.js     → promote daily-log + dual-write vault concepts
+//   2. ingest-erp-reports.py  → pull team reports from ERP into the vault
+//   3. export-team-wiki.py    → rebuild the sanitized team export
+// Fedora is the target (crontab is empty); systemd --user is the native
+// scheduler. Idempotent: re-running install rewrites the unit files and
+// re-enables the timer. If systemctl --user is unavailable (non-systemd host,
+// or no user bus), we write the units anyway and print manual-run fallback
+// instructions instead of failing the install.
+function installMemoryTimer() {
+  printSection("Memory loop scheduler");
+
+  const os = require("os");
+  const { spawnSync } = require("child_process");
+  const HOME = os.homedir();
+
+  const unitDir = path.join(HOME, ".config", "systemd", "user");
+  const binFlush = path.join(CLAUDE_DIR, "bin", "knowledge-flush.js");
+  const vaultRoot = process.env.QUALIA_MEMORY || path.join(HOME, "qualia-memory");
+  const scriptsDir = path.join(vaultRoot, "scripts");
+  const ingest = path.join(scriptsDir, "ingest-erp-reports.py");
+  const exportWiki = path.join(scriptsDir, "export-team-wiki.py");
+  const logFile = path.join(CLAUDE_DIR, ".qualia-loop.log");
+
+  // The runner script chains the three steps; non-fatal per step so one failure
+  // (e.g. ERP down) doesn't block the others. node for the flush, python3 for
+  // the vault scripts (skipped gracefully if absent — the vault may be on
+  // another machine).
+  const runner = path.join(CLAUDE_DIR, "bin", "qualia-loop.sh");
+  const runnerBody = [
+    "#!/usr/bin/env bash",
+    "# qualia-loop.sh — nightly memory-loop runner (installed by qualia-framework).",
+    "# One loop: flush → ingest ERP team reports → export team wiki. Each step is",
+    "# non-fatal so a single failure does not block the others.",
+    "set -u",
+    `LOG="${logFile}"`,
+    'echo "[$(date -Iseconds)] qualia-loop start" >> "$LOG"',
+    `node "${binFlush}" >> "$LOG" 2>&1 || echo "[$(date -Iseconds)] flush failed" >> "$LOG"`,
+    `if [ -f "${ingest}" ]; then python3 "${ingest}" >> "$LOG" 2>&1 || echo "[$(date -Iseconds)] ingest failed" >> "$LOG"; else echo "[$(date -Iseconds)] ingest skipped (no vault scripts)" >> "$LOG"; fi`,
+    `if [ -f "${exportWiki}" ]; then python3 "${exportWiki}" >> "$LOG" 2>&1 || echo "[$(date -Iseconds)] export failed" >> "$LOG"; else echo "[$(date -Iseconds)] export skipped (no vault scripts)" >> "$LOG"; fi`,
+    'echo "[$(date -Iseconds)] qualia-loop done" >> "$LOG"',
+    "",
+  ].join("\n");
+
+  const serviceBody = [
+    "[Unit]",
+    "Description=Qualia memory loop (flush → ingest ERP → export team wiki)",
+    "",
+    "[Service]",
+    "Type=oneshot",
+    `Environment=QUALIA_MEMORY=${vaultRoot}`,
+    `ExecStart=/usr/bin/env bash ${runner}`,
+    "",
+  ].join("\n");
+
+  const timerBody = [
+    "[Unit]",
+    "Description=Nightly Qualia memory loop",
+    "",
+    "[Timer]",
+    "OnCalendar=*-*-* 03:00:00",
+    "Persistent=true",
+    "",
+    "[Install]",
+    "WantedBy=timers.target",
+    "",
+  ].join("\n");
+
+  try {
+    if (!fs.existsSync(unitDir)) fs.mkdirSync(unitDir, { recursive: true });
+    fs.writeFileSync(runner, runnerBody);
+    try { fs.chmodSync(runner, 0o755); } catch {}
+    fs.writeFileSync(path.join(unitDir, "qualia-loop.service"), serviceBody);
+    fs.writeFileSync(path.join(unitDir, "qualia-loop.timer"), timerBody);
+    ok("unit files written (~/.config/systemd/user/qualia-loop.{service,timer})");
+  } catch (e) {
+    warn(`memory-loop unit files — ${e.message}`);
+    return;
+  }
+
+  // Only enable if systemctl --user is usable. On non-systemd hosts or where
+  // there's no user bus (e.g. CI), print manual fallback and move on.
+  const probe = spawnSync("systemctl", ["--user", "--version"], { stdio: "ignore" });
+  if (probe.status !== 0) {
+    log(`${DIM}systemctl --user unavailable — units written but not enabled.${RESET}`);
+    log(`${DIM}Manual run:${RESET} ${TEAL}node ${binFlush}${RESET}`);
+    log(`${DIM}Or schedule via cron:${RESET} ${TEAL}0 3 * * * bash ${runner}${RESET}`);
+    return;
+  }
+
+  const reload = spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
+  const enable = spawnSync("systemctl", ["--user", "enable", "--now", "qualia-loop.timer"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (reload.status === 0 && enable.status === 0) {
+    ok("nightly timer enabled (qualia-loop.timer · 03:00 daily)");
+  } else {
+    log(`${DIM}timer written but enable failed — run manually:${RESET}`);
+    log(`  ${TEAL}systemctl --user daemon-reload && systemctl --user enable --now qualia-loop.timer${RESET}`);
+    if (enable.stderr) log(`${DIM}${enable.stderr.trim().split("\n").slice(0, 2).join(" ")}${RESET}`);
+  }
+}
+
 // ─── Main ────────────────────────────────────────────────
 async function main() {
   // Piped install: drain stdin once up front. Avoids EOF/'close' racing
@@ -1479,10 +1584,19 @@ Client-specific preferences, design choices, and requirements. Loaded by \`/qual
   fs.writeFileSync(settingsTmp, JSON.stringify(settings, null, 2));
   fs.renameSync(settingsTmp, settingsPath);
 
-  ok("Hooks: session-start, auto-update, branch-guard, pre-push, migration-guard, deploy-gate, git-guardrails, stop-session-log, fawzi-approval-guard, vercel-account-guard, env-empty-guard, supabase-destructive-guard");
+  ok("Hooks: session-start, auto-update, branch-guard, pre-push, migration-guard, deploy-gate, git-guardrails, stop-session-log, fawzi-approval-guard, vercel-account-guard, env-empty-guard, supabase-destructive-guard, secret-guard, task-write-guard, pre-compact, usage-capture");
   ok("Status line + spinner configured");
   ok("Environment variables + permissions");
 
+  // ─── Memory loop scheduler (systemd --user timer) ─────────
+  // Installs ONE nightly timer: knowledge-flush → ingest-erp-reports →
+  // export-team-wiki. Idempotent; safe-skips when systemctl --user is absent.
+  try {
+    installMemoryTimer();
+  } catch (e) {
+    warn(`memory-loop scheduler — ${e.message}`);
+  }
+
   // ─── Codex (optional second target) ──────────────────────
   if (installCodexTarget) {
     await installCodex(member, target, employeeMode);
@@ -1802,6 +1916,10 @@ async function installCodex(member, target, employeeMode = false) {
     const referencesSrc = path.join(FRAMEWORK_DIR, "references");
     if (fs.existsSync(referencesSrc)) {
       copyTreeTransform(referencesSrc, path.join(CODEX_DIR, "qualia-references"), codexText);
+      // Canonical copy: ${QUALIA_REFERENCES} resolves to <home>/references on both
+      // runtimes, and qualia-scope reads references/archetypes/*.md from it. Mirror
+      // the whole tree (incl. nested archetypes/) so the token resolves on Codex.
+      copyTreeTransform(referencesSrc, path.join(CODEX_DIR, "references"), codexText);
     }
     const knowledgeSrc = path.join(FRAMEWORK_DIR, "templates", "knowledge");
     const knowledgeDest = path.join(CODEX_DIR, "knowledge");

package/bin/knowledge-flush.js

@@ -6,10 +6,19 @@
 // memory loop end-to-end:
 //
 //   Stop hook (auto, every turn) → <install-home>/knowledge/daily-log/{date}.md
-//   THIS SCRIPT (weekly cron)    → spawns the installed agent CLI
-//   flush prompt                 → promotes raw → curated tier
+//   THIS SCRIPT (nightly timer)  → spawns the installed agent CLI
+//   flush prompt                 → promotes raw → curated tier (~/.claude/knowledge)
+//                                → ALSO dual-writes durable concepts into the vault
+//                                  at ${QUALIA_MEMORY:-~/qualia-memory}/wiki/sessions/concepts/
 //   bin/knowledge.js (every spawn) → reads index.md → reaches the right file
 //
+// PROMOTE step (the agreed one-loop contract, replacing Cole's compile.py):
+// after the agent CLI flush succeeds, this script reads the freshly-promoted
+// curated concepts and dual-writes a deterministic markdown file per concept
+// into the qualia-memory vault. The vault is resolved from $QUALIA_MEMORY (else
+// ~/qualia-memory); if the vault dir does not exist the dual-write is skipped
+// gracefully with a logged notice — it never crashes the flush.
+//
 // Usage:
 //   node ~/.claude/bin/knowledge-flush.js               # 7-day flush
 //   node ~/.claude/bin/knowledge-flush.js --days 14     # custom window
@@ -50,6 +59,24 @@ const KNOWLEDGE_DIR = path.join(QUALIA_HOME, "knowledge");
 const DAILY_DIR = path.join(KNOWLEDGE_DIR, "daily-log");
 const LOG_FILE = path.join(QUALIA_HOME, ".qualia-flush.log");
 
+// ── Vault dual-write target (PROMOTE step of the one-loop contract) ──────
+// Resolve the qualia-memory vault from $QUALIA_MEMORY, else ~/qualia-memory.
+// Durable concepts promoted into the curated tier are mirrored into
+// <vault>/wiki/sessions/concepts/ so the brain (qualia-memory) and the
+// framework-local curated tier stay in sync. If the vault dir is absent the
+// mirror is skipped gracefully (logged "vault-absent"), never crashing.
+function vaultRoot() {
+  return process.env.QUALIA_MEMORY || path.join(HOME, "qualia-memory");
+}
+const VAULT_ROOT = vaultRoot();
+const VAULT_CONCEPTS_DIR = path.join(VAULT_ROOT, "wiki", "sessions", "concepts");
+
+// The curated concept sources to mirror into the vault. Top-level curated
+// files (promoted by the agent flush) plus anything the flush wrote under
+// knowledge/concepts/. Deterministic so each run overwrites idempotently.
+const CURATED_CONCEPT_FILES = ["learned-patterns.md", "common-fixes.md", "client-prefs.md"];
+const CURATED_CONCEPTS_SUBDIR = path.join(KNOWLEDGE_DIR, "concepts");
+
 const _start = Date.now();
 
 function logEvent(event) {
@@ -65,6 +92,82 @@ function logEvent(event) {
   } catch {}
 }
 
+// ── PROMOTE → vault dual-write ──────────────────────────────────────────
+// Mirror the curated concept tier into the qualia-memory vault. Each curated
+// source becomes a deterministic file at <vault>/wiki/sessions/concepts/ —
+// stable name (slug of the source path) so re-runs overwrite idempotently
+// rather than accumulating duplicates. Returns a structured summary for the
+// flush log. NEVER throws — a vault-write failure must not fail the flush.
+function dualWriteVault() {
+  // Resolve the set of curated concept files to mirror.
+  const sources = [];
+  for (const f of CURATED_CONCEPT_FILES) {
+    const p = path.join(KNOWLEDGE_DIR, f);
+    if (fs.existsSync(p)) sources.push({ abs: p, slug: f.replace(/\.md$/, "") });
+  }
+  try {
+    if (fs.existsSync(CURATED_CONCEPTS_SUBDIR)) {
+      for (const f of fs.readdirSync(CURATED_CONCEPTS_SUBDIR)) {
+        if (!f.endsWith(".md")) continue;
+        sources.push({
+          abs: path.join(CURATED_CONCEPTS_SUBDIR, f),
+          slug: `concept-${f.replace(/\.md$/, "")}`,
+        });
+      }
+    }
+  } catch {}
+
+  if (sources.length === 0) {
+    return { event_detail: "no-curated-concepts", written: 0 };
+  }
+
+  // Vault must exist on disk; if not, skip gracefully (the brain may live on a
+  // different machine than the one running the timer).
+  if (!fs.existsSync(VAULT_ROOT)) {
+    return { event_detail: "vault-absent", vault: VAULT_ROOT, written: 0 };
+  }
+
+  let written = 0;
+  const failures = [];
+  try {
+    if (!fs.existsSync(VAULT_CONCEPTS_DIR)) {
+      fs.mkdirSync(VAULT_CONCEPTS_DIR, { recursive: true });
+    }
+  } catch (e) {
+    return { event_detail: "vault-mkdir-failed", vault: VAULT_CONCEPTS_DIR, error: e.message, written: 0 };
+  }
+
+  const stamp = new Date().toISOString();
+  for (const src of sources) {
+    try {
+      const body = fs.readFileSync(src.abs, "utf8").trim();
+      if (!body) continue;
+      // Deterministic filename: slug of the curated source. Idempotent overwrite.
+      const safeSlug = src.slug.replace(/[^a-z0-9._-]/gi, "-").toLowerCase();
+      const dest = path.join(VAULT_CONCEPTS_DIR, `${safeSlug}.md`);
+      const frontMatter = [
+        "---",
+        "source: qualia-framework/knowledge-flush",
+        `promoted_from: knowledge/${path.relative(KNOWLEDGE_DIR, src.abs)}`,
+        `last_promoted: ${stamp}`,
+        "share: team",
+        "---",
+        "",
+      ].join("\n");
+      fs.writeFileSync(dest, frontMatter + body + "\n");
+      written++;
+    } catch (e) {
+      failures.push(`${src.slug}: ${e.message}`);
+    }
+  }
+  return {
+    event_detail: "vault-mirrored",
+    vault_dir: VAULT_CONCEPTS_DIR,
+    written,
+    failures: failures.length ? failures : undefined,
+  };
+}
+
 function which(cmd) {
   // Cross-platform `which`. Returns the first PATH match or null.
   // We don't shell out to `which` itself because it doesn't exist on Windows
@@ -109,6 +212,18 @@ function dailyLogHasRecentEntries(windowDays) {
   return false;
 }
 
+// When required as a module (tests), export the pure helpers and stop here —
+// do not spawn the agent CLI or touch process exit.
+if (require.main !== module) {
+  module.exports = {
+    dualWriteVault,
+    vaultRoot,
+    VAULT_CONCEPTS_DIR,
+    CURATED_CONCEPT_FILES,
+  };
+  return;
+}
+
 // ── Preflight ────────────────────────────────────────────
 // Per-host facts (which CLI, how to invoke it) come from the adapter — the one
 // place runtime differences live. See bin/host-adapters.js.
@@ -171,6 +286,11 @@ if (status !== 0) {
   process.exit(1);
 }
 
+// Success: the curated tier has just been (re)written by the agent flush.
+// PROMOTE step — mirror the durable concepts into the qualia-memory vault.
+const vault = dualWriteVault();
+logEvent({ event: "vault-dual-write", ...vault });
+
 // Success: parse stdout for the skill's summary line if present, else log
 // the full output tail.
 const summaryMatch = stdout.match(/⬢ Flushed daily-log .+/);
@@ -178,6 +298,7 @@ logEvent({
   event: "ok",
   prompt,
   summary: summaryMatch ? summaryMatch[0] : stdout.split("\n").slice(-3).join(" | "),
+  vault: vault.event_detail,
 });
 
 // Echo the user-facing summary to stdout so cron logs / interactive runs

package/bin/qualia-doctor.js

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+// ~/.claude/bin/qualia-doctor.js — memory-loop freshness gates for /qualia-doctor.
+//
+// The memory loop (capture → promote → ingest → export) can silently freeze:
+// the audit found raw/sessions/ stale for 23 days with no monitoring. These
+// gates make staleness loud. Each gate prints PASS / WARN / FAIL with the
+// offending detail, so the operator sees exactly which leg of the loop stopped.
+//
+// Usage:
+//   node ~/.claude/bin/qualia-doctor.js           # human-readable gates
+//   node ~/.claude/bin/qualia-doctor.js --json     # machine-readable
+//   node ~/.claude/bin/qualia-doctor.js --exit-code # exit 1 if any gate FAILs
+//
+// Gates:
+//   1. daily-log newest        ≤ 2 days  (capture is alive)
+//   2. flush log last run      ≤ 8 days  (promote/flush is scheduled & running)
+//   3. wiki/_export rebuilt    ≤ 2 days  (export is scheduled & running)
+//   4. export concept count    == allowed source set (export covers all concepts)
+//   5. tags:deprecated         == 0 in _export (no deprecated rows leaked out)
+//
+// Zero-dependency. Resolves the vault from $QUALIA_MEMORY else ~/qualia-memory,
+// and the install home from $QUALIA_HOME else ~/.claude. Missing dirs surface
+// as the gate's offending detail rather than a crash.
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const HOME = os.homedir();
+
+function qualiaHome() {
+  if (process.env.QUALIA_HOME) return process.env.QUALIA_HOME;
+  const parent = path.basename(path.dirname(__dirname));
+  if (parent === ".codex" || parent === ".claude") return path.dirname(__dirname);
+  return path.join(HOME, ".claude");
+}
+function vaultRoot() {
+  return process.env.QUALIA_MEMORY || path.join(HOME, "qualia-memory");
+}
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+function ageDays(ms) {
+  return (Date.now() - ms) / DAY_MS;
+}
+
+// Newest mtime among files in a dir (optionally filtered). null if dir absent/empty.
+function newestMtime(dir, filterFn) {
+  if (!fs.existsSync(dir)) return null;
+  let newest = null;
+  let stack = [dir];
+  while (stack.length) {
+    const d = stack.pop();
+    let entries;
+    try { entries = fs.readdirSync(d, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      const p = path.join(d, e.name);
+      if (e.isDirectory()) { stack.push(p); continue; }
+      if (filterFn && !filterFn(e.name, p)) continue;
+      try {
+        const m = fs.statSync(p).mtimeMs;
+        if (newest === null || m > newest) newest = m;
+      } catch {}
+    }
+  }
+  return newest;
+}
+
+// ── Gate definitions ────────────────────────────────────────────────────
+// Each returns { gate, status: PASS|WARN|FAIL, detail }.
+
+function gateDailyLog(QUALIA_HOME) {
+  const dir = path.join(QUALIA_HOME, "knowledge", "daily-log");
+  const newest = newestMtime(dir, (name) => name.endsWith(".md"));
+  if (newest === null) {
+    return { gate: "daily-log freshness", status: "FAIL", detail: `no daily-log entries at ${dir}` };
+  }
+  const age = ageDays(newest);
+  if (age <= 2) return { gate: "daily-log freshness", status: "PASS", detail: `newest ${age.toFixed(1)}d old (≤2d)` };
+  if (age <= 4) return { gate: "daily-log freshness", status: "WARN", detail: `newest ${age.toFixed(1)}d old (>2d)` };
+  return { gate: "daily-log freshness", status: "FAIL", detail: `newest ${age.toFixed(1)}d old — capture may be dead` };
+}
+
+function gateFlushLog(QUALIA_HOME) {
+  const logFile = path.join(QUALIA_HOME, ".qualia-flush.log");
+  if (!fs.existsSync(logFile)) {
+    return { gate: "flush last-run", status: "FAIL", detail: `no flush log at ${logFile} — flush never ran` };
+  }
+  // Last run = last "ok"/"skipped"/"failed" event timestamp in the JSONL log.
+  let lastTs = null;
+  try {
+    const lines = fs.readFileSync(logFile, "utf8").trim().split("\n").filter(Boolean);
+    for (let i = lines.length - 1; i >= 0; i--) {
+      try {
+        const ev = JSON.parse(lines[i]);
+        if (ev.timestamp) { lastTs = Date.parse(ev.timestamp); break; }
+      } catch {}
+    }
+  } catch {}
+  if (lastTs === null || Number.isNaN(lastTs)) {
+    // Fall back to file mtime.
+    try { lastTs = fs.statSync(logFile).mtimeMs; } catch { lastTs = null; }
+  }
+  if (lastTs === null) {
+    return { gate: "flush last-run", status: "FAIL", detail: "flush log unreadable" };
+  }
+  const age = ageDays(lastTs);
+  if (age <= 8) return { gate: "flush last-run", status: "PASS", detail: `last run ${age.toFixed(1)}d ago (≤8d)` };
+  if (age <= 12) return { gate: "flush last-run", status: "WARN", detail: `last run ${age.toFixed(1)}d ago (>8d)` };
+  return { gate: "flush last-run", status: "FAIL", detail: `last run ${age.toFixed(1)}d ago — flush schedule may be broken` };
+}
+
+function gateExportFresh(VAULT) {
+  const exportDir = path.join(VAULT, "wiki", "_export");
+  const newest = newestMtime(exportDir);
+  if (newest === null) {
+    return { gate: "team-export freshness", status: "FAIL", detail: `no export at ${exportDir} — export never ran` };
+  }
+  const age = ageDays(newest);
+  if (age <= 2) return { gate: "team-export freshness", status: "PASS", detail: `rebuilt ${age.toFixed(1)}d ago (≤2d)` };
+  if (age <= 4) return { gate: "team-export freshness", status: "WARN", detail: `rebuilt ${age.toFixed(1)}d ago (>2d)` };
+  return { gate: "team-export freshness", status: "FAIL", detail: `rebuilt ${age.toFixed(1)}d ago — export schedule may be broken` };
+}
+
+// Allowed source set = concept markdown in the vault's source concepts tier
+// (wiki/sessions/concepts/ + wiki/concepts/). Export must cover the same count
+// of concept files (under _export/.../concepts or _export wiki concepts).
+function countConceptMd(dir) {
+  if (!fs.existsSync(dir)) return 0;
+  let n = 0;
+  let stack = [dir];
+  while (stack.length) {
+    const d = stack.pop();
+    let entries;
+    try { entries = fs.readdirSync(d, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      const p = path.join(d, e.name);
+      if (e.isDirectory()) {
+        if (/concepts?$/i.test(e.name)) stack.push(p);
+        else stack.push(p);
+        continue;
+      }
+      if (e.name.endsWith(".md") && /concepts?[\\/]/i.test(path.relative(dir, p) + "/")) n++;
+    }
+  }
+  return n;
+}
+
+function gateExportCoverage(VAULT) {
+  // Source concepts: the curated/promoted concept tier in the vault.
+  const sourceDirs = [
+    path.join(VAULT, "wiki", "sessions", "concepts"),
+    path.join(VAULT, "wiki", "concepts"),
+  ];
+  let sourceCount = 0;
+  for (const d of sourceDirs) {
+    if (!fs.existsSync(d)) continue;
+    try { sourceCount += fs.readdirSync(d).filter((f) => f.endsWith(".md")).length; } catch {}
+  }
+  const exportRoot = path.join(VAULT, "wiki", "_export");
+  if (!fs.existsSync(exportRoot)) {
+    return { gate: "export concept coverage", status: "FAIL", detail: `no export dir — source has ${sourceCount} concept(s)` };
+  }
+  const exportCount = countConceptMd(exportRoot);
+  if (sourceCount === 0) {
+    return { gate: "export concept coverage", status: "WARN", detail: "no source concepts to cover yet" };
+  }
+  if (exportCount === sourceCount) {
+    return { gate: "export concept coverage", status: "PASS", detail: `${exportCount}/${sourceCount} concepts exported` };
+  }
+  return {
+    gate: "export concept coverage",
+    status: "FAIL",
+    detail: `export has ${exportCount} concept(s), source has ${sourceCount} — export is stale or partial`,
+  };
+}
+
+function gateNoDeprecated(VAULT) {
+  const exportRoot = path.join(VAULT, "wiki", "_export");
+  if (!fs.existsSync(exportRoot)) {
+    return { gate: "no deprecated in export", status: "FAIL", detail: "no export dir to scan" };
+  }
+  const offenders = [];
+  let stack = [exportRoot];
+  while (stack.length) {
+    const d = stack.pop();
+    let entries;
+    try { entries = fs.readdirSync(d, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      const p = path.join(d, e.name);
+      if (e.isDirectory()) { stack.push(p); continue; }
+      if (!e.name.endsWith(".md")) continue;
+      try {
+        const txt = fs.readFileSync(p, "utf8");
+        // Match `tags: [..., deprecated, ...]`, `tags:deprecated`, or a `deprecated` tag line.
+        if (/tags?\s*:\s*\[?[^\]\n]*\bdeprecated\b/i.test(txt) || /^\s*-\s*deprecated\s*$/im.test(txt)) {
+          offenders.push(path.relative(exportRoot, p));
+        }
+      } catch {}
+    }
+  }
+  if (offenders.length === 0) {
+    return { gate: "no deprecated in export", status: "PASS", detail: "0 deprecated-tagged files" };
+  }
+  return {
+    gate: "no deprecated in export",
+    status: "FAIL",
+    detail: `${offenders.length} deprecated file(s): ${offenders.slice(0, 3).join(", ")}${offenders.length > 3 ? "…" : ""}`,
+  };
+}
+
+function runGates() {
+  const QUALIA_HOME = qualiaHome();
+  const VAULT = vaultRoot();
+  return [
+    gateDailyLog(QUALIA_HOME),
+    gateFlushLog(QUALIA_HOME),
+    gateExportFresh(VAULT),
+    gateExportCoverage(VAULT),
+    gateNoDeprecated(VAULT),
+  ];
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const json = args.includes("--json");
+  const exitCode = args.includes("--exit-code");
+  const results = runGates();
+
+  if (json) {
+    console.log(JSON.stringify({ gates: results }, null, 2));
+  } else {
+    console.log("Memory-loop freshness gates");
+    for (const r of results) {
+      const mark = r.status === "PASS" ? "PASS" : r.status === "WARN" ? "WARN" : "FAIL";
+      console.log(`  [${mark}] ${r.gate} — ${r.detail}`);
+    }
+  }
+
+  const anyFail = results.some((r) => r.status === "FAIL");
+  if (exitCode && anyFail) process.exit(1);
+  process.exit(0);
+}
+
+if (require.main === module) {
+  main();
+} else {
+  module.exports = { runGates, gateDailyLog, gateFlushLog, gateExportFresh, gateExportCoverage, gateNoDeprecated, qualiaHome, vaultRoot };
+}

package/bin/runtime-manifest.js

@@ -43,6 +43,7 @@ const RUNTIME_BIN_SCRIPTS = [
   { file: "learning-candidates.js", label: "learning-candidates.js (scan recent commits + daily-log for patterns worth promoting)" },
   { file: "status-snapshot.js", label: "status-snapshot.js (portable operator snapshot — install + project + work + ERP + memory)" },
   { file: "security-scan.js", label: "security-scan.js (static security scanner for agent config — secrets, permissions, hook hygiene)" },
+  { file: "qualia-doctor.js", label: "qualia-doctor.js (memory-loop freshness gates for /qualia-doctor)" },
 ];
 
 function binFiles() {

package/guide.md

@@ -3,7 +3,7 @@
 > Follow the road. Type the commands. The framework handles the rest.
 > `--auto` chains the whole road end-to-end with only two human checkpoints per project.
 
-Surface: **25 active skills**. Use `/qualia-fix` for broken behavior, `/qualia-feature` for new single-feature work, `/qualia-scope` in PROJECT MODE for kickoff capture, `/qualia-polish --loop` for the autonomous visual loop, and `/qualia-polish --vibe` for fast layout-preserving aesthetic pivots.
+Surface: **28 active skills** (`skills/` is the source of truth — run `qualia-framework doctor` for the live list). Use `/qualia-fix` for broken behavior, `/qualia-feature` for new single-feature work, `/qualia-scope` in PROJECT MODE for kickoff capture, `/qualia-polish --loop` for the autonomous visual loop, and `/qualia-polish --vibe` for fast layout-preserving aesthetic pivots.
 
 For the identity statement see [`SOUL.md`](./SOUL.md). For every skill flag see [`FLAGS.md`](./FLAGS.md). When something breaks see [`TROUBLESHOOTING.md`](./TROUBLESHOOTING.md). For release history see [`CHANGELOG.md`](./CHANGELOG.md).
 
@@ -73,6 +73,11 @@ Append `--auto` to `/qualia-new` and the framework chains every step:
 | Road view | `/qualia-road` | View and navigate journey/milestone/phase status |
 | Lost — need next command | `/qualia` | Mechanical state-driven router |
 | Confused — need to understand the situation | `/qualia-idk` | Three-scan diagnostic + paste-ready command sequence |
+| Post-launch change | `/qualia-update` | Ship one update to a LAUNCHED project (lean plan → build → verify → ship, no milestone machinery) |
+| Security scan | `/qualia-secure` | Scan agent config (CLAUDE.md / settings / hooks / MCP) for injection, leaked secrets, unscoped perms |
+| AI-feature gate | `/qualia-eval` | Evaluate an AI feature (chat / RAG / voice / agent) against a layered eval suite and gate on the result |
+| Recall prior knowledge | `/qualia-recall` | OWNER-only — recall curated lessons from the knowledge layer + qualia-memory vault |
+| Health check | `/qualia-doctor` | Framework health — install, project state, contracts, hooks, memory, ERP queue + safe repair suggestions |
 
 ## Full Journey Hierarchy
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualia-framework",
-  "version": "7.2.0",
+  "version": "7.2.1",
   "description": "Claude Code and Codex workflow framework by Qualia Solutions. Plan, build, verify, ship.",
   "bin": {
     "qualia-framework": "./bin/cli.js"

package/rules/infrastructure.md

@@ -46,8 +46,10 @@ Standard services across all Qualia projects. Use these unless the project expli
 - `gh` — GitHub CLI (PRs, issues, repos)
 
 ## GitHub Organizations
-- **QualiasolutionsCY** — primary org for all Qualia Solutions projects
-- **SakaniQualia** — org for Sakani-related projects (real estate platform)
+> Canonical slugs (verified via `gh repo list`). This list is the single source of truth — other docs reference it, they do not restate it.
+- **`Qualiasolutions`** — the home of the four core Qualia systems (`qualia-framework`, `qualia-memory`, `qualia-erp`, `qualiafinal`). Default target for internal/system repos.
+- **`QualiaSolutionsCY`** — org for client/delivery projects (e.g. USD-Academy, innrvo). Default target for new client work.
+- **`SakaniQualia`** — org for Sakani-related projects (real estate platform).
 - All repos are private by default
 - Main integration: feature branches integrate to `main` at **`/qualia-ship`** (ship is the single merge point — it fast-forwards the branch into `main`, deploys from `main`, and deletes the branch). Pushes to `main` are **allowed and recorded** by `branch-guard` (per-employee tally → ERP) — accountability, not a hard block. `/qualia-report` sweeps for branches with unshipped commits + stale PRs at clock-out so nothing lingers. Keep GitHub branch protection on `main` OFF (or with the team allowed to push) for this model; if you re-enable required reviews, switch ship to an auto-merged PR instead.
 

package/skills/qualia-doctor/SKILL.md

@@ -92,6 +92,29 @@ node ${QUALIA_BIN}/knowledge.js list
 
 Healthy memory has at least `index.md`, `agents.md`, and a writable `daily-log/` directory. Missing curated memory is not fatal, but missing installed memory files means reinstall.
 
+### 5a. Memory-loop freshness gates
+
+The memory loop (capture → promote/flush → ingest ERP → export team wiki) can silently freeze — the audit found capture stale for 23 days with zero monitoring. Run the freshness gates:
+
+```bash
+node ${QUALIA_BIN}/qualia-doctor.js
+```
+
+It prints PASS / WARN / FAIL with the offending detail for five gates:
+
+1. **daily-log freshness** — newest `knowledge/daily-log/*.md` ≤ 2 days old (capture is alive).
+2. **flush last-run** — `.qualia-flush.log` last event ≤ 8 days ago (the nightly flush is scheduled and running).
+3. **team-export freshness** — `${QUALIA_MEMORY:-~/qualia-memory}/wiki/_export` rebuilt ≤ 2 days ago (export is scheduled and running).
+4. **export concept coverage** — `_export` concept count == the vault source concept set (`wiki/sessions/concepts/` + `wiki/concepts/`); a mismatch means the export is stale or partial.
+5. **no deprecated in export** — zero `tags: deprecated` files in `_export` (deprecated rows must not leak into the published team snapshot).
+
+Any **FAIL** means a leg of the loop stopped. Repair routing:
+- daily-log FAIL → capture (Stop hook) not firing → reinstall to re-wire the `Stop` hook.
+- flush / export FAIL → the nightly `qualia-loop.timer` is not running → `systemctl --user status qualia-loop.timer`, or reinstall (`npx qualia-framework@latest install`) to re-install the timer.
+- coverage / deprecated FAIL → run the vault export manually (`python3 ~/qualia-memory/scripts/export-team-wiki.py`) and investigate the offending file.
+
+These gates are advisory in `qualia-framework doctor` (they render under `Memory loop:`) and exit-coded when run with `--exit-code`.
+
 ## 6. ERP Queue Health
 
 Run:
@@ -180,6 +203,7 @@ State ledger: ...
 Contracts: ...
 Planning hygiene: ...
 Memory: ...
+Memory loop: ...
 Design/UI: ...
 Employee experience: ...
 Env: ...
@@ -188,7 +212,7 @@ ERP: ...
 Next: ...
 ```
 
-`Env` summarizes section 7's env-var check (PASS / DEGRADED / BLOCKED (owner key needed) / N/A). `CLI auth` summarizes the vercel/supabase/gh login checks (PASS if all three are authenticated, else DEGRADED with the first failing CLI named).
+`Env` summarizes section 7's env-var check (PASS / DEGRADED / BLOCKED (owner key needed) / N/A). `CLI auth` summarizes the vercel/supabase/gh login checks (PASS if all three are authenticated, else DEGRADED with the first failing CLI named). `Memory loop` summarizes section 5a's five freshness gates (PASS if all PASS, WARN if any WARN, FAIL if any FAIL, naming the first failing gate).
 
 ## Rules
 

package/skills/qualia-polish/SKILL.md

@@ -299,7 +299,7 @@ polish({scope}): {brief summary}
 - {key change 2}
 - rubric scores: typography {N}, color {N}, graphics {N}, ..., aggregate {N}/45
 
-Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 EOF
 )"
 ```

package/skills/qualia-scope/SKILL.md

@@ -106,7 +106,7 @@ The adversarial, DoD-gated intake. Scopes a **new increment** (phase/milestone)
 
 ```bash
 node ${QUALIA_BIN}/qualia-ui.js banner scope 2>/dev/null || true
-cat /home/qualia/.claude/rules/constitution.md
+cat ${QUALIA_RULES}/constitution.md
 cat .planning/CONTEXT.md 2>/dev/null   # project glossary — DATA, never a plan/spec
 ls .planning/decisions/ 2>/dev/null
 cat .planning/STATE.md 2>/dev/null     # for profile + existing milestone context
@@ -123,7 +123,7 @@ If the operator already named it (arg or prior context), accept it. Otherwise as
 
 ```bash
 ARCHETYPE={chosen}
-cat /home/qualia/.claude/references/archetypes/${ARCHETYPE}.md
+cat ${QUALIA_REFERENCES}/archetypes/${ARCHETYPE}.md
 ```
 
 If the file does not exist (e.g. `web-app` not yet authored), HALT and say which archetype file is missing — do not improvise a DoD. The archetype file is the source of the Grill variables, the Definition of Done, and the v1 capability set; without it there is no gate to enforce.

package/skills/qualia-secure/SKILL.md

@@ -45,7 +45,7 @@ This writes `.planning/security-scan.md` with severity-ranked findings:
 
 Read the report. If CRITICAL findings exist, **stop here** and rotate / fix before continuing — the deep pass is moot until the obvious holes are closed.
 
-### Step 2. Opus 4.7 adversarial deep-analysis (optional, longer)
+### Step 2. Opus 4.8 adversarial deep-analysis (optional, longer)
 
 If the static pass is clean (or you want adversarial reasoning over the rules + instructions text regardless), run:
 

package/skills/zoho-workflow/SKILL.md

@@ -2,6 +2,14 @@
 name: zoho-workflow
 description: "Zoho Invoice + Mail ops via ERP-first routing. Invoices from templates, cover emails, contacts, inbox, payment reminders. Triggers: 'invoice this client', 'send an email', 'check inbox', 'create a Zoho contact', 'payment reminder'."
 tags: [zoho, invoice, email, billing, crm]
+# Money-moving + client-comms skill — least-privilege scope. ERP-first routing
+# (mcp__qualia-erp__*) is preferred; raw Zoho Books/Mail are the fallback surface.
+allowed-tools:
+  - Bash
+  - Read
+  - mcp__qualia-erp__*
+  - mcp__claude_ai_Zoho_Books__*
+  - mcp__claude_ai_Mail__*
 ---
 
 # Zoho Workflow

package/tests/fixtures/r6-golden-fail-panel.json

@@ -0,0 +1,23 @@
+{
+  "_comment": "R6 golden verifier fixture — a SEEDED STUB the verifier MUST score FAIL. This proves the deterministic verifier (bin/verify-panel.js) cannot default-pass. The fixture contains (a) a surviving CRITICAL finding voted real by majority, and (b) an unvoted HIGH (INSUFFICIENT-EVIDENCE-style: unverified != disproven). Both survive the skeptic round, so the verdict MUST be FAIL (exit 1). If verify-panel ever regresses to a default-3/PASS, r6-golden.test.sh turns red.",
+  "phase": 99,
+  "lenses": ["security", "correctness"],
+  "findings": [
+    {
+      "lens": "security",
+      "file": "lib/supabase/client.ts",
+      "line": 12,
+      "severity": "CRITICAL",
+      "title": "service_role key imported into a client component (auth bypass)",
+      "votes": { "real": 3, "notReal": 0 }
+    },
+    {
+      "lens": "correctness",
+      "file": "app/api/checkout/route.ts",
+      "line": 47,
+      "severity": "HIGH",
+      "title": "INSUFFICIENT EVIDENCE — payment idempotency unverified, no test backs the happy path",
+      "votes": { "real": 0, "notReal": 0 }
+    }
+  ]
+}

package/tests/lib.test.sh

@@ -532,7 +532,7 @@ TMP=$(mktmp)
 mkdir -p "$TMP/home/.claude/bin" "$TMP/home/.claude/hooks" "$TMP/home/.claude/knowledge/daily-log" "$TMP/home/.claude/qualia-design" "$TMP/home/.claude/agents" "$TMP/home/.claude/qualia-templates" "$TMP/project"
 echo '{"installed_by":"Test","role":"OWNER","version":"6.3.0","erp":{"enabled":false}}' > "$TMP/home/.claude/.qualia-config.json"
 touch "$TMP/home/.claude/CLAUDE.md" "$TMP/home/.claude/settings.json"
-for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js recall.js vault-access.js repo-map.js design-tokens.js batch-plan.js state-ledger.js plan-contract.js contract-runner.js agent-status.js analyze-gate.js verify-panel.js wave-plan.js eval-runner.js branch-hygiene.js last-report.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs dep-verify.mjs erp-retry.js erp-event.js work-packet.js report-payload.js project-snapshot.js project-sync.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
+for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js recall.js vault-access.js repo-map.js design-tokens.js batch-plan.js state-ledger.js plan-contract.js contract-runner.js agent-status.js analyze-gate.js verify-panel.js wave-plan.js eval-runner.js branch-hygiene.js last-report.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs dep-verify.mjs erp-retry.js erp-event.js work-packet.js report-payload.js project-snapshot.js project-sync.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js qualia-doctor.js auto-report.js; do
   touch "$TMP/home/.claude/bin/$f"
 done
 for h in session-start.js auto-update.js branch-guard.js pre-push.js pre-deploy-gate.js migration-guard.js git-guardrails.js stop-session-log.js fawzi-approval-guard.js vercel-account-guard.js env-empty-guard.js supabase-destructive-guard.js secret-guard.js; do
@@ -647,7 +647,7 @@ TMP=$(mktmp)
 mkdir -p "$TMP/.claude/bin" "$TMP/.claude/hooks" "$TMP/.claude/knowledge/daily-log" "$TMP/.claude/qualia-design" "$TMP/.claude/agents" "$TMP/.claude/qualia-templates" "$TMP/project/.planning"
 echo '{"installed_by":"Test","role":"OWNER","erp":{"enabled":false}}' > "$TMP/.claude/.qualia-config.json"
 touch "$TMP/.claude/CLAUDE.md" "$TMP/.claude/settings.json"
-for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js recall.js vault-access.js repo-map.js design-tokens.js batch-plan.js state-ledger.js plan-contract.js contract-runner.js agent-status.js analyze-gate.js verify-panel.js wave-plan.js eval-runner.js branch-hygiene.js last-report.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs dep-verify.mjs erp-retry.js erp-event.js work-packet.js report-payload.js project-snapshot.js project-sync.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
+for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js recall.js vault-access.js repo-map.js design-tokens.js batch-plan.js state-ledger.js plan-contract.js contract-runner.js agent-status.js analyze-gate.js verify-panel.js wave-plan.js eval-runner.js branch-hygiene.js last-report.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs dep-verify.mjs erp-retry.js erp-event.js work-packet.js report-payload.js project-snapshot.js project-sync.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js qualia-doctor.js auto-report.js; do
   touch "$TMP/.claude/bin/$f"
 done
 for h in session-start.js auto-update.js branch-guard.js pre-push.js pre-deploy-gate.js migration-guard.js git-guardrails.js stop-session-log.js fawzi-approval-guard.js vercel-account-guard.js env-empty-guard.js supabase-destructive-guard.js secret-guard.js; do

package/tests/memory-loop.test.sh

@@ -0,0 +1,136 @@
+#!/bin/bash
+# memory-loop.test.sh — the one-loop contract: knowledge-flush vault dual-write
+# (ITEM 13) + qualia-doctor freshness gates (ITEM 14b).
+#
+# Pure-function tests, no agent CLI, no live vault. Each builds a temp QUALIA_HOME
+# and QUALIA_MEMORY so the loop logic is exercised hermetically.
+#
+# Run: bash tests/memory-loop.test.sh
+
+PASS=0
+FAIL=0
+DIR="$(cd "$(dirname "$0")" && pwd)"
+BIN_DIR="$(cd "$DIR/../bin" && pwd)"
+NODE="${NODE:-node}"
+FLUSH="$BIN_DIR/knowledge-flush.js"
+DOCTOR="$BIN_DIR/qualia-doctor.js"
+
+assert_contains() {
+  local name="$1" hay="$2" needle="$3"
+  if echo "$hay" | grep -qF "$needle"; then echo "  ✓ $name"; PASS=$((PASS+1));
+  else echo "  ✗ $name (missing '$needle' in: $hay)"; FAIL=$((FAIL+1)); fi
+}
+assert_ok() {
+  local name="$1" rc="$2"
+  if [ "$rc" -eq 0 ]; then echo "  ✓ $name"; PASS=$((PASS+1));
+  else echo "  ✗ $name (rc=$rc)"; FAIL=$((FAIL+1)); fi
+}
+
+echo "memory-loop.test.sh — dual-write + freshness gates"
+echo ""
+
+# --- syntax ---
+$NODE -c "$FLUSH" 2>/dev/null && { echo "  ✓ knowledge-flush.js syntax"; PASS=$((PASS+1)); } || { echo "  ✗ knowledge-flush.js syntax"; FAIL=$((FAIL+1)); }
+$NODE -c "$DOCTOR" 2>/dev/null && { echo "  ✓ qualia-doctor.js syntax"; PASS=$((PASS+1)); } || { echo "  ✗ qualia-doctor.js syntax"; FAIL=$((FAIL+1)); }
+
+# ── ITEM 13: dualWriteVault mirrors curated concepts into the vault ──────────
+TMP=$(mktemp -d); mkdir -p "$TMP/vault"
+OUT=$(QUALIA_HOME="$TMP/home" QUALIA_MEMORY="$TMP/vault" $NODE -e '
+const fs=require("fs"),path=require("path");
+const kh=process.env.QUALIA_HOME;
+fs.mkdirSync(path.join(kh,"knowledge","concepts"),{recursive:true});
+fs.writeFileSync(path.join(kh,"knowledge","learned-patterns.md"),"# Patterns\n- always RLS\n");
+fs.writeFileSync(path.join(kh,"knowledge","concepts","voice-call-state.md"),"# Voice\nstate\n");
+const m=require("'"$FLUSH"'");
+const r1=m.dualWriteVault();
+const files1=fs.readdirSync(m.VAULT_CONCEPTS_DIR).sort();
+const r2=m.dualWriteVault();
+const files2=fs.readdirSync(m.VAULT_CONCEPTS_DIR).sort();
+console.log("detail="+r1.event_detail);
+console.log("written="+r1.written);
+console.log("idempotent="+(files1.length===files2.length && files1.join(",")===files2.join(",")));
+console.log("files="+files2.join(","));
+const sample=fs.readFileSync(path.join(m.VAULT_CONCEPTS_DIR,files2[0]),"utf8");
+console.log("hasFrontmatter="+sample.includes("source: qualia-framework/knowledge-flush"));
+' 2>&1)
+assert_contains "dual-write mirrors concepts (vault-mirrored)" "$OUT" "detail=vault-mirrored"
+assert_contains "dual-write wrote 2 files" "$OUT" "written=2"
+assert_contains "dual-write is idempotent" "$OUT" "idempotent=true"
+assert_contains "dual-write emits a concept-prefixed subdir file" "$OUT" "concept-voice-call-state.md"
+assert_contains "dual-write emits curated top-level file" "$OUT" "learned-patterns.md"
+assert_contains "dual-write stamps provenance front-matter" "$OUT" "hasFrontmatter=true"
+rm -rf "$TMP"
+
+# --- vault absent → graceful skip, no crash ---
+TMP=$(mktemp -d)
+OUT=$(QUALIA_HOME="$TMP/home" QUALIA_MEMORY="$TMP/does-not-exist" $NODE -e '
+const fs=require("fs"),path=require("path");
+const kh=process.env.QUALIA_HOME;
+fs.mkdirSync(path.join(kh,"knowledge"),{recursive:true});
+fs.writeFileSync(path.join(kh,"knowledge","learned-patterns.md"),"# P\n- x\n");
+const m=require("'"$FLUSH"'");
+const r=m.dualWriteVault();
+console.log("detail="+r.event_detail+" written="+r.written);
+' 2>&1)
+assert_ok "vault-absent does not crash" $?
+assert_contains "vault-absent is skipped gracefully" "$OUT" "detail=vault-absent"
+rm -rf "$TMP"
+
+# ── ITEM 14b: freshness gates ───────────────────────────────────────────────
+# Healthy loop: fresh daily-log, recent flush log, fresh export with matching
+# coverage and no deprecated rows → all PASS.
+TMP=$(mktemp -d)
+KH="$TMP/home"; VAULT="$TMP/vault"
+mkdir -p "$KH/knowledge/daily-log"
+TODAY=$(date +%Y-%m-%d)
+echo "# log" > "$KH/knowledge/daily-log/$TODAY.md"
+printf '{"timestamp":"%s","event":"ok"}\n' "$(date -Iseconds)" > "$KH/.qualia-flush.log"
+mkdir -p "$VAULT/wiki/sessions/concepts" "$VAULT/wiki/_export/concepts"
+echo "# c1" > "$VAULT/wiki/sessions/concepts/c1.md"
+echo "# c1 exported" > "$VAULT/wiki/_export/concepts/c1.md"
+OUT=$(QUALIA_HOME="$KH" QUALIA_MEMORY="$VAULT" $NODE "$DOCTOR" --json 2>&1)
+assert_contains "healthy daily-log → PASS" "$OUT" '"gate": "daily-log freshness"'
+HEALTHY_FAILS=$(echo "$OUT" | grep -c '"status": "FAIL"')
+if [ "$HEALTHY_FAILS" -eq 0 ]; then echo "  ✓ healthy loop has zero FAIL gates"; PASS=$((PASS+1)); else echo "  ✗ healthy loop has $HEALTHY_FAILS FAIL gate(s): $OUT"; FAIL=$((FAIL+1)); fi
+rm -rf "$TMP"
+
+# Broken loop: no daily-log, no flush log, no export → FAILs + --exit-code 1.
+TMP=$(mktemp -d)
+mkdir -p "$TMP/home/knowledge" "$TMP/vault"
+OUT=$(QUALIA_HOME="$TMP/home" QUALIA_MEMORY="$TMP/vault" $NODE "$DOCTOR" --json 2>&1)
+assert_contains "broken loop flags stale daily-log" "$OUT" 'no daily-log entries'
+assert_contains "broken loop flags missing flush log" "$OUT" 'flush never ran'
+assert_contains "broken loop flags missing export" "$OUT" 'export never ran'
+QUALIA_HOME="$TMP/home" QUALIA_MEMORY="$TMP/vault" $NODE "$DOCTOR" --exit-code >/dev/null 2>&1
+RC=$?
+if [ "$RC" -eq 1 ]; then echo "  ✓ broken loop --exit-code returns 1"; PASS=$((PASS+1)); else echo "  ✗ broken loop --exit-code returned $RC"; FAIL=$((FAIL+1)); fi
+rm -rf "$TMP"
+
+# Coverage gate: source has 2 concepts, export has 1 → FAIL (stale/partial).
+TMP=$(mktemp -d)
+KH="$TMP/home"; VAULT="$TMP/vault"
+mkdir -p "$KH/knowledge/daily-log"
+echo "# log" > "$KH/knowledge/daily-log/$(date +%Y-%m-%d).md"
+printf '{"timestamp":"%s","event":"ok"}\n' "$(date -Iseconds)" > "$KH/.qualia-flush.log"
+mkdir -p "$VAULT/wiki/sessions/concepts" "$VAULT/wiki/_export/concepts"
+echo "# a" > "$VAULT/wiki/sessions/concepts/a.md"
+echo "# b" > "$VAULT/wiki/sessions/concepts/b.md"
+echo "# a" > "$VAULT/wiki/_export/concepts/a.md"
+OUT=$(QUALIA_HOME="$KH" QUALIA_MEMORY="$VAULT" $NODE "$DOCTOR" --json 2>&1)
+assert_contains "partial export → coverage FAIL" "$OUT" 'export is stale or partial'
+rm -rf "$TMP"
+
+# Deprecated gate: an export file tagged deprecated → FAIL.
+TMP=$(mktemp -d)
+KH="$TMP/home"; VAULT="$TMP/vault"
+mkdir -p "$KH/knowledge/daily-log" "$VAULT/wiki/_export"
+echo "# log" > "$KH/knowledge/daily-log/$(date +%Y-%m-%d).md"
+printf '{"timestamp":"%s","event":"ok"}\n' "$(date -Iseconds)" > "$KH/.qualia-flush.log"
+printf -- '---\ntags: [deprecated, old]\n---\n# stale\n' > "$VAULT/wiki/_export/old.md"
+OUT=$(QUALIA_HOME="$KH" QUALIA_MEMORY="$VAULT" $NODE "$DOCTOR" --json 2>&1)
+assert_contains "deprecated row in export → FAIL" "$OUT" 'deprecated file(s)'
+rm -rf "$TMP"
+
+echo ""
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/r6-golden.test.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+# r6-golden.test.sh — R6 golden verifier fixture.
+#
+# Proves the deterministic verifier (bin/verify-panel.js) CANNOT default-pass.
+# The fixture tests/fixtures/r6-golden-fail-panel.json is a SEEDED STUB
+# engineered so the only correct verdict is FAIL: it carries a surviving
+# CRITICAL (voted real 3-0) plus an unvoted HIGH (INSUFFICIENT-EVIDENCE style —
+# unverified is not disproven, so it survives the skeptic round).
+#
+# If verify-panel ever regresses to scoring 3/PASS on input it cannot fully
+# clear, this turns red. It is the framework gating its OWN verifier the way it
+# gates user projects (the missing R6 piece from the v7 audit, F3).
+#
+# CONSTRAINT: this test ONLY adds the fixture wiring. It does not touch the
+# anti-default-3 logic, the gates, or Codex parity — it observes them.
+#
+# Run: bash tests/r6-golden.test.sh
+
+PASS=0
+FAIL=0
+DIR="$(cd "$(dirname "$0")" && pwd)"
+BIN_DIR="$(cd "$DIR/../bin" && pwd)"
+NODE="${NODE:-node}"
+VP="$BIN_DIR/verify-panel.js"
+FIXTURE="$DIR/fixtures/r6-golden-fail-panel.json"
+
+assert_exit() {
+  local name="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then echo "  ✓ $name"; PASS=$((PASS+1));
+  else echo "  ✗ $name (expected exit $expected, got $actual)"; FAIL=$((FAIL+1)); fi
+}
+assert_contains() {
+  local name="$1" hay="$2" needle="$3"
+  if echo "$hay" | grep -qF "$needle"; then echo "  ✓ $name"; PASS=$((PASS+1));
+  else echo "  ✗ $name (missing '$needle')"; FAIL=$((FAIL+1)); fi
+}
+assert_absent() {
+  local name="$1" hay="$2" needle="$3"
+  if echo "$hay" | grep -qF "$needle"; then echo "  ✗ $name (found forbidden '$needle')"; FAIL=$((FAIL+1));
+  else echo "  ✓ $name"; PASS=$((PASS+1)); fi
+}
+
+echo "r6-golden.test.sh — verifier cannot default-pass"
+echo ""
+
+# Fixture must exist (precondition).
+[ -f "$FIXTURE" ] && { echo "  ✓ golden fixture present"; PASS=$((PASS+1)); } \
+  || { echo "  ✗ golden fixture missing: $FIXTURE"; FAIL=$((FAIL+1)); }
+
+# The golden stub MUST FAIL (exit 1). This is the anti-default-pass proof.
+$NODE "$VP" "$FIXTURE" >/dev/null 2>&1
+assert_exit "golden stub → FAIL (exit 1), not a default PASS" 1 $?
+
+OUT=$($NODE "$VP" "$FIXTURE" --json 2>&1)
+assert_contains "verdict is FAIL" "$OUT" '"verdict": "FAIL"'
+assert_absent  "verdict is NOT PASS" "$OUT" '"verdict": "PASS"'
+# ok must be false — the contract kernel treats this as a phase fail.
+assert_contains "ok:false (phase does not ship)" "$OUT" '"ok": false'
+# The surviving CRITICAL is the load-bearing reason it cannot pass.
+assert_contains "surviving CRITICAL preserved" "$OUT" '"severity": "CRITICAL"'
+# The unvoted HIGH survives (unverified != disproven).
+assert_contains "unvoted HIGH survives the skeptic round" "$OUT" '"severity": "HIGH"'
+
+echo ""
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/refs.test.sh

@@ -184,6 +184,39 @@ for pattern in "${forbidden_surface_patterns[@]}"; do
   fi
 done
 
+# ── Count-drift guard ─────────────────────────────────────────────────────────
+# The orientation docs (README.md / guide.md) hardcode skill/hook/rule counts.
+# These rot every time a skill/hook/rule is added. Assert each stated count
+# matches the live directory listing so the numbers can't silently drift again.
+#   skills/  = directory entries
+#   hooks/   = *.js files
+#   rules/   = *.md files
+SKILL_COUNT=$(find "$FRAMEWORK_ROOT/skills" -mindepth 1 -maxdepth 1 -type d | wc -l | tr -d ' ')
+HOOK_COUNT=$(find "$FRAMEWORK_ROOT/hooks" -maxdepth 1 -name '*.js' | wc -l | tr -d ' ')
+RULE_COUNT=$(find "$FRAMEWORK_ROOT/rules" -maxdepth 1 -name '*.md' | wc -l | tr -d ' ')
+
+# assert_count <label> <expected-actual> <file> <regex-with-NUM-placeholder>
+# Fails if the file contains a "<N> <label>" claim where N != actual.
+assert_count() {
+  local label="$1" actual="$2" file="$3" pattern="$4"
+  local bad
+  # Find every "<digits> <label>" mention; flag any whose number != actual.
+  # grep -oE (no -n) yields just the matched "<N> label" substrings; pull the
+  # leading integer from each and compare. (No line-number prefix to confuse it.)
+  bad=$(grep -oE "$pattern" "$file" 2>/dev/null | grep -oE '^[0-9]+' | grep -vx "$actual" || true)
+  if [ -n "$bad" ]; then
+    fail_case "count drift: $label in $(basename "$file")" \
+      "stated $(echo "$bad" | paste -sd, -) but actual is $actual — regenerate from the directory listing"
+  else
+    pass "$(basename "$file") $label count = $actual (matches $label/)"
+  fi
+}
+
+assert_count "skills" "$SKILL_COUNT" "$FRAMEWORK_ROOT/README.md" '[0-9]+ (installed )?skills'
+assert_count "hooks"  "$HOOK_COUNT"  "$FRAMEWORK_ROOT/README.md" '[0-9]+ hooks'
+assert_count "rules"  "$RULE_COUNT"  "$FRAMEWORK_ROOT/README.md" '[0-9]+ (installed )?rules'
+assert_count "skills" "$SKILL_COUNT" "$FRAMEWORK_ROOT/guide.md"  '[0-9]+ active skills'
+
 echo ""
 echo "Results: $PASS passed, $FAIL failed"
 

package/tests/run-all.sh

@@ -35,6 +35,8 @@ SUITES=(
   "repo-map"
   "design-tokens"
   "batch-plan"
+  "r6-golden"
+  "memory-loop"
   "journey-spine"
 )